[Tue Nov 19 13:27:28.422433 2019] [:error] [pid 7782:tid 139689784702720] [client 5.188.84.6:60688] [client 5.188.84.6] ModSecurity: Access denied with code 403 (phase 1). Match of "within %{tx.allowed_http_versions}" against "REQUEST_PROTOCOL" required. [file "/etc/modsecurity/owasp-modsecurity-crs-3.2.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "972"] [id "920430"] [msg "HTTP protocol version is not allowed by policy"] [data "HTTP/1.0"] [severity "CRITICAL"] [ver "OWASP_CRS/3.2.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "OWASP_CRS/POLICY/PROTOCOL_NOT_ALLOWED"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A6"] [tag "PCI/6.5.10"] [hostname "karangploso.jatim.bmkg.go.id"] [uri "/index.php/component/tags/tag/415-layanan-informasi-gempa-bumi-melalui-email"] [unique_id "XdOLULVa3xvPhxxTaYH2YwAAAJY"], referer: http://karangploso.jatim.bmkg.go.id/index.php/component/tags/tag/415-layanan-informasi-gempa-bum
...

63.88.23.146 was recorded 14 times by 8 hosts attempting to connect to the following ports: 80. Incident counter (4h, 24h, all-time): 14, 80, 260

\[2019-11-19 01:46:22\] NOTICE\[2601\] chan_sip.c: Registration from '\' failed for '81.171.85.101:56580' - Wrong password
\[2019-11-19 01:46:22\] SECURITY\[2634\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-11-19T01:46:22.129-0500",Severity="Error",Service="SIP",EventVersion="2",AccountID="7981",SessionID="0x7fdf2c19f8b8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/81.171.85.101/56580",Challenge="17405e64",ReceivedChallenge="17405e64",ReceivedHash="748ee31c9032d0bf28dd5bc04a21428d"
\[2019-11-19 01:51:30\] NOTICE\[2601\] chan_sip.c: Registration from '\' failed for '81.171.85.101:54338' - Wrong password
\[2019-11-19 01:51:30\] SECURITY\[2634\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-11-19T01:51:30.577-0500",Severity="Error",Service="SIP",EventVersion="2",AccountID="8335",SessionID="0x7fdf2c19f8b8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/81.171.85

Nov 18 21:56:52 eddieflores sshd\[17489\]: Invalid user seisakupengin from 120.131.3.119
Nov 18 21:56:52 eddieflores sshd\[17489\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.131.3.119
Nov 18 21:56:54 eddieflores sshd\[17489\]: Failed password for invalid user seisakupengin from 120.131.3.119 port 50526 ssh2
Nov 18 22:02:14 eddieflores sshd\[17878\]: Invalid user passwd123467 from 120.131.3.119
Nov 18 22:02:14 eddieflores sshd\[17878\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.131.3.119

Nov 19 08:31:03 sd-53420 sshd\[4736\]: Invalid user coto from 51.158.115.237
Nov 19 08:31:03 sd-53420 sshd\[4736\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.158.115.237
Nov 19 08:31:05 sd-53420 sshd\[4736\]: Failed password for invalid user coto from 51.158.115.237 port 59144 ssh2
Nov 19 08:31:23 sd-53420 sshd\[4830\]: Invalid user angelos from 51.158.115.237
Nov 19 08:31:23 sd-53420 sshd\[4830\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.158.115.237
...

11/19/2019-08:26:02.563422 35.163.247.104 Protocol: 6 SURICATA TLS invalid record/traffic

Nov 19 04:56:06 firewall sshd[3423]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.133.247
Nov 19 04:56:06 firewall sshd[3423]: Invalid user hendricks from 106.12.133.247
Nov 19 04:56:08 firewall sshd[3423]: Failed password for invalid user hendricks from 106.12.133.247 port 54982 ssh2
...

Unauthorised access (Nov 19) SRC=220.121.97.43 LEN=40 TTL=241 ID=13900 TCP DPT=3389 WINDOW=1024 SYN 
Unauthorised access (Nov 17) SRC=220.121.97.43 LEN=40 TTL=241 ID=18588 TCP DPT=3389 WINDOW=1024 SYN

Nov 19 11:34:58 microserver sshd[12666]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.185.181.64  user=news
Nov 19 11:35:00 microserver sshd[12666]: Failed password for news from 146.185.181.64 port 41811 ssh2
Nov 19 11:38:06 microserver sshd[13244]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.185.181.64  user=root
Nov 19 11:38:09 microserver sshd[13244]: Failed password for root from 146.185.181.64 port 60076 ssh2
Nov 19 11:41:13 microserver sshd[13818]: Invalid user pachi from 146.185.181.64 port 50105

Nov 19 08:44:01 markkoudstaal sshd[3062]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.177.240.4
Nov 19 08:44:03 markkoudstaal sshd[3062]: Failed password for invalid user cod from 94.177.240.4 port 46294 ssh2
Nov 19 08:47:36 markkoudstaal sshd[3309]: Failed password for root from 94.177.240.4 port 57018 ssh2

F2B jail: sshd. Time: 2019-11-19 07:28:02, Reported by: VKReport

Nov 19 12:28:11 gw1 sshd[3039]: Failed password for smmsp from 221.178.157.244 port 51969 ssh2
...

Nov 19 08:24:57 dcd-gentoo sshd[29490]: User root from 222.186.180.41 not allowed because none of user's groups are listed in AllowGroups
Nov 19 08:24:59 dcd-gentoo sshd[29490]: error: PAM: Authentication failure for illegal user root from 222.186.180.41
Nov 19 08:24:57 dcd-gentoo sshd[29490]: User root from 222.186.180.41 not allowed because none of user's groups are listed in AllowGroups
Nov 19 08:24:59 dcd-gentoo sshd[29490]: error: PAM: Authentication failure for illegal user root from 222.186.180.41
Nov 19 08:24:57 dcd-gentoo sshd[29490]: User root from 222.186.180.41 not allowed because none of user's groups are listed in AllowGroups
Nov 19 08:24:59 dcd-gentoo sshd[29490]: error: PAM: Authentication failure for illegal user root from 222.186.180.41
Nov 19 08:24:59 dcd-gentoo sshd[29490]: Failed keyboard-interactive/pam for invalid user root from 222.186.180.41 port 53624 ssh2
...

Fail2Ban Ban Triggered

Unauthorised access (Nov 19) SRC=178.186.28.71 LEN=52 TTL=115 ID=27953 DF TCP DPT=445 WINDOW=8192 SYN