103.13.100.230 - - [11/Oct/2020:07:52:34 +0200] "POST /xmlrpc.php HTTP/1.1" 403 146 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
103.13.100.230 - - [11/Oct/2020:07:53:04 +0200] "POST /xmlrpc.php HTTP/1.1" 403 146 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
...

Oct 11 11:44:24 OPSO sshd\[14264\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.85.42.47  user=root
Oct 11 11:44:27 OPSO sshd\[14264\]: Failed password for root from 112.85.42.47 port 53750 ssh2
Oct 11 11:44:30 OPSO sshd\[14264\]: Failed password for root from 112.85.42.47 port 53750 ssh2
Oct 11 11:44:33 OPSO sshd\[14264\]: Failed password for root from 112.85.42.47 port 53750 ssh2
Oct 11 11:44:36 OPSO sshd\[14264\]: Failed password for root from 112.85.42.47 port 53750 ssh2

CMS (WordPress or Joomla) login attempt.

2020-10-10T22:43:54+02:00  exim[32518]: fixed_login authenticator failed for (ylmf-pc) [156.96.107.245]: 535 Incorrect authentication data (set_id=bacskiskun)

[munged]::80 167.71.53.185 - - [11/Oct/2020:11:15:14 +0200] "POST /[munged]: HTTP/1.1" 200 3208 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"

Oct 11 10:11:06 marvibiene sshd[20990]: Failed password for root from 46.101.139.105 port 36516 ssh2
Oct 11 10:17:22 marvibiene sshd[21558]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.101.139.105 
Oct 11 10:17:24 marvibiene sshd[21558]: Failed password for invalid user ee from 46.101.139.105 port 45824 ssh2

Oct 11 05:25:41 ns382633 sshd\[24126\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.157.82.202  user=root
Oct 11 05:25:43 ns382633 sshd\[24126\]: Failed password for root from 121.157.82.202 port 50812 ssh2
Oct 11 05:57:44 ns382633 sshd\[31527\]: Invalid user saumur from 121.157.82.202 port 38162
Oct 11 05:57:44 ns382633 sshd\[31527\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.157.82.202
Oct 11 05:57:46 ns382633 sshd\[31527\]: Failed password for invalid user saumur from 121.157.82.202 port 38162 ssh2

2020-10-11T04:03:32+0200 Failed SSH Authentication/Brute Force Attack.(Server 2)

Oct 11 09:42:51 email sshd\[22208\]: Invalid user vcsa from 49.233.88.126
Oct 11 09:42:51 email sshd\[22208\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.233.88.126
Oct 11 09:42:53 email sshd\[22208\]: Failed password for invalid user vcsa from 49.233.88.126 port 32824 ssh2
Oct 11 09:48:08 email sshd\[23199\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.233.88.126  user=root
Oct 11 09:48:10 email sshd\[23199\]: Failed password for root from 49.233.88.126 port 60986 ssh2
...

(sshd) Failed SSH login from 49.232.71.199 (CN/China/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Oct 11 04:45:52 optimus sshd[3510]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.232.71.199  user=root
Oct 11 04:45:54 optimus sshd[3510]: Failed password for root from 49.232.71.199 port 60674 ssh2
Oct 11 05:05:30 optimus sshd[10088]: Invalid user test from 49.232.71.199
Oct 11 05:05:30 optimus sshd[10088]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.232.71.199 
Oct 11 05:05:32 optimus sshd[10088]: Failed password for invalid user test from 49.232.71.199 port 42288 ssh2

[Sun Oct 11 15:02:17.349135 2020] [:error] [pid 28469:tid 139832357467904] [client 185.191.171.40:31782] [client 185.191.171.40] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "SemrushBot" at REQUEST_HEADERS:User-Agent. [file "/etc/modsecurity/coreruleset-3.3.0/rules/REQUEST-913-SCANNER-DETECTION.conf"] [line "181"] [id "913102"] [msg "Found User-Agent associated with web crawler/bot"] [data "Matched Data: SemrushBot found within REQUEST_HEADERS:User-Agent: mozilla/5.0 (compatible; semrushbot/6~bl; +http://www.semrush.com/bot.html)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-crawler"] [tag "OWASP_CRS"] [tag "capec/1000/118/224/541/310"] [tag "PCI/6.5.10"] [tag "paranoia-level/2"] [hostname "karangploso.jatim.bmkg.go.id"] [uri "/index.php/analisis-bulanan/3910-analisis-distribusi-hujan/analisis-distribusi-sifat-hujan/analisis-distribusi-sifat-hujan-jawa-timur-bulanan/a
...

Port scan on 1 port(s): 445

2020-10-11T02:29:38.388114yoshi.linuxbox.ninja sshd[1812708]: Failed password for invalid user service from 167.71.9.180 port 54088 ssh2
2020-10-11T02:33:05.139609yoshi.linuxbox.ninja sshd[1815011]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.9.180  user=root
2020-10-11T02:33:07.257701yoshi.linuxbox.ninja sshd[1815011]: Failed password for root from 167.71.9.180 port 59636 ssh2
...

Oct 11 01:28:56 ns382633 sshd\[7828\]: Invalid user edu from 129.211.94.145 port 48142
Oct 11 01:28:56 ns382633 sshd\[7828\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.211.94.145
Oct 11 01:28:58 ns382633 sshd\[7828\]: Failed password for invalid user edu from 129.211.94.145 port 48142 ssh2
Oct 11 01:32:45 ns382633 sshd\[9043\]: Invalid user j from 129.211.94.145 port 59084
Oct 11 01:32:45 ns382633 sshd\[9043\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.211.94.145

Port Scan: TCP/443