Kernel Drops (nftables)
26,138
CrowdSec Decisions
10
SSH Failed Attempts
111
Warning Flags
3
Audit Duration
0m 3s
Security Posture & Vulnerability Findings
🟡 WARNING [c1.mwan.dev]: Stale In-Memory Services
5 service(s) running outdated libraries in memory requiring restart: getty@tty1.service, NetworkManager.service, serial-getty@ttyAMA0.service, systemd-logind.service...
🟡 WARNING [c2.mwan.dev]: Stale In-Memory Services
5 service(s) running outdated libraries in memory requiring restart: dbus.service, getty@tty1.service, NetworkManager.service, serial-getty@ttyAMA0.service...
🟡 WARNING [c3.mwan.dev]: Stale In-Memory Services
5 service(s) running outdated libraries in memory requiring restart: dbus.service, getty@tty1.service, NetworkManager.service, serial-getty@ttyAMA0.service...
Fleet Host Posture & Firewall Telemetry
| Host | Status | CrowdSec Set | Kernel Dropped | Needrestart | Reboot Status |
|---|---|---|---|---|---|
home.mwan.dev |
Reachable | 25,130 | 10,111 pkts |
Clean | No Reboot |
c1.mwan.dev |
Reachable | 32,710 | 5,104 pkts |
5 stale | No Reboot |
c2.mwan.dev |
Reachable | 32,292 | 5,008 pkts |
5 stale | No Reboot |
c3.mwan.dev |
Reachable | 32,363 | 5,915 pkts |
5 stale | No Reboot |
Top Offending Attacker IPs
| IP Address | Attempts | Country | ASN / Organization | Vector |
|---|---|---|---|---|
213.209.159.230 |
7 | Germany | AS208137 Feo Prest SRL | SSH Brute-Force |
171.231.196.247 |
6 | Vietnam | AS7552 Viettel Group | SSH Brute-Force |
116.99.171.205 |
6 | Vietnam | AS24086 Viettel Corporation | SSH Brute-Force |
180.73.196.21 |
5 | Malaysia | AS4788 TM TECHNOLOGY SERVICES SDN. BHD. | SSH Brute-Force |
116.99.170.47 |
5 | Vietnam | AS24086 Viettel Corporation | SSH Brute-Force |
20.115.209.228 |
5 | United States | AS8075 Microsoft Corporation | SSH Brute-Force |
217.216.109.215 |
4 | Singapore | AS141995 Contabo Asia Private Limited | SSH Brute-Force |
58.221.214.202 |
3 | China | AS4134 CHINANET BACKBONE | SSH Brute-Force |
Triggered Attack Scenarios (CrowdSec)
crowdsecurity/ssh-time-based-bf
72 triggers
crowdsecurity/ssh-slow-bf
20 triggers
crowdsecurity/ssh-time-based-bf_user-enum
16 triggers
crowdsecurity/http-sensitive-files
15 triggers
crowdsecurity/jira_cve-2021-26086
12 triggers
crowdsecurity/ssh-bf
10 triggers
crowdsecurity/http-crawl-non_statics
4 triggers
crowdsecurity/http-cve-2021-41773
4 triggers
Top Targeted Usernames:
admin (17)from (15)user (13)temp (3)support (3)ubuntu (2)sol (2)ubnt (2)