Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Sa ...
show moreMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0
show less
UDP flood (DDoS) vs AS215599: 4561 pkts / 6.52 MB to UDP 8443 across 37 dst IP(s), 2026-08-19 21:46 ...
show moreUDP flood (DDoS) vs AS215599: 4561 pkts / 6.52 MB to UDP 8443 across 37 dst IP(s), 2026-08-19 21:46 to 2026-08-20 00:36 CEST. No legitimate service on these UDP ports (7-day baseline 0 GB/day). Carpet-bombing of a /24, likely botnet-compromised host. Evidence: sFlow + hardware ACL counters.
show less
UDP flood (DDoS) vs AS215599: 4561 pkts / 6.52 MB to UDP 8443 across 37 dst IP(s), 2026-08-19 21:46 ...
show moreUDP flood (DDoS) vs AS215599: 4561 pkts / 6.52 MB to UDP 8443 across 37 dst IP(s), 2026-08-19 21:46 to 2026-08-20 00:36 CEST. No legitimate service on these UDP ports (7-day baseline 0 GB/day). Carpet-bombing of a /24, likely botnet-compromised host. Evidence: sFlow + hardware ACL counters.
show less
[19:55] Attempted SSH login on port 2222 with credentials odoo:odoo2020
Brute-Force
SSH
Anonymous
2026-05-03T23:21:29.171844+00:00 Canada1 sshd-session[628181]: pam_unix(sshd:auth): authentication f ...
show more2026-05-03T23:21:29.171844+00:00 Canada1 sshd-session[628181]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=38.255.75.67
2026-05-03T23:21:31.367325+00:00 Canada1 sshd-session[628181]: Failed password for invalid user newuser from 38.255.75.67 port 50772 ssh2
...
show less
[AI-generated report] Contact: [email protected]
IP 38.255.75.67 attacked an SSH honeypot ...
show more[AI-generated report] Contact: [email protected]
IP 38.255.75.67 attacked an SSH honeypot from Venezuela with 111 login attempts on April 29-30, 2026, targeting port 2222. Successful root access used credentials like "admin@123!@#" and executed commands to modify .ssh directories for persistence. Malware family trojan.shell/malkey observed. Botnet cluster identified (subnet: 38.255.75.*).
show less