Infrastructure Security & Threat Telemetry
Audit Run: 2m 31s 2026-09-04
Attacks Blocked
1,305
Across 7-day lookback
Attacker IPs
408
Unique IPv4 addresses
Coordinated Attackers
26
Targeting ≥2 fleet servers
Stale Daemons
46
Pending daemon restarts
Pending Reboots
0
Fleet kernel up-to-date
Execution Duration
2m 31s
Full parallel audit run
CRITICAL AUDIT FINDINGS REQUIRING ACTION

Infrastructure Fleet Posture Overview

4 Target Hosts Audited
Host Fail2ban Status 7-Day Events Active Bans Docker Exposed Stale Libraries Reboot Status
home.mwan.dev
17:02:29 up 6 days, 50 min, 2 users, load average: 0.41, 0.34, 0.29		 FAILED (grafana log) 0 0 currently banned 4 exposed Clean OK
c1.mwan.dev
00:02:29 up 4 days, 9:39, 1 user, load average: 0.28, 0.22, 0.19		 Active (6 jails) 345 2 currently banned 0 9 daemons OK
c2.mwan.dev
00:02:29 up 6 days, 3:14, 2 users, load average: 0.04, 0.07, 0.08		 Active (3 jails) 565 2 currently banned 0 27 daemons OK
c3.mwan.dev
00:02:29 up 4 days, 20:25, 1 user, load average: 0.14, 0.10, 0.09		 Active (5 jails) 395 3 currently banned 0 10 daemons OK

Attack Activity by Hour of Day (UTC)

Targeted Services & Jails Breakdown

Top 10 Offending Attacker IPs

High Recidivism
Rank IP Address Geolocation ASN / Organization Attack Events Targeted Hosts Targeted Jails
#1 213.209.159.230 Germany, Aachen AS208137 Feo Prest SRL 30 (12 bans) c1 c2 c3 recidive sshd
#2 185.93.89.23 The Netherlands, Eygelshoven AS213790 Limited Network LTD 26 (8 bans) c1 c3 recidive sshd
#3 217.216.109.215 Singapore, Singapore AS141995 Contabo Asia Private Limited 15 (3 bans) c2 c3 recidive sshd
#4 186.180.130.170 Colombia, Cali AS13489 UNE EPM TELECOMUNICACIONES S.A. 14 (3 bans) c1 c3 recidive sshd
#5 185.240.215.110 Colombia, Pasto AS272869 INTERCOMM DE NARIÑO SAS 13 (4 bans) c1 recidive sshd
#6 189.90.33.195 Brazil, Imperatriz AS28191 Jupiter Telecomunicacoes e Informatica Ltda 13 (4 bans) c2 recidive sshd
#7 116.99.171.205 Vietnam, Hanoi AS24086 Viettel Corporation 10 (2 bans) c1 c3 recidive sshd
#8 171.231.196.247 Vietnam, Da Nang AS7552 Viettel Group 10 (2 bans) c1 c3 recidive sshd
#9 171.231.185.233 Vietnam, Da Nang AS7552 Viettel Group 10 (2 bans) c1 c3 recidive sshd
#10 116.110.210.76 Vietnam, Da Nang AS24086 Viettel Corporation 10 (2 bans) c1 c3 recidive sshd

Top Offending /24 Subnets

Firewall CIDR Candidates
Rank Subnet Volume Recommendation
#1 213.209.159.0/24 30 attacks Candidate for nftables CIDR Drop
#2 185.93.89.0/24 26 attacks Candidate for nftables CIDR Drop
#3 171.231.196.0/24 20 attacks Candidate for nftables CIDR Drop
#4 171.231.185.0/24 20 attacks Candidate for nftables CIDR Drop
#5 217.216.109.0/24 15 attacks Candidate for nftables CIDR Drop

Top Attacking ASNs & Cloud Providers

Rank Autonomous System Attack Volume
#1 AS14061 DigitalOcean, LLC 99 events
#2 AS7552 Viettel Group 62 events
#3 AS24086 Viettel Corporation 43 events
#4 AS31898 Oracle Corporation 42 events
#5 AS4134 CHINANET BACKBONE 38 events

Check #1: Docker Port Exposure Audit (Wildcard Sockets)

Firewall Bypass Vector
Host Container Name Image Port Binding Exposure Level
home.mwan.dev teslamate-grafana-1 teslamate/grafana:latest 0.0.0.0:3000->3000/tcp, [::]:3000->3000/tcp 0.0.0.0 Wildcard
home.mwan.dev teslamate-teslamate-1 teslamate/teslamate:latest 0.0.0.0:4000->4000/tcp, [::]:4000->4000/tcp 0.0.0.0 Wildcard
home.mwan.dev immich_server ghcr.io/immich-app/immich-server:release 0.0.0.0:2283->2283/tcp, [::]:2283->2283/tcp 0.0.0.0 Wildcard
home.mwan.dev jellyfin jellyfin/jellyfin:latest 0.0.0.0:8096->8096/tcp, [::]:8096->8096/tcp 0.0.0.0 Wildcard
Note: Docker modifies iptables/nftables prerouting chains by default, allowing external traffic to hit these ports even if host UFW is set to default-deny.

