cyberzone.hu

2026-W44 · 2026-10-26 – 2026-11-01

898 366
unsolicited attempts this week (UTC)
distinct IP addresses
16 627
countries
137
networks (AS)
1 139
ports knocked on for the first time
49 960
busiest new ports: 27018, 788, 29092, 14265, 42999, 25461, 32000, 49154, 22622, 31222, 33694, 57452

THIS WEEK'S HIGHLIGHTS

Most attempts from one IP within 10 minutes: 185.136.x.x (Kazakhstan), 6 185 attempts in 10 minutes, mostly other TCP ports.
IP address seen in the most distinct hours: 157.66.x.x, in 168 hours, 2 504 attempts in total, mostly RDP.
Campaign running on the most machines: 640dd635, 24 machines, 29 steps (listed below with the others).
Seen for the first time this week: TCP 27018, TCP 788, TCP 29092, TCP 14265, TCP 42999.
Most tried passwords (Telnet, FTP, SMTP, PostgreSQL, MS SQL): 123 (1 789), 123456 (1 724), 1234 (1 049), aaaaaa (778), Wawan24 (634).

SERVICES

VNC
436 725
other TCP ports
263 993
MS SQL
84 603
web (HTTP/S)
47 826
Docker / Elasticsearch API
23 888
RDP
9 885
cz-waf
7 743
fake SSH (22)
7 741

CAMPAIGNS THIS WEEK

several machines, the same 3+ steps: one program, many places
640dd635 · 24 machines · 29 steps
crowdsec-sim waf GET /.DS_Store GET /.env GET /.git/config GET /.vscode/sftp.json GET /.well-known/security.txt GET /@vite/env GET /___proxy_subdomain_c
a2b28b77 · 22 machines · 30 steps
crowdsec-sim waf port 8443 GET /.DS_Store GET /.env GET /.git/config GET /.vscode/sftp.json GET /.well-known/security.txt GET /@vite/env GET /___proxy_
f2d19d02 · 20 machines · 3 steps
port 2000 port 8080 port 9080
7d8c3681 · 18 machines · 4 steps
GET /.well-known/security.txt GET /app-ads.txt GET /security.txt GET /sellers.json
abc54b01 · 14 machines · 3 steps
mysql mysql login as root port 3307

ARCHIVE

2026-W45 2026-W44 2026-W43 2026-W42

updated hourly · the full dataset without IP addresses: /data/