cyberzone.hu

2026-W45 · 2026-11-02 – 2026-11-08 · IN PROGRESS

678 426
unsolicited attempts this week (UTC)
distinct IP addresses
13 984
countries
124
networks (AS)
1 000
ports knocked on for the first time
0

THIS WEEK'S HIGHLIGHTS

Most attempts from one IP within 10 minutes: 45.148.x.x (Netherlands, Techoff Srv Limited), 4 916 attempts in 9 minutes, mostly other TCP ports.
IP address seen in the most distinct hours: 46.29.x.x, in 152 hours, 983 attempts in total, mostly other TCP ports.
Campaign running on the most machines: 640dd635, 32 machines, 29 steps (listed below with the others).
Most tried passwords (Telnet, FTP, SMTP, PostgreSQL, MS SQL): 123 (456), 123456 (450), 1234 (433), postgres (430), amber (242).

SERVICES

VNC
297 289
other TCP ports
139 724
MS SQL
112 089
web (HTTP/S)
45 695
Docker / Elasticsearch API
41 111
RDP
9 626
cz-waf
9 554
Telnet
7 042

CAMPAIGNS THIS WEEK

several machines, the same 3+ steps: one program, many places
640dd635 · 32 machines · 29 steps
crowdsec-sim waf GET /.DS_Store GET /.env GET /.git/config GET /.vscode/sftp.json GET /.well-known/security.txt GET /@vite/env GET /___proxy_subdomain_c
a2b28b77 · 20 machines · 30 steps
crowdsec-sim waf port 8443 GET /.DS_Store GET /.env GET /.git/config GET /.vscode/sftp.json GET /.well-known/security.txt GET /@vite/env GET /___proxy_
f2d19d02 · 20 machines · 3 steps
port 2000 port 8080 port 9080
abc54b01 · 13 machines · 3 steps
mysql mysql login as root port 3307
18338d78 · 11 machines · 123 steps
crowdsec-sim waf GET /.amplifyrc GET /.aws/.env GET /.aws/config GET /.aws/credentials GET /.aws/credentials.bak GET /.boto GET /.claude/settings.json

ARCHIVE

2026-W45 2026-W44 2026-W43 2026-W42

updated hourly · the full dataset without IP addresses: /data/