Vulnerability Scanner

DATE:2020-09-22 14:46:52, IP:134.209.254.62, PORT:ssh SSH brute force auth (docker-dc)

Sep 21 19:57:10 master sshd[22438]: Failed password for root from 134.209.254.62 port 45940 ssh2
Sep 21 20:12:13 master sshd[23045]: Failed password for root from 134.209.254.62 port 60368 ssh2
Sep 21 20:15:46 master sshd[23092]: Failed password for invalid user ftpuser from 134.209.254.62 port 40478 ssh2
Sep 21 20:19:28 master sshd[23109]: Failed password for root from 134.209.254.62 port 48836 ssh2
Sep 21 20:23:00 master sshd[23187]: Failed password for root from 134.209.254.62 port 57174 ssh2
Sep 21 20:26:35 master sshd[23240]: Failed password for root from 134.209.254.62 port 37282 ssh2
Sep 21 20:30:14 master sshd[23670]: Failed password for root from 134.209.254.62 port 45620 ssh2
Sep 21 20:33:54 master sshd[23688]: Failed password for root from 134.209.254.62 port 53958 ssh2
Sep 21 20:37:37 master sshd[23739]: Failed password for root from 134.209.254.62 port 34064 ssh2
Sep 21 20:41:09 master sshd[23869]: Failed password for invalid user vnc from 134.209.254.62 port 42402 ssh2

134.209.254.16 - - [15/Sep/2020:13:35:46 +0200] "GET /wp-login.php HTTP/1.1" 200 8796 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
134.209.254.16 - - [15/Sep/2020:13:35:51 +0200] "POST /wp-login.php HTTP/1.1" 200 9047 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
134.209.254.16 - - [15/Sep/2020:13:35:52 +0200] "POST /xmlrpc.php HTTP/1.1" 200 427 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"

WordPress login Brute force / Web App Attack on client site.

Sep 14 21:30:22 lavrea wordpress(quiquetieva.com)[218883]: XML-RPC authentication attempt for unknown user [login] from 134.209.254.16
...

Sep  8 20:17:19 v26 sshd[15275]: Invalid user a1 from 134.209.254.62 port 45310
Sep  8 20:17:19 v26 sshd[15275]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.254.62
Sep  8 20:17:21 v26 sshd[15275]: Failed password for invalid user a1 from 134.209.254.62 port 45310 ssh2
Sep  8 20:17:21 v26 sshd[15275]: Received disconnect from 134.209.254.62 port 45310:11: Bye Bye [preauth]
Sep  8 20:17:21 v26 sshd[15275]: Disconnected from 134.209.254.62 port 45310 [preauth]
Sep  8 20:27:40 v26 sshd[16307]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.254.62  user=r.r
Sep  8 20:27:41 v26 sshd[16307]: Failed password for r.r from 134.209.254.62 port 43226 ssh2
Sep  8 20:27:41 v26 sshd[16307]: Received disconnect from 134.209.254.62 port 43226:11: Bye Bye [preauth]
Sep  8 20:27:41 v26 sshd[16307]: Disconnected from 134.209.254.62 port 43226 [preauth]
Sep  8 20:31:04 v26 sshd[16594]: pam_u........
-------------------------------

Sep  8 20:17:19 v26 sshd[15275]: Invalid user a1 from 134.209.254.62 port 45310
Sep  8 20:17:19 v26 sshd[15275]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.254.62
Sep  8 20:17:21 v26 sshd[15275]: Failed password for invalid user a1 from 134.209.254.62 port 45310 ssh2
Sep  8 20:17:21 v26 sshd[15275]: Received disconnect from 134.209.254.62 port 45310:11: Bye Bye [preauth]
Sep  8 20:17:21 v26 sshd[15275]: Disconnected from 134.209.254.62 port 45310 [preauth]
Sep  8 20:27:40 v26 sshd[16307]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.254.62  user=r.r
Sep  8 20:27:41 v26 sshd[16307]: Failed password for r.r from 134.209.254.62 port 43226 ssh2
Sep  8 20:27:41 v26 sshd[16307]: Received disconnect from 134.209.254.62 port 43226:11: Bye Bye [preauth]
Sep  8 20:27:41 v26 sshd[16307]: Disconnected from 134.209.254.62 port 43226 [preauth]
Sep  8 20:31:04 v26 sshd[16594]: pam_u........
-------------------------------

XMLRPC Attack

"XSS Attack Detected via libinjection - Matched Data: XSS data found within ARGS_NAMES:

Aug  4 06:11:25 h2829583 sshd[27078]: Failed password for root from 134.209.250.37 port 38048 ssh2

Jul 28 16:30:11 ny01 sshd[22186]: Failed password for root from 134.209.250.37 port 47444 ssh2
Jul 28 16:34:26 ny01 sshd[22649]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.250.37
Jul 28 16:34:28 ny01 sshd[22649]: Failed password for invalid user andreas from 134.209.250.37 port 59022 ssh2

Jul 28 00:50:44 sso sshd[17946]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.250.37
Jul 28 00:50:46 sso sshd[17946]: Failed password for invalid user liuyufei from 134.209.250.37 port 38784 ssh2
...

