Threat LevelCRITICAL80/1004 rule types across 4 attack categories

48 incidents · 4 rule types · active attacker + blocklisted · persistent 22-day campaign · last seen 45d ago · bulletproof hosting

PTR	N/A
Org / ASN	Limited Network LTD
Country	🇬🇧 United Kingdom
City	Manchester, England
Timezone	Europe/London

Bulletproof HostingLimited Network LTD (AS213790)

Limited Network LTD (AS213790) is a UK-registered but Romania-operated hosting entity whose address space is listed on Spamhaus DROP. The abuse contact routes to a Romanian address — a pattern consistent with Eastern European bulletproof hosting using UK shell companies as legitimacy facades. Flagged by multiple honeypot networks for reconnaissance and intrusion attempts.

Attack Analysis

IDS: Blocklist — Spamhaus DROP

This IP is on the Spamhaus DROP list — a dataset of netblocks hijacked or leased by professional spam and cybercrime operations with no legitimate users. Traffic from DROP-listed ranges is considered hostile by design. Blocking is unconditional.

IDS: Database Port Scan

Suricata detected this IP scanning database ports (MySQL, PostgreSQL, Redis, MongoDB). This is reconnaissance to find exposed database services for direct exploitation or credential brute-force. Database ports should never be reachable from the internet.

Port 22 Honeypot Probe

This IP connected to a fake SSH honeypot — a port 22 listener that is not a real SSH server. This is an automated scanner fingerprinting targets before launching a brute-force campaign. Legitimate systems never probe port 22 without a specific reason; this activity is virtually 100% malicious.

Suricata IDS Alert

Suricata intrusion detection flagged this IP for malicious network behaviour — including port scanning, exploit attempts, botnet activity, or known attack signatures. The specific signature is shown in the report list below.

Reports (48)

Date	Severity	Description
16 Aug 2026 - 07:42	high	IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 7
16 Aug 2026 - 06:42	high	IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 7
16 Aug 2026 - 05:42	high	IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 7
16 Aug 2026 - 04:42	high	IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 7
16 Aug 2026 - 04:08	high	IDS: Database port scan — ET SCAN Suspicious inbound to PostgreSQL port 5432
16 Aug 2026 - 04:07	high	IDS: Database port scan — ET SCAN Suspicious inbound to PostgreSQL port 5432
16 Aug 2026 - 03:42	high	IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 7
16 Aug 2026 - 03:18	medium	IDS: Suricata alert — Honeypot: probe to closed SSH port 22
16 Aug 2026 - 02:42	high	IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 7
16 Aug 2026 - 01:42	high	IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 7
16 Aug 2026 - 00:42	high	IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 7
15 Aug 2026 - 23:42	high	IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 7
15 Aug 2026 - 22:42	high	IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 7
15 Aug 2026 - 21:42	high	IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 7
15 Aug 2026 - 20:42	high	IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 7
15 Aug 2026 - 19:42	high	IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 7
15 Aug 2026 - 18:42	high	IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 7
15 Aug 2026 - 17:42	high	IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 7
15 Aug 2026 - 16:41	high	IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 7
15 Aug 2026 - 15:41	high	IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 7

Report for IP: 45.142.193.4

Attack Analysis

Reports (48)

Related IPs — Same /24 Block (45.142.193.0/24)