\[2019-10-02 10:31:35\] SECURITY\[1715\] res_security_log.c: SecurityEvent="ChallengeResponseFailed",EventTV="2019-10-02T10:31:35.137+0200",Severity="Error",Service="PJSIP",EventVersion="1",AccountID="\",SessionID="569253123-542477898-1895812680",LocalAddress="IPV4/UDP/188.40.118.248/5060",RemoteAddress="IPV4/UDP/158.69.226.6/57442",Challenge="1570005095/ab027d4bbef7adef4c76f623da31c90c",Response="d010c9bc7b0b6170a63983f369576d3a",ExpectedResponse=""
\[2019-10-02 10:31:35\] SECURITY\[1715\] res_security_log.c: SecurityEvent="ChallengeResponseFailed",EventTV="2019-10-02T10:31:35.431+0200",Severity="Error",Service="PJSIP",EventVersion="1",AccountID="\",SessionID="569253123-542477898-1895812680",LocalAddress="IPV4/UDP/188.40.118.248/5060",RemoteAddress="IPV4/UDP/158.69.226.6/57442",Challenge="1570005095/ab027d4bbef7adef4c76f623da31c90c",Response="f8a2ebb6d3a41456a0eaad17005ed6cc",ExpectedResponse=""
\[2019-10-02 10:31:35\] SECURITY\[1715\] res_security_log.c: SecurityEvent="ChallengeResponse

\[2019-09-11 23:58:17\] SECURITY\[1849\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-09-11T23:58:17.065-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="300011442922550329",SessionID="0x7fd9a86cbbd8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/158.69.226.6/50622",ACLName="no_extension_match"
\[2019-09-12 00:01:16\] SECURITY\[1849\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-09-12T00:01:16.838-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="200011442922550329",SessionID="0x7fd9a863a768",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/158.69.226.6/54856",ACLName="no_extension_match"
\[2019-09-12 00:04:00\] SECURITY\[1849\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-09-12T00:04:00.291-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="100011442922550329",SessionID="0x7fd9a863a768",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/158.69.226.6/61697",ACLName="

 TCP (SYN) 158.69.226.175:54004 -> port 27983, len 44

TCP port : 27983

 TCP (SYN) 158.69.226.175:54004 -> port 27983, len 44

Port scanning [2 denied]

Aug  2 15:40:37 debian-2gb-nbg1-2 kernel: \[18634112.539997\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=158.69.226.175 DST=195.201.40.59 LEN=40 TOS=0x18 PREC=0x00 TTL=239 ID=58485 PROTO=TCP SPT=46968 DPT=22222 WINDOW=1024 RES=0x00 SYN URGP=0

 TCP (SYN) 158.69.226.175:44819 -> port 25259, len 44

15013/tcp 27567/tcp 27275/tcp...
[2020-06-21/07-07]53pkt,19pt.(tcp)

portscan

Mar 13 11:12:52 aragorn sshd[20388]: Invalid user odoo from 158.69.226.107
Mar 13 11:12:53 aragorn sshd[20390]: Invalid user test from 158.69.226.107
Mar 13 11:12:53 aragorn sshd[20392]: User postgres from ns523267.ip-158-69-226.net not allowed because not listed in AllowUsers
Mar 13 11:12:53 aragorn sshd[20394]: Invalid user oracle from 158.69.226.107
...

Detected by Fail2Ban

Feb  8 07:55:28 server sshd\[5362\]: Invalid user rft from 158.69.226.175
Feb  8 07:55:28 server sshd\[5362\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ns523335.ip-158-69-226.net 
Feb  8 07:55:30 server sshd\[5362\]: Failed password for invalid user rft from 158.69.226.175 port 55605 ssh2
Feb  8 07:58:37 server sshd\[5584\]: Invalid user rft from 158.69.226.175
Feb  8 07:58:37 server sshd\[5584\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ns523335.ip-158-69-226.net 
...

