Triggered by Fail2Ban at Ares web server

Feb 12 05:40:38 roki sshd[8617]: Invalid user postgres from 112.133.223.142
Feb 12 05:40:38 roki sshd[8617]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.133.223.142
Feb 12 05:40:40 roki sshd[8617]: Failed password for invalid user postgres from 112.133.223.142 port 47228 ssh2
Feb 12 05:58:23 roki sshd[11694]: Invalid user ec2-user from 112.133.223.142
Feb 12 05:58:23 roki sshd[11694]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.133.223.142
...

Feb 12 05:59:57 MK-Soft-VM5 sshd[21670]: Failed password for root from 222.186.30.218 port 49874 ssh2
Feb 12 05:59:59 MK-Soft-VM5 sshd[21670]: Failed password for root from 222.186.30.218 port 49874 ssh2
...

Feb 12 00:30:23 plex sshd[27741]: Invalid user clara from 51.77.41.246 port 53210

[Wed Feb 12 05:23:57.865880 2020] [:error] [pid 17173:tid 140476512638720] [client 66.220.149.22:40672] [client 66.220.149.22] ModSecurity: Access denied with code 403 (phase 4). Pattern match "^5\\\\d{2}$" at RESPONSE_STATUS. [file "/etc/modsecurity/owasp-modsecurity-crs-3.2.0/rules/RESPONSE-950-DATA-LEAKAGES.conf"] [line "118"] [id "950100"] [msg "The Application Returned a 500-Level Status Code"] [data "Matched Data: 500 found within RESPONSE_STATUS: 500"] [severity "ERROR"] [ver "OWASP_CRS/3.2.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-disclosure"] [tag "WASCTC/WASC-13"] [tag "OWASP_TOP_10/A6"] [tag "PCI/6.5.6"] [tag "paranoia-level/2"] [hostname "karangploso.jatim.bmkg.go.id"] [uri "/index.php/profil/meteorologi/list-all-categories/555557850-prakiraan-cuaca-harian-tiap-3-jam-sekali-di-kabupaten-malang"] [unique_id "XkMpfRpeLICRfEyFYGnDvgAAADg"]
...

1581459824 - 02/11/2020 23:23:44 Host: 193.200.151.31/193.200.151.31 Port: 445 TCP Blocked

TCP Port Scanning

Feb 11 14:46:38 hpm sshd\[6327\]: Invalid user prueba1 from 82.251.138.44
Feb 11 14:46:38 hpm sshd\[6327\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=lns-bzn-40-82-251-138-44.adsl.proxad.net
Feb 11 14:46:39 hpm sshd\[6327\]: Failed password for invalid user prueba1 from 82.251.138.44 port 53398 ssh2
Feb 11 14:49:46 hpm sshd\[6737\]: Invalid user ella from 82.251.138.44
Feb 11 14:49:46 hpm sshd\[6737\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=lns-bzn-40-82-251-138-44.adsl.proxad.net

20 attempts against mh-misbehave-ban on grain

port scan and connect, tcp 23 (telnet)

Invalid user ccw from 159.89.169.137 port 49872

Feb 12 05:55:02 [host] sshd[11390]: pam_unix(sshd:
Feb 12 05:55:04 [host] sshd[11390]: Failed passwor
Feb 12 05:58:12 [host] sshd[11476]: pam_unix(sshd:

Feb 12 05:55:43 silence02 sshd[1699]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.227.211
Feb 12 05:55:45 silence02 sshd[1699]: Failed password for invalid user ts from 178.128.227.211 port 35388 ssh2
Feb 12 05:58:51 silence02 sshd[1957]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.227.211

Feb 12 01:57:49 firewall sshd[23721]: Invalid user ray from 211.251.237.142
Feb 12 01:57:51 firewall sshd[23721]: Failed password for invalid user ray from 211.251.237.142 port 54592 ssh2
Feb 12 01:58:21 firewall sshd[23754]: Invalid user ray from 211.251.237.142
...

Feb 11 23:41:08  exim[24575]: [1\51] 1j1eDK-0006ON-UO H=appetite.yeouan.com (appetite.badabuk.com) [81.28.106.234] F= rejected after DATA: This message scored 100.5 spam points.