Threat LevelCRITICAL80/1002 rule types across 2 attack categories
26 incidents · 2 rule types · active attack detected · 26 attacks/day · last seen 1d ago · bulletproof hosting
| PTR | 45.78.18.39.16clouds.com |
| Org / ASN | IT7 Networks Inc |
| Country | 🇭🇰 Hong Kong |
| City | Hong Kong, Kowloon |
| Timezone | Asia/Hong_Kong |
Abuse-Tolerant HostingIT7 Networks Inc / 16clouds.com (AS25820)
IT7 Networks Inc (AS25820) operates approximately 425,000 IPv4 addresses across North America and Hong Kong under the 16clouds.com brand, with abuse contact routing to abuse@sioru.com. The network is tagged for BitTorrent, anonymizing proxy, and botnet infrastructure. A single IP in the 45.78.19.0/24 block generated over 4,000 block events against monitored infrastructure in a single day — the highest single-IP event rate in the observed dataset — consistent with dedicated, long-running attack VPS allocations rather than compromised consumer endpoints.
Attack Analysis
Suricata IDS Alert
Suricata intrusion detection flagged this IP for malicious network behaviour — including port scanning, exploit attempts, botnet activity, or known attack signatures. The specific signature is shown in the report list below.
IDS: SSH Port Scan
Suricata detected automated SSH port scanning from this IP. SSH scanners map targets before launching credential brute-force attacks. This is the reconnaissance phase of a larger attack campaign.
Reports (26)
| Date | Severity | Description |
|---|---|---|
| 12 Jun 2026 - 02:36 | medium | IDS: Suricata alert — Honeypot: probe to closed SSH port 22 |
| 12 Jun 2026 - 02:35 | medium | IDS: Suricata alert — Honeypot: probe to closed SSH port 22 |
| 12 Jun 2026 - 02:35 | high | IDS: SSH port scan — ET SCAN Potential SSH Scan |
| 12 Jun 2026 - 00:05 | medium | IDS: Suricata alert — Honeypot: probe to closed SSH port 22 |
| 12 Jun 2026 - 00:04 | medium | IDS: Suricata alert — Honeypot: probe to closed SSH port 22 |
| 12 Jun 2026 - 00:04 | high | IDS: SSH port scan — ET SCAN Potential SSH Scan |
| 11 Jun 2026 - 21:41 | medium | IDS: Suricata alert — Honeypot: probe to closed SSH port 22 |
| 11 Jun 2026 - 21:40 | medium | IDS: Suricata alert — Honeypot: probe to closed SSH port 22 |
| 11 Jun 2026 - 21:40 | high | IDS: SSH port scan — ET SCAN Potential SSH Scan |
| 11 Jun 2026 - 20:59 | medium | IDS: Suricata alert — Honeypot: probe to closed SSH port 22 |
| 11 Jun 2026 - 20:58 | medium | IDS: Suricata alert — Honeypot: probe to closed SSH port 22 |
| 11 Jun 2026 - 20:58 | high | IDS: SSH port scan — ET SCAN Potential SSH Scan |
| 11 Jun 2026 - 20:12 | medium | IDS: Suricata alert — Honeypot: probe to closed SSH port 22 |
| 11 Jun 2026 - 20:11 | medium | IDS: Suricata alert — Honeypot: probe to closed SSH port 22 |
| 11 Jun 2026 - 20:11 | high | IDS: SSH port scan — ET SCAN Potential SSH Scan |
| 11 Jun 2026 - 17:01 | medium | IDS: Suricata alert — Honeypot: probe to closed SSH port 22 |
| 11 Jun 2026 - 17:00 | medium | IDS: Suricata alert — Honeypot: probe to closed SSH port 22 |
| 11 Jun 2026 - 17:00 | high | IDS: SSH port scan — ET SCAN Potential SSH Scan |
| 11 Jun 2026 - 16:18 | medium | IDS: Suricata alert — Honeypot: probe to closed SSH port 22 |
| 11 Jun 2026 - 16:17 | high | IDS: SSH port scan — ET SCAN Potential SSH Scan |
EagleEye Intelligence