04:42
################### Logwatch 7.4.0 (03/01/11) ####################
Processing Initiated: Sun Jan 31 04:42:04 2021
Date Range Processed: yesterday
( 2021-Jan-30 )
Period is day.
Detail Level of Output: 0
Type of Output/Format: mail / text
Logfiles for Host: h2361197.stratoserver.net
##################################################################
--------------------- fail2ban-messages Begin ------------------------
Banned services with Fail2Ban: Bans:Unbans
ssh: [223:221]
---------------------- fail2ban-messages End -------------------------
--------------------- httpd Begin ------------------------
Connection attempts using mod_proxy:
112.66.96.183 -> zapf.wiki:443: 1 Time(s)
183.185.111.100 -> zapf.wiki:443: 1 Time(s)
63.143.61.42 -> zapf.wiki:443: 2 Time(s)
A total of 3 sites probed the server
45.148.10.61
5.188.210.227
61.219.11.153
Requests with error response codes
400 Bad Request
mstshash=Administr: 9 Time(s)
null: 4 Time(s)
zapf.wiki:443: 4 Time(s)
/: 1 Time(s)
/0bef: 1 Time(s)
/bag2: 1 Time(s)
/config/getuser?index=0: 1 Time(s)
/w00tw00t.at.ISC.SANS.DFind:): 1 Time(s)
http://5.188.210.227/echo.php: 1 Time(s)
404 Not Found
/robots.txt: 43 Time(s)
/wp-login.php: 2 Time(s)
/.env: 1 Time(s)
/download/reader_aachen08.pdf: 1 Time(s)
/download/reader_ma97.pdf: 1 Time(s)
/home/verein: 1 Time(s)
/home/zapf: 1 Time(s)
/protokolle/Protokoll_MV_2019_01_11_Freiburg.pdf: 1 Time(s)
/protokolle/Protokoll_MV_2020_11_12_Muenchen.pdf: 1 Time(s)
/sites/all/libraries/ofcv1/php-ofc-library ... pload_image.php: 1 Time(s)
/sites/all/modules/civicrm/packages/OpenFl ... pload_image.php: 1 Time(s)
/sites/all/modules/tinymce/tinymce/jscript ... s/fm/index.html: 1 Time(s)
/sites/all/modules/tinytinymce/tinymce/jsc ... s/fm/index.html: 1 Time(s)
/sites/default/modules/civicrm/packages/Op ... pload_image.php: 1 Time(s)
/wp-content/: 1 Time(s)
/xmlrpc.php/: 1 Time(s)
499 (undefined)
/fonts/SourceSansPro-Regular.woff: 1 Time(s)
500 Internal Server Error
/: 31 Time(s)
/robots.txt: 8 Time(s)
/atom.xml: 5 Time(s)
/sitemap.xml: 5 Time(s)
/sitemap.xml.gz: 5 Time(s)
/sitemap_index.xml: 5 Time(s)
/sitemaps.xml: 4 Time(s)
/.env: 2 Time(s)
/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php: 2 Time(s)
/?XDEBUG_SESSION_START=phpstorm: 1 Time(s)
/actuator/health: 1 Time(s)
/admin//config.php: 1 Time(s)
/api/jsonws/invoke: 1 Time(s)
/bag2: 1 Time(s)
/console/: 1 Time(s)
/dns-query: 1 Time(s)
/dns-query?dns=AAABAAABAAAAAAAAA3d3dwdleGFtcGxlA2NvbQAAAQAB: 1 Time(s)
/index.php?s=/Index/\x5Cthink\x5Capp/invok ... HelloThinkPHP21: 1 Time(s)
/mifs/.;/services/LogService: 1 Time(s)
/owa/auth/logon.aspx?url=https%3a%2f%2f1%2fecp%2f: 1 Time(s)
/sitemap.txt: 1 Time(s)
/wp-content/plugins/wp-file-manager/readme.txt: 1 Time(s)
---------------------- httpd End -------------------------
--------------------- pam_unix Begin ------------------------
sshd:
Authentication Failures:
root (119.45.243.74): 143 Time(s)
root (142.93.195.157): 73 Time(s)
root (167.99.167.135): 73 Time(s)
root (201.75.13.14): 72 Time(s)
root (118.25.251.58): 71 Time(s)
root (49.233.117.199): 68 Time(s)
root (200.91.160.238): 66 Time(s)
