It’s just trawlers, scripts that ping ip address ranges, and if they get a response, they try to login on port 22 with default passwords, and stuff like that, and run portscans to see what ports you have open, and they send standard requests to standard ports looking for access.

Essentially going around to everybody’s house and knocking on the door, and see if they can be easily let inside. they keep knocking until you stop answering the door. There’s stuff like fail2ban (I think) that blacklists any ip address that tries to login more than X amount of times

Unless somebody knows specifically what service you are running and what port is on, it is unlikely to be anything more sophisticated than that.

Welcome to the World Wild Web

It is not a solution but advice, and I am sorry if I offended you. I think you need to close your server. It is not worth it to protect your server. There’s a possibility that your server is shared with other attackers. More attackers means a high probability that you get compromised. With one wrong setting, your whole network will be compromised. Maybe pay for service instead.

Surely you should have the answers before exposing sensitive devices to the outside world?

Not trying to be mean but if you don’t understand what’s happening and why then how can you guard against it?

Everybody gets probed, that is normal. Make it difficult by taking basic precautions and they will move on to easier targets. There’s so many people that don’t do anything and leave themselves wide open. This is what they’re looking for in most cases. Exceptions do include people you might have upset and specifically want access to yours.

Do some homework, secure / segregate your stuff and move on :)

Very possible as something like Minecraft server is popular enough so if there’s known vulnerabilities they might be trying to exploit them. Be sure you are hosting that on a separate vlan that is split from rest of your network.

If you want to be more safe only allow your friends’ IPs through.

I don’t know from what software you posted these screenshots, but most of these alerts are complete horseshit.

There are only four billion IPv4 addresses. A modest botnet containing only 1000 nodes, each scanning one IP a second, can scan the entire space every month and a half.

This is typical. I ran a betting pool (in minecraft) with my friends on which country the latest unauthorized connection attempt was from. Prior to 2022 the safe money was Russia.

It would appear that your router is already proactively denying requests from known-bad connections. That’s good, but not sufficient.

If you expose SSH, use a public key or a strong (>128 bit strength) random password. Keep all port-forwarded software up to date to limit vulnerabilities. Use containers or virtual machines to limit the impact of a vulnerability.

It seems as they are on a blacklist of your duck dns but not because they tried to hack you but because on those IPs where malware / phishing websites hosted. Likely somebody used those server now as Proxy / tor exit node. It’s of course possible he had bad intentions but that’s not the reason he was blocked. (at least the screenshot suggests that)

Concerning the attack on the wifi I’m not sure what you mean. Do you mean the wifi router / internet modem? Because to gain access to your wifi network from different countries seems very unlikely.

If I had a dollar for every time someone attempted to “attack” one of my pubic facing servers I probly wouldn’t need a job. The moment you have 443 open on your network you get 100s of bots scanning you a day.

Thanks for all the help everyone!

Oui

Without even looking, yes. If it is on the Internet, it is being attacked.

Harden the OS where Minecraft is hosted. https://dev.to/samerickson/how-to-create-a-minecraft-server-hardening-the-server-30ko

who attacks a minecraft server?

every firewall/router with a public IP address gets hammered with this garbage. it’s happening constantly.