Automatic report - Banned IP Access

Unauthorized connection attempt detected from IP address 107.172.137.116 to port 8088 [T]

Jul 25 14:35:14 debian-2gb-nbg1-2 kernel: \[17939029.435149\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=107.172.137.116 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=241 ID=54321 PROTO=TCP SPT=39186 DPT=8088 WINDOW=65535 RES=0x00 SYN URGP=0

(From barbaratysonhw@yahoo.com) Hi,

We'd like to introduce to you our explainer video service which we feel can benefit your site myvenicechiropractor.com.

Check out some of our existing videos here:
https://www.youtube.com/watch?v=zvGF7uRfH04
https://www.youtube.com/watch?v=MOnhn77TgDE
https://www.youtube.com/watch?v=KhSCHaI6gw0

All of our videos are in a similar animated format as the above examples and we have voice over artists with US/UK/Australian accents.

They can show a solution to a problem or simply promote one of your products or services. They are concise, can be uploaded to video such as Youtube, and can be embedded into your website or featured on landing pages.

Our prices are as follows depending on video length:
0-1 minutes = $159
1-2 minutes = $269
2-3 minutes = $379

*All prices above are in USD and include a custom video, full script and a voice-over.

If this is something you would like to discuss further, don't hesitate to get in touch.
If you are not interested,

(From barbaratysonhw@yahoo.com) Hi,

We'd like to introduce to you our explainer video service which we feel can benefit your site minorchiropractic.com.

Check out some of our existing videos here:
https://www.youtube.com/watch?v=oYoUQjxvhA0
https://www.youtube.com/watch?v=MOnhn77TgDE
https://www.youtube.com/watch?v=NKY4a3hvmUc

All of our videos are in a similar animated format as the above examples and we have voice over artists with US/UK/Australian accents.

They can show a solution to a problem or simply promote one of your products or services. They are concise, can be uploaded to video such as Youtube, and can be embedded into your website or featured on landing pages.

Our prices are as follows depending on video length:
0-1 minutes = $259
1-2 minutes = $369
2-3 minutes = $479
3-4 minutes = $589

*All prices above are in USD and include a custom video, full script and a voice-over.

If this is something you would like to discuss further, don't hesitate to get in touch.
If you ar

(From claudiauclement@yahoo.com) Hi, We are wondering if you would be interested in our service, where we can provide you with a dofollow link from Amazon (DA 96) back to doctorbo.com?

The price is just $77 per link, via Paypal.

To explain what DA is and the benefit for your website, along with a sample of an existing link, please read here: https://pastelink.net/1nm60

If you'd be interested in learning more, reply to this email but please make sure you include the word INTERESTED in the subject line field.

Kind Regards,
Claudia

1,18-01/02 [bc03/m75] PostRequest-Spammer scoring: lisboa

(From eric@talkwithwebvisitor.com) My name’s Eric and I just came across your website - drmerritt.net - in the search results.

Here’s what that means to me…

Your SEO’s working.

You’re getting eyeballs – mine at least.

Your content’s pretty good, wouldn’t change a thing.

BUT…

Eyeballs don’t pay the bills.

CUSTOMERS do.

And studies show that 7 out of 10 visitors to a site like drmerritt.net will drop by, take a gander, and then head for the hills without doing anything else.

It’s like they never were even there.

You can fix this.

You can make it super-simple for them to raise their hand, say, “okay, let’s talk” without requiring them to even pull their cell phone from their pocket… thanks to Talk With Web Visitor.

Talk With Web Visitor is a software widget that sits on your site, ready and waiting to capture any visitor’s Name, Email address and Phone Number.  It lets you know immediately – so you can talk to that lead immediately… without delay… BEFORE they head for those hi

(From claudiauclement@yahoo.com) Hi, We are wondering if you would be interested in our service, where we can provide you with a dofollow link from Amazon (DA 96) back to streckerfamilychiropractic.com?

The price is just $67 per link, via Paypal.

To explain what DA is and the benefit for your website, along with a sample of an existing link, please read here: https://justpaste.it/amazonbacklink

If you'd be interested in learning more, reply to this email but please make sure you include the word INTERESTED in the subject line field, so we can get to your reply sooner.

Kind Regards,
Claudia

(From claudiauclement@yahoo.com) Hi, We are wondering if you would be interested in our service, where we can provide you with a dofollow link from Amazon (DA 96) back to outtenchiropractic.com?

The price is just $67 per link, via Paypal.

To explain what DA is and the benefit for your website, along with a sample of an existing link, please read here: https://justpaste.it/amazonbacklink

If you'd be interested in learning more, reply to this email but please make sure you include the word INTERESTED in the subject line field, so we can get to your reply sooner.

Kind Regards,
Claudia

Daft bot

Registration form abuse

WordPress XMLRPC scan :: 107.172.131.205 0.156 BYPASS [11/Sep/2019:08:11:58  1000] www.[censored_1] "POST /xmlrpc.php HTTP/1.1" 200 382 "https://www.[censored_1]/" "PHP/7.3.69"

Unauthorized access detected from banned ip

Unauthorized access detected from banned ip

*Port Scan* detected from 165.22.112.45 (GB/United Kingdom/-). 4 hits in the last 180 seconds

SSH invalid-user multiple login try

Dec 24 06:16:35 relay postfix/smtpd\[11605\]: warning: unknown\[46.38.144.117\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Dec 24 06:17:45 relay postfix/smtpd\[11188\]: warning: unknown\[46.38.144.117\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Dec 24 06:18:14 relay postfix/smtpd\[11605\]: warning: unknown\[46.38.144.117\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Dec 24 06:19:23 relay postfix/smtpd\[7015\]: warning: unknown\[46.38.144.117\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Dec 24 06:19:55 relay postfix/smtpd\[11607\]: warning: unknown\[46.38.144.117\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
...

