94.156.131.120: 2026-10-20 19:02.Categories: Port Scan, Hacking.
Comment: Port scanning
2026-10-20 13:00.Categories: Port Scan.
Comment: Unauthorized connection attempt from IP address 94.156.131.120 on Port 3389(RDP)
2026-10-20 12:00.Categories: Port Scan.
Comment: Blocked by UFW [3389/tcp] | SPT: 50539 | TTL: 249 | LEN: 40 | TOS: 0x00 • Reported by: github.com/sefinek/UFW-AbuseIPDB-Reporter
2026-10-20 07:17.Categories: Port Scan.
Comment: Blocked by firewall on hugin [3389/tcp] | Rule: AbuseIPDB | SPT: 50539 | TTL: 246 | LEN: 40 | TOS: 0x00 • Reported by: github.com/sefinek/UFW-AbuseIPDB-Reporter
2026-10-20 06:04.Categories: Port Scan, Brute-Force.
Comment: T-Pot honeypot: 4 hits on ports 3389
2026-10-20 05:46.Categories: Port Scan.
Comment: Blocked by firewall on hugin [3389/tcp] | Rule: AbuseIPDB | SPT: 50539 | TTL: 249 | LEN: 40 | TOS: 0x00 • Reported by: github.com/sefinek/UFW-AbuseIPDB-Reporter
2026-10-20 05:42.Categories: Email Spam, Port Scan.
Comment: connection to honeypot
2026-10-20 04:19.Categories: Port Scan, Hacking, Brute-Force.
Comment: Blocked by UFW (TCP on 3389) Source port: 50539 TTL: 247 Packet length: 40 TOS: 0x00 This report (for 94.156.131.120) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter
2026-10-20 03:45.Categories: Port Scan, Hacking, Brute-Force.
Comment: Attempt on port 3389 (RDP) – potential remote access / brute-force attempt. Blocked by firewall (unsolicited inbound, no prior outbound connection). 2 attempts observed within the last 24h. Ports targeted: 22, 3389.
2026-10-20 03:11.Categories: Port Scan.
Comment: [UFW SCAN!!!!] SRC=94.156.131.120 LEN=40 TOS=0x00 PREC=0x00 TTL=244 PROTO=TCP SPT=50539 DPT=3389 WINDOW=1024 RES=0x00 SYN URGP=0 …
2026-10-20 01:39.Categories: Port Scan.
Comment: Illegal port scans
2026-10-20 01:23.Categories: Port Scan.
Comment: Oct 20 03:23:20 sthoyer kernel: [IPTables-Block] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd:10:f7:08:00 SRC=94.156.131.120 DST=173.212.223.67 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=4223 PROTO=TCP SPT=50539 DPT=3389 WINDOW=1024 RES=0x00 SYN URGP=0 …
2026-10-20 01:12.Categories: Port Scan.
Comment: FW-PortScan: Traffic Blocked srcport=50539 dstport=3389
2026-10-19 23:54.Categories: Port Scan.
Comment: PortscanT
2026-10-19 23:12.Categories: Port Scan.
Comment: PortScan: TCP/3389
2026-10-18 14:45.Categories: Brute-Force.
Comment: Real-time Intercept: RDP attack. Reference: 2026-10-18 17:45:46.6928 Login failure: 94.156.131.120 RDP 2 14
2026-10-18 09:09.Categories: Hacking.
Comment: Auto-blocked by Seczar SecureOps — High-Risk Port Probe (admin-managed entries) — RDP (13 events in 5min) at 2026-10-18 09:09
2026-10-18 08:57.Categories: Web App Attack.
Comment: Auto-blocked by Seczar SecureOps — High-Risk Port Probe (admin-managed entries) — RDP (10 events in 5min) at 2026-10-18 08:57
2026-10-18 00:22.Categories: Port Scan.
Comment: portscan on multiple TCP ports : Firewall: Within 2026-09-29 00:59:05 – 2026-10-15 03:19:03 CEST(+0200) identified: unallowed access from 94.156.131.120/32 on uncommon port/s: 22(ssh),3389(ms-wbt-server) (2 trials) Fail2ban: Within 2026-10-14 01:31:56 – 2026-10-15 03:19:03 CEST(+0200) banned: 6 times by fail2ban[firewall]; 6 times by fail2ban[recidive]
2026-10-17 20:19.Categories: Port Scan.
