Threat LevelCRITICAL72/1002 rule types across 2 attack categories

14 incidents · 2 rule types · persistent 12-day campaign · last seen 37d ago

PTR	123072.ip-ptr.tech
Org / ASN	Global Connectivity Solutions LLP
Country	🇦🇱 Albania
City	Elbasan, Elbasan County
Timezone	Europe/Tirane

Attack Analysis

Port 22 Honeypot Probe

This IP connected to a fake SSH honeypot — a port 22 listener that is not a real SSH server. This is an automated scanner fingerprinting targets before launching a brute-force campaign. Legitimate systems never probe port 22 without a specific reason; this activity is virtually 100% malicious.

IDS: SSH Port Scan

Suricata detected automated SSH port scanning from this IP. SSH scanners map targets before launching credential brute-force attacks. This is the reconnaissance phase of a larger attack campaign.

Reports (14)

Date	Severity	Description
23 Aug 2026 - 23:12	high	IDS: SSH port scan — ET SCAN Potential SSH Scan
23 Aug 2026 - 23:12	medium	IDS: Suricata alert — Honeypot: probe to closed SSH port 22
23 Aug 2026 - 21:50	medium	IDS: Suricata alert — Honeypot: probe to closed SSH port 22
23 Aug 2026 - 21:50	high	IDS: SSH port scan — ET SCAN Potential SSH Scan
20 Aug 2026 - 14:01	high	IDS: SSH port scan — ET SCAN Potential SSH Scan
20 Aug 2026 - 14:01	medium	IDS: Suricata alert — Honeypot: probe to closed SSH port 22
20 Aug 2026 - 13:48	medium	IDS: Suricata alert — Honeypot: probe to closed SSH port 22
11 Aug 2026 - 18:22	high	IDS: SSH port scan — ET SCAN Potential SSH Scan
11 Aug 2026 - 18:21	medium	IDS: Suricata alert — Honeypot: probe to closed SSH port 22
11 Aug 2026 - 18:15	medium	IDS: Suricata alert — Honeypot: probe to closed SSH port 22
11 Aug 2026 - 16:25	high	IDS: SSH port scan — ET SCAN Potential SSH Scan
11 Aug 2026 - 16:25	medium	IDS: Suricata alert — Honeypot: probe to closed SSH port 22
11 Aug 2026 - 16:14	medium	IDS: Suricata alert — Honeypot: probe to closed SSH port 22
11 Aug 2026 - 16:05	high	IDS: Suricata alert — Honeypot: probe to closed SSH port 22

Report for IP: 78.159.131.105

Attack Analysis

Reports (14)

Related IPs — Same /24 Block (78.159.131.0/24)