Automatic report - Banned IP Access

Lines containing failures of 107.172.157.142
Aug 16 20:01:45 newdogma sshd[31238]: Invalid user router from 107.172.157.142 port 56294
Aug 16 20:01:45 newdogma sshd[31238]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.172.157.142 
Aug 16 20:01:47 newdogma sshd[31238]: Failed password for invalid user router from 107.172.157.142 port 56294 ssh2
Aug 16 20:01:48 newdogma sshd[31238]: Received disconnect from 107.172.157.142 port 56294:11: Bye Bye [preauth]
Aug 16 20:01:48 newdogma sshd[31238]: Disconnected from invalid user router 107.172.157.142 port 56294 [preauth]
Aug 16 20:21:57 newdogma sshd[32281]: Invalid user batch from 107.172.157.142 port 47780
Aug 16 20:21:58 newdogma sshd[32281]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.172.157.142 
Aug 16 20:22:00 newdogma sshd[32281]: Failed password for invalid user batch from 107.172.157.142 port 47780 ssh2
Aug 16 20:22:00 newdo........
------------------------------

(From eric@talkwithwebvisitor.com) Cool website!

My name’s Eric, and I just found your site - jbchiro.com - while surfing the net. You showed up at the top of the search results, so I checked you out. Looks like what you’re doing is pretty cool.
 
But if you don’t mind me asking – after someone like me stumbles across jbchiro.com, what usually happens?

Is your site generating leads for your business? 
 
I’m guessing some, but I also bet you’d like more… studies show that 7 out 10 who land on a site wind up leaving without a trace.

Not good.

Here’s a thought – what if there was an easy way for every visitor to “raise their hand” to get a phone call from you INSTANTLY… the second they hit your site and said, “call me now.”

You can –
  
Talk With Web Visitor is a software widget that’s works on your site, ready to capture any visitor’s Name, Email address and Phone Number.  It lets you know IMMEDIATELY – so that you can talk to that lead while they’re literally looking over your site.

CLI

Honeypot attack, port: 445, PTR: 107-172-15-10-host.colocrossing.com.

(From palmermckelvey687@gmail.com) Hello,

Have you thought about making your site l function more efficiently and look better so it can generate more profit to your business? I see a significant potential for your site to attract more clients. As soon as people start noticing your site, it'll generate more profit. It's not difficult to achieve, and it'll be cheap too! 

With a simple redesign and some additional modern and functional elements, your site will be able to attract more clients and make your business grow. I'd like to present you examples that I've made from my previous projects and discuss with you my ideas.

Please let me know if you're interested so I can contact you as soon as possible. Just reply with your preferred contact details and the best time for us to have a free consultation over the phone. I hope to speak with you soon! 

 - Mckelvey

(From webdesigngurus21@gmail.com) Good day!

Are you satisfied with your website's user-interface? Have you considered making some upgrades/improvements on it to better suit your business?

Designing highly functional and beautiful websites is what I've been doing for more than a decade now. I can do this for cheap, and I can help you with any design that you're thinking of right now. If you'd like, I'll be able to provide you with a free consultation to share with you some expert advice and answer the questions you have for me.

If this is something that interests you, then please let me know about the best time to reach out and your preferred number. I'm looking forward to speaking with you soon! 

Tyler Forrest - Web Developer





If you would like to be removed from any of these emails, kindly send me an email to inform me and you won't hear from me again.

1578517844 - 01/08/2020 22:10:44 Host: 107.172.15.10/107.172.15.10 Port: 445 TCP Blocked

Automatic report - Banned IP Access

Sep  2 10:41:35 yabzik sshd[23348]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.172.156.150
Sep  2 10:41:37 yabzik sshd[23348]: Failed password for invalid user demo from 107.172.156.150 port 45539 ssh2
Sep  2 10:45:31 yabzik sshd[24844]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.172.156.150

