Jun 19 19:58:48 our-server-hostname postfix/smtpd[4892]: connect from unknown[177.85.142.48]
Jun x@x
Jun x@x
Jun x@x
Jun x@x
Jun x@x
Jun x@x
Jun x@x
Jun x@x
Jun x@x
Jun x@x
Jun x@x
Jun x@x
Jun x@x
Jun 19 19:58:58 our-server-hostname postfix/smtpd[4892]: lost connection after RCPT from unknown[177.85.142.48]
Jun 19 19:58:58 our-server-hostname postfix/smtpd[4892]: disconnect from unknown[177.85.142.48]
Jun 20 02:00:09 our-server-hostname postfix/smtpd[6442]: connect from unknown[177.85.142.48]
Jun x@x
Jun x@x
Jun x@x
Jun x@x
Jun x@x
Jun x@x
Jun x@x
Jun x@x
Jun x@x
Jun 20 02:00:16 our-server-hostname postfix/smtpd[6442]: lost connection after RCPT from unknown[177.85.142.48]
Jun 20 02:00:16 our-server-hostname postfix/smtpd[6442]: disconnect from unknown[177.85.142.48]


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=177.85.142.48

Oct  4 06:35:01 mail.srvfarm.net postfix/smtpd[739716]: warning: unknown[177.85.142.140]: SASL PLAIN authentication failed: 
Oct  4 06:35:02 mail.srvfarm.net postfix/smtpd[739716]: lost connection after AUTH from unknown[177.85.142.140]
Oct  4 06:36:11 mail.srvfarm.net postfix/smtpd[735772]: warning: unknown[177.85.142.140]: SASL PLAIN authentication failed: 
Oct  4 06:36:12 mail.srvfarm.net postfix/smtpd[735772]: lost connection after AUTH from unknown[177.85.142.140]
Oct  4 06:38:36 mail.srvfarm.net postfix/smtpd[737249]: warning: unknown[177.85.142.140]: SASL PLAIN authentication failed:

Oct  4 06:35:01 mail.srvfarm.net postfix/smtpd[739716]: warning: unknown[177.85.142.140]: SASL PLAIN authentication failed: 
Oct  4 06:35:02 mail.srvfarm.net postfix/smtpd[739716]: lost connection after AUTH from unknown[177.85.142.140]
Oct  4 06:36:11 mail.srvfarm.net postfix/smtpd[735772]: warning: unknown[177.85.142.140]: SASL PLAIN authentication failed: 
Oct  4 06:36:12 mail.srvfarm.net postfix/smtpd[735772]: lost connection after AUTH from unknown[177.85.142.140]
Oct  4 06:38:36 mail.srvfarm.net postfix/smtpd[737249]: warning: unknown[177.85.142.140]: SASL PLAIN authentication failed:

Oct  4 06:35:01 mail.srvfarm.net postfix/smtpd[739716]: warning: unknown[177.85.142.140]: SASL PLAIN authentication failed: 
Oct  4 06:35:02 mail.srvfarm.net postfix/smtpd[739716]: lost connection after AUTH from unknown[177.85.142.140]
Oct  4 06:36:11 mail.srvfarm.net postfix/smtpd[735772]: warning: unknown[177.85.142.140]: SASL PLAIN authentication failed: 
Oct  4 06:36:12 mail.srvfarm.net postfix/smtpd[735772]: lost connection after AUTH from unknown[177.85.142.140]
Oct  4 06:38:36 mail.srvfarm.net postfix/smtpd[737249]: warning: unknown[177.85.142.140]: SASL PLAIN authentication failed:

Sep 17 18:19:24 mail.srvfarm.net postfix/smtpd[143201]: warning: unknown[177.85.142.179]: SASL PLAIN authentication failed: 
Sep 17 18:19:25 mail.srvfarm.net postfix/smtpd[143201]: lost connection after AUTH from unknown[177.85.142.179]
Sep 17 18:25:13 mail.srvfarm.net postfix/smtps/smtpd[159171]: lost connection after CONNECT from unknown[177.85.142.179]
Sep 17 18:29:05 mail.srvfarm.net postfix/smtpd[157369]: warning: unknown[177.85.142.179]: SASL PLAIN authentication failed: 
Sep 17 18:29:06 mail.srvfarm.net postfix/smtpd[157369]: lost connection after AUTH from unknown[177.85.142.179]

Sep 17 18:19:24 mail.srvfarm.net postfix/smtpd[143201]: warning: unknown[177.85.142.179]: SASL PLAIN authentication failed: 
Sep 17 18:19:25 mail.srvfarm.net postfix/smtpd[143201]: lost connection after AUTH from unknown[177.85.142.179]
Sep 17 18:25:13 mail.srvfarm.net postfix/smtps/smtpd[159171]: lost connection after CONNECT from unknown[177.85.142.179]
Sep 17 18:29:05 mail.srvfarm.net postfix/smtpd[157369]: warning: unknown[177.85.142.179]: SASL PLAIN authentication failed: 
Sep 17 18:29:06 mail.srvfarm.net postfix/smtpd[157369]: lost connection after AUTH from unknown[177.85.142.179]

