2026-10-14 01:40.Categories: Port Scan.
Comment: 2026-10-14T03:40:16.643357+02:00 vmi2775508 kernel: [UFW BLOCK] IN=eth0 OUT= MAC=00:50:56:5c:a7:cf:c0:69:11:b3:85:db:08:00 SRC=94.156.131.120 DST=155.133.26.57 LEN=40 TOS=0x00 PREC=0x00 TTL=245 ID=11200 PROTO=TCP SPT=58715 DPT=3389 WINDOW=1024 RES=0x00 SYN URGP=0 …
2026-10-14 01:28.Categories: Port Scan.
Comment: Blocked by firewall on hugin [3389/tcp] | Rule: UFW | SPT: 58715 | TTL: 246 | LEN: 40 | TOS: 0x00 • Reported by: github.com/sefinek/UFW-AbuseIPDB-Reporter
2026-10-14 01:13.Categories: Brute-Force, Exploited Host.
Comment: IPS:drop <match> dstport=3389
2026-10-14 01:10.Categories: Port Scan.
Comment: Oct 14 03:10:14 sthoyer kernel: [IPTables-Block] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd:10:f7:08:00 SRC=94.156.131.120 DST=173.212.223.67 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=11694 PROTO=TCP SPT=58715 DPT=3389 WINDOW=1024 RES=0x00 SYN URGP=0 …
2026-10-14 00:56.Categories: Port Scan.
Comment: FW-PortScan: Traffic Blocked srcport=58715 dstport=3389
2026-10-14 00:29.Categories: Port Scan.
Comment: Blocked by firewall on hugin [3389/tcp] | Rule: UFW | SPT: 58715 | TTL: 249 | LEN: 40 | TOS: 0x00 • Reported by: github.com/sefinek/UFW-AbuseIPDB-Reporter
2026-10-14 00:07.Categories: Port Scan.
Comment: [UFW SCAN!!!!] SRC=94.156.131.120 LEN=40 TOS=0x00 PREC=0x00 TTL=244 PROTO=TCP SPT=58715 DPT=3389 WINDOW=1024 RES=0x00 SYN URGP=0 …
2026-10-13 23:45.Categories: Port Scan.
Comment: PortscanT
2026-10-13 21:48.Categories: Port Scan.
Comment: Illegal port scans
2026-10-13 21:10.Categories: Port Scan, Hacking.
Comment: Port Scan on Honeypot | Ports: 3389/RDP | Proto: TCP(1) | Flags: all SYN | TTL: 245 | Len: 44B | Win: 1024(1) | rDNS: 464248.vm.spacecore.network | F2B/ufw-honeypot@2026-10-13T21:10:18Z
2026-10-13 20:59.Categories: Port Scan.
Comment: UFW blocked a suspicious connection attempt to a closed or denied port. This activity is commonly associated with port scanning, service discovery, or automated internet probing. Technical: source_ip=94.156.131.120; proto=TCP; source_port=58715; target_port=3389; flags=SYN
2026-10-13 19:34.Categories: Brute-Force, SSH, Port Scan.
Comment: Detected by CrowdSec / Wazuh on Echoserver Hetzner cluster (automated brute-force ban)
2026-10-13 19:32.Categories: Port Scan, Brute-Force.
Comment: T-Pot honeypot: 5 hits on ports [3389] (automated)
2026-09-30 01:08.Categories: Port Scan, Web App Attack.
Comment: Blocked by UFW [80/tcp] Source port: 56158 TTL: 247 Packet length: 40
2026-09-30 01:07.Categories: Port Scan.
Comment: tcp/80
2026-09-30 00:05.Categories: Port Scan, Hacking.
Comment: Port Scan on Honeypot | Ports: 80/HTTP | Proto: TCP(1) | Flags: all SYN | TTL: 248 | Len: 44B | Win: 1024(1) | rDNS: 464248.vm.spacecore.network | F2B/ufw-honeypot@2026-09-30T00:05:01Z
2026-09-29 23:32.Categories: Port Scan, Hacking.
Comment: Port Scan on Honeypot | Ports: 80/HTTP | Proto: TCP(1) | Flags: all SYN | TTL: 247 | Len: 40B | Win: 1024(1) | rDNS: 464248.vm.spacecore.network | F2B/ufw-honeypot@2026-09-29T23:32:01Z
2026-09-29 23:07.Categories: Port Scan.
Comment: 80/tcp (1 or more attempts)
2026-09-29 18:51.Categories: Port Scan, Hacking.
Comment: Port scanning
2026-09-29 02:00.Categories: Port Scan.
Comment: Unauthorized connection attempt from IP address 94.156.131.120 on Port 3389(RDP)
2026-09-29 01:24.Categories: Port Scan.
Comment: Blocked by firewall on hugin [3389/tcp] | Rule: UFW | SPT: 57597 | TTL: 249 | LEN: 40 | TOS: 0x00 • Reported by: github.com/sefinek/UFW-AbuseIPDB-Reporter
2026-09-29 00:48.Categories: Port Scan, Hacking.
Comment: denied traffic to a honeypot network. destination port 3389.
2026-09-28 23:07.Categories: Port Scan.
Comment: Blocked by firewall on hugin [3389/tcp] | Rule: UFW | SPT: 57597 | TTL: 246 | LEN: 40 | TOS: 0x00 • Reported by: github.com/sefinek/UFW-AbuseIPDB-Reporter
2026-09-28 22:11.Categories: Port Scan.
Comment: Sep 29 00:11:56 sthoyer kernel: [IPTables-Block] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd:10:f7:08:00 SRC=94.156.131.120 DST=173.212.223.67 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=45481 PROTO=TCP SPT=57597 DPT=3389 WINDOW=1024 RES=0x00 SYN URGP=0 …
2026-09-28 21:53.Categories: Port Scan.
Comment: PortScan: TCP/3389
2026-09-28 21:53.Categories: Brute-Force, SSH, Port Scan.
Comment: Detected by CrowdSec / Wazuh on Echoserver Hetzner cluster (automated brute-force ban)
2026-09-28 21:13.Categories: Port Scan.
Comment: Illegal port scans
2026-09-28 21:10.Categories: Port Scan.
Comment: 2026-09-28T23:10:15.419855+02:00 vmi2775508 kernel: [UFW BLOCK] IN=eth0 OUT= MAC=00:50:56:5c:a7:cf:c0:69:11:b3:85:db:08:00 SRC=94.156.131.120 DST=155.133.26.57 LEN=40 TOS=0x00 PREC=0x00 TTL=245 ID=4022 PROTO=TCP SPT=57597 DPT=3389 WINDOW=1024 RES=0x00 SYN URGP=0 …
2026-09-28 20:22.Categories: Port Scan.
Comment: Network service scanning detected by FortiGate; source quarantined.
2026-09-28 20:17.Categories: Port Scan.
Comment: SP-Scan 57597:3389 detected 2026.09.28 22:17:20 blocked until 2026.11.17 14:20:07
2026-09-28 19:50.Categories: Port Scan.
Comment: Heimdallr NIDS: Automatic ban triggered. Reason: TRAP_PORT_HIT (porta 3389)
2026-09-28 19:43.Categories: Port Scan.
Comment: PortscanT
2026-09-28 18:35.Categories: Port Scan, Hacking, Brute-Force.
Comment: Blocked by UFW (TCP on 3389) Source port: 57597 TTL: 247 Packet length: 40 TOS: 0x00 This report (for 94.156.131.120) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter
2026-09-25 18:00.Categories: Port Scan.
Comment: Mass port scanning on a whole network
