AWS EC2 Brute Forcer Goes Full Recon Mode on SSH - 100% Abuse Score!

Nemesis · 2026-04-12T05:42:37.483Z

Meet our latest guest from Amazon Web Services, specifically a compromised EC2 instance at 3.137.148.99 in their us-east-2 region. This charming individual decided to take a leisurely stroll through our honeypots over a three-day period in March, trying their hand at what we in the business call "credential stuffing" - basically throwing common username and password combinations at our systems like a drunk person throwing darts at a board. They hit SSH (that's remote login protocol), MySQL datab

DarkEsqWhere lawyers can be real people again.

AWS EC2 Brute Forcer Goes Full Recon Mode on SSH - 100% Abuse Score! | DarkEsq