Sep 17 18:19:24 mail.srvfarm.net postfix/smtpd[143201]: warning: unknown[177.85.142.179]: SASL PLAIN authentication failed: 
Sep 17 18:19:25 mail.srvfarm.net postfix/smtpd[143201]: lost connection after AUTH from unknown[177.85.142.179]
Sep 17 18:25:13 mail.srvfarm.net postfix/smtps/smtpd[159171]: lost connection after CONNECT from unknown[177.85.142.179]
Sep 17 18:29:05 mail.srvfarm.net postfix/smtpd[157369]: warning: unknown[177.85.142.179]: SASL PLAIN authentication failed: 
Sep 17 18:29:06 mail.srvfarm.net postfix/smtpd[157369]: lost connection after AUTH from unknown[177.85.142.179]

Sep 14 18:35:36 mail.srvfarm.net postfix/smtps/smtpd[2073845]: warning: unknown[177.85.142.224]: SASL PLAIN authentication failed: 
Sep 14 18:35:37 mail.srvfarm.net postfix/smtps/smtpd[2073845]: lost connection after AUTH from unknown[177.85.142.224]
Sep 14 18:39:10 mail.srvfarm.net postfix/smtpd[2073585]: warning: unknown[177.85.142.224]: SASL PLAIN authentication failed: 
Sep 14 18:39:11 mail.srvfarm.net postfix/smtpd[2073585]: lost connection after AUTH from unknown[177.85.142.224]
Sep 14 18:40:37 mail.srvfarm.net postfix/smtps/smtpd[2077858]: warning: unknown[177.85.142.224]: SASL PLAIN authentication failed:

Sep 14 18:35:36 mail.srvfarm.net postfix/smtps/smtpd[2073845]: warning: unknown[177.85.142.224]: SASL PLAIN authentication failed: 
Sep 14 18:35:37 mail.srvfarm.net postfix/smtps/smtpd[2073845]: lost connection after AUTH from unknown[177.85.142.224]
Sep 14 18:39:10 mail.srvfarm.net postfix/smtpd[2073585]: warning: unknown[177.85.142.224]: SASL PLAIN authentication failed: 
Sep 14 18:39:11 mail.srvfarm.net postfix/smtpd[2073585]: lost connection after AUTH from unknown[177.85.142.224]
Sep 14 18:40:37 mail.srvfarm.net postfix/smtps/smtpd[2077858]: warning: unknown[177.85.142.224]: SASL PLAIN authentication failed:

Sep 14 18:35:36 mail.srvfarm.net postfix/smtps/smtpd[2073845]: warning: unknown[177.85.142.224]: SASL PLAIN authentication failed: 
Sep 14 18:35:37 mail.srvfarm.net postfix/smtps/smtpd[2073845]: lost connection after AUTH from unknown[177.85.142.224]
Sep 14 18:39:10 mail.srvfarm.net postfix/smtpd[2073585]: warning: unknown[177.85.142.224]: SASL PLAIN authentication failed: 
Sep 14 18:39:11 mail.srvfarm.net postfix/smtpd[2073585]: lost connection after AUTH from unknown[177.85.142.224]
Sep 14 18:40:37 mail.srvfarm.net postfix/smtps/smtpd[2077858]: warning: unknown[177.85.142.224]: SASL PLAIN authentication failed:

SSH invalid-user multiple login try

Automatic report - Port Scan Attack

Unauthorized connection attempt detected from IP address 177.85.142.194 to port 23 [J]

Automatic report - Port Scan Attack

Oct 17 13:32:29 mc1 kernel: \[2598316.595942\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:11:a9:7b:d2:74:7f:6e:37:e3:08:00 SRC=177.85.142.95 DST=159.69.205.51 LEN=44 TOS=0x00 PREC=0x00 TTL=49 ID=1128 PROTO=TCP SPT=58048 DPT=34567 WINDOW=12511 RES=0x00 SYN URGP=0 
Oct 17 13:36:22 mc1 kernel: \[2598550.057861\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:11:a9:7b:d2:74:7f:6e:37:e3:08:00 SRC=177.85.142.95 DST=159.69.205.51 LEN=44 TOS=0x00 PREC=0x00 TTL=49 ID=1128 PROTO=TCP SPT=58048 DPT=34567 WINDOW=12511 RES=0x00 SYN URGP=0 
Oct 17 13:37:04 mc1 kernel: \[2598591.854725\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:11:a9:7b:d2:74:7f:6e:37:e3:08:00 SRC=177.85.142.95 DST=159.69.205.51 LEN=44 TOS=0x00 PREC=0x00 TTL=49 ID=1128 PROTO=TCP SPT=58048 DPT=34567 WINDOW=12511 RES=0x00 SYN URGP=0 
...