Comment: Illegal port scans
2026-10-17 20:17.Categories: Port Scan.
Comment: 3389/tcp (1 or more attempts)
2026-10-17 19:45.Categories: Brute-Force.
Comment: RDP (Windows Remote Desktop) Brute-force detected.
2026-10-17 19:08.Categories: Port Scan, Hacking, Brute-Force.
Comment: Blocked by UFW [3389/tcp] Source port: 42960 TTL: 248 Packet length: 40
2026-10-17 18:56.Categories: Port Scan.
Comment: tcp/3389
2026-10-15 13:44.Categories: Brute-Force.
Comment: ICS Labs threat intelligence (ICS Feeds): Brute-Force. Last observed 2026-10-15 UTC.
2026-10-15 04:11.Categories: Email Spam, Port Scan.
Comment: connection to honeypot
2026-10-15 03:43.Categories: Port Scan, Hacking, SSH.
Comment: FW-PortScan: Traffic Blocked srcport=44667 dstport=22
2026-10-15 03:42.Categories: Port Scan, SSH.
Comment: F2B – Malicious activity detected. Unauthorized connection attempt: SSH. -c0423ad6-
2026-10-15 03:21.Categories: Port Scan.
Comment: [UFW SCAN!!!!] SRC=94.156.131.120 LEN=40 TOS=0x00 PREC=0x00 TTL=244 PROTO=TCP SPT=44667 DPT=22 WINDOW=1024 RES=0x00 SYN URGP=0 …
2026-10-15 02:41.Categories: Port Scan, Brute-Force, SSH.
Comment: T-Pot honeypot: 5 hits on ports 22
2026-10-15 01:19.Categories: DDoS Attack Participating, Port Scan, Brute-Force, SSH.
Comment: fail2ban:firewall:2026-10-15T02:56:13.129455+02:00 firewall: filter IN= OUT= MAC= SRC=94.156.131.120 DST= LEN=40 TOS=0x00 PREC=0x00 TTL=248 ID=4722 PROTO=TCP SPT=44667 DPT=22 WINDOW=1024 RES=0x00 SYN URGP=0 2026-10-15T03:19:03.233633+02:00 firewall: filter IN= OUT= MAC= SRC=94.156.131.120 DST= LEN=40 TOS=0x00 PREC=0x00 TTL=248 ID=27569 PROTO=TCP SPT=44667 DPT=22 WINDOW=1024 RES=0x00 SYN URGP=0
2026-10-14 23:28.Categories: Port Scan, Hacking.
Comment: Port Scan on Honeypot | Ports: 22/SSH | Proto: TCP(1) | Flags: all SYN | TTL: 248 | Len: 44B | Win: 1024(1) | rDNS: 464248.vm.spacecore.network | F2B/ufw-honeypot@2026-10-14T23:28:17Z
2026-10-14 23:07.Categories: Port Scan, SSH.
Comment: F2B – Malicious activity detected. Unauthorized connection attempt: SSH. -151302cd-
2026-10-14 22:23.Categories: SSH, Port Scan.
Comment: SSH trap triggered on port 22
2026-10-14 22:20.Categories: Brute-Force, Port Scan, SSH.
Comment: Unauthorized connection attempt detected, SSH Brute-Force
2026-10-14 22:15.Categories: Port Scan, SSH.
Comment: F2B – Malicious activity detected. Unauthorized connection attempt: SSH. -8ff06ede-
2026-10-14 22:01.Categories: Port Scan.
Comment: [hp-100] 2 unsolicited packets to honeypot ports 3389,22 (OCI DShield sensor)
2026-10-14 21:45.Categories: Port Scan.
Comment: Oct 14 23:45:37 sthoyer kernel: [IPTables-Block] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd:10:f7:08:00 SRC=94.156.131.120 DST=173.212.223.67 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=27876 PROTO=TCP SPT=44667 DPT=22 WINDOW=1024 RES=0x00 SYN URGP=0 …
2026-10-14 21:15.Categories: Port Scan, SSH.
Comment: F2B – Malicious activity detected. Unauthorized connection attempt: SSH. -c23856ef-
2026-10-14 19:07.Categories: Port Scan, SSH.
Comment: Blocked by UFW [22/tcp] | SPT: 44667 | TTL: 247 | LEN: 40 | TOS: 0x00 • Reported by: github.com/sefinek/UFW-AbuseIPDB-Reporter
2026-10-14 18:54.Categories: Port Scan, Hacking.
