-1

A few days back I have received the abuse notification from Hetzner datacenter. There seems to be a netscan going on my server. What I don't understand is that why the destinations are the local network IPs? What does that mean and how should I stop it ? Below is the email they sent me :

Fri Jun 15 21:02:46 2018 TCP MY SERVER IP 33342 => 192.168.1.122 7
Fri Jun 15 21:02:46 2018 TCP MY SERVER IP 33249 => 192.168.1.123 7
Fri Jun 15 21:02:46 2018 TCP MY SERVER IP 54650 => 192.168.1.124 7
Fri Jun 15 21:02:46 2018 TCP MY SERVER IP 50813 => 192.168.1.125 7
Fri Jun 15 21:02:46 2018 TCP MY SERVER IP 43352 => 192.168.1.126 7
Fri Jun 15 21:02:46 2018 TCP MY SERVER IP 53177 => 192.168.1.127 7
Fri Jun 15 21:02:46 2018 TCP MY SERVER IP 58477 => 192.168.1.128 7
Fri Jun 15 21:02:46 2018 TCP MY SERVER IP 33213 => 192.168.1.129 7
Fri Jun 15 21:02:47 2018 TCP MY SERVER IP 58466 => 192.168.1.130 7
Fri Jun 15 21:02:47 2018 TCP MY SERVER IP 51264 => 192.168.1.133 7
Fri Jun 15 21:02:47 2018 TCP MY SERVER IP 53684 => 192.168.1.134 7
Fri Jun 15 21:02:47 2018 TCP MY SERVER IP 51751 => 192.168.1.135 7
Fri Jun 15 21:02:47 2018 TCP MY SERVER IP 54523 => 192.168.1.136 7
Fri Jun 15 21:02:47 2018 TCP MY SERVER IP 42139 => 192.168.1.137 7
Fri Jun 15 21:02:47 2018 TCP MY SERVER IP 51317 => 192.168.1.138 7
Fri Jun 15 21:02:47 2018 TCP MY SERVER IP 34863 => 192.168.1.139 7
Fri Jun 15 21:02:47 2018 TCP MY SERVER IP 43767 => 192.168.1.140 7
Fri Jun 15 21:02:47 2018 TCP MY SERVER IP 34036 => 192.168.1.141 7
Fri Jun 15 21:02:47 2018 TCP MY SERVER IP 36163 => 192.168.1.143 7
Fri Jun 15 21:02:47 2018 TCP MY SERVER IP 43617 => 192.168.1.145 7
Fri Jun 15 21:02:48 2018 TCP MY SERVER IP 56095 => 192.168.1.149 7
Fri Jun 15 21:02:48 2018 TCP MY SERVER IP 51691 => 192.168.1.150 7

kubanczyk
  • 13,502
  • 5
  • 40
  • 55
Liverpool Alid
  • 1
  • 1

1 Answers1

0

Your server has been compromised. You should save your data, format the disks, reinstall everything and secure it up with strong passwords and even better ssh access with keys only (nopassword option), all unnecessary services turned off.

wazoox
  • 6,782
  • 4
  • 30
  • 62