95.164.201.145

Honeypot Finding: verified TCP multi-port scan/probing; 6 application-level events across 6 target ports and 6 source port(s). Ports: 2021/service, 2190/service, 5825/service, 8222/service, 9998/service, 13783/service. Sensors: Honeytrap.

2026-11-11T18:58:10.576597-05:00 localhost kernel: [1410357.273347] iptables_INPUT_denied: IN=eth0 OUT= MAC=f2:3c:91:84:83:95:fe:ff:ff:ff:ff:ff:08:00 SRC=95.164.201.145 DST=[mungedIP2] LEN=60 TOS=0x00 PREC=0x00 TTL=57 ID=44484 DF PROTO=TCP SPT=49089 ... show more 2026-11-11T18:58:10.576597-05:00 localhost kernel: [1410357.273347] iptables_INPUT_denied: IN=eth0 OUT= MAC=f2:3c:91:84:83:95:fe:ff:ff:ff:ff:ff:08:00 SRC=95.164.201.145 DST=[mungedIP2] LEN=60 TOS=0x00 PREC=0x00 TTL=57 ID=44484 DF PROTO=TCP SPT=49089 DPT=3260 SEQ=197418427 ACK=0 WINDOW=32760 RES=0x00 SYN URGP=0 OPT (020404EC0402080AD3FF833E0000000001030307) 2026-11-11T18:58:10.877735-05:00 localhost kernel: [1410357.317431] iptables_INPUT_denied: IN=eth0 OUT= MAC=f2:3c:91:84:83:95:fe:ff:ff:ff:ff:ff:08:00 SRC=95.164.201.145 DST=[mungedIP2] LEN=60 TOS=0x00 PREC=0x00 TTL=57 ID=49368 DF PROTO=TCP SPT=45827 DPT=2602 SEQ=479034624 ACK=0 WINDOW=32760 RES=0x00 SYN URGP=0 OPT (020404EC0402080AD3FF839B0000000001030307) 2026-11-11T18:58:11.942283-05:00 localhost kernel: [1410358.268262] iptables_INPUT_denied: IN=eth0 OUT= MAC=f2:3c:91:84:83:95:fe:ff:ff:ff:ff:ff:08:00 SRC=95.164.201.145 DST=[mungedIP2] LEN=60 TOS=0x00 PREC=0x00 TTL=57 ID=44485 DF PROTO=TCP SPT=49089 DPT=3260 SEQ=197418427 ACK=0 WINDOW=32760 RES=0x00 SYN show less

Honeypot Finding: verified TCP multi-port scan/probing; 8 application-level events across 8 target ports and 8 source port(s). Ports: 1455/service, 1533/service, 3168/service, 5440/service, 8022/service, 9101/service, 56738/service, 64680/service. Se ... show more Honeypot Finding: verified TCP multi-port scan/probing; 8 application-level events across 8 target ports and 8 source port(s). Ports: 1455/service, 1533/service, 3168/service, 5440/service, 8022/service, 9101/service, 56738/service, 64680/service. Sensors: Honeytrap. show less

Blocked by UFW firewall

Honeypot Finding: repeated TCP service probing on TCP/3000 (HTTP/API); 56 application-level events across 56 source port(s). Sensor(s): Honeyaml.

Honeypot Finding: repeated TCP service probing on TCP/3000 (HTTP/API); 40 application-level events across 40 source port(s). Sensor(s): Honeyaml.

Honeypot Finding: verified TCP multi-port scan/probing; 7 application-level events across 7 target ports and 6 source port(s). Ports: 3000/HTTP/API, 3001/service, 8000/service, 8001/service, 8081/HTTP, 8888/service, 9000/service. Sensors: Honeytrap, ... show more Honeypot Finding: verified TCP multi-port scan/probing; 7 application-level events across 7 target ports and 6 source port(s). Ports: 3000/HTTP/API, 3001/service, 8000/service, 8001/service, 8081/HTTP, 8888/service, 9000/service. Sensors: Honeytrap, Honeyaml. show less

Port scan / reconnaissance probe on closed infrastructure service ports. Log: 2026-10-14T22:41:35.881381+00:00 XRM-00 kernel: [1487666.292146] [TRAP:HONEYPORT] IN=eth0 OUT= MAC=REDACTED SRC=95.164.201.145 DST=REDACTED LEN=60 TOS=0x00 PREC=0x00 TTL=52 ... show more Port scan / reconnaissance probe on closed infrastructure service ports. Log: 2026-10-14T22:41:35.881381+00:00 XRM-00 kernel: [1487666.292146] [TRAP:HONEYPORT] IN=eth0 OUT= MAC=REDACTED SRC=95.164.201.145 DST=REDACTED LEN=60 TOS=0x00 PREC=0x00 TTL=52 ID=6489 DF PROTO=TCP SPT=55773 DPT=5000 WINDOW=32760 RES=0x00 SYN URGP=0 ... show less

GlobalProtect login attempts with user [email protected].

Unauthorized VPN login attempts: 1 attempts were recorded from 95.164.201.145 2024-09-07T14:45:40+02:00 vpn Access-Reject 'ondrej.nowak' station: 95.164.201.145 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '< ... show more Unauthorized VPN login attempts: 1 attempts were recorded from 95.164.201.145 2024-09-07T14:45:40+02:00 vpn Access-Reject 'ondrej.nowak' station: 95.164.201.145 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>' show less

Unauthorized VPN login attempts: 1 attempts were recorded from 95.164.201.145 2024-09-07T04:34:23+02:00 vpn Access-Reject 'cauahoj' station: 95.164.201.145 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redac ... show more Unauthorized VPN login attempts: 1 attempts were recorded from 95.164.201.145 2024-09-07T04:34:23+02:00 vpn Access-Reject 'cauahoj' station: 95.164.201.145 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>' show less

Unauthorized VPN login attempts: 4 attempts were recorded from 95.164.201.145 2024-09-06T17:09:32+02:00 vpn Access-Reject <redacted>' station: 95.164.201.145 auth-type: - realm: <redacted> nas: <redacted> called: <redacted> => address-pool: - msg: ' ... show more Unauthorized VPN login attempts: 4 attempts were recorded from 95.164.201.145 2024-09-06T17:09:32+02:00 vpn Access-Reject <redacted>' station: 95.164.201.145 auth-type: - realm: <redacted> nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>' 2024-09-06T17:52:27+02:00 vpn Access-Reject 'xslel06' station: 95.164.201.145 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>' 2024-09-06T18:07:09+02:00 vpn Access-Reject 'kunca' station: 95.164.201.145 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>' 2024-09-06T18:24:52+02:00 vpn Access-Reject 'trezor22' station: 95.164.201.145 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>' show less

Automatic report - Vulnerability scan /RDWeb/Pages/en-US/login.aspx

This IP was involved in an brute force and password spray attack on 2024/09/04 03:30:49

"reason=sslvpn_login_permission_denied"