Automatic report - Port Scan Attack

2019-09-30 22:47:53 H=(host-21.193.162.46.ucom.am) [46.162.193.21]:58015 I=[192.147.25.65]:25 F= rejected RCPT : RBL: found in thrukfz5b56tq6xao6odgdyjrq.zen.dq.spamhaus.net (127.0.0.3, 127.0.0.11, 127.0.0.4) (https://www.spamhaus.org/query/ip/46.162.193.21)
2019-09-30 22:47:53 H=(host-21.193.162.46.ucom.am) [46.162.193.21]:58015 I=[192.147.25.65]:25 F= rejected RCPT : RBL: found in thrukfz5b56tq6xao6odgdyjrq.zen.dq.spamhaus.net (127.0.0.3, 127.0.0.11, 127.0.0.4) (https://www.spamhaus.org/query/ip/46.162.193.21)
2019-09-30 22:47:54 H=(host-21.193.162.46.ucom.am) [46.162.193.21]:58015 I=[192.147.25.65]:25 F= rejected RCPT : RBL: found in thrukfz5b56tq6xao6odgdyjrq.zen.dq.spamhaus.net (127.0.0.3, 127.0.0.4, 127.0.0.11) (https://www.spamhaus.org/sbl/query/SBLCSS)
...

Oct  1 12:26:47 vps647732 sshd[18583]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=151.80.60.151
Oct  1 12:26:49 vps647732 sshd[18583]: Failed password for invalid user couchdb from 151.80.60.151 port 34552 ssh2
...

Oct  1 10:15:52 vpn01 sshd[16874]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.129.220.214
Oct  1 10:15:54 vpn01 sshd[16874]: Failed password for invalid user pos from 103.129.220.214 port 35006 ssh2
...

Oct  1 11:50:54 vps691689 sshd[2784]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.82.121.34
Oct  1 11:50:56 vps691689 sshd[2784]: Failed password for invalid user admin from 183.82.121.34 port 45713 ssh2
...

IP Ban Report : https://help-dysk.pl/wordpress-firewall-plugins/ip/151.16.122.236/ 
 IT - 1H : (176)  
 Protection Against DDoS WordPress plugin :  
 "odzyskiwanie danych help-dysk" 
 IP Address Ranges by Country : IT 
 NAME ASN : ASN1267 
 
 IP : 151.16.122.236 
 
 CIDR : 151.16.0.0/16 
 
 PREFIX COUNT : 161 
 
 UNIQUE IP COUNT : 6032640 
 
 
 WYKRYTE ATAKI Z ASN1267 :  
  1H - 2 
  3H - 6 
  6H - 10 
 12H - 15 
 24H - 27 
 
 DateTime : 2019-10-01 05:47:43 
 
 INFO : Port MAX SCAN Scan Detected and Blocked by ADMIN  - data recovery

WordPress login Brute force / Web App Attack on client site.

IP Ban Report : https://help-dysk.pl/wordpress-firewall-plugins/ip/201.190.211.102/ 
 AR - 1H : (76)  
 Protection Against DDoS WordPress plugin :  
 "odzyskiwanie danych help-dysk" 
 IP Address Ranges by Country : AR 
 NAME ASN : ASN28075 
 
 IP : 201.190.211.102 
 
 CIDR : 201.190.208.0/22 
 
 PREFIX COUNT : 128 
 
 UNIQUE IP COUNT : 67328 
 
 
 WYKRYTE ATAKI Z ASN28075 :  
  1H - 1 
  3H - 1 
  6H - 2 
 12H - 2 
 24H - 2 
 
 DateTime : 2019-10-01 05:47:43 
 
 INFO : Port MAX SCAN Scan Detected and Blocked by ADMIN  - data recovery

Oct  1 03:13:34 lvps83-169-44-148 sshd[8795]: warning: /etc/hosts.allow, line 26: can't verify hostname: getaddrinfo(dsl-189-172-79-33-dyn.prod-infinhostnameum.com.mx, AF_INET) failed
Oct  1 03:13:35 lvps83-169-44-148 sshd[8795]: reveeclipse mapping checking getaddrinfo for dsl-189-172-79-33-dyn.prod-infinhostnameum.com.mx [189.172.79.33] failed - POSSIBLE BREAK-IN ATTEMPT!
Oct  1 03:13:35 lvps83-169-44-148 sshd[8795]: Invalid user albi from 189.172.79.33
Oct  1 03:13:35 lvps83-169-44-148 sshd[8795]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.172.79.33 
Oct  1 03:13:38 lvps83-169-44-148 sshd[8795]: Failed password for invalid user albi from 189.172.79.33 port 60354 ssh2
Oct  1 03:17:48 lvps83-169-44-148 sshd[9112]: warning: /etc/hosts.allow, line 26: can't verify hostname: getaddrinfo(dsl-189-172-79-33-dyn.prod-infinhostnameum.com.mx, AF_INET) failed
Oct  1 03:17:49 lvps83-169-44-148 sshd[9112]: reveeclipse mapping checki........
-------------------------------

$f2bV_matches

schuetzenmusikanten.de 54.69.184.224 \[01/Oct/2019:09:32:13 +0200\] "POST /wp-login.php HTTP/1.1" 200 5682 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"
schuetzenmusikanten.de 54.69.184.224 \[01/Oct/2019:09:32:15 +0200\] "POST /wp-login.php HTTP/1.1" 200 5648 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"

Oct  1 00:35:44 new sshd[2080]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=em3-3-16-57-78.us-east-2.compute.amazonaws.com
Oct  1 00:35:47 new sshd[2080]: Failed password for invalid user ubnt from 3.16.57.78 port 56448 ssh2
Oct  1 00:35:47 new sshd[2080]: Received disconnect from 3.16.57.78: 11: Bye Bye [preauth]
Oct  1 01:02:46 new sshd[8931]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=em3-3-16-57-78.us-east-2.compute.amazonaws.com
Oct  1 01:02:49 new sshd[8931]: Failed password for invalid user shell from 3.16.57.78 port 58206 ssh2
Oct  1 01:02:49 new sshd[8931]: Received disconnect from 3.16.57.78: 11: Bye Bye [preauth]
Oct  1 01:06:19 new sshd[10013]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=em3-3-16-57-78.us-east-2.compute.amazonaws.com
Oct  1 01:06:21 new sshd[10013]: Failed password for invalid user walter from 3.16.57.78 port 4........
-------------------------------

Oct  1 07:47:23 www sshd\[24452\]: Invalid user chrissie from 136.34.218.11Oct  1 07:47:25 www sshd\[24452\]: Failed password for invalid user chrissie from 136.34.218.11 port 12155 ssh2Oct  1 07:51:52 www sshd\[24618\]: Invalid user postgres from 136.34.218.11
...

Oct  1 07:07:47 apollo sshd\[1846\]: Invalid user pul from 113.87.47.254Oct  1 07:07:49 apollo sshd\[1846\]: Failed password for invalid user pul from 113.87.47.254 port 12568 ssh2Oct  1 07:20:28 apollo sshd\[1927\]: Invalid user noc from 113.87.47.254
...

2019-10-01T09:06:43.353211abusebot-4.cloudsearch.cf sshd\[11301\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.158  user=root