Your server 95.216.24.235 has been registered as an attack source Incident report Dear provider, I am Mark Bacsko, Incident Analyst at BitNinja Server Security. I’m writing to inform you that we have detected malicious requests targeting our clients’ servers from the IP 95.216.24.235 you own based on a public database. We’ve been able to stop these requests and prevent future attacks by adding your IP to our greylist , but we wanted to reach out and inform you, as you might not be aware. Timestamp (UTC): 2023-02-16 01:44:49 Sometimes it’s not easy to notice that your servers are used as a “bot” sending malicious attacks over the Internet. AGENT LOGS If this is the case with you, you can take steps to protect your and others’ servers. To help you to fix this problem, I’ve collected the 3 earliest logs below, which have led to your IP being blocked. Under the link, you can find the freshest 100 logs that may help you disinfect your server.
[2023-02-14 10:52:53 +0600] info [cpaneld] 95.216.24.235 - sales1 "GET /cpsess5062459513/frontend/paper_lantern/email_accounts/index.html/execute/ResourceUsage/get_usages HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user [2023-02-14 10:52:53 +0600] info [cpaneld] 95.216.24.235 - sales1 "GET /cpsess5062459513/frontend/paper_lantern/email_accounts/index.html/execute/Email/list_pops_with_disk HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user [2023-02-14 10:52:53 +0600] info [cpaneld] 95.216.24.235 - sales1 "GET /cpsess5062459513/frontend/paper_lantern/email_accounts/index.html/execute/LastLogin/get_last_or_current_logged_in_ip HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user [2023-02-14 10:52:53 +0600] info [cpaneld] 95.216.24.235 - logistics "GET /cpsess9018747747/frontend/paper_lantern/email_accounts/index.html/execute/Email/list_pops_with_disk HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user [2023-02-14 10:52:53 +0600] info [cpaneld] 95.216.24.235 - logistics "GET /cpsess9018747747/frontend/paper_lantern/email_accounts/index.html/execute/LastLogin/get_last_or_current_logged_in_ip HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user [2023-02-14 10:52:53 +0600] info [cpaneld] 95.216.24.235 - admin1 "GET /cpsess0241848244/frontend/paper_lantern/email_accounts/index.html/execute/Email/list_pops_with_disk HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user [2023-02-14 10:52:53 +0600] info [cpaneld] 95.216.24.235 - admin1 "GET /cpsess0241848244/frontend/paper_lantern/email_accounts/index.html/execute/DomainInfo/domains_data HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user [2023-02-14 10:52:53 +0600] info [cpaneld] 95.216.24.235 - order "GET /cpsess1990020742/frontend/paper_lantern/email_accounts/index.html/execute/DomainInfo/domains_data HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user [2023-02-14 10:52:53 +0600] info [cpaneld] 95.216.24.235 - support "GET /cpsess4160542911/frontend/paper_lantern/email_accounts/index.html/execute/DomainInfo/domains_data HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user [2023-02-14 10:52:53 +0600] info [cpaneld] 95.216.24.235 - support "GET /cpsess4160542911/frontend/paper_lantern/email_accounts/index.html/execute/LastLogin/get_last_or_current_logged_in_ip HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user SenseLog id [80_2_019] Message [CpanelLogin]]
[2023-02-14 10:52:53 +0600] info [cpaneld] 95.216.24.235 - sales1 "GET /cpsess5062459513/frontend/paper_lantern/email_accounts/index.html/execute/DomainInfo/domains_data HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user [2023-02-14 10:52:53 +0600] info [cpaneld] 95.216.24.235 - support "GET /cpsess4160542911/frontend/paper_lantern/email_accounts/index.html/execute/Email/list_pops_with_disk HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user [2023-02-14 10:52:53 +0600] info [cpaneld] 95.216.24.235 - logistics "GET /cpsess9018747747/frontend/paper_lantern/email_accounts/index.html/execute/LastLogin/get_last_or_current_logged_in_ip HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user [2023-02-14 10:52:53 +0600] info [cpaneld] 95.216.24.235 - logistics "GET /cpsess9018747747/frontend/paper_lantern/email_accounts/index.html/execute/Email/list_pops_with_disk HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user [2023-02-14 10:52:53 +0600] info [cpaneld] 95.216.24.235 - sales1 "GET /cpsess5062459513/frontend/paper_lantern/email_accounts/index.html/execute/Email/list_pops_with_disk HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user [2023-02-14 10:52:53 +0600] info [cpaneld] 95.216.24.235 - dhakapdm "GET //execute/LastLogin/get_last_or_current_logged_in_ip HTTP/1.1" FAILED LOGIN cpaneld: brute force attempt (user dhakapdm) has locked out IP 95.216.24.235 [2023-02-14 10:52:53 +0600] info [cpaneld] 95.216.24.235 - order "GET /cpsess1990020742/frontend/paper_lantern/email_accounts/index.html/execute/ResourceUsage/get_usages HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user [2023-02-14 10:52:53 +0600] info [cpaneld] 95.216.24.235 - dhakapdm "GET //execute/ResourceUsage/get_usages HTTP/1.1" FAILED LOGIN cpaneld: brute force attempt (user dhakapdm) has locked out IP 95.216.24.235 [2023-02-14 10:52:53 +0600] info [cpaneld] 95.216.24.235 - logistics "GET /cpsess9018747747/frontend/paper_lantern/email_accounts/index.html/execute/DomainInfo/domains_data HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user [2023-02-14 10:52:53 +0600] info [cpaneld] 95.216.24.235 - order "GET /cpsess1990020742/frontend/paper_lantern/email_accounts/index.html/execute/Email/list_pops_with_disk HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user SenseLog id [80_2_019] Message [CpanelLogin]]
[2023-02-14 10:52:53 +0600] info [cpaneld] 95.216.24.235 - order "GET /cpsess1990020742/frontend/paper_lantern/email_accounts/index.html/execute/LastLogin/get_last_or_current_logged_in_ip HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user [2023-02-14 10:52:53 +0600] info [cpaneld] 95.216.24.235 - admin1 "GET /cpsess0241848244/frontend/paper_lantern/email_accounts/index.html/execute/ResourceUsage/get_usages HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user [2023-02-14 10:52:53 +0600] info [cpaneld] 95.216.24.235 - admin1 "GET /cpsess0241848244/frontend/paper_lantern/email_accounts/index.html/execute/Email/list_pops_with_disk HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user [2023-02-14 10:52:53 +0600] info [cpaneld] 95.216.24.235 - logistics "GET /cpsess9018747747/frontend/paper_lantern/email_accounts/index.html/execute/ResourceUsage/get_usages HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user [2023-02-14 10:52:53 +0600] info [cpaneld] 95.216.24.235 - sales1 "GET /cpsess5062459513/frontend/paper_lantern/email_accounts/index.html/execute/DomainInfo/domains_data HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user [2023-02-14 10:52:53 +0600] info [cpaneld] 95.216.24.235 - dhakapdm "GET //execute/ResourceUsage/get_usages HTTP/1.1" FAILED LOGIN cpaneld: brute force attempt (user dhakapdm) has locked out IP 95.216.24.235 [2023-02-14 10:52:53 +0600] info [cpaneld] 95.216.24.235 - order "GET /cpsess1990020742/frontend/paper_lantern/email_accounts/index.html/execute/DomainInfo/domains_data HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user [2023-02-14 10:52:53 +0600] info [cpaneld] 95.216.24.235 - admin1 "GET /cpsess0241848244/frontend/paper_lantern/email_accounts/index.html/execute/LastLogin/get_last_or_current_logged_in_ip HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user [2023-02-14 10:52:53 +0600] info [cpaneld] 95.216.24.235 - admin1 "GET /cpsess0241848244/frontend/paper_lantern/email_accounts/index.html/execute/DomainInfo/domains_data HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user [2023-02-14 10:52:53 +0600] info [cpaneld] 95.216.24.235 - dhakapdm "GET //execute/Email/list_pops_with_disk HTTP/1.1" FAILED LOGIN cpaneld: brute force attempt (user dhakapdm) has locked out IP 95.216.24.235 SenseLog id [80_2_019] Message [CpanelLogin]]
GO TO INCIDENTS Please keep in mind that after the first intrusion we log all traffic between your server and the BitNinja-protected servers until the IP is removed from the greylist. This means you may see valid logs beside the malicious actions in the link above. If you need help finding the malicious logs, please don’t hesitate to contact our incident experts by replying to this e-mail. Have an amazing week: The BitNinja Team
