Week 1 | Notion

I ran the virtual host for around 10 minutes and immediately logged the firewall.

Here is the summary.

Analysis

Timestamp	Source IP	Destination Port	Protocol
2024-09-12 03:22:50	87.251.75.136	49798	TCP
2024-09-12 03:22:54	82.46.16.199	23	TCP
2024-09-12 03:23:04	79.110.62.78	13080	TCP
2024-09-12 03:23:06	205.210.31.166	465	TCP
2024-09-12 03:23:20	167.94.138.139	3702	UDP
2024-09-12 03:23:36	112.6.212.233	2376	TCP
2024-09-12 03:23:40	208.115.200.22	123	UDP
2024-09-12 03:23:56	162.216.150.136	2212	TCP
2024-09-12 03:23:59	115.231.78.10	587	TCP
2024-09-12 03:24:03	87.251.75.136	16578	TCP
2024-09-12 03:24:09	87.251.75.136	6770	TCP
2024-09-12 03:24:16	165.154.129.43	3109	TCP
2024-09-12 03:24:18	87.251.75.136	14034	TCP
2024-09-12 03:24:22	70.73.124.136	23	TCP
2024-09-12 03:24:40	27.254.65.111	23	TCP
2024-09-12 03:24:55	79.110.62.78	1861	TCP
2024-09-12 03:25:11	87.251.75.136	36308	TCP
2024-09-12 03:25:28	79.110.62.78	6282	TCP
2024-09-12 03:25:51	107.151.150.64	100	TCP
2024-09-12 03:26:08	64.225.108.199	1194	TCP
2024-09-12 03:26:32	52.160.37.45	8009	TCP
2024-09-12 03:27:12	87.251.75.136	3193	TCP
2024-09-12 03:27:17	198.235.24.40	888	TCP
2024-09-12 03:27:33	79.110.62.78	6001	TCP
2024-09-12 03:27:48	94.141.120.143	25	TCP
2024-09-12 03:28:11	167.94.146.29	9301	TCP
2024-09-12 03:28:43	87.251.75.136	38064	TCP
2024-09-12 03:28:51	87.251.75.136	43841	TCP
2024-09-12 03:29:13	45.84.89.3	2049	TCP
2024-09-12 03:29:31	79.110.62.78	2319	TCP
2024-09-12 03:29:50	115.231.78.10	37777	TCP
2024-09-12 03:30:11	35.203.210.31	849	TCP

Based on the table,

There were 32 different attempts to connect to my server.
21 different IP addresses attempted to connect to my server.
Most IP addresses attempted to connect once, except for: • 87.251.75.136: 7 attempts • 79.110.62.78: 4 attempts • 115.231.78.10: 2 attempts
The activity occurred quickly, from 03:22:50 to 03:30:11 on September 12, 2024.
There isn't a specific time of day that is most common for activity, as all attempts occurred within a 7-minute window.
The IP address 87.251.75.136 returns multiple times, but not at regular intervals.

Location: Amsterdam, North Holland
Organization: XHOST INTEREST SOLUTIONS LP
Company: XHOST INTERNET SOLUTIONS LP Suite 6060, 128 Aldersgate Street, Barbican, London EClA 4AE, England
Server provider:

dns1.bacloud.com

dns1.laisvas.lt

dns2.bacloud.com

dns2.laisvas.lt