Threat LevelHIGH52/1001 rule type

19 incidents · active attack detected · 19 attacks/day · last seen 23d ago

PTR	201-63-223-138.customer.tdatabrasil.net.br
Org / ASN	TELEF�NICA BRASIL S.A
Country	🇧🇷 Brazil
City	São Paulo, São Paulo
Timezone	America/Sao_Paulo

Attack Analysis

🇧🇷 Brazil · Sorocaba · 10429 · HEXATO TECNOLOGIA E FERRAMENTAS DE INTERNET LTDA

SSH: Login Attempt — Non-Existent User

This IP attempted to authenticate via SSH using a username that does not exist on the system. This is characteristic of automated credential-stuffing attacks cycling through common username wordlists (admin, root, ubuntu, pi, etc.).

Reports (19)

Date	Severity	Description
9 Jul 2026 - 09:13	medium	SSH: Login attempt using non-existent user
9 Jul 2026 - 09:12	medium	SSH: Login attempt using non-existent user
9 Jul 2026 - 09:04	medium	SSH: Login attempt using non-existent user
9 Jul 2026 - 09:02	medium	SSH: Login attempt using non-existent user
9 Jul 2026 - 09:00	medium	SSH: Login attempt using non-existent user
9 Jul 2026 - 08:58	medium	SSH: Login attempt using non-existent user
9 Jul 2026 - 08:55	medium	SSH: Login attempt using non-existent user
9 Jul 2026 - 08:49	medium	SSH: Login attempt using non-existent user
9 Jul 2026 - 08:47	medium	SSH: Login attempt using non-existent user
9 Jul 2026 - 08:43	medium	SSH: Login attempt using non-existent user
9 Jul 2026 - 08:40	medium	SSH: Login attempt using non-existent user
9 Jul 2026 - 08:38	medium	SSH: Login attempt using non-existent user
9 Jul 2026 - 08:36	medium	SSH: Login attempt using non-existent user
9 Jul 2026 - 08:34	medium	SSH: Login attempt using non-existent user
9 Jul 2026 - 08:27	medium	SSH: Login attempt using non-existent user
9 Jul 2026 - 08:25	medium	SSH: Login attempt using non-existent user
9 Jul 2026 - 08:23	medium	SSH: Login attempt using non-existent user
9 Jul 2026 - 08:19	medium	SSH: Login attempt using non-existent user
9 Jul 2026 - 08:05	high	SSH: Login attempt using non-existent user

Report for IP: 201.63.223.138

Attack Analysis

Reports (19)