04:42
################### Logwatch 7.4.0 (03/01/11) ####################
Processing Initiated: Sat Jan 8 04:42:04 2022
Date Range Processed: yesterday
( 2022-Jan-07 )
Period is day.
Detail Level of Output: 0
Type of Output/Format: mail / text
Logfiles for Host: h2361197.stratoserver.net
##################################################################
--------------------- fail2ban-messages Begin ------------------------
Banned services with Fail2Ban: Bans:Unbans
ssh: [ 22:22 ]
---------------------- fail2ban-messages End -------------------------
--------------------- httpd Begin ------------------------
Connection attempts using mod_proxy:
103.145.13.223 -> zapf.wiki:443: 1 Time(s)
A total of 6 sites probed the server
103.156.91.51
172.104.131.24
45.134.144.108
46.101.90.119
5.62.16.22
68.183.44.92
Requests with error response codes
400 Bad Request
null: 7 Time(s)
/: 3 Time(s)
/cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh: 3 Time(s)
/phpmyadmin/scripts/setup.php: 3 Time(s)
mstshash=Administr: 2 Time(s)
mstshash=Domain: 2 Time(s)
/55636784: 1 Time(s)
/ab2g: 1 Time(s)
/ab2h: 1 Time(s)
/favicon.ico: 1 Time(s)
/w00tw00t.at.ISC.SANS.DFind:): 1 Time(s)
/web/1000(a)/wmLogin.html: 1 Time(s)
zapf.wiki:443: 1 Time(s)
500 Internal Server Error
/: 23 Time(s)
/.env: 3 Time(s)
/Autodiscover/Autodiscover.xml: 2 Time(s)
/_ignition/execute-solution: 2 Time(s)
/ecp/Current/exporttool/microsoft.exchange ... ool.application: 2 Time(s)
/robots.txt: 2 Time(s)
/.git/config: 1 Time(s)
///remote/fgt_lang?lang=/../../../..//////////dev/: 1 Time(s)
/?XDEBUG_SESSION_START=phpstorm: 1 Time(s)
/actuator/health: 1 Time(s)
/console/: 1 Time(s)
/favicon.ico: 1 Time(s)
/owa/auth/logon.aspx: 1 Time(s)
/owa/auth/logon.aspx?url=https%3a%2f%2f1%2fecp%2f: 1 Time(s)
/owa/auth/x.js: 1 Time(s)
/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php: 1 Time(s)
---------------------- httpd End -------------------------
--------------------- pam_unix Begin ------------------------
sshd:
Authentication Failures:
root (1.15.102.211): 40 Time(s)
root (180.97.195.39): 38 Time(s)
root (211.219.114.39): 38 Time(s)
root (111.229.187.216): 35 Time(s)
root (static-201-151-6-30.alestra.net.mx): 30 Time(s)
root (83.135.97.46): 29 Time(s)
root (103.123.25.48): 26 Time(s)
root (103.219.204.75): 17 Time(s)
root (198.23.233.28): 17 Time(s)
unknown (83.135.97.46): 17 Time(s)
unknown (static-201-151-6-30.alestra.net.mx): 16 Time(s)
root (219.147.74.48): 15 Time(s)
unknown (111.229.187.216): 15 Time(s)
root (154.83.14.152): 13 Time(s)
unknown (103.123.25.48): 12 Time(s)
unknown (180.97.195.39): 12 Time(s)
unknown (211.219.114.39): 12 Time(s)
unknown (1.15.102.211): 10 Time(s)
unknown (154.83.14.152): 8 Time(s)
unknown (103.219.204.75): 7 Time(s)
unknown (198.23.233.28): 7 Time(s)
root (103.28.52.93): 6 Time(s)
root (185.100.87.133): 6 Time(s)
root (185.191.127.231): 6 Time(s)
root (91.149.225.120): 6 Time(s)
root (djb.tor-exit.calyxinstitute.org): 6 Time(s)
root (tor-exit-1.privacy.gd): 6 Time(s)
unknown (219.147.74.48): 6 Time(s)
root (117.111.1.192): 4 Time(s)
root (211.36.141.208): 4 Time(s)
root (113.102.207.178): 3 Time(s)
