52.159.229.165

denied traffic to a non-approved destination port. destination port 21.

21/tcp (1 or more attempts)

Fetched browser challenge page 10 times in <2h without solving. Likely bad bot.

Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was hijacked and held in a tarpit to slow down the scan. Probed target: cp.cloudflare.com:443

Spring.Boot.Actuator.Unauthorized.Access

Unauthorized connection attempt

2026-06-14T15:54:15.002620+03:00 6kw kernel: [UFW BLOCK] IN=eth0 OUT= MAC=00:16:3e:b6:e7:09:78:9a:18:bd:57:7e:08:00 SRC=52.159.229.165 DST=5.61.88.83 LEN=60 TOS=0x00 PREC=0x00 TTL=41 ID=353 DF PROTO=TCP SPT=25670 DPT=3000 WINDOW=64240 RES=0x00 SYN UR ... show more 2026-06-14T15:54:15.002620+03:00 6kw kernel: [UFW BLOCK] IN=eth0 OUT= MAC=00:16:3e:b6:e7:09:78:9a:18:bd:57:7e:08:00 SRC=52.159.229.165 DST=5.61.88.83 LEN=60 TOS=0x00 PREC=0x00 TTL=41 ID=353 DF PROTO=TCP SPT=25670 DPT=3000 WINDOW=64240 RES=0x00 SYN URGP=0 ... show less

2026-05-28T18:24:15.915789+02:00 machodeer kernel: [2693373.414062] [UFW BLOCK] IN=ens3 OUT= MAC=REDACTED SRC=52.159.229.165 DST=REDACTED LEN=40 TOS=0x00 PREC=0x00 TTL=105 ID=1 DF PROTO=TCP SPT=21504 DPT=443 WINDOW=0 RES=0x00 ACK RST URGP=0 2026-05- ... show more 2026-05-28T18:24:15.915789+02:00 machodeer kernel: [2693373.414062] [UFW BLOCK] IN=ens3 OUT= MAC=REDACTED SRC=52.159.229.165 DST=REDACTED LEN=40 TOS=0x00 PREC=0x00 TTL=105 ID=1 DF PROTO=TCP SPT=21504 DPT=443 WINDOW=0 RES=0x00 ACK RST URGP=0 2026-05-28T18:24:17.866260+02:00 machodeer kernel: [2693375.364537] [UFW BLOCK] IN=ens3 OUT= MAC=REDACTED SRC=52.159.229.165 DST=REDACTED LEN=40 TOS=0x00 PREC=0x00 TTL=103 ID=1 DF PROTO=TCP SPT=21505 DPT=443 WINDOW=0 RES=0x00 ACK RST URGP=0 2026-05-28T18:24:19.916613+02:00 machodeer kernel: [2693377.414944] [UFW BLOCK] IN=ens3 OUT= MAC=REDACTED SRC=52.159.229.165 DST=REDACTED LEN=40 TOS=0x00 PREC=0x00 TTL=105 ID=1 DF PROTO=TCP SPT=21506 DPT=443 WINDOW=0 RES=0x00 ACK RST URGP=0 show less

52.159.229.165 - - [12/May/2026:00:22:26 -0500] "CONNECT finance.sina.com.cn:443 HTTP/1.1" 502 488 "-" "Go-http-client/1.1" 52.159.229.165 - - [12/May/2026:00:22:26 -0500] "CONNECT web.ifzq.gtimg.cn:443 HTTP/1.1" 502 488 "-" "Go-http-client/1.1" 52.1 ... show more 52.159.229.165 - - [12/May/2026:00:22:26 -0500] "CONNECT finance.sina.com.cn:443 HTTP/1.1" 502 488 "-" "Go-http-client/1.1" 52.159.229.165 - - [12/May/2026:00:22:26 -0500] "CONNECT web.ifzq.gtimg.cn:443 HTTP/1.1" 502 488 "-" "Go-http-client/1.1" 52.159.229.165 - - [12/May/2026:00:22:26 -0500] "CONNECT proxy.finance.qq.com:443 HTTP/1.1" 502 488 "-" "Go-http-client/1.1" 52.159.229.165 - - [12/May/2026:00:22:26 -0500] "\x16\x03\x01\x05\xd4\x01" 400 392 "-" "-" 52.159.229.165 - - [12/May/2026:00:22:26 -0500] "\x16\x03\x01\x05\xd4\x01" 400 392 "-" "-" ... show less

Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was hijacked and held in a tarpit to slow down the scan. Probed target: www.eastmoney.com:443

list.rtbh.com.tr report: tcp/0

list.rtbh.com.tr report: tcp/0

🚨 CRITICAL: Real-time threat on Cowrie | United States | PhantomGrid Real-time Defense

FFM Nov 11 17:09:10 websrv01 sshd[1749520]: Failed password for root from 52.159.229.165 port 13312 ssh2 Nov 11 17:17:17 websrv01 sshd[1750753]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.159.229.165 u ... show more FFM Nov 11 17:09:10 websrv01 sshd[1749520]: Failed password for root from 52.159.229.165 port 13312 ssh2 Nov 11 17:17:17 websrv01 sshd[1750753]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.159.229.165 user=root Nov 11 17:17:19 websrv01 sshd[1750753]: Failed password for root from 52.159.229.165 port 13312 ssh2 Nov 11 17:19:04 websrv01 sshd[1750823]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.159.229.165 user=root Nov 11 17:19:06 websrv01 sshd[1750823]: Failed password for root from 52.159.229.165 port 13312 ssh2 show less

2025-11-11T11:10:25.209920-05:00 ip-172-31-76-241 sshd[197407]: Connection closed by authenticating user root 52.159.229.165 port 13312 [preauth] 2025-11-11T11:18:23.662190-05:00 ip-172-31-76-241 sshd[246071]: Connection closed by authenticating user ... show more 2025-11-11T11:10:25.209920-05:00 ip-172-31-76-241 sshd[197407]: Connection closed by authenticating user root 52.159.229.165 port 13312 [preauth] 2025-11-11T11:18:23.662190-05:00 ip-172-31-76-241 sshd[246071]: Connection closed by authenticating user root 52.159.229.165 port 13312 [preauth] 2025-11-11T11:23:27.665425-05:00 ip-172-31-76-241 sshd[318046]: Connection closed by authenticating user root 52.159.229.165 port 13312 [preauth] ... show less