| 5.45.207.74 |
attackspambots |
[Thu Mar 05 20:35:09.077839 2020] [:error] [pid 2076:tid 139658339280640] [client 5.45.207.74:50527] [client 5.45.207.74] ModSecurity: Access denied with code 403 (phase 2). Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/modsecurity/owasp-modsecurity-crs-3.2.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "696"] [id "920350"] [msg "Host header is a numeric IP address"] [data "103.27.207.197"] [severity "WARNING"] [ver "OWASP_CRS/3.2.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/IP_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "103.27.207.197"] [uri "/"] [unique_id "XmEADdNqPnL4hDn@SrG94wAAADs"]
... |
2020-03-05 22:41:24 |
| 49.234.47.124 |
attack |
Mar 5 15:07:58 lnxmysql61 sshd[18254]: Failed password for lp from 49.234.47.124 port 59180 ssh2
Mar 5 15:07:58 lnxmysql61 sshd[18254]: Failed password for lp from 49.234.47.124 port 59180 ssh2 |
2020-03-05 22:12:03 |
| 167.71.215.72 |
attackbots |
Nov 12 22:21:43 odroid64 sshd\[12760\]: Invalid user admin from 167.71.215.72
Nov 12 22:21:43 odroid64 sshd\[12760\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.215.72
Nov 16 17:38:30 odroid64 sshd\[8065\]: Invalid user tiny from 167.71.215.72
Nov 16 17:38:30 odroid64 sshd\[8065\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.215.72
... |
2020-03-05 22:46:41 |
| 220.133.213.215 |
attack |
Telnet/23 MH Probe, Scan, BF, Hack - |
2020-03-05 22:29:24 |
| 220.201.199.4 |
attackbots |
Telnet/23 MH Probe, Scan, BF, Hack - |
2020-03-05 22:35:01 |
| 167.71.226.158 |
attackbots |
(sshd) Failed SSH login from 167.71.226.158 (IN/India/-): 2 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Mar 5 15:37:23 ubnt-55d23 sshd[14155]: Invalid user cpanelphppgadmin from 167.71.226.158 port 34418
Mar 5 15:37:25 ubnt-55d23 sshd[14155]: Failed password for invalid user cpanelphppgadmin from 167.71.226.158 port 34418 ssh2 |
2020-03-05 22:42:10 |
| 14.169.194.51 |
attack |
suspicious action Thu, 05 Mar 2020 10:35:21 -0300 |
2020-03-05 22:17:28 |
| 167.71.223.191 |
attack |
Feb 15 01:42:11 odroid64 sshd\[4514\]: Invalid user anicia from 167.71.223.191
Feb 15 01:42:11 odroid64 sshd\[4514\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.223.191
... |
2020-03-05 22:45:01 |
| 132.148.129.180 |
attack |
Mar 5 14:41:12 * sshd[21663]: Failed password for root from 132.148.129.180 port 53982 ssh2 |
2020-03-05 22:31:21 |
| 192.241.220.219 |
attack |
Port scan: Attack repeated for 24 hours |
2020-03-05 22:20:40 |
| 173.213.85.124 |
attack |
(From mike@graphicdesignisrael.co) Shalom, Mike here.
Your website and business look great and both seem well established.
I am messaging you today to compliment your business + let you know about the unreasonably low pricing I am charging for a limited time to new clients interested in my graphic design services.
Reply back to say Hi, ask to see my portfolio, or check out my site.
Email me: Mike@graphicdesignisrael.co Website: GraphicDesignIsrael.co
--
Mike Saffern
graphicdesignisrael.co
Mike@graphicdesignisrael.co |
2020-03-05 22:30:23 |
| 51.75.67.108 |
attack |
Mar 5 03:53:37 wbs sshd\[8666\]: Invalid user nx from 51.75.67.108
Mar 5 03:53:37 wbs sshd\[8666\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=108.ip-51-75-67.eu
Mar 5 03:53:39 wbs sshd\[8666\]: Failed password for invalid user nx from 51.75.67.108 port 55098 ssh2
Mar 5 04:02:43 wbs sshd\[9560\]: Invalid user abdullah from 51.75.67.108
Mar 5 04:02:43 wbs sshd\[9560\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=108.ip-51-75-67.eu |
2020-03-05 22:27:15 |
| 138.97.159.10 |
attackspam |
From: Walgreens Rewards
Repetitive Walgreens reward spam - likely fraud – primarily Ukraine ISP; targeted Google phishing redirect; repetitive blacklisted phishing redirect spam links.
No entity name; BBB results for "8 The Green, Dover, DE 19901":
… The websites collect personal information and then transfer it to lenders and other service providers and marketing companies. BBB suggests caution in dealing with these websites. …
Unsolicited bulk spam - (EHLO betrothment.clausloan.eu) (138.97.159.217) – repetitive UBE from IP range 138.97.156.*
Spam link clausloan.eu = 138.97.159.10 My Tech BZ – blacklisted – phishing redirect:
- www.google.com – effective URL; phishing redirect
- lukkins.com = 139.99.70.208 Ovh Sas
- link.agnesta.com = 62.113.207.188 23Media GmbH (previous domain link.orcelsor.com)
- kq6.securessl.company = 104.223.205.137, 104.223.205.138 Global Frag Networks |
2020-03-05 22:38:17 |
| 167.71.242.140 |
attackspambots |
Dec 27 17:44:12 odroid64 sshd\[29677\]: Invalid user lazaroo from 167.71.242.140
Dec 27 17:44:12 odroid64 sshd\[29677\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.242.140
Feb 21 00:54:07 odroid64 sshd\[24645\]: Invalid user kernelsys from 167.71.242.140
Feb 21 00:54:07 odroid64 sshd\[24645\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.242.140
... |
2020-03-05 22:35:48 |
| 49.88.112.112 |
attack |
March 05 2020, 14:12:57 [sshd] - Banned from the Cipher Host hosting platform by Fail2ban. |
2020-03-05 22:19:36 |