Icarus honeypot on github

Unauthorized connection attempt detected from IP address 192.210.189.68 to port 1433 [T]

(From eric@talkwithwebvisitor.com) Hi, my name is Eric and I’m betting you’d like your website advancedchirosolutions.com to generate more leads.

Here’s how:
Talk With Web Visitor is a software widget that’s works on your site, ready to capture any visitor’s Name, Email address and Phone Number.  It signals you as soon as they say they’re interested – so that you can talk to that lead while they’re still there at advancedchirosolutions.com.

Talk With Web Visitor – CLICK HERE http://www.talkwithwebvisitor.com for a live demo now.

And now that you’ve got their phone number, our new SMS Text With Lead feature enables you to start a text (SMS) conversation – answer questions, provide more info, and close a deal that way.

If they don’t take you up on your offer then, just follow up with text messages for new offers, content links, even just “how you doing?” notes to build a relationship.

CLICK HERE http://www.talkwithwebvisitor.com to discover what Talk With Web Visitor can do for your business.

(From eric@talkwithwebvisitor.com) Hi, my name is Eric and I’m betting you’d like your website newtonpainrelief.com to generate more leads.

Here’s how:
Talk With Web Visitor is a software widget that’s works on your site, ready to capture any visitor’s Name, Email address and Phone Number.  It signals you as soon as they say they’re interested – so that you can talk to that lead while they’re still there at newtonpainrelief.com.

Talk With Web Visitor – CLICK HERE http://www.talkwithwebvisitor.com for a live demo now.

And now that you’ve got their phone number, our new SMS Text With Lead feature enables you to start a text (SMS) conversation – answer questions, provide more info, and close a deal that way.

If they don’t take you up on your offer then, just follow up with text messages for new offers, content links, even just “how you doing?” notes to build a relationship.

CLICK HERE http://www.talkwithwebvisitor.com to discover what Talk With Web Visitor can do for your business.

The differe

(From eric@talkwithwebvisitor.com) Hey, this is Eric and I ran across rasselfamilychiropractic.com a few minutes ago.

Looks great… but now what?

By that I mean, when someone like me finds your website – either through Search or just bouncing around – what happens next?  Do you get a lot of leads from your site, or at least enough to make you happy?

Honestly, most business websites fall a bit short when it comes to generating paying customers. Studies show that 70% of a site’s visitors disappear and are gone forever after just a moment.

Here’s an idea…
 
How about making it really EASY for every visitor who shows up to get a personal phone call you as soon as they hit your site…
 
You can –
  
Talk With Web Visitor is a software widget that’s works on your site, ready to capture any visitor’s Name, Email address and Phone Number.  It signals you the moment they let you know they’re interested – so that you can talk to that lead while they’re literally looking over your site.

CLICK HERE htt

03/30/2020-00:49:24.614962 192.210.189.120 Protocol: 6 ET SCAN NMAP -sS window 1024

Port probing on unauthorized port 445

(From eric@talkwithcustomer.com) 
Hi,

My name is Eric and I was looking at a few different sites online and came across your site staytunedchiropractic.com.  I must say - your website is very impressive.  I am seeing your website on the first page of the Search Engine. 

Have you noticed that 70 percent of visitors who leave your website will never return?  In most cases, this means that 95 percent to 98 percent of your marketing efforts are going to waste, not to mention that you are losing more money in customer acquisition costs than you need to.
 
As a business person, the time and money you put into your marketing efforts is extremely valuable.  So why let it go to waste?  Our users have seen staggering improvements in conversions with insane growths of 150 percent going upwards of 785 percent. Are you ready to unlock the highest conversion revenue from each of your website visitors?  

TalkWithCustomer is a widget which captures a website visitor’s Name, Email address and Phone Number and then

(From eric@talkwithcustomer.com)  
Hey,

You have a website nervedoc.org, right?

Of course you do. I am looking at your website now.

It gets traffic every day – that you’re probably spending $2 / $4 / $10 or more a click to get.  Not including all of the work you put into creating social media, videos, blog posts, emails, and so on.

So you’re investing seriously in getting people to that site.

But how’s it working?  Great? Okay?  Not so much?

If that answer could be better, then it’s likely you’re putting a lot of time, effort, and money into an approach that’s not paying off like it should.

Now… imagine doubling your lead conversion in just minutes… In fact, I’ll go even better.
 
You could actually get up to 100X more conversions!

I’m not making this up.  As Chris Smith, best-selling author of The Conversion Code says: Speed is essential - there is a 100x decrease in Leads when a Lead is contacted within 14 minutes vs being contacted within 5 minutes.

He’s backed up by a study a

SPAM Bot Host Blocked!

Unauthorised access (Jan 26) SRC=192.210.189.120 LEN=40 TTL=244 ID=15168 TCP DPT=1433 WINDOW=1024 SYN 
Unauthorised access (Jan 23) SRC=192.210.189.120 LEN=40 TTL=244 ID=52913 TCP DPT=445 WINDOW=1024 SYN

(From eric@talkwithcustomer.com) 
Hi,

Let’s take a quick trip to Tomorrow-land.

I’m not talking about a theme park, I’m talking about your business’s future…

Don’t worry, we won’t even need a crystal ball.  

Just imagine… 

… a future where the money you invest in driving traffic to your site wellnessfirstclinics.com pays off with tons of calls from qualified leads.
 
And the difference between what you experienced in the past is staggering – you’re seeing 10X, 20X, 50X, even up to a 100X more leads coming from your website wellnessfirstclinics.com.  Leads that are already engaged with what you have to offer and are ready to learn more and even open their wallets.