*Port Scan* detected from 142.93.201.168 (US/United States/209060.cloudwaysapps.com). 4 hits in the last 215 seconds

12/24/2019-05:54:48.404560 193.31.201.20 Protocol: 6 ET SCAN Suspicious inbound to MSSQL port 1433

Looking for resource vulnerabilities

Dec 24 05:55:39 srv-ubuntu-dev3 sshd[49573]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.175.148  user=root
Dec 24 05:55:40 srv-ubuntu-dev3 sshd[49573]: Failed password for root from 222.186.175.148 port 64072 ssh2
Dec 24 05:55:50 srv-ubuntu-dev3 sshd[49573]: Failed password for root from 222.186.175.148 port 64072 ssh2
Dec 24 05:55:39 srv-ubuntu-dev3 sshd[49573]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.175.148  user=root
Dec 24 05:55:40 srv-ubuntu-dev3 sshd[49573]: Failed password for root from 222.186.175.148 port 64072 ssh2
Dec 24 05:55:50 srv-ubuntu-dev3 sshd[49573]: Failed password for root from 222.186.175.148 port 64072 ssh2
Dec 24 05:55:39 srv-ubuntu-dev3 sshd[49573]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.175.148  user=root
Dec 24 05:55:40 srv-ubuntu-dev3 sshd[49573]: Failed password for root from 222.186.175.148 p
...

Dec 24 04:55:14 work-partkepr sshd\[22026\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.64.67.116  user=root
Dec 24 04:55:16 work-partkepr sshd\[22026\]: Failed password for root from 212.64.67.116 port 58898 ssh2
...

Dec 23 14:55:51 web1 sshd\[9297\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.156.67.18  user=backup
Dec 23 14:55:53 web1 sshd\[9297\]: Failed password for backup from 117.156.67.18 port 2303 ssh2
Dec 23 14:58:59 web1 sshd\[9560\]: Invalid user aik from 117.156.67.18
Dec 23 14:58:59 web1 sshd\[9560\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.156.67.18
Dec 23 14:59:01 web1 sshd\[9560\]: Failed password for invalid user aik from 117.156.67.18 port 22799 ssh2

Dec 24 05:52:57 vps691689 sshd[11572]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=89.216.47.154
Dec 24 05:52:59 vps691689 sshd[11572]: Failed password for invalid user wwwadmin from 89.216.47.154 port 53356 ssh2
...

Dec 23 08:36:38 scivo sshd[17151]: Invalid user nordmark from 148.70.94.56
Dec 23 08:36:38 scivo sshd[17151]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.94.56 
Dec 23 08:36:40 scivo sshd[17151]: Failed password for invalid user nordmark from 148.70.94.56 port 46040 ssh2
Dec 23 08:36:41 scivo sshd[17151]: Received disconnect from 148.70.94.56: 11: Bye Bye [preauth]
Dec 23 08:46:13 scivo sshd[17733]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.94.56  user=r.r
Dec 23 08:46:15 scivo sshd[17733]: Failed password for r.r from 148.70.94.56 port 57142 ssh2
Dec 23 08:46:15 scivo sshd[17733]: Received disconnect from 148.70.94.56: 11: Bye Bye [preauth]
Dec 23 08:54:14 scivo sshd[18095]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.94.56  user=r.r
Dec 23 08:54:16 scivo sshd[18095]: Failed password for r.r from 148.70.94.56 port 36........
-------------------------------

SSH Brute-Force attacks

Lines containing failures of 178.48.248.5
Dec 23 22:24:07 shared10 sshd[15604]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.48.248.5  user=r.r
Dec 23 22:24:10 shared10 sshd[15604]: Failed password for r.r from 178.48.248.5 port 54070 ssh2
Dec 23 22:24:10 shared10 sshd[15604]: Received disconnect from 178.48.248.5 port 54070:11: Bye Bye [preauth]
Dec 23 22:24:10 shared10 sshd[15604]: Disconnected from authenticating user r.r 178.48.248.5 port 54070 [preauth]
Dec 23 22:37:50 shared10 sshd[20580]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.48.248.5  user=r.r
Dec 23 22:37:52 shared10 sshd[20580]: Failed password for r.r from 178.48.248.5 port 36302 ssh2
Dec 23 22:37:53 shared10 sshd[20580]: Received disconnect from 178.48.248.5 port 36302:11: Bye Bye [preauth]
Dec 23 22:37:53 shared10 sshd[20580]: Disconnected from authenticating user r.r 178.48.248.5 port 36302 [preauth]
Dec 23 ........
------------------------------

$f2bV_matches

Dec 24 00:06:11 hcbbdb sshd\[19478\]: Invalid user vifladt from 106.75.34.41
Dec 24 00:06:11 hcbbdb sshd\[19478\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.75.34.41
Dec 24 00:06:13 hcbbdb sshd\[19478\]: Failed password for invalid user vifladt from 106.75.34.41 port 46416 ssh2
Dec 24 00:12:09 hcbbdb sshd\[20093\]: Invalid user 1234 from 106.75.34.41
Dec 24 00:12:09 hcbbdb sshd\[20093\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.75.34.41