What type of hardware are you using: VPS bought online
What YunoHost version are you running: 12.0.12
How are you able to access your server: The webadmin
SSH
Direct access via physical keyboard/screen
Describe your issue
I started to get these messages from the hosting company (Hetzner):
Abuse Message [AbuseID:******]: NetscanOutLevel: scansnarf-ng detected Netscan from ****
We have indications that there was an attack from your server.
Please take all necessary measures to avoid this in the future and to solve the issue.We also request that you send a short response to us. This response should contain information about how this could have happened and what you intend to do about it.
In the event that the following steps are not completed successfully, your server can be blocked at any time after the 2025-03-28 10:48:12 +0100.
I have done nothing different for the past days. My installed apps are: borg, fail2ban, peertube, redirect, rspamd, rspamd web ui, jirafeau, wordpress, webmin, jitsi, element, synapse-admin, synapse, tldraw, nextcloud, gitea, roundcube, facilmap, collabora, haste, opensondage, qr, readeck, rss-bridge, friendica, scratch, librespeed.
scratch and rss-bridge are not updated since the update fails.
I wonder what can it be…any help is much appreciated!
Share relevant logs or error messages
# Netscan detected from host ******* #
TIME (UTC) SRC SRC-PORT -> DST DST-PORT SIZE PROT
----------------------------------------------------------------------------------------------------------
2025-03-27 19:47:02 MY SERVER IP 34672 -> 64:ff9b::30d:368b 443 98 TCP
2025-03-27 19:47:02 MY SERVER IP 33812 -> 64:ff9b::317:a6f6 443 98 TCP
2025-03-27 19:46:59 MY SERVER IP 58706 -> 64:ff9b::342:32f0 443 98 TCP
2025-03-27 19:47:04 MY SERVER IP 43450 -> 64:ff9b::381:6cc2 443 98 TCP
2025-03-27 19:47:17 MY SERVER IP 43466 -> 64:ff9b::382:411 443 98 TCP
2025-03-27 19:47:00 MY SERVER IP 56130 -> 64:ff9b::38e:e377 443 98 TCP
2025-03-27 19:47:05 MY SERVER IP 59264 -> 64:ff9b::394:5917 443 98 TCP
EDIT: The ports are 443 and 8448 - used by Synapse. I think Hetzner is wrongly seeing these as “attacks”. I reported to them, lets see…