WordPress wp-login brute force :: 2604:a880:400:d1::7ba:9001 0.056 BYPASS [03/Aug/2019:14:40:08  1000] [censored_2] "POST /wp-login.php HTTP/1.1" 200 4630 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"

SSH Brute-Force reported by Fail2Ban

Apr  6 03:00:43 server sshd\[22875\]: Failed password for root from 82.200.226.226 port 54478 ssh2
Apr  6 10:04:09 server sshd\[9179\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.200.226.226.dial.online.kz  user=root
Apr  6 10:04:12 server sshd\[9179\]: Failed password for root from 82.200.226.226 port 40948 ssh2
Apr  6 10:19:14 server sshd\[13355\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.200.226.226.dial.online.kz  user=root
Apr  6 10:19:16 server sshd\[13355\]: Failed password for root from 82.200.226.226 port 41442 ssh2
...

Apr  6 10:19:15 ift sshd\[7625\]: Failed password for root from 222.186.175.163 port 29088 ssh2Apr  6 10:19:39 ift sshd\[7632\]: Failed password for root from 222.186.175.163 port 54308 ssh2Apr  6 10:19:42 ift sshd\[7632\]: Failed password for root from 222.186.175.163 port 54308 ssh2Apr  6 10:19:46 ift sshd\[7632\]: Failed password for root from 222.186.175.163 port 54308 ssh2Apr  6 10:19:55 ift sshd\[7632\]: Failed password for root from 222.186.175.163 port 54308 ssh2
...

$f2bV_matches

Apr  6 03:54:00 ws22vmsma01 sshd[187660]: Failed password for root from 37.187.54.45 port 47794 ssh2
...

Apr  6 05:57:41 vps333114 sshd[26755]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.66.243.77  user=root
Apr  6 05:57:43 vps333114 sshd[26755]: Failed password for root from 117.66.243.77 port 50144 ssh2
...

Apr  6 06:32:48 localhost sshd\[26163\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.199.248.156  user=root
Apr  6 06:32:50 localhost sshd\[26163\]: Failed password for root from 139.199.248.156 port 46411 ssh2
Apr  6 06:37:06 localhost sshd\[26440\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.199.248.156  user=root
Apr  6 06:37:07 localhost sshd\[26440\]: Failed password for root from 139.199.248.156 port 48057 ssh2
Apr  6 06:41:58 localhost sshd\[26799\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.199.248.156  user=root
...

(smtpauth) Failed SMTP AUTH login from 159.203.166.132 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 2020-04-06 08:24:02 login authenticator failed for (ADMIN) [159.203.166.132]: 535 Incorrect authentication data (set_id=info@tookatarh.com)

(imapd) Failed IMAP login from 183.89.215.68 (TH/Thailand/mx-ll-183.89.215-68.dynamic.3bb.in.th): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Apr  6 08:23:27 ir1 dovecot[566034]: imap-login: Disconnected (auth failed, 1 attempts in 7 secs): user=, method=PLAIN, rip=183.89.215.68, lip=5.63.12.44, TLS: Connection closed, session=

(mod_security) mod_security (id:217290) triggered by 118.150.218.47 (TW/Taiwan/n218-h47.150.118.dynamic.da.net.tw): 5 in the last 3600 secs

Triggered by Fail2Ban at Ares web server

2020-04-05T20:53:44.615734suse-nuc sshd[27728]: User root from 175.6.35.82 not allowed because listed in DenyUsers
...

Apr  6 05:38:51 ns382633 sshd\[28603\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=140.143.57.203  user=root
Apr  6 05:38:53 ns382633 sshd\[28603\]: Failed password for root from 140.143.57.203 port 49324 ssh2
Apr  6 05:54:12 ns382633 sshd\[31793\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=140.143.57.203  user=root
Apr  6 05:54:15 ns382633 sshd\[31793\]: Failed password for root from 140.143.57.203 port 36076 ssh2
Apr  6 05:58:45 ns382633 sshd\[322\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=140.143.57.203  user=root

Apr  6 09:33:17 vps sshd[920785]: Failed password for root from 49.88.112.55 port 17088 ssh2
Apr  6 09:33:20 vps sshd[920785]: Failed password for root from 49.88.112.55 port 17088 ssh2
Apr  6 09:33:24 vps sshd[920785]: Failed password for root from 49.88.112.55 port 17088 ssh2
Apr  6 09:33:27 vps sshd[920785]: Failed password for root from 49.88.112.55 port 17088 ssh2
Apr  6 09:33:31 vps sshd[920785]: Failed password for root from 49.88.112.55 port 17088 ssh2
...

Apr  5 21:49:42 server1 sshd\[12639\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.111.201  user=root
Apr  5 21:49:44 server1 sshd\[12639\]: Failed password for root from 106.12.111.201 port 41990 ssh2
Apr  5 21:51:48 server1 sshd\[13278\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.111.201  user=root
Apr  5 21:51:50 server1 sshd\[13278\]: Failed password for root from 106.12.111.201 port 38562 ssh2
Apr  5 21:54:10 server1 sshd\[14012\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.111.201  user=root
...