Beginning in th evening of 15 December 2023, Clipeus honeypots detected a spike in traffic originating from IP addresses geolocated in Brazil towards our honeypots.
The event continued throughout the following day (16 December). The traffic dropped almost to zero approximately at 6 PM Central European Time (CET) on 16 December, and gradually returned to high volume 12 hours later, around 6 AM CET today (17 December).
While the traffic originated from several locations, Brazil-based IP addresses were prevalent.
Majority of the attacks (over 22 thousand in packet count) were directed towards port 123, typically dedicated to network time protocol (NTP). Targeting of this port may be consistent with NTP amplification attacks.