There was a successful sign-in from this address, and the same address was flagged by other defences — or a file check, the antivirus or a newly opened port fired right after it. Worth confirming that the sign-in was yours.
| Time | Severity | Source | Message | Count |
|---|---|---|---|---|
| 11.10.2026 16:36 | Warning | ssh |
SSH: login from a new address sergey@198.51.100.17
|
1 |
| 11.10.2026 20:55 | Critical | ssh |
SSH: root login sergey@198.51.100.17
|
1 |
| 12.10.2026 06:18 | Warning | suricata |
Suricata: new alerts ET SCAN Nmap Scripting Engine User-Agent
|
14 |
| 12.10.2026 07:18 | Warning | fail2ban |
Fail2ban: new bans 198.51.100.17
|
6 |
| 12.10.2026 08:03 | Warning | ssh |
SSH: login from a new address deploy@198.51.100.17
|
1 |
Events that carry no address: their source does not know who did it. Shown for the span this address was active, plus six hours after it.
| 11.10.2026 22:32 | Critical | falco |
Falco: critical events Read of sensitive file /etc/shadow
|
| 11.10.2026 23:24 | Warning | network |
A new port is reachable from outside 3000
|
| 12.10.2026 07:52 | Critical | service | Protection service stopped: suricata |