Edit: /var/log/talon/talon-events-2017-03-04.log (22528B)
SQLite format 3 @ +
wQtablelogslogsCREATE TABLE logs(id int auto increment,timestamp datetime default current_timestamp,message text) ‘ ϋφρμηβέΨΣΞΙΔΏΊ΅°«¦‘': {u'account': u'arenacpy', u'undo_action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'arenacpy', u'unblock'], u'action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'arenacpy', u'block'], u'abuse_type': u'compromised', u'undo_action': u'clamdscan_action', u'host_name': u'md-in-64.webhostbox.net', u'action_type': u'do', u'action': u'clamdscan_action', 'action_id': 'c81e6f1c-00d1-11e7-abbf-0cc47aca427c'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}\ 32017-03-04 11:57:46{u'message': {u'action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'arenacpy', u'block'], u'undo_action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'arenacpy', u'unblock'], u'account': u'arenacpy', u'abuse_type': u'compromised', u'undo_action': u'clamdscan_action', u'host_name': u'md-in-64.webhostbox.net', u'action_type': u'do', u'action': ' % # !
!
32017-03-04 11:57:46{u'message': {u'account': u'arenacpy', u'undo_action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'arenacpy', u'unblock'], u'action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'arenacpy', u'block'], u'abuse_type': u'compromised', u'undo_action': u'clamdscan_action', u'host_name': u'md-in-64.webhostbox.net', u'action_type': u'do', u'action': u'clamdscan_action', 'action_id': 'c81e6f1c-00d1-11e7-abbf-0cc47aca427c'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}\ 32017-03-04 11:57:46{u'message': {u'action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'arenacpy', u'block'], u'undo_action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'arenacpy', u'unblock'], u'account': u'arenacpy', u'abuse_type': u'compromised', u'undo_action': u'clamdscan_action', u'host_name': u'md-in-64.webhostbox.net', u'action_type': u'do', u'action': u'clamdscan_action'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}
N -N \ 32017-03-04 11:57:48{u'message': {u'action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'ateligpp', u'block'], u'undo_action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'ateligpp', u'unblock'], u'account': u'ateligpp', u'abuse_type': u'compromised', u'undo_action': u'clamdscan_action', u'host_name': u'md-in-64.webhostbox.net', u'action_type': u'do', u'action': u'clamdscan_action'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}P 3}2017-03-04 11:57:47{u'message': {'status': 'done', 'parent_action_id': None, 'action_id': 'c81e6f1c-00d1-11e7-abbf-0cc47aca427c'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}
μ P 3}2017-03-04 11:57:50{u'message': {'status': 'done', 'parent_action_id': None, 'action_id': 'c9ad5df2-00d1-11e7-8769-0cc47aca427c'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'} 32017-03-04 11:57:49{u'message': {u'account': u'ateligpp', u'undo_action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'ateligpp', u'unblock'], u'action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'ateligpp', u'block'], u'abuse_type': u'compromised', u'undo_action': u'clamdscan_action', u'host_name': u'md-in-64.webhostbox.net', u'action_type': u'do', u'action': u'clamdscan_action', 'action_id': 'c9ad5df2-00d1-11e7-8769-0cc47aca427c'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}
!
32017-03-04 11:57:52{u'message': {u'account': u'dexteqnw', u'undo_action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'dexteqnw', u'unblock'], u'action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'dexteqnw', u'block'], u'abuse_type': u'compromised', u'undo_action': u'clamdscan_action', u'host_name': u'md-in-64.webhostbox.net', u'action_type': u'do', u'action': u'clamdscan_action', 'action_id': 'cb3b3766-00d1-11e7-b975-0cc47aca427c'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}\ 32017-03-04 11:57:51{u'message': {u'action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'dexteqnw', u'block'], u'undo_action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'dexteqnw', u'unblock'], u'account': u'dexteqnw', u'abuse_type': u'compromised', u'undo_action': u'clamdscan_action', u'host_name': u'md-in-64.webhostbox.net', u'action_type': u'do', u'action': u'clamdscan_action'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}
N -N \
32017-03-04 11:57:54{u'message': {u'action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'elagn6ph', u'block'], u'undo_action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'elagn6ph', u'unblock'], u'account': u'elagn6ph', u'abuse_type': u'compromised', u'undo_action': u'clamdscan_action', u'host_name': u'md-in-64.webhostbox.net', u'action_type': u'do', u'action': u'clamdscan_action'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}P 3}2017-03-04 11:57:52{u'message': {'status': 'done', 'parent_action_id': None, 'action_id': 'cb3b3766-00d1-11e7-b975-0cc47aca427c'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}
μ P 3}2017-03-04 11:57:55{u'message': {'status': 'done', 'parent_action_id': None, 'action_id': 'ccbef140-00d1-11e7-9bb3-0cc47aca427c'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'} 32017-03-04 11:57:54{u'message': {u'account': u'elagn6ph', u'undo_action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'elagn6ph', u'unblock'], u'action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'elagn6ph', u'block'], u'abuse_type': u'compromised', u'undo_action': u'clamdscan_action', u'host_name': u'md-in-64.webhostbox.net', u'action_type': u'do', u'action': u'clamdscan_action', 'action_id': 'ccbef140-00d1-11e7-9bb3-0cc47aca427c'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}
!
