Aug 21 06:19:17 l02a sshd[26152]: Invalid user cacheusr from 167.71.236.116
Aug 21 06:19:17 l02a sshd[26152]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.236.116 
Aug 21 06:19:17 l02a sshd[26152]: Invalid user cacheusr from 167.71.236.116
Aug 21 06:19:19 l02a sshd[26152]: Failed password for invalid user cacheusr from 167.71.236.116 port 53892 ssh2

Aug 20 05:44:14 rush sshd[25723]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.236.116
Aug 20 05:44:16 rush sshd[25723]: Failed password for invalid user ts2 from 167.71.236.116 port 38242 ssh2
Aug 20 05:49:59 rush sshd[25946]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.236.116
...

Aug 18 22:50:18 gw1 sshd[26060]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.236.116
Aug 18 22:50:20 gw1 sshd[26060]: Failed password for invalid user admin from 167.71.236.116 port 53794 ssh2
...

Aug 18 00:56:49 ns382633 sshd\[19610\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.236.116  user=root
Aug 18 00:56:50 ns382633 sshd\[19610\]: Failed password for root from 167.71.236.116 port 37746 ssh2
Aug 18 01:14:56 ns382633 sshd\[22672\]: Invalid user vnc from 167.71.236.116 port 52090
Aug 18 01:14:56 ns382633 sshd\[22672\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.236.116
Aug 18 01:14:59 ns382633 sshd\[22672\]: Failed password for invalid user vnc from 167.71.236.116 port 52090 ssh2

2020-08-14T05:41:56.530564shield sshd\[16465\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.236.116  user=root
2020-08-14T05:41:58.632240shield sshd\[16465\]: Failed password for root from 167.71.236.116 port 36870 ssh2
2020-08-14T05:46:05.518900shield sshd\[16722\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.236.116  user=root
2020-08-14T05:46:07.470088shield sshd\[16722\]: Failed password for root from 167.71.236.116 port 54456 ssh2
2020-08-14T05:49:54.608190shield sshd\[16903\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.236.116  user=root

Port Scan detected!
...

Aug  9 23:18:43 rocket sshd[17857]: Failed password for root from 167.71.236.116 port 33190 ssh2
Aug  9 23:22:23 rocket sshd[18467]: Failed password for root from 167.71.236.116 port 58228 ssh2
...

Jun  4 22:21:39 v22019038103785759 sshd\[24928\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.236.138  user=root
Jun  4 22:21:41 v22019038103785759 sshd\[24928\]: Failed password for root from 167.71.236.138 port 50204 ssh2
Jun  4 22:21:44 v22019038103785759 sshd\[24930\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.236.138  user=root
Jun  4 22:21:46 v22019038103785759 sshd\[24930\]: Failed password for root from 167.71.236.138 port 50560 ssh2
Jun  4 22:21:48 v22019038103785759 sshd\[24932\]: Invalid user admin from 167.71.236.138 port 50930
...

Total attacks: 2

[munged]::443 167.71.236.240 - - [28/Feb/2020:19:41:26 +0100] "POST /[munged]: HTTP/1.1" 200 7275 "-" "-"
[munged]::443 167.71.236.240 - - [28/Feb/2020:19:41:42 +0100] "POST /[munged]: HTTP/1.1" 200 7275 "-" "-"
[munged]::443 167.71.236.240 - - [28/Feb/2020:19:41:42 +0100] "POST /[munged]: HTTP/1.1" 200 7275 "-" "-"
[munged]::443 167.71.236.240 - - [28/Feb/2020:19:41:58 +0100] "POST /[munged]: HTTP/1.1" 200 7275 "-" "-"
[munged]::443 167.71.236.240 - - [28/Feb/2020:19:41:58 +0100] "POST /[munged]: HTTP/1.1" 200 7275 "-" "-"
[munged]::443 167.71.236.240 - - [28/Feb/2020:19:42:14 +0100] "POST /[munged]: HTTP/1.1" 200 7275 "-" "-"

WordPress login Brute force / Web App Attack on client site.

Sep 29 07:19:27 meumeu sshd[27336]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.236.0 
Sep 29 07:19:29 meumeu sshd[27336]: Failed password for invalid user patrick from 167.71.236.0 port 47930 ssh2
Sep 29 07:24:34 meumeu sshd[27965]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.236.0 
...

Sep 23 15:13:46 vtv3 sshd\[17245\]: Invalid user sublink from 186.18.108.3 port 37099
Sep 23 15:13:46 vtv3 sshd\[17245\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.18.108.3
Sep 23 15:13:48 vtv3 sshd\[17245\]: Failed password for invalid user sublink from 186.18.108.3 port 37099 ssh2
Sep 23 15:18:59 vtv3 sshd\[20298\]: Invalid user pankaj from 186.18.108.3 port 58254
Sep 23 15:18:59 vtv3 sshd\[20298\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.18.108.3
Sep 23 15:29:31 vtv3 sshd\[26175\]: Invalid user r_maner from 186.18.108.3 port 44097
Sep 23 15:29:31 vtv3 sshd\[26175\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.18.108.3
Sep 23 15:29:32 vtv3 sshd\[26175\]: Failed password for invalid user r_maner from 186.18.108.3 port 44097 ssh2
Sep 23 15:34:56 vtv3 sshd\[29061\]: Invalid user servercsgo from 186.18.108.3 port 37022
Sep 23 15:34:56 vtv3 sshd\[29061\]:

Sep 23 16:14:22 mail sshd[10197]: Invalid user kpaul from 121.122.141.49
Sep 23 16:14:22 mail sshd[10197]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.122.141.49
Sep 23 16:14:22 mail sshd[10197]: Invalid user kpaul from 121.122.141.49
Sep 23 16:14:24 mail sshd[10197]: Failed password for invalid user kpaul from 121.122.141.49 port 54452 ssh2
Sep 23 16:41:01 mail sshd[13464]: Invalid user elena from 121.122.141.49
...

