CONN src=10.0.1.231 dst=193.27.228.114 dport=443 bytes=310 interval=60s


CONN src=10.0.1.231 dst=193.27.228.114 dport=443 bytes=473 interval=60s


CONN src=10.0.1.231 dst=193.27.228.114 dport=443 bytes=807 interval=60s


CONN src=10.0.1.231 dst=193.27.228.114 dport=443 bytes=498 interval=60s


CONN src=10.0.1.231 dst=193.27.228.114 dport=443 bytes=830 interval=60s


39.112.216.61 - - "GET /health HTTP/1.1" 200 4404


CONN src=10.0.1.231 dst=193.27.228.114 dport=443 bytes=738 interval=60s


Accepted password for root from 10.0.2.45 port 54240 ssh2


Accepted password for svc_backup from 10.0.1.75 port 55468 ssh2


CONN src=10.0.1.231 dst=193.27.228.114 dport=443 bytes=273 interval=60s


CONN src=10.0.1.231 dst=193.27.228.114 dport=443 bytes=827 interval=60s


Accepted password for nattapong from 10.0.1.91 port 49282 ssh2


sudo: nattapong : TTY=pts/0 ; PWD=/home/nattapong ; USER=root ; COMMAND=/usr/bin/cat /etc/shadow


Failed password for root from 91.219.236.18 port 43826 ssh2


Failed password for root from 91.219.236.18 port 56511 ssh2


Failed password for root from 91.219.236.18 port 42459 ssh2


Failed password for root from 91.219.236.18 port 46335 ssh2


Failed password for root from 91.219.236.18 port 41570 ssh2


Failed password for root from 91.219.236.18 port 52294 ssh2


Failed password for root from 91.219.236.18 port 49602 ssh2


Failed password for root from 91.219.236.18 port 50972 ssh2


Failed password for root from 91.219.236.18 port 41834 ssh2


Failed password for root from 91.219.236.18 port 49150 ssh2


Failed password for somchai from 193.27.228.114 port 54583 ssh2


Failed password for somchai from 193.27.228.114 port 40264 ssh2


Failed password for somchai from 193.27.228.114 port 53838 ssh2


Failed password for somchai from 193.27.228.114 port 51258 ssh2


Failed password for somchai from 193.27.228.114 port 52552 ssh2


Failed password for somchai from 193.27.228.114 port 43356 ssh2


Failed password for somchai from 193.27.228.114 port 50267 ssh2


Failed password for somchai from 193.27.228.114 port 42320 ssh2


Failed password for somchai from 193.27.228.114 port 52541 ssh2


Failed password for somchai from 193.27.228.114 port 44681 ssh2


Failed password for somchai from 193.27.228.114 port 44331 ssh2


Failed password for somchai from 193.27.228.114 port 57383 ssh2


Failed password for somchai from 193.27.228.114 port 49805 ssh2


Failed password for somchai from 193.27.228.114 port 42840 ssh2


Failed password for somchai from 193.27.228.114 port 44587 ssh2


Failed password for somchai from 193.27.228.114 port 59319 ssh2


Failed password for somchai from 193.27.228.114 port 51507 ssh2


Failed password for somchai from 193.27.228.114 port 54496 ssh2


Failed password for somchai from 193.27.228.114 port 40277 ssh2


Failed password for somchai from 193.27.228.114 port 45377 ssh2


Failed password for somchai from 193.27.228.114 port 54070 ssh2


Failed password for somchai from 193.27.228.114 port 46981 ssh2


Failed password for somchai from 193.27.228.114 port 44960 ssh2


Failed password for somchai from 193.27.228.114 port 52583 ssh2


185.220.101.34 - - "GET /search?q=<img src=x onerror=alert(document.cookie)> HTTP/1.1" 200 391


Accepted password for nattapong from 10.0.4.179 port 59191 ssh2


OUTBOUND src=10.0.5.188 dst=91.219.236.18 bytes=3165650944 proto=TCP dport=443 duration=166s


ALLOW IN=174.57.148.115 OUT= PROTO=TCP DPT=80


152.82.213.216 - - "GET /health HTTP/1.1" 200 5245


Accepted password for admin from 10.0.5.135 port 52646 ssh2


Accepted password for oppa from 10.0.2.39 port 52799 ssh2


209.141.56.12 - - "GET /api/products?id=' OR '1'='1 HTTP/1.1" 200 381


ALLOW IN=145.201.49.205 OUT= PROTO=TCP DPT=443


Accepted password for postgres from 10.0.0.100 port 58602 ssh2


45.137.21.9 - - "GET /api/products?id=UNION SELECT username,password FROM users-- HTTP/1.1" 200 115


Accepted password for root from 10.0.4.17 port 43883 ssh2


168.209.209.26 - - "GET /static/app.js HTTP/1.1" 200 3727


CONN src=10.0.4.113 dst=185.220.101.34 dport=443 bytes=664 interval=30s


CONN src=10.0.4.113 dst=185.220.101.34 dport=443 bytes=540 interval=30s


CONN src=10.0.3.97 dst=91.219.236.18 dport=443 bytes=771 interval=30s


CONN src=10.0.4.113 dst=185.220.101.34 dport=443 bytes=879 interval=30s


CONN src=10.0.3.97 dst=91.219.236.18 dport=443 bytes=764 interval=30s


Accepted password for admin from 10.0.2.249 port 45864 ssh2


CONN src=10.0.4.113 dst=185.220.101.34 dport=443 bytes=265 interval=30s


CONN src=10.0.3.97 dst=91.219.236.18 dport=443 bytes=504 interval=30s


ALLOW IN=144.46.62.65 OUT= PROTO=TCP DPT=80


CONN src=10.0.4.113 dst=185.220.101.34 dport=443 bytes=795 interval=30s


CONN src=10.0.3.97 dst=91.219.236.18 dport=443 bytes=779 interval=30s


CONN src=10.0.4.113 dst=185.220.101.34 dport=443 bytes=413 interval=30s


CONN src=10.0.3.97 dst=91.219.236.18 dport=443 bytes=489 interval=30s


CONN src=10.0.4.113 dst=185.220.101.34 dport=443 bytes=457 interval=30s


CONN src=10.0.3.97 dst=91.219.236.18 dport=443 bytes=874 interval=30s


CONN src=10.0.4.113 dst=185.220.101.34 dport=443 bytes=585 interval=30s


CONN src=10.0.3.97 dst=91.219.236.18 dport=443 bytes=791 interval=30s


CONN src=10.0.4.113 dst=185.220.101.34 dport=443 bytes=455 interval=30s


CONN src=10.0.3.97 dst=91.219.236.18 dport=443 bytes=824 interval=30s


CONN src=10.0.4.113 dst=185.220.101.34 dport=443 bytes=728 interval=30s


CONN src=10.0.3.97 dst=91.219.236.18 dport=443 bytes=826 interval=30s


CONN src=10.0.3.97 dst=91.219.236.18 dport=443 bytes=609 interval=30s


ALLOW IN=55.88.142.241 OUT= PROTO=TCP DPT=443


43.230.49.10 - - "GET /login HTTP/1.1" 200 6308


Accepted password for guest from 10.0.0.18 port 53818 ssh2


98.11.94.246 - - "GET /static/app.js HTTP/1.1" 200 971


ALLOW IN=137.95.72.135 OUT= PROTO=TCP DPT=443


Accepted password for www-data from 10.0.1.47 port 56972 ssh2


ALLOW IN=105.71.37.201 OUT= PROTO=TCP DPT=443


ALLOW IN=128.168.152.91 OUT= PROTO=TCP DPT=80


sudo: deploy : TTY=pts/0 ; PWD=/home/deploy ; USER=root ; COMMAND=/usr/bin/passwd root


ALLOW IN=106.41.56.226 OUT= PROTO=TCP DPT=80


141.240.253.42 - - "GET /login HTTP/1.1" 200 737


174.139.212.45 - - "GET /static/app.js HTTP/1.1" 200 3985


45.137.21.9 - - "GET /search?q=<script>alert(1)</script> HTTP/1.1" 403 225


CONN src=10.0.5.22 dst=45.137.21.9 dport=443 bytes=256 interval=30s


CONN src=10.0.5.22 dst=45.137.21.9 dport=443 bytes=285 interval=30s


CONN src=10.0.5.22 dst=45.137.21.9 dport=443 bytes=534 interval=30s


CONN src=10.0.5.22 dst=45.137.21.9 dport=443 bytes=634 interval=30s


CONN src=10.0.5.22 dst=45.137.21.9 dport=443 bytes=275 interval=30s


CONN src=10.0.5.22 dst=45.137.21.9 dport=443 bytes=625 interval=30s


CONN src=10.0.5.22 dst=45.137.21.9 dport=443 bytes=272 interval=30s


CONN src=10.0.5.22 dst=45.137.21.9 dport=443 bytes=799 interval=30s


sudo: guest : TTY=pts/0 ; PWD=/home/guest ; USER=root ; COMMAND=/usr/bin/passwd root


CONN src=10.0.5.22 dst=45.137.21.9 dport=443 bytes=670 interval=30s


205.143.33.6 - - "GET / HTTP/1.1" 200 5994


CONN src=10.0.5.22 dst=45.137.21.9 dport=443 bytes=397 interval=30s


208.247.252.11 - - "GET /dashboard HTTP/1.1" 200 4236


DROP IN=148.241.64.227 OUT= PROTO=TCP DPT=6379 FLAGS=SYN


DROP IN=148.241.64.227 OUT= PROTO=TCP DPT=21 FLAGS=SYN


DROP IN=148.241.64.227 OUT= PROTO=TCP DPT=3306 FLAGS=SYN


DROP IN=148.241.64.227 OUT= PROTO=TCP DPT=25 FLAGS=SYN


DROP IN=148.241.64.227 OUT= PROTO=TCP DPT=443 FLAGS=SYN


DROP IN=148.241.64.227 OUT= PROTO=TCP DPT=53 FLAGS=SYN


DROP IN=148.241.64.227 OUT= PROTO=TCP DPT=8080 FLAGS=SYN


DROP IN=148.241.64.227 OUT= PROTO=TCP DPT=3389 FLAGS=SYN


Accepted password for svc_backup from 10.0.5.218 port 54307 ssh2


Accepted password for postgres from 10.0.1.91 port 56525 ssh2


Accepted password for nattapong from 10.0.4.208 port 50009 ssh2


Accepted password for guest from 10.0.3.128 port 43024 ssh2


54.139.10.129 - - "GET /static/app.js HTTP/1.1" 200 7530


ALLOW IN=127.132.155.219 OUT= PROTO=TCP DPT=80


91.219.236.18 - - "GET /search?q=<img src=x onerror=alert(document.cookie)> HTTP/1.1" 200 435


30.252.108.162 - - "GET /health HTTP/1.1" 200 5809


ALLOW IN=54.42.255.217 OUT= PROTO=TCP DPT=443


DROP IN=209.141.56.12 OUT= PROTO=TCP DPT=80 FLAGS=SYN


DROP IN=209.141.56.12 OUT= PROTO=TCP DPT=3306 FLAGS=SYN


DROP IN=209.141.56.12 OUT= PROTO=TCP DPT=25 FLAGS=SYN


DROP IN=209.141.56.12 OUT= PROTO=TCP DPT=22 FLAGS=SYN


DROP IN=209.141.56.12 OUT= PROTO=TCP DPT=3389 FLAGS=SYN


DROP IN=209.141.56.12 OUT= PROTO=TCP DPT=5432 FLAGS=SYN


DROP IN=209.141.56.12 OUT= PROTO=TCP DPT=21 FLAGS=SYN


DROP IN=209.141.56.12 OUT= PROTO=TCP DPT=443 FLAGS=SYN


ALLOW IN=19.170.166.28 OUT= PROTO=TCP DPT=80


ALLOW IN=217.35.43.87 OUT= PROTO=TCP DPT=443


23.45.132.86 - - "GET /dashboard HTTP/1.1" 200 5069


ALLOW IN=13.34.6.106 OUT= PROTO=TCP DPT=80


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=53 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=80 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=8080 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=22 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=5432 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=21 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=3389 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=6379 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=25 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=443 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=27017 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=3306 FLAGS=SYN


Accepted password for deploy from 10.0.2.136 port 46386 ssh2


sudo: www-data : TTY=pts/0 ; PWD=/home/www-data ; USER=root ; COMMAND=/bin/su -


ALLOW IN=203.78.71.28 OUT= PROTO=TCP DPT=443


Accepted password for postgres from 10.0.0.153 port 43875 ssh2


Accepted password for oppa from 10.0.5.184 port 58402 ssh2


ALLOW IN=80.78.225.92 OUT= PROTO=TCP DPT=80


169.77.28.133 - - "GET /login HTTP/1.1" 200 2113


159.183.37.157 - - "GET /health HTTP/1.1" 200 6943


ALLOW IN=36.193.196.6 OUT= PROTO=TCP DPT=80


ALLOW IN=55.240.186.232 OUT= PROTO=TCP DPT=443


Accepted password for guest from 10.0.5.70 port 59188 ssh2


ALLOW IN=220.116.103.94 OUT= PROTO=TCP DPT=80


CONN src=10.0.5.231 dst=193.27.228.114 dport=443 bytes=203 interval=300s


ALLOW IN=223.213.76.196 OUT= PROTO=TCP DPT=80


CONN src=10.0.5.231 dst=193.27.228.114 dport=443 bytes=484 interval=300s


sudo: guest : TTY=pts/0 ; PWD=/home/guest ; USER=root ; COMMAND=/usr/bin/passwd root


129.112.225.26 - - "GET /static/app.js HTTP/1.1" 200 4490


DROP IN=23.0.108.12 OUT= PROTO=TCP DPT=27017 FLAGS=SYN


DROP IN=23.0.108.12 OUT= PROTO=TCP DPT=3389 FLAGS=SYN


DROP IN=23.0.108.12 OUT= PROTO=TCP DPT=6379 FLAGS=SYN


DROP IN=23.0.108.12 OUT= PROTO=TCP DPT=80 FLAGS=SYN


DROP IN=23.0.108.12 OUT= PROTO=TCP DPT=21 FLAGS=SYN


DROP IN=23.0.108.12 OUT= PROTO=TCP DPT=8080 FLAGS=SYN


DROP IN=23.0.108.12 OUT= PROTO=TCP DPT=25 FLAGS=SYN


DROP IN=23.0.108.12 OUT= PROTO=TCP DPT=53 FLAGS=SYN


DROP IN=23.0.108.12 OUT= PROTO=TCP DPT=22 FLAGS=SYN


DROP IN=23.0.108.12 OUT= PROTO=TCP DPT=443 FLAGS=SYN


CONN src=10.0.5.231 dst=193.27.228.114 dport=443 bytes=556 interval=300s


ALLOW IN=136.53.202.113 OUT= PROTO=TCP DPT=80


CONN src=10.0.5.231 dst=193.27.228.114 dport=443 bytes=329 interval=300s


Accepted password for www-data from 10.0.2.122 port 56297 ssh2


39.79.30.226 - - "GET /api/orders?page=2 HTTP/1.1" 200 463


CONN src=10.0.5.231 dst=193.27.228.114 dport=443 bytes=232 interval=300s


Accepted password for guest from 10.0.5.33 port 45445 ssh2


ALLOW IN=152.66.169.93 OUT= PROTO=TCP DPT=443


91.219.236.18 - - "GET /api/products?id=' OR '1'='1 HTTP/1.1" 403 166


CONN src=10.0.4.223 dst=45.137.21.9 dport=443 bytes=298 interval=300s


Accepted password for oppa from 10.0.1.202 port 58920 ssh2


116.113.103.194 - - "GET /login HTTP/1.1" 200 741


CONN src=10.0.4.223 dst=45.137.21.9 dport=443 bytes=339 interval=300s


193.27.228.114 - - "GET /api/products?id=UNION SELECT username,password FROM users-- HTTP/1.1" 500 114


