Last night I had an external IP tried to access my server over SSH. The attempt was blocked as it failed to authorise in the number of times and time limit that I'd specified.
Doing a whois on the ip address comes back with:
[Querying whois.apnic.net] [whois.apnic.net] % [whois.apnic.net] % Whois data copyright terms http://www.apnic.net/db/dbcopyright.html % Information related to '126.96.36.199 - 188.8.131.52' inetnum: 184.108.40.206 - 220.127.116.11 netname: CHINANET-JS descr: CHINANET jiangsu province network descr: China Telecom descr: A12,Xin-Jie-Kou-Wai Street descr: Beijing 100088 country: CN admin-c: CH93-AP tech-c: CJ186-AP mnt-by: APNIC-HM mnt-lower: MAINT-CHINANET-JS mnt-routes: MAINT-CHINANET-JS remarks: This object can only modify by APNIC hostmaster remarks: If you wish to modify this object details please remarks: send email to firstname.lastname@example.org with your remarks: organisation account name in the subject line. status: ALLOCATED PORTABLE source: APNIC mnt-irt: IRT-CHINANET-CN changed: email@example.com 20040223 irt: IRT-CHINANET-CN address: No.31 ,jingrong street,beijing address: 100032 e-mail: firstname.lastname@example.org abuse-mailbox: email@example.com admin-c: CH93-AP tech-c: CH93-AP auth: # Filtered mnt-by: MAINT-CHINANET changed: firstname.lastname@example.org 20101115 source: APNIC role: CHINANET JIANGSU address: 260 Zhongyang Road,Nanjing 210037 country: CN phone: +86-25-86588231 phone: +86-25-86588745 fax-no: +86-25-86588104 e-mail: email@example.com remarks: send anti-spam reports to firstname.lastname@example.org remarks: send abuse reports to email@example.com remarks: times in GMT+8 admin-c: CH360-AP tech-c: CS306-AP tech-c: CN142-AP nic-hdl: CJ186-AP remarks: www.jsinfo.net notify: firstname.lastname@example.org mnt-by: MAINT-CHINANET-JS changed: email@example.com 20090831 changed: firstname.lastname@example.org 20090831 changed: email@example.com 20090901 source: APNIC changed: firstname.lastname@example.org 20111114 person: Chinanet Hostmaster nic-hdl: CH93-AP e-mail: email@example.com address: No.31 ,jingrong street,beijing address: 100032 phone: +86-10-58501724 fax-no: +86-10-58501724 country: CN changed: firstname.lastname@example.org 20070416 changed: email@example.com 20140227 mnt-by: MAINT-CHINANET source: APNIC
I'm currently scanning my server that they tried to access but I can't see anything on first look that they changed anything. however, on my other server if I try to SSH into it I now get:
Warning: the ECDSA host key for '<snip>' differs from the key for the IP address '<snip>' Offending key for IP in /home/<snip>/.ssh/known_hosts:14 Matching host key in /home/<snip>/.ssh/known_hosts:12 Are you sure you want to continue connecting (yes/no)?
The IP of the machine shouldn't have changed as all my servers are given static IPs allocated by their MAC addresses.
Could this be something related and if so, what is the best way of restoring my systems and stopping future attacks.