May 12 12:05:42 web8 sshd\[11580\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.230.40.72  user=root
May 12 12:05:44 web8 sshd\[11580\]: Failed password for root from 157.230.40.72 port 43710 ssh2
May 12 12:10:25 web8 sshd\[14278\]: Invalid user azureadmin from 157.230.40.72
May 12 12:10:25 web8 sshd\[14278\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.230.40.72
May 12 12:10:27 web8 sshd\[14278\]: Failed password for invalid user azureadmin from 157.230.40.72 port 52300 ssh2

May  9 02:48:05 game-panel sshd[27987]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.230.40.72
May  9 02:48:08 game-panel sshd[27987]: Failed password for invalid user annamarie from 157.230.40.72 port 49166 ssh2
May  9 02:51:52 game-panel sshd[28121]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.230.40.72

2020-05-04T15:58:30.027028abusebot-7.cloudsearch.cf sshd[12117]: Invalid user reseller02 from 157.230.40.72 port 49590
2020-05-04T15:58:30.033519abusebot-7.cloudsearch.cf sshd[12117]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.230.40.72
2020-05-04T15:58:30.027028abusebot-7.cloudsearch.cf sshd[12117]: Invalid user reseller02 from 157.230.40.72 port 49590
2020-05-04T15:58:32.151546abusebot-7.cloudsearch.cf sshd[12117]: Failed password for invalid user reseller02 from 157.230.40.72 port 49590 ssh2
2020-05-04T16:06:17.257702abusebot-7.cloudsearch.cf sshd[12612]: Invalid user shop from 157.230.40.72 port 36980
2020-05-04T16:06:17.266630abusebot-7.cloudsearch.cf sshd[12612]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.230.40.72
2020-05-04T16:06:17.257702abusebot-7.cloudsearch.cf sshd[12612]: Invalid user shop from 157.230.40.72 port 36980
2020-05-04T16:06:19.494959abusebot-7.cloudsearch.cf sshd[1
...

Invalid user marguerite from 157.230.40.132 port 6415

Unauthorized connection attempt detected from IP address 157.230.40.174 to port 2220 [J]

A spam with Japanese Language was sent from this SMTP server via Gmail on 26 Aug 2019 (PDT)/(JST).

157.230.40.118 - - [25/Jul/2019:20:00:56 +0200] "GET /wp-login.php HTTP/1.1" 200 1122 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
157.230.40.118 - - [25/Jul/2019:20:01:07 +0200] "POST /wp-login.php HTTP/1.1" 200 1503 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
157.230.40.118 - - [25/Jul/2019:20:01:17 +0200] "GET /wp-login.php HTTP/1.1" 200 1122 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
157.230.40.118 - - [25/Jul/2019:20:01:38 +0200] "GET /wp-login.php HTTP/1.1" 200 1122 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
157.230.40.118 - - [25/Jul/2019:20:01:42 +0200] "POST /wp-login.php HTTP/1.1" 200 1491 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
157.230.40.118 - - [25/Jul/2019:20:01:49 +0200] "GET /wp-login.php HTTP/1.1" 200 1122 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
...

Jul  8 14:45:51 vps200512 sshd\[1334\]: Invalid user moodle from 157.230.40.177
Jul  8 14:45:51 vps200512 sshd\[1334\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.230.40.177
Jul  8 14:45:53 vps200512 sshd\[1334\]: Failed password for invalid user moodle from 157.230.40.177 port 50056 ssh2
Jul  8 14:49:13 vps200512 sshd\[1347\]: Invalid user sinusbot from 157.230.40.177
Jul  8 14:49:13 vps200512 sshd\[1347\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.230.40.177

Jul  7 20:52:20 itv-usvr-02 sshd[2401]: Invalid user test1 from 157.230.40.177 port 59038
Jul  7 20:52:20 itv-usvr-02 sshd[2401]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.230.40.177
Jul  7 20:52:20 itv-usvr-02 sshd[2401]: Invalid user test1 from 157.230.40.177 port 59038
Jul  7 20:52:23 itv-usvr-02 sshd[2401]: Failed password for invalid user test1 from 157.230.40.177 port 59038 ssh2
Jul  7 20:57:04 itv-usvr-02 sshd[2408]: Invalid user app from 157.230.40.177 port 49926

Jul  5 21:07:27 localhost sshd\[15932\]: Invalid user jt from 157.230.40.177 port 35866
Jul  5 21:07:27 localhost sshd\[15932\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.230.40.177
Jul  5 21:07:28 localhost sshd\[15932\]: Failed password for invalid user jt from 157.230.40.177 port 35866 ssh2

Jul  5 04:52:46 mail sshd\[15547\]: Invalid user jule from 157.230.40.177
Jul  5 04:52:46 mail sshd\[15547\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.230.40.177
Jul  5 04:52:48 mail sshd\[15547\]: Failed password for invalid user jule from 157.230.40.177 port 45818 ssh2
...

