Threat LevelCRITICAL72/1002 rule types across 2 attack categories

13 incidents · 2 rule types · active attack detected · 13 attacks/day · last seen 16d ago

PTR	107-172-168-104-host.colocrossing.com
Org / ASN	RackNerd LLC
Country	🇺🇸 United States
City	Buffalo, New York
Timezone	America/New_York

Attack Analysis

🇺🇸 United States · West Seneca · 36352 · Racknerd LLC

Suricata IDS Alert

Suricata intrusion detection flagged this IP for malicious network behaviour — including port scanning, exploit attempts, botnet activity, or known attack signatures. The specific signature is shown in the report list below.

IDS: SSH Port Scan

Suricata detected automated SSH port scanning from this IP. SSH scanners map targets before launching credential brute-force attacks. This is the reconnaissance phase of a larger attack campaign.

Reports (13)

Date	Severity	Description
16 Jul 2026 - 07:42	medium	IDS: Suricata alert — Honeypot: probe to closed SSH port 22
16 Jul 2026 - 07:42	high	IDS: SSH port scan — ET SCAN Potential SSH Scan
16 Jul 2026 - 05:52	medium	IDS: Suricata alert — Honeypot: probe to closed SSH port 22
16 Jul 2026 - 05:52	high	IDS: SSH port scan — ET SCAN Potential SSH Scan
16 Jul 2026 - 04:03	high	IDS: SSH port scan — ET SCAN Potential SSH Scan
16 Jul 2026 - 04:03	medium	IDS: Suricata alert — Honeypot: probe to closed SSH port 22
16 Jul 2026 - 02:15	high	IDS: SSH port scan — ET SCAN Potential SSH Scan
16 Jul 2026 - 02:15	medium	IDS: Suricata alert — Honeypot: probe to closed SSH port 22
16 Jul 2026 - 00:28	high	IDS: SSH port scan — ET SCAN Potential SSH Scan
16 Jul 2026 - 00:28	medium	IDS: Suricata alert — Honeypot: probe to closed SSH port 22
15 Jul 2026 - 22:40	high	IDS: SSH port scan — ET SCAN Potential SSH Scan
15 Jul 2026 - 22:40	medium	IDS: Suricata alert — Honeypot: probe to closed SSH port 22
15 Jul 2026 - 20:46	high	IDS: Suricata alert — Honeypot: probe to closed SSH port 22

Report for IP: 107.172.168.104

Attack Analysis

Reports (13)