OSSEC Alert - iris - Level 2 - Unknown problem somewhere in the system.

Tue Oct 8 02:00:50 EDT 2019

OSSEC HIDS Notification.
2019 Oct 07 23:27:42

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 01:27:40 iris sshguard[84562]: Attack from "185.197.30.74" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 23:27:42

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 01:27:41 iris sshguard[84562]: Attack from "185.197.30.74" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 23:27:42

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 01:27:41 iris sshguard[84562]: Blocking "185.197.30.74/32" for 1920 secs (3 attacks in 1 secs, after 5 abuses over 4019 secs.)

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 23:27:58

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 01:27:58 iris sshguard[84562]: Attack from "177.69.237.49" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 23:33:56

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 01:33:54 iris sshguard[84562]: Attack from "175.139.242.49" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 23:37:05

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 01:37:04 iris sshguard[84562]: Attack from "200.52.80.34" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 23:37:05

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 01:37:04 iris sshguard[84562]: Attack from "200.52.80.34" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 23:37:05

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 01:37:04 iris sshguard[84562]: Blocking "200.52.80.34/32" for 7680 secs (3 attacks in 0 secs, after 7 abuses over 14556 secs.)

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 23:37:37

Received From: iris->/var/log/messages
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 01:37:36 iris ddclient[15573]: FAILED:   updating autonsys.com: NOACCESS: Authentication failed. This happens if the username/password OR host or domain are wrong.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 23:38:09

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 01:38:07 iris sshguard[84562]: Attack from "162.243.253.67" on service 100 with danger 2.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 23:39:29

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 01:39:28 iris sshguard[84562]: Attack from "140.143.222.95" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 23:44:25

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 01:44:23 iris sshguard[84562]: Attack from "140.143.222.95" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 23:44:25

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 01:44:23 iris sshguard[84562]: Blocking "140.143.222.95/32" for 3840 secs (3 attacks in 295 secs, after 6 abuses over 6562 secs.)

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 23:44:25

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 01:44:23 iris sshd[45373]: fatal: userauth_finish: Permission denied [preauth]

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 23:44:49

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 01:44:47 iris sshguard[84562]: Attack from "175.139.242.49" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 23:44:49

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 01:44:47 iris sshguard[84562]: Blocking "175.139.242.49/32" for 120 secs (3 attacks in 653 secs, after 1 abuses over 653 secs.)

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 23:44:49

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 01:44:47 iris sshd[84287]: fatal: userauth_finish: Permission denied [preauth]

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 23:45:19

Received From: iris->/var/log/messages
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 01:45:19 iris dhclient[58870]: em0: sendmsg(DHCPREQUEST): Permission denied

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 23:47:38

Received From: iris->/var/log/messages
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 01:47:36 iris ddclient[15573]: FAILED:   updating autonsys.com: NOACCESS: Authentication failed. This happens if the username/password OR host or domain are wrong.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 23:49:14

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 01:49:14 iris sshguard[84562]: Attack from "175.139.242.49" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 23:51:35

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 01:51:33 iris sshguard[84562]: Attack from "177.69.237.49" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 23:51:35

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 01:51:33 iris sshguard[84562]: Blocking "177.69.237.49/32" for 120 secs (3 attacks in 1415 secs, after 1 abuses over 1415 secs.)

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 23:51:35

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 01:51:33 iris sshd[46475]: fatal: userauth_finish: Permission denied [preauth]

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 23:53:38

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 01:53:37 iris sshguard[84562]: Attack from "175.139.242.49" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 23:53:38

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 01:53:37 iris sshguard[84562]: Blocking "175.139.242.49/32" for 240 secs (3 attacks in 263 secs, after 2 abuses over 1183 secs.)

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 23:53:38

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 01:53:37 iris sshd[91411]: fatal: userauth_finish: Permission denied [preauth]

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 23:54:18

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 01:54:17 iris sshguard[84562]: Attack from "52.50.232.130" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 23:54:18

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 01:54:17 iris sshguard[84562]: Attack from "52.50.232.130" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 23:54:18

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 01:54:17 iris sshguard[84562]: Blocking "52.50.232.130/32" for 15360 secs (3 attacks in 0 secs, after 8 abuses over 18515 secs.)

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 23:56:10

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 01:56:09 iris sshguard[84562]: Attack from "177.69.237.49" on service 100 with danger 10.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 23:56:59

Received From: iris->/var/log/authlog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 01:56:57 iris sshguard[84562]: Attack from "162.243.253.67" on service 100 with danger 2.

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2019 Oct 07 23:57:37

Received From: iris->/var/log/messages
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct  8 01:57:36 iris ddclient[15573]: FAILED:   updating autonsys.com: NOACCESS: Authentication failed. This happens if the username/password OR host or domain are wrong.

 --END OF NOTIFICATION