################### Logwatch 7.4.0 (03/01/11) #################### Processing Initiated: Mon Jul 5 04:42:05 2021 Date Range Processed: yesterday ( 2021-Jul-04 ) Period is day. Detail Level of Output: 0 Type of Output/Format: mail / text Logfiles for Host: h2361197.stratoserver.net ################################################################## --------------------- fail2ban-messages Begin ------------------------ Banned services with Fail2Ban: Bans:Unbans ssh: [332:324] ---------------------- fail2ban-messages End ------------------------- --------------------- httpd Begin ------------------------ Connection attempts using mod_proxy: 158.51.126.242 -> httpbin.org:443: 1 Time(s) A total of 3 sites probed the server 138.68.175.207 162.62.123.46 76.72.172.168 Requests with error response codes 400 Bad Request /: 3 Time(s) /config/getuser?index=0: 3 Time(s) null: 3 Time(s) /URoG: 1 Time(s) /admin/config.php: 1 Time(s) /manager/text/list: 1 Time(s) /w00tw00t.at.ISC.SANS.DFind:): 1 Time(s) httpbin.org:443: 1 Time(s) mstshash=Administr: 1 Time(s) 404 Not Found /robots.txt: 29 Time(s) /.env: 1 Time(s) /.git/config: 1 Time(s) /.well-known/acme-challenge/%3C%3fxml%20ve ... %3C/x:script%3E: 1 Time(s) //wp-admin/admin-ajax.php?action=_ning_upload_image: 1 Time(s) /administrator/editor/filemanager/browser/ ... rrentFolder=%2F: 1 Time(s) /home/verein: 1 Time(s) /home/zapf: 1 Time(s) /includes/editor/filemanager/browser/defau ... rrentFolder=%2F: 1 Time(s) /protokolle/Ergebnisprotokoll_MV_09.06.2017.pdf: 1 Time(s) /reader/2016_SoSe_Konstanz_lang.pdf%7CLangversion: 1 Time(s) /resolutionen/wise15/Transparenz_in_der_: 1 Time(s) /resolutionen/wise17/pruefungsunfaehigkeit ... scheinigung.pdf: 1 Time(s) /sites/default/files/2010_SoSe_Frankfurt.pdf: 1 Time(s) /sites/default/files/Empfehlungen_der_ZaPF ... 7CStellungnahme: 1 Time(s) /user: 1 Time(s) /vendor/phpunit/phpunit/LICENSE: 1 Time(s) /vendor/phpunit/phpunit/src/Util/PHP/: 1 Time(s) /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php: 1 Time(s) /verein/satzung/%7CSatzung: 1 Time(s) /wp-login.php: 1 Time(s) 499 (undefined) /build/260ef443edb4dfd026d82e2b21a4c75c.woff: 3 Time(s) /build/emojify.js/dist/images/basic/smile.png: 1 Time(s) /favicon.png: 1 Time(s) /fonts/SourceSansPro-Regular.woff: 1 Time(s) 500 Internal Server Error /: 26 Time(s) /.env: 4 Time(s) //: 2 Time(s) /admin/config.php: 2 Time(s) /robots.txt: 2 Time(s) /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php: 2 Time(s) /?XDEBUG_SESSION_START=phpstorm: 1 Time(s) /Autodiscover/Autodiscover.xml: 1 Time(s) /Telerik.Web.UI.WebResource.axd?type=rau: 1 Time(s) /_ignition/execute-solution: 1 Time(s) /api/jsonws/invoke: 1 Time(s) /bag2: 1 Time(s) /console/: 1 Time(s) /ecp/Current/exporttool/microsoft.exchange ... ool.application: 1 Time(s) /index.php?s=/Index/\x5Cthink\x5Capp/invok ... HelloThinkPHP21: 1 Time(s) /mifs/.;/services/LogService: 1 Time(s) /owa/: 1 Time(s) /owa/auth/logon.aspx?url=https%3a%2f%2f1%2fecp%2f: 1 Time(s) /remote/login: 1 Time(s) /wp-content/plugins/wp-file-manager/readme.txt: 1 Time(s) ---------------------- httpd End ------------------------- --------------------- pam_unix Begin ------------------------ sshd: Authentication Failures: root (111.230.233.68): 70 Time(s) root (134.122.121.218): 70 Time(s) root (139.59.235.24): 70 Time(s) root (143.110.188.7): 70 Time(s) root (159.89.53.183): 70 Time(s) root (168.187.77.177): 70 Time(s) root (221.231.9.138): 70 Time(s) root (42.193.55.36): 70 Time(s) root (49.51.138.189): 70 Time(s) root (43.128.73.248): 69 Time(s) root (106.52.195.43): 67 Time(s) root (188.166.229.193): 65 Time(s) root (49.234.59.246): 65 Time(s) root (81.70.161.94): 64 Time(s) root (139.155.83.6): 63 Time(s) root (132.232.108.149): 61 Time(s) root (81.68.243.3): 57 Time(s) root (159.89.226.114): 55 Time(s) root (125.99.46.50): 50 Time(s) root (139.155.232.195): 50 Time(s) root (175.118.152.100): 50 Time(s) root (179.127.167.201): 50 Time(s) root (45.163.189.10): 50 Time(s) root (45.240.88.251): 50 Time(s) root (103.102.15.182): 49 Time(s) root (81.68.83.82): 49 Time(s) root (118.24.70.248): 48 Time(s) root (195.29.102.42): 48 Time(s) root (58.221.62.195): 48 Time(s) root (221.229.219.104): 46 Time(s) root (101.71.3.53): 45 Time(s) root (49.232.198.56): 44 Time(s) root (218.29.196.186): 42 Time(s) root (99-152-118-172.lightspeed.sntcca.sbcglobal.net): 42 Time(s) root (139.199.9.173): 41 Time(s) root (113.134.211.242): 40 Time(s) root (121.4.206.169): 40 Time(s) root (159.89.172.207): 40 Time(s) root (167.71.251.252): 40 Time(s) root (188.170.13.225): 40 Time(s) root (210.245.92.136): 40 Time(s) root (ip-107-180-106-60.ip.secureserver.net): 40 Time(s) root (121.5.55.208): 39 Time(s) root (49.233.54.55): 38 Time(s) root (60.red-80-37-181.staticip.rima-tde.net): 38 Time(s) root (ti0004q162-0122.bb.online.no): 35 Time(s) root (142.93.145.85): 33 Time(s) root (45.239.240.20): 33 Time(s) root (140.143.244.192): 32 Time(s) root (154.8.151.45): 32 Time(s) root (49.232.147.64): 31 Time(s) root (test.fmly.ae): 30 Time(s) root (201.30.84.242): 29 Time(s) root (212.64.71.225): 29 Time(s) root (129.211.75.184): 27 Time(s) root (111.132.7.174): 26 Time(s) root (121.5.66.217): 26 Time(s) root (58.33.4.228): 26 Time(s) root (115.159.120.142): 25 Time(s) root (67.205.187.133): 25 Time(s) root (52.130.192.172): 24 Time(s) root (81.71.140.116): 24 Time(s) root (ns511372.ip-142-4-208.net): 24 Time(s) unknown (106.75.87.16): 24 Time(s) root (210.3.92.14): 23 Time(s) unknown (177.19.226.178): 23 Time(s) unknown (43.129.28.74): 23 Time(s) unknown (49.232.216.161): 23 Time(s) root (117.50.31.176): 21 Time(s) unknown (101.231.146.34): 21 Time(s) root (104.131.13.185): 20 Time(s) root (182.72.122.126): 20 Time(s) unknown (159.75.43.3): 20 Time(s) unknown (180.76.168.236): 20 Time(s) unknown (201-217-195-230-host.ifx.net.co): 20 Time(s) unknown (42.192.41.216): 20 Time(s) unknown (52.249.217.193): 20 Time(s) unknown (118.97.247.186): 19 Time(s) unknown (189-46-211-10.dsl.telesp.net.br): 19 Time(s) root (111.230.195.170): 18 Time(s) root (41.215.138.42): 18 Time(s) unknown (101.32.183.189): 18 Time(s) unknown (148.153.90.227): 18 Time(s) unknown (68.183.106.207): 18 Time(s) unknown (81.69.99.51): 18 Time(s) unknown (mail.carecomputers.nl): 18 Time(s) root (ip207.ip-51-81-89.us): 17 Time(s) unknown (159.89.226.114): 17 Time(s) unknown (161.35.238.147): 17 Time(s) unknown (42.192.37.232): 17 Time(s) unknown (91.126.186.148): 17 Time(s) root (139.155.204.11): 16 Time(s) unknown (121.4.206.169): 16 Time(s) unknown (159.75.80.191): 16 Time(s) unknown (211.143.255.70): 16 Time(s) unknown (bras-base-gtnupq1404w-grc-36-174-89-240-132.dsl.bell.ca): 16 Time(s) root (182.151.3.137): 15 Time(s) unknown (106.12.100.112): 15 Time(s) unknown (113.215.181.79): 15 Time(s) unknown (40.72.96.125): 15 Time(s) unknown (83.69.211.198): 15 Time(s) unknown (175.24.152.35): 13 Time(s) root (36.112.170.36): 12 Time(s) root (bras-base-gtnupq1404w-grc-36-174-89-240-132.dsl.bell.ca): 12 Time(s) unknown (112.220.27.58): 12 Time(s) unknown (122.52.48.92): 12 Time(s) root (103.27.4.161): 11 Time(s) root (198.199.94.189): 11 Time(s) root (91.126.186.148): 11 Time(s) unknown (106.13.89.74): 11 Time(s) unknown (es30.homesyspro.com): 11 Time(s) root (128.1.49.175): 9 Time(s) root (212.64.111.18): 8 Time(s) root (42.192.41.216): 8 Time(s) unknown (180.76.55.21): 8 Time(s) root (161.35.238.147): 7 Time(s) root (189-46-211-10.dsl.telesp.net.br): 7 Time(s) root (60.8.87.190): 7 Time(s) root (122.52.48.92): 6 Time(s) root (40.72.96.125): 6 Time(s) root (42.192.37.232): 6 Time(s) root (43.129.28.74): 6 Time(s) root (49.232.216.161): 6 Time(s) root (81.69.42.199): 6 Time(s) root (81.69.99.51): 6 Time(s) unknown (141.98.10.203): 6 Time(s) unknown (81.69.57.175): 6 Time(s) root (101.32.183.189): 5 Time(s) root (118.97.247.186): 5 Time(s) root (148.153.90.227): 5 Time(s) root (159.75.43.3): 5 Time(s) root (177.19.226.178): 5 Time(s) root (180.76.168.236): 5 Time(s) root (201-217-195-230-host.ifx.net.co): 5 Time(s) root (83.69.211.198): 5 Time(s) root (mail.carecomputers.nl): 5 Time(s) root (106.12.100.112): 4 Time(s) root (106.75.87.16): 4 Time(s) root (107.189.1.202): 4 Time(s) root (118.5.132.34.bc.googleusercontent.com): 4 Time(s) root (211.143.255.70): 4 Time(s) root (52.249.217.193): 4 Time(s) unknown (199.195.248.154): 4 Time(s) unknown (209.141.46.32): 4 Time(s) root (1.234.58.166): 3 Time(s) root (101.231.146.34): 3 Time(s) root (112.220.27.58): 3 Time(s) root (129.226.154.218): 3 Time(s) root (209.141.46.32): 3 Time(s) root (68.183.106.207): 3 Time(s) unknown (107.189.1.180): 3 Time(s) unknown (107.189.1.202): 3 Time(s) unknown (195.133.40.104): 3 Time(s) unknown (205.185.125.109): 3 Time(s) unknown (205.185.127.25): 3 Time(s) unknown (209.97.141.112): 3 Time(s) unknown (45.135.232.165): 3 Time(s) unknown (45.146.165.72): 3 Time(s) root (106.13.89.74): 2 Time(s) root (107.189.1.161): 2 Time(s) root (107.189.1.180): 2 Time(s) root (113.215.181.79): 2 Time(s) root (114.67.87.255): 2 Time(s) root (175.24.152.35): 2 Time(s) root (es30.homesyspro.com): 2 Time(s) unknown (107.189.1.161): 2 Time(s) unknown (195.133.40.46): 2 Time(s) unknown (cpc76908-dals22-2-0-cust512.20-2.cable.virginm.net): 2 Time(s) unknown (ipbcc06448.dynamic.kabel-deutschland.de): 2 Time(s) backup (101.231.146.34): 1 Time(s) mysql (122.52.48.92): 1 