root (host81-131-114-5.range81-131.btcentralplus.com): 65 Time(s)
root (vps-91e9c584.vps.ovh.net): 64 Time(s)
root (197.5.145.75): 63 Time(s)
root (222.187.239.31): 63 Time(s)
root (bsn-61-66-59.static.siol.net): 63 Time(s)
root (server1.milesdev.be): 63 Time(s)
root (106.13.102.197): 62 Time(s)
root (156.ip-51-254-37.eu): 62 Time(s)
root (164.90.217.133): 62 Time(s)
root (218.75.121.74): 62 Time(s)
root (ip93.ip-87-98-182.eu): 62 Time(s)
root (vmi459537.contaboserver.net): 62 Time(s)
root (119.45.144.250): 61 Time(s)
root (185.188.127.107): 61 Time(s)
root (241.ip-145-239-95.eu): 61 Time(s)
root (106.12.16.82): 60 Time(s)
root (124.43.9.184): 60 Time(s)
root (167.71.6.91): 60 Time(s)
root (206.189.234.238): 60 Time(s)
root (51.105.5.16): 60 Time(s)
root (host81-156-142-165.range81-156.btcentralplus.com): 60 Time(s)
root (104.131.40.97): 59 Time(s)
root (111.229.253.130): 59 Time(s)
root (123.206.216.65): 59 Time(s)
root (188.166.23.215): 59 Time(s)
root (223.197.151.55): 59 Time(s)
root (47.145.218.59): 59 Time(s)
root (vps-ffcd362e.vps.ovh.net): 59 Time(s)
root (222.187.238.87): 58 Time(s)
root (101.32.34.76): 57 Time(s)
root (118.140.205.198): 57 Time(s)
root (125.ip-51-77-202.eu): 57 Time(s)
root (189.254.242.60): 57 Time(s)
root (202.61.135.185): 56 Time(s)
root (119.28.51.32): 55 Time(s)
root (121.165.140.242): 55 Time(s)
root (183.111.204.148): 55 Time(s)
root (212.199.145.190): 55 Time(s)
root (fixed-187-188-107-115.totalplay.net): 54 Time(s)
root (153.101.29.178): 53 Time(s)
root (167.71.99.196): 53 Time(s)
root (178.62.117.106): 53 Time(s)
root (27.148.165.23): 53 Time(s)
root (154.8.192.65): 52 Time(s)
root (61.174.171.62): 52 Time(s)
root (122.252.225.165): 51 Time(s)
root (36.22.187.34): 51 Time(s)
root (cpe-98-146-212-146.natnow.res.rr.com): 51 Time(s)
root (212.95.137.19): 50 Time(s)
root (v150-95-25-165.a00a.g.bkk1.static.cnode.io): 50 Time(s)
root (106.12.185.16): 49 Time(s)
root (128.199.177.224): 48 Time(s)
root (138.197.151.129): 48 Time(s)
root (154.66.218.218): 48 Time(s)
root (221.181.185.141): 48 Time(s)
root (129.204.233.194): 47 Time(s)
root (106.13.88.158): 46 Time(s)
root (27.128.168.225): 46 Time(s)
root (185.216.178.231): 45 Time(s)
root (104.236.69.31): 44 Time(s)
root (178.62.78.193): 44 Time(s)
root (118.25.91.168): 42 Time(s)
root (188.254.0.172): 42 Time(s)
root (27.50.164.117): 42 Time(s)
root (static.28.203.203.116.clients.your-server.de): 41 Time(s)
root (118.212.146.30): 39 Time(s)
root (157.230.80.232): 39 Time(s)
root (220.171.93.62): 37 Time(s)
root (152.171.152.2): 36 Time(s)
root (46.101.214.201): 36 Time(s)
root (163.172.167.225): 35 Time(s)
root (106.55.145.106): 32 Time(s)
root (221.181.185.143): 32 Time(s)
root (159.75.21.113): 31 Time(s)
unknown (112.64.52.87): 27 Time(s)
root (156.236.72.209): 26 Time(s)
unknown (68.183.188.159): 26 Time(s)
root (139.186.78.122): 24 Time(s)
root (152.32.214.84): 24 Time(s)
root (111.229.253.8): 22 Time(s)
root (152.136.134.77): 22 Time(s)
root (68.183.188.159): 22 Time(s)
unknown (139.186.78.122): 21 Time(s)
root (149.129.248.95): 20 Time(s)
root (42.193.127.186): 18 Time(s)
root (221.181.185.140): 16 Time(s)
