WordPress wp-login brute force :: 2001:41d0:1:da44::1 0.148 BYPASS [12/Nov/2019:14:33:19  0000] [censored_4] "POST /wp-login.php HTTP/1.1" 200 1561 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"

Unauthorized connection attempt detected from IP address 90.68.28.214 to port 445

Dec 14 15:41:55  exim[22054]: [1\51] 1ig8cD-0005ji-Gj H=coast.jcnovel.com (coast.hislult.com) [63.81.87.157] F= rejected after DATA: This message scored 101.2 spam points.

Invalid user superstage from 35.159.51.64 port 47168

SSH Brute Force

Dec 14 15:36:07 srv1 sshd[21996]: Did not receive identification string from 27.5.167.146
Dec 14 15:36:10 srv1 sshd[22054]: Invalid user dircreate from 27.5.167.146
Dec 14 15:36:11 srv1 sshd[22054]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.5.167.146 
Dec 14 15:36:13 srv1 sshd[22054]: Failed password for invalid user dircreate from 27.5.167.146 port 60362 ssh2
Dec 14 15:36:13 srv1 sshd[22071]: Connection closed by 27.5.167.146


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=27.5.167.146

Dec 14 20:22:24 pornomens sshd\[24950\]: Invalid user tomcat from 49.235.192.71 port 47198
Dec 14 20:22:24 pornomens sshd\[24950\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.235.192.71
Dec 14 20:22:26 pornomens sshd\[24950\]: Failed password for invalid user tomcat from 49.235.192.71 port 47198 ssh2
...

Dec 14 23:00:34 microserver sshd[35105]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.203.80.96  user=root
Dec 14 23:00:36 microserver sshd[35105]: Failed password for root from 116.203.80.96 port 45582 ssh2
Dec 14 23:08:57 microserver sshd[36191]: Invalid user estacio from 116.203.80.96 port 39116
Dec 14 23:08:57 microserver sshd[36191]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.203.80.96
Dec 14 23:08:58 microserver sshd[36191]: Failed password for invalid user estacio from 116.203.80.96 port 39116 ssh2
Dec 14 23:23:27 microserver sshd[38472]: Invalid user 123 from 116.203.80.96 port 37588
Dec 14 23:23:27 microserver sshd[38472]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.203.80.96
Dec 14 23:23:30 microserver sshd[38472]: Failed password for invalid user 123 from 116.203.80.96 port 37588 ssh2
Dec 14 23:28:32 microserver sshd[39290]: Invalid user rachelle from 116.2

Autoban   181.46.140.207 AUTH/CONNECT

Dec 14 17:29:44 server sshd\[32064\]: Invalid user support from 86.110.180.50
Dec 14 17:29:44 server sshd\[32064\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=86.110.180.50 
Dec 14 17:29:46 server sshd\[32064\]: Failed password for invalid user support from 86.110.180.50 port 58250 ssh2
Dec 14 17:41:35 server sshd\[3432\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=86.110.180.50  user=lp
Dec 14 17:41:37 server sshd\[3432\]: Failed password for lp from 86.110.180.50 port 36791 ssh2
...

Webapp hits @ plonkatronixBL
You can't even trust the top level people you buy your domains off!
Get your FREE bad IP list @ plonkatronix.com

12/14/2019-15:41:44.951732 190.144.6.245 Protocol: 6 ET SCAN Suspicious inbound to MSSQL port 1433

Dec 14 16:22:58 ws25vmsma01 sshd[62826]: Failed password for root from 125.77.30.71 port 57795 ssh2
...

Automatic report - Port Scan Attack

Invalid user siti from 123.207.5.190 port 39842

Dec 14 12:48:33 firewall sshd[26898]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.149.22.37
Dec 14 12:48:33 firewall sshd[26898]: Invalid user ident from 201.149.22.37
Dec 14 12:48:35 firewall sshd[26898]: Failed password for invalid user ident from 201.149.22.37 port 58870 ssh2
...