🛰 Наш сенсор за сутки
Suricata на боевом трафике: 2194 срабатываний, 60 уникальных атакующих IP.

Топ источников атак:
• 94[.]154[.]43[.]56 — 13 попыток · ET DROP Dshield Block Listed Source group 1
• 85[.]217[.]140[.]40 — 12 попыток · ET CINS Active Threat Intelligence Poor Reputation IP group 142
• 85[.]217[.]140[.]11 — 11 попыток · ET CINS Active Threat Intelligence Poor Reputation IP group 141
• 85[.]217[.]140[.]12 — 11 попыток · ET CINS Active Threat Intelligence Poor Reputation IP group 141
• 85[.]217[.]140[.]41 — 11 попыток · ET CINS Active Threat Intelligence Poor Reputation IP group 142
• 85[.]217[.]140[.]53 — 11 попыток · ET CINS Active Threat Intelligence Poor Reputation IP group 142
• 85[.]217[.]149[.]66 — 11 попыток · ET CINS Active Threat Intelligence Poor Reputation IP group 143
• 85[.]217[.]149[.]69 — 11 попыток · ET CINS Active Threat Intelligence Poor Reputation IP group 143
• 85[.]217[.]149[.]71 — 11 попыток · ET CINS Active Threat Intelligence Poor Reputation IP group 143
• 85[.]217[.]140[.]15 — 10 попыток · ET CINS Active Threat Intelligence Poor Reputation IP group 141
• 85[.]217[.]140[.]18 — 10 попыток · ET CINS Active Threat Intelligence Poor Reputation IP group 141
• 85[.]217[.]140[.]4 — 10 попыток · ET CINS Active Threat Intelligence Poor Reputation IP group 142

Топ сигнатур:
• ET DROP Dshield Block Listed Source group 1 (555)
• ET CINS Active Threat Intelligence Poor Reputation IP group 147 (122)
• ET CINS Active Threat Intelligence Poor Reputation IP group 142 (120)
• ET CINS Active Threat Intelligence Poor Reputation IP group 143 (70)
• ET DROP Spamhaus DROP Listed Traffic Inbound group 17 (64)
• ET CINS Active Threat Intelligence Poor Reputation IP group 148 (48)

First-party телеметрия. IP уже в базе поиска и экспортах (источник «Belyaev NTA»).
#сенсор #BelyaevThreatMap