04:42
################### Logwatch 7.4.0 (03/01/11) ####################
Processing Initiated: Thu Jul 8 04:42:05 2021
Date Range Processed: yesterday
( 2021-Jul-07 )
Period is day.
Detail Level of Output: 0
Type of Output/Format: mail / text
Logfiles for Host: h2361197.stratoserver.net
##################################################################
--------------------- fail2ban-messages Begin ------------------------
Banned services with Fail2Ban: Bans:Unbans
ssh: [240:240]
---------------------- fail2ban-messages End -------------------------
--------------------- httpd Begin ------------------------
A total of 8 sites probed the server
101.187.147.238
103.232.53.229
139.162.145.250
161.35.230.3
167.71.102.181
209.141.41.98
49.51.232.64
62.171.133.153
Requests with error response codes
400 Bad Request
/: 45 Time(s)
null: 8 Time(s)
/static/../../../a/../../../../etc/passwd: 2 Time(s)
/_next/../../../../../../../../../../etc/passwd: 1 Time(s)
/admin/config.php: 1 Time(s)
/node_modules/../../../../../etc/passwd: 1 Time(s)
/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/: 1 Time(s)
\xB3;p3`\xFE\xBEr\x8CUS\xEE\xE45!\xDDr.\xF ... xC5\xD6\x09\xF1: 1 Time(s)
\xB9\xDB\x0CEN#5h[\xE4\xC5\x16\xF7wBr=\xB1: 1 Time(s)
\xBF\x02\x00\x88\x13\x00\x00\x87\x00\x00\x ... 0\x00/\x9E\x16E: 1 Time(s)
\xEC\xF7\x14\xD3\xEA\xBA\xB4T!\xF6{\x02\x8 ... x09\xC0\x14\xC0: 1 Time(s)
http://fuwu.sogou.com/404/index.html: 1 Time(s)
403 Forbidden
/resolutionen/wise17/Zwangsexmatrikulation/: 1 Time(s)
404 Not Found
/robots.txt: 28 Time(s)
/.env: 3 Time(s)
/.well-known/security.txt: 2 Time(s)
/security.txt: 2 Time(s)
/wp-login.php: 2 Time(s)
//.env: 1 Time(s)
//vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php: 1 Time(s)
/ads.txt: 1 Time(s)
/berlin/apple-touch-icon.png: 1 Time(s)
/berlin/orientierung/apple-touch-icon.png: 1 Time(s)
/neuigkeiten/einladung-mgv-ss2011: 1 Time(s)
/sites/all/libraries/elfinder/connectors/php/connector.php: 1 Time(s)
/sites/all/libraries/elfinder/src/connecto ... p/connector.php: 1 Time(s)
/sites/all/libraries/plupload/examples/upload.php: 1 Time(s)
/sites/default/files/1999_SoSe_Karlsruhe.pdf: 1 Time(s)
/sites/default/files/Empfehlungen_der_ZaPF ... 7CStellungnahme: 1 Time(s)
/user: 1 Time(s)
/verein/zqxjGKEYDHAtnv.html: 1 Time(s)
/wp-admin/upload_index.php?auth=hash: 1 Time(s)
/wp-content/: 1 Time(s)
/wp-includes/upload_index.php?auth=hash: 1 Time(s)
/xmlrpc.php: 1 Time(s)
/zapf/reader/2018_WiSe_Wuerzburg: 1 Time(s)
/zapf/zqxjGKEYDHAtnv.html: 1 Time(s)
/zqxjGKEYDHAtnv.html: 1 Time(s)
405 Method Not Allowed
/: 1 Time(s)
500 Internal Server Error
/: 34 Time(s)
/.env: 5 Time(s)
/.git/config: 2 Time(s)
//: 2 Time(s)
/admin/config.php: 2 Time(s)
/favicon.ico: 2 Time(s)
/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php: 2 Time(s)
//a2billing/customer/templates/default/footer.tpl: 1 Time(s)
/?XDEBUG_SESSION_START=phpstorm: 1 Time(s)
/HNAP1/: 1 Time(s)
/actuator/health: 1 Time(s)
/admin/connection/: 1 Time(s)
/api/jsonws/invoke: 1 Time(s)
/console/: 1 Time(s)
/ecp/Current/exporttool/microsoft.exchange ... ool.application: 1 Time(s)
