🛰 Наш сенсор за сутки
Suricata на боевом трафике: 1738 срабатываний, 60 уникальных атакующих IP.

Топ источников атак:
• 152[.]42[.]163[.]59 — 34 попыток · SURICATA STREAM 3way handshake excessive different SYNs
• 130[.]12[.]182[.]225 — 8 попыток · ET COMPROMISED Known Compromised or Hostile Host Traffic group 5
• 18[.]119[.]209[.]50 — 8 попыток · ET CINS Active Threat Intelligence Poor Reputation IP group 20
• 18[.]217[.]208[.]51 — 7 попыток · ET CINS Active Threat Intelligence Poor Reputation IP group 20
• 3[.]131[.]24[.]55 — 7 попыток · ET CINS Active Threat Intelligence Poor Reputation IP group 2
• 45[.]142[.]193[.]177 — 7 попыток · ET DROP Spamhaus DROP Listed Traffic Inbound group 8
• 85[.]11[.]167[.]7 — 7 попыток · ET DROP Spamhaus DROP Listed Traffic Inbound group 12
• 94[.]154[.]43[.]56 — 7 попыток · ET DROP Spamhaus DROP Listed Traffic Inbound group 17
• 94[.]26[.]88[.]126 — 7 попыток · ET DROP Spamhaus DROP Listed Traffic Inbound group 17
• 94[.]26[.]88[.]134 — 7 попыток · ET DROP Spamhaus DROP Listed Traffic Inbound group 17
• 94[.]26[.]88[.]18 — 7 попыток · ET DROP Spamhaus DROP Listed Traffic Inbound group 17
• 148[.]59[.]129[.]16 — 6 попыток · ET CINS Active Threat Intelligence Poor Reputation IP group 210

Топ сигнатур:
• ET DROP Dshield Block Listed Source group 1 (280)
• ET CINS Active Threat Intelligence Poor Reputation IP group 147 (223)
• ET CINS Active Threat Intelligence Poor Reputation IP group 148 (87)
• ET CINS Active Threat Intelligence Poor Reputation IP group 143 (57)
• ET CINS Active Threat Intelligence Poor Reputation IP group 134 (44)
• ET DROP Spamhaus DROP Listed Traffic Inbound group 17 (44)

First-party телеметрия. IP уже в базе поиска и экспортах (источник «Belyaev NTA»).
#сенсор #BelyaevThreatMap