09/24/2019-23:55:19.127594 81.22.45.252 Protocol: 6 ET CINS Active Threat Intelligence Poor Reputation IP group 84

09/24/2019-06:11:02.861711 81.22.45.252 Protocol: 6 ET DROP Dshield Block Listed Source group 1

Sep 23 20:56:46 lumpi kernel: INPUT:DROP:SPAMHAUS_EDROP:IN=eth0 OUT= MAC=52:54:a2:01:a5:04:d2:74:7f:6e:37:e3:08:00 SRC=81.22.45.252 DST=172.31.1.100 LEN=40 TOS=0x00 PREC=0x00 TTL=244 ID=52926 PROTO=TCP SPT=57189 DPT=8412 WINDOW=1024 RES=0x00 SYN URGP=0 
...

09/20/2019-23:54:30.547732 81.22.45.252 Protocol: 6 ET CINS Active Threat Intelligence Poor Reputation IP group 85

09/11/2019-16:39:01.392270 81.22.45.252 Protocol: 6 ET CINS Active Threat Intelligence Poor Reputation IP group 85

Sep 11 09:58:51 lumpi kernel: INPUT:DROP:SPAMHAUS_EDROP:IN=eth0 OUT= MAC=52:54:a2:01:a5:04:d2:74:7f:6e:37:e3:08:00 SRC=81.22.45.252 DST=172.31.1.100 LEN=40 TOS=0x00 PREC=0x00 TTL=244 ID=64535 PROTO=TCP SPT=56366 DPT=555 WINDOW=1024 RES=0x00 SYN URGP=0 
...

09/09/2019-22:50:08.900130 81.22.45.252 Protocol: 6 ET SCAN NMAP -sS window 1024

Portscan or hack attempt detected by psad/fwsnort

09/02/2019-21:55:36.711016 81.22.45.252 Protocol: 6 ET CINS Active Threat Intelligence Poor Reputation IP group 85

Aug 29 22:27:38 lumpi kernel: INPUT:DROP:SPAMHAUS_EDROP:IN=eth0 OUT= MAC=52:54:a2:01:a5:04:d2:74:7f:6e:37:e3:08:00 SRC=81.22.45.252 DST=172.31.1.100 LEN=40 TOS=0x00 PREC=0x00 TTL=244 ID=19486 PROTO=TCP SPT=42798 DPT=8896 WINDOW=1024 RES=0x00 SYN URGP=0 
...

Aug 25 16:54:52 lumpi kernel: INPUT:DROP:SPAMHAUS_EDROP:IN=eth0 OUT= MAC=52:54:a2:01:a5:04:d2:74:7f:6e:37:e3:08:00 SRC=81.22.45.252 DST=172.31.1.100 LEN=40 TOS=0x00 PREC=0x00 TTL=244 ID=55931 PROTO=TCP SPT=44112 DPT=9513 WINDOW=1024 RES=0x00 SYN URGP=0 
...

Aug 24 13:48:18 lumpi kernel: INPUT:DROP:SPAMHAUS_EDROP:IN=eth0 OUT= MAC=52:54:a2:01:a5:04:d2:74:7f:6e:37:e3:08:00 SRC=81.22.45.252 DST=172.31.1.100 LEN=40 TOS=0x00 PREC=0x00 TTL=244 ID=31493 PROTO=TCP SPT=44112 DPT=9816 WINDOW=1024 RES=0x00 SYN URGP=0 
...

08/22/2019-23:14:29.720865 81.22.45.252 Protocol: 6 ET SCAN NMAP -sS window 1024

MultiHost/MultiPort Probe, Scan, Hack -

08/21/2019-15:29:26.343421 81.22.45.252 Protocol: 6 ET CINS Active Threat Intelligence Poor Reputation IP group 85

08/20/2019-00:26:00.148329 81.22.45.252 Protocol: 6 ET SCAN NMAP -sS window 1024

Port Scan: TCP/9242

08/15/2019-07:36:36.318969 81.22.45.252 Protocol: 6 ET CINS Active Threat Intelligence Poor Reputation IP group 85

Aug 15 02:06:01 lumpi kernel: INPUT:DROP:SPAMHAUS_EDROP:IN=eth0 OUT= MAC=52:54:a2:01:a5:04:d2:74:7f:6e:37:e3:08:00 SRC=81.22.45.252 DST=172.31.1.100 LEN=40 TOS=0x00 PREC=0x00 TTL=244 ID=27811 PROTO=TCP SPT=44112 DPT=50122 WINDOW=1024 RES=0x00 SYN URGP=0 
...

