darklist.de

• darklist.de 로 부터 다음과 같은 내용의 메일을 받는다면, 서버내의 무언가가 잘못된 것입니다.
  • 실제 ip address는 256.256.256.256로 변경한 문장입니다.

Dear Sir or Madam,

the IP address '256.256.256.256', which belongs to your address space, has been used for network abuse against one of our monitored systems (IP: 85.25.7.16). Attacks were recognized in the timespan: 07.03.2021 03:18:10 - 07.03.2021 03:18:10 (timezone is UTC+0100). The entire log of malicious behavior is attached to this email.

Log excerpt:
Mar 7 03:10:11 localhost sshd[29367]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=256.256.256.256 user=root
Mar 7 03:10:13 localhost sshd[29367]: Failed password for root from 256.256.256.256 port 40072 ssh2
Mar 7 03:10:14 localhost sshd[29367]: Received disconnect from 256.256.256.256 port 40072:11: Bye Bye [preauth]
Mar 7 03:10:14 localhost sshd[29367]: Disconnected from 256.256.256.256 port 40072 [preauth]
Mar 7 03:16:59 localhost sshd[29423]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=256.256.256.256 user=root

In consequence of these attacks your IP address has been temporarily blacklisted and reported to public blacklists (source: https://darklist.de/?ip=256.256.256.256). After solving this task you may request removal from blacklist by replying to this email or requesting removal on our website, naming the actions taken to prevent further attacks.

An increasing number of hostile IP addresses from your network will result in your entire IP address space being blacklisted. You will receive a separate email in this case.

If you dont want to receive any more blacklist reports or want us to use a different
way of reporting, e.g. API, please reply to this email and provide the necessary
information. Additionally we provide API access to unlist blacklisted IP addresses.
Come back to us if you are interested in getting an API key.

Yours faithfully,

Robert Krause
Darklist.de

darklist script

또 http://darklist.de/iptables.php 에는 공개된 blacklist ip를 block할 수 있는 스크립트도 제공하고 있습니다.

Ref

• http://darklist.de/iptables.php