Dear Administrator,
We have detected a recent scan probe in our servers. This security incident seems to be originated from an IP address registered to your network.
Here follows the log records regarding such incident.
Timezone in Europe/Moscow (+3).
###start log###
Bruteforce to port 22 from ip 178.63.132.249
2021-06-02 23:10:15 block TCP from 178.63.132.249 to 188.227.58.XXX:22
2021-06-02 23:10:51 block TCP from 178.63.132.249 to 45.138.27.XXX:22
2021-06-02 23:10:13 block TCP from 178.63.132.249 to 188.227.57.XXX:22
2021-06-02 23:10:53 block TCP from 178.63.132.249 to 188.227.57.XXX:22
2021-06-02 23:10:18 block TCP from 178.63.132.249 to 188.227.59.XXX:22
2021-06-02 23:10:47 block TCP from 178.63.132.249 to 45.138.26.XXX:22
2021-06-02 23:10:45 block TCP from 178.63.132.249 to 188.227.59.XXX:22
2021-06-02 23:10:32 block TCP from 178.63.132.249 to 188.227.57.XXX:22
2021-06-02 23:10:20 block TCP from 178.63.132.249 to 188.227.57.XXX:22
2021-06-02 23:10:57 block TCP from 178.63.132.249 to 45.138.26.XXX:22
2021-06-02 23:10:35 block TCP from 178.63.132.249 to 45.138.26.XXX:22
2021-06-02 23:10:53 block TCP from 178.63.132.249 to 188.227.57.XXX:22
2021-06-02 23:10:23 block TCP from 178.63.132.249 to 188.227.58.XXX:22
2021-06-02 23:10:37 block TCP from 178.63.132.249 to 45.138.27.XXX:22
2021-06-02 23:10:10 block TCP from 178.63.132.249 to 45.138.27.XXX:22
2021-06-02 23:10:54 block TCP from 178.63.132.249 to 45.138.27.XXX:22
2021-06-02 23:10:09 block TCP from 178.63.132.249 to 188.227.106.XXX:22
2021-06-02 23:10:44 block TCP from 178.63.132.249 to 188.227.58.XXX:22
2021-06-02 23:10:24 block TCP from 178.63.132.249 to 188.227.58.XXX:22
2021-06-02 23:10:46 block TCP from 178.63.132.249 to 188.227.59.XXX:22
2021-06-02 23:10:43 block TCP from 178.63.132.249 to 45.138.26.XXX:22
2021-06-02 23:10:51 block TCP from 178.63.132.249 to 45.138.27.XXX:22
2021-06-02 23:10:46 block TCP from 178.63.132.249 to 45.138.27.XXX:22
2021-06-02 23:10:55 block TCP from 178.63.132.249 to 188.227.106.XXX:22
2021-06-02 23:10:21 block TCP from 178.63.132.249 to 45.138.27.XXX:22
2021-06-02 23:10:57 block TCP from 178.63.132.249 to 45.138.27.XXX:22
2021-06-02 23:10:17 block TCP from 178.63.132.249 to 188.227.106.XXX:22
2021-06-02 23:10:55 block TCP from 178.63.132.249 to 188.227.59.XXX:22
2021-06-02 23:10:52 block TCP from 178.63.132.249 to 188.227.58.XXX:22
2021-06-02 23:10:52 block TCP from 178.63.132.249 to 45.138.26.XXX:22
2021-06-02 23:10:51 block TCP from 178.63.132.249 to 188.227.58.XXX:22
2021-06-02 23:10:55 block TCP from 178.63.132.249 to 188.227.57.XXX:22
2021-06-02 23:10:31 block TCP from 178.63.132.249 to 45.138.26.XXX:22
2021-06-02 23:10:21 block TCP from 178.63.132.249 to 188.227.58.XXX:22
2021-06-02 23:10:50 block TCP from 178.63.132.249 to 188.227.58.XXX:22
2021-06-02 23:10:28 block TCP from 178.63.132.249 to 188.227.57.XXX:22
2021-06-02 23:10:49 block TCP from 178.63.132.249 to 188.227.59.XXX:22
2021-06-02 23:10:36 block TCP from 178.63.132.249 to 45.138.27.XXX:22
2021-06-02 23:10:49 block TCP from 178.63.132.249 to 45.138.26.XXX:22
2021-06-02 23:10:09 block TCP from 178.63.132.249 to 188.227.57.XXX:22
2021-06-02 23:10:51 block TCP from 178.63.132.249 to 45.138.27.XXX:22
