Brute force attack stopped by firewall

07/11/2020-10:51:06.826846 195.54.160.135 Protocol: 6 ET SCAN NMAP -sS window 1024

TCP ports : 8081 / 8983

scans 8 times in preceeding hours on the ports (in chronological order) 8081 2375 4506 8081 8088 6379 6800 8983 resulting in total of 28 scans from 195.54.160.0/23 block.

 TCP (SYN) 195.54.160.135:56179 -> port 6379, len 44

[07/Jul/2020:06:46:57 -0400] - [07/Jul/2020:18:15:55 -0400] General vuln. probe

Jul  7 15:15:02 debian-2gb-nbg1-2 kernel: \[16386306.007306\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=195.54.160.135 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=245 ID=58202 PROTO=TCP SPT=45402 DPT=8088 WINDOW=1024 RES=0x00 SYN URGP=0

Web application attack detected by fail2ban

 TCP (SYN) 195.54.160.135:55742 -> port 80, len 40

07/05/2020-00:31:58.436931 195.54.160.135 Protocol: 6 ET SCAN NMAP -sS window 1024

firewall-block, port(s): 80/tcp, 2375/tcp, 4506/tcp, 8081/tcp

 TCP (SYN) 195.54.160.135:52671 -> port 2375, len 44

195.54.160.135 - - \[26/Jun/2020:07:20:55 +0200\] "GET /solr/admin/info/system\?wt=json HTTP/1.1" 403 468 "-" "Mozilla/5.0 \(Windows NT 10.0\; Win64\; x64\) AppleWebKit/537.36 \(KHTML, like Gecko\) Chrome/78.0.3904.108 Safari/537.36"
195.54.160.135 - - \[26/Jun/2020:07:34:35 +0200\] "GET /\?XDEBUG_SESSION_START=phpstorm HTTP/1.1" 403 446 "-" "Mozilla/5.0 \(Windows NT 10.0\; Win64\; x64\) AppleWebKit/537.36 \(KHTML, like Gecko\) Chrome/78.0.3904.108 Safari/537.36"
195.54.160.135 - - \[26/Jun/2020:07:34:35 +0200\] "GET /\?a=fetch\&content=\die\(@md5\(HelloThinkCMF\)\)\ HTTP/1.1" 403 446 "-" "Mozilla/5.0 \(Windows NT 10.0\; Win64\; x64\) AppleWebKit/537.36 \(KHTML, like Gecko\) Chrome/78.0.3904.108 Safari/537.36"
...

Hacking & Attacking

Unauthorized connection attempt detected from IP address 195.54.160.135 to port 6379

195.54.160.135 - - \[17/Jun/2020:07:18:51 +0800\] "GET /solr/admin/info/system\?wt=json HTTP/1.1" 404 360 "-" "Mozilla/5.0 \(Windows NT 10.0\; Win64\; x64\) AppleWebKit/537.36 \(KHTML, like Gecko\) Chrome/78.0.3904.108 Safari/537.36"

[14/Jun/2020:19:17:16 -0400] clown.local 195.54.160.135 - - "GET /index.php?s=/Index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP HTTP/1.1" 404 705
[14/Jun/2020:19:23:58 -0400] clown.local 195.54.160.135 - - "POST /api/jsonws/invoke HTTP/1.1" 404 705
[14/Jun/2020:20:30:07 -0400] clown.local 195.54.160.135 - - "GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 705
[14/Jun/2020:20:30:07 -0400] clown.local 195.54.160.135 - - "POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 705
...

