Report for IP: 36.50.151.66

This IP attempted to authenticate via SSH using a username that does not exist on the system. This is characteristic of automated credential-stuffing attacks cycling through common username wordlists (admin, root, ubuntu, pi, etc.).

This IP attempted SSH logins using 5 or more invalid usernames within 2 minutes — a credential-stuffing attack cycling through common account names (admin, root, ubuntu, deploy, pi). This indicates an automated tool probing for default or common accounts.

Suricata intrusion detection flagged this IP for malicious network behaviour — including port scanning, exploit attempts, botnet activity, or known attack signatures. The specific signature is shown in the report list below.

Suricata detected automated SSH port scanning from this IP. SSH scanners map targets before launching credential brute-force attacks. This is the reconnaissance phase of a larger attack campaign.