Bible

"AmooT";tag=3533393765393339313363340132313832313335333935

\[2020-10-02 15:01:13\] SECURITY\[6939\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-10-02T15:01:13.624+0200",Severity="Error",Service="SIP",EventVersion="2",AccountID="100",SessionID="0x7f0ffea08d88",LocalAddress="IPV4/UDP/204.8.216.89/5060",RemoteAddress="IPV4/UDP/37.49.230.126/5862",Challenge="096f171f",ReceivedChallenge="096f171f",ReceivedHash="b099bdfad5869da4ae2114a56a2b4299"
\[2020-10-02 15:01:13\] SECURITY\[6939\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-10-02T15:01:13.759+0200",Severity="Error",Service="SIP",EventVersion="2",AccountID="100",SessionID="0x7f0ffeab8148",LocalAddress="IPV4/UDP/204.8.216.89/5060",RemoteAddress="IPV4/UDP/37.49.230.126/5862",Challenge="233a417c",ReceivedChallenge="233a417c",ReceivedHash="0017581d14759d4b5ad3a404ed924131"
\[2020-10-02 15:01:13\] SECURITY\[6939\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-10-02T15:01:13.783+0200",Severity="Error",Service="SIP",EventVersion="2",Accoun
...

\[2020-10-02 15:01:13\] SECURITY\[6939\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-10-02T15:01:13.624+0200",Severity="Error",Service="SIP",EventVersion="2",AccountID="100",SessionID="0x7f0ffea08d88",LocalAddress="IPV4/UDP/204.8.216.89/5060",RemoteAddress="IPV4/UDP/37.49.230.126/5862",Challenge="096f171f",ReceivedChallenge="096f171f",ReceivedHash="b099bdfad5869da4ae2114a56a2b4299"
\[2020-10-02 15:01:13\] SECURITY\[6939\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-10-02T15:01:13.759+0200",Severity="Error",Service="SIP",EventVersion="2",AccountID="100",SessionID="0x7f0ffeab8148",LocalAddress="IPV4/UDP/204.8.216.89/5060",RemoteAddress="IPV4/UDP/37.49.230.126/5862",Challenge="233a417c",ReceivedChallenge="233a417c",ReceivedHash="0017581d14759d4b5ad3a404ed924131"
\[2020-10-02 15:01:13\] SECURITY\[6939\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-10-02T15:01:13.783+0200",Severity="Error",Service="SIP",EventVersion="2",Accoun
...

[N1.H1.VM1] Port Scanner Detected Blocked by UFW

SIP Server BruteForce Attack

Jul 29 06:33:51 *hidden* postfix/postscreen[32497]: DNSBL rank 3 for [37.49.230.126]:62346

Jul 31 18:42:13 *hidden* kernel: [UFW BLOCK] IN=eth0 OUT= MAC=00:50:56:3f:fd:58:00:08:e3:ff:fd:90:08:00 SRC=37.49.230.126 DST=79.143.186.54 LEN=52 TOS=0x02 PREC=0x00 TTL=122 ID=11465 DF PROTO=TCP SPT=62372 DPT=25 WINDOW=8192 RES=0x00 CWR ECE SYN URGP=0 Jul 31 18:42:16 *hidden* kernel: [UFW BLOCK] IN=eth0 OUT= MAC=00:50:56:3f:fd:58:00:08:e3:ff:fd:90:08:00 SRC=37.49.230.126 DST=79.143.186.54 LEN=52 TOS=0x02 PREC=0x00 TTL=122 ID=11466 DF PROTO=TCP SPT=62372 DPT=25 WINDOW=8192 RES=0x00 CWR ECE SYN URGP=0 Jul 31 18:42:22 *hidden* kernel: [UFW BLOCK] IN=eth0 OUT= MAC=00:50:56:3f:fd:58:00:08:e3:ff:fd:90:08:00 SRC=37.49.230.126 DST=79.143.186.54 LEN=48 TOS=0x00 PREC=0x00 TTL=122 ID=11467 DF PROTO=TCP SPT=62372 DPT=25 WINDOW=8192 RES=0x00 SYN URGP=0

