Threat LevelCRITICAL72/1001 rule type

7 incidents on record · active over 5 days · last seen 7d ago

PTR	N/A
Org / ASN	Chinanet HB
Country	🇨🇳 China
City	Shizishan, Hubei
Timezone	Asia/Shanghai

Botnet InfrastructureChinaNet (AS4134, China Telecom)

ChinaNet (AS4134) is one of the highest-volume attack-originating ASNs globally, consistently ranking in SANS/DShield top-10 attacker lists. Activity ranges from compromised consumer endpoints to dedicated scan infrastructure. SSH brute-force from this network targets common username dictionaries at scale — automated, persistent credential-harvesting botnet behavior.

Attack Analysis

Port 22 Honeypot Probe

This IP connected to a fake SSH honeypot — a port 22 listener that is not a real SSH server. This is an automated scanner fingerprinting targets before launching a brute-force campaign. Legitimate systems never probe port 22 without a specific reason; this activity is virtually 100% malicious.

Reports (7)

Date	Severity	Description
22 Sep 2026 - 12:37	high	IDS: Honeypot probe — port 22 listener that is not a real SSH server — Honeypot: probe to closed SSH port 22
22 Sep 2026 - 02:28	high	IDS: Honeypot probe — port 22 listener that is not a real SSH server — Honeypot: probe to closed SSH port 22
21 Sep 2026 - 00:02	high	IDS: Honeypot probe — port 22 listener that is not a real SSH server — Honeypot: probe to closed SSH port 22
19 Sep 2026 - 03:32	high	IDS: Honeypot probe — port 22 listener that is not a real SSH server — Honeypot: probe to closed SSH port 22
18 Sep 2026 - 07:20	high	IDS: Honeypot probe — port 22 listener that is not a real SSH server — Honeypot: probe to closed SSH port 22
18 Sep 2026 - 01:08	high	IDS: Honeypot probe — port 22 listener that is not a real SSH server — Honeypot: probe to closed SSH port 22
17 Sep 2026 - 21:11	high	IDS: Honeypot probe — port 22 listener that is not a real SSH server — Honeypot: probe to closed SSH port 22

Report for IP: 58.51.182.237

Attack Analysis

Reports (7)

Related IPs — Same /24 Block (58.51.182.0/24)