netflix scam

Jan 29 07:01:36 grey postfix/smtpd\[28549\]: NOQUEUE: reject: RCPT from wire.jcnovel.com\[63.81.87.184\]: 554 5.7.1 Service unavailable\; Client host \[63.81.87.184\] blocked using truncate.gbudb.net\; http://www.gbudb.com/truncate/ \[63.81.87.184\]\; from=\ to=\ proto=ESMTP helo=\
...

Unauthorized connection attempt from IP address 192.30.89.51 on Port 445(SMB)

Jan 29 07:36:06 localhost sshd\[22004\]: Invalid user tavish from 119.252.143.68 port 59537
Jan 29 07:36:06 localhost sshd\[22004\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.252.143.68
Jan 29 07:36:08 localhost sshd\[22004\]: Failed password for invalid user tavish from 119.252.143.68 port 59537 ssh2

Jan 28 21:03:59 php1 sshd\[30983\]: Invalid user magana from 5.196.67.41
Jan 28 21:03:59 php1 sshd\[30983\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ns378499.ip-5-196-67.eu
Jan 28 21:04:01 php1 sshd\[30983\]: Failed password for invalid user magana from 5.196.67.41 port 55868 ssh2
Jan 28 21:08:59 php1 sshd\[31529\]: Invalid user prabuddha from 5.196.67.41
Jan 28 21:08:59 php1 sshd\[31529\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ns378499.ip-5-196-67.eu

Jan 29 06:52:56 www sshd\[91614\]: Invalid user people from 80.211.232.135
Jan 29 06:52:56 www sshd\[91614\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.232.135
Jan 29 06:52:58 www sshd\[91614\]: Failed password for invalid user people from 80.211.232.135 port 33580 ssh2
...

WordPress wp-login brute force :: 51.255.51.127 0.084 BYPASS [29/Jan/2020:04:54:05  0000] [censored_2] "POST /wp-login.php HTTP/1.1" 200 2287 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"

Automatic report - SSH Brute-Force Attack

Automatic report - Banned IP Access

Jan 28 20:24:07 php1 sshd\[26251\]: Invalid user ashrut from 220.246.26.51
Jan 28 20:24:07 php1 sshd\[26251\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=n220246026051.netvigator.com
Jan 28 20:24:09 php1 sshd\[26251\]: Failed password for invalid user ashrut from 220.246.26.51 port 51962 ssh2
Jan 28 20:27:16 php1 sshd\[26649\]: Invalid user jaishree from 220.246.26.51
Jan 28 20:27:16 php1 sshd\[26649\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=n220246026051.netvigator.com

2020-01-29T05:53:37.3411741240 sshd\[21169\]: Invalid user samba from 95.85.43.241 port 39039
2020-01-29T05:53:37.3441411240 sshd\[21169\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=95.85.43.241
2020-01-29T05:53:38.8530051240 sshd\[21169\]: Failed password for invalid user samba from 95.85.43.241 port 39039 ssh2
...

Jan 29 08:12:24 srv206 sshd[2883]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.171  user=root
Jan 29 08:12:26 srv206 sshd[2883]: Failed password for root from 218.92.0.171 port 19560 ssh2
Jan 29 08:12:29 srv206 sshd[2883]: Failed password for root from 218.92.0.171 port 19560 ssh2
Jan 29 08:12:24 srv206 sshd[2883]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.171  user=root
Jan 29 08:12:26 srv206 sshd[2883]: Failed password for root from 218.92.0.171 port 19560 ssh2
Jan 29 08:12:29 srv206 sshd[2883]: Failed password for root from 218.92.0.171 port 19560 ssh2
...

Unauthorized connection attempt detected from IP address 101.231.201.50 to port 2220 [J]

Excessive Port-Scanning

Jan 29 05:52:51  exim[27499]: [1\51] 1iwfLM-00079X-JS H=suppose.dlitmtk.com (suppose.baarro.com) [69.94.136.172] F= rejected after DATA: This message scored 101.2 spam points.

2020-01-29T02:09:07.529399vostok sshd\[31727\]: Invalid user deploy from 51.77.211.94 port 40016 | Triggered by Fail2Ban at Vostok web server