Mar 13 00:35:01 srv-prod sshd[35100]: Connection from 139.99.38.79 port 58100 on 10.0.1.15 port 22
...
show moreMar 13 00:35:01 srv-prod sshd[35100]: Connection from 139.99.38.79 port 58100 on 10.0.1.15 port 22
Mar 13 00:35:02 srv-prod sshd[35100]: SSH2_MSG_KEX_DH_GEX_REQUEST(2048<8192<8192) received
Mar 13 00:35:05 srv-prod sshd[35105]: Connection from 139.99.38.79 port 58101 on 10.0.1.15 port 22
Mar 13 00:35:06 srv-prod sshd[35105]: SSH2_MSG_KEX_DH_GEX_REQUEST(4096<8192<8192) received
Mar 13 00:35:10 srv-prod kernel: [18120.44] CPU0: Core temperature above threshold, cpu clock throttled
Mar 13 00:35:12 srv-prod sshd[35110]: Connection from 139.99.38.79 port 58102 on 10.0.1.15 port 22
Mar 13 00:35:15 srv-prod sshd[35110]: fatal: Timeout before authentication for 139.99.38.79 port 58102 [preauth]
Mar 13 00:35:20 srv-prod sshd[35115]: drop connection #25 from [139.99.38.79]:58110 on [10.0.1.15]:22 past MaxStartups
Mar 13 00:35:25 srv-prod sshd[35120]: error: kex_exchange_identification: client sent invalid protocol identifier "QUIT"
show less
DNS Compromise
DDoS Attack
Port Scan
Brute-Force
Bad Web Bot
Exploited Host
SSH
Hacking
Mar 13 00:25:01 srv-prod sshd[33001]: Connection from 139.99.38.79 port 41200 on 10.0.1.15 port 22
...
show moreMar 13 00:25:01 srv-prod sshd[33001]: Connection from 139.99.38.79 port 41200 on 10.0.1.15 port 22
Mar 13 00:25:02 srv-prod sshd[33001]: Invalid user admin from 139.99.38.79 port 41200
Mar 13 00:25:03 srv-prod sshd[33005]: Connection from 139.99.38.79 port 41201 on 10.0.1.15 port 22
Mar 13 00:25:04 srv-prod sshd[33005]: Invalid user manager from 139.99.38.79 port 41201
Mar 13 00:25:05 srv-prod kernel: [17105.12] [UFW BLOCK] IN=eth0 SRC=139.99.38.79 DST=10.0.1.15 PROTO=TCP SPT=41202 DPT=3306
Mar 13 00:25:05 srv-prod kernel: [17105.14] [UFW BLOCK] IN=eth0 SRC=139.99.38.79 DST=10.0.1.15 PROTO=TCP SPT=41203 DPT=6379
Mar 13 00:25:05 srv-prod kernel: [17105.16] [UFW BLOCK] IN=eth0 SRC=139.99.38.79 DST=10.0.1.15 PROTO=TCP SPT=41204 DPT=8080
Mar 13 00:25:06 srv-prod sshd[33010]: error: kex_exchange_identification: client sent invalid protocol identifier "NmapScan"
Mar 13 00:25:10 srv-prod sshd[33020]: drop connection #10 from [139.99.38.79]:41205 on [10.0.1.15]:22 past MaxStartups
show less
DDoS Attack
Port Scan
Spoofing
Exploited Host
SSH
Hacking
Mar 13 00:20:01 srv-prod sshd[31500]: Connection from 139.99.38.79 port 60221 on 10.0.1.15 port 22
...
show moreMar 13 00:20:01 srv-prod sshd[31500]: Connection from 139.99.38.79 port 60221 on 10.0.1.15 port 22
Mar 13 00:20:05 srv-prod sshd[31505]: Connection from 139.99.38.79 port 60222 on 10.0.1.15 port 22
Mar 13 00:20:10 srv-prod sshd[31510]: Connection from 139.99.38.79 port 60223 on 10.0.1.15 port 22
Mar 13 00:20:15 srv-prod sshd[31515]: Connection from 139.99.38.79 port 60224 on 10.0.1.15 port 22
Mar 13 00:20:30 srv-prod kernel: [16240.11] [UFW BLOCK] IN=eth0 OUT= MAC=... SRC=139.99.38.79 DST=10.0.1.15 PROTO=UDP SPT=53 DPT=123 LEN=1024
Mar 13 00:21:00 srv-prod sshd[31500]: fatal: Timeout before authentication for 139.99.38.79 port 60221 [preauth]
Mar 13 00:21:01 srv-prod sshd[31520]: Connection from 139.99.38.79 port 60230 on 10.0.1.15 port 22
Mar 13 00:21:01 srv-prod sshd[31521]: Connection from 139.99.38.79 port 60231 on 10.0.1.15 port 22
Mar 13 00:21:02 srv-prod sshd[31525]: fatal: mm_request_receive: read: Connection reset by peer [preauth]
show less
DDoS Attack
Port Scan
Bad Web Bot
Exploited Host
SSH
Mar 13 00:10:01 srv-prod sshd[30104]: Connection from 139.99.38.79 port 52101 on 10.0.1.15 port 22
...
