firewall-block, port(s): 2167/tcp

Sep  7 09:22:05 Host-KEWR-E sshd[225832]: User root from 218.249.73.36 not allowed because not listed in AllowUsers
...

SSH Brute Force

SSH brute force

$f2bV_matches

Honeypot attack, port: 445, PTR: PTR record not found

(From eric@talkwithwebvisitor.com) Hey there, I just found your site, quick question…

My name’s Eric, I found wattfamilychiropractic.com after doing a quick search – you showed up near the top of the rankings, so whatever you’re doing for SEO, looks like it’s working well.

So here’s my question – what happens AFTER someone lands on your site?  Anything?

Research tells us at least 70% of the people who find your site, after a quick once-over, they disappear… forever.

That means that all the work and effort you put into getting them to show up, goes down the tubes.

Why would you want all that good work – and the great site you’ve built – go to waste?

Because the odds are they’ll just skip over calling or even grabbing their phone, leaving you high and dry.

But here’s a thought… what if you could make it super-simple for someone to raise their hand, say, “okay, let’s talk” without requiring them to even pull their cell phone from their pocket?
  
You can – thanks to revolutionary new softw

51.158.104.101 (FR/France/-), 6 distributed sshd attacks on account [root] in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_DISTATTACK; Logs: Sep  7 10:45:24 server2 sshd[29767]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.122.32.99  user=root
Sep  7 10:45:26 server2 sshd[29767]: Failed password for root from 103.122.32.99 port 42626 ssh2
Sep  7 10:43:38 server2 sshd[28190]: Failed password for root from 45.230.240.118 port 29270 ssh2
Sep  7 10:41:39 server2 sshd[26658]: Failed password for root from 59.126.108.47 port 59247 ssh2
Sep  7 10:43:36 server2 sshd[28190]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.230.240.118  user=root
Sep  7 10:46:34 server2 sshd[31260]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.158.104.101  user=root

IP Addresses Blocked:

103.122.32.99 (ID/Indonesia/-)
45.230.240.118 (EC/Ecuador/-)
59.126.108.47 (TW/Taiwan/-)

Sep  7 17:05:56 rotator sshd\[28787\]: Failed password for root from 185.100.87.206 port 38891 ssh2Sep  7 17:05:58 rotator sshd\[28787\]: Failed password for root from 185.100.87.206 port 38891 ssh2Sep  7 17:06:00 rotator sshd\[28787\]: Failed password for root from 185.100.87.206 port 38891 ssh2Sep  7 17:06:03 rotator sshd\[28787\]: Failed password for root from 185.100.87.206 port 38891 ssh2Sep  7 17:06:15 rotator sshd\[28787\]: Failed password for root from 185.100.87.206 port 38891 ssh2Sep  7 17:06:17 rotator sshd\[28787\]: Failed password for root from 185.100.87.206 port 38891 ssh2
...

Honeypot attack, port: 445, PTR: 109-110-167-217-dynamic.shabdiznet.com.

Time:     Mon Sep  7 07:26:21 2020 +0000
IP:       49.235.153.54 (-)
Failures: 5 (sshd)
Interval: 3600 seconds
Blocked:  Permanent Block [LF_SSHD]

Log entries:

Sep  7 07:01:24 ca-18-ede1 sshd[47834]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.235.153.54  user=root
Sep  7 07:01:26 ca-18-ede1 sshd[47834]: Failed password for root from 49.235.153.54 port 45808 ssh2
Sep  7 07:21:27 ca-18-ede1 sshd[50227]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.235.153.54  user=root
Sep  7 07:21:29 ca-18-ede1 sshd[50227]: Failed password for root from 49.235.153.54 port 59404 ssh2
Sep  7 07:26:17 ca-18-ede1 sshd[50793]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.235.153.54  user=root

Failed password for root from 92.223.105.154 port 60038 ssh2
Invalid user oracle from 92.223.105.154 port 37776
pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=mad-projects.online
Invalid user oracle from 92.223.105.154 port 37776
Failed password for invalid user oracle from 92.223.105.154 port 37776 ssh2

2020-09-07T17:31:04.833123 sshd[2886563]: Unable to negotiate with 222.186.175.163 port 8396: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1 [preauth]
2020-09-07T17:31:04.929882 sshd[2886565]: Unable to negotiate with 222.186.175.163 port 52780: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1 [preauth]
2020-09-07T17:37:51.778206 sshd[2890730]: Unable to negotiate with 222.186.175.163 port 27732: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1 [preauth]

Honeypot attack, port: 5555, PTR: PTR record not found

Unauthorised login to NAS