Sep 23 06:52:56 home sshd[10939]: Invalid user test from 159.65.146.232 port 42132
Sep 23 06:52:56 home sshd[10939]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.65.146.232
Sep 23 06:52:56 home sshd[10939]: Invalid user test from 159.65.146.232 port 42132
Sep 23 06:52:58 home sshd[10939]: Failed password for invalid user test from 159.65.146.232 port 42132 ssh2
Sep 23 06:57:57 home sshd[10998]: Invalid user musikbot from 159.65.146.232 port 58362
Sep 23 06:57:57 home sshd[10998]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.65.146.232
Sep 23 06:57:57 home sshd[10998]: Invalid user musikbot from 159.65.146.232 port 58362
Sep 23 06:57:58 home sshd[10998]: Failed password for invalid user musikbot from 159.65.146.232 port 58362 ssh2
Sep 23 07:02:19 home sshd[11015]: Invalid user prueba from 159.65.146.232 port 42706
Sep 23 07:02:19 home sshd[11015]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=

IP Ban Report : https://help-dysk.pl/wordpress-firewall-plugins/ip/31.223.233.226/ 
 HU - 1H : (31)  
 Protection Against DDoS WordPress plugin :  
 "odzyskiwanie danych help-dysk" 
 IP Address Ranges by Country : HU 
 NAME ASN : ASN47116 
 
 IP : 31.223.233.226 
 
 CIDR : 31.223.232.0/21 
 
 PREFIX COUNT : 5 
 
 UNIQUE IP COUNT : 6656 
 
 
 WYKRYTE ATAKI Z ASN47116 :  
  1H - 1 
  3H - 1 
  6H - 1 
 12H - 1 
 24H - 1 
 
 INFO : SERVER - Looking for resource vulnerabilities Detected and Blocked by ADMIN  - data recovery

Sep 23 20:38:03 eventyay sshd[27653]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.213.172.204
Sep 23 20:38:06 eventyay sshd[27653]: Failed password for invalid user pi from 188.213.172.204 port 58588 ssh2
Sep 23 20:42:30 eventyay sshd[27793]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.213.172.204
...

Sep 23 12:00:30 plusreed sshd[7709]: Invalid user kf from 58.47.177.161
...

Sep 23 08:36:29 hpm sshd\[27887\]: Invalid user gmodserver from 129.226.56.22
Sep 23 08:36:29 hpm sshd\[27887\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.226.56.22
Sep 23 08:36:31 hpm sshd\[27887\]: Failed password for invalid user gmodserver from 129.226.56.22 port 44852 ssh2
Sep 23 08:41:26 hpm sshd\[28469\]: Invalid user test from 129.226.56.22
Sep 23 08:41:26 hpm sshd\[28469\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.226.56.22

Sep 23 17:16:58 dedicated sshd[21826]: Invalid user www from 73.5.207.198 port 60487

fraudulent SSH attempt

104.140.183.62 - - [23/Sep/2019:08:16:37 -0400] "GET /?page=products&action=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd&manufacturerID=1&productID=6501.15M&linkID=3128 HTTP/1.1" 200 17212 "https://baldwinbrasshardware.com/?page=products&action=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd&manufacturerID=1&productID=6501.15M&linkID=3128" "Mozilla/5.0 (Windows NT 10.0; WOW64; Rv:50.0) Gecko/20100101 Firefox/50.0"
...

\[2019-09-23 14:28:10\] NOTICE\[2270\] chan_sip.c: Registration from '\' failed for '195.154.48.30:56913' - Wrong password
\[2019-09-23 14:28:10\] SECURITY\[2283\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-09-23T14:28:10.177-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="5631",SessionID="0x7fcd8c57a408",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/195.154.48.30/56913",Challenge="4b8d5e97",ReceivedChallenge="4b8d5e97",ReceivedHash="3bb31c9339a617325c28fa769036a9f6"
\[2019-09-23 14:32:03\] NOTICE\[2270\] chan_sip.c: Registration from '\' failed for '195.154.48.30:61551' - Wrong password
\[2019-09-23 14:32:03\] SECURITY\[2283\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-09-23T14:32:03.072-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="22801",SessionID="0x7fcd8c12cad8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/195.154

Sep 23 14:19:04 XXX sshd[48300]: Invalid user user from 45.55.225.152 port 60183

" "

Sep 23 05:01:35 aiointranet sshd\[27813\]: Invalid user faxserver from 188.131.200.191
Sep 23 05:01:35 aiointranet sshd\[27813\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.131.200.191
Sep 23 05:01:36 aiointranet sshd\[27813\]: Failed password for invalid user faxserver from 188.131.200.191 port 59493 ssh2
Sep 23 05:05:16 aiointranet sshd\[28111\]: Invalid user ftpuser from 188.131.200.191
Sep 23 05:05:16 aiointranet sshd\[28111\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.131.200.191

Sep 23 14:35:19 at sshd\[17400\]: Invalid user pi from 86.35.42.74 port 42288
Sep 23 14:35:19 at sshd\[17402\]: Invalid user pi from 86.35.42.74 port 42296
Sep 23 14:35:19 at sshd\[17400\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=86.35.42.74
Sep 23 14:35:19 at sshd\[17402\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=86.35.42.74
Sep 23 14:35:21 at sshd\[17400\]: Failed password for invalid user pi from 86.35.42.74 port 42288 ssh2
Sep 23 14:35:21 at sshd\[17402\]: Failed password for invalid user pi from 86.35.42.74 port 42296 ssh2
...