Threat LevelCRITICAL72/1002 rule types across 2 attack categories

8 incidents on record · 2 rule types · active attack detected · last seen 27d ago

PTR	v2202608396801498475.megasrv.de
Org / ASN	NETCUP-KVM
Country	🇩🇪 Germany
City	Nuremberg, Bavaria
Timezone	Europe/Berlin

Attack Analysis

Port 22 Honeypot Probe

This IP connected to a fake SSH honeypot — a port 22 listener that is not a real SSH server. This is an automated scanner fingerprinting targets before launching a brute-force campaign. Legitimate systems never probe port 22 without a specific reason; this activity is virtually 100% malicious.

Suricata IDS Alert

Suricata intrusion detection flagged this IP for malicious network behaviour — including port scanning, exploit attempts, botnet activity, or known attack signatures. The specific signature is shown in the report list below.

Reports (8)

Date	Severity	Description
2 Sep 2026 - 23:24	medium	IDS: Suricata alert — Honeypot: probe to closed SSH port 22
2 Sep 2026 - 22:22	medium	IDS: Suricata alert — Honeypot: probe to closed SSH port 22
2 Sep 2026 - 14:04	medium	IDS: Suricata alert — Honeypot: probe to closed SSH port 22
2 Sep 2026 - 08:13	medium	IDS: Suricata alert — Honeypot: probe to closed SSH port 22
2 Sep 2026 - 04:40	high	IDS: Suricata alert
2 Sep 2026 - 04:06	high	IDS: Suricata alert
2 Sep 2026 - 04:06	medium	IDS: Suricata alert — Honeypot: probe to closed SSH port 22
2 Sep 2026 - 00:34	high	IDS: Suricata alert — Honeypot: probe to closed SSH port 22

Report for IP: 159.195.225.196

Attack Analysis

Reports (8)