Report for IP: 141.94.28.181

Threat LevelCRITICAL72/1001 rule type
11 incidents · 11 attacks/day · last seen 7d ago
PTR ns31417671.ip-141-94-28.eu
Org / ASN OVH
Country 🇫🇷 France
City Wattrelos, Hauts-de-France
Timezone Europe/Paris

Attack Analysis

Port 22 Honeypot Probe
This IP connected to a fake SSH honeypot — a port 22 listener that is not a real SSH server. This is an automated scanner fingerprinting targets before launching a brute-force campaign. Legitimate systems never probe port 22 without a specific reason; this activity is virtually 100% malicious.

Reports (11)

Date Severity Description
22 Sep 2026 - 22:13 high IDS: Honeypot probe — port 22 listener that is not a real SSH server — Honeypot: probe to closed SSH port 22
22 Sep 2026 - 22:01 high IDS: Honeypot probe — port 22 listener that is not a real SSH server — Honeypot: probe to closed SSH port 22
22 Sep 2026 - 21:38 high IDS: Honeypot probe — port 22 listener that is not a real SSH server — Honeypot: probe to closed SSH port 22
22 Sep 2026 - 21:34 high IDS: Honeypot probe — port 22 listener that is not a real SSH server — Honeypot: probe to closed SSH port 22
22 Sep 2026 - 21:28 high IDS: Honeypot probe — port 22 listener that is not a real SSH server — Honeypot: probe to closed SSH port 22
22 Sep 2026 - 21:11 high IDS: Honeypot probe — port 22 listener that is not a real SSH server — Honeypot: probe to closed SSH port 22
22 Sep 2026 - 21:03 high IDS: Honeypot probe — port 22 listener that is not a real SSH server — Honeypot: probe to closed SSH port 22
22 Sep 2026 - 20:55 high IDS: Honeypot probe — port 22 listener that is not a real SSH server — Honeypot: probe to closed SSH port 22
22 Sep 2026 - 20:55 high IDS: Honeypot probe — port 22 listener that is not a real SSH server
22 Sep 2026 - 20:53 high IDS: Honeypot probe — port 22 listener that is not a real SSH server — Honeypot: probe to closed SSH port 22
22 Sep 2026 - 20:43 high IDS: Honeypot probe — port 22 listener that is not a real SSH server
Part of EagleEye Intelligence