CONN src=10.0.4.223 dst=45.137.21.9 dport=443 bytes=877 interval=300s


ALLOW IN=179.54.195.243 OUT= PROTO=TCP DPT=443


Accepted password for somchai from 10.0.0.27 port 59462 ssh2


CONN src=10.0.4.223 dst=45.137.21.9 dport=443 bytes=291 interval=300s


193.27.228.114 - - "GET /api/products?id=' OR '1'='1 HTTP/1.1" 500 265


Accepted password for postgres from 10.0.1.124 port 57486 ssh2


CONN src=10.0.4.223 dst=45.137.21.9 dport=443 bytes=353 interval=300s


45.137.21.9 - - "GET /api/products?id=' OR '1'='1 HTTP/1.1" 403 47


ALLOW IN=214.118.156.33 OUT= PROTO=TCP DPT=443


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=22 FLAGS=SYN


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=80 FLAGS=SYN


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=3389 FLAGS=SYN


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=5432 FLAGS=SYN


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=8080 FLAGS=SYN


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=21 FLAGS=SYN


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=53 FLAGS=SYN


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=25 FLAGS=SYN


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=3306 FLAGS=SYN


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=443 FLAGS=SYN


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=6379 FLAGS=SYN


45.137.21.9 - - "GET /search?q=<img src=x onerror=alert(document.cookie)> HTTP/1.1" 200 352


CONN src=10.0.4.223 dst=45.137.21.9 dport=443 bytes=514 interval=300s


DROP IN=20.173.28.87 OUT= PROTO=TCP DPT=3389 FLAGS=SYN


DROP IN=20.173.28.87 OUT= PROTO=TCP DPT=80 FLAGS=SYN


DROP IN=20.173.28.87 OUT= PROTO=TCP DPT=3306 FLAGS=SYN


DROP IN=20.173.28.87 OUT= PROTO=TCP DPT=25 FLAGS=SYN


DROP IN=20.173.28.87 OUT= PROTO=TCP DPT=21 FLAGS=SYN


DROP IN=20.173.28.87 OUT= PROTO=TCP DPT=6379 FLAGS=SYN


DROP IN=20.173.28.87 OUT= PROTO=TCP DPT=8080 FLAGS=SYN


DROP IN=20.173.28.87 OUT= PROTO=TCP DPT=5432 FLAGS=SYN


CONN src=10.0.4.223 dst=45.137.21.9 dport=443 bytes=275 interval=300s


ALLOW IN=221.77.200.97 OUT= PROTO=TCP DPT=443


183.162.86.232 - - "GET /static/app.js HTTP/1.1" 200 6115


123.226.144.101 - - "GET /login HTTP/1.1" 200 676


CONN src=10.0.4.223 dst=45.137.21.9 dport=443 bytes=406 interval=300s


ALLOW IN=106.173.212.192 OUT= PROTO=TCP DPT=80


sudo: postgres : TTY=pts/0 ; PWD=/home/postgres ; USER=root ; COMMAND=/bin/bash


Accepted password for nattapong from 10.0.1.105 port 47972 ssh2


ALLOW IN=185.148.116.135 OUT= PROTO=TCP DPT=80


sudo: postgres : TTY=pts/0 ; PWD=/home/postgres ; USER=root ; COMMAND=/usr/bin/passwd root


ALLOW IN=167.208.212.26 OUT= PROTO=TCP DPT=80


160.22.130.44 - - "GET / HTTP/1.1" 200 2526


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=21 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=80 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=53 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=443 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=3389 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=22 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=27017 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=25 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=8080 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=3306 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=5432 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=6379 FLAGS=SYN


152.51.126.196 - - "GET /static/app.js HTTP/1.1" 200 5537


Failed password for guest from 209.141.56.12 port 58074 ssh2


Failed password for guest from 209.141.56.12 port 57808 ssh2


Failed password for guest from 209.141.56.12 port 59320 ssh2


Failed password for guest from 209.141.56.12 port 55469 ssh2


Failed password for guest from 209.141.56.12 port 55227 ssh2


Failed password for guest from 209.141.56.12 port 52861 ssh2


Failed password for guest from 209.141.56.12 port 44870 ssh2


Failed password for guest from 209.141.56.12 port 53001 ssh2


Failed password for guest from 209.141.56.12 port 47827 ssh2


Failed password for guest from 209.141.56.12 port 49535 ssh2


Failed password for guest from 209.141.56.12 port 56455 ssh2


Failed password for guest from 209.141.56.12 port 56725 ssh2


Failed password for guest from 209.141.56.12 port 45434 ssh2


Failed password for guest from 209.141.56.12 port 44599 ssh2


ALLOW IN=70.38.25.189 OUT= PROTO=TCP DPT=80


91.219.236.18 - - "GET /api/products?id='; DROP TABLE sessions;-- HTTP/1.1" 403 320


OUTBOUND src=10.0.1.100 dst=209.141.56.12 bytes=6810501120 proto=TCP dport=443 duration=341s


Failed password for nattapong from 91.219.236.18 port 48856 ssh2


Failed password for nattapong from 91.219.236.18 port 52292 ssh2


Failed password for nattapong from 91.219.236.18 port 52019 ssh2


Failed password for nattapong from 91.219.236.18 port 51345 ssh2


Failed password for nattapong from 91.219.236.18 port 51210 ssh2


Failed password for nattapong from 91.219.236.18 port 53910 ssh2


Failed password for nattapong from 91.219.236.18 port 49228 ssh2


Failed password for nattapong from 91.219.236.18 port 48571 ssh2


Accepted password for nattapong from 91.219.236.18 port 51234 ssh2


Failed password for nattapong from 91.219.236.18 port 46321 ssh2


Accepted password for admin from 10.0.3.238 port 46357 ssh2


OUTBOUND src=10.0.3.124 dst=209.141.56.12 bytes=574619648 proto=TCP dport=443 duration=420s


Accepted password for admin from 10.0.3.115 port 52460 ssh2


Accepted password for root from 10.0.1.165 port 52272 ssh2


88.63.79.234 - - "GET /health HTTP/1.1" 200 1453


ALLOW IN=124.6.77.101 OUT= PROTO=TCP DPT=443


52.90.201.176 - - "GET /static/app.js HTTP/1.1" 200 1738


176.17.27.177 - - "GET /api/products?id=1' AND SLEEP(5)-- HTTP/1.1" 403 327


ALLOW IN=116.22.214.127 OUT= PROTO=TCP DPT=443


DROP IN=185.220.101.34 OUT= PROTO=TCP DPT=27017 FLAGS=SYN


DROP IN=185.220.101.34 OUT= PROTO=TCP DPT=443 FLAGS=SYN


DROP IN=185.220.101.34 OUT= PROTO=TCP DPT=3306 FLAGS=SYN


DROP IN=185.220.101.34 OUT= PROTO=TCP DPT=8080 FLAGS=SYN


DROP IN=185.220.101.34 OUT= PROTO=TCP DPT=21 FLAGS=SYN


DROP IN=185.220.101.34 OUT= PROTO=TCP DPT=3389 FLAGS=SYN


DROP IN=185.220.101.34 OUT= PROTO=TCP DPT=80 FLAGS=SYN


DROP IN=185.220.101.34 OUT= PROTO=TCP DPT=6379 FLAGS=SYN


DROP IN=185.220.101.34 OUT= PROTO=TCP DPT=53 FLAGS=SYN


DROP IN=185.220.101.34 OUT= PROTO=TCP DPT=5432 FLAGS=SYN


DROP IN=185.220.101.34 OUT= PROTO=TCP DPT=22 FLAGS=SYN


157.176.184.98 - - "GET / HTTP/1.1" 200 4221


Failed password for www-data from 185.220.101.34 port 42647 ssh2


Failed password for www-data from 185.220.101.34 port 47041 ssh2


Failed password for www-data from 185.220.101.34 port 51033 ssh2


Failed password for www-data from 185.220.101.34 port 48542 ssh2


Failed password for www-data from 185.220.101.34 port 51098 ssh2


Failed password for www-data from 185.220.101.34 port 54681 ssh2


Failed password for www-data from 185.220.101.34 port 57787 ssh2


Failed password for www-data from 185.220.101.34 port 55742 ssh2


Failed password for www-data from 185.220.101.34 port 53724 ssh2


Failed password for www-data from 185.220.101.34 port 50675 ssh2


Failed password for www-data from 185.220.101.34 port 49308 ssh2


Failed password for www-data from 185.220.101.34 port 40655 ssh2


Failed password for www-data from 185.220.101.34 port 56102 ssh2


Failed password for www-data from 185.220.101.34 port 56553 ssh2


Failed password for www-data from 185.220.101.34 port 58447 ssh2


Failed password for www-data from 185.220.101.34 port 43143 ssh2


Failed password for www-data from 185.220.101.34 port 54252 ssh2


Failed password for www-data from 185.220.101.34 port 49585 ssh2


Failed password for www-data from 185.220.101.34 port 40611 ssh2


Failed password for www-data from 185.220.101.34 port 45921 ssh2


Failed password for www-data from 185.220.101.34 port 46798 ssh2


Failed password for www-data from 185.220.101.34 port 56945 ssh2


DROP IN=223.246.175.22 OUT= PROTO=TCP DPT=27017 FLAGS=SYN


DROP IN=223.246.175.22 OUT= PROTO=TCP DPT=53 FLAGS=SYN


DROP IN=223.246.175.22 OUT= PROTO=TCP DPT=80 FLAGS=SYN


DROP IN=223.246.175.22 OUT= PROTO=TCP DPT=25 FLAGS=SYN


DROP IN=223.246.175.22 OUT= PROTO=TCP DPT=6379 FLAGS=SYN


DROP IN=223.246.175.22 OUT= PROTO=TCP DPT=3306 FLAGS=SYN


DROP IN=223.246.175.22 OUT= PROTO=TCP DPT=3389 FLAGS=SYN


DROP IN=223.246.175.22 OUT= PROTO=TCP DPT=5432 FLAGS=SYN


DROP IN=223.246.175.22 OUT= PROTO=TCP DPT=8080 FLAGS=SYN


DROP IN=223.246.175.22 OUT= PROTO=TCP DPT=443 FLAGS=SYN


DROP IN=223.246.175.22 OUT= PROTO=TCP DPT=22 FLAGS=SYN


DROP IN=223.246.175.22 OUT= PROTO=TCP DPT=21 FLAGS=SYN


45.137.21.9 - - "GET /api/products?id=1' AND SLEEP(5)-- HTTP/1.1" 403 102


sudo: svc_backup : TTY=pts/0 ; PWD=/home/svc_backup ; USER=root ; COMMAND=/usr/bin/passwd root


ALLOW IN=214.85.53.114 OUT= PROTO=TCP DPT=443


ALLOW IN=124.106.78.106 OUT= PROTO=TCP DPT=443


Failed password for www-data from 193.27.228.114 port 53371 ssh2


Failed password for www-data from 193.27.228.114 port 58376 ssh2


Failed password for www-data from 193.27.228.114 port 46908 ssh2


Failed password for www-data from 193.27.228.114 port 52597 ssh2


Failed password for www-data from 193.27.228.114 port 41371 ssh2


Failed password for www-data from 193.27.228.114 port 56334 ssh2


Failed password for www-data from 193.27.228.114 port 44459 ssh2


Failed password for www-data from 193.27.228.114 port 48505 ssh2


Failed password for www-data from 193.27.228.114 port 55386 ssh2


Failed password for www-data from 193.27.228.114 port 45661 ssh2


Failed password for www-data from 193.27.228.114 port 46408 ssh2


Failed password for www-data from 193.27.228.114 port 53876 ssh2


Failed password for www-data from 193.27.228.114 port 51910 ssh2


Failed password for www-data from 193.27.228.114 port 58815 ssh2


Failed password for www-data from 193.27.228.114 port 49446 ssh2


91.219.236.18 - - "GET /api/products?id=' OR '1'='1 HTTP/1.1" 500 405


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=27017 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=6379 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=8080 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=25 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=80 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=22 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=53 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=443 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=3306 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=3389 FLAGS=SYN


OUTBOUND src=10.0.3.98 dst=45.137.21.9 bytes=3166699520 proto=TCP dport=443 duration=481s


196.0.222.78 - - "GET /health HTTP/1.1" 200 222


sudo: www-data : TTY=pts/0 ; PWD=/home/www-data ; USER=root ; COMMAND=/usr/bin/cat /etc/shadow


OUTBOUND src=10.0.4.90 dst=193.27.228.114 bytes=5986320384 proto=TCP dport=443 duration=69s


209.141.56.12 - - "GET /search?q=<img src=x onerror=alert(document.cookie)> HTTP/1.1" 403 181


CONN src=10.0.0.192 dst=209.141.56.12 dport=443 bytes=311 interval=300s


171.60.106.205 - - "GET /static/app.js HTTP/1.1" 200 3596


ALLOW IN=153.165.105.16 OUT= PROTO=TCP DPT=80


CONN src=10.0.0.192 dst=209.141.56.12 dport=443 bytes=245 interval=300s


CONN src=10.0.0.192 dst=209.141.56.12 dport=443 bytes=280 interval=300s


ALLOW IN=66.190.12.115 OUT= PROTO=TCP DPT=443


CONN src=10.0.0.192 dst=209.141.56.12 dport=443 bytes=491 interval=300s


208.118.228.95 - - "GET /dashboard HTTP/1.1" 200 4813


ALLOW IN=69.237.59.171 OUT= PROTO=TCP DPT=80


ALLOW IN=81.125.114.36 OUT= PROTO=TCP DPT=80


CONN src=10.0.0.192 dst=209.141.56.12 dport=443 bytes=627 interval=300s


45.137.21.9 - - "GET /search?q=<script>alert(1)</script> HTTP/1.1" 200 168


Accepted password for postgres from 10.0.3.27 port 40632 ssh2


OUTBOUND src=10.0.4.56 dst=45.137.21.9 bytes=7464812544 proto=TCP dport=443 duration=380s


209.141.56.12 - - "GET /search?q=<img src=x onerror=alert(document.cookie)> HTTP/1.1" 403 212