Aug 13 21:52:01 lumpi kernel: INPUT:DROP:SPAMHAUS_EDROP:IN=eth0 OUT= MAC=52:54:a2:01:a5:04:d2:74:7f:6e:37:e3:08:00 SRC=81.22.45.252 DST=172.31.1.100 LEN=40 TOS=0x00 PREC=0x00 TTL=244 ID=8514 PROTO=TCP SPT=44112 DPT=9456 WINDOW=1024 RES=0x00 SYN URGP=0 
...

Aug 13 09:34:50 lumpi kernel: INPUT:DROP:SPAMHAUS_EDROP:IN=eth0 OUT= MAC=52:54:a2:01:a5:04:d2:74:7f:6e:37:e3:08:00 SRC=81.22.45.252 DST=172.31.1.100 LEN=40 TOS=0x00 PREC=0x00 TTL=244 ID=63503 PROTO=TCP SPT=44112 DPT=49372 WINDOW=1024 RES=0x00 SYN URGP=0 
...

Port scan: Attack repeated for 24 hours

08/08/2019-11:11:27.144901 81.22.45.252 Protocol: 6 ET SCAN NMAP -sS window 1024

Aug  7 22:17:05 lumpi kernel: INPUT:DROP:SPAMHAUS_EDROP:IN=eth0 OUT= MAC=52:54:a2:01:a5:04:d2:74:7f:6e:37:e3:08:00 SRC=81.22.45.252 DST=172.31.1.100 LEN=40 TOS=0x00 PREC=0x00 TTL=244 ID=5820 PROTO=TCP SPT=46654 DPT=9964 WINDOW=1024 RES=0x00 SYN URGP=0 
...

08/03/2019-23:46:50.120395 81.22.45.252 Protocol: 6 ET CINS Active Threat Intelligence Poor Reputation IP group 79

08/03/2019-07:43:52.987075 81.22.45.252 Protocol: 6 ET SCAN NMAP -sS window 1024

08/02/2019-21:52:03.775377 81.22.45.252 Protocol: 6 ET CINS Active Threat Intelligence Poor Reputation IP group 79

Port scan on 5 port(s): 44090 44091 44112 44154 44210

30.07.2019 14:00:06 Connection to port 44111 blocked by firewall

Jul 29 08:53:16 lumpi kernel: INPUT:DROP:SPAMHAUS_EDROP:IN=eth0 OUT= MAC=52:54:a2:01:a5:04:d2:74:7f:6e:37:e3:08:00 SRC=81.22.45.252 DST=172.31.1.100 LEN=40 TOS=0x00 PREC=0x00 TTL=244 ID=2845 PROTO=TCP SPT=41668 DPT=44215 WINDOW=1024 RES=0x00 SYN URGP=0 
...

suspicious action Sat, 29 Feb 2020 11:28:01 -0300

2020-02-19T00:19:18.463055+01:00 lumpi kernel: [7357790.238387] INPUT:DROP:SPAMHAUS_EDROP:IN=eth0 OUT= MAC=52:54:a2:01:a5:04:d2:74:7f:6e:37:e3:08:00 SRC=81.22.45.133 DST=78.46.199.189 LEN=40 TOS=0x00 PREC=0x00 TTL=243 ID=60679 PROTO=TCP SPT=50449 DPT=7000 WINDOW=1024 RES=0x00 SYN URGP=0 
...

