firewall-block, port(s): 1812/udp, 4433/tcp, 5353/udp

MultiHost/MultiPort Probe, Scan, Hack -

Aug  8 08:26:44 debian-2gb-nbg1-2 kernel: \[19126451.893223\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=223.71.167.166 DST=195.201.40.59 LEN=44 TOS=0x04 PREC=0x00 TTL=112 ID=53203 PROTO=TCP SPT=11295 DPT=14265 WINDOW=29200 RES=0x00 SYN URGP=0

Attempts against SMTP/SSMTP

firewall-block, port(s): 79/tcp, 113/tcp, 2379/tcp, 5678/tcp, 5986/tcp, 8123/tcp, 12587/tcp

Aug  5 11:03:37 debian-2gb-nbg1-2 kernel: \[18876679.406299\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=223.71.167.166 DST=195.201.40.59 LEN=44 TOS=0x04 PREC=0x00 TTL=112 ID=60102 PROTO=TCP SPT=33654 DPT=8291 WINDOW=29200 RES=0x00 SYN URGP=0

Telnet/23 MH Probe, Scan, BF, Hack -

Jul 31 15:26:45 debian-2gb-nbg1-2 kernel: \[18460490.672896\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=223.71.167.166 DST=195.201.40.59 LEN=44 TOS=0x04 PREC=0x00 TTL=112 ID=55179 PROTO=TCP SPT=40160 DPT=2048 WINDOW=29200 RES=0x00 SYN URGP=0

Jul 30 15:09:09 debian-2gb-nbg1-2 kernel: \[18373039.435474\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=223.71.167.166 DST=195.201.40.59 LEN=44 TOS=0x04 PREC=0x00 TTL=112 ID=45574 PROTO=TCP SPT=6526 DPT=4567 WINDOW=29200 RES=0x00 SYN URGP=0

Jul 27 11:57:18 debian-2gb-nbg1-2 kernel: \[18102343.941733\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=223.71.167.166 DST=195.201.40.59 LEN=44 TOS=0x04 PREC=0x00 TTL=112 ID=40242 PROTO=TCP SPT=20041 DPT=5443 WINDOW=29200 RES=0x00 SYN URGP=0

Jul 25 23:37:29 debian-2gb-nbg1-2 kernel: \[17971563.161905\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=223.71.167.166 DST=195.201.40.59 LEN=44 TOS=0x04 PREC=0x00 TTL=112 ID=52547 PROTO=TCP SPT=40362 DPT=5061 WINDOW=29200 RES=0x00 SYN URGP=0

Jul 25 13:27:43 debian-2gb-nbg1-2 kernel: \[17934979.153440\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=223.71.167.166 DST=195.201.40.59 LEN=44 TOS=0x04 PREC=0x00 TTL=112 ID=12266 PROTO=TCP SPT=21165 DPT=1010 WINDOW=29200 RES=0x00 SYN URGP=0

Telnet/23 MH Probe, Scan, BF, Hack -

[Wed Jul 01 17:37:40 2020] - DDoS Attack From IP: 223.71.167.166 Port: 50589

Jul  8 12:16:34 debian-2gb-nbg1-2 kernel: \[16461993.370049\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=223.71.167.166 DST=195.201.40.59 LEN=44 TOS=0x04 PREC=0x60 TTL=113 ID=12950 PROTO=TCP SPT=16429 DPT=9002 WINDOW=29200 RES=0x00 SYN URGP=0

firewall-block, port(s): 23/tcp, 119/tcp, 2323/tcp, 6969/udp, 7474/tcp, 9876/tcp, 16010/tcp

firewall-block, port(s): 1604/tcp, 5632/udp, 6664/tcp, 8883/tcp, 50100/tcp

Jun 29 08:52:33 debian-2gb-nbg1-2 kernel: \[15672197.829342\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=223.71.167.166 DST=195.201.40.59 LEN=44 TOS=0x04 PREC=0x00 TTL=113 ID=12747 PROTO=TCP SPT=30152 DPT=3542 WINDOW=29200 RES=0x00 SYN URGP=0

Honeypot attack, port: 4567, PTR: PTR record not found

Jun 15 10:28:43 debian-2gb-nbg1-2 kernel: \[14468432.000812\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=223.71.167.166 DST=195.201.40.59 LEN=33 TOS=0x04 PREC=0x00 TTL=114 ID=29482 PROTO=UDP SPT=9056 DPT=3283 LEN=13

Jun 15 01:03:59 debian-2gb-nbg1-2 kernel: \[14434549.593658\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=223.71.167.166 DST=195.201.40.59 LEN=44 TOS=0x04 PREC=0x00 TTL=114 ID=25287 PROTO=TCP SPT=8811 DPT=873 WINDOW=29200 RES=0x00 SYN URGP=0

