Honeypot attack, port: 445, PTR: 99.124.254.80.donpac.ru.

(From minton.garland51@hotmail.com) Hey,

I heard about SocialAdr from a friend of mine but was hesitant at first, because it sounded too good to be true.  She told me, "All you have to do is enter your web page details and other members promote your URLs to their social media profiles automatically.  It literally takes 5 minutes to get setup."

So I figured, "What the heck!", I may as well give it a try.

I signed up for the 'Free' account and found the Setup Wizard super easy to use.  With the 'Free' account you have to setup all your own social media accounts (only once though) in order to get started.  Next, I shared 5 other members' links, which was as simple as clicking a single button.  I had to do this first in order to earn "credits" which can then be spent when other members share my links.  Then I added a couple of my own web pages and a short while later started receiving notification that they had been submitted to a list of social media sites.

Wow.  And this was just with the 'Free' acc

3x Failed Password

Honeypot attack, port: 23, PTR: PTR record not found

61.2.188.57 - - [15/Dec/2019:03:20:19] "POST /GponForm/diag_Form?images/ HTTP/1.1" 444 0 "-" "Hello, World"

83.236.137.231

Honeypot attack, port: 445, PTR: PTR record not found

/var/log/messages:Dec 14 18:45:37 sanyalnet-cloud-vps audispd: node=sanyalnet-cloud-vps.freeddns.org type=CRYPTO_SESSION msg=audhostname(1576349137.487:10283): pid=9199 uid=0 auid=4294967295 ses=4294967295 msg='op=start direction=from-server cipher=aes256-ctr ksize=256 mac=hmac-sha1 pfs=ecdh-sha2-nistp256 spid=9200 suid=74 rport=34058 laddr=104.167.106.93 lport=22  exe="/usr/sbin/sshd" hostname=? addr=163.44.153.232 terminal=? res=success'
/var/log/messages:Dec 14 18:45:37 sanyalnet-cloud-vps audispd: node=sanyalnet-cloud-vps.freeddns.org type=CRYPTO_SESSION msg=audhostname(1576349137.490:10284): pid=9199 uid=0 auid=4294967295 ses=4294967295 msg='op=start direction=from-client cipher=aes256-ctr ksize=256 mac=hmac-sha1 pfs=ecdh-sha2-nistp256 spid=9200 suid=74 rport=34058 laddr=104.167.106.93 lport=22  exe="/usr/sbin/sshd" hostname=? addr=163.44.153.232 terminal=? res=success'
/var/log/messages:Dec 14 18:45:38 sanyalnet-cloud-vps fail2ban.filter[1551]: WARNING Determined ........
-------------------------------

2019-12-15T11:54:14.848768abusebot.cloudsearch.cf sshd\[10572\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=168.ip-164-132-102.eu  user=root
2019-12-15T11:54:16.612342abusebot.cloudsearch.cf sshd\[10572\]: Failed password for root from 164.132.102.168 port 52564 ssh2
2019-12-15T12:01:30.495212abusebot.cloudsearch.cf sshd\[10747\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=168.ip-164-132-102.eu  user=root
2019-12-15T12:01:32.444677abusebot.cloudsearch.cf sshd\[10747\]: Failed password for root from 164.132.102.168 port 36674 ssh2

Dec 15 14:04:42 nextcloud sshd\[13695\]: Invalid user hanspeter from 218.144.166.212
Dec 15 14:04:42 nextcloud sshd\[13695\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.144.166.212
Dec 15 14:04:44 nextcloud sshd\[13695\]: Failed password for invalid user hanspeter from 218.144.166.212 port 47460 ssh2
...

sshd jail - ssh hack attempt

Dec 14 08:43:53 penfold sshd[17556]: Invalid user erpnext from 31.24.236.13 port 37185
Dec 14 08:43:53 penfold sshd[17556]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.24.236.13 
Dec 14 08:43:55 penfold sshd[17556]: Failed password for invalid user erpnext from 31.24.236.13 port 37185 ssh2
Dec 14 08:43:55 penfold sshd[17556]: Received disconnect from 31.24.236.13 port 37185:11: Bye Bye [preauth]
Dec 14 08:43:55 penfold sshd[17556]: Disconnected from 31.24.236.13 port 37185 [preauth]
Dec 14 08:58:38 penfold sshd[18443]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.24.236.13  user=r.r
Dec 14 08:58:40 penfold sshd[18443]: Failed password for r.r from 31.24.236.13 port 35112 ssh2
Dec 14 08:58:40 penfold sshd[18443]: Received disconnect from 31.24.236.13 port 35112:11: Bye Bye [preauth]
Dec 14 08:58:40 penfold sshd[18443]: Disconnected from 31.24.236.13 port 35112 [preauth]
Dec 14 09........
-------------------------------

Dec 15 10:29:53 MK-Soft-VM6 sshd[4174]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.241.183.220 
Dec 15 10:29:54 MK-Soft-VM6 sshd[4174]: Failed password for invalid user Gang from 192.241.183.220 port 42789 ssh2
...

Dec 14 17:43:34 web1 sshd[12635]: Address 189.181.210.65 maps to dsl-189-181-210-65-dyn.prod-infinhostnameum.com.mx, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!
Dec 14 17:43:34 web1 sshd[12635]: Invalid user zd from 189.181.210.65
Dec 14 17:43:34 web1 sshd[12635]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.181.210.65 
Dec 14 17:43:36 web1 sshd[12635]: Failed password for invalid user zd from 189.181.210.65 port 10337 ssh2
Dec 14 17:43:37 web1 sshd[12635]: Received disconnect from 189.181.210.65: 11: Bye Bye [preauth]
Dec 14 17:48:44 web1 sshd[13023]: Address 189.181.210.65 maps to dsl-189-181-210-65-dyn.prod-infinhostnameum.com.mx, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!
Dec 14 17:48:44 web1 sshd[13023]: Invalid user zch from 189.181.210.65
Dec 14 17:48:44 web1 sshd[13023]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.........
-------------------------------

2019-12-15T13:52:44.550389+01:00 lumpi kernel: [1704302.121406] INPUT:DROP:SPAMHAUS_EDROP:IN=eth0 OUT= MAC=52:54:a2:01:a5:04:d2:74:7f:6e:37:e3:08:00 SRC=185.143.223.104 DST=78.46.199.189 LEN=40 TOS=0x00 PREC=0x00 TTL=245 ID=40939 PROTO=TCP SPT=46757 DPT=33394 WINDOW=1024 RES=0x00 SYN URGP=0 
...