k+ssh-bruteforce

2019-11-07T09:19:36.413553host3.slimhost.com.ua dovecot[859034]: pop3-login: Aborted login (auth failed, 1 attempts in 2 secs): user=, method=PLAIN, rip=93.174.93.5, lip=207.180.241.50, session=<+7RPU72WXjBdrl0F>
2019-11-07T09:22:11.104250host3.slimhost.com.ua dovecot[859034]: pop3-login: Aborted login (auth failed, 1 attempts in 2 secs): user=, method=PLAIN, rip=93.174.93.5, lip=207.180.241.50, session=
2019-11-07T09:23:22.392802host3.slimhost.com.ua dovecot[859034]: pop3-login: Aborted login (auth failed, 1 attempts in 2 secs): user=, method=PLAIN, rip=93.174.93.5, lip=207.180.241.50, session=<4oHIYL2WgIJdrl0F>
2019-11-07T09:23:50.474822host3.slimhost.com.ua dovecot[859034]: pop3-login: Aborted login (auth failed, 1 attempts in 2 secs): user=, method=PLAIN, rip=93.174.93.5, lip=207.180.241.50, session=
2019-11-07T09:24:09.190135host3.slimhost.com.ua dovecot[8590
...

IP Ban Report :  
 https://help-dysk.pl/wordpress-firewall-plugins/ip/117.67.146.220/ 
 
 CN - 1H : (643)  
 Protection Against DDoS WordPress plugin :  
 "odzyskiwanie danych help-dysk" 
 IP Address Ranges by Country : CN 
 NAME ASN : ASN4134 
 
 IP : 117.67.146.220 
 
 CIDR : 117.64.0.0/13 
 
 PREFIX COUNT : 5430 
 
 UNIQUE IP COUNT : 106919680 
 
 
 ATTACKS DETECTED ASN4134 :  
  1H - 19 
  3H - 55 
  6H - 100 
 12H - 163 
 24H - 297 
 
 DateTime : 2019-11-07 07:27:43 
 
 INFO : Port MAX SCAN Scan Detected and Blocked by ADMIN  - data recovery

SSH bruteforce (Triggered fail2ban)

Nov  7 08:43:31 ms-srv sshd[48103]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.178.128.41  user=root
Nov  7 08:43:33 ms-srv sshd[48103]: Failed password for invalid user root from 45.178.128.41 port 35442 ssh2

2019-11-07T07:26:09.013176struts4.enskede.local sshd\[15798\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=196.29.99.2  user=root
2019-11-07T07:26:12.066802struts4.enskede.local sshd\[15798\]: Failed password for root from 196.29.99.2 port 42852 ssh2
2019-11-07T07:26:13.947130struts4.enskede.local sshd\[15801\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=196.29.99.2  user=root
2019-11-07T07:26:16.533608struts4.enskede.local sshd\[15801\]: Failed password for root from 196.29.99.2 port 44452 ssh2
2019-11-07T07:26:18.382036struts4.enskede.local sshd\[15804\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=196.29.99.2  user=root
...

Lines containing failures of 58.174.126.184
Nov  7 07:21:57 server01 postfix/smtpd[7372]: warning: hostname cpe-58-174-126-184.sb03.sa.asp.telstra.net does not resolve to address 58.174.126.184: Name or service not known
Nov  7 07:21:57 server01 postfix/smtpd[7372]: connect from unknown[58.174.126.184]
Nov x@x
Nov x@x
Nov  7 07:21:58 server01 postfix/policy-spf[7382]: : Policy action=PREPEND Received-SPF: none (sgaservice.hostname: No applicable sender policy available) receiver=x@x
Nov x@x


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=58.174.126.184

Nov  7 07:21:58 offspring postfix/smtpd[25388]: warning: hostname static.vnpt.vn does not resolve to address 14.186.63.131
Nov  7 07:21:58 offspring postfix/smtpd[25388]: connect from unknown[14.186.63.131]
Nov  7 07:22:01 offspring postfix/smtpd[25388]: warning: unknown[14.186.63.131]: SASL CRAM-MD5 authentication failed: authentication failure
Nov  7 07:22:01 offspring postfix/smtpd[25388]: warning: unknown[14.186.63.131]: SASL PLAIN authentication failed: authentication failure
Nov  7 07:22:03 offspring postfix/smtpd[25388]: warning: unknown[14.186.63.131]: SASL LOGIN authentication failed: authentication failure
Nov  7 07:22:03 offspring postfix/smtpd[25388]: disconnect from unknown[14.186.63.131]


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=14.186.63.131

Nov  7 09:06:44 sticky sshd\[819\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.219.3.139  user=root
Nov  7 09:06:47 sticky sshd\[819\]: Failed password for root from 46.219.3.139 port 51376 ssh2
Nov  7 09:10:44 sticky sshd\[898\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.219.3.139  user=root
Nov  7 09:10:46 sticky sshd\[898\]: Failed password for root from 46.219.3.139 port 32870 ssh2
Nov  7 09:14:44 sticky sshd\[952\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.219.3.139  user=root
...

2019-11-07T09:38:25.301872mail01 postfix/smtpd[4942]: warning: ip76.ip-54-36-214.eu[54.36.214.76]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
2019-11-07T09:38:57.343848mail01 postfix/smtpd[13074]: warning: ip76.ip-54-36-214.eu[54.36.214.76]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
2019-11-07T09:39:42.427609mail01 postfix/smtpd[13074]: warning: ip76.ip-54-36-214.eu[54.36.214.76]: SASL LOGIN authentication failed: UGFzc3dvcmQ6

Port Scan 1433

Nov  7 05:35:17 firewall sshd[28975]: Invalid user wb from 193.70.39.175
Nov  7 05:35:19 firewall sshd[28975]: Failed password for invalid user wb from 193.70.39.175 port 33952 ssh2
Nov  7 05:39:14 firewall sshd[29076]: Invalid user css from 193.70.39.175
...

Nov  7 14:04:31 vibhu-HP-Z238-Microtower-Workstation sshd\[16793\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.51.116  user=root
Nov  7 14:04:33 vibhu-HP-Z238-Microtower-Workstation sshd\[16793\]: Failed password for root from 80.211.51.116 port 48760 ssh2
Nov  7 14:08:29 vibhu-HP-Z238-Microtower-Workstation sshd\[16949\]: Invalid user 6 from 80.211.51.116
Nov  7 14:08:29 vibhu-HP-Z238-Microtower-Workstation sshd\[16949\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.51.116
Nov  7 14:08:32 vibhu-HP-Z238-Microtower-Workstation sshd\[16949\]: Failed password for invalid user 6 from 80.211.51.116 port 58798 ssh2
...

11/07/2019-01:27:32.619613 93.174.93.26 Protocol: 6 ET DROP Dshield Block Listed Source group 1

Nov  7 09:11:45 markkoudstaal sshd[3967]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=88.174.4.30
Nov  7 09:11:45 markkoudstaal sshd[3968]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=88.174.4.30
Nov  7 09:11:47 markkoudstaal sshd[3967]: Failed password for invalid user pi from 88.174.4.30 port 50116 ssh2
Nov  7 09:11:47 markkoudstaal sshd[3968]: Failed password for invalid user pi from 88.174.4.30 port 50118 ssh2