Threat LevelCRITICAL72/1002 rule types across 2 attack categories

3 incidents on record · 2 rule types · active attack detected · active over 4 days · last seen 24d ago

PTR	static.24.148.130.94.clients.your-server.de
Org / ASN	Hetzner
Country	🇩🇪 Germany
City	Nuremberg, Bavaria
Timezone	Europe/Berlin

Attack Analysis

Port 22 Honeypot Probe

This IP connected to a fake SSH honeypot — a port 22 listener that is not a real SSH server. This is an automated scanner fingerprinting targets before launching a brute-force campaign. Legitimate systems never probe port 22 without a specific reason; this activity is virtually 100% malicious.

Suricata IDS Alert

Suricata intrusion detection flagged this IP for malicious network behaviour — including port scanning, exploit attempts, botnet activity, or known attack signatures. The specific signature is shown in the report list below.

Reports (3)

Date	Severity	Description
6 Sep 2026 - 06:46	high	IDS: Honeypot probe — port 22 listener that is not a real SSH server — Honeypot: probe to closed SSH port 22
6 Sep 2026 - 06:46	high	IDS: Honeypot probe — port 22 listener that is not a real SSH server
2 Sep 2026 - 12:09	high	IDS: Suricata alert

Report for IP: 94.130.148.24

Attack Analysis

Reports (3)