Time(s) mysql (177.19.226.178): 1 Time(s) mysql (42.192.41.216): 1 Time(s) mysql (49.232.216.161): 1 Time(s) mysql (68.183.106.207): 1 Time(s) postgres (118.97.247.186): 1 Time(s) postgres (121.4.175.18): 1 Time(s) postgres (121.4.206.169): 1 Time(s) postgres (159.89.226.114): 1 Time(s) postgres (175.24.152.35): 1 Time(s) postgres (209.141.46.32): 1 Time(s) postgres (mail.carecomputers.nl): 1 Time(s) root (1.116.175.189): 1 Time(s) root (104.236.248.184): 1 Time(s) root (106.54.74.83): 1 Time(s) root (111.20.213.220): 1 Time(s) root (111.74.11.82): 1 Time(s) root (117.33.225.111): 1 Time(s) root (119.29.173.247): 1 Time(s) root (122.14.222.202): 1 Time(s) root (142.93.211.192): 1 Time(s) root (159.75.80.191): 1 Time(s) root (175.27.226.176): 1 Time(s) root (180.76.55.21): 1 Time(s) root (183.240.197.44): 1 Time(s) root (185.247.225.55): 1 Time(s) root (193.169.252.151): 1 Time(s) root (31.42.176.55): 1 Time(s) root (42.123.118.32): 1 Time(s) root (42.192.79.87): 1 Time(s) root (81.69.57.175): 1 Time(s) temp (211.143.255.70): 1 Time(s) temp (bras-base-gtnupq1404w-grc-36-174-89-240-132.dsl.bell.ca): 1 Time(s) unknown (106.12.78.22): 1 Time(s) unknown (106.54.112.173): 1 Time(s) unknown (118.5.132.34.bc.googleusercontent.com): 1 Time(s) unknown (121.4.175.18): 1 Time(s) unknown (193.169.252.151): 1 Time(s) unknown (193.169.254.113): 1 Time(s) unknown (198.98.62.88): 1 Time(s) unknown (36.112.150.103): 1 Time(s) unknown (81.70.161.94): 1 Time(s) unknown (static-201-163-1-66.alestra.net.mx): 1 Time(s) Invalid Users: Unknown Account: 663 Time(s) ---------------------- pam_unix End ------------------------- --------------------- Postfix Begin ------------------------ 3 Miscellaneous warnings 24.673K Bytes accepted 25,265 24.673K Bytes sent via SMTP 25,265 ======== ================================================== 1 Accepted 100.00% -------- -------------------------------------------------- 1 Total 100.00% ======== ================================================== 4 4xx Reject relay denied 100.00% -------- -------------------------------------------------- 4 Total 4xx Rejects 100.00% ======== ================================================== 379 Connections 304 Connections lost (inbound) 379 Disconnections 1 Removed from queue 1 Sent via SMTP 17 Hostname verification errors (FCRDNS) ---------------------- Postfix End ------------------------- --------------------- sendmail-largeboxes (large mail spool files) Begin ------------------------ Large Mailbox threshold: 40MB (41943040 bytes) Warning: Large mailbox: mailman.gz (1747199807) Warning: Large mailbox: mailman (235703599967) ---------------------- sendmail-largeboxes (large mail spool files) End ------------------------- --------------------- SSHD Begin ------------------------ Failed logins from: 1.116.175.189: 1 time 1.234.58.166: 3 times 31.42.176.55 (my.tor.exit): 1 time 34.132.5.118 (118.5.132.34.bc.googleusercontent.com): 4 times 36.112.170.36: 12 times 40.72.96.125: 6 times 41.215.138.42: 18 times 42.123.118.32: 1 time 42.192.37.232: 6 times 42.192.41.216: 9 times 42.192.79.87: 1 time 42.193.55.36: 70 times 43.128.73.248: 