158.69.242.94 has been banned for [WebApp Attack]
...

10/29/2019-16:19:19.138750 158.69.242.232 Protocol: 17 ET SCAN Sipvicious Scan

SIP Server BruteForce Attack

MultiHost/MultiPort Probe, Scan, Hack -

MultiHost/MultiPort Probe, Scan, Hack -

Automatic report - Port Scan Attack

SIP Server BruteForce Attack

Automatic report generated by Wazuh

\[2019-07-19 03:34:10\] NOTICE\[20804\] chan_sip.c: Registration from '"1161"\' failed for '158.69.242.197:20562' - Wrong password
\[2019-07-19 03:34:10\] SECURITY\[20812\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-07-19T03:34:10.021-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="1161",SessionID="0x7f06f8009f28",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/158.69.242.197/20562",Challenge="2f1c9e56",ReceivedChallenge="2f1c9e56",ReceivedHash="bb3c066c26d1cafee54dd91026da4a67"
\[2019-07-19 03:35:39\] NOTICE\[20804\] chan_sip.c: Registration from '"1162"\' failed for '158.69.242.197:9626' - Wrong password
\[2019-07-19 03:35:39\] SECURITY\[20812\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-07-19T03:35:39.121-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="1162",SessionID="0x7f06f8009f28",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/158.69.

\[2019-07-18 20:40:51\] NOTICE\[20804\] chan_sip.c: Registration from '"628"\' failed for '158.69.242.237:21961' - Wrong password
\[2019-07-18 20:40:51\] SECURITY\[20812\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-07-18T20:40:51.705-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="628",SessionID="0x7f06f85ff978",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/158.69.242.237/21961",Challenge="7179136b",ReceivedChallenge="7179136b",ReceivedHash="6a450ec05af1bdb23ef3b934f358a6d7"
\[2019-07-18 20:42:21\] NOTICE\[20804\] chan_sip.c: Registration from '"629"\' failed for '158.69.242.237:17006' - Wrong password
\[2019-07-18 20:42:21\] SECURITY\[20812\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-07-18T20:42:21.364-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="629",SessionID="0x7f06f85ff978",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/158.69.242.237/1

Bruteforce on Asterisk server
[Jul 18 22:19:28] NOTICE[899][C-00000010] chan_sip.c: Call from '' (158.69.242.200:54079) to extension '900441415360027' rejected because extension not found in context 'default'.
[Jul 18 22:20:19] NOTICE[899][C-00000012] chan_sip.c: Call from '' (158.69.242.200:57647) to extension '+441415360027' rejected because extension not found in context 'default'.
[Jul 18 22:17:48] NOTICE[899][C-0000000a] chan_sip.c: Call from '' (158.69.242.200:50213) to extension '00441415360027' rejected because extension not found in context 'default'.

\[2019-07-18 06:59:15\] NOTICE\[20804\] chan_sip.c: Registration from '"576543"\' failed for '158.69.242.237:15524' - Wrong password
\[2019-07-18 06:59:15\] SECURITY\[20812\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-07-18T06:59:15.330-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="576543",SessionID="0x7f06f85ff978",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/158.69.242.237/15524",Challenge="6fcfa8ae",ReceivedChallenge="6fcfa8ae",ReceivedHash="3b5014d2cfd51f25807bece40023b2c2"
\[2019-07-18 06:59:17\] NOTICE\[20804\] chan_sip.c: Registration from '"576543"\' failed for '158.69.242.237:5123' - Wrong password
\[2019-07-18 06:59:17\] SECURITY\[20812\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-07-18T06:59:17.297-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="576543",SessionID="0x7f06f823f758",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4

\[2019-07-18 01:38:23\] NOTICE\[20804\] chan_sip.c: Registration from '"9678"\' failed for '158.69.242.237:9545' - Wrong password
\[2019-07-18 01:38:23\] SECURITY\[20812\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-07-18T01:38:23.838-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="9678",SessionID="0x7f06f85ff978",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/158.69.242.237/9545",Challenge="10251272",ReceivedChallenge="10251272",ReceivedHash="7268e4193e019834a36ca70ce05ca47c"
\[2019-07-18 01:38:25\] NOTICE\[20804\] chan_sip.c: Registration from '"9678"\' failed for '158.69.242.237:15034' - Wrong password
\[2019-07-18 01:38:25\] SECURITY\[20812\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-07-18T01:38:25.824-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="9678",SessionID="0x7f06f804c2c8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/158.69.2