Jun 14 16:53:28 debian-2gb-nbg1-2 kernel: \[14405120.598908\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=223.71.167.166 DST=195.201.40.59 LEN=44 TOS=0x04 PREC=0x00 TTL=114 ID=35674 PROTO=TCP SPT=8257 DPT=1080 WINDOW=29200 RES=0x00 SYN URGP=0

Jun 14 01:33:01 debian-2gb-nbg1-2 kernel: \[14349896.469495\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=223.71.167.166 DST=195.201.40.59 LEN=44 TOS=0x04 PREC=0x00 TTL=114 ID=34317 PROTO=TCP SPT=18453 DPT=4730 WINDOW=29200 RES=0x00 SYN URGP=0

firewall-block, port(s): 79/tcp, 1723/tcp, 2323/tcp, 4064/tcp, 5432/tcp, 8834/tcp, 9999/tcp

Jun  3 05:58:30 debian-2gb-nbg1-2 kernel: \[13415474.445020\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=223.71.167.166 DST=195.201.40.59 LEN=44 TOS=0x04 PREC=0x00 TTL=114 ID=34816 PROTO=TCP SPT=56585 DPT=2424 WINDOW=29200 RES=0x00 SYN URGP=0

May 28 19:33:01 debian-2gb-nbg1-2 kernel: \[12945969.922515\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=223.71.167.166 DST=195.201.40.59 LEN=44 TOS=0x04 PREC=0x00 TTL=114 ID=32739 PROTO=TCP SPT=54621 DPT=2080 WINDOW=29200 RES=0x00 SYN URGP=0

scans 29 times in preceeding hours on the ports (in chronological order) 1723 16992 8099 9711 9191 1777 4500 6665 1604 7548 9999 8378 9009 7779 1723 5683 3460 9200 9002 2002 2096 10554 10243 47808 32400 10038 50050 5000 1201 resulting in total of 29 scans from 223.64.0.0/11 block.

firewall-block, port(s): 15/tcp, 4063/tcp, 5683/udp, 10554/tcp

May 25 01:22:43 debian-2gb-nbg1-2 kernel: \[12621369.137064\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=223.71.167.166 DST=195.201.40.59 LEN=44 TOS=0x04 PREC=0x00 TTL=114 ID=35405 PROTO=TCP SPT=64777 DPT=61616 WINDOW=29200 RES=0x00 SYN URGP=0

May 24 18:52:27 debian-2gb-nbg1-2 kernel: \[12597954.791975\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=223.71.167.166 DST=195.201.40.59 LEN=28 TOS=0x04 PREC=0x00 TTL=114 ID=11894 PROTO=UDP SPT=35441 DPT=500 LEN=8

223.71.167.165 was recorded 6 times by 2 hosts attempting to connect to the following ports: 389,8883,9711,40000,1962. Incident counter (4h, 24h, all-time): 6, 55, 26947

Port scan detected

223.71.167.165 was recorded 13 times by 3 hosts attempting to connect to the following ports: 25,4567,5000,4840,82,55443,500,8008,9009,465,21. Incident counter (4h, 24h, all-time): 13, 57, 26900

223.71.167.165 was recorded 11 times by 3 hosts attempting to connect to the following ports: 4880,12000,30005,27017,7000,2086,8125,23424,23456,3790,3310. Incident counter (4h, 24h, all-time): 11, 61, 26833

unauthorized access on port 443 [https]

SSH Bruteforce Attempt on Honeypot

Unauthorized connection attempt detected from IP address 223.71.167.165 to port 5985 [T]

telnet attack

 TCP (SYN) 223.71.167.164:60928 -> port 4444, len 44

Unauthorized connection attempt detected from IP address 223.71.167.165 to port 4000 [T]

Web application attack detected by fail2ban

 UDP 223.71.167.165:36529 -> port 53, len 58

 TCP (SYN) 223.71.167.164:44529 -> port 11211, len 44

 TCP (SYN) 223.71.167.164:10073 -> port 4840, len 44

scan

Unauthorised access (Sep 12) SRC=115.99.212.233 LEN=40 TOS=0x10 PREC=0x40 TTL=51 ID=29968 TCP DPT=23 WINDOW=62782 SYN

Automatic report - Port Scan Attack

$f2bV_matches

2 attempts against mh-modsecurity-ban on comet

2020-09-13T12:22:57.934529amanda2.illicoweb.com sshd\[44685\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=162-204-50-89.lightspeed.stlsmo.sbcglobal.net  user=root
2020-09-13T12:22:59.545905amanda2.illicoweb.com sshd\[44685\]: Failed password for root from 162.204.50.89 port 46978 ssh2
2020-09-13T12:27:01.055842amanda2.illicoweb.com sshd\[44922\]: Invalid user master from 162.204.50.89 port 43139
2020-09-13T12:27:01.058494amanda2.illicoweb.com sshd\[44922\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=162-204-50-89.lightspeed.stlsmo.sbcglobal.net
2020-09-13T12:27:02.835242amanda2.illicoweb.com sshd\[44922\]: Failed password for invalid user master from 162.204.50.89 port 43139 ssh2
...