Accepted password for www-data from 10.0.4.175 port 50713 ssh2


134.225.108.6 - - "GET /health HTTP/1.1" 200 3514


110.160.193.138 - - "GET /static/app.js HTTP/1.1" 200 3374


ALLOW IN=187.12.15.22 OUT= PROTO=TCP DPT=443


209.141.56.12 - - "GET /search?q=<script>alert(1)</script> HTTP/1.1" 200 189


Accepted password for postgres from 10.0.0.219 port 42474 ssh2


Accepted password for guest from 10.0.2.39 port 45928 ssh2


ALLOW IN=96.45.51.40 OUT= PROTO=TCP DPT=443


Accepted password for svc_backup from 10.0.1.176 port 42070 ssh2


ALLOW IN=124.35.92.119 OUT= PROTO=TCP DPT=443


97.243.215.91 - - "GET /login HTTP/1.1" 200 7086


180.231.180.68 - - "GET / HTTP/1.1" 200 7793


55.255.193.4 - - "GET /login HTTP/1.1" 200 2473


74.141.34.159 - - "GET /dashboard HTTP/1.1" 200 3410


Accepted password for admin from 10.0.2.78 port 41627 ssh2


sudo: postgres : TTY=pts/0 ; PWD=/home/postgres ; USER=root ; COMMAND=/bin/su -


CONN src=10.0.5.167 dst=209.141.56.12 dport=443 bytes=391 interval=300s


208.68.101.167 - - "GET /api/orders?page=2 HTTP/1.1" 200 7848


CONN src=10.0.5.167 dst=209.141.56.12 dport=443 bytes=319 interval=300s


CONN src=10.0.5.167 dst=209.141.56.12 dport=443 bytes=771 interval=300s


Accepted password for deploy from 10.0.0.91 port 55684 ssh2


CONN src=10.0.5.167 dst=209.141.56.12 dport=443 bytes=393 interval=300s


OUTBOUND src=10.0.1.163 dst=209.141.56.12 bytes=2851078144 proto=TCP dport=443 duration=568s


Accepted password for deploy from 10.0.2.145 port 51128 ssh2


97.251.150.74 - - "GET /api/orders?page=2 HTTP/1.1" 200 4637


CONN src=10.0.5.167 dst=209.141.56.12 dport=443 bytes=625 interval=300s


Accepted password for nattapong from 10.0.0.72 port 47367 ssh2


CONN src=10.0.5.167 dst=209.141.56.12 dport=443 bytes=586 interval=300s


107.84.199.48 - - "GET /static/app.js HTTP/1.1" 200 1157


CONN src=10.0.5.167 dst=209.141.56.12 dport=443 bytes=663 interval=300s


Accepted password for svc_backup from 10.0.2.125 port 59660 ssh2


CONN src=10.0.5.167 dst=209.141.56.12 dport=443 bytes=670 interval=300s


41.196.230.81 - - "GET /health HTTP/1.1" 200 3282


ALLOW IN=47.235.80.13 OUT= PROTO=TCP DPT=443


31.232.64.79 - - "GET / HTTP/1.1" 200 6099


Accepted password for svc_backup from 10.0.4.215 port 51341 ssh2


DROP IN=185.220.101.34 OUT= PROTO=TCP DPT=25 FLAGS=SYN


DROP IN=185.220.101.34 OUT= PROTO=TCP DPT=5432 FLAGS=SYN


DROP IN=185.220.101.34 OUT= PROTO=TCP DPT=21 FLAGS=SYN


DROP IN=185.220.101.34 OUT= PROTO=TCP DPT=3306 FLAGS=SYN


DROP IN=185.220.101.34 OUT= PROTO=TCP DPT=8080 FLAGS=SYN


DROP IN=185.220.101.34 OUT= PROTO=TCP DPT=27017 FLAGS=SYN


DROP IN=185.220.101.34 OUT= PROTO=TCP DPT=6379 FLAGS=SYN


DROP IN=185.220.101.34 OUT= PROTO=TCP DPT=53 FLAGS=SYN


DROP IN=185.220.101.34 OUT= PROTO=TCP DPT=3389 FLAGS=SYN


DROP IN=185.220.101.34 OUT= PROTO=TCP DPT=22 FLAGS=SYN


193.27.228.114 - - "GET /search?q=<script>alert(1)</script> HTTP/1.1" 403 473


193.27.228.114 - - "GET /api/products?id=1' AND SLEEP(5)-- HTTP/1.1" 200 260


Accepted password for www-data from 10.0.4.131 port 58166 ssh2


198.36.111.77 - - "GET / HTTP/1.1" 200 336


95.16.11.105 - - "GET /login HTTP/1.1" 200 3091


ALLOW IN=200.161.160.4 OUT= PROTO=TCP DPT=443


ALLOW IN=147.110.226.179 OUT= PROTO=TCP DPT=80


168.160.86.160 - - "GET /static/app.js HTTP/1.1" 200 6722


ALLOW IN=126.87.82.24 OUT= PROTO=TCP DPT=80


sudo: guest : TTY=pts/0 ; PWD=/home/guest ; USER=root ; COMMAND=/bin/su -


ALLOW IN=25.108.172.129 OUT= PROTO=TCP DPT=443


Accepted password for nattapong from 10.0.1.69 port 54972 ssh2


DROP IN=209.141.56.12 OUT= PROTO=TCP DPT=80 FLAGS=SYN


DROP IN=209.141.56.12 OUT= PROTO=TCP DPT=25 FLAGS=SYN


DROP IN=209.141.56.12 OUT= PROTO=TCP DPT=21 FLAGS=SYN


DROP IN=209.141.56.12 OUT= PROTO=TCP DPT=3306 FLAGS=SYN


DROP IN=209.141.56.12 OUT= PROTO=TCP DPT=53 FLAGS=SYN


DROP IN=209.141.56.12 OUT= PROTO=TCP DPT=6379 FLAGS=SYN


DROP IN=209.141.56.12 OUT= PROTO=TCP DPT=8080 FLAGS=SYN


DROP IN=209.141.56.12 OUT= PROTO=TCP DPT=27017 FLAGS=SYN


DROP IN=209.141.56.12 OUT= PROTO=TCP DPT=22 FLAGS=SYN


DROP IN=209.141.56.12 OUT= PROTO=TCP DPT=443 FLAGS=SYN


DROP IN=209.141.56.12 OUT= PROTO=TCP DPT=5432 FLAGS=SYN


DROP IN=209.141.56.12 OUT= PROTO=TCP DPT=3389 FLAGS=SYN


128.138.17.126 - - "GET /static/app.js HTTP/1.1" 200 3742


76.34.31.73 - - "GET / HTTP/1.1" 200 2427


ALLOW IN=212.53.35.184 OUT= PROTO=TCP DPT=443


Accepted password for oppa from 10.0.4.170 port 49930 ssh2


Accepted password for root from 10.0.4.156 port 53305 ssh2


OUTBOUND src=10.0.3.49 dst=91.219.236.18 bytes=6957301760 proto=TCP dport=443 duration=356s


Accepted password for nattapong from 10.0.2.56 port 51129 ssh2


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=21 FLAGS=SYN


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=443 FLAGS=SYN


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=53 FLAGS=SYN


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=25 FLAGS=SYN


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=6379 FLAGS=SYN


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=3306 FLAGS=SYN


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=5432 FLAGS=SYN


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=8080 FLAGS=SYN


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=80 FLAGS=SYN


27.226.52.7 - - "GET /dashboard HTTP/1.1" 200 1867


Accepted password for root from 10.0.5.149 port 59768 ssh2


Failed password for admin from 91.219.236.18 port 42406 ssh2


Failed password for admin from 91.219.236.18 port 50902 ssh2


Failed password for admin from 91.219.236.18 port 50484 ssh2


Failed password for admin from 91.219.236.18 port 58091 ssh2


Failed password for admin from 91.219.236.18 port 47839 ssh2


Failed password for admin from 91.219.236.18 port 53430 ssh2


Failed password for admin from 91.219.236.18 port 55780 ssh2


Failed password for admin from 91.219.236.18 port 46873 ssh2


Failed password for admin from 91.219.236.18 port 41108 ssh2


Failed password for admin from 91.219.236.18 port 45129 ssh2


Failed password for admin from 91.219.236.18 port 59256 ssh2


Failed password for admin from 91.219.236.18 port 46274 ssh2


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=80 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=53 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=3389 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=22 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=25 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=443 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=5432 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=21 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=27017 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=8080 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=3306 FLAGS=SYN


137.59.49.61 - - "GET /static/app.js HTTP/1.1" 200 1311


DROP IN=185.220.101.34 OUT= PROTO=TCP DPT=3389 FLAGS=SYN


DROP IN=185.220.101.34 OUT= PROTO=TCP DPT=5432 FLAGS=SYN


DROP IN=185.220.101.34 OUT= PROTO=TCP DPT=27017 FLAGS=SYN


DROP IN=185.220.101.34 OUT= PROTO=TCP DPT=80 FLAGS=SYN


DROP IN=185.220.101.34 OUT= PROTO=TCP DPT=443 FLAGS=SYN


DROP IN=185.220.101.34 OUT= PROTO=TCP DPT=8080 FLAGS=SYN


DROP IN=185.220.101.34 OUT= PROTO=TCP DPT=6379 FLAGS=SYN


DROP IN=185.220.101.34 OUT= PROTO=TCP DPT=25 FLAGS=SYN


DROP IN=185.220.101.34 OUT= PROTO=TCP DPT=53 FLAGS=SYN


DROP IN=185.220.101.34 OUT= PROTO=TCP DPT=22 FLAGS=SYN


DROP IN=185.220.101.34 OUT= PROTO=TCP DPT=21 FLAGS=SYN


DROP IN=185.220.101.34 OUT= PROTO=TCP DPT=3306 FLAGS=SYN


174.130.24.153 - - "GET / HTTP/1.1" 200 5622


Failed password for admin from 185.220.101.34 port 58840 ssh2


Failed password for admin from 185.220.101.34 port 48475 ssh2


Failed password for admin from 185.220.101.34 port 52715 ssh2


Failed password for admin from 185.220.101.34 port 52763 ssh2


Failed password for admin from 185.220.101.34 port 53252 ssh2


Failed password for admin from 185.220.101.34 port 50367 ssh2


Failed password for admin from 185.220.101.34 port 42378 ssh2


Failed password for admin from 185.220.101.34 port 49497 ssh2


Failed password for admin from 185.220.101.34 port 43876 ssh2


Failed password for admin from 185.220.101.34 port 52812 ssh2


Failed password for admin from 185.220.101.34 port 40193 ssh2


Failed password for admin from 185.220.101.34 port 56476 ssh2


Failed password for admin from 185.220.101.34 port 42072 ssh2


Failed password for admin from 185.220.101.34 port 58137 ssh2


Failed password for admin from 185.220.101.34 port 59189 ssh2


Failed password for admin from 185.220.101.34 port 54341 ssh2


Failed password for admin from 185.220.101.34 port 52947 ssh2


Failed password for admin from 185.220.101.34 port 45122 ssh2


Failed password for admin from 185.220.101.34 port 49874 ssh2


Failed password for admin from 185.220.101.34 port 42834 ssh2


Failed password for admin from 185.220.101.34 port 52226 ssh2


Failed password for admin from 185.220.101.34 port 41009 ssh2


Failed password for admin from 185.220.101.34 port 47204 ssh2


Failed password for admin from 185.220.101.34 port 49665 ssh2


Failed password for admin from 185.220.101.34 port 44721 ssh2


Accepted password for postgres from 10.0.5.165 port 43313 ssh2


sudo: nattapong : TTY=pts/0 ; PWD=/home/nattapong ; USER=root ; COMMAND=/bin/su -


ALLOW IN=109.64.28.78 OUT= PROTO=TCP DPT=80


ALLOW IN=51.60.114.147 OUT= PROTO=TCP DPT=443


CONN src=10.0.3.134 dst=209.141.56.12 dport=443 bytes=394 interval=300s


209.141.56.12 - - "GET /search?q=<script>alert(1)</script> HTTP/1.1" 200 370


186.5.16.75 - - "GET /static/app.js HTTP/1.1" 200 1824


130.52.28.121 - - "GET /health HTTP/1.1" 200 2536


CONN src=10.0.3.134 dst=209.141.56.12 dport=443 bytes=498 interval=300s


193.27.228.114 - - "GET /api/products?id='; DROP TABLE sessions;-- HTTP/1.1" 403 283


CONN src=10.0.3.134 dst=209.141.56.12 dport=443 bytes=650 interval=300s


DROP IN=209.141.56.12 OUT= PROTO=TCP DPT=3389 FLAGS=SYN


DROP IN=209.141.56.12 OUT= PROTO=TCP DPT=6379 FLAGS=SYN


DROP IN=209.141.56.12 OUT= PROTO=TCP DPT=27017 FLAGS=SYN


DROP IN=209.141.56.12 OUT= PROTO=TCP DPT=22 FLAGS=SYN


DROP IN=209.141.56.12 OUT= PROTO=TCP DPT=3306 FLAGS=SYN


DROP IN=209.141.56.12 OUT= PROTO=TCP DPT=5432 FLAGS=SYN


DROP IN=209.141.56.12 OUT= PROTO=TCP DPT=80 FLAGS=SYN


DROP IN=209.141.56.12 OUT= PROTO=TCP DPT=25 FLAGS=SYN


CONN src=10.0.5.198 dst=91.219.236.18 dport=443 bytes=635 interval=300s


CONN src=10.0.3.134 dst=209.141.56.12 dport=443 bytes=607 interval=300s


Accepted password for somchai from 10.0.1.216 port 40667 ssh2


Accepted password for somchai from 10.0.2.231 port 58170 ssh2


CONN src=10.0.5.198 dst=91.219.236.18 dport=443 bytes=743 interval=300s


CONN src=10.0.3.134 dst=209.141.56.12 dport=443 bytes=511 interval=300s


sudo: nattapong : TTY=pts/0 ; PWD=/home/nattapong ; USER=root ; COMMAND=/usr/bin/passwd root


28.180.169.50 - - "GET /api/products HTTP/1.1" 200 7752


OUTBOUND src=10.0.1.181 dst=91.219.236.18 bytes=3908042752 proto=TCP dport=443 duration=216s


CONN src=10.0.5.198 dst=91.219.236.18 dport=443 bytes=603 interval=300s


Accepted password for guest from 10.0.1.172 port 48971 ssh2


104.89.34.144 - - "GET /api/orders?page=2 HTTP/1.1" 200 6537


Accepted password for postgres from 10.0.5.246 port 57396 ssh2


CONN src=10.0.5.198 dst=91.219.236.18 dport=443 bytes=690 interval=300s


ALLOW IN=205.237.123.8 OUT= PROTO=TCP DPT=80


91.219.236.18 - - "GET /api/products?id=UNION SELECT username,password FROM users-- HTTP/1.1" 200 354