2020-10-13T06:44:21.356144news0 auth[956]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=admin rhost=37.49.230.238
2020-10-13T06:44:25.395781news0 dovecot[21131]: pop3-login: Aborted login (auth failed, 1 attempts in 4 secs): user=, method=PLAIN, rip=37.49.230.238, lip=95.111.246.42, session=
2020-10-13T06:44:28.401407news0 auth[956]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=admin rhost=37.49.230.238
...

2020-10-13T06:44:21.356144news0 auth[956]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=admin rhost=37.49.230.238
2020-10-13T06:44:25.395781news0 dovecot[21131]: pop3-login: Aborted login (auth failed, 1 attempts in 4 secs): user=, method=PLAIN, rip=37.49.230.238, lip=95.111.246.42, session=
2020-10-13T06:44:28.401407news0 auth[956]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=admin rhost=37.49.230.238
...

Dovecot Invalid User Login Attempt.

[2020-09-30 18:00:12] NOTICE[1159][C-0000421d] chan_sip.c: Call from '' (37.49.230.201:64644) to extension '12526890745' rejected because extension not found in context 'public'.
[2020-09-30 18:00:12] SECURITY[1198] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-09-30T18:00:12.866-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="12526890745",SessionID="0x7fcaa045f8f8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.230.201/64644",ACLName="no_extension_match"
[2020-09-30 18:00:26] NOTICE[1159][C-0000421f] chan_sip.c: Call from '' (37.49.230.201:57391) to extension '712526890745' rejected because extension not found in context 'public'.
[2020-09-30 18:00:26] SECURITY[1198] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-09-30T18:00:26.237-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="712526890745",SessionID="0x7fcaa04d8d08",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.230.201/
...

[2020-09-30 18:00:12] NOTICE[1159][C-0000421d] chan_sip.c: Call from '' (37.49.230.201:64644) to extension '12526890745' rejected because extension not found in context 'public'.
[2020-09-30 18:00:12] SECURITY[1198] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-09-30T18:00:12.866-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="12526890745",SessionID="0x7fcaa045f8f8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.230.201/64644",ACLName="no_extension_match"
[2020-09-30 18:00:26] NOTICE[1159][C-0000421f] chan_sip.c: Call from '' (37.49.230.201:57391) to extension '712526890745' rejected because extension not found in context 'public'.
[2020-09-30 18:00:26] SECURITY[1198] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-09-30T18:00:26.237-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="712526890745",SessionID="0x7fcaa04d8d08",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.230.201/
...

[2020-09-30 18:00:12] NOTICE[1159][C-0000421d] chan_sip.c: Call from '' (37.49.230.201:64644) to extension '12526890745' rejected because extension not found in context 'public'.
[2020-09-30 18:00:12] SECURITY[1198] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-09-30T18:00:12.866-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="12526890745",SessionID="0x7fcaa045f8f8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.230.201/64644",ACLName="no_extension_match"
[2020-09-30 18:00:26] NOTICE[1159][C-0000421f] chan_sip.c: Call from '' (37.49.230.201:57391) to extension '712526890745' rejected because extension not found in context 'public'.
[2020-09-30 18:00:26] SECURITY[1198] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-09-30T18:00:26.237-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="712526890745",SessionID="0x7fcaa04d8d08",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.230.201/
...