2020-02-18T20:40:14.685548+01:00 lumpi kernel: [7344646.660249] INPUT:DROP:SPAMHAUS_EDROP:IN=eth0 OUT= MAC=52:54:a2:01:a5:04:d2:74:7f:6e:37:e3:08:00 SRC=81.22.45.133 DST=78.46.199.189 LEN=40 TOS=0x00 PREC=0x00 TTL=243 ID=12495 PROTO=TCP SPT=50449 DPT=7777 WINDOW=1024 RES=0x00 SYN URGP=0 
...

02/17/2020-20:00:28.393431 81.22.45.106 Protocol: 6 ET CINS Active Threat Intelligence Poor Reputation IP group 83

ET CINS Active Threat Intelligence Poor Reputation IP group 69 - port: 5322 proto: TCP cat: Misc Attack

Fail2Ban Ban Triggered

MultiHost/MultiPort Probe, Scan, Hack -

Feb  8 10:02:23 mail kernel: [562000.917378] [UFW BLOCK] IN=eth0 OUT= MAC=00:16:3c:05:0d:89:f8:66:f2:68:66:ff:08:00 SRC=81.22.45.182 DST=77.73.69.240 LEN=40 TOS=0x00 PREC=0x00 TTL=250 ID=56258 PROTO=TCP SPT=42357 DPT=16115 WINDOW=1024 RES=0x00 SYN URGP=0 
...

ET CINS Active Threat Intelligence Poor Reputation IP group 77 - port: 3389 proto: TCP cat: Misc Attack

3388/tcp 3377/tcp 3385/tcp...
[2019-12-09/2020-02-07]121pkt,33pt.(tcp)

Unauthorized connection attempt from IP address 81.22.45.83 on Port 3389(RDP)

Feb  6 17:32:05 mail kernel: [416183.709828] [UFW BLOCK] IN=eth0 OUT= MAC=00:16:3c:05:0d:89:f8:66:f2:68:66:ff:08:00 SRC=81.22.45.182 DST=77.73.69.240 LEN=40 TOS=0x00 PREC=0x00 TTL=249 ID=30608 PROTO=TCP SPT=50336 DPT=10904 WINDOW=1024 RES=0x00 SYN URGP=0 
...

Feb  6 08:44:36 mail kernel: [384534.949997] [UFW BLOCK] IN=eth0 OUT= MAC=00:16:3c:05:0d:89:f8:66:f2:68:66:ff:08:00 SRC=81.22.45.182 DST=77.73.69.240 LEN=40 TOS=0x00 PREC=0x00 TTL=250 ID=55760 PROTO=TCP SPT=50336 DPT=10994 WINDOW=1024 RES=0x00 SYN URGP=0 
...

Unauthorised access (Feb  6) SRC=81.22.45.104 LEN=40 TTL=249 ID=41689 TCP DPT=3389 WINDOW=1024 SYN 
Unauthorised access (Feb  4) SRC=81.22.45.104 LEN=40 TTL=249 ID=63055 TCP DPT=3389 WINDOW=1024 SYN 
Unauthorised access (Feb  2) SRC=81.22.45.104 LEN=40 TTL=248 ID=40974 TCP DPT=3389 WINDOW=1024 SYN

Feb  6 01:19:32 mail kernel: [357831.266667] [UFW BLOCK] IN=eth0 OUT= MAC=00:16:3c:05:0d:89:f8:66:f2:68:66:ff:08:00 SRC=81.22.45.182 DST=77.73.69.240 LEN=40 TOS=0x00 PREC=0x00 TTL=249 ID=40878 PROTO=TCP SPT=50336 DPT=10137 WINDOW=1024 RES=0x00 SYN URGP=0 
...