Accepted password for guest from 10.0.5.92 port 54148 ssh2


CONN src=10.0.5.198 dst=91.219.236.18 dport=443 bytes=300 interval=300s


Accepted password for admin from 10.0.0.235 port 57465 ssh2


159.1.163.119 - - "GET / HTTP/1.1" 200 6529


CONN src=10.0.2.184 dst=185.220.101.34 dport=443 bytes=233 interval=300s


Accepted password for postgres from 10.0.4.102 port 57601 ssh2


ALLOW IN=199.194.160.101 OUT= PROTO=TCP DPT=80


CONN src=10.0.2.184 dst=185.220.101.34 dport=443 bytes=595 interval=300s


CONN src=10.0.2.184 dst=185.220.101.34 dport=443 bytes=823 interval=300s


58.206.117.185 - - "GET /api/products?id=UNION SELECT username,password FROM users-- HTTP/1.1" 403 98


108.240.20.130 - - "GET /dashboard HTTP/1.1" 200 4028


CONN src=10.0.2.184 dst=185.220.101.34 dport=443 bytes=435 interval=300s


Accepted password for root from 10.0.5.173 port 47739 ssh2


ALLOW IN=45.122.241.125 OUT= PROTO=TCP DPT=80


Accepted password for svc_backup from 10.0.1.22 port 48420 ssh2


CONN src=10.0.2.184 dst=185.220.101.34 dport=443 bytes=532 interval=300s


Failed password for svc_backup from 210.202.14.50 port 54739 ssh2


Failed password for svc_backup from 210.202.14.50 port 47363 ssh2


Failed password for svc_backup from 210.202.14.50 port 59627 ssh2


Failed password for svc_backup from 210.202.14.50 port 44172 ssh2


Failed password for svc_backup from 210.202.14.50 port 56696 ssh2


Failed password for svc_backup from 210.202.14.50 port 45153 ssh2


Failed password for svc_backup from 210.202.14.50 port 53674 ssh2


Failed password for svc_backup from 210.202.14.50 port 58405 ssh2


Failed password for svc_backup from 210.202.14.50 port 44769 ssh2


Failed password for svc_backup from 210.202.14.50 port 42459 ssh2


Failed password for svc_backup from 210.202.14.50 port 59654 ssh2


Failed password for svc_backup from 210.202.14.50 port 49424 ssh2


Failed password for svc_backup from 210.202.14.50 port 49089 ssh2


Failed password for svc_backup from 210.202.14.50 port 49202 ssh2


Failed password for svc_backup from 210.202.14.50 port 51189 ssh2


Failed password for svc_backup from 210.202.14.50 port 57540 ssh2


Failed password for svc_backup from 210.202.14.50 port 41309 ssh2


Failed password for svc_backup from 210.202.14.50 port 55398 ssh2


Failed password for svc_backup from 210.202.14.50 port 50718 ssh2


CONN src=10.0.2.184 dst=185.220.101.34 dport=443 bytes=758 interval=300s


ALLOW IN=58.114.44.196 OUT= PROTO=TCP DPT=80


Accepted password for www-data from 10.0.2.38 port 54554 ssh2


ALLOW IN=146.219.117.241 OUT= PROTO=TCP DPT=443


ALLOW IN=68.24.142.236 OUT= PROTO=TCP DPT=443


23.193.74.149 - - "GET / HTTP/1.1" 200 871


Failed password for www-data from 185.220.101.34 port 57498 ssh2


Failed password for www-data from 185.220.101.34 port 50140 ssh2


Failed password for www-data from 185.220.101.34 port 46357 ssh2


Failed password for www-data from 185.220.101.34 port 58691 ssh2


Failed password for www-data from 185.220.101.34 port 55128 ssh2


Failed password for www-data from 185.220.101.34 port 59813 ssh2


Failed password for www-data from 185.220.101.34 port 48192 ssh2


Failed password for www-data from 185.220.101.34 port 52513 ssh2


Failed password for www-data from 185.220.101.34 port 55747 ssh2


Failed password for www-data from 185.220.101.34 port 56905 ssh2


Failed password for www-data from 185.220.101.34 port 49340 ssh2


Failed password for www-data from 185.220.101.34 port 45310 ssh2


Failed password for www-data from 185.220.101.34 port 45253 ssh2


Failed password for www-data from 185.220.101.34 port 57283 ssh2


Failed password for www-data from 185.220.101.34 port 54782 ssh2


Failed password for www-data from 185.220.101.34 port 58171 ssh2


Failed password for www-data from 185.220.101.34 port 54723 ssh2


Failed password for www-data from 185.220.101.34 port 43005 ssh2


Failed password for www-data from 185.220.101.34 port 40873 ssh2


Failed password for www-data from 185.220.101.34 port 41745 ssh2


Failed password for www-data from 185.220.101.34 port 56449 ssh2


Failed password for www-data from 185.220.101.34 port 44828 ssh2


193.27.228.114 - - "GET /search?q=<script>alert(1)</script> HTTP/1.1" 200 490


152.127.90.125 - - "GET /api/products HTTP/1.1" 200 5722


ALLOW IN=72.245.136.178 OUT= PROTO=TCP DPT=80


ALLOW IN=176.204.169.248 OUT= PROTO=TCP DPT=443


DROP IN=209.141.56.12 OUT= PROTO=TCP DPT=27017 FLAGS=SYN


DROP IN=209.141.56.12 OUT= PROTO=TCP DPT=21 FLAGS=SYN


DROP IN=209.141.56.12 OUT= PROTO=TCP DPT=8080 FLAGS=SYN


DROP IN=209.141.56.12 OUT= PROTO=TCP DPT=6379 FLAGS=SYN


DROP IN=209.141.56.12 OUT= PROTO=TCP DPT=5432 FLAGS=SYN


DROP IN=209.141.56.12 OUT= PROTO=TCP DPT=3389 FLAGS=SYN


DROP IN=209.141.56.12 OUT= PROTO=TCP DPT=443 FLAGS=SYN


DROP IN=209.141.56.12 OUT= PROTO=TCP DPT=25 FLAGS=SYN


DROP IN=209.141.56.12 OUT= PROTO=TCP DPT=80 FLAGS=SYN


DROP IN=209.141.56.12 OUT= PROTO=TCP DPT=22 FLAGS=SYN


DROP IN=209.141.56.12 OUT= PROTO=TCP DPT=53 FLAGS=SYN


134.158.231.231 - - "GET /api/products HTTP/1.1" 200 6600


ALLOW IN=71.179.55.20 OUT= PROTO=TCP DPT=443


Accepted password for svc_backup from 10.0.2.209 port 59135 ssh2


ALLOW IN=102.227.130.68 OUT= PROTO=TCP DPT=443


ALLOW IN=56.100.107.51 OUT= PROTO=TCP DPT=80


ALLOW IN=96.24.114.8 OUT= PROTO=TCP DPT=443


ALLOW IN=218.236.82.59 OUT= PROTO=TCP DPT=443


193.27.228.114 - - "GET /api/products?id=1' AND SLEEP(5)-- HTTP/1.1" 200 105


15.136.76.179 - - "GET /search?q=<img src=x onerror=alert(document.cookie)> HTTP/1.1" 200 18


Accepted password for oppa from 10.0.0.46 port 41637 ssh2


ALLOW IN=47.208.184.133 OUT= PROTO=TCP DPT=80


ALLOW IN=110.249.127.72 OUT= PROTO=TCP DPT=443


ALLOW IN=211.150.227.36 OUT= PROTO=TCP DPT=443


Accepted password for admin from 10.0.3.5 port 55241 ssh2


ALLOW IN=161.96.150.203 OUT= PROTO=TCP DPT=80


Accepted password for deploy from 10.0.4.219 port 42386 ssh2


OUTBOUND src=10.0.3.15 dst=45.137.21.9 bytes=5669650432 proto=TCP dport=443 duration=219s


218.91.138.63 - - "GET /static/app.js HTTP/1.1" 200 7565


sudo: postgres : TTY=pts/0 ; PWD=/home/postgres ; USER=root ; COMMAND=/usr/bin/cat /etc/shadow


Accepted password for somchai from 10.0.4.132 port 40948 ssh2


Failed password for postgres from 209.141.56.12 port 50251 ssh2


Failed password for postgres from 209.141.56.12 port 54962 ssh2


Failed password for postgres from 209.141.56.12 port 50008 ssh2


Failed password for postgres from 209.141.56.12 port 54160 ssh2


Failed password for postgres from 209.141.56.12 port 58296 ssh2


Failed password for postgres from 209.141.56.12 port 49947 ssh2


Failed password for postgres from 209.141.56.12 port 44632 ssh2


Failed password for postgres from 209.141.56.12 port 41804 ssh2


Failed password for postgres from 209.141.56.12 port 53741 ssh2


Failed password for postgres from 209.141.56.12 port 52531 ssh2


Failed password for postgres from 209.141.56.12 port 46021 ssh2


Failed password for postgres from 209.141.56.12 port 59593 ssh2


Failed password for postgres from 209.141.56.12 port 51181 ssh2


Failed password for postgres from 209.141.56.12 port 59366 ssh2


Failed password for postgres from 209.141.56.12 port 50052 ssh2


Failed password for postgres from 209.141.56.12 port 42688 ssh2


Failed password for postgres from 209.141.56.12 port 43374 ssh2


127.51.151.170 - - "GET /health HTTP/1.1" 200 4323


70.157.225.33 - - "GET /static/app.js HTTP/1.1" 200 2160


185.220.101.34 - - "GET /api/products?id=1' AND SLEEP(5)-- HTTP/1.1" 200 225


Failed password for www-data from 91.219.236.18 port 51509 ssh2


Failed password for www-data from 91.219.236.18 port 55711 ssh2


Failed password for www-data from 91.219.236.18 port 52299 ssh2


Failed password for www-data from 91.219.236.18 port 54787 ssh2


Failed password for www-data from 91.219.236.18 port 41094 ssh2


Failed password for www-data from 91.219.236.18 port 42431 ssh2


Failed password for www-data from 91.219.236.18 port 47391 ssh2


Failed password for www-data from 91.219.236.18 port 40657 ssh2


Failed password for www-data from 91.219.236.18 port 48556 ssh2


Failed password for www-data from 91.219.236.18 port 45574 ssh2


Failed password for www-data from 91.219.236.18 port 41754 ssh2


Failed password for www-data from 91.219.236.18 port 50849 ssh2


Failed password for www-data from 91.219.236.18 port 45272 ssh2


Failed password for www-data from 91.219.236.18 port 46225 ssh2


Failed password for www-data from 91.219.236.18 port 59465 ssh2


Failed password for www-data from 91.219.236.18 port 45406 ssh2


Failed password for www-data from 91.219.236.18 port 42457 ssh2


Failed password for www-data from 91.219.236.18 port 43050 ssh2


Failed password for www-data from 91.219.236.18 port 55818 ssh2


Failed password for www-data from 91.219.236.18 port 58157 ssh2


Failed password for www-data from 91.219.236.18 port 41015 ssh2


Accepted password for www-data from 91.219.236.18 port 51234 ssh2


Failed password for www-data from 91.219.236.18 port 54227 ssh2


Failed password for www-data from 91.219.236.18 port 57698 ssh2


ALLOW IN=118.101.127.47 OUT= PROTO=TCP DPT=80


Accepted password for root from 10.0.3.114 port 47678 ssh2


Accepted password for nattapong from 10.0.1.98 port 51316 ssh2


90.87.192.187 - - "GET / HTTP/1.1" 200 4726


OUTBOUND src=10.0.2.130 dst=209.141.56.12 bytes=2829058048 proto=TCP dport=443 duration=189s


sudo: somchai : TTY=pts/0 ; PWD=/home/somchai ; USER=root ; COMMAND=/usr/bin/passwd root


Accepted password for admin from 10.0.2.10 port 40432 ssh2


70.58.19.48 - - "GET /search?q=<img src=x onerror=alert(document.cookie)> HTTP/1.1" 403 21


ALLOW IN=16.95.52.73 OUT= PROTO=TCP DPT=443


22.181.117.183 - - "GET / HTTP/1.1" 200 2318


91.219.236.18 - - "GET /api/products?id=UNION SELECT username,password FROM users-- HTTP/1.1" 500 27


Failed password for somchai from 209.141.56.12 port 58260 ssh2


Failed password for somchai from 209.141.56.12 port 57627 ssh2


Failed password for somchai from 209.141.56.12 port 49209 ssh2


Failed password for somchai from 209.141.56.12 port 46787 ssh2


Failed password for somchai from 209.141.56.12 port 53357 ssh2


Failed password for somchai from 209.141.56.12 port 43754 ssh2


Failed password for somchai from 209.141.56.12 port 47965 ssh2


Failed password for somchai from 209.141.56.12 port 57283 ssh2


Failed password for somchai from 209.141.56.12 port 51485 ssh2


Failed password for somchai from 209.141.56.12 port 57137 ssh2


Failed password for somchai from 209.141.56.12 port 57170 ssh2


Failed password for somchai from 209.141.56.12 port 40394 ssh2


Failed password for somchai from 209.141.56.12 port 55503 ssh2


Failed password for somchai from 209.141.56.12 port 59525 ssh2


Failed password for somchai from 209.141.56.12 port 57552 ssh2


Failed password for somchai from 209.141.56.12 port 51544 ssh2


Failed password for somchai from 209.141.56.12 port 50946 ssh2


Failed password for somchai from 209.141.56.12 port 51574 ssh2


Failed password for somchai from 209.141.56.12 port 58245 ssh2


Failed password for somchai from 209.141.56.12 port 55683 ssh2


Failed password for somchai from 209.141.56.12 port 41152 ssh2


Failed password for somchai from 209.141.56.12 port 45114 ssh2


Failed password for somchai from 209.141.56.12 port 59372 ssh2


Failed password for somchai from 209.141.56.12 port 45253 ssh2


157.103.201.156 - - "GET /api/orders?page=2 HTTP/1.1" 200 5322


sudo: somchai : TTY=pts/0 ; PWD=/home/somchai ; USER=root ; COMMAND=/bin/bash


109.214.127.247 - - "GET /health HTTP/1.1" 200 7591


OUTBOUND src=10.0.4.112 dst=193.27.228.114 bytes=7582253056 proto=TCP dport=443 duration=464s


193.76.112.219 - - "GET /login HTTP/1.1" 200 1269


Accepted password for svc_backup from 10.0.0.163 port 58823 ssh2


Failed password for admin from 92.56.172.55 port 59274 ssh2


Failed password for admin from 92.56.172.55 port 54422 ssh2


Failed password for admin from 92.56.172.55 port 54354 ssh2


Failed password for admin from 92.56.172.55 port 51134 ssh2


Failed password for admin from 92.56.172.55 port 55194 ssh2


Failed password for admin from 92.56.172.55 port 41436 ssh2


Failed password for admin from 92.56.172.55 port 51595 ssh2


Failed password for admin from 92.56.172.55 port 43273 ssh2


Failed password for admin from 92.56.172.55 port 46267 ssh2


Failed password for admin from 92.56.172.55 port 58046 ssh2


Accepted password for www-data from 10.0.2.13 port 40116 ssh2


Accepted password for www-data from 10.0.0.125 port 57516 ssh2


Failed password for admin from 92.56.172.55 port 59329 ssh2


Failed password for admin from 92.56.172.55 port 51998 ssh2


Failed password for admin from 92.56.172.55 port 40919 ssh2


137.194.87.96 - - "GET / HTTP/1.1" 200 2968


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=3389 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=25 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=8080 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=443 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=3306 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=22 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=53 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=27017 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=21 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=6379 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=27017 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=443 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=80 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=5432 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=25 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=3306 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=22 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=3389 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=53 FLAGS=SYN