show moreMar 13 00:10:01 srv-prod sshd[30104]: Connection from 139.99.38.79 port 52101 on 10.0.1.15 port 22
Mar 13 00:10:01 srv-prod sshd[30104]: error: kex_exchange_identification: client sent oversized identification string (16384 bytes)
Mar 13 00:10:02 srv-prod sshd[30105]: Connection from 139.99.38.79 port 52102 on 10.0.1.15 port 22
Mar 13 00:10:02 srv-prod sshd[30105]: error: kex_exchange_identification: client sent oversized identification string (16384 bytes)
Mar 13 00:10:05 srv-prod kernel: [15102.44] TCP: 139.99.38.79:52103 -> 10.0.1.15:22; Window scale 14 (multiplier 16384) detected.
Mar 13 00:10:05 srv-prod kernel: [15102.45] TCP: 139.99.38.79:52103; forcing memory allocation: 262144 bytes per buffer.
Mar 13 00:10:10 srv-prod sshd[30120]: Connection from 139.99.38.79 port 52110 on 10.0.1.15 port 22
Mar 13 00:10:11 srv-prod sshd[30120]: Invalid user \x01\x02\x03\x04\x05\x06\x07\x08 from 139.99.38.79
Mar 13 00:10:12 srv-prod sshd[30120]: error: buffer_get: bad string length 16777216
show less
DDoS Attack
Port Scan
Brute-Force
Exploited Host
Hacking
Mar 12 23:58:10 srv-prod sshd[28100]: Connection from 139.99.38.79 port 33101 on 10.0.1.15 port 22
...
show moreMar 12 23:58:10 srv-prod sshd[28100]: Connection from 139.99.38.79 port 33101 on 10.0.1.15 port 22
Mar 12 23:58:12 srv-prod sshd[28100]: Invalid user j.smith from 139.99.38.79 port 33101
Mar 12 23:58:15 srv-prod sshd[28105]: Connection from 139.99.38.79 port 33102 on 10.0.1.15 port 22
Mar 12 23:58:18 srv-prod sshd[28105]: Invalid user b.wayne from 139.99.38.79 port 33102
Mar 12 23:58:22 srv-prod sshd[28110]: Connection from 139.99.38.79 port 33103 on 10.0.1.15 port 22
Mar 12 23:58:25 srv-prod sshd[28110]: Invalid user dev_admin from 139.99.38.79 port 33103
Mar 12 23:58:30 srv-prod sshd[28115]: Connection from 139.99.38.79 port 33104 on 10.0.1.15 port 22
Mar 12 23:58:33 srv-prod sshd[28115]: Invalid user sys_manager from 139.99.38.79 port 33104
Mar 12 23:58:45 srv-prod sshd[28120]: error: kex_exchange_identification: Connection closed by remote host
Mar 12 23:59:01 srv-prod kernel: [14201.88] [DDoS Alert] SYN-RECV flood from 139.99.38.79 on Port 22
show less
DDoS Attack
Brute-Force
Exploited Host
SSH
Ping of Death
Mar 12 23:50:01 srv-prod sshd[25001]: Invalid user wp-admin from 139.99.38.79 port 42100
Mar 12 23: ...