Fail2Ban Ban Triggered

Mar 17 19:22:36 eddieflores sshd\[30427\]: Invalid user mikel from 180.150.251.32
Mar 17 19:22:36 eddieflores sshd\[30427\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.150.251.32
Mar 17 19:22:37 eddieflores sshd\[30427\]: Failed password for invalid user mikel from 180.150.251.32 port 54620 ssh2
Mar 17 19:27:23 eddieflores sshd\[30813\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.150.251.32  user=root
Mar 17 19:27:24 eddieflores sshd\[30813\]: Failed password for root from 180.150.251.32 port 46002 ssh2

Fail2Ban Ban Triggered

Mar 18 04:48:54 host01 sshd[30060]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=66.70.178.55 
Mar 18 04:48:56 host01 sshd[30060]: Failed password for invalid user minecraft from 66.70.178.55 port 34260 ssh2
Mar 18 04:53:22 host01 sshd[30763]: Failed password for root from 66.70.178.55 port 39508 ssh2
...

Mar 18 06:19:57 pornomens sshd\[10025\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=59.36.143.3  user=root
Mar 18 06:19:58 pornomens sshd\[10025\]: Failed password for root from 59.36.143.3 port 59129 ssh2
Mar 18 06:28:18 pornomens sshd\[10090\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=59.36.143.3  user=root
...

Fail2Ban Ban Triggered

DATE:2020-03-18 07:10:41, IP:166.111.152.230, PORT:ssh SSH brute force auth (docker-dc)

Invalid user user from 175.6.32.134 port 59066

(From eric@talkwithwebvisitor.com) Hey, this is Eric and I ran across performancechiroofga.com a few minutes ago.

Looks great… but now what?

By that I mean, when someone like me finds your website – either through Search or just bouncing around – what happens next?  Do you get a lot of leads from your site, or at least enough to make you happy?

Honestly, most business websites fall a bit short when it comes to generating paying customers. Studies show that 70% of a site’s visitors disappear and are gone forever after just a moment.

Here’s an idea…
 
How about making it really EASY for every visitor who shows up to get a personal phone call you as soon as they hit your site…
 
You can –
  
Talk With Web Visitor is a software widget that’s works on your site, ready to capture any visitor’s Name, Email address and Phone Number.  It signals you the moment they let you know they’re interested – so that you can talk to that lead while they’re literally looking over your site.

CLICK HERE http://

Mar 18 04:45:27 srv-ubuntu-dev3 sshd[48216]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.98.71.57  user=root
Mar 18 04:45:29 srv-ubuntu-dev3 sshd[48216]: Failed password for root from 167.98.71.57 port 49224 ssh2
Mar 18 04:49:16 srv-ubuntu-dev3 sshd[48896]: Invalid user tinkerware from 167.98.71.57
Mar 18 04:49:16 srv-ubuntu-dev3 sshd[48896]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.98.71.57
Mar 18 04:49:16 srv-ubuntu-dev3 sshd[48896]: Invalid user tinkerware from 167.98.71.57
Mar 18 04:49:19 srv-ubuntu-dev3 sshd[48896]: Failed password for invalid user tinkerware from 167.98.71.57 port 60606 ssh2
Mar 18 04:52:59 srv-ubuntu-dev3 sshd[49458]: Invalid user andoria from 167.98.71.57
Mar 18 04:52:59 srv-ubuntu-dev3 sshd[49458]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.98.71.57
Mar 18 04:52:59 srv-ubuntu-dev3 sshd[49458]: Invalid user andoria 
...

$f2bV_matches

Mar 18 05:16:02 plex sshd[17631]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.254.120.222  user=root
Mar 18 05:16:04 plex sshd[17631]: Failed password for root from 103.254.120.222 port 49814 ssh2

Invalid user mmr from 175.24.102.249 port 59150

Mar 17 19:44:15 kapalua sshd\[8284\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.122.143  user=root
Mar 17 19:44:17 kapalua sshd\[8284\]: Failed password for root from 104.248.122.143 port 58824 ssh2
Mar 17 19:48:22 kapalua sshd\[8648\]: Invalid user testftp from 104.248.122.143
Mar 17 19:48:22 kapalua sshd\[8648\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.122.143
Mar 17 19:48:24 kapalua sshd\[8648\]: Failed password for invalid user testftp from 104.248.122.143 port 52766 ssh2

Unauthorized connection attempt detected from IP address 49.51.160.31 to port 8060