Greetings. First of all, I would like to say I’m not very knowledgeable about anything, and I’m currently learning about Linux, security, networking and even a little programming from creating and managing Droplets. I hope this question doesn’t sound too dumb to the more knowledgeable users. I recently set up a Debian 8.1 Droplet and added an extra layer of security to it with PSAD. Ever since its installation, I have been getting “danger level 3” warnings on the same ports and from the same IP6 address. I do not have any ports open to the world, unless specifically requested by the services I run in a Droplet --and even then, if I can change their default ports, I will assign an (almost) completely random number to them. A log is attached below. Just to make it short, is it safe to whitelist this IP6? PSAD doesn’t seem particularly worried about it (else it would’ve been banned by rules) but it makes me uneasy to have these warnings. Specially because they seem to come from DO (or another Droplet.)

=-=-=-=-=-=-=-=-=-=-=-= Wed Sep 2 13:03:21 2015 =-=-=-=-=-=-=-=-=-=-=-=

     Danger level: [3] (out of 5) Multi-Protocol

Scanned TCP ports: [11-62078: 193 packets]
        TCP flags: [SYN: 193 packets, Nmap: -sT or -sS]
   iptables chain: INPUT, 184 packets
   iptables chain: INPUT (prefix "[UFW BLOCK]"), 9 packets
Scanned UDP ports: [7-47808: 34 packets, Nmap: -sU]
   iptables chain: INPUT (prefix "[UFW BLOCK]"), 1 packets
   iptables chain: INPUT, 33 packets

           Source: 2604:a880:0800:0010:0000:0000:0089:c001
              DNS: [No reverse dns info available]

      Destination: 2604:a880:0400:00d0:0000:0000:000e:d001
              DNS: [No reverse dns info available]

Overall scan start: Wed Sep 2 13:03:21 2015 Total email alerts: 1 Complete TCP range: [11-62078] Complete UDP range: [7-47808] Syslog hostname: localhost

     Global stats:
                   chain:   interface:  protocol:  packets:
                   INPUT    eth0        tcp        193
                   INPUT    eth0        udp        34

[+] UDP scan signatures:

“PSAD-CUSTOM Slammer communication attempt” dst port: 1434 (no server bound to local port) psad_id: 100208 chain: INPUT packets: 1 classtype: trojan-activity

“SCAN UPnP communication attempt” dst port: 1900 (no server bound to local port) psad_id: 100074 (derived from: 1917 1384 1388) chain: INPUT packets: 1 classtype: misc-attack

[+] TCP scan signatures:

“MISC VNC communication attempt” dst port: 5900 (no server bound to local port) flags: SYN psad_id: 100202 chain: INPUT packets: 1 classtype: attempted-admin

“MISC Microsoft PPTP communication attempt” dst port: 1723 (no server bound to local port) flags: SYN psad_id: 100082 (derived from: 2126 2044) chain: INPUT packets: 1 classtype: attempted-admin

“BACKDOOR DoomJuice file upload attempt” dst port: 3128 (no server bound to local port) flags: SYN sid: 2375 chain: INPUT packets: 1 classtype: trojan-activity

“MISC MS Terminal Server communication attempt” dst port: 3389 (no server bound to local port) flags: SYN psad_id: 100077 (derived from: 1447 1448 2418) chain: INPUT packets: 1 classtype: misc-activity

“MISC HP Web JetAdmin communication attempt” dst port: 8000 (no server bound to local port) flags: SYN psad_id: 100084 (derived from: 2547 2548 2549 2655) chain: INPUT packets: 1 classtype: web-application-activity

“POLICY HP JetDirect LCD commnication attempt” dst port: 9100 (no server bound to local port) flags: SYN sid: 568 chain: INPUT packets: 1 classtype: misc-activity

“BACKDOOR SatansBackdoor.2.0.Beta, or BackConstruction 2.1 Connection Attempt” dst port: 666 (no server bound to local port) flags: SYN psad_id: 100041 (derived from: 118 157 158) chain: INPUT packets: 1 classtype: misc-activity

“BACKDOOR netbus Connection Cttempt” dst port: 12345 (no server bound to local port) flags: SYN psad_id: 100028 (derived from: 109 110) chain: INPUT packets: 1 classtype: misc-activity

“POLICY HP JetDirect LCD communication attempt” dst port: 9002 (no server bound to local port) flags: SYN sid: 510 chain: INPUT packets: 3 classtype: misc-activity

[+] Whois Information (source IP):

ARIN WHOIS data and services are subject to the Terms of Use

available at: https://www.arin.net/whois_tou.html

If you see inaccuracies in the results, please report at

http://www.arin.net/public/whoisinaccuracy/index.xhtml

The following results may also be obtained via:

http://whois.arin.net/rest/nets;q=2604:a880:0800:0010:0000:0000:0089:c001?showDetails=true&showARIN=false&showNonArinTopLevelNet=false&ext=netref2

NetRange: 2604:A880:: - 2604:A880:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF CIDR: 2604:A880::/32 NetName: DIGITALOCEAN-V6-1 NetHandle: NET6-2604-A880-1 Parent: NET6-2600 (NET6-2600-1) NetType: Direct Allocation OriginAS: AS14061 Organization: Digital Ocean, Inc. (DO-13) RegDate: 2013-04-11 Updated: 2013-04-11 Ref: http://whois.arin.net/rest/net/NET6-2604-A880-1

OrgName: Digital Ocean, Inc. OrgId: DO-13 Address: 101 Ave of the Americas Address: 10th Floor City: New York StateProv: NY PostalCode: 10013 Country: US RegDate: 2012-05-14 Updated: 2014-10-23 Comment: http://www.digitalocean.com

Comment: Simple Cloud Hosting Ref: http://whois.arin.net/rest/org/DO-13