Aug 25 00:24:08 web8 sshd\[26774\]: Invalid user cycle from 107.172.156.150
Aug 25 00:24:08 web8 sshd\[26774\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.172.156.150
Aug 25 00:24:09 web8 sshd\[26774\]: Failed password for invalid user cycle from 107.172.156.150 port 40794 ssh2
Aug 25 00:28:21 web8 sshd\[28901\]: Invalid user tracker from 107.172.156.150
Aug 25 00:28:21 web8 sshd\[28901\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.172.156.150

Aug 24 21:03:32 web8 sshd\[24610\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.172.156.150  user=root
Aug 24 21:03:34 web8 sshd\[24610\]: Failed password for root from 107.172.156.150 port 35574 ssh2
Aug 24 21:07:49 web8 sshd\[26673\]: Invalid user gituser from 107.172.156.150
Aug 24 21:07:49 web8 sshd\[26673\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.172.156.150
Aug 24 21:07:51 web8 sshd\[26673\]: Failed password for invalid user gituser from 107.172.156.150 port 58036 ssh2

Aug 24 17:05:26 hb sshd\[25869\]: Invalid user marie from 107.172.156.169
Aug 24 17:05:26 hb sshd\[25869\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.172.156.169
Aug 24 17:05:28 hb sshd\[25869\]: Failed password for invalid user marie from 107.172.156.169 port 47126 ssh2
Aug 24 17:09:57 hb sshd\[26297\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.172.156.169  user=root
Aug 24 17:09:58 hb sshd\[26297\]: Failed password for root from 107.172.156.169 port 41872 ssh2

445/tcp 445/tcp 445/tcp...
[2019-07-27/08-23]7pkt,1pt.(tcp)

Aug 23 10:56:55 v22019058497090703 sshd[27350]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.172.156.150
Aug 23 10:56:57 v22019058497090703 sshd[27350]: Failed password for invalid user viet from 107.172.156.150 port 58512 ssh2
Aug 23 11:01:15 v22019058497090703 sshd[27707]: Failed password for root from 107.172.156.150 port 52975 ssh2
...

Aug 22 09:41:51 hcbb sshd\[30544\]: Invalid user christ from 107.172.156.150
Aug 22 09:41:51 hcbb sshd\[30544\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.172.156.150
Aug 22 09:41:53 hcbb sshd\[30544\]: Failed password for invalid user christ from 107.172.156.150 port 39985 ssh2
Aug 22 09:46:00 hcbb sshd\[30845\]: Invalid user FadeCommunity from 107.172.156.150
Aug 22 09:46:00 hcbb sshd\[30845\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.172.156.150

Automatic report - Banned IP Access

Invalid user ident from 174.138.44.30 port 60380

9001/tcp
[2019-11-16]1pkt

Brute-force attempt banned

IP Ban Report :  
 https://help-dysk.pl/wordpress-firewall-plugins/ip/41.38.191.251/ 
 
 EG - 1H : (34)  
 Protection Against DDoS WordPress plugin :  
 "odzyskiwanie danych help-dysk" 
 IP Address Ranges by Country : EG 
 NAME ASN : ASN8452 
 
 IP : 41.38.191.251 
 
 CIDR : 41.38.0.0/15 
 
 PREFIX COUNT : 833 
 
 UNIQUE IP COUNT : 7610368 
 
 
 ATTACKS DETECTED ASN8452 :  
  1H - 2 
  3H - 4 
  6H - 4 
 12H - 10 
 24H - 31 
 
 DateTime : 2019-11-16 07:19:45 
 
 INFO : Port Scan TELNET Detected and Blocked by ADMIN  - data recovery

Nov 16 09:24:44 eventyay sshd[30320]: Failed password for root from 157.86.248.13 port 60284 ssh2
Nov 16 09:29:59 eventyay sshd[30379]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.86.248.13
Nov 16 09:30:01 eventyay sshd[30379]: Failed password for invalid user mysql from 157.86.248.13 port 50947 ssh2
...

