Threat LevelCRITICAL72/1003 rule types across 3 attack categories

4 incidents on record · 3 rule types · active attack detected · last seen 20d ago

PTR	v2202606368806470727.luckysrv.de
Org / ASN	NETCUP-KVM
Country	🇩🇪 Germany
City	Karlsruhe, Baden-Wurttemberg
Timezone	Europe/Berlin

Attack Analysis

🇩🇪 Germany · Nuremberg · 197540 · DE-NETCUP-KVM

SSH: Login Attempt — Non-Existent User

This IP attempted to authenticate via SSH using a username that does not exist on the system. This is characteristic of automated credential-stuffing attacks cycling through common username wordlists (admin, root, ubuntu, pi, etc.).

Suricata IDS Alert

Suricata intrusion detection flagged this IP for malicious network behaviour — including port scanning, exploit attempts, botnet activity, or known attack signatures. The specific signature is shown in the report list below.

IDS: SSH Port Scan

Suricata detected automated SSH port scanning from this IP. SSH scanners map targets before launching credential brute-force attacks. This is the reconnaissance phase of a larger attack campaign.

Reports (4)

Date	Severity	Description
12 Jul 2026 - 02:55	high	IDS: SSH port scan — ET SCAN Potential SSH Scan
12 Jul 2026 - 02:54	medium	IDS: Suricata alert — Honeypot: probe to closed SSH port 22
11 Jul 2026 - 12:52	medium	SSH: Login attempt using non-existent user
11 Jul 2026 - 12:51	high	SSH: Login attempt using non-existent user

Report for IP: 152.53.185.81

Attack Analysis

Reports (4)