Comment: Port scanning
2026-10-14 03:00.Categories: Port Scan.
Comment: Unauthorized connection attempt from IP address 94.156.131.120 on Port 3389(RDP)
2026-10-14 02:55.Categories: Email Spam, Port Scan.
Comment: connection to honeypot
2026-10-14 02:45.Categories: Port Scan, Hacking, Brute-Force.
Comment: Attempt on port 3389 (RDP) – potential remote access / brute-force attempt. Blocked by firewall (unsolicited inbound, no prior outbound connection).
2026-10-14 02:13.Categories: Port Scan, Hacking.
Comment: Port Scan on Honeypot | Ports: 3389/RDP | Proto: TCP(1) | Flags: all SYN | TTL: 246 | Len: 44B | Win: 1024(1) | rDNS: 464248.vm.spacecore.network | F2B/ufw-honeypot@2026-10-14T02:13:13Z
2026-10-14 02:00.Categories: Port Scan, Hacking.
Comment: denied traffic to a honeypot network. destination port 3389.
2026-10-14 01:40.Categories: Port Scan.
Comment: 2026-10-14T03:40:16.643357+02:00 vmi2775508 kernel: [UFW BLOCK] IN=eth0 OUT= MAC=00:50:56:5c:a7:cf:c0:69:11:b3:85:db:08:00 SRC=94.156.131.120 DST=155.133.26.57 LEN=40 TOS=0x00 PREC=0x00 TTL=245 ID=11200 PROTO=TCP SPT=58715 DPT=3389 WINDOW=1024 RES=0x00 SYN URGP=0 …
2026-10-14 01:28.Categories: Port Scan.
Comment: Blocked by firewall on hugin [3389/tcp] | Rule: UFW | SPT: 58715 | TTL: 246 | LEN: 40 | TOS: 0x00 • Reported by: github.com/sefinek/UFW-AbuseIPDB-Reporter
2026-10-14 01:13.Categories: Brute-Force, Exploited Host.
Comment: IPS:drop dstport=3389
2026-10-14 01:10.Categories: Port Scan.
Comment: Oct 14 03:10:14 sthoyer kernel: [IPTables-Block] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd:10:f7:08:00 SRC=94.156.131.120 DST=173.212.223.67 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=11694 PROTO=TCP SPT=58715 DPT=3389 WINDOW=1024 RES=0x00 SYN URGP=0 …
2026-10-14 00:56.Categories: Port Scan.
Comment: FW-PortScan: Traffic Blocked srcport=58715 dstport=3389
2026-10-14 00:29.Categories: Port Scan.
Comment: Blocked by firewall on hugin [3389/tcp] | Rule: UFW | SPT: 58715 | TTL: 249 | LEN: 40 | TOS: 0x00 • Reported by: github.com/sefinek/UFW-AbuseIPDB-Reporter
2026-10-14 00:07.Categories: Port Scan.
Comment: [UFW SCAN!!!!] SRC=94.156.131.120 LEN=40 TOS=0x00 PREC=0x00 TTL=244 PROTO=TCP SPT=58715 DPT=3389 WINDOW=1024 RES=0x00 SYN URGP=0 …
2026-10-13 23:45.Categories: Port Scan.
Comment: PortscanT
2026-10-13 21:48.Categories: Port Scan.
Comment: Illegal port scans
2026-10-13 21:10.Categories: Port Scan, Hacking.
Comment: Port Scan on Honeypot | Ports: 3389/RDP | Proto: TCP(1) | Flags: all SYN | TTL: 245 | Len: 44B | Win: 1024(1) | rDNS: 464248.vm.spacecore.network | F2B/ufw-honeypot@2026-10-13T21:10:18Z
2026-10-13 20:59.Categories: Port Scan.
Comment: UFW blocked a suspicious connection attempt to a closed or denied port. This activity is commonly associated with port scanning, service discovery, or automated internet probing. Technical: source_ip=94.156.131.120; proto=TCP; source_port=58715; target_port=3389; flags=SYN
2026-10-13 19:34.Categories: Brute-Force, SSH, Port Scan.
Comment: Detected by CrowdSec / Wazuh on Echoserver Hetzner cluster (automated brute-force ban)
2026-10-13 19:32.Categories: Port Scan, Brute-Force.