Invalid user loshbough from 162.214.14.3 port 40762

port scan and connect, tcp 23 (telnet)

Nov 14 06:12:33 l01 sshd[398109]: Invalid user oracle from 184.73.74.5
Nov 14 06:12:33 l01 sshd[398109]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=em3-184-73-74-5.compute-1.amazonaws.com 
Nov 14 06:12:35 l01 sshd[398109]: Failed password for invalid user oracle from 184.73.74.5 port 47154 ssh2
Nov 14 06:19:15 l01 sshd[398681]: Invalid user yeuen from 184.73.74.5
Nov 14 06:19:15 l01 sshd[398681]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=em3-184-73-74-5.compute-1.amazonaws.com 
Nov 14 06:19:18 l01 sshd[398681]: Failed password for invalid user yeuen from 184.73.74.5 port 46656 ssh2
Nov 14 06:24:16 l01 sshd[399111]: Invalid user deploy from 184.73.74.5
Nov 14 06:24:16 l01 sshd[399111]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=em3-184-73-74-5.compute-1.amazonaws.com 
Nov 14 06:24:18 l01 sshd[399111]: Failed password for invalid user dep........
-------------------------------

Nov 14 07:22:05 rb06 sshd[4677]: reveeclipse mapping checking getaddrinfo for doircle.net [173.208.149.162] failed - POSSIBLE BREAK-IN ATTEMPT!
Nov 14 07:22:07 rb06 sshd[4677]: Failed password for invalid user shrike from 173.208.149.162 port 55336 ssh2
Nov 14 07:22:07 rb06 sshd[4677]: Received disconnect from 173.208.149.162: 11: Bye Bye [preauth]
Nov 14 07:34:55 rb06 sshd[21530]: reveeclipse mapping checking getaddrinfo for doircle.net [173.208.149.162] failed - POSSIBLE BREAK-IN ATTEMPT!
Nov 14 07:34:57 rb06 sshd[21530]: Failed password for invalid user em from 173.208.149.162 port 58158 ssh2
Nov 14 07:34:57 rb06 sshd[21530]: Received disconnect from 173.208.149.162: 11: Bye Bye [preauth]
Nov 14 07:38:27 rb06 sshd[21790]: reveeclipse mapping checking getaddrinfo for doircle.net [173.208.149.162] failed - POSSIBLE BREAK-IN ATTEMPT!
Nov 14 07:38:30 rb06 sshd[21790]: Failed password for invalid user etzell from 173.208.149.162 port 39786 ssh2
Nov 14 07:38:30 rb06 sshd[2........
-------------------------------

Unauthorised access (Nov 16) SRC=95.189.102.218 LEN=52 TTL=115 ID=17940 DF TCP DPT=445 WINDOW=8192 SYN

2019-11-16T06:11:10.861499hub.schaetter.us sshd\[22880\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.101.233.35.bc.googleusercontent.com  user=sshd
2019-11-16T06:11:12.588437hub.schaetter.us sshd\[22880\]: Failed password for sshd from 35.233.101.146 port 55900 ssh2
2019-11-16T06:14:58.420651hub.schaetter.us sshd\[22908\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.101.233.35.bc.googleusercontent.com  user=root
2019-11-16T06:15:01.116324hub.schaetter.us sshd\[22908\]: Failed password for root from 35.233.101.146 port 36710 ssh2
2019-11-16T06:18:42.897208hub.schaetter.us sshd\[22939\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.101.233.35.bc.googleusercontent.com  user=root
...

Nov 16 07:27:50 TORMINT sshd\[26740\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.85.42.227  user=root
Nov 16 07:27:51 TORMINT sshd\[26740\]: Failed password for root from 112.85.42.227 port 19255 ssh2
Nov 16 07:28:58 TORMINT sshd\[26788\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.85.42.227  user=root
...

Invalid user user from 45.253.26.34 port 50810

81.177.33.4 - - \[16/Nov/2019:12:42:17 +0000\] "POST /wp/wp-login.php HTTP/1.1" 200 4205 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"
81.177.33.4 - - \[16/Nov/2019:12:42:18 +0000\] "POST /wp/xmlrpc.php HTTP/1.1" 200 403 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"
...