2020-07-27T02:29:33.353994mail.standpoint.com.ua sshd[29889]: Invalid user sotiris from 134.209.252.17 port 55656
2020-07-27T02:29:33.356694mail.standpoint.com.ua sshd[29889]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.252.17
2020-07-27T02:29:33.353994mail.standpoint.com.ua sshd[29889]: Invalid user sotiris from 134.209.252.17 port 55656
2020-07-27T02:29:34.944416mail.standpoint.com.ua sshd[29889]: Failed password for invalid user sotiris from 134.209.252.17 port 55656 ssh2
2020-07-27T02:30:31.856909mail.standpoint.com.ua sshd[30191]: Invalid user student from 134.209.252.17 port 43264
...

Jul 22 13:57:03 lanister sshd[15252]: Failed password for invalid user site1 from 134.209.252.17 port 55750 ssh2
Jul 22 13:57:02 lanister sshd[15252]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.252.17
Jul 22 13:57:02 lanister sshd[15252]: Invalid user site1 from 134.209.252.17
Jul 22 13:57:03 lanister sshd[15252]: Failed password for invalid user site1 from 134.209.252.17 port 55750 ssh2

2019-09-19T20:06:16.273428abusebot-3.cloudsearch.cf sshd\[19682\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.19.181.10  user=daemon

Sep 19 16:24:30 plusreed sshd[30833]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.30.165  user=root
Sep 19 16:24:32 plusreed sshd[30833]: Failed password for root from 222.186.30.165 port 17722 ssh2
...

Sep 19 10:26:09 lcprod sshd\[15534\]: Invalid user p2p from 222.124.16.227
Sep 19 10:26:09 lcprod sshd\[15534\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.124.16.227
Sep 19 10:26:11 lcprod sshd\[15534\]: Failed password for invalid user p2p from 222.124.16.227 port 60166 ssh2
Sep 19 10:30:53 lcprod sshd\[15979\]: Invalid user get from 222.124.16.227
Sep 19 10:30:53 lcprod sshd\[15979\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.124.16.227

\[2019-09-19 16:21:03\] NOTICE\[2270\] chan_sip.c: Registration from '"7001" \' failed for '77.247.109.72:5916' - Wrong password
\[2019-09-19 16:21:03\] SECURITY\[2283\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-09-19T16:21:03.681-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="7001",SessionID="0x7fcd8c0e88d8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/77.247.109.72/5916",Challenge="1c1711ef",ReceivedChallenge="1c1711ef",ReceivedHash="b079bb192c8399280b99d70908977ee0"
\[2019-09-19 16:21:03\] NOTICE\[2270\] chan_sip.c: Registration from '"7001" \' failed for '77.247.109.72:5916' - Wrong password
\[2019-09-19 16:21:03\] SECURITY\[2283\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-09-19T16:21:03.820-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="7001",SessionID="0x7fcd8c1c4788",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UD

Sep 19 18:20:37 xb3 sshd[18614]: Failed password for invalid user valet from 129.213.100.212 port 41348 ssh2
Sep 19 18:20:37 xb3 sshd[18614]: Received disconnect from 129.213.100.212: 11: Bye Bye [preauth]
Sep 19 18:26:53 xb3 sshd[22263]: Failed password for invalid user fd from 129.213.100.212 port 41548 ssh2
Sep 19 18:26:53 xb3 sshd[22263]: Received disconnect from 129.213.100.212: 11: Bye Bye [preauth]
Sep 19 18:30:53 xb3 sshd[21018]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.213.100.212  user=r.r
Sep 19 18:30:55 xb3 sshd[21018]: Failed password for r.r from 129.213.100.212 port 57042 ssh2
Sep 19 18:30:55 xb3 sshd[21018]: Received disconnect from 129.213.100.212: 11: Bye Bye [preauth]
Sep 19 18:34:53 xb3 sshd[31270]: Failed password for invalid user jack from 129.213.100.212 port 44294 ssh2
Sep 19 18:34:53 xb3 sshd[31270]: Received disconnect from 129.213.100.212: 11: Bye Bye [preauth]
Sep 19 18:38:58 xb3 sshd[29196]:........
-------------------------------

