2020-02-17 22:23:15 SMTP protocol synchronization error (input sent without waiting for greeting): rejected connection from H=[192.241.213.126] input="EHLO zg0213a-61
"

Unauthorized connection attempt detected from IP address 118.186.203.34 to port 1433 [J]

MultiHost/MultiPort Probe, Scan, Hack -

Mar  1 20:19:32 server sshd\[7359\]: Invalid user admin1 from 200.196.249.170
Mar  1 20:19:32 server sshd\[7359\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.196.249.170 
Mar  1 20:19:33 server sshd\[7359\]: Failed password for invalid user admin1 from 200.196.249.170 port 38080 ssh2
Mar  1 20:38:14 server sshd\[10590\]: Invalid user export from 200.196.249.170
Mar  1 20:38:14 server sshd\[10590\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.196.249.170 
...

Mar  1 19:24:23 hcbbdb sshd\[414\]: Invalid user hector from 190.96.172.101
Mar  1 19:24:23 hcbbdb sshd\[414\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.96.172.101
Mar  1 19:24:25 hcbbdb sshd\[414\]: Failed password for invalid user hector from 190.96.172.101 port 40276 ssh2
Mar  1 19:33:50 hcbbdb sshd\[1694\]: Invalid user nginx from 190.96.172.101
Mar  1 19:33:50 hcbbdb sshd\[1694\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.96.172.101

Mar  1 20:16:31 v22018076622670303 sshd\[20053\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.85.42.182  user=root
Mar  1 20:16:34 v22018076622670303 sshd\[20053\]: Failed password for root from 112.85.42.182 port 64707 ssh2
Mar  1 20:16:37 v22018076622670303 sshd\[20053\]: Failed password for root from 112.85.42.182 port 64707 ssh2
...

Email rejected due to spam filtering

2020-03-01T20:40:11.000726  sshd[2707]: Invalid user louis from 187.72.69.49 port 44312
2020-03-01T20:40:11.017108  sshd[2707]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.72.69.49
2020-03-01T20:40:11.000726  sshd[2707]: Invalid user louis from 187.72.69.49 port 44312
2020-03-01T20:40:12.687867  sshd[2707]: Failed password for invalid user louis from 187.72.69.49 port 44312 ssh2
...

Mar  1 20:10:23 * sshd[10310]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.115.66
Mar  1 20:10:25 * sshd[10310]: Failed password for invalid user alex from 51.38.115.66 port 53451 ssh2

Automatic report - Port Scan Attack

Mar  1 20:21:10 debian64 sshd[2610]: Failed password for root from 222.186.30.145 port 40496 ssh2
Mar  1 20:21:13 debian64 sshd[2610]: Failed password for root from 222.186.30.145 port 40496 ssh2
...

\[Sun Mar 01 17:38:22 2020\] \[error\] \[client 34.212.128.86\] ModSecurity: collection_retrieve_ex: Unable to retrieve collection \(name "global", key "global"\). Use SecDataDir to define data directory first. \[hostname "167.114.2.187"\] \[uri "/w00tw00t.at.blackhats.romanian.anti-sec:\)"\] \[unique_id "XlvW7qdyArsAABPfNvQAAAAA"\]
\[Sun Mar 01 17:38:22 2020\] \[error\] \[client 34.212.128.86\] ModSecurity: collection_retrieve_ex: Unable to retrieve collection \(name "ip", key "34.212.128.86_28782b907f7d9bde163d4b5ff7f449d84f6dddaa"\). Use SecDataDir to define data directory first. \[hostname "167.114.2.187"\] \[uri "/w00tw00t.at.blackhats.romanian.anti-sec:\)"\] \[unique_id "XlvW7qdyArsAABPfNvQAAAAA"\]
\[Sun Mar 01 17:38:22 2020\] \[error\] \[client 34.212.128.86\] ModSecurity: Warning. Matched phrase "zmeu" at REQUEST_HEADERS:User-Agent. \[file "/etc/httpd/conf/modsecurity.d/rules/REQUEST-913-SCANNER-DETECTION.conf"\] \[line "59"\] \[id "913100"\] \[rev "2"\] \[msg "Found Use

Malicious/Probing: /wp-login.php

[2020-03-01 14:22:31] NOTICE[1148] chan_sip.c: Registration from 'xxxxxtestxxxx ' failed for '104.238.220.208:5066' - Wrong password
[2020-03-01 14:22:31] SECURITY[1163] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-03-01T14:22:31.612-0500",Severity="Error",Service="SIP",EventVersion="2",AccountID="xxxxxtestxxxx",SessionID="0x7fd82c4d9f48",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/104.238.220.208/5066",Challenge="271b6473",ReceivedChallenge="271b6473",ReceivedHash="8dc47e78696780cd70769921119f7838"
[2020-03-01 14:22:31] NOTICE[1148] chan_sip.c: Registration from '9996 ' failed for '104.238.220.208:5066' - Wrong password
[2020-03-01 14:22:31] SECURITY[1163] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-03-01T14:22:31.960-0500",Severity="Error",Service="SIP",EventVersion="2",AccountID="9996",SessionID="0x7fd82c538db8",LocalAddress="IPV4/UDP/192.168.244.6/506
...

Attempt to attack host OS, exploiting network vulnerabilities, on 01-03-2020 13:20:10.