/index.php?s=/Index/\x5Cthink\x5Capp/invok ... HelloThinkPHP21: 1 Time(s)
/mifs/.;/services/LogService: 1 Time(s)
/owa/: 1 Time(s)
/owa/auth/logon.aspx?url=https%3a%2f%2f1%2fecp%2f: 1 Time(s)
/robots.txt: 1 Time(s)
---------------------- httpd End -------------------------
--------------------- pam_unix Begin ------------------------
sshd:
Authentication Failures:
root (128.199.171.106): 71 Time(s)
root (103.119.92.107): 70 Time(s)
root (104.131.167.203): 70 Time(s)
root (119.28.62.229): 70 Time(s)
root (119.65.3.170): 70 Time(s)
root (128.199.90.73): 70 Time(s)
root (129.205.124.253): 70 Time(s)
root (194.5.178.182): 70 Time(s)
root (27.111.44.196): 70 Time(s)
root (111.230.136.231): 69 Time(s)
root (115.220.2.6): 69 Time(s)
root (128.199.177.224): 69 Time(s)
root (39.109.122.82): 69 Time(s)
root (106.13.181.104): 65 Time(s)
root (120.48.25.245): 55 Time(s)
root (119.29.155.249): 51 Time(s)
root (119.194.242.212): 50 Time(s)
root (120.31.71.238): 50 Time(s)
root (134.17.5.55): 50 Time(s)
root (159.203.111.100): 50 Time(s)
root (167.99.75.240): 50 Time(s)
root (177.1.213.19): 50 Time(s)
root (178.128.254.128): 50 Time(s)
root (180.76.161.127): 50 Time(s)
root (212.129.236.203): 50 Time(s)
root (42.193.179.232): 50 Time(s)
root (45.119.215.150): 50 Time(s)
root (49.51.182.144): 50 Time(s)
root (81.68.93.27): 50 Time(s)
root (122.51.154.84): 48 Time(s)
root (134.209.107.228): 48 Time(s)
root (150.158.4.230): 46 Time(s)
root (89.163.224.65): 46 Time(s)
root (138.128.216.220.16clouds.com): 43 Time(s)
root (159.89.105.53): 42 Time(s)
root (198.211.121.90): 42 Time(s)
root (85.105.174.22): 41 Time(s)
root (106.52.63.234): 40 Time(s)
root (betalweqayah.online): 40 Time(s)
root (156.236.71.248): 38 Time(s)
root (111.67.207.156): 37 Time(s)
root (13.74.46.65): 37 Time(s)
root (180.96.63.162): 37 Time(s)
root (106.54.92.36): 36 Time(s)
root (49.234.71.65): 35 Time(s)
root (120.92.94.76): 31 Time(s)
root (14.63.162.98): 31 Time(s)
root (118.212.146.44): 30 Time(s)
root (134.122.89.249): 30 Time(s)
root (182.61.147.176): 29 Time(s)
root (103.205.7.83): 28 Time(s)
root (121.4.164.75): 28 Time(s)
root (172.81.212.47): 27 Time(s)
root (20.83.32.5): 27 Time(s)
root (201.149.20.162): 25 Time(s)
unknown (109.188.86.174): 24 Time(s)
root (106.55.236.107): 23 Time(s)
unknown (196.12.143.54): 23 Time(s)
unknown (1.15.220.145): 22 Time(s)
unknown (141.98.10.203): 21 Time(s)
unknown (45.146.166.238): 21 Time(s)
root (200.146.197.198): 20 Time(s)
unknown (139.186.134.246): 20 Time(s)
unknown (210.91.16.39): 20 Time(s)
unknown (014136104038.ctinets.com): 19 Time(s)
unknown (122.176.79.222): 19 Time(s)
unknown (202.101.2.134): 19 Time(s)
unknown (81.68.142.128): 19 Time(s)
unknown (81.69.11.51): 19 Time(s)
unknown (dynamic-adsl-84-220-240-168.clienti.tiscali.it): 19 Time(s)
root (112.94.9.81): 18 Time(s)
root (42.193.101.249): 18 Time(s)
unknown (185.136.85.115): 18 Time(s)
unknown (134.175.240.28): 17 Time(s)
unknown (188.166.151.44): 17 Time(s)
unknown (190.9.132.186): 17 Time(s)
unknown (49.232.194.141): 17 Time(s)
unknown (101.32.243.13): 16 Time(s)
