We suffered and brute force irrumption by ssh to our server and taking look at the logs and iptables and we found these:
:OUTPUT ACCEPT [6967:2510527] :DOCKER