Seeing all this taking place in your business, you think back: What did I do only a short time ago that made such a huge difference?

And then it hits you: You took advantage of a free 14 day Test Drive of TalkWithCustomer.

You installed TalkWithCustomer on wellnessfirstclinics.com – it was a snap.

And practically overnig

1576996019 - 12/22/2019 07:26:59 Host: 192.210.189.120/192.210.189.120 Port: 445 TCP Blocked

Unauthorized connection attempt detected from IP address 192.210.189.69 to port 445

Honeypot attack, port: 445, PTR: 192-210-189-120-host.colocrossing.com.

bruteforce detected

Mar 28 04:53:58 dcd-gentoo sshd[11003]: Invalid user support from 46.148.21.32 port 54726
Mar 28 04:54:00 dcd-gentoo sshd[11003]: error: PAM: Authentication failure for illegal user support from 46.148.21.32
Mar 28 04:53:58 dcd-gentoo sshd[11003]: Invalid user support from 46.148.21.32 port 54726
Mar 28 04:54:00 dcd-gentoo sshd[11003]: error: PAM: Authentication failure for illegal user support from 46.148.21.32
Mar 28 04:53:58 dcd-gentoo sshd[11003]: Invalid user support from 46.148.21.32 port 54726
Mar 28 04:54:00 dcd-gentoo sshd[11003]: error: PAM: Authentication failure for illegal user support from 46.148.21.32
Mar 28 04:54:00 dcd-gentoo sshd[11003]: Failed keyboard-interactive/pam for invalid user support from 46.148.21.32 port 54726 ssh2
...

2020-03-28T04:56:35.606088dmca.cloudsearch.cf sshd[13623]: Invalid user qkm from 190.223.41.18 port 60958
2020-03-28T04:56:35.622488dmca.cloudsearch.cf sshd[13623]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.223.41.18
2020-03-28T04:56:35.606088dmca.cloudsearch.cf sshd[13623]: Invalid user qkm from 190.223.41.18 port 60958
2020-03-28T04:56:38.263117dmca.cloudsearch.cf sshd[13623]: Failed password for invalid user qkm from 190.223.41.18 port 60958 ssh2
2020-03-28T05:06:07.949253dmca.cloudsearch.cf sshd[14303]: Invalid user rxo from 190.223.41.18 port 41014
2020-03-28T05:06:07.958632dmca.cloudsearch.cf sshd[14303]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.223.41.18
2020-03-28T05:06:07.949253dmca.cloudsearch.cf sshd[14303]: Invalid user rxo from 190.223.41.18 port 41014
2020-03-28T05:06:09.791380dmca.cloudsearch.cf sshd[14303]: Failed password for invalid user rxo from 190.223.41.18 port 410
...

sshd jail - ssh hack attempt

Mar 28 06:10:44 debian-2gb-nbg1-2 kernel: \[7631311.987726\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=149.154.71.44 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=51 ID=55559 DF PROTO=TCP SPT=35919 DPT=80 WINDOW=0 RES=0x00 RST URGP=0

Mar 28 04:54:10 debian-2gb-nbg1-2 kernel: \[7626718.261314\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=80.82.77.240 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=247 ID=40881 PROTO=TCP SPT=64344 DPT=1080 WINDOW=1024 RES=0x00 SYN URGP=0

k+ssh-bruteforce

DATE:2020-03-28 04:53:51, IP:106.53.38.69, PORT:ssh SSH brute force auth (docker-dc)

Mar 28 05:26:19 mail postfix/smtpd\[13015\]: warning: unknown\[185.234.217.66\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6\
Mar 28 05:58:24 mail postfix/smtpd\[14014\]: warning: unknown\[185.234.217.66\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6\
Mar 28 06:09:17 mail postfix/smtpd\[14418\]: warning: unknown\[185.234.217.66\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6\
Mar 28 06:19:53 mail postfix/smtpd\[14722\]: warning: unknown\[185.234.217.66\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6\

Mar 28 00:53:30 plusreed sshd[3048]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.30.167  user=root
Mar 28 00:53:32 plusreed sshd[3048]: Failed password for root from 222.186.30.167 port 64730 ssh2
...

Brute force attempt

Mar 28 10:25:18 gw1 sshd[10465]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.168.137.2
Mar 28 10:25:20 gw1 sshd[10465]: Failed password for invalid user market from 152.168.137.2 port 33749 ssh2
...

SQL Injection

Mar 28 10:05:29 gw1 sshd[9772]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.34.196
Mar 28 10:05:32 gw1 sshd[9772]: Failed password for invalid user zpb from 106.13.34.196 port 42568 ssh2
...

(sshd) Failed SSH login from 118.25.12.59 (CN/China/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Mar 28 04:40:07 amsweb01 sshd[4446]: Invalid user delma from 118.25.12.59 port 46500
Mar 28 04:40:08 amsweb01 sshd[4446]: Failed password for invalid user delma from 118.25.12.59 port 46500 ssh2
Mar 28 04:48:52 amsweb01 sshd[5298]: Invalid user hmx from 118.25.12.59 port 58426
Mar 28 04:48:54 amsweb01 sshd[5298]: Failed password for invalid user hmx from 118.25.12.59 port 58426 ssh2
Mar 28 04:53:53 amsweb01 sshd[5840]: User mnc from 118.25.12.59 not allowed because not listed in AllowUsers