Threat LevelCRITICAL72/1002 rule types across 2 attack categories

27 incidents · 2 rule types · active attacker + blocklisted · persistent 39-day campaign · last seen 6d ago

PTR	N/A
Org / ASN	VMHeaven.io
Country	🇳🇱 The Netherlands
City	Eygelshoven, Limburg
Timezone	Europe/Amsterdam

Attack Analysis

🇳🇱 Netherlands · Eygelshoven · 51396 · VMHeaven.io

Suricata IDS Alert

Suricata intrusion detection flagged this IP for malicious network behaviour — including port scanning, exploit attempts, botnet activity, or known attack signatures. The specific signature is shown in the report list below.

IDS: Blocklist — Spamhaus DROP

This IP is on the Spamhaus DROP list — a dataset of netblocks hijacked or leased by professional spam and cybercrime operations with no legitimate users. Traffic from DROP-listed ranges is considered hostile by design. Blocking is unconditional.

Reports (27)

Date	Severity	Description
26 Jul 2026 - 00:48	high	IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 7
26 Jul 2026 - 00:48	medium	IDS: Suricata alert — Honeypot: probe to closed SSH port 22
14 Jul 2026 - 00:38	high	IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 7
14 Jul 2026 - 00:38	medium	IDS: Suricata alert — Honeypot: probe to closed SSH port 22
13 Jul 2026 - 01:01	medium	IDS: Suricata alert — Honeypot: probe to closed SSH port 22
13 Jul 2026 - 01:01	high	IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 7
12 Jul 2026 - 22:24	high	IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 7
12 Jul 2026 - 22:24	medium	IDS: Suricata alert — Honeypot: probe to closed SSH port 22
12 Jul 2026 - 01:11	medium	IDS: Suricata alert — Honeypot: probe to closed SSH port 22
12 Jul 2026 - 01:08	high	IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 7
12 Jul 2026 - 01:08	medium	IDS: Suricata alert — Honeypot: probe to closed SSH port 22
10 Jul 2026 - 23:13	medium	IDS: Suricata alert — Honeypot: probe to closed SSH port 22
6 Jul 2026 - 20:50	high	IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 8
6 Jul 2026 - 20:50	medium	IDS: Suricata alert — Honeypot: probe to closed SSH port 22
5 Jul 2026 - 00:33	medium	IDS: Suricata alert — Honeypot: probe to closed SSH port 22
5 Jul 2026 - 00:33	high	IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 7
1 Jul 2026 - 00:54	high	IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 7
1 Jul 2026 - 00:54	medium	IDS: Suricata alert — Honeypot: probe to closed SSH port 22
28 Jun 2026 - 00:45	high	IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 7
28 Jun 2026 - 00:45	medium	IDS: Suricata alert — Honeypot: probe to closed SSH port 22

Report for IP: 45.153.34.235

Attack Analysis

Reports (27)

Related IPs — Same /24 Block (45.153.34.0/24)