fuck you

Sep 13 11:05:56 web8 sshd\[31941\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=66.98.116.207  user=root
Sep 13 11:05:57 web8 sshd\[31941\]: Failed password for root from 66.98.116.207 port 35524 ssh2
Sep 13 11:13:31 web8 sshd\[3442\]: Invalid user f from 66.98.116.207
Sep 13 11:13:31 web8 sshd\[3442\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=66.98.116.207
Sep 13 11:13:33 web8 sshd\[3442\]: Failed password for invalid user f from 66.98.116.207 port 49290 ssh2

srvr2: (mod_security) mod_security (id:934100) triggered by 20.36.194.79 (US/-/-): 1 in the last 600 secs; Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: 2020/09/13 07:52:22 [error] 70302#0: *112258 [client 20.36.194.79] ModSecurity: Access denied with code 406 (phase 2).  [file "/etc/modsecurity.d/REQUEST-934-APPLICATION-ATTACK-NODEJS.conf"] [line "48"] [id "934100"] [rev ""] [msg ""] [redacted] [severity "0"] [ver "OWASP_CRS/3.3.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-javascript"] [tag "platform-multi"] [tag "attack-rce"] [tag "attack-injection-nodejs"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [redacted] [uri "/p/i/"] [unique_id "159997634234.076801"] [ref ""], client: 20.36.194.79, [redacted] request: "GET /p/i/?a=">alert(String.fromCharCode(88,83,83))&get=f_26&order=ASC&token=f1c6dd4b95196516b8a5cafed373733de1dafb9d HTTP/1.1" [redacted]

Automatic report - Port Scan Attack

Sep 13 07:03:40 inter-technics sshd[11401]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.100.85.61  user=root
Sep 13 07:03:41 inter-technics sshd[11401]: Failed password for root from 185.100.85.61 port 36742 ssh2
Sep 13 07:03:43 inter-technics sshd[11401]: Failed password for root from 185.100.85.61 port 36742 ssh2
Sep 13 07:03:40 inter-technics sshd[11401]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.100.85.61  user=root
Sep 13 07:03:41 inter-technics sshd[11401]: Failed password for root from 185.100.85.61 port 36742 ssh2
Sep 13 07:03:43 inter-technics sshd[11401]: Failed password for root from 185.100.85.61 port 36742 ssh2
Sep 13 07:03:40 inter-technics sshd[11401]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.100.85.61  user=root
Sep 13 07:03:41 inter-technics sshd[11401]: Failed password for root from 185.100.85.61 port 36742 ssh2
Sep 13 07
...

2020-09-13T06:11:50.301717abusebot-4.cloudsearch.cf sshd[11418]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.58.65.21  user=root
2020-09-13T06:11:52.476849abusebot-4.cloudsearch.cf sshd[11418]: Failed password for root from 187.58.65.21 port 20410 ssh2
2020-09-13T06:13:45.946926abusebot-4.cloudsearch.cf sshd[11430]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.58.65.21  user=root
2020-09-13T06:13:47.911096abusebot-4.cloudsearch.cf sshd[11430]: Failed password for root from 187.58.65.21 port 2186 ssh2
2020-09-13T06:15:26.333289abusebot-4.cloudsearch.cf sshd[11437]: Invalid user shake from 187.58.65.21 port 34150
2020-09-13T06:15:26.339375abusebot-4.cloudsearch.cf sshd[11437]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.58.65.21
2020-09-13T06:15:26.333289abusebot-4.cloudsearch.cf sshd[11437]: Invalid user shake from 187.58.65.21 port 34150
2020-09
...

2020-09-13T06:04:38.665308devel sshd[24172]: Failed password for root from 115.223.34.141 port 42876 ssh2
2020-09-13T06:07:21.139743devel sshd[24380]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.223.34.141  user=root
2020-09-13T06:07:23.039914devel sshd[24380]: Failed password for root from 115.223.34.141 port 57117 ssh2

SSH/22 MH Probe, BF, Hack -

Sep 13 13:20:14 nextcloud sshd\[30391\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.23.33.22  user=root
Sep 13 13:20:16 nextcloud sshd\[30391\]: Failed password for root from 94.23.33.22 port 56998 ssh2
Sep 13 13:24:16 nextcloud sshd\[2081\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.23.33.22  user=root

Sep 13 06:22:09 ip106 sshd[7245]: Failed password for root from 152.136.106.94 port 55796 ssh2
...