Check #2: In-Memory Stale Libraries

Restart Required
Host Service / Process Status Remediation Command
c1.mwan.dev getty@tty1.service Outdated Shared Lib sudo systemctl restart getty@tty1.service
c1.mwan.dev libvirtd.service Outdated Shared Lib sudo systemctl restart libvirtd.service
c1.mwan.dev NetworkManager.service Outdated Shared Lib sudo systemctl restart NetworkManager.service
c1.mwan.dev serial-getty@ttyAMA0.service Outdated Shared Lib sudo systemctl restart serial-getty@ttyAMA0.service
c1.mwan.dev systemd-logind.service Outdated Shared Lib sudo systemctl restart systemd-logind.service
c1.mwan.dev unattended-upgrades.service Outdated Shared Lib sudo systemctl restart unattended-upgrades.service
c1.mwan.dev virtlockd.service Outdated Shared Lib sudo systemctl restart virtlockd.service
c1.mwan.dev virtlogd.service Outdated Shared Lib sudo systemctl restart virtlogd.service
c1.mwan.dev wpa_supplicant.service Outdated Shared Lib sudo systemctl restart wpa_supplicant.service
c2.mwan.dev (sd-pam) Deleted Lib in Memory Restart process / daemon
c2.mwan.dev ModemManager Deleted Lib in Memory Restart process / daemon
c2.mwan.dev NetworkManager Deleted Lib in Memory Restart process / daemon
c2.mwan.dev dbus-daemon Deleted Lib in Memory Restart process / daemon
c2.mwan.dev fail2ban-server Deleted Lib in Memory Restart process / daemon
c2.mwan.dev fsidd Deleted Lib in Memory Restart process / daemon
c2.mwan.dev fwupd Deleted Lib in Memory Restart process / daemon
c2.mwan.dev iscsid Deleted Lib in Memory Restart process / daemon
c2.mwan.dev libvirtd Deleted Lib in Memory Restart process / daemon
c2.mwan.dev nfsdcld Deleted Lib in Memory Restart process / daemon
c2.mwan.dev polkitd Deleted Lib in Memory Restart process / daemon
c2.mwan.dev python3 Deleted Lib in Memory Restart process / daemon
c2.mwan.dev qbittorrent-nox Deleted Lib in Memory Restart process / daemon
c2.mwan.dev rpc.idmapd Deleted Lib in Memory Restart process / daemon
c2.mwan.dev rpc.mountd Deleted Lib in Memory Restart process / daemon
c2.mwan.dev systemd Deleted Lib in Memory Restart process / daemon
c2.mwan.dev systemd-journal Deleted Lib in Memory Restart process / daemon
c2.mwan.dev systemd-logind Deleted Lib in Memory Restart process / daemon
c2.mwan.dev systemd-machine Deleted Lib in Memory Restart process / daemon
c2.mwan.dev systemd-network Deleted Lib in Memory Restart process / daemon
c2.mwan.dev systemd-resolve Deleted Lib in Memory Restart process / daemon
c2.mwan.dev systemd-timesyn Deleted Lib in Memory Restart process / daemon
c2.mwan.dev systemd-udevd Deleted Lib in Memory Restart process / daemon
c2.mwan.dev unattended-upgr Deleted Lib in Memory Restart process / daemon
c2.mwan.dev virtlockd Deleted Lib in Memory Restart process / daemon
c2.mwan.dev virtlogd Deleted Lib in Memory Restart process / daemon
c2.mwan.dev wpa_supplicant Deleted Lib in Memory Restart process / daemon
c3.mwan.dev dbus.service Outdated Shared Lib sudo systemctl restart dbus.service
c3.mwan.dev getty@tty1.service Outdated Shared Lib sudo systemctl restart getty@tty1.service
c3.mwan.dev libvirtd.service Outdated Shared Lib sudo systemctl restart libvirtd.service
c3.mwan.dev NetworkManager.service Outdated Shared Lib sudo systemctl restart NetworkManager.service
c3.mwan.dev serial-getty@ttyAMA0.service Outdated Shared Lib sudo systemctl restart serial-getty@ttyAMA0.service
c3.mwan.dev systemd-logind.service Outdated Shared Lib sudo systemctl restart systemd-logind.service
c3.mwan.dev unattended-upgrades.service Outdated Shared Lib sudo systemctl restart unattended-upgrades.service
c3.mwan.dev virtlockd.service Outdated Shared Lib sudo systemctl restart virtlockd.service
c3.mwan.dev virtlogd.service Outdated Shared Lib sudo systemctl restart virtlogd.service
c3.mwan.dev wpa_supplicant.service Outdated Shared Lib sudo systemctl restart wpa_supplicant.service

Check #4: Persistence & Systemd Linger Audit

Host Mechanism Entity Operational Impact

All 4 hosts have lingering enabled for mason. Verified authorized to execute user-space background timers (e.g. agy-remote-control, daily-digest, audit-server-attacks-weekly). No rogue crontabs or unrecognized user unit files detected.

Actionable Remediation & Hardening Roadmap

Prioritized
Priority 1 (Urgent) Fix Fail2ban Configuration on home.mwan.dev

Fail2ban crashed due to a missing log file for Grafana. Fix the path in /etc/fail2ban/jail.local or disable the grafana jail, then restart:

sudo sed -i '/^\[grafana\]/,/^\[/ s/^enabled = true/enabled = false/' /etc/fail2ban/jail.local && sudo systemctl restart fail2ban
Priority 2 Restrict Docker Port Exposure on home.mwan.dev

Bind Docker container ports to localhost (127.0.0.1:3000:3000, 127.0.0.1:4000:4000, 127.0.0.1:2283:2283) in compose files so they cannot be accessed directly without an authenticated reverse proxy.

Priority 3 Refresh Outdated In-Memory Daemons

Execute sudo needrestart -r a on c1 and c3, and restart fail2ban, qbittorrent-nox, and NetworkManager on c2 to purge stale shared libraries from memory.

Priority 4 Add Top Attacker Subnets to NFTables Blocklist

Append top offender CIDRs (213.209.159.0/24, 185.93.89.0/24, 171.231.196.0/24, 171.231.185.0/24, 217.216.109.0/24) into nftables @blocked_subnets to drop brute-force packets before hitting daemon sockets.