209.141.56.12 - - "GET /search?q=<script>alert(1)</script> HTTP/1.1" 403 114


71.21.202.102 - - "GET /login HTTP/1.1" 200 3755


Accepted password for somchai from 10.0.1.68 port 52110 ssh2


CONN src=10.0.5.238 dst=209.141.56.12 dport=443 bytes=264 interval=30s


CONN src=10.0.5.238 dst=209.141.56.12 dport=443 bytes=727 interval=30s


CONN src=10.0.5.238 dst=209.141.56.12 dport=443 bytes=521 interval=30s


OUTBOUND src=10.0.1.34 dst=193.27.228.114 bytes=1311768576 proto=TCP dport=443 duration=237s


CONN src=10.0.5.238 dst=209.141.56.12 dport=443 bytes=358 interval=30s


CONN src=10.0.5.238 dst=209.141.56.12 dport=443 bytes=683 interval=30s


CONN src=10.0.5.238 dst=209.141.56.12 dport=443 bytes=397 interval=30s


145.228.172.134 - - "GET /health HTTP/1.1" 200 6829


ALLOW IN=176.171.33.85 OUT= PROTO=TCP DPT=80


34.160.182.52 - - "GET /api/orders?page=2 HTTP/1.1" 200 1433


Accepted password for somchai from 10.0.0.49 port 56456 ssh2


45.137.21.9 - - "GET /search?q=<img src=x onerror=alert(document.cookie)> HTTP/1.1" 200 375


169.224.254.152 - - "GET /dashboard HTTP/1.1" 200 729


ALLOW IN=214.143.64.218 OUT= PROTO=TCP DPT=443


sudo: nattapong : TTY=pts/0 ; PWD=/home/nattapong ; USER=root ; COMMAND=/usr/bin/cat /etc/shadow


Accepted password for oppa from 10.0.1.64 port 48776 ssh2


DROP IN=185.220.101.34 OUT= PROTO=TCP DPT=3389 FLAGS=SYN


DROP IN=185.220.101.34 OUT= PROTO=TCP DPT=443 FLAGS=SYN


DROP IN=185.220.101.34 OUT= PROTO=TCP DPT=21 FLAGS=SYN


DROP IN=185.220.101.34 OUT= PROTO=TCP DPT=22 FLAGS=SYN


DROP IN=185.220.101.34 OUT= PROTO=TCP DPT=6379 FLAGS=SYN


DROP IN=185.220.101.34 OUT= PROTO=TCP DPT=80 FLAGS=SYN


DROP IN=185.220.101.34 OUT= PROTO=TCP DPT=25 FLAGS=SYN


DROP IN=185.220.101.34 OUT= PROTO=TCP DPT=5432 FLAGS=SYN


DROP IN=185.220.101.34 OUT= PROTO=TCP DPT=27017 FLAGS=SYN


DROP IN=185.220.101.34 OUT= PROTO=TCP DPT=53 FLAGS=SYN


DROP IN=185.220.101.34 OUT= PROTO=TCP DPT=3306 FLAGS=SYN


Failed password for nattapong from 128.83.70.114 port 44745 ssh2


Failed password for nattapong from 128.83.70.114 port 47147 ssh2


Failed password for nattapong from 128.83.70.114 port 44836 ssh2


Failed password for nattapong from 128.83.70.114 port 46411 ssh2


Failed password for nattapong from 128.83.70.114 port 58863 ssh2


Failed password for nattapong from 128.83.70.114 port 43147 ssh2


Failed password for nattapong from 128.83.70.114 port 40299 ssh2


Failed password for nattapong from 128.83.70.114 port 41719 ssh2


Failed password for nattapong from 128.83.70.114 port 56889 ssh2


Failed password for nattapong from 128.83.70.114 port 53995 ssh2


Failed password for nattapong from 128.83.70.114 port 53238 ssh2


Failed password for nattapong from 128.83.70.114 port 41113 ssh2


Failed password for nattapong from 128.83.70.114 port 47892 ssh2


Failed password for nattapong from 128.83.70.114 port 55527 ssh2


Failed password for nattapong from 128.83.70.114 port 52300 ssh2


Failed password for nattapong from 128.83.70.114 port 45512 ssh2


ALLOW IN=215.216.244.241 OUT= PROTO=TCP DPT=80


Failed password for nattapong from 128.83.70.114 port 56011 ssh2


Failed password for nattapong from 128.83.70.114 port 51091 ssh2


Failed password for nattapong from 128.83.70.114 port 59534 ssh2


Failed password for nattapong from 128.83.70.114 port 54215 ssh2


Failed password for nattapong from 128.83.70.114 port 52520 ssh2


Failed password for nattapong from 128.83.70.114 port 54585 ssh2


Failed password for nattapong from 128.83.70.114 port 42936 ssh2


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=443 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=53 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=3306 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=8080 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=22 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=5432 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=25 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=6379 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=80 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=27017 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=3389 FLAGS=SYN


Accepted password for deploy from 10.0.2.145 port 59659 ssh2


48.110.232.46 - - "GET /dashboard HTTP/1.1" 200 3259


119.132.59.155 - - "GET /health HTTP/1.1" 200 6773


135.112.173.163 - - "GET /health HTTP/1.1" 200 573


170.11.242.40 - - "GET /dashboard HTTP/1.1" 200 5444


CONN src=10.0.1.79 dst=45.137.21.9 dport=443 bytes=461 interval=30s


CONN src=10.0.1.79 dst=45.137.21.9 dport=443 bytes=496 interval=30s


CONN src=10.0.1.79 dst=45.137.21.9 dport=443 bytes=535 interval=30s


CONN src=10.0.1.79 dst=45.137.21.9 dport=443 bytes=322 interval=30s


208.225.15.245 - - "GET /login HTTP/1.1" 200 6423


CONN src=10.0.1.79 dst=45.137.21.9 dport=443 bytes=207 interval=30s


CONN src=10.0.1.79 dst=45.137.21.9 dport=443 bytes=709 interval=30s


Accepted password for postgres from 10.0.2.130 port 53099 ssh2


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=8080 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=6379 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=80 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=3389 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=443 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=53 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=22 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=27017 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=21 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=5432 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=25 FLAGS=SYN


120.209.12.14 - - "GET / HTTP/1.1" 200 1246


202.70.60.247 - - "GET /search?q=<img src=x onerror=alert(document.cookie)> HTTP/1.1" 200 356


114.188.213.216 - - "GET /dashboard HTTP/1.1" 200 3972


147.191.57.82 - - "GET /static/app.js HTTP/1.1" 200 3671


ALLOW IN=98.141.189.113 OUT= PROTO=TCP DPT=443


sudo: www-data : TTY=pts/0 ; PWD=/home/www-data ; USER=root ; COMMAND=/usr/bin/cat /etc/shadow


Accepted password for guest from 10.0.2.61 port 58877 ssh2


ALLOW IN=143.190.36.247 OUT= PROTO=TCP DPT=443


sudo: guest : TTY=pts/0 ; PWD=/home/guest ; USER=root ; COMMAND=/bin/bash


52.69.54.126 - - "GET / HTTP/1.1" 200 1104


ALLOW IN=179.111.62.182 OUT= PROTO=TCP DPT=80


ALLOW IN=213.125.4.40 OUT= PROTO=TCP DPT=80


ALLOW IN=221.15.241.156 OUT= PROTO=TCP DPT=443


ALLOW IN=219.5.182.57 OUT= PROTO=TCP DPT=443


185.220.101.34 - - "GET /search?q=<script>alert(1)</script> HTTP/1.1" 200 39


ALLOW IN=129.157.11.102 OUT= PROTO=TCP DPT=443


Failed password for oppa from 91.219.236.18 port 47284 ssh2


Failed password for oppa from 91.219.236.18 port 47608 ssh2


Failed password for oppa from 91.219.236.18 port 48229 ssh2


Failed password for oppa from 91.219.236.18 port 43673 ssh2


Failed password for oppa from 91.219.236.18 port 43346 ssh2


Failed password for oppa from 91.219.236.18 port 53293 ssh2


Failed password for oppa from 91.219.236.18 port 56528 ssh2


Failed password for oppa from 91.219.236.18 port 57075 ssh2


Failed password for oppa from 91.219.236.18 port 50812 ssh2


Failed password for oppa from 91.219.236.18 port 41054 ssh2


Failed password for oppa from 91.219.236.18 port 42080 ssh2


Failed password for oppa from 91.219.236.18 port 51654 ssh2


Accepted password for oppa from 91.219.236.18 port 51234 ssh2


Failed password for oppa from 91.219.236.18 port 41474 ssh2


sudo: guest : TTY=pts/0 ; PWD=/home/guest ; USER=root ; COMMAND=/bin/su -


ALLOW IN=144.155.38.235 OUT= PROTO=TCP DPT=80


Accepted password for root from 10.0.4.219 port 49101 ssh2


90.156.68.215 - - "GET /health HTTP/1.1" 200 5719


Accepted password for root from 10.0.4.94 port 53288 ssh2


CONN src=10.0.5.9 dst=193.27.228.114 dport=443 bytes=338 interval=30s


CONN src=10.0.5.9 dst=193.27.228.114 dport=443 bytes=223 interval=30s


CONN src=10.0.5.9 dst=193.27.228.114 dport=443 bytes=822 interval=30s


CONN src=10.0.5.9 dst=193.27.228.114 dport=443 bytes=468 interval=30s


CONN src=10.0.5.9 dst=193.27.228.114 dport=443 bytes=547 interval=30s


CONN src=10.0.5.9 dst=193.27.228.114 dport=443 bytes=361 interval=30s


Failed password for somchai from 209.141.56.12 port 55906 ssh2


CONN src=10.0.5.9 dst=193.27.228.114 dport=443 bytes=404 interval=30s


Failed password for somchai from 209.141.56.12 port 57669 ssh2


Failed password for somchai from 209.141.56.12 port 58711 ssh2


Failed password for somchai from 209.141.56.12 port 55498 ssh2


Failed password for somchai from 209.141.56.12 port 43176 ssh2


Failed password for somchai from 209.141.56.12 port 55488 ssh2


Failed password for somchai from 209.141.56.12 port 46239 ssh2


Failed password for somchai from 209.141.56.12 port 53193 ssh2


Failed password for somchai from 209.141.56.12 port 48147 ssh2


Failed password for somchai from 209.141.56.12 port 53879 ssh2


Failed password for somchai from 209.141.56.12 port 55303 ssh2


Failed password for somchai from 209.141.56.12 port 54124 ssh2


Failed password for somchai from 209.141.56.12 port 41775 ssh2


Accepted password for somchai from 209.141.56.12 port 51234 ssh2


Failed password for somchai from 209.141.56.12 port 43224 ssh2


Failed password for somchai from 209.141.56.12 port 51118 ssh2


ALLOW IN=94.92.13.183 OUT= PROTO=TCP DPT=80


157.119.42.155 - - "GET /health HTTP/1.1" 200 3734


41.129.22.17 - - "GET /api/products HTTP/1.1" 200 5668


DROP IN=209.141.56.12 OUT= PROTO=TCP DPT=8080 FLAGS=SYN


DROP IN=209.141.56.12 OUT= PROTO=TCP DPT=5432 FLAGS=SYN


DROP IN=209.141.56.12 OUT= PROTO=TCP DPT=6379 FLAGS=SYN


DROP IN=209.141.56.12 OUT= PROTO=TCP DPT=53 FLAGS=SYN


DROP IN=209.141.56.12 OUT= PROTO=TCP DPT=80 FLAGS=SYN


DROP IN=209.141.56.12 OUT= PROTO=TCP DPT=21 FLAGS=SYN


DROP IN=209.141.56.12 OUT= PROTO=TCP DPT=3306 FLAGS=SYN


DROP IN=209.141.56.12 OUT= PROTO=TCP DPT=443 FLAGS=SYN


DROP IN=209.141.56.12 OUT= PROTO=TCP DPT=22 FLAGS=SYN


65.198.98.212 - - "GET /static/app.js HTTP/1.1" 200 2597


Accepted password for postgres from 10.0.5.59 port 51063 ssh2


Accepted password for somchai from 10.0.4.211 port 50800 ssh2


Accepted password for root from 10.0.4.22 port 49537 ssh2


ALLOW IN=128.148.104.106 OUT= PROTO=TCP DPT=80


Accepted password for guest from 10.0.3.249 port 47969 ssh2


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=80 FLAGS=SYN


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=443 FLAGS=SYN


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=53 FLAGS=SYN


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=8080 FLAGS=SYN


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=3306 FLAGS=SYN


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=22 FLAGS=SYN


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=5432 FLAGS=SYN


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=6379 FLAGS=SYN


ALLOW IN=200.50.106.161 OUT= PROTO=TCP DPT=80


CONN src=10.0.0.173 dst=193.27.228.114 dport=443 bytes=594 interval=30s


91.219.236.18 - - "GET /search?q=<img src=x onerror=alert(document.cookie)> HTTP/1.1" 403 144


CONN src=10.0.0.173 dst=193.27.228.114 dport=443 bytes=392 interval=30s


CONN src=10.0.0.173 dst=193.27.228.114 dport=443 bytes=699 interval=30s


CONN src=10.0.0.173 dst=193.27.228.114 dport=443 bytes=307 interval=30s


CONN src=10.0.0.173 dst=193.27.228.114 dport=443 bytes=548 interval=30s


CONN src=10.0.0.173 dst=193.27.228.114 dport=443 bytes=413 interval=30s


CONN src=10.0.0.173 dst=193.27.228.114 dport=443 bytes=804 interval=30s


CONN src=10.0.0.173 dst=193.27.228.114 dport=443 bytes=740 interval=30s


129.208.33.124 - - "GET / HTTP/1.1" 200 3538


153.212.188.204 - - "GET /api/orders?page=2 HTTP/1.1" 200 677


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=27017 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=8080 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=53 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=21 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=443 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=80 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=25 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=3389 FLAGS=SYN


ALLOW IN=126.115.68.9 OUT= PROTO=TCP DPT=80


Accepted password for oppa from 10.0.1.212 port 53126 ssh2


Accepted password for nattapong from 10.0.4.13 port 53722 ssh2


91.219.236.18 - - "GET /api/products?id='; DROP TABLE sessions;-- HTTP/1.1" 200 15


Accepted password for www-data from 10.0.3.233 port 59139 ssh2


sudo: nattapong : TTY=pts/0 ; PWD=/home/nattapong ; USER=root ; COMMAND=/bin/bash