\[2019-07-17 21:51:42\] NOTICE\[20804\] chan_sip.c: Registration from '"65439"\' failed for '158.69.242.197:21882' - Wrong password
\[2019-07-17 21:51:42\] SECURITY\[20812\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-07-17T21:51:42.925-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="65439",SessionID="0x7f06f811a3c8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/158.69.242.197/21882",Challenge="1693eafe",ReceivedChallenge="1693eafe",ReceivedHash="ee67009c1662676bec8c45b966c9b246"
\[2019-07-17 21:53:11\] NOTICE\[20804\] chan_sip.c: Registration from '"65438"\' failed for '158.69.242.197:13391' - Wrong password
\[2019-07-17 21:53:11\] SECURITY\[20812\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-07-17T21:53:11.508-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="65438",SessionID="0x7f06f811a3c8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/

\[2019-07-17 19:03:45\] NOTICE\[20804\] chan_sip.c: Registration from '"87656"\' failed for '158.69.242.197:19642' - Wrong password
\[2019-07-17 19:03:45\] SECURITY\[20812\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-07-17T19:03:45.718-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="87656",SessionID="0x7f06f878a398",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/158.69.242.197/19642",Challenge="3a745756",ReceivedChallenge="3a745756",ReceivedHash="e0489af5ba48e7b8b8413d50e810ac5a"
\[2019-07-17 19:05:13\] NOTICE\[20804\] chan_sip.c: Registration from '"87655"\' failed for '158.69.242.197:23666' - Wrong password
\[2019-07-17 19:05:13\] SECURITY\[20812\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-07-17T19:05:13.968-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="87655",SessionID="0x7f06f811a3c8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/

Unauthorised access (Oct 23) SRC=94.102.199.221 LEN=44 TOS=0x08 PREC=0x20 TTL=236 ID=49315 DF TCP DPT=8080 WINDOW=14600 SYN

Oct 23 05:50:27 rotator sshd\[25370\]: Address 74.203.74.74 maps to 74-203-74-74.brescobroadband.com, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!Oct 23 05:50:28 rotator sshd\[25370\]: Failed password for root from 74.203.74.74 port 51808 ssh2Oct 23 05:53:54 rotator sshd\[25455\]: Address 74.203.74.74 maps to 74-203-74-74.brescobroadband.com, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!Oct 23 05:53:54 rotator sshd\[25455\]: Invalid user mikkel from 74.203.74.74Oct 23 05:53:57 rotator sshd\[25455\]: Failed password for invalid user mikkel from 74.203.74.74 port 34496 ssh2Oct 23 05:57:21 rotator sshd\[26284\]: Address 74.203.74.74 maps to 74-203-74-74.brescobroadband.com, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!
...

MultiHost/MultiPort Probe, Scan, Hack -

Oct 22 18:48:18 php1 sshd\[25875\]: Invalid user halbpixel from 61.175.134.190
Oct 22 18:48:18 php1 sshd\[25875\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.175.134.190
Oct 22 18:48:20 php1 sshd\[25875\]: Failed password for invalid user halbpixel from 61.175.134.190 port 58998 ssh2
Oct 22 18:53:27 php1 sshd\[26319\]: Invalid user linda123 from 61.175.134.190
Oct 22 18:53:27 php1 sshd\[26319\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.175.134.190

2019-10-23T04:29:50.593298shield sshd\[8066\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.80.108.83  user=root
2019-10-23T04:29:52.442691shield sshd\[8066\]: Failed password for root from 201.80.108.83 port 32128 ssh2
2019-10-23T04:34:45.981440shield sshd\[8894\]: Invalid user abastillas from 201.80.108.83 port 31453
2019-10-23T04:34:45.987595shield sshd\[8894\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.80.108.83
2019-10-23T04:34:47.335085shield sshd\[8894\]: Failed password for invalid user abastillas from 201.80.108.83 port 31453 ssh2

IP Ban Report :  
 https://help-dysk.pl/wordpress-firewall-plugins/ip/170.78.71.254/ 
 
