UFW Blocks some IPs which are trying to attempt a connection to the server

Question

UFW‌ Blocks some IPs which are trying to attempt a connection to the server. I checked most blocked IPs in abuseIPD website and all blocked IPs are reported for brute force attack and/Or ssh spamming in past 24hrs.

Sample Log:

[UFW BLOCK] IN=eth0 OUT= MAC=xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx SRC=189.173.30.x DST=xx:xx:xx:xx LEN=52 TOS=0x00 PREC=0x00 TTL=53 ID=52308 DF PROTO=TCP SPT=52572 DPT=1557 WINDOW=1445 RES=0x00 ACK FIN URGP=0

What are my questions

1) Is the server under attack?

2) If yes,How does UFW‌ distinguish dangerous IPs from normal ones?

3) What should i do for greater security?

Answer 1

Simple answers:

1. Is this server under attack? No more than any other server on the internet. This is just the background noise of the internet. In short, any computer that is accessible to the internet will find itself being regularly scanned by various bot nets for many different reasons. All the more reason to keep your servers secure.
2. How does UFW‌ distinguish dangerous IPs normal ones? I don't specifically know about UFW, but there are two simple ways to identify malicious IP addresses: because they are sending malicious traffic, and because they have been reported as being malicious in intent (basically, by checking services just like you did).
3. What should I do for greater security? All the usual things: make sure the only open ports are the necessary ones, harden your server appropriately, and keep vulnerabilities out of your applications. This question is too broad for a better answer that than.