Sep 19 20:37:38 hcbbdb sshd\[10465\]: Invalid user sites123 from 178.62.17.167
Sep 19 20:37:38 hcbbdb sshd\[10465\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.62.17.167
Sep 19 20:37:40 hcbbdb sshd\[10465\]: Failed password for invalid user sites123 from 178.62.17.167 port 41036 ssh2
Sep 19 20:41:53 hcbbdb sshd\[10978\]: Invalid user acacia from 178.62.17.167
Sep 19 20:41:53 hcbbdb sshd\[10978\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.62.17.167

Sep 19 22:30:06 mail sshd\[619\]: Invalid user ryan from 201.249.134.155 port 59428
Sep 19 22:30:06 mail sshd\[619\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.249.134.155
Sep 19 22:30:08 mail sshd\[619\]: Failed password for invalid user ryan from 201.249.134.155 port 59428 ssh2
Sep 19 22:30:25 mail sshd\[687\]: Invalid user jack from 201.249.134.155 port 60760
Sep 19 22:30:25 mail sshd\[687\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.249.134.155

Sep 19 22:30:18 mail sshd\[638\]: Invalid user jack from 148.70.52.44 port 25660
Sep 19 22:30:18 mail sshd\[638\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.52.44
Sep 19 22:30:20 mail sshd\[638\]: Failed password for invalid user jack from 148.70.52.44 port 25660 ssh2
Sep 19 22:30:45 mail sshd\[724\]: Invalid user donald from 148.70.52.44 port 27078
Sep 19 22:30:45 mail sshd\[724\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.52.44

Automatic report - Banned IP Access

Lines containing failures of 60.26.203.128
Sep 19 20:16:38 mx-in-02 sshd[23256]: Invalid user lada from 60.26.203.128 port 50554
Sep 19 20:16:38 mx-in-02 sshd[23256]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=60.26.203.128 
Sep 19 20:16:39 mx-in-02 sshd[23256]: Failed password for invalid user lada from 60.26.203.128 port 50554 ssh2
Sep 19 20:16:41 mx-in-02 sshd[23256]: Received disconnect from 60.26.203.128 port 50554:11: Bye Bye [preauth]
Sep 19 20:16:41 mx-in-02 sshd[23256]: Disconnected from invalid user lada 60.26.203.128 port 50554 [preauth]
Sep 19 20:32:51 mx-in-02 sshd[24562]: Invalid user willow from 60.26.203.128 port 45148
Sep 19 20:32:51 mx-in-02 sshd[24562]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=60.26.203.128 
Sep 19 20:32:53 mx-in-02 sshd[24562]: Failed password for invalid user willow from 60.26.203.128 port 45148 ssh2
Sep 19 20:32:56 mx-in-02 sshd[24562]: Recei........
------------------------------

Sep 19 16:38:26 xtremcommunity sshd\[259253\]: Invalid user dokku from 46.148.199.34 port 10573
Sep 19 16:38:26 xtremcommunity sshd\[259253\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.148.199.34
Sep 19 16:38:28 xtremcommunity sshd\[259253\]: Failed password for invalid user dokku from 46.148.199.34 port 10573 ssh2
Sep 19 16:42:45 xtremcommunity sshd\[259486\]: Invalid user ho from 46.148.199.34 port 58356
Sep 19 16:42:45 xtremcommunity sshd\[259486\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.148.199.34
...

Sep 19 22:30:00 mail sshd\[566\]: Invalid user diane from 49.165.47.31 port 38790
Sep 19 22:30:00 mail sshd\[566\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.165.47.31
Sep 19 22:30:02 mail sshd\[566\]: Failed password for invalid user diane from 49.165.47.31 port 38790 ssh2
Sep 19 22:30:21 mail sshd\[656\]: Invalid user carl from 49.165.47.31 port 39690
Sep 19 22:30:21 mail sshd\[656\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.165.47.31

09/19/2019-15:34:22.908089 163.172.122.164 Protocol: 17 ATTACK [PTSecurity] Cisco ASA and Cisco FTD possible DoS (CVE-2018-15454)

Sep 19 22:31:10 webserver postfix/smtpd\[30505\]: warning: unknown\[46.38.144.179\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Sep 19 22:33:33 webserver postfix/smtpd\[30712\]: warning: unknown\[46.38.144.179\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Sep 19 22:35:57 webserver postfix/smtpd\[30503\]: warning: unknown\[46.38.144.179\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Sep 19 22:38:19 webserver postfix/smtpd\[30505\]: warning: unknown\[46.38.144.179\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Sep 19 22:40:43 webserver postfix/smtpd\[31190\]: warning: unknown\[46.38.144.179\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
...

Chat Spam