2021-06-02 23:10:56 block TCP from 178.63.132.249 to 45.138.27.XXX:22
2021-06-02 23:10:57 block TCP from 178.63.132.249 to 188.227.59.XXX:22
2021-06-02 23:10:26 block TCP from 178.63.132.249 to 188.227.59.XXX:22
2021-06-02 23:10:54 block TCP from 178.63.132.249 to 188.227.58.XXX:22
2021-06-02 23:10:33 block TCP from 178.63.132.249 to 188.227.58.XXX:22
2021-06-02 23:10:43 block TCP from 178.63.132.249 to 45.138.26.XXX:22
2021-06-02 23:10:28 block TCP from 178.63.132.249 to 45.138.26.XXX:22
2021-06-02 23:10:28 block TCP from 178.63.132.249 to 188.227.58.XXX:22
2021-06-02 23:10:58 block TCP from 178.63.132.249 to 188.227.58.XXX:22
2021-06-02 23:10:56 block TCP from 178.63.132.249 to 188.227.57.XXX:22
2021-06-02 23:10:54 block TCP from 178.63.132.249 to 45.138.27.XXX:22
2021-06-02 23:10:48 block TCP from 178.63.132.249 to 188.227.59.XXX:22
2021-06-02 23:10:58 block TCP from 178.63.132.249 to 188.227.59.XXX:22
2021-06-02 23:10:33 block TCP from 178.63.132.249 to 188.227.57.XXX:22
2021-06-02 23:10:22 block TCP from 178.63.132.249 to 46.243.183.XXX:22
2021-06-02 23:10:48 block TCP from 178.63.132.249 to 45.138.27.XXX:22
2021-06-02 23:10:56 block TCP from 178.63.132.249 to 45.138.26.XXX:22
2021-06-02 23:10:37 block TCP from 178.63.132.249 to 188.227.59.XXX:22
2021-06-02 23:10:58 block TCP from 178.63.132.249 to 45.138.26.XXX:22
2021-06-02 23:10:53 block TCP from 178.63.132.249 to 46.243.183.XXX:22
2021-06-02 23:11:22 block TCP from 178.63.132.249 to 46.243.186.XXX:22
2021-06-02 23:10:52 block TCP from 178.63.132.249 to 46.243.183.XXX:22
2021-06-02 23:11:26 block TCP from 178.63.132.249 to 45.138.24.XXX:22
2021-06-02 23:10:51 block TCP from 178.63.132.249 to 46.243.183.XXX:22
2021-06-02 23:12:18 block TCP from 178.63.132.249 to 46.243.182.XXX:22
2021-06-02 23:11:08 block TCP from 178.63.132.249 to 46.243.183.XXX:22
2021-06-02 23:11:08 block TCP from 178.63.132.249 to 46.243.183.XXX:22
2021-06-02 23:11:39 block TCP from 178.63.132.249 to 46.243.183.XXX:22
2021-06-02 23:10:38 block TCP from 178.63.132.249 to 46.243.183.XXX:22
2021-06-02 23:11:55 block TCP from 178.63.132.249 to 45.14.50.XXX:22
2021-06-02 23:12:23 block TCP from 178.63.132.249 to 46.243.182.XXX:22
2021-06-02 23:10:28 block TCP from 178.63.132.249 to 188.227.85.XXX:22
2021-06-02 23:11:47 block TCP from 178.63.132.249 to 188.227.86.XXX:22
2021-06-02 23:11:45 block TCP from 178.63.132.249 to 188.227.86.XXX:22
2021-06-02 23:11:07 block TCP from 178.63.132.249 to 185.255.78.XXX:22
2021-06-02 23:11:22 block TCP from 178.63.132.249 to 46.243.183.XXX:22
2021-06-02 23:12:10 block TCP from 178.63.132.249 to 46.243.187.XXX:22
2021-06-02 23:10:59 block TCP from 178.63.132.249 to 31.44.3.XXX:22
2021-06-02 23:11:38 block TCP from 178.63.132.249 to 46.243.183.XXX:22
###end###
We are asking for your help in order to identify who did those connections and what was its purpose.
You should investigate this suspicious activity because it could mean that your network has been compromised and is being used as a launch point for attacks, or someone of your legitimate users are doing hacking activities.
Thank you for your cooperation.
Best regards,
Support itglobal.com.
