1

I just noticed that my syslog, kern log & ufw log have similar enteries, all are filled with blocking IP addresses, here I am only putting some lines from syslog. Can anyone tell what kind of activity is going on here ? Is some one trying to access server without permission ?

Jun 12 06:48:54 myservername kernel: [54265.822092] [UFW BLOCK] IN=eth0 OUT= MAC=04:01:fa:50:b3:01:3c:8a:b0:0d:3f:f0:08:00 SRC=184.105.139.78 DST=my.ser.ver.ip LEN=42 TOS=0x00 PREC=0x00 TTL=59 ID=32866 DF PROTO=UDP SPT=38445 DPT=69 LEN=22 
Jun 12 06:54:35 myservername kernel: [54606.549986] [UFW BLOCK] IN=eth0 OUT= MAC=04:01:fa:50:b3:01:3c:8a:b0:0d:3f:f0:08:00 SRC=118.101.17.53 DST=my.ser.ver.ip LEN=52 TOS=0x00 PREC=0x00 TTL=56 ID=1220 DF PROTO=TCP SPT=35765 DPT=23 WINDOW=14600 RES=0x00 SYN URGP=0 
Jun 12 06:56:07 myservername kernel: [54698.851346] [UFW BLOCK] IN=eth0 OUT= MAC=04:01:fa:50:b3:01:3c:8a:b0:0d:6f:f0:08:00 SRC=122.3.85.251 DST=my.ser.ver.ip LEN=60 TOS=0x00 PREC=0x00 TTL=56 ID=9255 DF PROTO=TCP SPT=58323 DPT=23 WINDOW=5808 RES=0x00 SYN URGP=0 
Jun 12 06:56:28 myservername kernel: [54719.844352] [UFW BLOCK] IN=eth0 OUT= MAC=04:01:fa:50:b3:01:3c:8a:b0:0d:6f:f0:08:00 SRC=122.3.85.251 DST=my.ser.ver.ip LEN=60 TOS=0x00 PREC=0x00 TTL=56 ID=9258 DF PROTO=TCP SPT=58323 DPT=23 WINDOW=5808 RES=0x00 SYN URGP=0 
Jun 12 06:57:16 myservername kernel: [54767.431166] [UFW BLOCK] IN=eth0 OUT= MAC=04:01:fa:50:b3:01:3c:8a:b0:0d:3f:f0:08:00 SRC=14.169.232.99 DST=my.ser.ver.ip LEN=29 TOS=0x00 PREC=0x00 TTL=50 ID=44305 DF PROTO=UDP SPT=46454 DPT=53413 LEN=9 
Jun 12 06:57:18 myservername kernel: [54769.427951] [UFW BLOCK] IN=eth0 OUT= MAC=04:01:fa:50:b3:01:3c:8a:b0:0d:3f:f0:08:00 SRC=14.169.232.99 DST=my.ser.ver.ip LEN=29 TOS=0x00 PREC=0x00 TTL=50 ID=44306 DF PROTO=UDP SPT=46454 DPT=53413 LEN=9 
Jun 12 07:05:00 myservername kernel: [55231.882804] [UFW BLOCK] IN=eth0 OUT= MAC=04:01:fa:50:b3:01:3c:8a:b0:0d:3f:f0:08:00 SRC=188.36.0.150 DST=my.ser.ver.ip LEN=52 TOS=0x00 PREC=0x00 TTL=51 ID=62193 DF PROTO=TCP SPT=59285 DPT=23 WINDOW=14600 RES=0x00 SYN URGP=0 
Jun 12 07:06:06 myservername kernel: [55297.871881] [UFW BLOCK] IN=eth0 OUT= MAC=04:01:fa:50:b3:01:3c:8a:b0:0d:3f:f0:08:00 SRC=181.29.79.38 DST=my.ser.ver.ip LEN=52 TOS=0x02 PREC=0x00 TTL=45 ID=12680 DF PROTO=TCP SPT=52294 DPT=23 WINDOW=14600 RES=0x00 SYN URGP=0 
Jun 12 07:09:03 myservername kernel: [55474.598492] [UFW BLOCK] IN=eth0 OUT= MAC=04:01:fa:50:b3:01:3c:8a:b0:0d:3f:f0:08:00 SRC=185.94.111.1 DST=my.ser.ver.ip LEN=28 TOS=0x00 PREC=0x00 TTL=243 ID=54321 PROTO=UDP SPT=51929 DPT=17 LEN=8 b0:0d:6f:f0:08:00 SRC=188.214.128.22 DST=my.ser.ver.ip LEN=431 TOS=0x00 PREC=0x00 TTL=51 ID=0 DF PROTO=UDP SPT=6459 DPT=5060 LEN=411 
Jun 12 07:09:56 myservername kernel: [55527.386590] [UFW BLOCK] IN=eth0 OUT= MAC=04:01:fa:50:b3:01:3c:8a:b0:0d:3f:f0:08:00 SRC=88.248.173.76 DST=my.ser.ver.ip LEN=60 TOS=0x00 PREC=0x00 TTL=48 ID=63734 DF PROTO=TCP SPT=46480 DPT=23 WINDOW=5808 RES=0x00 SYN URGP=0 
Jun 12 07:09:59 myservername kernel: [55530.344008] [UFW BLOCK] IN=eth0 OUT= MAC=04:01:fa:50:b3:01:3c:8a:b0:0d:3f:f0:08:00 SRC=88.248.173.76 DST=my.ser.ver.ip LEN=60 TOS=0x00 PREC=0x00 TTL=48 ID=63735 DF PROTO=TCP SPT=46480 DPT=23 WINDOW=5808 RES=0x00 SYN URGP=0 
Jun 12 07:11:01 myservername kernel: [55592.482239] [UFW BLOCK] IN=eth0 OUT= MAC=04:01:fa:50:b3:01:3c:8a:b0:0d:3f:f0:08:00 SRC=91.229.52.67 DST=my.ser.ver.ip LEN=52 TOS=0x00 PREC=0x00 TTL=50 ID=9704 DF PROTO=TCP SPT=54204 DPT=23 WINDOW=14600 RES=0x00 SYN URGP=0 

logs are keep on filling, just to put some of the ip addresses in SRC from logs:

116.102.232.245
78.189.90.35
184.105.247.211
85.96.174.23
91.200.12.123
116.5.103.204
209.126.120
180.97.239.30
62.38.251.88
119.82.252.71
184.105.139.78
46.43.111.187
1.53.1.9
116.102.232.245
207.244.70.169
139.162.32.199
81.17.21.218
59.94.217.136
187.22.126.42
95.77.132.106

DPT varies from 23, 53413 , 523 , 1433 , 5060, 3306 , 2425 1080 etc. 23 & 53413 are most repeatedly appearing in the logs.

1

Welcome to Internet !!

That is someone is DDOS-ing to your IP address on various ports and trying to find an insecured port they can leverage. From the logs i can see various IP addresses with various ports e.g. 17 (qotd), 23 (telnet), 69 (tftp) and probably many more.

Good thing is, all the attacks are being blocked by the firewall, at least it is clear from the chunk you have provided. Make sure by going through the logs in full.

If you do not have any unnecessary service running, and all the running services are secured properly, you have nothing much to worry. This is normal in todays world, most of the days i get them too.

Also note that, its a good idea to ensure rate limiting by using something like fail2ban. At least, make sure that the native security measures for all the services are in place.

1
  • thanks @heemayl, I knew my website is few days old so it can't be people ;) . I just googled what DDOS is , 'll further find some steps to protect against DDOS attack. – lawsome Jun 12 '16 at 9:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.