Failed password for invalid user openbravo from 157.230.40.177 port 60588 ssh2
Invalid user ftpuser from 157.230.40.177 port 57770
pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.230.40.177
Failed password for invalid user ftpuser from 157.230.40.177 port 57770 ssh2
Invalid user michielan from 157.230.40.177 port 54950

03.07.2019 16:15:11 SSH access blocked by firewall

Jul  2 02:33:27 dedicated sshd[11324]: Invalid user bscw from 157.230.40.177 port 38216

Jul  6 02:26:58 NPSTNNYC01T sshd[5646]: Failed password for root from 211.179.124.162 port 54392 ssh2
Jul  6 02:29:12 NPSTNNYC01T sshd[5897]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.179.124.162
Jul  6 02:29:14 NPSTNNYC01T sshd[5897]: Failed password for invalid user ubuntu from 211.179.124.162 port 57586 ssh2
...

WordPress login Brute force / Web App Attack on client site.

Jul  6 08:35:06 our-server-hostname sshd[22796]: Invalid user update from 218.94.103.226
Jul  6 08:35:06 our-server-hostname sshd[22796]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.94.103.226 
Jul  6 08:35:08 our-server-hostname sshd[22796]: Failed password for invalid user update from 218.94.103.226 port 35354 ssh2
Jul  6 08:37:15 our-server-hostname sshd[23207]: Invalid user compta from 218.94.103.226
Jul  6 08:37:15 our-server-hostname sshd[23207]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.94.103.226 


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=218.94.103.226

(smtpauth) Failed SMTP AUTH login from 186.250.193.222 (BR/Brazil/186-250-193-222.ibl.com.br): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 2020-07-06 08:22:32 plain authenticator failed for ([186.250.193.222]) [186.250.193.222]: 535 Incorrect authentication data (set_id=ar.davoudi)

Jul  6 05:50:58 rush sshd[4338]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=86.210.71.37
Jul  6 05:51:00 rush sshd[4338]: Failed password for invalid user cloud from 86.210.71.37 port 59910 ssh2
Jul  6 05:55:12 rush sshd[4447]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=86.210.71.37
...

 TCP (SYN) 101.51.208.55:26959 -> port 23, len 44

Jul  6 05:41:11 server6 sshd[19667]: Failed password for invalid user guest from 175.139.138.176 port 61445 ssh2
Jul  6 05:41:11 server6 sshd[19669]: Failed password for invalid user guest from 175.139.138.176 port 61455 ssh2
Jul  6 05:41:11 server6 sshd[19673]: Failed password for invalid user guest from 175.139.138.176 port 61479 ssh2
Jul  6 05:41:11 server6 sshd[19667]: Connection closed by 175.139.138.176 [preauth]
Jul  6 05:41:11 server6 sshd[19670]: Failed password for invalid user guest from 175.139.138.176 port 61456 ssh2
Jul  6 05:41:11 server6 sshd[19669]: Connection closed by 175.139.138.176 [preauth]
Jul  6 05:41:11 server6 sshd[19673]: Connection closed by 175.139.138.176 [preauth]


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=175.139.138.176

2020-07-06T06:30:51.769154shield sshd\[29962\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.9.153  user=root
2020-07-06T06:30:53.399854shield sshd\[29962\]: Failed password for root from 106.13.9.153 port 33670 ssh2
2020-07-06T06:32:45.899080shield sshd\[30725\]: Invalid user howard from 106.13.9.153 port 54320
2020-07-06T06:32:45.902521shield sshd\[30725\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.9.153
2020-07-06T06:32:47.849874shield sshd\[30725\]: Failed password for invalid user howard from 106.13.9.153 port 54320 ssh2

20/7/6@00:47:37: FAIL: Alarm-Network address from=125.163.6.32
...

Attempts against non-existent wp-login

Jul  6 03:08:54 firewall sshd[6121]: Failed password for root from 49.88.112.118 port 17555 ssh2
Jul  6 03:08:56 firewall sshd[6121]: Failed password for root from 49.88.112.118 port 17555 ssh2
Jul  6 03:08:58 firewall sshd[6121]: Failed password for root from 49.88.112.118 port 17555 ssh2
...

167.99.252.133 - - [06/Jul/2020:05:52:08 +0200] "GET /wp-login.php HTTP/1.1" 200 5738 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
167.99.252.133 - - [06/Jul/2020:05:52:10 +0200] "POST /wp-login.php HTTP/1.1" 200 5989 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
167.99.252.133 - - [06/Jul/2020:05:52:10 +0200] "POST /xmlrpc.php HTTP/1.1" 200 427 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"

 TCP (SYN) 168.228.188.2:52054 -> port 8671, len 44

Jul  6 05:20:08 django sshd[115080]: Invalid user minecraft from 58.213.198.74
Jul  6 05:20:08 django sshd[115080]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.213.198.74 
Jul  6 05:20:10 django sshd[115080]: Failed password for invalid user minecraft from 58.213.198.74 port 8640 ssh2
Jul  6 05:20:10 django sshd[115083]: Received disconnect from 58.213.198.74: 11: Bye Bye
Jul  6 05:42:00 django sshd[118232]: Invalid user ftpuser from 58.213.198.74
Jul  6 05:42:00 django sshd[118232]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.213.198.74 
Jul  6 05:42:02 django sshd[118232]: Failed password for invalid user ftpuser from 58.213.198.74 port 8642 ssh2
Jul  6 05:42:02 django sshd[118233]: Received disconnect from 58.213.198.74: 11: Bye Bye
Jul  6 05:45:19 django sshd[118690]: Invalid user jonny from 58.213.198.74
Jul  6 05:45:19 django sshd[118690]: pam_unix(sshd:auth): authenticat........
-------------------------------

Autoban   45.125.65.52 AUTH FAILED