Failed password for svc_backup from 45.137.21.9 port 48877 ssh2


Failed password for svc_backup from 45.137.21.9 port 44573 ssh2


Failed password for svc_backup from 45.137.21.9 port 59067 ssh2


223.213.237.235 - - "GET /static/app.js HTTP/1.1" 200 4884


Failed password for svc_backup from 45.137.21.9 port 47791 ssh2


Failed password for svc_backup from 45.137.21.9 port 43442 ssh2


Failed password for svc_backup from 45.137.21.9 port 45024 ssh2


Failed password for svc_backup from 45.137.21.9 port 56440 ssh2


Failed password for svc_backup from 45.137.21.9 port 59375 ssh2


Failed password for svc_backup from 45.137.21.9 port 41617 ssh2


Failed password for svc_backup from 45.137.21.9 port 44576 ssh2


Failed password for svc_backup from 45.137.21.9 port 54470 ssh2


Failed password for svc_backup from 45.137.21.9 port 55274 ssh2


Failed password for svc_backup from 45.137.21.9 port 48235 ssh2


Failed password for svc_backup from 45.137.21.9 port 44156 ssh2


Failed password for svc_backup from 45.137.21.9 port 47741 ssh2


Failed password for svc_backup from 45.137.21.9 port 48335 ssh2


Failed password for svc_backup from 45.137.21.9 port 50529 ssh2


Failed password for svc_backup from 45.137.21.9 port 57684 ssh2


Accepted password for somchai from 10.0.4.167 port 51006 ssh2


ALLOW IN=133.166.10.104 OUT= PROTO=TCP DPT=443


Accepted password for nattapong from 10.0.0.56 port 43701 ssh2


16.125.209.50 - - "GET / HTTP/1.1" 200 7424


OUTBOUND src=10.0.3.235 dst=185.220.101.34 bytes=6686769152 proto=TCP dport=443 duration=450s


166.133.80.165 - - "GET /health HTTP/1.1" 200 5933


Accepted password for deploy from 10.0.4.114 port 43941 ssh2


ALLOW IN=176.23.178.126 OUT= PROTO=TCP DPT=443


ALLOW IN=81.129.14.183 OUT= PROTO=TCP DPT=443


40.172.86.6 - - "GET /static/app.js HTTP/1.1" 200 2871


ALLOW IN=117.94.48.128 OUT= PROTO=TCP DPT=80


Accepted password for root from 10.0.3.75 port 47085 ssh2


209.141.56.12 - - "GET /search?q=<script>alert(1)</script> HTTP/1.1" 403 312


136.168.215.147 - - "GET /health HTTP/1.1" 200 304


218.0.109.184 - - "GET /search?q=<img src=x onerror=alert(document.cookie)> HTTP/1.1" 200 398


189.223.122.15 - - "GET /login HTTP/1.1" 200 906


Accepted password for oppa from 10.0.1.225 port 41024 ssh2


OUTBOUND src=10.0.2.137 dst=91.219.236.18 bytes=4803526656 proto=TCP dport=443 duration=200s


ALLOW IN=125.104.138.79 OUT= PROTO=TCP DPT=443


ALLOW IN=69.253.234.100 OUT= PROTO=TCP DPT=443


sudo: svc_backup : TTY=pts/0 ; PWD=/home/svc_backup ; USER=root ; COMMAND=/usr/bin/passwd root


ALLOW IN=30.47.57.137 OUT= PROTO=TCP DPT=80


45.137.21.9 - - "GET /search?q=<script>alert(1)</script> HTTP/1.1" 403 51


Accepted password for svc_backup from 10.0.2.100 port 58587 ssh2


Accepted password for oppa from 10.0.2.233 port 50858 ssh2


DROP IN=105.44.219.251 OUT= PROTO=TCP DPT=80 FLAGS=SYN


DROP IN=105.44.219.251 OUT= PROTO=TCP DPT=27017 FLAGS=SYN


DROP IN=105.44.219.251 OUT= PROTO=TCP DPT=53 FLAGS=SYN


DROP IN=105.44.219.251 OUT= PROTO=TCP DPT=8080 FLAGS=SYN


DROP IN=105.44.219.251 OUT= PROTO=TCP DPT=25 FLAGS=SYN


DROP IN=105.44.219.251 OUT= PROTO=TCP DPT=3306 FLAGS=SYN


DROP IN=105.44.219.251 OUT= PROTO=TCP DPT=443 FLAGS=SYN


DROP IN=105.44.219.251 OUT= PROTO=TCP DPT=22 FLAGS=SYN


DROP IN=105.44.219.251 OUT= PROTO=TCP DPT=5432 FLAGS=SYN


DROP IN=105.44.219.251 OUT= PROTO=TCP DPT=21 FLAGS=SYN


Failed password for svc_backup from 86.49.211.54 port 43260 ssh2


Failed password for svc_backup from 86.49.211.54 port 59551 ssh2


Failed password for svc_backup from 86.49.211.54 port 56314 ssh2


Failed password for svc_backup from 86.49.211.54 port 47549 ssh2


Failed password for svc_backup from 86.49.211.54 port 51227 ssh2


Failed password for svc_backup from 86.49.211.54 port 50983 ssh2


Failed password for svc_backup from 86.49.211.54 port 47516 ssh2


18.53.40.46 - - "GET /api/products HTTP/1.1" 200 6009


Failed password for svc_backup from 86.49.211.54 port 51648 ssh2


Failed password for svc_backup from 86.49.211.54 port 47774 ssh2


Failed password for svc_backup from 86.49.211.54 port 46511 ssh2


Failed password for svc_backup from 86.49.211.54 port 42126 ssh2


Failed password for svc_backup from 86.49.211.54 port 59837 ssh2


Failed password for svc_backup from 86.49.211.54 port 47777 ssh2


Failed password for svc_backup from 86.49.211.54 port 44664 ssh2


Failed password for svc_backup from 86.49.211.54 port 40997 ssh2


Failed password for svc_backup from 86.49.211.54 port 44401 ssh2


Failed password for svc_backup from 86.49.211.54 port 55953 ssh2


Accepted password for svc_backup from 86.49.211.54 port 51234 ssh2


36.101.249.244 - - "GET /api/products HTTP/1.1" 200 3125


Failed password for svc_backup from 86.49.211.54 port 55273 ssh2


Failed password for svc_backup from 86.49.211.54 port 45652 ssh2


DROP IN=72.223.189.113 OUT= PROTO=TCP DPT=21 FLAGS=SYN


DROP IN=72.223.189.113 OUT= PROTO=TCP DPT=53 FLAGS=SYN


DROP IN=72.223.189.113 OUT= PROTO=TCP DPT=22 FLAGS=SYN


DROP IN=72.223.189.113 OUT= PROTO=TCP DPT=25 FLAGS=SYN


DROP IN=72.223.189.113 OUT= PROTO=TCP DPT=3306 FLAGS=SYN


DROP IN=72.223.189.113 OUT= PROTO=TCP DPT=3389 FLAGS=SYN


DROP IN=72.223.189.113 OUT= PROTO=TCP DPT=80 FLAGS=SYN


DROP IN=72.223.189.113 OUT= PROTO=TCP DPT=443 FLAGS=SYN


DROP IN=72.223.189.113 OUT= PROTO=TCP DPT=6379 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=21 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=5432 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=53 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=3306 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=8080 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=22 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=443 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=25 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=3389 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=6379 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=80 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=27017 FLAGS=SYN


ALLOW IN=63.173.106.187 OUT= PROTO=TCP DPT=443


Accepted password for root from 10.0.3.152 port 55913 ssh2


sudo: guest : TTY=pts/0 ; PWD=/home/guest ; USER=root ; COMMAND=/usr/bin/cat /etc/shadow


87.165.3.30 - - "GET /api/orders?page=2 HTTP/1.1" 200 2930


Accepted password for nattapong from 10.0.3.108 port 44312 ssh2


Accepted password for postgres from 10.0.0.137 port 47110 ssh2


CONN src=10.0.0.136 dst=91.219.236.18 dport=443 bytes=718 interval=300s


CONN src=10.0.0.136 dst=91.219.236.18 dport=443 bytes=759 interval=300s


CONN src=10.0.0.136 dst=91.219.236.18 dport=443 bytes=558 interval=300s


Accepted password for svc_backup from 10.0.5.94 port 59322 ssh2


CONN src=10.0.0.4 dst=91.219.236.18 dport=443 bytes=761 interval=300s


100.204.169.241 - - "GET / HTTP/1.1" 200 1144


CONN src=10.0.0.136 dst=91.219.236.18 dport=443 bytes=861 interval=300s


Accepted password for guest from 10.0.1.33 port 40965 ssh2


ALLOW IN=56.167.177.145 OUT= PROTO=TCP DPT=80


CONN src=10.0.0.4 dst=91.219.236.18 dport=443 bytes=776 interval=300s


CONN src=10.0.0.136 dst=91.219.236.18 dport=443 bytes=895 interval=300s


CONN src=10.0.0.4 dst=91.219.236.18 dport=443 bytes=294 interval=300s


CONN src=10.0.0.136 dst=91.219.236.18 dport=443 bytes=225 interval=300s


CONN src=10.0.0.4 dst=91.219.236.18 dport=443 bytes=833 interval=300s


149.115.1.99 - - "GET /search?q=<img src=x onerror=alert(document.cookie)> HTTP/1.1" 200 290


38.137.65.201 - - "GET / HTTP/1.1" 200 7783


CONN src=10.0.0.136 dst=91.219.236.18 dport=443 bytes=290 interval=300s


CONN src=10.0.0.4 dst=91.219.236.18 dport=443 bytes=317 interval=300s


Accepted password for deploy from 10.0.1.120 port 42516 ssh2


CONN src=10.0.0.136 dst=91.219.236.18 dport=443 bytes=234 interval=300s


CONN src=10.0.0.4 dst=91.219.236.18 dport=443 bytes=718 interval=300s


Accepted password for nattapong from 10.0.2.13 port 45037 ssh2


CONN src=10.0.0.136 dst=91.219.236.18 dport=443 bytes=577 interval=300s


Accepted password for deploy from 10.0.4.150 port 50681 ssh2


Accepted password for somchai from 10.0.5.127 port 42620 ssh2


193.27.228.114 - - "GET /api/products?id=UNION SELECT username,password FROM users-- HTTP/1.1" 403 374


Accepted password for oppa from 10.0.2.60 port 50272 ssh2


ALLOW IN=116.127.147.147 OUT= PROTO=TCP DPT=80


Failed password for postgres from 91.219.236.18 port 58250 ssh2


Failed password for postgres from 91.219.236.18 port 50626 ssh2


Failed password for postgres from 91.219.236.18 port 47505 ssh2


Failed password for postgres from 91.219.236.18 port 50336 ssh2


Failed password for postgres from 91.219.236.18 port 46913 ssh2


Failed password for postgres from 91.219.236.18 port 56358 ssh2


Failed password for postgres from 91.219.236.18 port 48773 ssh2


Failed password for postgres from 91.219.236.18 port 48679 ssh2


Failed password for postgres from 91.219.236.18 port 48081 ssh2


Failed password for postgres from 91.219.236.18 port 55035 ssh2


Failed password for postgres from 91.219.236.18 port 44532 ssh2


Failed password for postgres from 91.219.236.18 port 50311 ssh2


Failed password for postgres from 91.219.236.18 port 41543 ssh2


Failed password for postgres from 91.219.236.18 port 45008 ssh2


Failed password for postgres from 91.219.236.18 port 59121 ssh2


Failed password for postgres from 91.219.236.18 port 51861 ssh2


Failed password for postgres from 91.219.236.18 port 58394 ssh2


Failed password for postgres from 91.219.236.18 port 48609 ssh2


Failed password for postgres from 91.219.236.18 port 59155 ssh2


Failed password for postgres from 91.219.236.18 port 56171 ssh2


201.236.37.210 - - "GET /login HTTP/1.1" 200 2651


209.220.165.176 - - "GET /static/app.js HTTP/1.1" 200 933


Accepted password for guest from 10.0.0.11 port 56361 ssh2


73.232.206.26 - - "GET /api/orders?page=2 HTTP/1.1" 200 4515


ALLOW IN=163.80.193.201 OUT= PROTO=TCP DPT=80


18.189.219.47 - - "GET /api/products HTTP/1.1" 200 3915


sudo: www-data : TTY=pts/0 ; PWD=/home/www-data ; USER=root ; COMMAND=/bin/bash


206.191.15.237 - - "GET /login HTTP/1.1" 200 2830


139.166.235.172 - - "GET /login HTTP/1.1" 200 3340


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=22 FLAGS=SYN


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=3389 FLAGS=SYN


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=25 FLAGS=SYN


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=5432 FLAGS=SYN


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=3306 FLAGS=SYN


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=8080 FLAGS=SYN


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=21 FLAGS=SYN


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=6379 FLAGS=SYN


185.220.101.34 - - "GET /search?q=<img src=x onerror=alert(document.cookie)> HTTP/1.1" 403 313


ALLOW IN=214.181.0.89 OUT= PROTO=TCP DPT=443


99.153.217.177 - - "GET /api/products HTTP/1.1" 200 3942


ALLOW IN=177.99.121.194 OUT= PROTO=TCP DPT=80


209.31.195.100 - - "GET /api/products HTTP/1.1" 200 692


192.251.125.194 - - "GET /api/products HTTP/1.1" 200 3005


ALLOW IN=82.16.91.238 OUT= PROTO=TCP DPT=443


CONN src=10.0.4.63 dst=209.141.56.12 dport=443 bytes=712 interval=300s


OUTBOUND src=10.0.5.109 dst=209.141.56.12 bytes=6383730688 proto=TCP dport=443 duration=505s


119.168.17.150 - - "GET /login HTTP/1.1" 200 6019


ALLOW IN=200.122.20.220 OUT= PROTO=TCP DPT=443


Accepted password for postgres from 10.0.5.129 port 43191 ssh2


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=5432 FLAGS=SYN


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=27017 FLAGS=SYN


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=22 FLAGS=SYN


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=80 FLAGS=SYN


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=3389 FLAGS=SYN


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=443 FLAGS=SYN


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=8080 FLAGS=SYN


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=53 FLAGS=SYN


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=25 FLAGS=SYN


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=3306 FLAGS=SYN


CONN src=10.0.4.63 dst=209.141.56.12 dport=443 bytes=519 interval=300s


sudo: somchai : TTY=pts/0 ; PWD=/home/somchai ; USER=root ; COMMAND=/bin/bash


128.158.190.72 - - "GET /login HTTP/1.1" 200 737


CONN src=10.0.4.63 dst=209.141.56.12 dport=443 bytes=608 interval=300s


92.72.9.25 - - "GET /health HTTP/1.1" 200 3491


196.17.203.103 - - "GET /api/products HTTP/1.1" 200 6181


CONN src=10.0.4.63 dst=209.141.56.12 dport=443 bytes=833 interval=300s


ALLOW IN=127.141.218.178 OUT= PROTO=TCP DPT=443


CONN src=10.0.4.63 dst=209.141.56.12 dport=443 bytes=258 interval=300s


204.241.106.167 - - "GET /health HTTP/1.1" 200 1903


CONN src=10.0.4.63 dst=209.141.56.12 dport=443 bytes=759 interval=300s


OUTBOUND src=10.0.5.109 dst=193.27.228.114 bytes=3747610624 proto=TCP dport=443 duration=381s