failed_logins

May  8 23:05:11 eventyay sshd[2549]: Failed password for root from 222.186.175.212 port 50234 ssh2
May  8 23:05:20 eventyay sshd[2549]: Failed password for root from 222.186.175.212 port 50234 ssh2
May  8 23:05:23 eventyay sshd[2549]: Failed password for root from 222.186.175.212 port 50234 ssh2
May  8 23:05:23 eventyay sshd[2549]: error: maximum authentication attempts exceeded for root from 222.186.175.212 port 50234 ssh2 [preauth]
...

May  8 23:03:32 piServer sshd[11596]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.99.188.229 
May  8 23:03:35 piServer sshd[11596]: Failed password for invalid user geiger from 192.99.188.229 port 44442 ssh2
May  8 23:09:51 piServer sshd[12222]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.99.188.229 
...

[Sat May 09 03:50:59.318534 2020] [:error] [pid 7231:tid 139913183377152] [client 54.36.148.151:33432] [client 54.36.148.151] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "AhrefsBot" at REQUEST_HEADERS:User-Agent. [file "/etc/modsecurity/owasp-modsecurity-crs-3.2.0/rules/REQUEST-913-SCANNER-DETECTION.conf"] [line "183"] [id "913102"] [msg "Found User-Agent associated with web crawler/bot"] [data "Matched Data: AhrefsBot found within REQUEST_HEADERS:User-Agent: mozilla/5.0 (compatible; ahrefsbot/6.1; +http://ahrefs.com/robot/)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.2.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-crawler"] [tag "OWASP_CRS"] [tag "OWASP_CRS/AUTOMATION/CRAWLER"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [tag "paranoia-level/2"] [hostname "karangploso.jatim.bmkg.go.id"] [uri "/index.php/monitoring-hari-tanpa-hujan-berturut-turut/624-monitoring-hari-tanpa-hujan-berturut-tur
...

Unauthorized connection attempt detected from IP address 78.85.28.56 to port 445 [T]

May  8 23:14:55 dcd-gentoo sshd[29347]: User root from 195.231.11.201 not allowed because none of user's groups are listed in AllowGroups
May  8 23:15:12 dcd-gentoo sshd[29364]: User root from 195.231.11.201 not allowed because none of user's groups are listed in AllowGroups
May  8 23:15:30 dcd-gentoo sshd[29384]: User root from 195.231.11.201 not allowed because none of user's groups are listed in AllowGroups
...

May  8 20:50:46 localhost sshd\[4359\]: Invalid user elopez from 61.161.250.202 port 57582
May  8 20:50:46 localhost sshd\[4359\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.161.250.202
May  8 20:50:48 localhost sshd\[4359\]: Failed password for invalid user elopez from 61.161.250.202 port 57582 ssh2
...

May 08 22:27:24 pop3-login: Info: Disconnected: Inactivity \(auth failed, 1 attempts in 180 secs\): user=\, method=PLAIN, rip=185.234.218.249, lip=192.168.100.101, session=\\
May 08 22:55:36 pop3-login: Info: Aborted login \(auth failed, 1 attempts in 2 secs\): user=\, method=PLAIN, rip=185.234.218.249, lip=192.168.100.101, session=\\
May 08 22:55:41 pop3-login: Info: Aborted login \(auth failed, 1 attempts in 6 secs\): user=\, method=PLAIN, rip=185.234.218.249, lip=192.168.100.101, session=\\
May 08 22:55:43 pop3-login: Info: Aborted login \(auth failed, 1 attempts in 6 secs\): user=\, method=PLAIN, rip=185.234.218.249, lip=192.168.100.101, session=\<7EQaOCml5gC56tr5\>\
May 08 22:55:44 pop3-login: Info: Aborted login \(auth failed, 1 attempts in 6 secs\): user=\, method=PLAIN, rip=185.234.218.249, lip=192.168.100.101, session=\

SSH authentication failure x 6 reported by Fail2Ban
...

May  8 22:51:16 vmd48417 sshd[14931]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=98.148.152.199

[MK-VM4] Blocked by UFW

May  8 23:00:07 pve1 sshd[12710]: Failed password for root from 218.92.0.145 port 52967 ssh2
May  8 23:00:11 pve1 sshd[12710]: Failed password for root from 218.92.0.145 port 52967 ssh2
...

$f2bV_matches

Automatic report - XMLRPC Attack

WordPress login Brute force / Web App Attack on client site.

May 08 2020, 21:08:30 [sshd] - Banned from the Cipher Host hosting platform by Fail2ban.