Triggered by Fail2Ban at Ares web server

Automatic report - Port Scan Attack

Apr  7 07:40:46 server1 sshd\[344\]: Failed password for invalid user user from 139.59.94.24 port 41758 ssh2
Apr  7 07:45:05 server1 sshd\[1656\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.94.24  user=ubuntu
Apr  7 07:45:07 server1 sshd\[1656\]: Failed password for ubuntu from 139.59.94.24 port 52016 ssh2
Apr  7 07:49:29 server1 sshd\[3016\]: Invalid user appuser from 139.59.94.24
Apr  7 07:49:29 server1 sshd\[3016\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.94.24 
...

Apr  7 16:24:08 marvibiene sshd[16318]: Invalid user pi from 82.64.15.106 port 42814
Apr  7 16:24:08 marvibiene sshd[16320]: Invalid user pi from 82.64.15.106 port 42818
...

Unauthorized connection attempt from IP address 201.131.7.105 on Port 445(SMB)

Unauthorized connection attempt from IP address 171.239.179.203 on Port 445(SMB)

(From eric@talkwithwebvisitor.com) Cool website!

My name’s Eric, and I just found your site - positivelychiropractic.com - while surfing the net. You showed up at the top of the search results, so I checked you out. Looks like what you’re doing is pretty cool.
 
But if you don’t mind me asking – after someone like me stumbles across positivelychiropractic.com, what usually happens?

Is your site generating leads for your business? 
 
I’m guessing some, but I also bet you’d like more… studies show that 7 out 10 who land on a site wind up leaving without a trace.

Not good.

Here’s a thought – what if there was an easy way for every visitor to “raise their hand” to get a phone call from you INSTANTLY… the second they hit your site and said, “call me now.”

You can –
  
Talk With Web Visitor is a software widget that’s works on your site, ready to capture any visitor’s Name, Email address and Phone Number.  It lets you know IMMEDIATELY – so that you can talk to that lead while they’re literally

(From eric@talkwithwebvisitor.com) Hey, this is Eric and I ran across hesschiropracticsc.com a few minutes ago.

Looks great… but now what?

By that I mean, when someone like me finds your website – either through Search or just bouncing around – what happens next?  Do you get a lot of leads from your site, or at least enough to make you happy?

Honestly, most business websites fall a bit short when it comes to generating paying customers. Studies show that 70% of a site’s visitors disappear and are gone forever after just a moment.

Here’s an idea…
 
How about making it really EASY for every visitor who shows up to get a personal phone call you as soon as they hit your site…
 
You can –
  
Talk With Web Visitor is a software widget that’s works on your site, ready to capture any visitor’s Name, Email address and Phone Number.  It signals you the moment they let you know they’re interested – so that you can talk to that lead while they’re literally looking over your site.

CLICK HERE http://ww

Automatic report - Port Scan Attack

Telnet/23 MH Probe, Scan, BF, Hack -

DATE:2020-04-07 14:46:34, IP:177.52.62.53, PORT:telnet Telnet brute force auth on honeypot server (honey-neo-dc)

Apr  7 19:18:08 vps333114 sshd[22283]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.36.224
Apr  7 19:18:11 vps333114 sshd[22283]: Failed password for invalid user sso from 106.12.36.224 port 57324 ssh2
...

Apr  7 20:53:55 h2829583 sshd[13845]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.235.115.221

[MK-VM4] Blocked by UFW

Apr  7 18:52:16 gw1 sshd[26841]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.167.123.113
Apr  7 18:52:18 gw1 sshd[26841]: Failed password for invalid user user3 from 14.167.123.113 port 2879 ssh2
...