CloudCIX Reconnaissance Scan Detected, PTR: PTR record not found

Sep  5 15:24:53 thevastnessof sshd[29860]: Failed password for root from 23.129.64.168 port 31778 ssh2
...

Sep  5 12:34:40 [host] sshd[15017]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.208.88  user=www-data
Sep  5 12:34:42 [host] sshd[15017]: Failed password for www-data from 167.71.208.88 port 41200 ssh2
Sep  5 12:39:14 [host] sshd[15196]: Invalid user test from 167.71.208.88
Sep  5 12:39:14 [host] sshd[15196]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.208.88

Sep  5 08:29:53 *** sshd[7844]: Invalid user admin from 123.21.129.16

Sep  5 06:08:29 aiointranet sshd\[16387\]: Invalid user test from 68.183.132.245
Sep  5 06:08:29 aiointranet sshd\[16387\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.183.132.245
Sep  5 06:08:31 aiointranet sshd\[16387\]: Failed password for invalid user test from 68.183.132.245 port 59030 ssh2
Sep  5 06:13:06 aiointranet sshd\[16849\]: Invalid user minecraft from 68.183.132.245
Sep  5 06:13:06 aiointranet sshd\[16849\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.183.132.245

Oracle WebLogic WLS Security Component Remote Code Execution Vulnerability 2017-10271, PTR: PTR record not found

Sep  5 05:32:40 sachi sshd\[28224\]: Invalid user test1 from 51.158.162.242
Sep  5 05:32:40 sachi sshd\[28224\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.158.162.242
Sep  5 05:32:42 sachi sshd\[28224\]: Failed password for invalid user test1 from 51.158.162.242 port 50348 ssh2
Sep  5 05:37:27 sachi sshd\[28605\]: Invalid user student from 51.158.162.242
Sep  5 05:37:27 sachi sshd\[28605\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.158.162.242

Sep  5 03:17:00 web9 sshd\[19647\]: Invalid user testuser from 125.27.12.20
Sep  5 03:17:00 web9 sshd\[19647\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.27.12.20
Sep  5 03:17:03 web9 sshd\[19647\]: Failed password for invalid user testuser from 125.27.12.20 port 52798 ssh2
Sep  5 03:22:11 web9 sshd\[20803\]: Invalid user mysql2 from 125.27.12.20
Sep  5 03:22:11 web9 sshd\[20803\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.27.12.20

\[2019-09-05 16:28:03\] NOTICE\[25634\] res_pjsip/pjsip_distributor.c: Request 'REGISTER' from '\' failed for '5.62.41.170:13183' \(callid: 435197573-2138794324-757683197\) - Failed to authenticate
\[2019-09-05 16:28:03\] SECURITY\[1715\] res_security_log.c: SecurityEvent="ChallengeResponseFailed",EventTV="2019-09-05T16:28:03.245+0200",Severity="Error",Service="PJSIP",EventVersion="1",AccountID="\",SessionID="435197573-2138794324-757683197",LocalAddress="IPV4/UDP/188.40.118.248/5060",RemoteAddress="IPV4/UDP/5.62.41.170/13183",Challenge="1567693683/3cbdf02a95fca26fe4f20a844136b0eb",Response="d1791c093fab0a43eaafd242d26596ec",ExpectedResponse=""
\[2019-09-05 16:28:03\] NOTICE\[5713\] res_pjsip/pjsip_distributor.c: Request 'REGISTER' from '\' failed for '5.62.41.170:13183' \(callid: 435197573-2138794324-757683197\) - Failed to authenticate
\[2019-09-05 16:28:03\] SECURITY\[1715\] res_security_log.c: SecurityEvent="ChallengeResponseFailed"

Sep  5 06:02:54 sachi sshd\[30771\]: Invalid user user from 185.196.118.119
Sep  5 06:02:54 sachi sshd\[30771\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.196.118.119
Sep  5 06:02:56 sachi sshd\[30771\]: Failed password for invalid user user from 185.196.118.119 port 41074 ssh2
Sep  5 06:07:12 sachi sshd\[31103\]: Invalid user admin01 from 185.196.118.119
Sep  5 06:07:12 sachi sshd\[31103\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.196.118.119

SIPVicious Scanner Detection, PTR: 6-35-31-64.static.reverse.lstn.net.

WordPress wp-login brute force :: 202.152.159.117 0.652 BYPASS [05/Sep/2019:18:29:08  1000] [censored_1] "POST /wp-login.php HTTP/1.1" 200 3972 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"

B: /wp-login.php attack

Sep  5 13:33:25 microserver sshd[16784]: Invalid user sinusbot from 62.210.129.207 port 34094
Sep  5 13:33:25 microserver sshd[16784]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.210.129.207
Sep  5 13:33:28 microserver sshd[16784]: Failed password for invalid user sinusbot from 62.210.129.207 port 34094 ssh2
Sep  5 13:38:13 microserver sshd[17433]: Invalid user qwerty321 from 62.210.129.207 port 50416
Sep  5 13:38:13 microserver sshd[17433]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.210.129.207
Sep  5 13:52:55 microserver sshd[19471]: Invalid user 130 from 62.210.129.207 port 42916
Sep  5 13:52:55 microserver sshd[19471]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.210.129.207
Sep  5 13:52:57 microserver sshd[19471]: Failed password for invalid user 130 from 62.210.129.207 port 42916 ssh2
Sep  5 13:58:09 microserver sshd[20151]: Invalid user 204 from 62.210.129.207 por

WordPress XMLRPC scan :: 201.159.106.130 0.192 BYPASS [05/Sep/2019:18:29:02  1000] www.[censored_1] "POST /xmlrpc.php HTTP/1.1" 200 382 "https://www.[censored_1]/" "PHP/6.2.96"