 BR - 1H : (251)  
 Protection Against DDoS WordPress plugin :  
 "odzyskiwanie danych help-dysk" 
 IP Address Ranges by Country : BR 
 NAME ASN : ASN262669 
 
 IP : 170.78.71.254 
 
 CIDR : 170.78.71.0/24 
 
 PREFIX COUNT : 24 
 
 UNIQUE IP COUNT : 15360 
 
 
 ATTACKS DETECTED ASN262669 :  
  1H - 1 
  3H - 1 
  6H - 1 
 12H - 1 
 24H - 1 
 
 DateTime : 2019-10-23 05:56:51 
 
 INFO : Server 403 - Looking for resource vulnerabilities Detected and Blocked by ADMIN  - data recovery

Unauthorized SSH login attempts

Oct 23 04:59:45 venus sshd\[29819\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.25.18.30  user=root
Oct 23 04:59:47 venus sshd\[29819\]: Failed password for root from 118.25.18.30 port 39208 ssh2
Oct 23 05:04:35 venus sshd\[29872\]: Invalid user chinaidc from 118.25.18.30 port 50560
...

Oct 23 02:02:29 firewall sshd[2199]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.124.199
Oct 23 02:02:29 firewall sshd[2199]: Invalid user domingos from 51.75.124.199
Oct 23 02:02:31 firewall sshd[2199]: Failed password for invalid user domingos from 51.75.124.199 port 57922 ssh2
...

SSH Bruteforce

Oct 23 03:56:23 system,error,critical: login failure for user admin from 89.39.82.184 via telnet
Oct 23 03:56:25 system,error,critical: login failure for user admin from 89.39.82.184 via telnet
Oct 23 03:56:27 system,error,critical: login failure for user root from 89.39.82.184 via telnet
Oct 23 03:56:31 system,error,critical: login failure for user admin from 89.39.82.184 via telnet
Oct 23 03:56:32 system,error,critical: login failure for user admin from 89.39.82.184 via telnet
Oct 23 03:56:34 system,error,critical: login failure for user root from 89.39.82.184 via telnet
Oct 23 03:56:38 system,error,critical: login failure for user root from 89.39.82.184 via telnet
Oct 23 03:56:40 system,error,critical: login failure for user root from 89.39.82.184 via telnet
Oct 23 03:56:41 system,error,critical: login failure for user admin from 89.39.82.184 via telnet
Oct 23 03:56:45 system,error,critical: login failure for user root from 89.39.82.184 via telnet

Oct 23 07:08:59 markkoudstaal sshd[17696]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.132.61.80
Oct 23 07:09:01 markkoudstaal sshd[17696]: Failed password for invalid user ovh from 120.132.61.80 port 60796 ssh2
Oct 23 07:14:14 markkoudstaal sshd[18209]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.132.61.80

Oct 23 06:18:41 vps01 sshd[10438]: Failed password for root from 139.219.15.178 port 38866 ssh2

Oct 23 01:25:45 firewall sshd[1256]: Failed password for root from 222.186.175.202 port 28008 ssh2
Oct 23 01:25:45 firewall sshd[1256]: error: maximum authentication attempts exceeded for root from 222.186.175.202 port 28008 ssh2 [preauth]
Oct 23 01:25:45 firewall sshd[1256]: Disconnecting: Too many authentication failures [preauth]
...

IP Ban Report :  
 https://help-dysk.pl/wordpress-firewall-plugins/ip/89.133.222.212/ 
 
 HU - 1H : (23)  
 Protection Against DDoS WordPress plugin :  
 "odzyskiwanie danych help-dysk" 
 IP Address Ranges by Country : HU 
 NAME ASN : ASN6830 
 
 IP : 89.133.222.212 
 
 CIDR : 89.132.0.0/15 
 
 PREFIX COUNT : 755 
 
 UNIQUE IP COUNT : 12137216 
 
 
 ATTACKS DETECTED ASN6830 :  
  1H - 1 
  3H - 4 
  6H - 4 
 12H - 7 
 24H - 10 
 
 DateTime : 2019-10-23 05:57:10 
 
 INFO : Port Scan TELNET Detected and Blocked by ADMIN  - data recovery