root (218.109.145.152): 14 Time(s)
unknown (195.54.160.134): 14 Time(s)
root (111.204.204.72): 11 Time(s)
root (119.45.194.126): 11 Time(s)
root (165.22.179.40): 11 Time(s)
root (122.194.229.122): 10 Time(s)
root (106.53.92.85): 9 Time(s)
root (64.227.33.176): 9 Time(s)
root (140.143.206.191): 8 Time(s)
root (192.95.6.110): 8 Time(s)
root (211.251.239.72): 8 Time(s)
root (106.13.94.193): 7 Time(s)
root (106.54.71.95): 7 Time(s)
unknown (163.172.167.225): 7 Time(s)
root (104.248.198.248): 6 Time(s)
root (112.85.42.119): 6 Time(s)
root (165.22.73.254): 6 Time(s)
root (184-98-149-22.phnx.qwest.net): 6 Time(s)
root (67.237.200.107): 6 Time(s)
root (112.85.42.184): 5 Time(s)
root (139.199.123.152): 5 Time(s)
root (152.32.239.166): 5 Time(s)
root (37.152.181.144): 5 Time(s)
root (106.12.105.161): 3 Time(s)
root (140.143.208.113): 3 Time(s)
root (179.186.110.131): 3 Time(s)
root (195.54.160.134): 3 Time(s)
unknown (188.126.89.28): 3 Time(s)
unknown (27.70.134.169): 3 Time(s)
root (103.242.56.122): 2 Time(s)
root (129.213.185.254): 2 Time(s)
root (81.161.63.101): 2 Time(s)
root (vps-5ec26a50.vps.ovh.net): 2 Time(s)
unknown (171.235.62.33): 2 Time(s)
unknown (185.213.155.169): 2 Time(s)
unknown (86-90-56-34.fixed.kpn.net): 2 Time(s)
unknown (bxo172.neoplus.adsl.tpnet.pl): 2 Time(s)
unknown (cpe-90-157-222-183.static.amis.net): 2 Time(s)
unknown (lfbn-nic-1-295-248.w90-116.abo.wanadoo.fr): 2 Time(s)
root (103.10.87.54): 1 Time(s)
root (103.232.120.109): 1 Time(s)
root (103.253.200.161): 1 Time(s)
root (103.255.191.76): 1 Time(s)
root (104.248.118.63): 1 Time(s)
root (111.229.194.156): 1 Time(s)
root (111.231.195.159): 1 Time(s)
root (112.85.42.174): 1 Time(s)
root (119.45.162.248): 1 Time(s)
root (124.65.8.209): 1 Time(s)
root (128.199.95.60): 1 Time(s)
root (134.122.44.93): 1 Time(s)
root (140.143.239.86): 1 Time(s)
root (150.136.31.34): 1 Time(s)
root (150.136.40.83): 1 Time(s)
root (167.99.109.254): 1 Time(s)
root (170.106.159.113): 1 Time(s)
root (171.235.62.33): 1 Time(s)
root (171.244.139.236): 1 Time(s)
root (182.61.43.226): 1 Time(s)
root (192.141.107.58): 1 Time(s)
root (193.112.85.35): 1 Time(s)
root (202.155.211.226): 1 Time(s)
root (206.189.153.222): 1 Time(s)
root (222.232.29.235): 1 Time(s)
root (49.232.31.85): 1 Time(s)
root (49.247.204.78): 1 Time(s)
root (64.188.30.226): 1 Time(s)
root (81.70.153.152): 1 Time(s)
root (81.71.85.116): 1 Time(s)
root (ns3004023.ip-151-80-38.eu): 1 Time(s)
root (smartjomok.kg): 1 Time(s)
unknown (119.45.144.250): 1 Time(s)
Invalid Users:
Unknown Account: 114 Time(s)
---------------------- pam_unix End -------------------------
--------------------- Postfix Begin ------------------------
5 Miscellaneous warnings
18.215K Bytes accepted 18,652
18.215K Bytes sent via SMTP 18,652
======== ==================================================
1 Accepted 100.00%
-------- --------------------------------------------------
1 Total 100.00%
======== ==================================================
2 4xx Reject relay denied 100.00%
-------- --------------------------------------------------
2 Total 4xx Rejects 100.00%
======== ==================================================