32017-03-04 11:57:57{u'message': {u'account': u'hamarktx', u'undo_action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'hamarktx', u'unblock'], u'action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'hamarktx', u'block'], u'abuse_type': u'compromised', u'undo_action': u'clamdscan_action', u'host_name': u'md-in-64.webhostbox.net', u'action_type': u'do', u'action': u'clamdscan_action', 'action_id': 'ce473482-00d1-11e7-81a7-0cc47aca427c'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}\
32017-03-04 11:57:56{u'message': {u'action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'hamarktx', u'block'], u'undo_action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'hamarktx', u'unblock'], u'account': u'hamarktx', u'abuse_type': u'compromised', u'undo_action': u'clamdscan_action', u'host_name': u'md-in-64.webhostbox.net', u'action_type': u'do', u'action': u'clamdscan_action'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}
N -N \ 32017-03-04 11:57:59{u'message': {u'action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'indiabig', u'block'], u'undo_action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'indiabig', u'unblock'], u'account': u'indiabig', u'abuse_type': u'compromised', u'undo_action': u'clamdscan_action', u'host_name': u'md-in-64.webhostbox.net', u'action_type': u'do', u'action': u'clamdscan_action'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}P 3}2017-03-04 11:57:57{u'message': {'status': 'done', 'parent_action_id': None, 'action_id': 'ce473482-00d1-11e7-81a7-0cc47aca427c'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}
μ P 3}2017-03-04 11:58:00{u'message': {'status': 'done', 'parent_action_id': None, 'action_id': 'cfcb83c6-00d1-11e7-abbf-0cc47aca427c'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'} 32017-03-04 11:57:59{u'message': {u'account': u'indiabig', u'undo_action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'indiabig', u'unblock'], u'action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'indiabig', u'block'], u'abuse_type': u'compromised', u'undo_action': u'clamdscan_action', u'host_name': u'md-in-64.webhostbox.net', u'action_type': u'do', u'action': u'clamdscan_action', 'action_id': 'cfcb83c6-00d1-11e7-abbf-0cc47aca427c'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}
!
32017-03-04 11:58:02{u'message': {u'account': u'jntukeyf', u'undo_action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'jntukeyf', u'unblock'], u'action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'jntukeyf', u'block'], u'abuse_type': u'compromised', u'undo_action': u'clamdscan_action', u'host_name': u'md-in-64.webhostbox.net', u'action_type': u'do', u'action': u'clamdscan_action', 'action_id': 'd151624c-00d1-11e7-8769-0cc47aca427c'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}\ 32017-03-04 11:58:01{u'message': {u'action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'jntukeyf', u'block'], u'undo_action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'jntukeyf', u'unblock'], u'account': u'jntukeyf', u'abuse_type': u'compromised', u'undo_action': u'clamdscan_action', u'host_name': u'md-in-64.webhostbox.net', u'action_type': u'do', u'action': u'clamdscan_action'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}
N -N \ 32017-03-04 11:58:04{u'message': {u'action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'regulfpa', u'block'], u'undo_action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'regulfpa', u'unblock'], u'account': u'regulfpa', u'abuse_type': u'compromised', u'undo_action': u'clamdscan_action', u'host_name': u'md-in-64.webhostbox.net', u'action_type': u'do', u'action': u'clamdscan_action'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}P 3}2017-03-04 11:58:03{u'message': {'status': 'done', 'parent_action_id': None, 'action_id': 'd151624c-00d1-11e7-8769-0cc47aca427c'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}
μ P 3}2017-03-04 11:58:05{u'message': {'status': 'done', 'parent_action_id': None, 'action_id': 'd2d86ade-00d1-11e7-b975-0cc47aca427c'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'} 32017-03-04 11:58:04{u'message': {u'account': u'regulfpa', u'undo_action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'regulfpa', u'unblock'], u'action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'regulfpa', u'block'], u'abuse_type': u'compromised', u'undo_action': u'clamdscan_action', u'host_name': u'md-in-64.webhostbox.net', u'action_type': u'do', u'action': u'clamdscan_action', 'action_id': 'd2d86ade-00d1-11e7-b975-0cc47aca427c'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}
!
