167.71.44.235

Aggressive web scan

Honeypot Hit: Port Scan (21) FTP

[HOST2] Port Scan detected

Trying ports that it shouldn't be.

[AUTORAVALT][[18/09/2025 - 13:26:45 -03:00 UTC] Attack from [DigitalOcean, LLC] [167.71.44.235] Action: BLocKed DDoS Attack -> Participating in distributed denial-of-service. Phishing -> Phishing websites and/or email. Web Spam -> Comment/forum spam ... show more [AUTORAVALT][[18/09/2025 - 13:26:45 -03:00 UTC] Attack from [DigitalOcean, LLC] [167.71.44.235] Action: BLocKed DDoS Attack -> Participating in distributed denial-of-service. Phishing -> Phishing websites and/or email. Web Spam -> Comment/forum spam, HTTP referer spam, or other CMS spam. Blog Spam -> CMS blog comment spam. Web App Attack -> Attempts to probe f] ... show less

[AUTORAVALT][[18/09/2025 - 13:03:30 -03:00 UTC] Attack from [DigitalOcean, LLC] [167.71.44.235] Action: BLocKed Bad Web Bot -> Webpage scraping (email extraction, content, etc.) crawlers that do not respect robots.txt. Excessive requests and user ag ... show more [AUTORAVALT][[18/09/2025 - 13:03:30 -03:00 UTC] Attack from [DigitalOcean, LLC] [167.71.44.235] Action: BLocKed Bad Web Bot -> Webpage scraping (email extraction, content, etc.) crawlers that do not respect robots.txt. Excessive requests and user agent spoofing. ] ... show less

167.71.44.235 - - [18/Sep/2025:15:47:36 +0000] "\x16\x03\x01\x01$\x01\x00\x01 \x03\x03a\x13Kf\xD4\x9C\xABc\x11\x99\x91biWKN/\x8E\x915\xED}z\xF3=\xA0\x89\x1F\xE3 \xF0\x86 \xAA\x84\xE0W\xEC\x0E\x00\x82\x10>\xFF\xDA\xBF\x97\x1B\x82\x1E\xAA\x01T\x83\xD5N ... show more 167.71.44.235 - - [18/Sep/2025:15:47:36 +0000] "\x16\x03\x01\x01$\x01\x00\x01 \x03\x03a\x13Kf\xD4\x9C\xABc\x11\x99\x91biWKN/\x8E\x915\xED}z\xF3=\xA0\x89\x1F\xE3 \xF0\x86 \xAA\x84\xE0W\xEC\x0E\x00\x82\x10>\xFF\xDA\xBF\x97\x1B\x82\x1E\xAA\x01T\x83\xD5N\xB8\x09\x81\xB4m\x191\xC6x\x00>\x13\x02\x13\x03\x13\x01\xC0,\xC00\x00\x9F\xCC\xA9\xCC\xA8\xCC\xAA\xC0+\xC0/\x00\x9E\xC0$\xC0(\x00k\xC0#\xC0'\x00g\xC0" 400 150 "-" "-" ... show less

1758202589 # Service_probe # SIGNATURE_SEND # source_ip:167.71.44.235 # dst_port:1911 ...

Sep 18 09:32:59 frank postfix/submission/smtpd[611863]: improper command pipelining after CONNECT from unknown[167.71.44.235]: \026\003\003\001\247\001\000\001\243\003\003\367:6?\360\332w\252*\367V\023>\0300\310\024\325M\267\331\224\255o\322e\256\030 ... show more Sep 18 09:32:59 frank postfix/submission/smtpd[611863]: improper command pipelining after CONNECT from unknown[167.71.44.235]: \026\003\003\001\247\001\000\001\243\003\003\367:6?\360\332w\252*\367V\023>\0300\310\024\325M\267\331\224\255o\322e\256\030\336E;p \3534X\265\321\300\361\340\346\252\364\251\276P\347\332:X\177\346\277\254\364px\211\304 \350dx\032\000\212\000\026\0003\000g\300\236\300\242\000\236\0009\000k\300\237\300\243\000\237 Sep 18 09:32:59 frank postfix/submission/smtpd[611863]: improper command pipelining after CONNECT from unknown[167.71.44.235]: \026\003\003\001\247\001\000\001\243\003\003fJ8\003(\b\242<\320\312\3108oU_\360\005\257\031\307ua^La\315\375R^c\356~ \b>S\311v\235\017\216\324\360\301\373eK\253kd\024'v6*\036\tWn*\252\361n\032\361\000\212\000\005\000\004\000\a\000\300\000\204\000\272\000A\000\235\300\241\300\235\000= Sep 18 09:33:00 frank postfix/submission/smtpd[611863]: improper command pipelining after CONNECT from unknown[167.71.44.235]: \026\003\003\001X\00 ... show less

70 port probes: 70x tcp/25 (smtp) [gda]

[13:23] Port scanning. Port(s) scanned: TCP/465

IP banned by Fail2Ban in jail nginx-abusive-ips

Sep 18 12:24:27 mail postfix/submission/smtpd[2691246]: lost connection after STARTTLS from unknown[167.71.44.235] Sep 18 12:24:29 mail postfix/submission/smtpd[2691246]: lost connection after UNKNOWN from unknown[167.71.44.235] ...

[HOST1] Port Scan detected

SMTP AUTH 167.71.44.235 (SMTP_LOGIN_ATTEMPT)