unknown (host-186-4-222-45.netlife.ec): 16 Time(s)
root (122.114.78.190): 14 Time(s)
unknown (115.159.212.30): 14 Time(s)
root (65.49.198.145): 13 Time(s)
unknown (106.75.224.132): 12 Time(s)
unknown (node-fxq.pool-1-0.dynamic.totinternet.net): 12 Time(s)
root (188.166.151.44): 11 Time(s)
root (109.188.86.174): 10 Time(s)
root (49.232.194.141): 10 Time(s)
unknown (141.98.10.179): 9 Time(s)
root (101.32.243.13): 8 Time(s)
root (165.232.105.80): 8 Time(s)
root (190.9.132.186): 8 Time(s)
root (87.241.1.186): 7 Time(s)
root (185.136.85.115): 6 Time(s)
root (202.101.2.134): 6 Time(s)
root (81.68.142.128): 6 Time(s)
root (app1.qbmatic.com): 6 Time(s)
unknown (45.135.232.165): 6 Time(s)
root (014136104038.ctinets.com): 5 Time(s)
root (139.186.134.246): 5 Time(s)
root (196.12.143.54): 5 Time(s)
root (45.146.166.238): 5 Time(s)
root (dynamic-adsl-84-220-240-168.clienti.tiscali.it): 5 Time(s)
unknown (195.133.40.104): 5 Time(s)
root (134.175.240.28): 4 Time(s)
unknown (107.189.3.151): 4 Time(s)
root (106.75.224.132): 3 Time(s)
root (115.159.212.30): 3 Time(s)
root (122.176.79.222): 3 Time(s)
root (210.91.16.39): 3 Time(s)
root (host-186-4-222-45.netlife.ec): 3 Time(s)
unknown (141.98.10.29): 3 Time(s)
unknown (205.185.117.79): 3 Time(s)
unknown (205.185.125.109): 3 Time(s)
unknown (209.97.141.112): 3 Time(s)
unknown (51.15.197.4): 3 Time(s)
unknown (app1.qbmatic.com): 3 Time(s)
root (1.15.220.145): 2 Time(s)
root (45.55.237.182): 2 Time(s)
root (81.69.11.51): 2 Time(s)
unknown (136.144.41.41): 2 Time(s)
unknown (143.92.131.114): 2 Time(s)
unknown (173-31-179-82.client.mchsi.com): 2 Time(s)
unknown (193.169.252.151): 2 Time(s)
unknown (45.146.165.72): 2 Time(s)
unknown (cpe-24-210-157-131.cinci.res.rr.com): 2 Time(s)
daemon (014136104038.ctinets.com): 1 Time(s)
games (81.68.142.128): 1 Time(s)
mysql (101.32.243.13): 1 Time(s)
mysql (210.91.16.39): 1 Time(s)
news (81.69.11.51): 1 Time(s)
postgres (014136104038.ctinets.com): 1 Time(s)
postgres (1.15.220.145): 1 Time(s)
postgres (dynamic-adsl-84-220-240-168.clienti.tiscali.it): 1 Time(s)
root (103.141.105.146): 1 Time(s)
root (119.45.182.212): 1 Time(s)
root (120.239.196.121): 1 Time(s)
root (185.100.87.202): 1 Time(s)
root (188.166.212.31): 1 Time(s)
root (195.154.35.52): 1 Time(s)
root (31.42.176.55): 1 Time(s)
root (51.15.197.4): 1 Time(s)
root (66.230.230.230): 1 Time(s)
root (69-172-87-212.static.imsbiz.com): 1 Time(s)
root (tor-exit5-readme.dfri.se): 1 Time(s)
sshd (45.146.165.72): 1 Time(s)
sshd (45.146.166.238): 1 Time(s)
unknown (181.16.22.165): 1 Time(s)
unknown (195.133.40.46): 1 Time(s)
unknown (198.98.62.88): 1 Time(s)
www-data (185.136.85.115): 1 Time(s)
Invalid Users:
Unknown Account: 478 Time(s)
---------------------- pam_unix End -------------------------
--------------------- Postfix Begin ------------------------
8 Miscellaneous warnings
19.385K Bytes accepted 19,850
19.385K Bytes sent via SMTP 19,850
======== ==================================================
1 Accepted 100.00%
-------- --------------------------------------------------
1 Total 100.00%
======== ==================================================
