DDOS Events Originating From Brazil

Beginning in th evening of 15 December 2023, Clipeus honeypots detected a spike in traffic originating from IP addresses geolocated in Brazil towards our honeypots.

Spike In Traffic Towards Clipeus Honeypots Beginning On 15 December 2023

The event continued throughout the following day (16 December). The traffic dropped almost to zero approximately at 6 PM Central European Time (CET) on 16 December, and gradually returned to high volume 12 hours later, around 6 AM CET today (17 December).

Drop And New Wave Of Attacks, 16-17 December 2023

While the traffic originated from several locations, Brazil-based IP addresses were prevalent.

Breakdown Of Observed Traffic By Originating IP Source

Majority of the attacks (over 22 thousand in packet count) were directed towards port 123, typically dedicated to network time protocol (NTP). Targeting of this port may be consistent with NTP amplification attacks.