show moreMar 12 23:50:01 srv-prod sshd[25001]: Invalid user wp-admin from 139.99.38.79 port 42100
Mar 12 23:50:01 srv-prod sshd[25002]: Invalid user guest from 139.99.38.79 port 42101
Mar 12 23:50:02 srv-prod sshd[25003]: Invalid user pi from 139.99.38.79 port 42102
Mar 12 23:50:02 srv-prod sshd[25004]: Invalid user ubuntu from 139.99.38.79 port 42103
Mar 12 23:50:03 srv-prod sshd[25005]: Invalid user git from 139.99.38.79 port 42104
Mar 12 23:50:04 srv-prod sshd[25006]: Invalid user deploy from 139.99.38.79 port 42105
Mar 12 23:50:05 srv-prod sshd[25007]: Invalid user postgres from 139.99.38.79 port 42106
Mar 12 23:50:06 srv-prod sshd[25008]: Invalid user nagios from 139.99.38.79 port 42107
Mar 12 23:50:07 srv-prod sshd[25009]: Invalid user asterisk from 139.99.38.79 port 42108
Mar 12 23:50:10 srv-prod sshd[25010]: Received disconnect from 139.99.38.79 port 42109:11: Bye Bye [preauth]
Mar 12 23:50:12 srv-prod sshd[25011]: pam_unix(sshd:auth): check pass; user unknown
show less
DDoS Attack
Port Scan
Brute-Force
Exploited Host
SSH
Mar 12 23:45:10 srv-prod sshd[15201]: Connection from 139.99.38.79 port 48290 on 10.0.1.15 port 22
...
show moreMar 12 23:45:10 srv-prod sshd[15201]: Connection from 139.99.38.79 port 48290 on 10.0.1.15 port 22
Mar 12 23:45:10 srv-prod sshd[15202]: Connection from 139.99.38.79 port 48291 on 10.0.1.15 port 22
Mar 12 23:45:11 srv-prod sshd[15203]: Connection from 139.99.38.79 port 48292 on 10.0.1.15 port 22
Mar 12 23:45:11 srv-prod sshd[15204]: Connection from 139.99.38.79 port 48293 on 10.0.1.15 port 22
Mar 12 23:45:15 srv-prod sshd[15201]: error: kex_protocol_error: type 30 [preauth]
Mar 12 23:45:15 srv-prod sshd[15202]: error: kex_protocol_error: type 30 [preauth]
Mar 12 23:45:20 srv-prod sshd[15210]: drop connection #10 from [139.99.38.79]:48305 on [10.0.1.15]:22 past MaxStartups
Mar 12 23:45:25 srv-prod sshd[15215]: Connection closed by authenticating user root 139.99.38.79 port 48310 [preauth]
Mar 12 23:45:30 srv-prod kernel: [9124.55] [INFO] sshd[15201] is using high CPU (98.2%) in KEX phase
Mar 12 23:45:32 srv-prod sshd[15220]: fatal: mm_answer_keyexchange: bad client public key [preauth]
show less
DDoS Attack
Port Scan
Brute-Force
Bad Web Bot
Exploited Host
SSH
Hacking
Mar 12 23:45:10 srv-prod sshd[15201]: Connection from 139.99.38.79 port 48290 on 10.0.1.15 port 22
...
show moreMar 12 23:45:10 srv-prod sshd[15201]: Connection from 139.99.38.79 port 48290 on 10.0.1.15 port 22
Mar 12 23:45:10 srv-prod sshd[15202]: Connection from 139.99.38.79 port 48291 on 10.0.1.15 port 22
Mar 12 23:45:11 srv-prod sshd[15203]: Connection from 139.99.38.79 port 48292 on 10.0.1.15 port 22
Mar 12 23:45:11 srv-prod sshd[15204]: Connection from 139.99.38.79 port 48293 on 10.0.1.15 port 22
Mar 12 23:45:15 srv-prod sshd[15201]: error: kex_protocol_error: type 30 [preauth]
Mar 12 23:45:15 srv-prod sshd[15202]: error: kex_protocol_error: type 30 [preauth]
Mar 12 23:45:20 srv-prod sshd[15210]: drop connection #10 from [139.99.38.79]:48305 on [10.0.1.15]:22 past MaxStartups
Mar 12 23:45:25 srv-prod sshd[15215]: Connection closed by authenticating user root 139.99.38.79 port 48310 [preauth]
Mar 12 23:45:30 srv-prod kernel: [9124.55] [INFO] sshd[15201] is using high CPU (98.2%) in KEX phase
Mar 12 23:45:32 srv-prod sshd[15220]: fatal: mm_answer_keyexchange: bad client public key [preauth]
show less
DDoS Attack
Port Scan
Exploited Host
SSH
Anonymous
Mar 12 23:40:01 srv-prod sshd[12840]: Connection from 139.99.38.79 port 59001 on 10.0.1.15 port 22
...