Feb  7 17:25:31 tuxlinux sshd[38070]: Invalid user ezk from 158.69.226.175 port 46869
Feb  7 17:25:31 tuxlinux sshd[38070]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=158.69.226.175 
Feb  7 17:25:31 tuxlinux sshd[38070]: Invalid user ezk from 158.69.226.175 port 46869
Feb  7 17:25:31 tuxlinux sshd[38070]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=158.69.226.175 
Feb  7 17:25:31 tuxlinux sshd[38070]: Invalid user ezk from 158.69.226.175 port 46869
Feb  7 17:25:31 tuxlinux sshd[38070]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=158.69.226.175 
Feb  7 17:25:33 tuxlinux sshd[38070]: Failed password for invalid user ezk from 158.69.226.175 port 46869 ssh2
...

2020-02-06T08:32:12.6921761495-001 sshd[37707]: Invalid user uwf from 158.69.226.175 port 43727
2020-02-06T08:32:12.7045611495-001 sshd[37707]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=ns523335.ip-158-69-226.net
2020-02-06T08:32:12.6921761495-001 sshd[37707]: Invalid user uwf from 158.69.226.175 port 43727
2020-02-06T08:32:14.1958071495-001 sshd[37707]: Failed password for invalid user uwf from 158.69.226.175 port 43727 ssh2
2020-02-06T08:44:11.4685801495-001 sshd[38399]: Invalid user jzk from 158.69.226.175 port 34271
2020-02-06T08:44:11.4783661495-001 sshd[38399]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=ns523335.ip-158-69-226.net
2020-02-06T08:44:11.4685801495-001 sshd[38399]: Invalid user jzk from 158.69.226.175 port 34271
2020-02-06T08:44:13.6839741495-001 sshd[38399]: Failed password for invalid user jzk from 158.69.226.175 port 34271 ssh2
2020-02-06T08:48:15.2886381495-001 sshd[38622]: 
...

Feb  3 14:38:32 legacy sshd[10148]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=158.69.226.175
Feb  3 14:38:34 legacy sshd[10148]: Failed password for invalid user venus from 158.69.226.175 port 34845 ssh2
Feb  3 14:41:16 legacy sshd[10322]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=158.69.226.175
...

Jan 13 01:38:30 mout sshd[7743]: Invalid user c from 158.69.226.175 port 48698

Unauthorized connection attempt from IP address 45.6.27.211 on port 587

20 attempts against mh-ssh on pluto

Automatic report - Banned IP Access

(ftpd) Failed FTP login from 114.250.151.150 (CN/China/-): 10 in the last 3600 secs

Jul  8 02:11:33 localhost sshd[60312]: Invalid user dl_group4 from 104.236.134.112 port 40695
Jul  8 02:11:33 localhost sshd[60312]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=mon.do.safelinkinternet.com
Jul  8 02:11:33 localhost sshd[60312]: Invalid user dl_group4 from 104.236.134.112 port 40695
Jul  8 02:11:35 localhost sshd[60312]: Failed password for invalid user dl_group4 from 104.236.134.112 port 40695 ssh2
Jul  8 02:18:59 localhost sshd[61316]: Invalid user energy from 104.236.134.112 port 39653
...

(From eric@talkwithwebvisitor.com) Hi, my name is Eric and I’m betting you’d like your website greenriverchiropractic.net to generate more leads.

Here’s how:
Talk With Web Visitor is a software widget that’s works on your site, ready to capture any visitor’s Name, Email address and Phone Number.  It signals you as soon as they say they’re interested – so that you can talk to that lead while they’re still there at greenriverchiropractic.net.

Talk With Web Visitor – CLICK HERE http://www.talkwithwebvisitor.com for a live demo now.

And now that you’ve got their phone number, our new SMS Text With Lead feature enables you to start a text (SMS) conversation – answer questions, provide more info, and close a deal that way.

If they don’t take you up on your offer then, just follow up with text messages for new offers, content links, even just “how you doing?” notes to build a relationship.

CLICK HERE http://www.talkwithwebvisitor.com to discover what Talk With Web Visitor can do for your business.

