165.232.104.25

2026-10-19T03:48:33.901251+03:00 6kw kernel: [UFW BLOCK] IN=eth0 OUT= MAC=00:16:3e:b6:e7:09:78:9a:18:bd:57:7e:08:00 SRC=165.232.104.25 DST=5.61.88.83 LEN=44 TOS=0x00 PREC=0x00 TTL=241 ID=63179 PROTO=TCP SPT=61009 DPT=8090 WINDOW=1025 RES=0x00 SYN URG ... show more 2026-10-19T03:48:33.901251+03:00 6kw kernel: [UFW BLOCK] IN=eth0 OUT= MAC=00:16:3e:b6:e7:09:78:9a:18:bd:57:7e:08:00 SRC=165.232.104.25 DST=5.61.88.83 LEN=44 TOS=0x00 PREC=0x00 TTL=241 ID=63179 PROTO=TCP SPT=61009 DPT=8090 WINDOW=1025 RES=0x00 SYN URGP=0 ... show less

GET /%3f%0apizza:pizza=pizza/wp-admin HTTP/1.1

Jul 16 04:19:02 165.232.104.25 TCP SPT=46339 DPT=12124 SYN Jul 16 04:19:04 165.232.104.25 TCP SPT=46339 DPT=64551 SYN Jul 16 04:19:06 165.232.104.25 TCP SPT=46339 DPT=24459 ...

Automated trigger via Nginx Police. Reason: IP-SCANNER

Jun 28 03:56:19 165.232.104.25 TCP SPT=40573 DPT=13841 SYN Jun 28 03:56:35 165.232.104.25 TCP SPT=40573 DPT=50963 SYN Jun 28 03:56:36 165.232.104.25 TCP SPT=40589 DPT=57852 ...

(mod_security) mod_security (id:210492) triggered by 165.232.104.25 (prod-mendelevium-lon1-2.do.binaryedge.ninja): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 21:48:01.133704 2026] [security2:error] [pid 2794 ... show more (mod_security) mod_security (id:210492) triggered by 165.232.104.25 (prod-mendelevium-lon1-2.do.binaryedge.ninja): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 21:48:01.133704 2026] [security2:error] [pid 27946:tid 27946] [client 165.232.104.25:43172] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.openmolecules.org"] [uri "/.env"] [unique_id "aiy20fpVbQMLOceR5QdM7gAAAAU"] show less

Jun 9 08:36:44 165.232.104.25 TCP SPT=55802 DPT=24057 SYN Jun 9 08:36:44 165.232.104.25 TCP SPT=55818 DPT=44790 SYN Jun 9 08:36:49 165.232.104.25 TCP SPT=55818 DPT=41885 ...

list.rtbh.com.tr report: tcp/0

list.rtbh.com.tr report: tcp/0

Failed 10 attempts using usernames: postgres, oracle, user, vps, testuser, server, hadoop, git, deploy and test

Fail2Ban

2026-02-27T19:04:50.066377+00:00 ubuntu-hpe-gen8 sshd[2833563]: Invalid user postgres from 165.232.104.25 port 50666 2026-02-27T19:05:31.094331+00:00 ubuntu-hpe-gen8 sshd[2833669]: Invalid user oracle from 165.232.104.25 port 60712 2026-02-27T19:06:1 ... show more 2026-02-27T19:04:50.066377+00:00 ubuntu-hpe-gen8 sshd[2833563]: Invalid user postgres from 165.232.104.25 port 50666 2026-02-27T19:05:31.094331+00:00 ubuntu-hpe-gen8 sshd[2833669]: Invalid user oracle from 165.232.104.25 port 60712 2026-02-27T19:06:10.267323+00:00 ubuntu-hpe-gen8 sshd[2833732]: Invalid user user from 165.232.104.25 port 59570 2026-02-27T19:06:49.227083+00:00 ubuntu-hpe-gen8 sshd[2833805]: Invalid user vps from 165.232.104.25 port 45398 2026-02-27T19:07:29.536432+00:00 ubuntu-hpe-gen8 sshd[2833881]: Invalid user testuser from 165.232.104.25 port 56258 ... show less

2026-02-27T19:04:46.491421+00:00 becker-software sshd[65259]: Invalid user postgres from 165.232.104.25 port 56070 2026-02-27T19:05:27.777582+00:00 becker-software sshd[65695]: Invalid user oracle from 165.232.104.25 port 53772 2026-02-27T19:06:06.88 ... show more 2026-02-27T19:04:46.491421+00:00 becker-software sshd[65259]: Invalid user postgres from 165.232.104.25 port 56070 2026-02-27T19:05:27.777582+00:00 becker-software sshd[65695]: Invalid user oracle from 165.232.104.25 port 53772 2026-02-27T19:06:06.889529+00:00 becker-software sshd[66063]: Invalid user user from 165.232.104.25 port 57102 2026-02-27T19:06:45.846106+00:00 becker-software sshd[66316]: Invalid user vps from 165.232.104.25 port 37246 2026-02-27T19:07:26.258905+00:00 becker-software sshd[66700]: Invalid user testuser from 165.232.104.25 port 60194 ... show less

Feb 27 20:04:38 srv2 sshd[3098376]: Invalid user postgres from 165.232.104.25 port 56054 Feb 27 20:05:19 srv2 sshd[3098514]: Invalid user oracle from 165.232.104.25 port 46138 Feb 27 20:05:59 srv2 sshd[3098535]: Invalid user user from 165.232.104.25 ... show more Feb 27 20:04:38 srv2 sshd[3098376]: Invalid user postgres from 165.232.104.25 port 56054 Feb 27 20:05:19 srv2 sshd[3098514]: Invalid user oracle from 165.232.104.25 port 46138 Feb 27 20:05:59 srv2 sshd[3098535]: Invalid user user from 165.232.104.25 port 38564 Feb 27 20:06:38 srv2 sshd[3098572]: Invalid user vps from 165.232.104.25 port 36788 Feb 27 20:07:17 srv2 sshd[3098647]: Invalid user testuser from 165.232.104.25 port 51310 ... show less

Honeypot hit: Brute-force attack detected on 22/SSH • Credentials: root:root, root:root123, root:root321, root:123, root:321, root:pass, root:qwerty, root:password, root:111111, postgres:postgres, oracle:oracle • Number of login attempts: 11 • 8 comm ... show more Honeypot hit: Brute-force attack detected on 22/SSH • Credentials: root:root, root:root123, root:root321, root:123, root:321, root:pass, root:qwerty, root:password, root:111111, postgres:postgres, oracle:oracle • Number of login attempts: 11 • 8 command(s) were executed during the session • Client: SSH-2.0-Go show less