 TCP (SYN) 195.54.160.135:43786 -> port 443, len 44

Unauthorized connection attempt detected from IP address 195.54.160.135 to port 8983 [T]

 TCP (SYN) 195.54.160.135:54360 -> port 8081, len 44

TCP ports : 6379 / 8088

06/07/2020-15:19:23.266779 195.54.160.135 Protocol: 6 ET SCAN NMAP -sS window 1024

 TCP (SYN) 195.54.160.135:59360 -> port 443, len 44

06/06/2020-13:49:57.812295 195.54.160.135 Protocol: 6 ET SCAN NMAP -sS window 1024

195.54.160.135 - - \[06/Jun/2020:08:42:43 +0200\] "GET /solr/admin/info/system\?wt=json HTTP/1.1" 403 468 "-" "Mozilla/5.0 \(Windows NT 10.0\; Win64\; x64\) AppleWebKit/537.36 \(KHTML, like Gecko\) Chrome/78.0.3904.108 Safari/537.36"
195.54.160.135 - - \[06/Jun/2020:08:48:18 +0200\] "GET /\?a=fetch\&content=\die\(@md5\(HelloThinkCMF\)\)\ HTTP/1.1" 403 446 "-" "Mozilla/5.0 \(Windows NT 10.0\; Win64\; x64\) AppleWebKit/537.36 \(KHTML, like Gecko\) Chrome/78.0.3904.108 Safari/537.36"
195.54.160.135 - - \[06/Jun/2020:08:48:18 +0200\] "GET /\?XDEBUG_SESSION_START=phpstorm HTTP/1.1" 403 446 "-" "Mozilla/5.0 \(Windows NT 10.0\; Win64\; x64\) AppleWebKit/537.36 \(KHTML, like Gecko\) Chrome/78.0.3904.108 Safari/537.36"
...

Scanned 3 times in the last 24 hours on port 6379

Fail2Ban Ban Triggered

GET /?a=fetch&content=die(@md5(HelloThinkCMF))

Jun  4 07:31:19 debian kernel: [147642.919130] [UFW BLOCK] IN=eth0 OUT= MAC=52:54:00:be:e4:65:08:e8:4f:6e:48:0c:08:00 SRC=195.54.160.135 DST=89.252.131.35 LEN=40 TOS=0x00 PREC=0x00 TTL=243 ID=35299 PROTO=TCP SPT=43385 DPT=2375 WINDOW=1024 RES=0x00 SYN URGP=0

Blocked until: 2020.07.21 04:28:32 TCPMSS DPT=2375 LEN=40 TOS=0x00 PREC=0x00 TTL=250 ID=24780 PROTO=TCP WINDOW=1024 RES=0x00 SYN URGP=0

Invalid user 9122 from 195.54.160.180 port 53705

Oct 13 09:25:01 santamaria sshd\[2434\]: Invalid user test from 195.54.160.180
Oct 13 09:25:01 santamaria sshd\[2434\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.54.160.180
Oct 13 09:25:02 santamaria sshd\[2434\]: Failed password for invalid user test from 195.54.160.180 port 58091 ssh2
...

Oct 12 20:05:00 er4gw sshd[19698]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.54.160.180

Oct 11 23:32:20 vmd26974 sshd[30264]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.54.160.180
Oct 11 23:32:23 vmd26974 sshd[30264]: Failed password for invalid user system from 195.54.160.180 port 14159 ssh2
...

Oct 11 15:41:50 santamaria sshd\[26585\]: Invalid user system from 195.54.160.180
Oct 11 15:41:50 santamaria sshd\[26585\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.54.160.180
Oct 11 15:41:52 santamaria sshd\[26585\]: Failed password for invalid user system from 195.54.160.180 port 32650 ssh2
...

Oct 11 06:35:54 ajax sshd[22680]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.54.160.180 
Oct 11 06:35:56 ajax sshd[22680]: Failed password for invalid user system from 195.54.160.180 port 14992 ssh2

Oct 11 01:01:19 jane sshd[1580]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.54.160.180 
Oct 11 01:01:21 jane sshd[1580]: Failed password for invalid user system from 195.54.160.180 port 22480 ssh2
...

Oct 10 15:31:39 vps639187 sshd\[5463\]: Invalid user video from 195.54.160.180 port 52740
Oct 10 15:31:39 vps639187 sshd\[5463\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.54.160.180
Oct 10 15:31:41 vps639187 sshd\[5463\]: Failed password for invalid user video from 195.54.160.180 port 52740 ssh2
...