319 Connections
4 Connections lost (inbound)
319 Disconnections
1 Removed from queue
1 Sent via SMTP
2 Hostname verification errors (FCRDNS)
---------------------- Postfix End -------------------------
--------------------- sendmail-largeboxes (large mail spool files) Begin
------------------------
Large Mailbox threshold: 40MB (41943040 bytes)
Warning: Large mailbox: mailman.gz (1747199807)
Warning: Large mailbox: mailman (235703599967)
---------------------- sendmail-largeboxes (large mail spool files) End
-------------------------
--------------------- SSHD Begin ------------------------
Disconnecting after too many authentication failures for user:
root : 6 Time(s)
Failed logins from:
27.50.164.117: 42 times
27.128.168.225: 46 times
27.148.165.23: 53 times
36.22.187.34: 51 times
37.152.181.144: 5 times
42.193.127.186: 18 times
46.101.214.201: 36 times
47.145.218.59: 59 times
49.232.31.85: 1 time
49.233.117.199: 68 times
49.247.204.78: 1 time
51.77.202.125 (125.ip-51-77-202.eu): 57 times
51.105.5.16: 60 times
51.178.43.9 (vps-ffcd362e.vps.ovh.net): 59 times
51.178.53.233 (vps-91e9c584.vps.ovh.net): 64 times
51.210.182.187 (vps-5ec26a50.vps.ovh.net): 2 times
51.254.37.156 (156.ip-51-254-37.eu): 62 times
51.254.37.237 (server1.milesdev.be): 63 times
61.174.171.62: 52 times
64.188.30.226 (64.188.30.226.static.quadranet.com): 1 time
64.227.33.176: 9 times
67.237.200.107 (tn-67-237-200-107.dhcp.embarqhsd.net): 6 times
68.183.188.159: 22 times
81.70.153.152: 1 time
81.71.85.116: 1 time
81.131.114.5 (host81-131-114-5.range81-131.btcentralplus.com): 65 times
81.156.142.165 (host81-156-142-165.range81-156.btcentralplus.com): 60 times
81.161.63.101: 2 times
86.61.66.59 (BSN-61-66-59.static.siol.net): 63 times
87.98.182.93 (ip93.ip-87-98-182.eu): 62 times
98.146.212.146 (cpe-98-146-212-146.natnow.res.rr.com): 51 times
101.32.34.76: 57 times
103.10.87.54: 1 time
103.232.120.109: 1 time
103.242.56.122: 2 times
103.253.200.161: 1 time
103.255.191.76: 1 time
104.131.40.97: 59 times
104.236.69.31: 44 times
104.248.118.63: 1 time
104.248.198.248: 6 times
106.12.16.82: 60 times
106.12.105.161: 3 times
106.12.185.16: 49 times
106.13.88.158: 46 times
106.13.94.193: 7 times
106.13.102.197: 62 times
106.53.92.85: 9 times
106.54.71.95: 7 times
106.55.145.106: 32 times
111.204.204.72: 11 times
111.229.194.156: 1 time
111.229.253.8: 22 times
111.229.253.130: 59 times
111.231.195.159: 1 time
112.85.42.119: 6 times
112.85.42.174: 2 times
112.85.42.184: 5 times
116.203.203.28 (static.28.203.203.116.clients.your-server.de): 41 times
118.25.91.168: 42 times
118.25.251.58: 71 times
118.140.205.198: 57 times
118.212.146.30 (30.146.212.118.adsl-pool.jx.chinaunicom.com): 39 times
119.28.51.32: 55 times
119.45.144.250: 61 times
119.45.162.248: 1 time
119.45.194.126: 11 times
119.45.243.74: 143 times
121.165.140.242: 55 times
122.194.229.122: 10 times
122.252.225.165: 51 times
123.206.216.65: 59 times
124.43.9.184: 60 times
124.65.8.209: 1 time
128.199.95.60: 1 time
128.199.177.224: 48 times
129.204.233.194: 47 times
129.213.185.254: 2 times
134.122.44.93: 1 time
138.197.151.129: 48 times
139.186.78.122: 24 times
