| 139.162.116.133 |
attackspam |
srvr2: (mod_security) mod_security (id:920350) triggered by 139.162.116.133 (JP/-/scan-66.security.ipip.net): 1 in the last 600 secs; Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: 2020/09/06 18:45:21 [error] 75202#0: *153186 [client 139.162.116.133] ModSecurity: Access denied with code 406 (phase 2). Matched "Operator `Rx' with parameter `^[\d.:]+$' against variable `REQUEST_HEADERS:Host' [redacted] [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "718"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [redacted] [severity "4"] [ver "OWASP_CRS/3.3.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [redacted] [uri "/"] [unique_id "159941072171.478932"] [ref "o0,14v21,14"], client: 139.162.116.133, [redacted] request: "GET / HTTP/1.1" [redacted] |
2020-09-07 20:06:17 |
| 4.7.94.244 |
attack |
SSH bruteforce |
2020-09-07 20:19:51 |
| 94.25.168.248 |
attackbots |
Unauthorized connection attempt from IP address 94.25.168.248 on Port 445(SMB) |
2020-09-07 20:12:37 |
| 222.186.30.35 |
attackspam |
Sep 7 14:20:29 vpn01 sshd[4661]: Failed password for root from 222.186.30.35 port 33805 ssh2
Sep 7 14:20:31 vpn01 sshd[4661]: Failed password for root from 222.186.30.35 port 33805 ssh2
... |
2020-09-07 20:21:22 |
| 150.117.208.74 |
attack |
Attempted connection to port 23. |
2020-09-07 19:52:15 |
| 49.48.220.120 |
attackspambots |
Unauthorized connection attempt from IP address 49.48.220.120 on Port 445(SMB) |
2020-09-07 19:58:08 |
| 2001:7d0:83eb:cd80:5912:a876:4a1d:747e |
attack |
Malicious/Probing: /xmlrpc.php |
2020-09-07 20:00:43 |
| 118.242.26.98 |
attackspambots |
Unauthorized connection attempt from IP address 118.242.26.98 on Port 445(SMB) |
2020-09-07 20:02:29 |
| 193.35.51.21 |
attackspam |
Sep 7 14:03:15 galaxy event: galaxy/lswi: smtp: kaja@wirtschaftsinformatik-potsdam.de [193.35.51.21] authentication failure using internet password
Sep 7 14:03:15 galaxy event: galaxy/lswi: smtp: sandy@wirtschaftsinformatik-potsdam.de [193.35.51.21] authentication failure using internet password
Sep 7 14:03:17 galaxy event: galaxy/lswi: smtp: kaja [193.35.51.21] authentication failure using internet password
Sep 7 14:03:17 galaxy event: galaxy/lswi: smtp: sandy [193.35.51.21] authentication failure using internet password
Sep 7 14:03:23 galaxy event: galaxy/lswi: smtp: norbert@wirtschaftsinformatik-potsdam.de [193.35.51.21] authentication failure using internet password
... |
2020-09-07 20:11:15 |
| 104.233.163.240 |
attackbotsspam |
Attempted connection to port 445. |
2020-09-07 19:56:41 |
| 5.22.64.179 |
attackspam |
(pop3d) Failed POP3 login from 5.22.64.179 (IR/Iran/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Sep 6 21:15:26 ir1 dovecot[3110802]: pop3-login: Aborted login (auth failed, 1 attempts in 2 secs): user=, method=PLAIN, rip=5.22.64.179, lip=5.63.12.44, session= |
2020-09-07 20:03:45 |
| 180.233.123.221 |
attackspambots |
20/9/6@20:45:18: FAIL: Alarm-Network address from=180.233.123.221
... |
2020-09-07 20:08:21 |
| 93.190.203.58 |
attackbots |
Honeypot attack, port: 445, PTR: PTR record not found |
2020-09-07 20:18:07 |
| 188.3.218.83 |
attackbotsspam |
Attempted connection to port 445. |
2020-09-07 19:49:16 |
| 188.19.179.99 |
attack |
Attempted connection to port 8080. |
2020-09-07 19:50:36 |