Dear colleagues,

our detection systems registered the following possible problem(s) related to host
192.168.1.1, that appears to belong to your IP address range or domain:


[1] The machine performed some type of active scanning.
    https://csirt.cesnet.cz/cs/services/eventclass/recon-scanning

    ===========================================================================
    Source:                 10.0.0.0/25
    First event:            2018-01-01 13:00:00 Z
    Last event:             2018-01-01 13:00:00 Z
    Events:                 1
    ---------------------------------------------------------------------------
    Details from detector org.example.dionaea:
    Connection count        42
    Source port             22
    Target IP addresses     11.2.2.0/24, 2004:ffff::ff00:42:0/112

    ===========================================================================
    Source:                 10.0.1.2-10.0.1.5
    First event:            2018-01-01 13:00:00 Z
    Last event:             2018-01-01 13:00:00 Z
    Events:                 1
    ---------------------------------------------------------------------------
    Details from detector org.example.dionaea:
    Connection count        42
    Source port             22
    Target IP addresses     11.2.2.0/24, 2004:ffff::ff00:42:0/112

    ===========================================================================
    Source:                 10.0.2.1
    First event:            2018-01-01 13:00:00 Z
    Last event:             2018-01-01 13:00:00 Z
    Events:                 1
    ---------------------------------------------------------------------------
    Details from detector org.example.dionaea:
    Connection count        42
    Source port             22, 23
    Target IP addresses     11.2.2.0/24, 2004:ffff::ff00:42:0/112

    ===========================================================================


our detection systems registered the following RECURRING possible problem(s) related to
host 192.168.1.1, that appears to belong to your IP address range or domain:


[1] The machine performed some type of active scanning.
    https://csirt.cesnet.cz/cs/services/eventclass/recon-scanning

    ===========================================================================
    Source:                 10.0.0.0/25
    First event:            2018-01-01 13:00:00 Z
    Last event:             2018-01-01 13:00:00 Z
    Events:                 1
    ---------------------------------------------------------------------------
    Details from detector org.example.dionaea:
    Connection count        42
    Source port             22
    Target IP addresses     11.2.2.0/24, 2004:ffff::ff00:42:0/112

    ===========================================================================
    Source:                 10.0.1.2-10.0.1.5
    First event:            2018-01-01 13:00:00 Z
    Last event:             2018-01-01 13:00:00 Z
    Events:                 1
    ---------------------------------------------------------------------------
    Details from detector org.example.dionaea:
    Connection count        42
    Source port             22
    Target IP addresses     11.2.2.0/24, 2004:ffff::ff00:42:0/112

    ===========================================================================
    Source:                 10.0.2.1
    First event:            2018-01-01 13:00:00 Z
    Last event:             2018-01-01 13:00:00 Z
    Events:                 1
    ---------------------------------------------------------------------------
    Details from detector org.example.dionaea:
    Connection count        42
    Source port             22, 23
    Target IP addresses     11.2.2.0/24, 2004:ffff::ff00:42:0/112

    ===========================================================================

These possible problem(s) were already reported to you some time before, however we have
detected relapses.

This report contains events with LOW severity. Please consider reviewing the host systems
mentioned in this report and fix any possible issues.

Link to interactive web version of this report and complete data:
https://URL/view=REPORT_LABEL/unauth

For further communication please keep the identifier [REPORT_LABEL] in email subject.

Thank you in advance for your cooperation

CESNET-CERTS <certs@cesnet.cz>
https://csirt.cesnet.cz/en/index