69 times 43.129.28.74: 6 times 45.163.189.10: 50 times 45.239.240.20: 33 times 45.240.88.251: 50 times 49.51.138.189: 70 times 49.232.147.64: 31 times 49.232.198.56: 44 times 49.232.216.161: 7 times 49.233.54.55: 38 times 49.234.59.246: 65 times 51.81.89.207 (ip207.ip-51-81-89.us): 17 times 52.130.192.172: 24 times 52.249.217.193: 4 times 58.33.4.228 (228.4.33.58.broad.xw.sh.dynamic.163data.com.cn): 26 times 58.221.62.195: 48 times 60.8.87.190: 7 times 67.205.187.133: 25 times 68.183.106.207: 4 times 80.37.181.60 (60.red-80-37-181.staticip.rima-tde.net): 38 times 81.68.83.82: 49 times 81.68.243.3: 57 times 81.69.42.199: 6 times 81.69.57.175: 1 time 81.69.99.51: 6 times 81.70.161.94: 64 times 81.71.140.116: 24 times 82.164.159.123 (ti0004q162-0122.bb.online.no): 35 times 83.69.211.198 (83.69.211-198.in-addr.mastertelecom.ru): 5 times 91.126.186.148 (cli-5b7eba94.bcn.adamo.es): 11 times 91.192.36.151 (mail.carecomputers.nl): 6 times 99.152.118.172 (99-152-118-172.lightspeed.sntcca.sbcglobal.net): 42 times 101.32.183.189: 5 times 101.71.3.53: 45 times 101.231.146.34: 4 times 103.27.4.161: 11 times 103.102.15.182 (ip-103-102-15-182.cloudteknologinusantara.co.id): 49 times 104.131.13.185: 20 times 104.236.248.184: 1 time 106.12.100.112: 4 times 106.13.89.74: 2 times 106.52.195.43: 67 times 106.54.74.83: 1 time 106.75.87.16 (sellerbulknewsexpress.live): 4 times 107.180.106.60 (ip-107-180-106-60.ip.secureserver.net): 40 times 107.189.1.161: 2 times 107.189.1.180: 2 times 107.189.1.202: 4 times 111.20.213.220: 1 time 111.74.11.82: 1 time 111.132.7.174: 26 times 111.230.195.170: 18 times 111.230.233.68: 70 times 112.220.27.58: 3 times 113.134.211.242: 40 times 113.215.181.79: 2 times 114.67.87.255: 2 times 115.159.120.142: 25 times 117.33.225.111: 1 time 117.50.31.176: 21 times 118.24.70.248: 48 times 118.97.247.186: 6 times 119.29.173.247: 1 time 121.4.175.18: 1 time 121.4.206.169: 41 times 121.5.55.208: 39 times 121.5.66.217: 26 times 122.14.222.202: 1 time 122.52.48.92 (122.52.48.92.static.pldt.net): 7 times 125.99.46.50: 50 times 128.1.49.175: 9 times 129.211.75.184: 27 times 129.226.154.218: 3 times 132.232.108.149: 61 times 134.122.121.218: 70 times 138.197.35.84 (test.fmly.ae): 30 times 139.59.235.24: 70 times 139.155.83.6: 63 times 139.155.204.11: 16 times 139.155.232.195: 50 times 139.199.9.173: 41 times 140.143.244.192: 32 times 142.4.208.155 (ns511372.ip-142-4-208.net): 24 times 142.93.145.85: 33 times 142.93.211.192: 1 time 143.110.188.7: 70 times 148.153.90.227: 5 times 154.8.151.45: 32 times 159.75.43.3: 5 times 159.75.80.191: 1 time 159.89.53.183: 70 times 159.89.172.207: 40 times 159.89.226.114: 56 times 161.35.238.147: 7 times 167.71.251.252 (ubuntu-s-1vcpu-2gb-nyc3-01erp11.san): 40 times 168.187.77.177: 70 times 174.89.240.132 (bras-base-gtnupq1404w-grc-36-174-89-240-132.dsl.bell.ca): 13 times 175.24.152.35: 3 times 175.27.226.176: 1 time 175.118.152.100: 50 times 177.19.226.178 (177.19.226.178.static.gvt.net.br): 6 times 179.127.167.201: 50 times 180.76.55.21: 1 time 180.76.168.236: 5 times 182.72.122.126 (nsg-static-126.122.72.182.airtel.in): 20 times 