Comment: T-Pot honeypot: 5 hits on ports 3389
2026-09-30 01:08.Categories: Port Scan, Web App Attack.
Comment: Blocked by UFW [80/tcp] Source port: 56158 TTL: 247 Packet length: 40
2026-09-30 01:07.Categories: Port Scan.
Comment: tcp/80
2026-09-30 00:05.Categories: Port Scan, Hacking.
Comment: Port Scan on Honeypot | Ports: 80/HTTP | Proto: TCP(1) | Flags: all SYN | TTL: 248 | Len: 44B | Win: 1024(1) | rDNS: 464248.vm.spacecore.network | F2B/ufw-honeypot@2026-09-30T00:05:01Z
2026-09-29 23:32.Categories: Port Scan, Hacking.
Comment: Port Scan on Honeypot | Ports: 80/HTTP | Proto: TCP(1) | Flags: all SYN | TTL: 247 | Len: 40B | Win: 1024(1) | rDNS: 464248.vm.spacecore.network | F2B/ufw-honeypot@2026-09-29T23:32:01Z
2026-09-29 23:07.Categories: Port Scan.
Comment: 80/tcp (1 or more attempts)
2026-09-29 18:51.Categories: Port Scan, Hacking.
Comment: Port scanning
2026-09-29 02:00.Categories: Port Scan.
Comment: Unauthorized connection attempt from IP address 94.156.131.120 on Port 3389(RDP)
2026-09-29 01:24.Categories: Port Scan.
Comment: Blocked by firewall on hugin [3389/tcp] | Rule: UFW | SPT: 57597 | TTL: 249 | LEN: 40 | TOS: 0x00 • Reported by: github.com/sefinek/UFW-AbuseIPDB-Reporter
2026-09-29 00:48.Categories: Port Scan, Hacking.
Comment: denied traffic to a honeypot network. destination port 3389.
2026-09-28 23:07.Categories: Port Scan.
Comment: Blocked by firewall on hugin [3389/tcp] | Rule: UFW | SPT: 57597 | TTL: 246 | LEN: 40 | TOS: 0x00 • Reported by: github.com/sefinek/UFW-AbuseIPDB-Reporter
2026-09-28 22:11.Categories: Port Scan.
Comment: Sep 29 00:11:56 sthoyer kernel: [IPTables-Block] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd:10:f7:08:00 SRC=94.156.131.120 DST=173.212.223.67 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=45481 PROTO=TCP SPT=57597 DPT=3389 WINDOW=1024 RES=0x00 SYN URGP=0 …
2026-09-28 21:53.Categories: Port Scan.
Comment: PortScan: TCP/3389
2026-09-28 21:53.Categories: Brute-Force, SSH, Port Scan.
Comment: Detected by CrowdSec / Wazuh on Echoserver Hetzner cluster (automated brute-force ban)
2026-09-28 21:13.Categories: Port Scan.
Comment: Illegal port scans
2026-09-28 21:10.Categories: Port Scan.
Comment: 2026-09-28T23:10:15.419855+02:00 vmi2775508 kernel: [UFW BLOCK] IN=eth0 OUT= MAC=00:50:56:5c:a7:cf:c0:69:11:b3:85:db:08:00 SRC=94.156.131.120 DST=155.133.26.57 LEN=40 TOS=0x00 PREC=0x00 TTL=245 ID=4022 PROTO=TCP SPT=57597 DPT=3389 WINDOW=1024 RES=0x00 SYN URGP=0 …
2026-09-28 20:22.Categories: Port Scan.
Comment: Network service scanning detected by FortiGate; source quarantined.
2026-09-28 20:17.Categories: Port Scan.
Comment: SP-Scan 57597:3389 detected 2026.09.28 22:17:20 blocked until 2026.11.17 14:20:07
2026-09-28 19:50.Categories: Port Scan.
Comment: Heimdallr NIDS: Automatic ban triggered. Reason: TRAP_PORT_HIT (porta 3389)
2026-09-28 19:43.Categories: Port Scan.
Comment: PortscanT
2026-09-28 18:35.Categories: Port Scan, Hacking, Brute-Force.
Comment: Blocked by UFW (TCP on 3389) Source port: 57597 TTL: 247 Packet length: 40 TOS: 0x00 This report (for 94.156.131.120) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter
2026-09-25 18:00.Categories: Port Scan.
Comment: Mass port scanning on a whole network
