Threat Intelligence Report May 22nd - May 28th 2017

Top 10 Attacker Countries:

The following data states the extent of attacks that have originated from various countries.

Top 10 Attacker Host:

The following data states the extent of attacks that have originated from specific host IP address.

Detailed Report on Suspicious Hosts:

Behavior: 
Scanning hosts

Activity: 
Continuously using different username password combination existing and non existing usernames.

We have found following different types of events:

• SSHD authentication failed.
• Multiple SSHD authentication failures.
• Multiple failed logins in a small period of time.
• SSH insecure connection attempt (scan).
• Failed Password
• Invalid User
• Input userauth request invalid user
  
  

Type of attack: 
Bruteforce

Source IP Addresses:
58.218.198.151
218.65.30.122
212.129.30.216
91.197.232.107
61.177.172.34
195.154.62.137
61.177.172.59
91.197.232.103
31.207.47.36
190.57.231.34
61.177.172.17