Oct  1 10:28:36 rotator sshd\[6571\]: Address 54.39.151.167 maps to tor-exit.deusvult.xyz, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!Oct  1 10:28:38 rotator sshd\[6571\]: Failed password for root from 54.39.151.167 port 39368 ssh2Oct  1 10:28:41 rotator sshd\[6571\]: Failed password for root from 54.39.151.167 port 39368 ssh2Oct  1 10:28:44 rotator sshd\[6571\]: Failed password for root from 54.39.151.167 port 39368 ssh2Oct  1 10:28:47 rotator sshd\[6571\]: Failed password for root from 54.39.151.167 port 39368 ssh2Oct  1 10:28:50 rotator sshd\[6571\]: Failed password for root from 54.39.151.167 port 39368 ssh2
...

Oct  1 10:21:59 lnxmail61 sshd[783]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.230.73.133

Oct  1 10:01:52 nextcloud sshd\[21140\]: Invalid user airaghi from 116.196.85.71
Oct  1 10:01:52 nextcloud sshd\[21140\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.196.85.71
Oct  1 10:01:54 nextcloud sshd\[21140\]: Failed password for invalid user airaghi from 116.196.85.71 port 35486 ssh2
...

Oct  1 00:49:44 xtremcommunity sshd\[53548\]: Invalid user pi from 94.177.161.168 port 54903
Oct  1 00:49:44 xtremcommunity sshd\[53548\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.177.161.168
Oct  1 00:49:45 xtremcommunity sshd\[53548\]: Failed password for invalid user pi from 94.177.161.168 port 54903 ssh2
Oct  1 00:53:55 xtremcommunity sshd\[53691\]: Invalid user vf from 94.177.161.168 port 47009
Oct  1 00:53:55 xtremcommunity sshd\[53691\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.177.161.168
...

Invalid user tv from 54.38.22.58 port 60936

Brute SSH

Sep 30 22:54:27 friendsofhawaii sshd\[29087\]: Invalid user teamspeak3 from 178.128.213.91
Sep 30 22:54:27 friendsofhawaii sshd\[29087\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.213.91
Sep 30 22:54:29 friendsofhawaii sshd\[29087\]: Failed password for invalid user teamspeak3 from 178.128.213.91 port 60406 ssh2
Sep 30 22:59:12 friendsofhawaii sshd\[29466\]: Invalid user en from 178.128.213.91
Sep 30 22:59:12 friendsofhawaii sshd\[29466\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.213.91

\[2019-10-01 05:28:30\] NOTICE\[1948\] chan_sip.c: Registration from '\' failed for '188.165.196.107:51749' - Wrong password
\[2019-10-01 05:28:30\] SECURITY\[2006\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-10-01T05:28:30.287-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="3008",SessionID="0x7f1e1c27a4c8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/188.165.196.107/51749",Challenge="5cb8fa4e",ReceivedChallenge="5cb8fa4e",ReceivedHash="f1196552c6f808fe932eda91c62eea16"
\[2019-10-01 05:30:52\] NOTICE\[1948\] chan_sip.c: Registration from '\' failed for '188.165.196.107:65392' - Wrong password
\[2019-10-01 05:30:52\] SECURITY\[2006\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-10-01T05:30:52.021-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="146",SessionID="0x7f1e1c27a4c8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/188.1

$f2bV_matches

Oct  1 09:18:00 venus sshd\[21250\]: Invalid user 123456 from 51.83.69.78 port 50806
Oct  1 09:18:00 venus sshd\[21250\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.83.69.78
Oct  1 09:18:02 venus sshd\[21250\]: Failed password for invalid user 123456 from 51.83.69.78 port 50806 ssh2
...

2019-10-01T11:31:54.963394tmaserv sshd\[3708\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.65.171.113  user=rpc
2019-10-01T11:31:56.972743tmaserv sshd\[3708\]: Failed password for rpc from 159.65.171.113 port 43562 ssh2
2019-10-01T11:36:06.356714tmaserv sshd\[3958\]: Invalid user lpadmin from 159.65.171.113 port 55836
2019-10-01T11:36:06.361066tmaserv sshd\[3958\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.65.171.113
2019-10-01T11:36:08.631735tmaserv sshd\[3958\]: Failed password for invalid user lpadmin from 159.65.171.113 port 55836 ssh2
2019-10-01T11:40:04.906162tmaserv sshd\[4081\]: Invalid user prueba1 from 159.65.171.113 port 39866
...

Wordpress bruteforce

Oct  1 05:48:50 vps691689 sshd[24990]: Failed password for root from 218.92.0.138 port 14447 ssh2
Oct  1 05:49:01 vps691689 sshd[24990]: Failed password for root from 218.92.0.138 port 14447 ssh2
Oct  1 05:49:03 vps691689 sshd[24990]: Failed password for root from 218.92.0.138 port 14447 ssh2
Oct  1 05:49:03 vps691689 sshd[24990]: error: maximum authentication attempts exceeded for root from 218.92.0.138 port 14447 ssh2 [preauth]
...

schuetzenmusikanten.de 54.69.184.224 \[01/Oct/2019:09:32:13 +0200\] "POST /wp-login.php HTTP/1.1" 200 5682 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"
schuetzenmusikanten.de 54.69.184.224 \[01/Oct/2019:09:32:15 +0200\] "POST /wp-login.php HTTP/1.1" 200 5648 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"

IP Ban Report : https://help-dysk.pl/wordpress-firewall-plugins/ip/125.27.137.177/ 
 TH - 1H : (90)  
 Protection Against DDoS WordPress plugin :  
 "odzyskiwanie danych help-dysk" 
 IP Address Ranges by Country : TH 
 NAME ASN : ASN23969 
 
 IP : 125.27.137.177 
 
 CIDR : 125.27.136.0/22 
 
 PREFIX COUNT : 1783 
 
 UNIQUE IP COUNT : 1183744 
 
 
 WYKRYTE ATAKI Z ASN23969 :  
  1H - 2 
  3H - 6 
  6H - 10 
 12H - 12 
 24H - 32 
 
 DateTime : 2019-10-01 05:48:17 
 
 INFO : Looking for resource vulnerabilities 403 Detected and Blocked by ADMIN  - data recovery