Report for IP: 36.138.252.97

Threat LevelCRITICAL78/1002 rule types across 2 attack categories
35 incidents · 2 rule types · active attack detected · active over 5 days · seen 4h ago
PTR N/A
Org / ASN China Mobile Communications Corporation
Country 🇨🇳 China
City Guangzhou, Guangdong
Timezone Asia/Shanghai

Attack Analysis

🇨🇳 China · Guangzhou · 9808 · China Mobile
Suricata IDS Alert
Suricata intrusion detection flagged this IP for malicious network behaviour — including port scanning, exploit attempts, botnet activity, or known attack signatures. The specific signature is shown in the report list below.
IDS: SSH Port Scan
Suricata detected automated SSH port scanning from this IP. SSH scanners map targets before launching credential brute-force attacks. This is the reconnaissance phase of a larger attack campaign.

Reports (35)

Date Severity Description
13 Jun 2026 - 04:05 medium IDS: Suricata alert — Honeypot: probe to closed SSH port 22
12 Jun 2026 - 21:01 medium IDS: Suricata alert — Honeypot: probe to closed SSH port 22
12 Jun 2026 - 13:28 medium IDS: Suricata alert — Honeypot: probe to closed SSH port 22
12 Jun 2026 - 06:13 medium IDS: Suricata alert — Honeypot: probe to closed SSH port 22
11 Jun 2026 - 23:22 high IDS: SSH port scan — ET SCAN Potential SSH Scan
11 Jun 2026 - 23:22 medium IDS: Suricata alert — Honeypot: probe to closed SSH port 22
11 Jun 2026 - 16:08 high IDS: SSH port scan — ET SCAN Potential SSH Scan
11 Jun 2026 - 16:07 medium IDS: Suricata alert — Honeypot: probe to closed SSH port 22
11 Jun 2026 - 08:13 high IDS: SSH port scan — ET SCAN Potential SSH Scan
11 Jun 2026 - 08:13 medium IDS: Suricata alert — Honeypot: probe to closed SSH port 22
11 Jun 2026 - 01:13 medium IDS: Suricata alert — Honeypot: probe to closed SSH port 22
11 Jun 2026 - 01:13 high IDS: SSH port scan — ET SCAN Potential SSH Scan
10 Jun 2026 - 18:35 high IDS: SSH port scan — ET SCAN Potential SSH Scan
10 Jun 2026 - 18:35 medium IDS: Suricata alert — Honeypot: probe to closed SSH port 22
10 Jun 2026 - 11:33 high IDS: SSH port scan — ET SCAN Potential SSH Scan
10 Jun 2026 - 11:33 medium IDS: Suricata alert — Honeypot: probe to closed SSH port 22
10 Jun 2026 - 04:22 high IDS: SSH port scan — ET SCAN Potential SSH Scan
10 Jun 2026 - 04:22 medium IDS: Suricata alert — Honeypot: probe to closed SSH port 22
9 Jun 2026 - 21:56 high IDS: SSH port scan — ET SCAN Potential SSH Scan
9 Jun 2026 - 21:56 medium IDS: Suricata alert — Honeypot: probe to closed SSH port 22
Part of EagleEye Intelligence