5 4xx Reject relay denied 100.00%
-------- --------------------------------------------------
5 Total 4xx Rejects 100.00%
======== ==================================================
799 Connections
664 Connections lost (inbound)
799 Disconnections
1 Removed from queue
1 Sent via SMTP
49 Hostname verification errors (FCRDNS)
---------------------- Postfix End -------------------------
--------------------- sendmail-largeboxes (large mail spool files) Begin
------------------------
Large Mailbox threshold: 40MB (41943040 bytes)
Warning: Large mailbox: mailman.gz (1747199807)
Warning: Large mailbox: mailman (235703599967)
---------------------- sendmail-largeboxes (large mail spool files) End
-------------------------
--------------------- SSHD Begin ------------------------
Disconnecting after too many authentication failures for user:
root : 1 Time(s)
Failed logins from:
1.15.220.145: 3 times
13.74.46.65: 37 times
14.63.162.98: 31 times
14.136.104.38 (014136104038.ctinets.com): 7 times
20.83.32.5: 27 times
27.111.44.196: 70 times
31.42.176.55 (my.tor.exit): 1 time
39.109.122.82: 69 times
42.193.101.249: 18 times
42.193.179.232: 50 times
45.55.237.182: 2 times
45.119.215.150: 50 times
45.146.165.72: 1 time
45.146.166.238: 6 times
49.51.182.144: 50 times
49.232.194.141: 10 times
49.234.71.65: 35 times
51.15.197.4 (4-197-15-51.instances.scw.cloud): 1 time
65.49.198.145 (localhost.localdomain): 13 times
66.230.230.230: 1 time
69.172.87.212 (69-172-87-212.static.imsbiz.com): 1 time
81.68.93.27: 50 times
81.68.142.128: 7 times
81.69.11.51: 3 times
84.220.240.168 (dynamic-adsl-84-220-240-168.clienti.tiscali.it): 6 times
85.105.174.22 (85.105.174.22.static.ttnet.com.tr): 41 times
87.241.1.186: 7 times
89.163.224.65: 46 times
101.32.243.13: 9 times
103.119.92.107: 70 times
103.141.105.146: 1 time
103.205.7.83: 28 times
104.131.167.203: 70 times
106.13.181.104: 65 times
106.52.63.234: 40 times
106.54.92.36: 36 times
106.55.236.107: 23 times
106.75.224.132: 3 times
109.188.86.174 (wimax-client.yota.ru): 10 times
111.67.207.156: 37 times
111.230.136.231: 69 times
112.94.9.81: 18 times
115.159.212.30: 3 times
115.220.2.6: 69 times
118.212.146.44 (44.146.212.118.adsl-pool.jx.chinaunicom.com): 30 times
119.28.62.229: 70 times
119.29.155.249: 51 times
119.45.182.212: 1 time
119.65.3.170: 70 times
119.194.242.212: 50 times
120.31.71.238 (ns2.eflydns.net): 50 times
120.48.25.245: 55 times
120.92.94.76: 31 times
120.239.196.121: 1 time
121.4.164.75: 28 times
122.51.154.84: 48 times
122.114.78.190: 14 times
122.176.79.222 (abts-north-static-222.79.176.122.airtelbroadband.in): 3 times
128.199.90.73: 70 times
128.199.154.15 (app1.qbmatic.com): 6 times
128.199.171.106: 71 times
128.199.177.224: 69 times
129.205.124.253: 70 times
134.17.5.55 (55-5-17-134-dynamic-pool.internet.mts.by): 50 times
134.122.89.249: 30 times
134.175.240.28: 4 times
134.209.107.228: 48 times
138.128.216.220 (138.128.216.220.16clouds.com): 43 times
139.186.134.246: 5 times
150.158.4.230: 46 times
156.236.71.248: 38 times
159.89.105.53: 42 times
159.203.111.100: 50 times