32017-03-04 11:58:07{u'message': {u'account': u'vfmobo6d', u'undo_action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'vfmobo6d', u'unblock'], u'action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'vfmobo6d', u'block'], u'abuse_type': u'compromised', u'undo_action': u'clamdscan_action', u'host_name': u'md-in-64.webhostbox.net', u'action_type': u'do', u'action': u'clamdscan_action', 'action_id': 'd46f3be8-00d1-11e7-9bb3-0cc47aca427c'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}\ 32017-03-04 11:58:07{u'message': {u'action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'vfmobo6d', u'block'], u'undo_action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'vfmobo6d', u'unblock'], u'account': u'vfmobo6d', u'abuse_type': u'compromised', u'undo_action': u'clamdscan_action', u'host_name': u'md-in-64.webhostbox.net', u'action_type': u'do', u'action': u'clamdscan_action'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}
6 -Μ 6 32017-03-04 11:58:10{u'message': {u'action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'reliqcat', u'unblock'], u'account': u'reliqcat', u'abuse_type': u'compromised', u'host_name': u'md-in-64.webhostbox.net', u'action_type': u'do', u'action': u'clamdscan_action', 'action_id': 'd5fc5982-00d1-11e7-81a7-0cc47aca427c'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}^ 3
2017-03-04 11:58:09{u'message': {u'action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'reliqcat', u'unblock'], u'account': u'reliqcat', u'abuse_type': u'compromised', u'host_name': u'md-in-64.webhostbox.net', u'action_type': u'do', u'action': u'clamdscan_action'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}P 3}2017-03-04 11:58:08{u'message': {'status': 'done', 'parent_action_id': None, 'action_id': 'd46f3be8-00d1-11e7-9bb3-0cc47aca427c'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}
- - ^ 3
2017-03-04 11:58:11{u'message': {u'action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'jaymajto', u'unblock'], u'account': u'jaymajto', u'abuse_type': u'compromised', u'host_name': u'md-in-64.webhostbox.net', u'action_type': u'do', u'action': u'clamdscan_action'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}o 3
;2017-03-04 11:58:10{u'message': {'status': 'not done', 'parent_action_id': None, 'error_message': 'There were errors during execution - error message = iptables: Bad rule (does a matching rule exist in that chain?).\n , exit code = 1', 'action_id': 'd5fc5982-00d1-11e7-81a7-0cc47aca427c'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}
ψ j ψ o! 3
;2017-03-04 11:58:12{u'message': {'status': 'not done', 'parent_action_id': None, 'error_message': 'There were errors during execution - error message = iptables: Bad rule (does a matching rule exist in that chain?).\n , exit code = 1', 'action_id': 'd72f35f4-00d1-11e7-abbf-0cc47aca427c'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'} 32017-03-04 11:58:12{u'message': {u'action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'jaymajto', u'unblock'], u'account': u'jaymajto', u'abuse_type': u'compromised', u'host_name': u'md-in-64.webhostbox.net', u'action_type': u'do', u'action': u'clamdscan_action', 'action_id': 'd72f35f4-00d1-11e7-abbf-0cc47aca427c'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}
# 32017-03-04 11:58:14{u'message': {u'action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'swarnm7f', u'unblock'], u'account': u'swarnm7f', u'abuse_type': u'compromised', u'host_name': u'md-in-64.webhostbox.net', u'action_type': u'do', u'action': u'clamdscan_action', 'action_id': 'd8621dd8-00d1-11e7-8769-0cc47aca427c'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}^" 3
2017-03-04 11:58:13{u'message': {u'action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'swarnm7f', u'unblock'], u'account': u'swarnm7f', u'abuse_type': u'compromised', u'host_name': u'md-in-64.webhostbox.net', u'action_type': u'do', u'action': u'clamdscan_action'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}
- - ^% 3
2017-03-04 11:58:15{u'message': {u'action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'webviudx', u'unblock'], u'account': u'webviudx', u'abuse_type': u'compromised', u'host_name': u'md-in-64.webhostbox.net', u'action_type': u'do', u'action': u'clamdscan_action'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}o$ 3
;2017-03-04 11:58:14{u'message': {'status': 'not done', 'parent_action_id': None, 'error_message': 'There were errors during execution - error message = iptables: Bad rule (does a matching rule exist in that chain?).\n , exit code = 1', 'action_id': 'd8621dd8-00d1-11e7-8769-0cc47aca427c'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}
ψ j ψ o' 3
;2017-03-04 11:58:16{u'message': {'status': 'not done', 'parent_action_id': None, 'error_message': 'There were errors during execution - error message = iptables: Bad rule (does a matching rule exist in that chain?).\n , exit code = 1', 'action_id': 'd9950b20-00d1-11e7-b975-0cc47aca427c'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}& 32017-03-04 11:58:16{u'message': {u'action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'webviudx', u'unblock'], u'account': u'webviudx', u'abuse_type': u'compromised', u'host_name': u'md-in-64.webhostbox.net', u'action_type': u'do', u'action': u'clamdscan_action', 'action_id': 'd9950b20-00d1-11e7-b975-0cc47aca427c'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}
6 6 P* 3}2017-03-04 17:15:00{u'message': {'status': 'done', 'parent_action_id': None, 'action_id': '1874d182-00fe-11e7-9bb3-0cc47aca427c'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}) 32017-03-04 17:14:59{u'message': {u'action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'ateligpp', u'unblock'], u'account': u'ateligpp', u'abuse_type': u'compromised', u'host_name': u'md-in-64.webhostbox.net', u'action_type': u'do', u'action': u'clamdscan_action', 'action_id': '1874d182-00fe-11e7-9bb3-0cc47aca427c'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}^( 3
2017-03-04 17:14:59{u'message': {u'action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'ateligpp', u'unblock'], u'account': u'ateligpp', u'abuse_type': u'compromised', u'host_name': u'md-in-64.webhostbox.net', u'action_type': u'do', u'action': u'clamdscan_action'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}