2020-10-09 13:00:16.840788-0500  localhost sshd[8287]: Failed password for invalid user video from 195.54.160.180 port 14076 ssh2

2020-10-08 UTC: (14x) - admin(8x),record(6x)

Invalid user ftp from 195.54.160.183 port 22214

Repeated RDP login failures. Last user: admin

SSH login attempts.

Invalid user ftp from 195.54.160.183 port 22214

Repeated RDP login failures. Last user: administrator

May  2 00:17:49 debian-2gb-nbg1-2 kernel: \[10630379.808280\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=160.16.82.31 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=234 ID=20535 PROTO=TCP SPT=42501 DPT=26827 WINDOW=1024 RES=0x00 SYN URGP=0

May  2 00:03:00 vpn01 sshd[14782]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.254.145.29
May  2 00:03:01 vpn01 sshd[14782]: Failed password for invalid user mar from 182.254.145.29 port 52654 ssh2
...

xmlrpc attack

[2020-05-01 17:55:57] NOTICE[1170][C-00009552] chan_sip.c: Call from '' (51.158.30.15:56407) to extension '96011972592277524' rejected because extension not found in context 'public'.
[2020-05-01 17:55:57] SECURITY[1184] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-05-01T17:55:57.485-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="96011972592277524",SessionID="0x7f6c0809b758",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/51.158.30.15/56407",ACLName="no_extension_match"
[2020-05-01 18:00:32] NOTICE[1170][C-00009558] chan_sip.c: Call from '' (51.158.30.15:60267) to extension '97011972592277524' rejected because extension not found in context 'public'.
[2020-05-01 18:00:32] SECURITY[1184] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-05-01T18:00:32.913-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="97011972592277524",SessionID="0x7f6c08545828",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4
...

May  2 00:17:43 meumeu sshd[5925]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.253.69.134 
May  2 00:17:44 meumeu sshd[5925]: Failed password for invalid user celka from 218.253.69.134 port 51326 ssh2
May  2 00:21:56 meumeu sshd[6873]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.253.69.134 
...

31.193.131.188 - - [01/May/2020:23:38:07 +0200] "GET /wp-login.php HTTP/1.1" 200 5702 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
31.193.131.188 - - [01/May/2020:23:38:11 +0200] "POST /wp-login.php HTTP/1.1" 200 5953 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
31.193.131.188 - - [01/May/2020:23:38:11 +0200] "POST /xmlrpc.php HTTP/1.1" 200 427 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"

May  1 22:13:29 debian-2gb-nbg1-2 kernel: \[10622920.782891\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=79.138.29.147 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=52 ID=33522 PROTO=TCP SPT=3787 DPT=23 WINDOW=12787 RES=0x00 SYN URGP=0

SASL PLAIN auth failed: ruser=...

May  2 00:01:39 ncomp postfix/smtpd[30431]: warning: unknown[46.38.145.171]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
May  2 00:01:47 ncomp postfix/smtpd[30431]: warning: unknown[46.38.145.171]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
May  2 00:01:59 ncomp postfix/smtpd[30431]: warning: unknown[46.38.145.171]: SASL LOGIN authentication failed: UGFzc3dvcmQ6

May  2 00:12:21 eventyay sshd[26761]: Failed password for root from 222.186.15.62 port 39014 ssh2
May  2 00:12:23 eventyay sshd[26761]: Failed password for root from 222.186.15.62 port 39014 ssh2
May  2 00:12:25 eventyay sshd[26761]: Failed password for root from 222.186.15.62 port 39014 ssh2
...

May  2 00:15:06 ns381471 sshd[4939]: Failed password for git from 51.178.50.11 port 51380 ssh2

Triggered: repeated knocking on closed ports.

(sshd) Failed SSH login from 222.186.15.115 (-): 5 in the last 3600 secs

Invalid user admin from 221.179.103.2 port 40320

May  2 00:18:54 vmanager6029 sshd\[21858\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.42.137  user=root
May  2 00:18:57 vmanager6029 sshd\[21856\]: error: PAM: Authentication failure for root from 222.186.42.137
May  2 00:18:58 vmanager6029 sshd\[21859\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.42.137  user=root