root (41.215.138.42): 3 Time(s)
root (113.102.204.107): 2 Time(s)
root (113.102.206.53): 2 Time(s)
root (113.102.206.99): 2 Time(s)
root (113.102.207.163): 2 Time(s)
root (113.102.207.45): 2 Time(s)
root (14.221.4.113): 2 Time(s)
root (61.133.122.19): 2 Time(s)
unknown (115.202.50.91): 2 Time(s)
unknown (194.61.26.214): 2 Time(s)
unknown (211.211.52.80): 2 Time(s)
unknown (220.71.14.244): 2 Time(s)
unknown (62.83.162.43.dyn.user.ono.com): 2 Time(s)
unknown (91.100.12.136.generic-hostname.arrownet.dk): 2 Time(s)
unknown (amontpellier-556-1-311-38.w81-251.abo.wanadoo.fr): 2 Time(s)
unknown (funeda.pl): 2 Time(s)
postgres (static-201-151-6-30.alestra.net.mx): 1 Time(s)
root (103.133.57.250): 1 Time(s)
root (112.10.97.106): 1 Time(s)
root (112.18.69.127): 1 Time(s)
root (113.102.204.111): 1 Time(s)
root (113.102.204.128): 1 Time(s)
root (113.102.204.157): 1 Time(s)
root (113.102.204.179): 1 Time(s)
root (113.102.205.14): 1 Time(s)
root (113.102.205.149): 1 Time(s)
root (113.102.205.153): 1 Time(s)
root (113.102.205.45): 1 Time(s)
root (113.102.205.53): 1 Time(s)
root (113.102.206.136): 1 Time(s)
root (113.102.206.164): 1 Time(s)
root (113.102.206.83): 1 Time(s)
root (113.102.207.114): 1 Time(s)
root (113.102.207.123): 1 Time(s)
root (113.102.207.20): 1 Time(s)
root (113.102.207.25): 1 Time(s)
root (113.78.112.175): 1 Time(s)
root (113.78.112.204): 1 Time(s)
root (113.78.115.202): 1 Time(s)
root (14.221.5.146): 1 Time(s)
root (194.61.26.214): 1 Time(s)
root (20.197.177.161): 1 Time(s)
root (202.86.139.109): 1 Time(s)
root (222.90.31.185): 1 Time(s)
unknown (113.102.204.111): 1 Time(s)
unknown (113.102.204.203): 1 Time(s)
unknown (113.102.205.149): 1 Time(s)
unknown (113.102.205.197): 1 Time(s)
unknown (113.102.205.53): 1 Time(s)
unknown (113.102.205.85): 1 Time(s)
unknown (113.102.207.132): 1 Time(s)
unknown (113.102.207.217): 1 Time(s)
unknown (117.111.1.192): 1 Time(s)
unknown (211.36.141.208): 1 Time(s)
unknown (92.255.85.237): 1 Time(s)
Invalid Users:
Unknown Account: 149 Time(s)
---------------------- pam_unix End -------------------------
--------------------- Postfix Begin ------------------------
3 Miscellaneous warnings
10.394K Bytes accepted 10,643
10.394K Bytes sent via SMTP 10,643
======== ==================================================
1 Accepted 100.00%
-------- --------------------------------------------------
1 Total 100.00%
======== ==================================================
4 4xx Reject relay denied 100.00%
-------- --------------------------------------------------
4 Total 4xx Rejects 100.00%
======== ==================================================
62 Connections
7 Connections lost (inbound)
62 Disconnections
1 Removed from queue
1 Sent via SMTP
1 Hostname verification errors (FCRDNS)
---------------------- Postfix End -------------------------
--------------------- sendmail-largeboxes (large mail spool files) Begin
------------------------
Large Mailbox threshold: 40MB (41943040 bytes)
Warning: Large mailbox: mailman.gz (1747199807)
Warning: Large mailbox: mailman (235703599967)
---------------------- sendmail-largeboxes (large mail spool files) End