CONN src=10.0.4.63 dst=209.141.56.12 dport=443 bytes=313 interval=300s


Accepted password for guest from 10.0.0.132 port 53923 ssh2


CONN src=10.0.4.63 dst=209.141.56.12 dport=443 bytes=796 interval=300s


Failed password for www-data from 91.219.236.18 port 57611 ssh2


Failed password for www-data from 91.219.236.18 port 42816 ssh2


Failed password for www-data from 91.219.236.18 port 52464 ssh2


Failed password for www-data from 91.219.236.18 port 55692 ssh2


Failed password for www-data from 91.219.236.18 port 56720 ssh2


Failed password for www-data from 91.219.236.18 port 40413 ssh2


Failed password for www-data from 91.219.236.18 port 50035 ssh2


Failed password for www-data from 91.219.236.18 port 55928 ssh2


ALLOW IN=60.93.48.154 OUT= PROTO=TCP DPT=80


CONN src=10.0.4.63 dst=209.141.56.12 dport=443 bytes=682 interval=300s


ALLOW IN=175.143.108.39 OUT= PROTO=TCP DPT=80


ALLOW IN=96.64.48.239 OUT= PROTO=TCP DPT=443


DROP IN=185.220.101.34 OUT= PROTO=TCP DPT=443 FLAGS=SYN


DROP IN=185.220.101.34 OUT= PROTO=TCP DPT=22 FLAGS=SYN


DROP IN=185.220.101.34 OUT= PROTO=TCP DPT=21 FLAGS=SYN


DROP IN=185.220.101.34 OUT= PROTO=TCP DPT=8080 FLAGS=SYN


DROP IN=185.220.101.34 OUT= PROTO=TCP DPT=53 FLAGS=SYN


DROP IN=185.220.101.34 OUT= PROTO=TCP DPT=27017 FLAGS=SYN


DROP IN=185.220.101.34 OUT= PROTO=TCP DPT=3389 FLAGS=SYN


DROP IN=185.220.101.34 OUT= PROTO=TCP DPT=25 FLAGS=SYN


DROP IN=185.220.101.34 OUT= PROTO=TCP DPT=3306 FLAGS=SYN


DROP IN=185.220.101.34 OUT= PROTO=TCP DPT=6379 FLAGS=SYN


DROP IN=185.220.101.34 OUT= PROTO=TCP DPT=5432 FLAGS=SYN


DROP IN=185.220.101.34 OUT= PROTO=TCP DPT=80 FLAGS=SYN


ALLOW IN=221.251.22.10 OUT= PROTO=TCP DPT=443


Accepted password for www-data from 10.0.4.8 port 42341 ssh2


Accepted password for somchai from 10.0.2.148 port 52168 ssh2


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=3389 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=53 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=27017 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=8080 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=443 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=25 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=6379 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=5432 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=80 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=22 FLAGS=SYN


CONN src=10.0.1.172 dst=185.220.101.34 dport=443 bytes=216 interval=300s


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=80 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=8080 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=53 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=3389 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=6379 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=21 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=22 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=443 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=3306 FLAGS=SYN


101.196.98.249 - - "GET /api/products HTTP/1.1" 200 503


CONN src=10.0.1.172 dst=185.220.101.34 dport=443 bytes=497 interval=300s


34.101.35.133 - - "GET / HTTP/1.1" 200 1108


193.27.228.114 - - "GET /search?q=<img src=x onerror=alert(document.cookie)> HTTP/1.1" 403 149


CONN src=10.0.1.172 dst=185.220.101.34 dport=443 bytes=835 interval=300s


174.154.216.103 - - "GET / HTTP/1.1" 200 1706


Failed password for postgres from 91.219.236.18 port 47855 ssh2


Failed password for postgres from 91.219.236.18 port 47266 ssh2


Failed password for postgres from 91.219.236.18 port 46351 ssh2


Failed password for postgres from 91.219.236.18 port 40758 ssh2


Failed password for postgres from 91.219.236.18 port 48036 ssh2


Failed password for postgres from 91.219.236.18 port 43635 ssh2


Failed password for postgres from 91.219.236.18 port 41695 ssh2


Failed password for postgres from 91.219.236.18 port 43508 ssh2


Failed password for postgres from 91.219.236.18 port 52389 ssh2


Failed password for postgres from 91.219.236.18 port 42718 ssh2


Failed password for postgres from 91.219.236.18 port 49255 ssh2


Failed password for postgres from 91.219.236.18 port 42535 ssh2


Failed password for postgres from 91.219.236.18 port 52805 ssh2


Failed password for postgres from 91.219.236.18 port 56090 ssh2


Failed password for postgres from 91.219.236.18 port 53557 ssh2


Failed password for postgres from 91.219.236.18 port 59526 ssh2


Failed password for postgres from 91.219.236.18 port 58984 ssh2


Failed password for postgres from 91.219.236.18 port 45918 ssh2


Failed password for postgres from 91.219.236.18 port 51842 ssh2


Accepted password for postgres from 91.219.236.18 port 51234 ssh2


CONN src=10.0.4.57 dst=209.141.56.12 dport=443 bytes=569 interval=30s


CONN src=10.0.4.57 dst=209.141.56.12 dport=443 bytes=765 interval=30s


CONN src=10.0.4.57 dst=209.141.56.12 dport=443 bytes=505 interval=30s


CONN src=10.0.4.57 dst=209.141.56.12 dport=443 bytes=393 interval=30s


ALLOW IN=108.123.254.234 OUT= PROTO=TCP DPT=80


CONN src=10.0.4.57 dst=209.141.56.12 dport=443 bytes=465 interval=30s


CONN src=10.0.4.57 dst=209.141.56.12 dport=443 bytes=535 interval=30s


CONN src=10.0.1.172 dst=185.220.101.34 dport=443 bytes=567 interval=300s


CONN src=10.0.4.57 dst=209.141.56.12 dport=443 bytes=606 interval=30s


ALLOW IN=199.48.164.230 OUT= PROTO=TCP DPT=443


13.104.84.174 - - "GET / HTTP/1.1" 200 843


ALLOW IN=147.225.188.200 OUT= PROTO=TCP DPT=443


CONN src=10.0.1.172 dst=185.220.101.34 dport=443 bytes=665 interval=300s


Failed password for root from 125.126.125.66 port 48031 ssh2


Failed password for root from 125.126.125.66 port 54944 ssh2


Failed password for root from 125.126.125.66 port 41318 ssh2


Failed password for root from 125.126.125.66 port 46226 ssh2


Failed password for root from 125.126.125.66 port 57123 ssh2


Failed password for root from 125.126.125.66 port 48708 ssh2


Failed password for root from 125.126.125.66 port 47457 ssh2


Failed password for root from 125.126.125.66 port 59191 ssh2


Failed password for root from 125.126.125.66 port 49092 ssh2


Failed password for root from 125.126.125.66 port 41994 ssh2


Failed password for root from 125.126.125.66 port 42086 ssh2


Failed password for root from 125.126.125.66 port 43220 ssh2


Failed password for root from 125.126.125.66 port 55639 ssh2


CONN src=10.0.1.172 dst=185.220.101.34 dport=443 bytes=866 interval=300s


80.211.53.202 - - "GET /login HTTP/1.1" 200 7079


sudo: postgres : TTY=pts/0 ; PWD=/home/postgres ; USER=root ; COMMAND=/usr/bin/cat /etc/shadow


DROP IN=209.141.56.12 OUT= PROTO=TCP DPT=5432 FLAGS=SYN


DROP IN=209.141.56.12 OUT= PROTO=TCP DPT=443 FLAGS=SYN


DROP IN=209.141.56.12 OUT= PROTO=TCP DPT=8080 FLAGS=SYN


DROP IN=209.141.56.12 OUT= PROTO=TCP DPT=53 FLAGS=SYN


DROP IN=209.141.56.12 OUT= PROTO=TCP DPT=21 FLAGS=SYN


DROP IN=209.141.56.12 OUT= PROTO=TCP DPT=25 FLAGS=SYN


DROP IN=209.141.56.12 OUT= PROTO=TCP DPT=6379 FLAGS=SYN


DROP IN=209.141.56.12 OUT= PROTO=TCP DPT=80 FLAGS=SYN


DROP IN=209.141.56.12 OUT= PROTO=TCP DPT=3306 FLAGS=SYN


DROP IN=209.141.56.12 OUT= PROTO=TCP DPT=22 FLAGS=SYN


DROP IN=209.141.56.12 OUT= PROTO=TCP DPT=27017 FLAGS=SYN


CONN src=10.0.1.172 dst=185.220.101.34 dport=443 bytes=653 interval=300s


ALLOW IN=208.94.67.113 OUT= PROTO=TCP DPT=443


ALLOW IN=39.92.211.180 OUT= PROTO=TCP DPT=443


CONN src=10.0.1.172 dst=185.220.101.34 dport=443 bytes=641 interval=300s


Accepted password for root from 10.0.2.200 port 52858 ssh2


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=3389 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=6379 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=53 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=80 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=443 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=27017 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=5432 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=3306 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=21 FLAGS=SYN


DROP IN=91.219.236.18 OUT= PROTO=TCP DPT=22 FLAGS=SYN


ALLOW IN=59.216.84.213 OUT= PROTO=TCP DPT=443


CONN src=10.0.1.172 dst=185.220.101.34 dport=443 bytes=383 interval=300s


ALLOW IN=157.209.11.84 OUT= PROTO=TCP DPT=80


ALLOW IN=120.95.41.167 OUT= PROTO=TCP DPT=80


CONN src=10.0.1.172 dst=185.220.101.34 dport=443 bytes=523 interval=300s


61.28.130.71 - - "GET /api/products HTTP/1.1" 200 618


Accepted password for somchai from 10.0.3.245 port 43219 ssh2


Accepted password for oppa from 10.0.0.209 port 51076 ssh2


Accepted password for somchai from 10.0.1.143 port 42459 ssh2


213.33.85.131 - - "GET /dashboard HTTP/1.1" 200 6354


ALLOW IN=121.252.39.124 OUT= PROTO=TCP DPT=80


ALLOW IN=79.178.235.231 OUT= PROTO=TCP DPT=443


68.14.163.239 - - "GET / HTTP/1.1" 200 7074


193.227.226.39 - - "GET /api/orders?page=2 HTTP/1.1" 200 7475


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=3389 FLAGS=SYN


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=443 FLAGS=SYN


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=5432 FLAGS=SYN


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=21 FLAGS=SYN


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=3306 FLAGS=SYN


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=6379 FLAGS=SYN


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=53 FLAGS=SYN


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=25 FLAGS=SYN


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=22 FLAGS=SYN


Accepted password for svc_backup from 10.0.5.126 port 57938 ssh2


Accepted password for deploy from 10.0.5.173 port 56703 ssh2


153.124.105.178 - - "GET / HTTP/1.1" 200 815


ALLOW IN=140.17.140.3 OUT= PROTO=TCP DPT=80


Accepted password for admin from 10.0.0.213 port 44638 ssh2


178.140.56.215 - - "GET /login HTTP/1.1" 200 241


CONN src=10.0.0.184 dst=45.137.21.9 dport=443 bytes=799 interval=60s


CONN src=10.0.0.184 dst=45.137.21.9 dport=443 bytes=706 interval=60s


ALLOW IN=56.0.42.171 OUT= PROTO=TCP DPT=80


CONN src=10.0.0.184 dst=45.137.21.9 dport=443 bytes=426 interval=60s


163.78.89.66 - - "GET /dashboard HTTP/1.1" 200 3998


DROP IN=37.134.79.22 OUT= PROTO=TCP DPT=5432 FLAGS=SYN


DROP IN=37.134.79.22 OUT= PROTO=TCP DPT=3306 FLAGS=SYN


DROP IN=37.134.79.22 OUT= PROTO=TCP DPT=6379 FLAGS=SYN


DROP IN=37.134.79.22 OUT= PROTO=TCP DPT=27017 FLAGS=SYN


DROP IN=37.134.79.22 OUT= PROTO=TCP DPT=21 FLAGS=SYN


DROP IN=37.134.79.22 OUT= PROTO=TCP DPT=80 FLAGS=SYN


DROP IN=37.134.79.22 OUT= PROTO=TCP DPT=22 FLAGS=SYN


DROP IN=37.134.79.22 OUT= PROTO=TCP DPT=8080 FLAGS=SYN


DROP IN=37.134.79.22 OUT= PROTO=TCP DPT=3389 FLAGS=SYN


DROP IN=37.134.79.22 OUT= PROTO=TCP DPT=25 FLAGS=SYN


DROP IN=37.134.79.22 OUT= PROTO=TCP DPT=443 FLAGS=SYN


CONN src=10.0.0.184 dst=45.137.21.9 dport=443 bytes=805 interval=60s


212.47.180.46 - - "GET /dashboard HTTP/1.1" 200 6807


ALLOW IN=97.58.206.46 OUT= PROTO=TCP DPT=443


CONN src=10.0.0.184 dst=45.137.21.9 dport=443 bytes=644 interval=60s


CONN src=10.0.0.184 dst=45.137.21.9 dport=443 bytes=881 interval=60s


ALLOW IN=161.132.38.6 OUT= PROTO=TCP DPT=80


ALLOW IN=79.30.51.174 OUT= PROTO=TCP DPT=443


ALLOW IN=203.243.181.217 OUT= PROTO=TCP DPT=443


ALLOW IN=164.194.134.57 OUT= PROTO=TCP DPT=80


Accepted password for somchai from 10.0.4.142 port 52156 ssh2


ALLOW IN=154.124.86.176 OUT= PROTO=TCP DPT=443


sudo: postgres : TTY=pts/0 ; PWD=/home/postgres ; USER=root ; COMMAND=/bin/bash


ALLOW IN=155.22.247.12 OUT= PROTO=TCP DPT=80


64.176.108.106 - - "GET /api/orders?page=2 HTTP/1.1" 200 7175


OUTBOUND src=10.0.0.144 dst=193.27.228.114 bytes=7090470912 proto=TCP dport=443 duration=486s


ALLOW IN=192.196.81.97 OUT= PROTO=TCP DPT=443


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=5432 FLAGS=SYN


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=6379 FLAGS=SYN


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=80 FLAGS=SYN


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=21 FLAGS=SYN


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=3306 FLAGS=SYN


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=8080 FLAGS=SYN


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=22 FLAGS=SYN


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=3389 FLAGS=SYN


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=25 FLAGS=SYN


ALLOW IN=86.126.37.22 OUT= PROTO=TCP DPT=443


Accepted password for root from 10.0.1.244 port 44839 ssh2


ALLOW IN=206.91.23.38 OUT= PROTO=TCP DPT=443


ALLOW IN=11.5.176.146 OUT= PROTO=TCP DPT=80


193.27.228.114 - - "GET /search?q=<script>alert(1)</script> HTTP/1.1" 403 474


196.205.45.51 - - "GET /login HTTP/1.1" 200 886


Accepted password for admin from 10.0.3.47 port 45286 ssh2


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=5432 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=21 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=6379 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=443 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=8080 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=27017 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=25 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=22 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=80 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=53 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=3306 FLAGS=SYN