139.199.123.152: 5 times
140.143.206.191: 8 times
140.143.208.113: 3 times
140.143.239.86: 1 time
142.93.195.157: 73 times
145.239.95.241 (241.ip-145-239-95.eu): 61 times
149.129.248.95: 20 times
150.95.25.165 (v150-95-25-165.a00a.g.bkk1.static.cnode.io): 50 times
150.136.31.34: 1 time
150.136.40.83: 1 time
151.80.38.19 (ns3004023.ip-151-80-38.eu): 1 time
152.32.214.84: 24 times
152.32.239.166: 5 times
152.136.134.77: 22 times
152.171.152.2 (2-152-171-152.fibertel.com.ar): 36 times
153.101.29.178: 53 times
154.8.192.65: 52 times
154.66.218.218: 48 times
156.236.72.209: 26 times
157.230.80.232: 39 times
159.75.21.113: 31 times
163.172.167.225 (225-167-172-163.instances.scw.cloud): 35 times
164.90.217.133: 62 times
165.22.22.250 (smartjomok.kg): 1 time
165.22.73.254: 6 times
165.22.179.40: 11 times
167.71.6.91: 60 times
167.71.99.196: 53 times
167.86.95.160 (vmi459537.contaboserver.net): 62 times
167.99.109.254: 1 time
167.99.167.135: 73 times
170.106.159.113: 1 time
171.235.62.33 (dynamic-adsl.viettel.vn): 1 time
171.244.139.236: 1 time
178.62.78.193: 44 times
178.62.117.106: 53 times
179.186.110.131: 3 times
182.61.43.226: 1 time
183.111.204.148: 55 times
184.98.149.22 (184-98-149-22.phnx.qwest.net): 6 times
185.188.127.107: 61 times
185.216.178.231 (nobody.yourvserver.net): 45 times
187.188.107.115 (fixed-187-188-107-115.totalplay.net): 54 times
188.166.23.215: 59 times
188.254.0.172: 42 times
189.254.242.60 (correo.capitaldezacatecas.gob.mx): 57 times
192.95.6.110 (sa.signifi.com): 8 times
192.141.107.58: 1 time
193.112.85.35: 1 time
195.54.160.134: 3 times
197.5.145.75: 63 times
200.91.160.238: 66 times
201.75.13.14 (c94b0d0e.virtua.com.br): 72 times
202.61.135.185: 56 times
202.155.211.226: 1 time
206.189.153.222: 1 time
206.189.234.238: 60 times
211.251.239.72: 8 times
212.95.137.19: 50 times
212.199.145.190 (190.145.199.212.in-addr.arpa): 55 times
218.75.121.74: 62 times
218.109.145.152: 14 times
220.171.93.62: 37 times
221.181.185.140: 18 times
221.181.185.141: 54 times
221.181.185.143: 36 times
222.187.238.87: 66 times
222.187.239.31: 69 times
222.232.29.235: 1 time
223.197.151.55 (223-197-151-55.static.imsbiz.com): 59 times
Illegal users from:
undef: 96 times
27.70.134.169 (localhost): 3 times
65.49.20.69 (scan-20.shadowserver.org): 1 time
68.183.188.159: 26 times
83.30.8.172 (bxo172.neoplus.adsl.tpnet.pl): 2 times
86.90.56.34 (86-90-56-34.fixed.kpn.net): 2 times
90.116.132.248 (lfbn-nic-1-295-248.w90-116.abo.wanadoo.fr): 2 times
90.157.222.183 (cpe-90-157-222-183.static.amis.net): 2 times
112.64.52.87: 27 times
119.45.144.250: 1 time
139.186.78.122: 21 times
163.172.167.225 (225-167-172-163.instances.scw.cloud): 7 times
171.235.62.33 (dynamic-adsl.viettel.vn): 2 times
185.213.155.169: 2 times
188.126.89.28: 3 times
195.54.160.134: 14 times
---------------------- SSHD End -------------------------
--------------------- Disk Space Begin ------------------------
Filesystem Size Used Avail Use% Mounted on
/dev/ploop47755p1 394G 243G 132G 65% /
none 4.0G 0 4.0G 0% /dev
---------------------- Disk Space End -------------------------
###################### Logwatch End #########################