20 attempts against mh-ssh on pluto

20 attempts against mh-ssh on pluto

Jul  8 05:07:53 vpn01 sshd[20068]: Failed password for root from 112.85.42.173 port 9365 ssh2
Jul  8 05:08:07 vpn01 sshd[20068]: Failed password for root from 112.85.42.173 port 9365 ssh2
Jul  8 05:08:07 vpn01 sshd[20068]: error: maximum authentication attempts exceeded for root from 112.85.42.173 port 9365 ssh2 [preauth]
...

2020-07-07T21:46:20.330405morrigan.ad5gb.com sshd[486756]: Invalid user wangyang from 201.184.169.106 port 45512
2020-07-07T21:46:22.396837morrigan.ad5gb.com sshd[486756]: Failed password for invalid user wangyang from 201.184.169.106 port 45512 ssh2

Jul  8 05:14:10 lukav-desktop sshd\[28314\]: Invalid user liushuang from 110.43.49.148
Jul  8 05:14:10 lukav-desktop sshd\[28314\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=110.43.49.148
Jul  8 05:14:12 lukav-desktop sshd\[28314\]: Failed password for invalid user liushuang from 110.43.49.148 port 7294 ssh2
Jul  8 05:18:11 lukav-desktop sshd\[28385\]: Invalid user drdh from 110.43.49.148
Jul  8 05:18:11 lukav-desktop sshd\[28385\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=110.43.49.148

Jul  8 04:59:01 PorscheCustomer sshd[14535]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.12.137.210
Jul  8 04:59:03 PorscheCustomer sshd[14535]: Failed password for invalid user rr from 195.12.137.210 port 49842 ssh2
Jul  8 05:02:20 PorscheCustomer sshd[14622]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.12.137.210
...

[TueJul0722:08:15.2870362020][:error][pid30744:tid47247895525120][client202.1.207.53:59904][client202.1.207.53]ModSecurity:Accessdeniedwithcode403\(phase2\).Matchof"rx\(\?:/index\\\\\\\\.php/admin/catalog_category/save\|\(\?:/admin/stats\|/css/gallery-css\)\\\\\\\\.php\\\\\\\\\?1=1\|/admin\\\\\\\\.php\\\\\\\\\?tile=mail\$\|/catalog_category/save/key/\|/\\\\\\\\\?op=admin_settings\|\^/\\\\\\\\\?openpage=\|\^/admin/extra\|\^/node/[0-9] /edit\\\\\\\\\?destination=admin/content\|\^/administ..."against"REQUEST_URI"required.[file"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf"][line"321"][id"340145"][rev"43"][msg"Atomicorp.comWAFRules:AttackBlocked-SQLinjectionprobe"][data"1=1"][severity"CRITICAL"][tag"SQLi"][hostname"www.appetit-sa.ch"][uri"/contatti/"][unique_id"XwTWL778BvIqndqOvrEhBAAAAEk"][TueJul0722:08:15.6260822020][:error][pid31466:tid47247922841344][client202.1.207.53:59918][client202.1.207.53]ModSecurity:Accessdeniedwithcode403\(phase2\).detectedSQLiusinglibinjectionwithfinger

Jul  8 03:33:24 Ubuntu-1404-trusty-64-minimal sshd\[30170\]: Invalid user sslvpn from 106.13.230.238
Jul  8 03:33:24 Ubuntu-1404-trusty-64-minimal sshd\[30170\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.230.238
Jul  8 03:33:26 Ubuntu-1404-trusty-64-minimal sshd\[30170\]: Failed password for invalid user sslvpn from 106.13.230.238 port 55864 ssh2
Jul  8 03:38:30 Ubuntu-1404-trusty-64-minimal sshd\[31788\]: Invalid user valentin from 106.13.230.238
Jul  8 03:38:30 Ubuntu-1404-trusty-64-minimal sshd\[31788\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.230.238

2020-07-08T06:44:59.135203hostname sshd[17549]: Invalid user zhangyiwen from 138.68.4.8 port 38148
2020-07-08T06:45:00.786006hostname sshd[17549]: Failed password for invalid user zhangyiwen from 138.68.4.8 port 38148 ssh2
2020-07-08T06:47:45.330856hostname sshd[18853]: Invalid user liuzr2 from 138.68.4.8 port 35112
...