show moreMar 12 23:40:01 srv-prod sshd[12840]: Connection from 139.99.38.79 port 59001 on 10.0.1.15 port 22
Mar 12 23:40:05 srv-prod sshd[12845]: Connection from 139.99.38.79 port 59002 on 10.0.1.15 port 22
Mar 12 23:40:10 srv-prod sshd[12850]: Connection from 139.99.38.79 port 59003 on 10.0.1.15 port 22
Mar 12 23:40:40 srv-prod sshd[12840]: error: Beginning identification string timeout for 139.99.38.79
Mar 12 23:40:45 srv-prod sshd[12845]: error: Beginning identification string timeout for 139.99.38.79
Mar 12 23:41:02 srv-prod sshd[12860]: Connection from 139.99.38.79 port 59010 on 10.0.1.15 port 22
Mar 12 23:41:05 srv-prod sshd[12861]: Connection from 139.99.38.79 port 59011 on 10.0.1.15 port 22
Mar 12 23:41:10 srv-prod sshd[12870]: drop connection #10 from [139.99.38.79]:59015 on [10.0.1.15]:22 past MaxStartups
Mar 12 23:41:15 srv-prod sshd[12875]: drop connection #11 from [139.99.38.79]:59020 on [10.0.1.15]:22 past MaxStartups
show less
DDoS Attack
Port Scan
Brute-Force
Exploited Host
SSH
Hacking
Mar 13 00:05:12 srv-prod kernel: [7210.12] net_ratelimit: 4520 callbacks suppressed
Mar 13 00:05:12 ...
show moreMar 13 00:05:12 srv-prod kernel: [7210.12] net_ratelimit: 4520 callbacks suppressed
Mar 13 00:05:12 srv-prod kernel: [7210.12] [FWD_IN_DROP] IN=eth0 OUT= MAC=... SRC=139.99.38.79 DST=10.0.1.15 LEN=40 TOS=0x00 PREC=0x00 TTL=114 ID=54321 PROTO=TCP SPT=55201 DPT=22 WINDOW=65535 RES=0x00 SYN URGP=0
Mar 13 00:05:12 srv-prod kernel: [7210.13] [FWD_IN_DROP] IN=eth0 OUT= MAC=... SRC=139.99.38.79 DST=10.0.1.15 LEN=40 TOS=0x00 PREC=0x00 TTL=114 ID=54322 PROTO=TCP SPT=55202 DPT=22 WINDOW=65535 RES=0x00 SYN URGP=0
Mar 13 00:05:12 srv-prod kernel: [7210.13] [FWD_IN_DROP] IN=eth0 OUT= MAC=... SRC=139.99.38.79 DST=10.0.1.15 LEN=40 TOS=0x00 PREC=0x00 TTL=114 ID=54323 PROTO=TCP SPT=55203 DPT=22 WINDOW=65535 RES=0x00 SYN URGP=0
Mar 13 00:05:12 srv-prod kernel: [7210.14] irq 16: qed_int: spurious interrupt (100001 events)
Mar 13 00:05:13 srv-prod kernel: [7211.01] CPU0: Core temperature above threshold, cpu clock throttled
Mar 13 00:05:14 srv-prod kernel: [7212.45] bond0: link status definitely down, disabling interface
show less
DDoS Attack
Port Scan
Brute-Force
Exploited Host
SSH
Anonymous
Mar 12 23:55:01 srv-prod sshd[35100]: Invalid user postgres from 139.99.38.79 port 58210
Mar 12 23: ...
show moreMar 12 23:55:01 srv-prod sshd[35100]: Invalid user postgres from 139.99.38.79 port 58210
Mar 12 23:55:01 srv-prod sshd[35101]: Invalid user oracle from 139.99.38.79 port 58212
Mar 12 23:55:01 srv-prod sshd[35102]: Invalid user mysql from 139.99.38.79 port 58214
Mar 12 23:55:01 srv-prod sshd[35103]: Invalid user test from 139.99.38.79 port 58216
Mar 12 23:55:02 srv-prod sshd[35104]: Invalid user webmaster from 139.99.38.79 port 58218
Mar 12 23:55:02 srv-prod systemd-journald[450]: Suppressed 8420 messages from /system.slice/ssh.service
Mar 12 23:55:02 srv-prod sshd[35110]: Received disconnect from 139.99.38.79 port 58220:11: Bye Bye [preauth]
Mar 12 23:55:02 srv-prod sshd[35111]: Disconnected from authenticating user root 139.99.38.79 port 58222 [preauth]
Mar 12 23:55:03 srv-prod systemd-journald[450]: Suppressed 12100 messages from /system.slice/ssh.service
Mar 12 23:55:05 srv-prod kernel: [6012.44] EXT4-fs (sda1): error: remounting filesystem read-only
show less
DDoS Attack
Brute-Force
Exploited Host
Showing 1 to
15
of 19 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown 🚩