165.232.105.80 (health-hub.ie): 8 times
167.99.75.240: 50 times
171.25.193.25 (tor-exit5-readme.dfri.se): 1 time
172.81.212.47: 27 times
177.1.213.19: 50 times
178.128.254.128: 50 times
180.76.161.127: 50 times
180.96.63.162: 37 times
182.61.147.176: 29 times
185.100.87.202: 1 time
185.136.85.115 (server.egebzenakliyat.com): 7 times
186.4.222.45 (host-186-4-222-45.netlife.ec): 3 times
188.166.151.44: 11 times
188.166.212.31: 1 time
190.9.132.186 (190.9-132-186.static.cantv.net): 8 times
194.5.178.182: 70 times
195.154.35.52 (195-154-35-52.rev.poneytelecom.eu): 1 time
196.12.143.54: 5 times
198.211.121.90: 42 times
200.146.197.198 (200-146-197-198.static.ctbctelecom.com.br): 20 times
201.149.20.162 (162.20.149.201.in-addr.arpa): 25 times
202.101.2.134: 6 times
207.154.228.201 (betalweqayah.online): 40 times
210.91.16.39: 4 times
212.129.236.203: 50 times
Illegal users from:
undef: 282 times
1.0.208.174 (node-fxq.pool-1-0.dynamic.totinternet.net): 15 times
1.15.220.145: 22 times
14.136.104.38 (014136104038.ctinets.com): 19 times
24.210.157.131 (cpe-24-210-157-131.cinci.res.rr.com): 2 times
45.135.232.165: 6 times
45.146.165.72: 2 times
45.146.166.238: 21 times
49.232.194.141: 17 times
51.15.197.4 (4-197-15-51.instances.scw.cloud): 3 times
65.49.20.69 (scan-20.shadowserver.org): 1 time
81.68.142.128: 19 times
81.69.11.51: 19 times
84.220.240.168 (dynamic-adsl-84-220-240-168.clienti.tiscali.it): 19 times
101.32.243.13: 16 times
106.75.224.132: 12 times
107.189.3.151: 4 times
109.188.86.174 (wimax-client.yota.ru): 24 times
115.159.212.30: 14 times
122.176.79.222 (abts-north-static-222.79.176.122.airtelbroadband.in): 19 times
128.199.154.15 (app1.qbmatic.com): 3 times
134.175.240.28: 17 times
136.144.41.41: 2 times
139.186.134.246: 20 times
141.98.10.29: 3 times
141.98.10.179 (er.includeswitche.com): 9 times
141.98.10.203: 21 times
143.92.131.114: 2 times
154.89.5.18: 1 time
173.31.179.82 (173-31-179-82.client.mchsi.com): 2 times
181.16.22.165 (host-181-16-22-165.telered.com.ar): 1 time
185.136.85.115 (server.egebzenakliyat.com): 18 times
186.4.222.45 (host-186-4-222-45.netlife.ec): 16 times
188.166.151.44: 17 times
190.9.132.186 (190.9-132-186.static.cantv.net): 17 times
193.169.252.151: 2 times
195.133.40.46: 1 time
195.133.40.104: 5 times
196.12.143.54: 23 times
198.98.62.88: 1 time
202.101.2.134: 19 times
205.185.117.79: 3 times
205.185.125.109: 3 times
209.97.141.112 (abrus.cloud): 3 times
210.91.16.39: 20 times
**Unmatched Entries**
fatal: no matching cipher found: client aes128-cbc,blowfish-cbc,3des-cbc server
aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com
[preauth] : 14 time(s)
---------------------- SSHD End -------------------------
--------------------- Disk Space Begin ------------------------
Filesystem Size Used Avail Use% Mounted on
/dev/ploop23974p1 394G 242G 132G 65% /
none 4.0G 0 4.0G 0% /dev
---------------------- Disk Space End -------------------------
###################### Logwatch End #########################
1566
days inactive
1566
days old
0 comments
1 participants
participants (1)
-
root＠zapf.in