Threat LevelCRITICAL72/1003 rule types across 2 attack categories
7 incidents on record · 3 rule types · active attack detected · active over 3 days · last seen 22d ago
| PTR | N/A |
| Org / ASN | Ntweb Solucoes EM Internet Ltda ME |
| Country | 🇧🇷 Brazil |
| City | Brasília, Federal District |
| Timezone | America/Sao_Paulo |
Attack Analysis
SSH: Login Attempt — Non-Existent User
This IP attempted to authenticate via SSH using a username that does not exist on the system. This is characteristic of automated credential-stuffing attacks cycling through common username wordlists (admin, root, ubuntu, pi, etc.).
SSH: Invalid User Flood
This IP attempted SSH logins using 5 or more invalid usernames within 2 minutes — a credential-stuffing attack cycling through common account names (admin, root, ubuntu, deploy, pi). This indicates an automated tool probing for default or common accounts.
Suricata IDS Alert
Suricata intrusion detection flagged this IP for malicious network behaviour — including port scanning, exploit attempts, botnet activity, or known attack signatures. The specific signature is shown in the report list below.
Reports (7)
| Date | Severity | Description |
|---|---|---|
| 10 Jul 2026 - 11:22 | medium | IDS: Suricata alert — Honeypot: probe to closed SSH port 22 |
| 7 Jul 2026 - 22:19 | medium | SSH: Login attempt using non-existent user |
| 7 Jul 2026 - 22:13 | high | SSH: Invalid user flood — 5+ attempts in 120s |
| 7 Jul 2026 - 22:13 | medium | SSH: Login attempt using non-existent user |
| 7 Jul 2026 - 22:11 | medium | SSH: Login attempt using non-existent user |
| 7 Jul 2026 - 22:01 | medium | SSH: Login attempt using non-existent user |
| 7 Jul 2026 - 21:39 | high | SSH: Login attempt using non-existent user |
EagleEye Intelligence