| 193.25.121.249 |
attackbotsspam |
port scan and connect, tcp 80 (http) |
2020-09-06 13:20:02 |
| 85.209.0.102 |
attack |
TCP (SYN) 85.209.0.102:23448 -> port 22, len 60 |
2020-09-06 13:40:56 |
| 190.14.47.108 |
attack |
failed_logins |
2020-09-06 13:07:43 |
| 164.163.25.207 |
attackbotsspam |
Automatic report - Banned IP Access |
2020-09-06 13:39:24 |
| 207.244.252.113 |
attackbots |
(From superior@brainboost.com) From:
HEADLINE NEWS August 2020
Bill Gates: "Americans Must Use This... I Never Leave Home Without Taking It First"
That's Bill Gates talking about this breakthrough treatment for getting his brain back in top shape. He is not happy with where the country is headed and so he has poured money into a treatment that has rescued his mental clarity and it's doing the same accross the nation.
Speaking on the TODAY Show last month, Bill Gates, Founder of Microsoft, spoke to the audience... "America is losing because of our own stupidity" We have got to change the way things are. You won't believe what Mr. Gates said he uses... "
Full Story Inside >
https://dclks.com/click.cgi?a=662x9a3059&o=72x335249&t=85x34d6a5&sub2=brain
If you have a brain you must use this. See what the Sharks say... |
2020-09-06 13:14:16 |
| 202.164.45.101 |
attack |
202.164.45.101 - - [05/Sep/2020:20:27:06 +0200] "POST /wp-login.php HTTP/1.0" 200 4793 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
... |
2020-09-06 13:04:57 |
| 98.159.99.58 |
attackbotsspam |
Connection to SSH Honeypot - Detected by HoneypotDB |
2020-09-06 13:33:53 |
| 14.160.52.58 |
attackspambots |
Attempted Brute Force (dovecot) |
2020-09-06 13:31:37 |
| 61.177.172.128 |
attackbots |
Sep 6 07:01:22 nextcloud sshd\[9807\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.177.172.128 user=root
Sep 6 07:01:24 nextcloud sshd\[9807\]: Failed password for root from 61.177.172.128 port 53255 ssh2
Sep 6 07:01:38 nextcloud sshd\[9807\]: Failed password for root from 61.177.172.128 port 53255 ssh2 |
2020-09-06 13:02:01 |
| 34.209.124.160 |
attackspam |
Lines containing failures of 34.209.124.160
auth.log:Sep 5 09:54:05 omfg sshd[14971]: Connection from 34.209.124.160 port 47182 on 78.46.60.42 port 22
auth.log:Sep 5 09:54:06 omfg sshd[14971]: Connection closed by 34.209.124.160 port 47182 [preauth]
auth.log:Sep 5 09:54:07 omfg sshd[14973]: Connection from 34.209.124.160 port 48614 on 78.46.60.42 port 22
auth.log:Sep 5 09:54:07 omfg sshd[14973]: Unable to negotiate whostnameh 34.209.124.160 port 48614: no matching host key type found. Their offer: ecdsa-sha2-nistp384 [preauth]
auth.log:Sep 5 09:54:08 omfg sshd[14975]: Connection from 34.209.124.160 port 49690 on 78.46.60.42 port 22
auth.log:Sep 5 09:54:09 omfg sshd[14975]: Unable to negotiate whostnameh 34.209.124.160 port 49690: no matching host key type found. Their offer: ecdsa-sha2-nistp521 [preauth]
auth.log:Sep 5 09:54:10 omfg sshd[14977]: Connection from 34.209.124.160 port 50530 on 78.46.60.42 port 22
auth.log:Sep 5 09:54:11 omfg sshd[14977]: Connection c........
------------------------------ |
2020-09-06 13:06:01 |
| 165.90.3.122 |
attack |
[Sun Sep 06 03:13:25.153543 2020] [:error] [pid 2754:tid 140397330274048] [client 165.90.3.122:65500] [client 165.90.3.122] ModSecurity: Access denied with code 403 (phase 1). Match of "within %{tx.allowed_http_versions}" against "REQUEST_PROTOCOL" required. [file "/etc/modsecurity/owasp-modsecurity-crs-3.2.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "972"] [id "920430"] [msg "HTTP protocol version is not allowed by policy"] [data "HTTP/1.0"] [severity "CRITICAL"] [ver "OWASP_CRS/3.2.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "OWASP_CRS/POLICY/PROTOCOL_NOT_ALLOWED"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A6"] [tag "PCI/6.5.10"] [hostname "karangploso.jatim.bmkg.go.id"] [uri "/"] [unique_id "X1PxZdlmuncnyx65RuMHlQAAAGU"]
... |
2020-09-06 13:06:58 |
| 192.35.168.80 |
attack |
Honeypot hit: [2020-09-06 00:46:51 +0300] Connected from 192.35.168.80 to (HoneypotIP):110 |
2020-09-06 13:24:26 |
| 222.186.15.62 |
attackspam |
Sep 6 15:02:40 localhost sshd[10987]: Disconnected from 222.186.15.62 port 58979 [preauth]
... |
2020-09-06 13:12:35 |
| 187.85.29.54 |
attackbotsspam |
TCP (SYN) 187.85.29.54:17485 -> port 23, len 44 |
2020-09-06 13:37:06 |
| 67.205.162.223 |
attackbotsspam |
TCP (SYN) 67.205.162.223:58529 -> port 26091, len 44 |
2020-09-06 13:16:07 |