" "

$f2bV_matches

2019-10-06T13:49:04.601409MailD postfix/smtpd[17896]: NOQUEUE: reject: RCPT from host-205-82.host.stetnet.com.br[187.73.205.82]: 554 5.7.1 Service unavailable; Client host [187.73.205.82] blocked using bl.spamcop.net; Blocked - see https://www.spamcop.net/bl.shtml?187.73.205.82; from= to= proto=ESMTP helo=
2019-10-06T13:49:05.212667MailD postfix/smtpd[17896]: NOQUEUE: reject: RCPT from host-205-82.host.stetnet.com.br[187.73.205.82]: 554 5.7.1 Service unavailable; Client host [187.73.205.82] blocked using bl.spamcop.net; Blocked - see https://www.spamcop.net/bl.shtml?187.73.205.82; from= to= proto=ESMTP helo=
2019-10-06T13:49:05.779258MailD postfix/smtpd[17896]: NOQUEUE: reject: RCPT from host-205-82.host.stetnet.com.br[187.73.205.82]: 554 5.7.1 Service unavailable; Client host [187.73.205.82] blocked using bl.spamcop.net; Blocked - see https://w

2019-10-06T12:15:53.051225shield sshd\[7998\]: Invalid user @WSX\#EDC from 148.70.41.33 port 34690
2019-10-06T12:15:53.056683shield sshd\[7998\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.41.33
2019-10-06T12:15:55.413833shield sshd\[7998\]: Failed password for invalid user @WSX\#EDC from 148.70.41.33 port 34690 ssh2
2019-10-06T12:21:21.020955shield sshd\[9081\]: Invalid user @WSX\#EDC from 148.70.41.33 port 45404
2019-10-06T12:21:21.025153shield sshd\[9081\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.41.33

Oct  6 14:11:02 legacy sshd[14146]: Failed password for root from 95.215.58.146 port 58754 ssh2
Oct  6 14:15:36 legacy sshd[14293]: Failed password for root from 95.215.58.146 port 50467 ssh2
...

Oct  6 02:15:56 hanapaa sshd\[8554\]: Invalid user Losenord1@3 from 46.101.17.215
Oct  6 02:15:56 hanapaa sshd\[8554\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=policies.musiciansfirst.com
Oct  6 02:15:58 hanapaa sshd\[8554\]: Failed password for invalid user Losenord1@3 from 46.101.17.215 port 58318 ssh2
Oct  6 02:19:43 hanapaa sshd\[8877\]: Invalid user Admin@800 from 46.101.17.215
Oct  6 02:19:43 hanapaa sshd\[8877\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=policies.musiciansfirst.com

Oct  6 08:19:51 xtremcommunity sshd\[240731\]: Invalid user server@1234 from 128.199.82.144 port 56180
Oct  6 08:19:51 xtremcommunity sshd\[240731\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.82.144
Oct  6 08:19:53 xtremcommunity sshd\[240731\]: Failed password for invalid user server@1234 from 128.199.82.144 port 56180 ssh2
Oct  6 08:24:19 xtremcommunity sshd\[240958\]: Invalid user Colorado2017 from 128.199.82.144 port 38714
Oct  6 08:24:19 xtremcommunity sshd\[240958\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.82.144
...

WordPress wp-login brute force :: 125.214.50.213 0.124 BYPASS [06/Oct/2019:22:49:44  1100] [censored_1] "POST /wp-login.php HTTP/1.1" 200 3972 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"

Oct  6 12:08:17 sshgateway sshd\[3364\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.180.19  user=root
Oct  6 12:08:19 sshgateway sshd\[3364\]: Failed password for root from 222.186.180.19 port 59244 ssh2
Oct  6 12:08:36 sshgateway sshd\[3364\]: error: maximum authentication attempts exceeded for root from 222.186.180.19 port 59244 ssh2 \[preauth\]

Automatic report - Port Scan Attack

Automatic report - XMLRPC Attack

SSH authentication failure x 6 reported by Fail2Ban
...

\[2019-10-06 13:44:47\] NOTICE\[28964\] res_pjsip/pjsip_distributor.c: Request 'REGISTER' from '\' failed for '185.117.118.187:57690' \(callid: 1482589021-1688183888-640310229\) - Failed to authenticate
\[2019-10-06 13:44:47\] SECURITY\[1715\] res_security_log.c: SecurityEvent="ChallengeResponseFailed",EventTV="2019-10-06T13:44:47.024+0200",Severity="Error",Service="PJSIP",EventVersion="1",AccountID="\",SessionID="1482589021-1688183888-640310229",LocalAddress="IPV4/UDP/188.40.118.248/5060",RemoteAddress="IPV4/UDP/185.117.118.187/57690",Challenge="1570362286/f19a9dc5d89ddcc2f130e221072c9170",Response="20a637f9548cc49c2876de772f639b6c",ExpectedResponse=""
\[2019-10-06 13:48:15\] NOTICE\[32542\] res_pjsip/pjsip_distributor.c: Request 'REGISTER' from '\' failed for '185.117.118.187:54231' \(callid: 883951133-1526915647-1418467370\) - Failed to authenticate
\[2019-10-06 13:48:15\] SECURITY\[1715\] res_security_log.c: SecurityEvent="Challeng

Oct  6 07:53:47 ny01 sshd[12195]: Failed password for root from 49.88.112.117 port 16620 ssh2
Oct  6 07:54:29 ny01 sshd[12324]: Failed password for root from 49.88.112.117 port 40070 ssh2

" "