182.151.3.137: 15 times 183.240.197.44: 1 time 185.247.225.55: 1 time 188.166.229.193: 65 times 188.170.13.225 (clients-13.170.188.225.misp.ru): 40 times 189.46.211.10 (189-46-211-10.dsl.telesp.net.br): 7 times 193.169.252.151: 1 time 195.29.102.42: 48 times 198.199.94.189: 11 times 201.30.84.242: 29 times 201.217.195.230 (201-217-195-230-host.ifx.net.co): 5 times 209.141.46.32 (mail.login-account.cyou): 4 times 210.3.92.14: 23 times 210.245.92.136: 40 times 211.143.255.70: 5 times 212.64.71.225: 29 times 212.64.111.18: 8 times 212.129.53.188 (es30.homesyspro.com): 2 times 218.29.196.186 (hn.kd.ny.adsl): 42 times 221.229.219.104: 46 times 221.231.9.138: 70 times Illegal users from: undef: 423 times 34.132.5.118 (118.5.132.34.bc.googleusercontent.com): 1 time 36.112.150.103: 1 time 40.72.96.125: 15 times 42.192.37.232: 17 times 42.192.41.216: 20 times 43.129.28.74: 23 times 45.135.232.165: 3 times 45.146.165.72: 3 times 49.232.216.161: 23 times 52.249.217.193: 20 times 65.49.20.67 (scan-18.shadowserver.org): 1 time 68.183.106.207: 18 times 81.69.57.175: 6 times 81.69.99.51: 18 times 81.70.161.94: 1 time 81.109.206.1 (cpc76908-dals22-2-0-cust512.20-2.cable.virginm.net): 2 times 83.69.211.198 (83.69.211-198.in-addr.mastertelecom.ru): 15 times 91.126.186.148 (cli-5b7eba94.bcn.adamo.es): 17 times 91.192.36.151 (mail.carecomputers.nl): 18 times 101.32.183.189: 18 times 101.231.146.34: 21 times 106.12.78.22: 1 time 106.12.100.112: 15 times 106.13.89.74: 11 times 106.54.112.173: 1 time 106.75.87.16 (sellerbulknewsexpress.live): 24 times 107.189.1.161: 2 times 107.189.1.180: 3 times 107.189.1.202: 3 times 112.220.27.58: 12 times 113.215.181.79: 15 times 118.97.247.186: 19 times 121.4.175.18: 1 time 121.4.206.169: 16 times 122.52.48.92 (122.52.48.92.static.pldt.net): 12 times 141.98.10.203: 6 times 148.153.90.227: 18 times 159.75.43.3: 20 times 159.75.80.191: 16 times 159.89.226.114: 17 times 161.35.238.147: 17 times 174.89.240.132 (bras-base-gtnupq1404w-grc-36-174-89-240-132.dsl.bell.ca): 16 times 175.24.152.35: 13 times 177.19.226.178 (177.19.226.178.static.gvt.net.br): 23 times 180.76.55.21: 8 times 180.76.168.236: 20 times 188.192.100.72 (ipbcc06448.dynamic.kabel-deutschland.de): 2 times 189.46.211.10 (189-46-211-10.dsl.telesp.net.br): 19 times 193.169.252.151: 1 time 193.169.254.113: 1 time 195.133.40.46: 2 times 195.133.40.104: 3 times 198.98.62.88: 1 time 199.195.248.154: 4 times 201.163.1.66 (static-201-163-1-66.alestra.net.mx): 1 time 201.217.195.230 (201-217-195-230-host.ifx.net.co): 20 times 205.185.125.109: 3 times 205.185.127.25 (serveroperations.com): 3 times 209.97.141.112 (abrus.cloud): 3 times 209.141.46.32 (mail.login-account.cyou): 4 times 211.143.255.70: 16 times 212.129.53.188 (es30.homesyspro.com): 11 times ---------------------- SSHD End ------------------------- --------------------- Disk Space Begin ------------------------ Filesystem Size Used Avail Use% Mounted on /dev/ploop23974p1 394G 242G 132G 65% / none 4.0G 0 4.0G 0% /dev ---------------------- Disk Space End ------------------------- ###################### Logwatch End #########################