fail2ban

$f2bV_matches

2020-03-0522:54:221j9yRh-0002Rr-R7\<=verena@rs-solution.chH=\(localhost\)[14.187.34.129]:39995P=esmtpsaX=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256CV=noA=dovecot_login:verena@rs-solution.chS=2375id=8386306368BC9221FDF8B109FD23A871@rs-solution.chT="Wouldliketogetacquaintedwithyou"forzakdaddy000041@gmail.com107bgautam@gmail.com2020-03-0522:54:471j9yS6-0002Uw-4D\<=verena@rs-solution.chH=\(localhost\)[14.231.61.171]:33023P=esmtpsaX=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256CV=noA=dovecot_login:verena@rs-solution.chS=2253id=A7A214474C98B605D9DC952DD92F7CAA@rs-solution.chT="Onlyrequireatinyamountofyourattention"forrivercena1@gmail.combigbucks1389@gmail.com2020-03-0522:54:591j9ySI-0002WC-PI\<=verena@rs-solution.chH=\(localhost\)[123.20.112.37]:59411P=esmtpsaX=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256CV=noA=dovecot_login:verena@rs-solution.chS=2240id=EFEA5C0F04D0FE4D9194DD659136D51C@rs-solution.chT="Justneedalittlebitofyourattention"forangelvegagarcia31@gmail.comabdulnurumusa076@gmail.com2020-03-0522:54:381j9yRx-0002UG-KY

Lines containing failures of 76.103.31.19
Mar  4 17:54:08 smtp-out sshd[20377]: Invalid user javier from 76.103.31.19 port 37384
Mar  4 17:54:08 smtp-out sshd[20377]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=76.103.31.19 
Mar  4 17:54:09 smtp-out sshd[20377]: Failed password for invalid user javier from 76.103.31.19 port 37384 ssh2
Mar  4 17:54:10 smtp-out sshd[20377]: Received disconnect from 76.103.31.19 port 37384:11: Bye Bye [preauth]
Mar  4 17:54:10 smtp-out sshd[20377]: Disconnected from invalid user javier 76.103.31.19 port 37384 [preauth]
Mar  4 18:16:08 smtp-out sshd[21065]: Invalid user vernemq from 76.103.31.19 port 37950
Mar  4 18:16:08 smtp-out sshd[21065]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=76.103.31.19 
Mar  4 18:16:10 smtp-out sshd[21065]: Failed password for invalid user vernemq from 76.103.31.19 port 37950 ssh2
Mar  4 18:16:11 smtp-out sshd[21065]: Receiv........
------------------------------

Mar  5 18:51:53 tdfoods sshd\[14559\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.54.134.145  user=root
Mar  5 18:51:54 tdfoods sshd\[14559\]: Failed password for root from 106.54.134.145 port 51276 ssh2
Mar  5 18:55:45 tdfoods sshd\[14857\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.54.134.145  user=root
Mar  5 18:55:47 tdfoods sshd\[14857\]: Failed password for root from 106.54.134.145 port 35856 ssh2
Mar  5 18:59:41 tdfoods sshd\[15162\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.54.134.145  user=root

fail2ban

SSH auth scanning - multiple failed logins

Mar  5 18:57:43 wbs sshd\[31377\]: Invalid user caizexin from 141.226.8.44
Mar  5 18:57:43 wbs sshd\[31377\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=141.226.8.44
Mar  5 18:57:45 wbs sshd\[31377\]: Failed password for invalid user caizexin from 141.226.8.44 port 27302 ssh2
Mar  5 18:59:52 wbs sshd\[31564\]: Invalid user centos from 141.226.8.44
Mar  5 18:59:52 wbs sshd\[31564\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=141.226.8.44

Mar  6 05:54:19 sd-53420 sshd\[32555\]: User root from 62.4.23.126 not allowed because none of user's groups are listed in AllowGroups
Mar  6 05:54:19 sd-53420 sshd\[32555\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.4.23.126  user=root
Mar  6 05:54:21 sd-53420 sshd\[32555\]: Failed password for invalid user root from 62.4.23.126 port 36578 ssh2
Mar  6 05:59:46 sd-53420 sshd\[523\]: User root from 62.4.23.126 not allowed because none of user's groups are listed in AllowGroups
Mar  6 05:59:46 sd-53420 sshd\[523\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.4.23.126  user=root
...

[Fri Mar 06 11:59:30.545468 2020] [:error] [pid 31020:tid 139856877369088] [client 141.8.132.9:65111] [client 141.8.132.9] ModSecurity: Access denied with code 403 (phase 2). Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/modsecurity/owasp-modsecurity-crs-3.2.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "696"] [id "920350"] [msg "Host header is a numeric IP address"] [data "103.27.207.197"] [severity "WARNING"] [ver "OWASP_CRS/3.2.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/IP_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "103.27.207.197"] [uri "/"] [unique_id "XmHYsnCflmAPk@m9WrMERAAAAUo"]
...

Mar  5 23:59:43 mail sshd\[10631\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.0.129.192  user=root
...

Mar  6 05:49:07 mail.srvfarm.net postfix/smtpd[1924585]: NOQUEUE: reject: RCPT from unknown[217.112.142.226]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar  6 05:49:08 mail.srvfarm.net postfix/smtpd[1921413]: NOQUEUE: reject: RCPT from unknown[217.112.142.226]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar  6 05:50:09 mail.srvfarm.net postfix/smtpd[1928946]: NOQUEUE: reject: RCPT from unknown[217.112.142.226]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar  6 05:51:10 mail.srvfarm.net postfix/smtpd[1928946]: NOQUEUE: reject: RCPT from unkno

Fail2Ban Ban Triggered

1583470766 - 03/06/2020 05:59:26 Host: 36.79.255.159/36.79.255.159 Port: 445 TCP Blocked

Honeypot attack, port: 5555, PTR: n218250090164.netvigator.com.