Port scan

2019-11-13T07:11:38.818104tmaserv sshd\[23153\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=41.40.88.191
2019-11-13T07:11:40.158990tmaserv sshd\[23153\]: Failed password for invalid user cochrane from 41.40.88.191 port 23102 ssh2
2019-11-13T08:19:33.464402tmaserv sshd\[26715\]: Invalid user guest from 41.40.88.191 port 52936
2019-11-13T08:19:33.467441tmaserv sshd\[26715\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=41.40.88.191
2019-11-13T08:19:35.233654tmaserv sshd\[26715\]: Failed password for invalid user guest from 41.40.88.191 port 52936 ssh2
2019-11-13T08:26:56.583890tmaserv sshd\[27129\]: Invalid user ronsse from 41.40.88.191 port 14731
2019-11-13T08:26:56.586795tmaserv sshd\[27129\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=41.40.88.191
...

Nov 13 07:28:48 cp sshd[11062]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=198.13.55.198

Lines containing failures of 185.102.238.194
Oct 27 12:32:31 server-name sshd[22572]: Did not receive identification string from 185.102.238.194 port 59802
Oct 27 12:32:35 server-name sshd[22574]: Invalid user noc from 185.102.238.194 port 64157
Oct 27 12:32:35 server-name sshd[22574]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.102.238.194 
Oct 27 12:32:37 server-name sshd[22574]: Failed password for invalid user noc from 185.102.238.194 port 64157 ssh2


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=185.102.238.194

Lines containing failures of 190.0.11.90
Oct 27 05:59:23 server-name sshd[31191]: Did not receive identification string from 190.0.11.90 port 51861
Oct 27 05:59:32 server-name sshd[31192]: Invalid user service from 190.0.11.90 port 59613
Oct 27 05:59:32 server-name sshd[31192]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.0.11.90 
Oct 27 05:59:35 server-name sshd[31192]: Failed password for invalid user service from 190.0.11.90 port 59613 ssh2


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=190.0.11.90

(From vickyrowe543@gmail.com) Hi!

I was checking on your website, and it seems you might have to update it to keep up with the current trends. People nowadays are more comfortable browsing the internet on their phone or tablet since it's more convenient. There were some issues when I was viewing it in mobile platforms, I can fix that for you. 

I already like its design and overall user-interface, but I believe that your website can get even better so that your potential clients can be more engaged to do business with you, thus making your website more profitable. I'm all about flexibility and I'm sure that we can work out something to fit your needs. 

My rates are cheap since I'm committed to helping small businesses. I'll answer all the questions you have for me during a free consultation over the phone. I'd also like to know your ideas for the website, so please reply with the best time for me to call and your preferred contact details. I look forward to hearing back from you. 

Best Regards,
Vick

xmlrpc attack

ft-1848-basketball.de 207.180.198.241 \[13/Nov/2019:07:28:43 +0100\] "POST /wp-login.php HTTP/1.1" 200 2164 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"
ft-1848-basketball.de 207.180.198.241 \[13/Nov/2019:07:28:44 +0100\] "POST /wp-login.php HTTP/1.1" 200 2136 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"

2019-11-13 08:40:07 dovecot_login authenticator failed for \(\[45.82.153.76\]\) \[45.82.153.76\]: 535 Incorrect authentication data \(set_id=bt@opso.it\)
2019-11-13 08:40:16 dovecot_login authenticator failed for \(\[45.82.153.76\]\) \[45.82.153.76\]: 535 Incorrect authentication data
2019-11-13 08:40:27 dovecot_login authenticator failed for \(\[45.82.153.76\]\) \[45.82.153.76\]: 535 Incorrect authentication data
2019-11-13 08:40:33 dovecot_login authenticator failed for \(\[45.82.153.76\]\) \[45.82.153.76\]: 535 Incorrect authentication data
2019-11-13 08:40:47 dovecot_login authenticator failed for \(\[45.82.153.76\]\) \[45.82.153.76\]: 535 Incorrect authentication data

web-1 [ssh_2] SSH Attack

\[2019-11-13 02:31:24\] NOTICE\[2601\] chan_sip.c: Registration from '\' failed for '81.171.85.101:62626' - Wrong password
\[2019-11-13 02:31:24\] SECURITY\[2634\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-11-13T02:31:24.473-0500",Severity="Error",Service="SIP",EventVersion="2",AccountID="2223",SessionID="0x7fdf2cd1cd48",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/81.171.85.101/62626",Challenge="7cf66a7a",ReceivedChallenge="7cf66a7a",ReceivedHash="a9b1e31bf1f2c7afe2d658bb048c6a38"
\[2019-11-13 02:31:36\] NOTICE\[2601\] chan_sip.c: Registration from '\' failed for '81.171.85.101:50927' - Wrong password
\[2019-11-13 02:31:36\] SECURITY\[2634\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-11-13T02:31:36.590-0500",Severity="Error",Service="SIP",EventVersion="2",AccountID="987",SessionID="0x7fdf2c3e82d8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/81.171.85.1

Lines containing failures of 85.154.47.69
Oct 17 17:35:00 server-name sshd[5687]: Invalid user admin from 85.154.47.69 port 47806
Oct 17 17:35:00 server-name sshd[5687]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.154.47.69 
Oct 17 17:35:02 server-name sshd[5687]: Failed password for invalid user admin from 85.154.47.69 port 47806 ssh2
Oct 17 17:35:04 server-name sshd[5687]: Connection closed by invalid user admin 85.154.47.69 port 47806 [preauth]


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=85.154.47.69

2019-11-13T08:09:33.468957abusebot-5.cloudsearch.cf sshd\[23254\]: Invalid user linux from 218.95.167.16 port 9212

Nov 13 04:37:36 firewall sshd[8814]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.105.129.129  user=sync
Nov 13 04:37:38 firewall sshd[8814]: Failed password for sync from 46.105.129.129 port 50619 ssh2
Nov 13 04:41:03 firewall sshd[8890]: Invalid user test from 46.105.129.129
...

Mail sent to address hacked/leaked from Last.fm

"Inject  etc/passwd"