Hellooo

Hellooo

Sep 28 15:49:19 : SSH login attempts with invalid user

SmallBizIT.US 1 packets to tcp(22)

 TCP (SYN) 37.49.230.229:45520 -> port 22, len 44

srvr3: (mod_security) mod_security (id:920350) triggered by 37.49.230.164 (NL/-/circlepole.xyz): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: 2020/09/26 22:39:25 [error] 324565#0: *1391 [client 37.49.230.164] ModSecurity: Access denied with code 406 (phase 2). Matched "Operator `Rx' with parameter `^[\d.:]+$' against variable `REQUEST_HEADERS:Host'  [redacted] [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "718"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [redacted] [severity "4"] [ver "OWASP_CRS/3.3.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [redacted] [uri "/"] [unique_id "160115276567.272105"] [ref "o0,14v21,14"], client: 37.49.230.164, [redacted] request: "GET / HTTP/1.1" [redacted]

[2020-09-26 23:25:46] NOTICE[1159][C-00002376] chan_sip.c: Call from '' (37.49.230.87:51231) to extension '900940441904911032' rejected because extension not found in context 'public'.
[2020-09-26 23:25:46] SECURITY[1198] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-09-26T23:25:46.655-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="900940441904911032",SessionID="0x7fcaa00dd368",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.230.87/51231",ACLName="no_extension_match"
[2020-09-26 23:26:25] NOTICE[1159][C-00002377] chan_sip.c: Call from '' (37.49.230.87:54479) to extension '900941441904911032' rejected because extension not found in context 'public'.
[2020-09-26 23:26:25] SECURITY[1198] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-09-26T23:26:25.135-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="900941441904911032",SessionID="0x7fcaa00dd368",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="
...

Port 22 Scan, PTR: None

Invalid user ubnt from 37.49.230.218 port 52114

NAME : ABCOM-HFC-Business-clients CIDR : 80.78.68.0/22 DDoS attack Albania - block certain countries :) IP: 80.78.74.53  Denial-of-Service Attack (DoS) Detected and Blocked by ADMIN  - data recovery https://help-dysk.pl

162.158.118.223 - - [06/Jul/2019:04:37:06 +0100] "POST /wp-login.php HTTP/1.1" 200 1458 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"

Brute force attempt

Jul  6 00:11:21 aat-srv002 sshd[25073]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.98.115.247
Jul  6 00:11:23 aat-srv002 sshd[25073]: Failed password for invalid user rrashid123 from 175.98.115.247 port 51280 ssh2
Jul  6 00:13:53 aat-srv002 sshd[25103]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.98.115.247
Jul  6 00:13:55 aat-srv002 sshd[25103]: Failed password for invalid user content123 from 175.98.115.247 port 48158 ssh2
...

2019-07-06T12:38:19.2925901240 sshd\[28277\]: Invalid user stephen from 178.128.124.83 port 60718
2019-07-06T12:38:19.3007031240 sshd\[28277\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.124.83
2019-07-06T12:38:21.2077321240 sshd\[28277\]: Failed password for invalid user stephen from 178.128.124.83 port 60718 ssh2
...

Unauthorised access (Jul  6) SRC=134.119.213.74 LEN=40 TTL=245 ID=55788 TCP DPT=445 WINDOW=1024 SYN 
Unauthorised access (Jul  2) SRC=134.119.213.74 LEN=40 TTL=244 ID=52914 TCP DPT=445 WINDOW=1024 SYN

[portscan] Port scan

Jul  6 09:15:42 *** sshd[13612]: Invalid user euclide from 217.182.79.245

ssh failed login

Jul  6 05:37:13 host sshd\[62456\]: Invalid user pi from 83.216.109.154 port 59528
Jul  6 05:37:14 host sshd\[62458\]: Invalid user pi from 83.216.109.154 port 59530
...

NAME : NEOMEDIA CIDR : 195.103.207.0/24 DDoS attack Italy - block certain countries :) IP: 195.103.207.149  Denial-of-Service Attack (DoS) Detected and Blocked by ADMIN  - data recovery https://help-dysk.pl

MySQL brute force attack detected by fail2ban

Jul  6 11:48:55 dedicated sshd[10594]: Invalid user sammy from 218.60.41.227 port 33895

Brute force attack to crack SMTP password (port 25 / 587)

Brute force SMTP login attempts.