Threat LevelCRITICAL74/1002 rule types across 2 attack categories

11 incidents · 2 rule types · active attack detected · persistent 42-day campaign · seen 7h ago

PTR	N/A
Org / ASN	Baykov Ilya Sergeevich
Country	🇩🇪 Germany
City	Frankfurt Am Main, Hesse
Timezone	Europe/Berlin

Attack Analysis

🇩🇪 Germany · Frankfurt · 41745 · Baykov Ilya Sergeevich

Suricata IDS Alert

Suricata intrusion detection flagged this IP for malicious network behaviour — including port scanning, exploit attempts, botnet activity, or known attack signatures. The specific signature is shown in the report list below.

IDS: SSH Port Scan

Suricata detected automated SSH port scanning from this IP. SSH scanners map targets before launching credential brute-force attacks. This is the reconnaissance phase of a larger attack campaign.

Reports (11)

Date	Severity	Description
1 Aug 2026 - 00:28	medium	IDS: Suricata alert — Honeypot: probe to closed SSH port 22
14 Jul 2026 - 00:41	medium	IDS: Suricata alert — ET COMPROMISED Known Compromised or Hostile Host Traffic group 7
13 Jul 2026 - 01:04	medium	IDS: Suricata alert — ET COMPROMISED Known Compromised or Hostile Host Traffic group 7
12 Jul 2026 - 01:10	medium	IDS: Suricata alert — ET COMPROMISED Known Compromised or Hostile Host Traffic group 7
11 Jul 2026 - 02:28	medium	IDS: Suricata alert — Honeypot: probe to closed SSH port 22
11 Jul 2026 - 02:27	high	IDS: SSH port scan — ET SCAN Potential SSH Scan
11 Jul 2026 - 02:26	high	IDS: Suricata alert — Honeypot: probe to closed SSH port 22
9 Jul 2026 - 13:37	medium	IDS: Suricata alert — ET COMPROMISED Known Compromised or Hostile Host Traffic group 7
28 Jun 2026 - 08:19	medium	IDS: Suricata alert — ET COMPROMISED Known Compromised or Hostile Host Traffic group 7
20 Jun 2026 - 03:19	medium	IDS: Suricata alert — Honeypot: probe to closed SSH port 22
20 Jun 2026 - 03:19	high	IDS: Suricata alert

Report for IP: 185.65.202.199

Attack Analysis

Reports (11)