Threat LevelMEDIUM47/1001 rule type
1 incident on record · active attack detected · last seen 20d ago
| PTR | vmi2995914.contaboserver.net |
| Org / ASN | Contabo GmbH |
| Country | 🇫🇷 France |
| City | Lauterbourg, Grand Est |
| Timezone | Europe/Paris |
Attack Analysis
Slow SSH Preauth Scan
This IP repeatedly connected to SSH, collected the server banner and host key, then disconnected before authenticating — multiple times over 30 minutes. This slow scan pattern maps SSH versions and keys while staying below rate-limit thresholds. It is used exclusively by botnet scanners preparing for brute-force attacks.
Reports (1)
| Date | Severity | Description |
|---|---|---|
| 12 Jul 2026 - 01:04 | high | SSH: Slow preauth scan — 5+ disconnects in 30 min |
EagleEye Intelligence