[Aegis] @ 2019-10-01 09:41:57  0100 -> SSHD brute force trying to get access to the system.

IP Ban Report : https://help-dysk.pl/wordpress-firewall-plugins/ip/159.192.247.6/ 
 TH - 1H : (91)  
 Protection Against DDoS WordPress plugin :  
 "odzyskiwanie danych help-dysk" 
 IP Address Ranges by Country : TH 
 NAME ASN : ASN131090 
 
 IP : 159.192.247.6 
 
 CIDR : 159.192.247.0/24 
 
 PREFIX COUNT : 407 
 
 UNIQUE IP COUNT : 199424 
 
 
 WYKRYTE ATAKI Z ASN131090 :  
  1H - 2 
  3H - 4 
  6H - 6 
 12H - 6 
 24H - 10 
 
 DateTime : 2019-10-01 05:48:53 
 
 INFO : Port MAX SCAN Scan Detected and Blocked by ADMIN  - data recovery

$f2bV_matches

Oct  1 10:28:36 rotator sshd\[6571\]: Address 54.39.151.167 maps to tor-exit.deusvult.xyz, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!Oct  1 10:28:38 rotator sshd\[6571\]: Failed password for root from 54.39.151.167 port 39368 ssh2Oct  1 10:28:41 rotator sshd\[6571\]: Failed password for root from 54.39.151.167 port 39368 ssh2Oct  1 10:28:44 rotator sshd\[6571\]: Failed password for root from 54.39.151.167 port 39368 ssh2Oct  1 10:28:47 rotator sshd\[6571\]: Failed password for root from 54.39.151.167 port 39368 ssh2Oct  1 10:28:50 rotator sshd\[6571\]: Failed password for root from 54.39.151.167 port 39368 ssh2
...

Oct  1 07:05:16 www sshd\[37271\]: Invalid user dragos from 202.129.241.102Oct  1 07:05:17 www sshd\[37271\]: Failed password for invalid user dragos from 202.129.241.102 port 43006 ssh2Oct  1 07:06:51 www sshd\[37286\]: Invalid user jia from 202.129.241.102
...

Oct  1 05:55:37 xxxxxxx0 sshd[11966]: Invalid user vagrant from 34.90.88.5 port 55154
Oct  1 05:55:39 xxxxxxx0 sshd[11966]: Failed password for invalid user vagrant from 34.90.88.5 port 55154 ssh2
Oct  1 06:04:01 xxxxxxx0 sshd[14123]: Invalid user User from 34.90.88.5 port 51730
Oct  1 06:04:03 xxxxxxx0 sshd[14123]: Failed password for invalid user User from 34.90.88.5 port 51730 ssh2
Oct  1 06:07:34 xxxxxxx0 sshd[15010]: Invalid user hiren from 34.90.88.5 port 36790

........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=34.90.88.5

Oct  1 09:08:57 venus sshd\[21074\]: Invalid user koyoto from 176.126.62.18 port 37540
Oct  1 09:08:57 venus sshd\[21074\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=176.126.62.18
Oct  1 09:08:59 venus sshd\[21074\]: Failed password for invalid user koyoto from 176.126.62.18 port 37540 ssh2
...

1 attack on Zyxel CVE-2017-18368 URLs like:
181.126.157.40 - - [30/Sep/2019:18:45:43 +0100] "POST /cgi-bin/ViewLog.asp HTTP/1.1" 403 9

Sep 30 23:42:09 auw2 sshd\[15339\]: Invalid user billing1 from 200.40.45.82
Sep 30 23:42:09 auw2 sshd\[15339\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=r200-40-45-82.ae-static.anteldata.net.uy
Sep 30 23:42:11 auw2 sshd\[15339\]: Failed password for invalid user billing1 from 200.40.45.82 port 58908 ssh2
Sep 30 23:46:51 auw2 sshd\[15795\]: Invalid user oframe4 from 200.40.45.82
Sep 30 23:46:51 auw2 sshd\[15795\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=r200-40-45-82.ae-static.anteldata.net.uy

\[2019-10-01 05:28:30\] NOTICE\[1948\] chan_sip.c: Registration from '\' failed for '188.165.196.107:51749' - Wrong password
\[2019-10-01 05:28:30\] SECURITY\[2006\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-10-01T05:28:30.287-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="3008",SessionID="0x7f1e1c27a4c8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/188.165.196.107/51749",Challenge="5cb8fa4e",ReceivedChallenge="5cb8fa4e",ReceivedHash="f1196552c6f808fe932eda91c62eea16"
\[2019-10-01 05:30:52\] NOTICE\[1948\] chan_sip.c: Registration from '\' failed for '188.165.196.107:65392' - Wrong password
\[2019-10-01 05:30:52\] SECURITY\[2006\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-10-01T05:30:52.021-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="146",SessionID="0x7f1e1c27a4c8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/188.1

Oct  1 06:39:18 pkdns2 sshd\[16448\]: Invalid user deploy from 81.16.125.9Oct  1 06:39:20 pkdns2 sshd\[16448\]: Failed password for invalid user deploy from 81.16.125.9 port 37166 ssh2Oct  1 06:44:15 pkdns2 sshd\[16652\]: Invalid user ftpusr from 81.16.125.9Oct  1 06:44:17 pkdns2 sshd\[16652\]: Failed password for invalid user ftpusr from 81.16.125.9 port 44754 ssh2Oct  1 06:48:40 pkdns2 sshd\[16839\]: Invalid user df from 81.16.125.9Oct  1 06:48:42 pkdns2 sshd\[16839\]: Failed password for invalid user df from 81.16.125.9 port 52188 ssh2
...

Oct  1 06:44:50 server sshd\[16405\]: Invalid user db1 from 103.224.251.102 port 52422
Oct  1 06:44:50 server sshd\[16405\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.224.251.102
Oct  1 06:44:51 server sshd\[16405\]: Failed password for invalid user db1 from 103.224.251.102 port 52422 ssh2
Oct  1 06:49:16 server sshd\[1190\]: Invalid user aura from 103.224.251.102 port 34388
Oct  1 06:49:16 server sshd\[1190\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.224.251.102

Oct  1 09:57:39 jane sshd[7985]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.89.124.170 
Oct  1 09:57:41 jane sshd[7985]: Failed password for invalid user pam from 103.89.124.170 port 50486 ssh2
...

Oct  1 11:14:27 icinga sshd[17833]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.78.236
Oct  1 11:14:28 icinga sshd[17833]: Failed password for invalid user hadoop from 139.59.78.236 port 39042 ssh2
...

[Aegis] @ 2019-10-01 09:41:25  0100 -> Sender domain has bogus MX record. It should not be sending e-mail.