62.60.130.148 | UnwantedIP

Threat LevelCRITICAL88/1002 rule types across 2 attack categories

325 incidents · 2 rule types · active attacker + blocklisted · persistent 38-day campaign · seen 6h ago

PTR	N/A
Org / ASN	UAB Host Baltic
Country	🇮🇷 Iran
City	Tehran, Tehran
Timezone	Asia/Tehran

Attack Analysis

🇬🇧 United Kingdom · London · 215930 · CIPHER OPERATIONS DOO BEOGRAD NOVI BEOGRAD

IDS: Blocklist — Spamhaus DROP

This IP is on the Spamhaus DROP list — a dataset of netblocks hijacked or leased by professional spam and cybercrime operations with no legitimate users. Traffic from DROP-listed ranges is considered hostile by design. Blocking is unconditional.

Suricata IDS Alert

Suricata intrusion detection flagged this IP for malicious network behaviour — including port scanning, exploit attempts, botnet activity, or known attack signatures. The specific signature is shown in the report list below.

Reports (325)

Date	Severity	Description
12 Jul 2026 - 14:16	medium	IDS: Suricata alert — Honeypot: probe to closed SSH port 22
12 Jul 2026 - 14:16	high	IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 9
12 Jul 2026 - 12:21	high	IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 8
12 Jul 2026 - 12:21	medium	IDS: Suricata alert — Honeypot: probe to closed SSH port 22
12 Jul 2026 - 05:22	medium	IDS: Suricata alert — Honeypot: probe to closed SSH port 22
12 Jul 2026 - 05:22	high	IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 9
12 Jul 2026 - 03:27	high	IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 8
12 Jul 2026 - 03:27	medium	IDS: Suricata alert — Honeypot: probe to closed SSH port 22
12 Jul 2026 - 01:10	medium	IDS: Suricata alert — Honeypot: probe to closed SSH port 22
12 Jul 2026 - 01:10	high	IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 9
11 Jul 2026 - 20:28	medium	IDS: Suricata alert — Honeypot: probe to closed SSH port 22
11 Jul 2026 - 20:28	high	IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 9
11 Jul 2026 - 18:33	high	IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 8
11 Jul 2026 - 18:33	medium	IDS: Suricata alert — Honeypot: probe to closed SSH port 22
11 Jul 2026 - 10:39	medium	IDS: Suricata alert — Honeypot: probe to closed SSH port 22
11 Jul 2026 - 10:39	high	IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 8
11 Jul 2026 - 09:23	medium	IDS: Suricata alert — Honeypot: probe to closed SSH port 22
11 Jul 2026 - 09:23	high	IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 9
11 Jul 2026 - 01:45	medium	IDS: Suricata alert — Honeypot: probe to closed SSH port 22
11 Jul 2026 - 01:45	high	IDS: Blocklist — Spamhaus DROP listed IP — ET DROP Spamhaus DROP Listed Traffic Inbound group 8

Report for IP: 62.60.130.148

Attack Analysis

Reports (325)

Related IPs — Same /24 Block (62.60.130.0/24)