-------------------------
--------------------- SSHD Begin ------------------------
Disconnecting after too many authentication failures for user:
root : 6 Time(s)
Failed logins from:
1.15.102.211: 40 times
14.221.4.113: 2 times
14.221.5.146: 1 time
20.197.177.161: 1 time
41.215.138.42: 3 times
61.133.122.19: 2 times
83.135.97.46: 29 times
91.149.225.120: 6 times
103.28.52.93 (ip93.52.28.103.in-addr.arpa.unknwn.cloudhost.asia): 6 times
103.123.25.48 (host-103-123-25-48.pky.kalteng.go.id): 26 times
103.133.57.250: 1 time
103.219.204.75: 17 times
104.192.3.118 (tor-exit-1.privacy.gd): 6 times
111.229.187.216: 35 times
112.10.97.106: 1 time
112.18.69.127: 1 time
113.78.112.175: 1 time
113.78.112.204: 1 time
113.78.115.202: 1 time
113.102.204.107: 2 times
113.102.204.111: 1 time
113.102.204.128: 1 time
113.102.204.157: 1 time
113.102.204.179: 1 time
113.102.205.14: 1 time
113.102.205.45: 1 time
113.102.205.53: 1 time
113.102.205.149: 1 time
113.102.205.153: 1 time
113.102.206.53: 2 times
113.102.206.83: 1 time
113.102.206.99: 2 times
113.102.206.136: 1 time
113.102.206.164: 1 time
113.102.207.20: 1 time
113.102.207.25: 1 time
113.102.207.45: 2 times
113.102.207.114: 1 time
113.102.207.123: 1 time
113.102.207.163: 2 times
113.102.207.178: 3 times
117.111.1.192: 4 times
154.83.14.152: 13 times
162.247.74.202 (djb.tor-exit.calyxinstitute.org): 6 times
180.97.195.39: 38 times
185.100.87.133: 6 times
185.191.127.231: 6 times
194.61.26.214: 1 time
198.23.233.28 (198-23-233-28-host.colocrossing.com): 17 times
201.151.6.30 (static-201-151-6-30.alestra.net.mx): 31 times
202.86.139.109 (n20286z139l109.static.ctmip.net): 1 time
211.36.141.208: 4 times
211.219.114.39: 38 times
219.147.74.48: 15 times
222.90.31.185: 1 time
Illegal users from:
2001:470:1:c84::14: 1 time
undef: 90 times
1.15.102.211: 10 times
46.101.148.71 (funeda.pl): 2 times
62.83.162.43 (62.83.162.43.dyn.user.ono.com): 2 times
64.62.197.212: 1 time
81.251.55.38 (amontpellier-556-1-311-38.w81-251.abo.wanadoo.fr): 2 times
83.135.97.46: 17 times
91.100.12.136 (91.100.12.136.generic-hostname.arrownet.dk): 2 times
92.255.85.237: 1 time
103.123.25.48 (host-103-123-25-48.pky.kalteng.go.id): 12 times
103.219.204.75: 7 times
111.229.187.216: 15 times
113.102.204.111: 1 time
113.102.204.203: 1 time
113.102.205.53: 1 time
113.102.205.85: 1 time
113.102.205.149: 1 time
113.102.205.197: 1 time
113.102.207.132: 1 time
113.102.207.217: 1 time
115.202.50.91: 2 times
117.111.1.192: 1 time
154.83.14.152: 8 times
154.89.5.75: 1 time
180.97.195.39: 12 times
194.61.26.214: 3 times
198.23.233.28 (198-23-233-28-host.colocrossing.com): 7 times
201.151.6.30 (static-201-151-6-30.alestra.net.mx): 16 times
211.36.141.208: 1 time
211.211.52.80: 2 times
211.219.114.39: 12 times
219.147.74.48: 6 times
220.71.14.244: 2 times
---------------------- SSHD End -------------------------
--------------------- Disk Space Begin ------------------------
Filesystem Size Used Avail Use% Mounted on
/dev/ploop33257p1 394G 242G 132G 65% /
none 4.0G 0 4.0G 0% /dev
---------------------- Disk Space End -------------------------
###################### Logwatch End #########################