🛰 Наш сенсор за сутки
Suricata на боевом трафике: 2134 срабатываний, 60 уникальных атакующих IP.

Топ источников атак:
• 85[.]11[.]167[.]7 — 8 попыток · ET DROP Spamhaus DROP Listed Traffic Inbound group 12
• 94[.]26[.]88[.]126 — 8 попыток · ET DROP Spamhaus DROP Listed Traffic Inbound group 17
• 94[.]26[.]88[.]134 — 8 попыток · ET DROP Spamhaus DROP Listed Traffic Inbound group 17
• 94[.]26[.]88[.]18 — 8 попыток · ET DROP Spamhaus DROP Listed Traffic Inbound group 17
• 100[.]50[.]17[.]159 — 7 попыток · ET CINS Active Threat Intelligence Poor Reputation IP group 165
• 18[.]217[.]208[.]51 — 7 попыток · ET CINS Active Threat Intelligence Poor Reputation IP group 20
• 45[.]142[.]193[.]177 — 7 попыток · ET DROP Spamhaus DROP Listed Traffic Inbound group 8
• 135[.]148[.]29[.]54 — 6 попыток · ET CINS Active Threat Intelligence Poor Reputation IP group 189
• 148[.]59[.]129[.]48 — 6 попыток · ET CINS Active Threat Intelligence Poor Reputation IP group 210
• 18[.]119[.]209[.]50 — 6 попыток · ET CINS Active Threat Intelligence Poor Reputation IP group 20
• 198[.]244[.]200[.]163 — 6 попыток · ET CINS Active Threat Intelligence Poor Reputation IP group 283
• 3[.]131[.]24[.]55 — 6 попыток · ET CINS Active Threat Intelligence Poor Reputation IP group 2

Топ сигнатур:
• ET DROP Dshield Block Listed Source group 1 (381)
• ET CINS Active Threat Intelligence Poor Reputation IP group 147 (217)
• ET CINS Active Threat Intelligence Poor Reputation IP group 148 (82)
• ET CINS Active Threat Intelligence Poor Reputation IP group 143 (48)
• ET DROP Spamhaus DROP Listed Traffic Inbound group 17 (44)
• ET CINS Active Threat Intelligence Poor Reputation IP group 134 (29)

First-party телеметрия. IP уже в базе поиска и экспортах (источник «Belyaev NTA»).
#сенсор #BelyaevThreatMap