DROP IN=207.63.51.172 OUT= PROTO=TCP DPT=21 FLAGS=SYN


DROP IN=207.63.51.172 OUT= PROTO=TCP DPT=3306 FLAGS=SYN


DROP IN=207.63.51.172 OUT= PROTO=TCP DPT=25 FLAGS=SYN


DROP IN=207.63.51.172 OUT= PROTO=TCP DPT=5432 FLAGS=SYN


DROP IN=207.63.51.172 OUT= PROTO=TCP DPT=8080 FLAGS=SYN


DROP IN=207.63.51.172 OUT= PROTO=TCP DPT=22 FLAGS=SYN


DROP IN=207.63.51.172 OUT= PROTO=TCP DPT=53 FLAGS=SYN


DROP IN=207.63.51.172 OUT= PROTO=TCP DPT=80 FLAGS=SYN


DROP IN=207.63.51.172 OUT= PROTO=TCP DPT=27017 FLAGS=SYN


DROP IN=207.63.51.172 OUT= PROTO=TCP DPT=6379 FLAGS=SYN


DROP IN=207.63.51.172 OUT= PROTO=TCP DPT=3389 FLAGS=SYN


DROP IN=207.63.51.172 OUT= PROTO=TCP DPT=443 FLAGS=SYN


ALLOW IN=222.154.178.108 OUT= PROTO=TCP DPT=80


sudo: www-data : TTY=pts/0 ; PWD=/home/www-data ; USER=root ; COMMAND=/usr/bin/cat /etc/shadow


Accepted password for somchai from 10.0.4.99 port 40298 ssh2


ALLOW IN=110.192.16.79 OUT= PROTO=TCP DPT=443


96.95.22.85 - - "GET /api/orders?page=2 HTTP/1.1" 200 4392


Accepted password for somchai from 10.0.0.129 port 46822 ssh2


sudo: postgres : TTY=pts/0 ; PWD=/home/postgres ; USER=root ; COMMAND=/bin/bash


Failed password for oppa from 192.12.158.144 port 58328 ssh2


Failed password for oppa from 192.12.158.144 port 46305 ssh2


Failed password for oppa from 192.12.158.144 port 55592 ssh2


Failed password for oppa from 192.12.158.144 port 57754 ssh2


Failed password for oppa from 192.12.158.144 port 57427 ssh2


Failed password for oppa from 192.12.158.144 port 40621 ssh2


Failed password for oppa from 192.12.158.144 port 41732 ssh2


Failed password for oppa from 192.12.158.144 port 58990 ssh2


Failed password for oppa from 192.12.158.144 port 57096 ssh2


Failed password for oppa from 192.12.158.144 port 40611 ssh2


Failed password for oppa from 192.12.158.144 port 46743 ssh2


ALLOW IN=20.185.84.91 OUT= PROTO=TCP DPT=443


82.249.142.168 - - "GET /login HTTP/1.1" 200 6189


196.140.76.104 - - "GET /dashboard HTTP/1.1" 200 4812


Accepted password for oppa from 10.0.5.127 port 54293 ssh2


Accepted password for www-data from 10.0.4.2 port 53860 ssh2


Failed password for admin from 173.176.73.69 port 53040 ssh2


Failed password for admin from 173.176.73.69 port 45518 ssh2


Failed password for admin from 173.176.73.69 port 50095 ssh2


Failed password for admin from 173.176.73.69 port 42288 ssh2


Failed password for admin from 173.176.73.69 port 40051 ssh2


Failed password for admin from 173.176.73.69 port 45780 ssh2


Failed password for admin from 173.176.73.69 port 55940 ssh2


Failed password for admin from 173.176.73.69 port 56469 ssh2


Failed password for admin from 173.176.73.69 port 53691 ssh2


Failed password for admin from 173.176.73.69 port 53659 ssh2


Failed password for admin from 173.176.73.69 port 46107 ssh2


Failed password for admin from 173.176.73.69 port 49448 ssh2


Failed password for admin from 173.176.73.69 port 54121 ssh2


Failed password for admin from 173.176.73.69 port 44401 ssh2


219.103.197.228 - - "GET /api/products HTTP/1.1" 200 3694


200.96.59.147 - - "GET /api/products HTTP/1.1" 200 1243


ALLOW IN=58.55.145.147 OUT= PROTO=TCP DPT=443


Accepted password for deploy from 10.0.1.235 port 53342 ssh2


DROP IN=192.81.47.158 OUT= PROTO=TCP DPT=22 FLAGS=SYN


DROP IN=192.81.47.158 OUT= PROTO=TCP DPT=5432 FLAGS=SYN


DROP IN=192.81.47.158 OUT= PROTO=TCP DPT=80 FLAGS=SYN


DROP IN=192.81.47.158 OUT= PROTO=TCP DPT=25 FLAGS=SYN


DROP IN=192.81.47.158 OUT= PROTO=TCP DPT=3306 FLAGS=SYN


DROP IN=192.81.47.158 OUT= PROTO=TCP DPT=53 FLAGS=SYN


DROP IN=192.81.47.158 OUT= PROTO=TCP DPT=443 FLAGS=SYN


DROP IN=192.81.47.158 OUT= PROTO=TCP DPT=3389 FLAGS=SYN


DROP IN=192.81.47.158 OUT= PROTO=TCP DPT=6379 FLAGS=SYN


DROP IN=192.81.47.158 OUT= PROTO=TCP DPT=8080 FLAGS=SYN


DROP IN=192.81.47.158 OUT= PROTO=TCP DPT=21 FLAGS=SYN


DROP IN=192.81.47.158 OUT= PROTO=TCP DPT=27017 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=22 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=53 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=3306 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=6379 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=80 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=8080 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=3389 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=21 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=25 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=27017 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=443 FLAGS=SYN


DROP IN=45.137.21.9 OUT= PROTO=TCP DPT=5432 FLAGS=SYN


Failed password for www-data from 45.137.21.9 port 54419 ssh2


Failed password for www-data from 45.137.21.9 port 42026 ssh2


Failed password for www-data from 45.137.21.9 port 48377 ssh2


Failed password for www-data from 45.137.21.9 port 44225 ssh2


Failed password for www-data from 45.137.21.9 port 48037 ssh2


Failed password for www-data from 45.137.21.9 port 42459 ssh2


Failed password for www-data from 45.137.21.9 port 52300 ssh2


Failed password for www-data from 45.137.21.9 port 43180 ssh2


Failed password for www-data from 45.137.21.9 port 54494 ssh2


Failed password for www-data from 45.137.21.9 port 58765 ssh2


Failed password for www-data from 45.137.21.9 port 50695 ssh2


Failed password for www-data from 45.137.21.9 port 51972 ssh2


Failed password for www-data from 45.137.21.9 port 48694 ssh2


Failed password for www-data from 45.137.21.9 port 55080 ssh2


Failed password for www-data from 45.137.21.9 port 50481 ssh2


Failed password for www-data from 45.137.21.9 port 55320 ssh2


Failed password for www-data from 45.137.21.9 port 41783 ssh2


Failed password for www-data from 45.137.21.9 port 42619 ssh2


Failed password for www-data from 45.137.21.9 port 57193 ssh2


ALLOW IN=163.196.236.149 OUT= PROTO=TCP DPT=80


98.133.160.206 - - "GET /api/orders?page=2 HTTP/1.1" 200 603


185.220.101.34 - - "GET /api/products?id=UNION SELECT username,password FROM users-- HTTP/1.1" 403 202


ALLOW IN=114.160.254.164 OUT= PROTO=TCP DPT=80


51.50.248.76 - - "GET /login HTTP/1.1" 200 5117


109.124.211.253 - - "GET /api/orders?page=2 HTTP/1.1" 200 3373


CONN src=10.0.4.108 dst=45.137.21.9 dport=443 bytes=500 interval=300s


CONN src=10.0.4.108 dst=45.137.21.9 dport=443 bytes=405 interval=300s


Failed password for postgres from 209.141.56.12 port 53995 ssh2


Failed password for postgres from 209.141.56.12 port 51380 ssh2


Failed password for postgres from 209.141.56.12 port 49890 ssh2


Failed password for postgres from 209.141.56.12 port 57693 ssh2


Failed password for postgres from 209.141.56.12 port 49827 ssh2


Failed password for postgres from 209.141.56.12 port 40609 ssh2


Failed password for postgres from 209.141.56.12 port 46556 ssh2


Failed password for postgres from 209.141.56.12 port 58902 ssh2


Failed password for postgres from 209.141.56.12 port 53182 ssh2


Failed password for postgres from 209.141.56.12 port 56887 ssh2


Failed password for postgres from 209.141.56.12 port 57942 ssh2


Failed password for postgres from 209.141.56.12 port 47876 ssh2


Failed password for postgres from 209.141.56.12 port 49839 ssh2


Failed password for postgres from 209.141.56.12 port 46978 ssh2


Failed password for postgres from 209.141.56.12 port 57456 ssh2


Failed password for postgres from 209.141.56.12 port 56915 ssh2


Failed password for postgres from 209.141.56.12 port 55154 ssh2


Failed password for postgres from 209.141.56.12 port 55312 ssh2


Failed password for postgres from 209.141.56.12 port 53443 ssh2


Failed password for postgres from 209.141.56.12 port 42111 ssh2


Failed password for postgres from 209.141.56.12 port 54212 ssh2


Failed password for postgres from 209.141.56.12 port 41962 ssh2


Failed password for postgres from 209.141.56.12 port 46574 ssh2


Failed password for postgres from 209.141.56.12 port 46670 ssh2


CONN src=10.0.4.108 dst=45.137.21.9 dport=443 bytes=281 interval=300s


Accepted password for root from 10.0.5.54 port 49913 ssh2


CONN src=10.0.4.210 dst=185.220.101.34 dport=443 bytes=729 interval=60s


CONN src=10.0.4.210 dst=185.220.101.34 dport=443 bytes=854 interval=60s


CONN src=10.0.4.210 dst=185.220.101.34 dport=443 bytes=597 interval=60s


91.219.236.18 - - "GET /search?q=<script>alert(1)</script> HTTP/1.1" 200 96


CONN src=10.0.4.210 dst=185.220.101.34 dport=443 bytes=261 interval=60s


CONN src=10.0.4.108 dst=45.137.21.9 dport=443 bytes=685 interval=300s


CONN src=10.0.4.210 dst=185.220.101.34 dport=443 bytes=206 interval=60s


CONN src=10.0.4.210 dst=185.220.101.34 dport=443 bytes=749 interval=60s


CONN src=10.0.4.210 dst=185.220.101.34 dport=443 bytes=215 interval=60s


CONN src=10.0.4.210 dst=185.220.101.34 dport=443 bytes=310 interval=60s


Accepted password for nattapong from 10.0.1.192 port 53263 ssh2


125.232.157.69 - - "GET /dashboard HTTP/1.1" 200 2086


CONN src=10.0.4.210 dst=185.220.101.34 dport=443 bytes=685 interval=60s


CONN src=10.0.4.108 dst=45.137.21.9 dport=443 bytes=290 interval=300s


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=21 FLAGS=SYN


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=53 FLAGS=SYN


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=8080 FLAGS=SYN


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=6379 FLAGS=SYN


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=80 FLAGS=SYN


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=22 FLAGS=SYN


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=3389 FLAGS=SYN


DROP IN=193.27.228.114 OUT= PROTO=TCP DPT=27017 FLAGS=SYN


ALLOW IN=115.242.110.164 OUT= PROTO=TCP DPT=80


ALLOW IN=194.166.205.247 OUT= PROTO=TCP DPT=443


ALLOW IN=164.166.197.4 OUT= PROTO=TCP DPT=443


45.137.21.9 - - "GET /search?q=<img src=x onerror=alert(document.cookie)> HTTP/1.1" 200 495


ALLOW IN=75.47.33.161 OUT= PROTO=TCP DPT=80


Accepted password for root from 10.0.5.188 port 57250 ssh2


Accepted password for nattapong from 10.0.1.208 port 46525 ssh2


DROP IN=155.110.191.13 OUT= PROTO=TCP DPT=80 FLAGS=SYN


DROP IN=155.110.191.13 OUT= PROTO=TCP DPT=8080 FLAGS=SYN


DROP IN=155.110.191.13 OUT= PROTO=TCP DPT=27017 FLAGS=SYN


DROP IN=155.110.191.13 OUT= PROTO=TCP DPT=5432 FLAGS=SYN


DROP IN=155.110.191.13 OUT= PROTO=TCP DPT=3389 FLAGS=SYN


DROP IN=155.110.191.13 OUT= PROTO=TCP DPT=22 FLAGS=SYN


DROP IN=155.110.191.13 OUT= PROTO=TCP DPT=3306 FLAGS=SYN


DROP IN=155.110.191.13 OUT= PROTO=TCP DPT=443 FLAGS=SYN


45.137.21.9 - - "GET /search?q=<img src=x onerror=alert(document.cookie)> HTTP/1.1" 200 477


Failed password for admin from 88.171.231.126 port 48432 ssh2


Failed password for admin from 88.171.231.126 port 55941 ssh2


Failed password for admin from 88.171.231.126 port 51937 ssh2


Failed password for admin from 88.171.231.126 port 40444 ssh2


Failed password for admin from 88.171.231.126 port 49867 ssh2


Failed password for admin from 88.171.231.126 port 53445 ssh2


Failed password for admin from 88.171.231.126 port 44641 ssh2


Failed password for admin from 88.171.231.126 port 48007 ssh2


Failed password for admin from 88.171.231.126 port 43694 ssh2


Failed password for admin from 88.171.231.126 port 50935 ssh2


Failed password for admin from 88.171.231.126 port 57016 ssh2


Failed password for admin from 88.171.231.126 port 52379 ssh2


Failed password for admin from 88.171.231.126 port 59521 ssh2


Failed password for admin from 88.171.231.126 port 56312 ssh2


Failed password for admin from 88.171.231.126 port 40679 ssh2


Failed password for admin from 88.171.231.126 port 46760 ssh2


Failed password for admin from 88.171.231.126 port 54113 ssh2


Failed password for admin from 88.171.231.126 port 42925 ssh2


Failed password for guest from 181.106.242.100 port 45197 ssh2


Failed password for admin from 88.171.231.126 port 43536 ssh2


Failed password for guest from 181.106.242.100 port 41382 ssh2


Failed password for guest from 181.106.242.100 port 58008 ssh2


Failed password for guest from 181.106.242.100 port 51810 ssh2


Failed password for guest from 181.106.242.100 port 47136 ssh2


Failed password for guest from 181.106.242.100 port 55768 ssh2


Failed password for guest from 181.106.242.100 port 47732 ssh2