################### Logwatch 7.4.0 (03/01/11) #################### Processing Initiated: Mon Sep 4 04:42:03 2023 Date Range Processed: yesterday ( 2023-Sep-03 ) Period is day. Detail Level of Output: 0 Type of Output/Format: mail / text Logfiles for Host: h2361197.stratoserver.net ################################################################## --------------------- fail2ban-messages Begin ------------------------ Banned services with Fail2Ban: Bans:Unbans ssh: [ 62:60 ] ---------------------- fail2ban-messages End ------------------------- --------------------- httpd Begin ------------------------ A total of 18 sites probed the server 1.164.164.68 104.140.148.98 107.170.246.46 138.197.40.80 162.216.150.181 179.43.191.194 181.214.164.109 185.100.87.136 192.241.239.40 193.111.248.71 198.235.24.122 207.90.244.10 45.137.203.48 45.79.181.179 5.188.210.227 65.49.1.77 66.240.205.34 79.110.48.254 Requests with error response codes 400 Bad Request null: 38 Time(s) mstshash=Domain: 12 Time(s) /: 5 Time(s) *: 4 Time(s) mstshash=Administr: 4 Time(s) /aaa9: 3 Time(s) /aab8: 3 Time(s) /config/getuser?index=0: 2 Time(s) '4[urq\x832\x01\xF1v\x95R\x87\xFD\x12\xD1, ... x09\xC0\x13\xC0: 1 Time(s) /bin/zhttpd/${IFS}cd${IFS}/tmp;${IFS}rm${I ... }zyxel.selfrep;: 1 Time(s) 7: 1 Time(s) LM: 1 Time(s) XP|'|'|No|'|'|0.6.4|'|'|..|'|'||'|'|[endof]: 1 Time(s) \x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x ... x00\x00\x00\x00: 1 Time(s) \xB1\xBET\xA4\x9AZ\x9A\xA0?\x90\xE0\xF2t0\ ... J\xA9<\xBD\xDA`: 1 Time(s) http://5.188.210.227/echo.php: 1 Time(s) 404 Not Found //2019/wp-includes/wlwmanifest.xml: 1 Time(s) //2020/wp-includes/wlwmanifest.xml: 1 Time(s) //blog/wp-includes/wlwmanifest.xml: 1 Time(s) //cms/wp-includes/wlwmanifest.xml: 1 Time(s) //news/wp-includes/wlwmanifest.xml: 1 Time(s) //shop/wp-includes/wlwmanifest.xml: 1 Time(s) //site/wp-includes/wlwmanifest.xml: 1 Time(s) //sito/wp-includes/wlwmanifest.xml: 1 Time(s) //test/wp-includes/wlwmanifest.xml: 1 Time(s) //web/wp-includes/wlwmanifest.xml: 1 Time(s) //website/wp-includes/wlwmanifest.xml: 1 Time(s) //wordpress/wp-includes/wlwmanifest.xml: 1 Time(s) //wp-includes/wlwmanifest.xml: 1 Time(s) //wp/wp-includes/wlwmanifest.xml: 1 Time(s) //wp1/wp-includes/wlwmanifest.xml: 1 Time(s) //wp2/wp-includes/wlwmanifest.xml: 1 Time(s) //xmlrpc.php?rsd: 1 Time(s) /wp-admin/js/widgets/about.php7: 1 Time(s) /wp-admin/maint/maint/ajax-actions.php: 1 Time(s) /wp-content/plugins/Cache/Cache.php: 1 Time(s) /wp-content/plugins/seoo/wsoyanz.php: 1 Time(s) /wp-content/plugins/seoo/wsoyanz1.php: 1 Time(s) 500 Internal Server Error /: 18 Time(s) /.env: 2 Time(s) /favicon.ico: 2 Time(s) /.git/config: 1 Time(s) /.well-known/security.txt: 1 Time(s) /?XDEBUG_SESSION_START=phpstorm: 1 Time(s) /actuator/gateway/routes: 1 Time(s) /ajax: 1 Time(s) /autodiscover/autodiscover.json?@zdi/Powershell: 1 Time(s) /ecp/Current/exporttool/microsoft.exchange ... ool.application: 1 Time(s) /ews/exchange/: 1 Time(s) /geoserver/web/: 1 Time(s) /owa/auth/logon.aspx: 1 Time(s) /owa/auth/x.js: 1 Time(s) /robots.txt: 1 Time(s) /sitemap.xml: 1 Time(s) ---------------------- httpd End ------------------------- --------------------- pam_unix Begin ------------------------ sshd: Authentication Failures: unknown (159.223.203.211): 98 Time(s) unknown (159.223.195.135): 93 Time(s) root (195.88.120.62): 84 Time(s) root (183.230.67.209): 77 Time(s) root (41.77.84.69): 71 Time(s) root (84-255-204-251.static.t-2.net): 66 Time(s) unknown (62.122.184.71): 63 Time(s) unknown (89.190.156.139): 55 Time(s) root (159.223.195.135): 42 Time(s) root (159.223.203.211): 39 Time(s) unknown (185.161.248.200): 37 Time(s) unknown (183.230.67.209): 34 Time(s) unknown (193.201.9.109): 26 Time(s) root (103.146.140.167): 24 Time(s) root (185.224.128.142): 18 Time(s) root (218.145.31.213): 18 Time(s) root (58.47.68.18): 18 Time(s) root (62.122.184.71): 14 Time(s) root (95.179.252.232): 12 Time(s) unknown (141.98.11.11): 12 Time(s) root (193.201.9.109): 7 Time(s) unknown (141.98.11.90): 7 Time(s) unknown (81.17.22.115): 7 Time(s) root (101.66.230.35.bc.googleusercontent.com): 6 Time(s) root (14.225.17.104): 6 Time(s) root (185.161.248.200): 6 Time(s) root (222.101.244.162): 6 Time(s) unknown (185.224.128.187): 6 Time(s) unknown (31.41.244.61): 6 Time(s) root (141.98.11.11): 4 Time(s) root (seed1.sheesh.rip): 3 Time(s) unknown (31.41.244.62): 3 Time(s) root (141.98.11.90): 2 Time(s) root (185.224.128.187): 2 Time(s) root (31.41.244.62): 2 Time(s) root (89.190.156.139): 2 Time(s) unknown (200.129.38.85): 2 Time(s) unknown (modemcable019.24-177-173.mc.videotron.ca): 2 Time(s) backup (185.161.248.200): 1 Time(s) backup (31.41.244.61): 1 Time(s) backup (62.122.184.71): 1 Time(s) bin (183.230.67.209): 1 Time(s) bin (185.161.248.200): 1 Time(s) mysql (62.122.184.71): 1 Time(s) nobody (62.122.184.71): 1 Time(s) postgres (183.230.67.209): 1 Time(s) root (31.41.244.61): 1 Time(s) sshd (185.161.248.200): 1 Time(s) sshd (62.122.184.71): 1 Time(s) sync (141.98.11.90): 1 Time(s) temp (159.223.195.135): 1 Time(s) temp (159.223.203.211): 1 Time(s) unknown (178.65.107.10): 1 Time(s) unknown (222.109.124.51): 1 Time(s) unknown (45.140.192.23): 1 Time(s) unknown (80.66.83.207): 1 Time(s) uucp (185.161.248.200): 1 Time(s) www-data (62.122.184.71): 1 Time(s) Invalid Users: Unknown Account: 487 Time(s) ---------------------- pam_unix End ------------------------- --------------------- Postfix Begin ------------------------ 4 Miscellaneous warnings 10.075K Bytes accepted 10,317 10.075K Bytes sent via SMTP 10,317 ======== ================================================== 1 Accepted 100.00% -------- -------------------------------------------------- 1 Total 100.00% ======== ================================================== 3 4xx Reject relay denied 100.00% -------- -------------------------------------------------- 3 Total 4xx Rejects 100.00% ======== ================================================== 65 Connections 24 Connections lost (inbound) 65 Disconnections 1 Removed from queue 1 Sent via SMTP 10 Timeouts (inbound) 5 SMTP dialog errors 6 Hostname verification errors (FCRDNS) ---------------------- Postfix End ------------------------- --------------------- sendmail-largeboxes (large mail spool files) Begin ------------------------ Large Mailbox threshold: 40MB (41943040 bytes) Warning: Large mailbox: mailman.gz (1747199807) Warning: Large mailbox: mailman (235703599967) ---------------------- sendmail-largeboxes (large mail spool files) End ------------------------- --------------------- SSHD Begin ------------------------ Disconnecting after too many authentication failures for user: root : 1 Time(s) Failed logins from: 14.225.17.104: 6 times 31.41.244.61: 2 times 31.41.244.62: 2 times 35.230.66.101 (101.66.230.35.bc.googleusercontent.com): 6 times 41.77.84.69: 71 times 58.47.68.18: 18 times 62.122.184.71: 19 times 84.255.204.251 (84-255-204-251.static.t-2.net): 66 times 89.190.156.139 (host0.heliosdax.email): 2 times 91.224.92.110 (seed1.sheesh.rip): 3 times 95.179.252.232 (95.179.252.232.vultrusercontent.com): 12 times 103.146.140.167: 24 times 141.98.11.11 (axon-stall.riddlecamera.net): 4 times 141.98.11.90 (lighten.medyamol.com): 3 times 159.223.195.135: 43 times 159.223.203.211: 40 times 183.230.67.209: 79 times 185.161.248.200: 10 times 185.224.128.142 (ihate.feds.kys): 18 times 185.224.128.187: 2 times 193.201.9.109: 7 times 195.88.120.62 (195-88-120-62.parustelecom.ru): 84 times 218.145.31.213: 18 times 222.101.244.162: 6 times Illegal users from: 2001:470:1:c84::27: 1 time undef: 173 times 31.41.244.61: 6 times 31.41.244.62: 3 times 45.140.192.23: 1 time 62.122.184.71: 63 times 64.62.197.211 (scan-50o.shadowserver.org): 1 time 80.66.83.207: 1 time 81.17.22.115 (hostedby.privatealps.net): 35 times 89.190.156.139 (host0.heliosdax.email): 55 times 141.98.11.11 (axon-stall.riddlecamera.net): 12 times 141.98.11.90 (lighten.medyamol.com): 7 times 159.223.195.135: 93 times 159.223.203.211: 98 times 173.177.24.19 (modemcable019.24-177-173.mc.videotron.ca): 2 times 178.65.107.10: 1 time 183.230.67.209: 34 times 185.161.248.200: 37 times 185.224.128.187: 6 times 193.201.9.109: 26 times 200.129.38.85: 2 times 222.109.124.51: 5 times ---------------------- SSHD End ------------------------- --------------------- Disk Space Begin ------------------------ Filesystem Size Used Avail Use% Mounted on /dev/ploop47383p1 394G 243G 132G 65% / none 4.0G 0 4.0G 0% /dev ---------------------- Disk Space End ------------------------- ###################### Logwatch End #########################