Threat LevelCRITICAL72/1002 rule types across 2 attack categories

11 incidents · 2 rule types · active attacker + blocklisted · persistent 11-day campaign · last seen 18d ago

PTR	N/A
Org / ASN	VMHeaven.io
Country	🇳🇱 The Netherlands
City	Eygelshoven, Limburg
Timezone	Europe/Amsterdam

Attack Analysis

🇳🇱 Netherlands · Eygelshoven · 51396 · VMHeaven.io

IDS: Blocklist — Spamhaus DROP

This IP is on the Spamhaus DROP list — a dataset of netblocks hijacked or leased by professional spam and cybercrime operations with no legitimate users. Traffic from DROP-listed ranges is considered hostile by design. Blocking is unconditional.

Suricata IDS Alert

Suricata intrusion detection flagged this IP for malicious network behaviour — including port scanning, exploit attempts, botnet activity, or known attack signatures. The specific signature is shown in the report list below.

Reports (11)

Date	Severity	Description
13 Jul 2026 - 13:28	high	IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 7
8 Jul 2026 - 05:39	high	IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 7
6 Jul 2026 - 08:48	high	IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 7
6 Jul 2026 - 06:57	high	IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 7
5 Jul 2026 - 07:02	high	IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 7
3 Jul 2026 - 18:43	high	IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 7
2 Jul 2026 - 13:36	high	IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 7
2 Jul 2026 - 08:54	high	IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 7
2 Jul 2026 - 04:21	high	IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 7
2 Jul 2026 - 02:11	medium	IDS: Suricata alert — Honeypot: probe to closed SSH port 22
2 Jul 2026 - 02:11	high	IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 7

Report for IP: 45.156.87.178

Attack Analysis

Reports (11)

Related IPs — Same /24 Block (45.156.87.0/24)