Sep 27 23:13:13 *** sshd[12967]: Invalid user webuser from 106.12.47.216

(sshd) Failed SSH login from 194.102.35.245 (RO/Romania/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Sep 27 17:08:55 host sshd[97824]: Invalid user viteo from 194.102.35.245 port 54450

Sep 27 23:12:15 hcbbdb sshd\[10472\]: Invalid user th from 51.77.140.244
Sep 27 23:12:15 hcbbdb sshd\[10472\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=244.ip-51-77-140.eu
Sep 27 23:12:18 hcbbdb sshd\[10472\]: Failed password for invalid user th from 51.77.140.244 port 53076 ssh2
Sep 27 23:18:41 hcbbdb sshd\[11190\]: Invalid user victor from 51.77.140.244
Sep 27 23:18:41 hcbbdb sshd\[11190\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=244.ip-51-77-140.eu

Sep 27 13:16:34 aiointranet sshd\[7496\]: Invalid user 1234 from 171.6.84.164
Sep 27 13:16:34 aiointranet sshd\[7496\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=mx-ll-171.6.84-164.dynamic.3bb.co.th
Sep 27 13:16:37 aiointranet sshd\[7496\]: Failed password for invalid user 1234 from 171.6.84.164 port 61562 ssh2
Sep 27 13:21:20 aiointranet sshd\[7943\]: Invalid user wendy123 from 171.6.84.164
Sep 27 13:21:20 aiointranet sshd\[7943\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=171.6.84.164

\[2019-09-27 19:24:06\] NOTICE\[1948\] chan_sip.c: Registration from '\' failed for '149.202.223.136:49420' - Wrong password
\[2019-09-27 19:24:06\] SECURITY\[2006\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-09-27T19:24:06.325-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="7300056",SessionID="0x7f1e1c3735b8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/149.202.223.136/49420",Challenge="7863b316",ReceivedChallenge="7863b316",ReceivedHash="ffd81978d3cf57d271c6b79af524da60"
\[2019-09-27 19:24:21\] NOTICE\[1948\] chan_sip.c: Registration from '\' failed for '149.202.223.136:52677' - Wrong password
\[2019-09-27 19:24:21\] SECURITY\[2006\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-09-27T19:24:21.494-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="7300057",SessionID="0x7f1e1c2bed58",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/149.202.223

Sep 27 19:33:43 debian sshd\[2916\]: Invalid user host from 106.248.41.245 port 60690
Sep 27 19:33:43 debian sshd\[2916\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.248.41.245
Sep 27 19:33:45 debian sshd\[2916\]: Failed password for invalid user host from 106.248.41.245 port 60690 ssh2
...

\[2019-09-27 19:09:15\] SECURITY\[2006\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-09-27T19:09:15.007-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="4249101148757329002",SessionID="0x7f1e1c1c7ef8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/77.247.110.132/64702",ACLName="no_extension_match"
\[2019-09-27 19:09:50\] SECURITY\[2006\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-09-27T19:09:50.605-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="3804401148957156002",SessionID="0x7f1e1c3735b8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/77.247.110.132/59366",ACLName="no_extension_match"
\[2019-09-27 19:09:58\] SECURITY\[2006\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-09-27T19:09:58.365-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="4635801148627490013",SessionID="0x7f1e1c02d9c8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/77.247.110.132/49391",

IP Ban Report : https://help-dysk.pl/wordpress-firewall-plugins/ip/60.5.33.38/ 
 CN - 1H : (1125)  
 Protection Against DDoS WordPress plugin :  
 "odzyskiwanie danych help-dysk" 
 IP Address Ranges by Country : CN 
 NAME ASN : ASN4837 
 
 IP : 60.5.33.38 
 
 CIDR : 60.0.0.0/13 
 
 PREFIX COUNT : 1262 
 
 UNIQUE IP COUNT : 56665856 
 
 
 WYKRYTE ATAKI Z ASN4837 :  
  1H - 21 
  3H - 56 
  6H - 106 
 12H - 223 
 24H - 498 
 
 INFO : Port Scan TELNET Detected and Blocked by ADMIN  - data recovery

Obvious phishing.

From: Jay Ket [mailto:admin@ketmonetaryfunding.com] 
Sent: Friday, September 27, 2019 01:55
Subject: Gift Order

Hello,
Trust you are well. I got your details through the internet while searching for gift items for a family event.
I will like to know if you sell Gift Baskets or gift boxes?
My brother's wedding is coming up towards the end of next month and I am planning a surprise wedding gift baskets or boxes for all the guests.
Kindly back if this is a service you offer so I can let you know my budget per gift basket. Also, what types of credit cards do you accept for payment? You can reply to my email below.
Best Regards,
Jay

Sep 28 01:51:14 v22018076622670303 sshd\[23449\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.15.101  user=root
Sep 28 01:51:16 v22018076622670303 sshd\[23449\]: Failed password for root from 222.186.15.101 port 15120 ssh2
Sep 28 01:51:19 v22018076622670303 sshd\[23449\]: Failed password for root from 222.186.15.101 port 15120 ssh2
...

Brute force attempt

Automatic report - Banned IP Access

Sep 27 02:41:02 toyboy sshd[31520]: Invalid user server from 8.208.11.176
Sep 27 02:41:02 toyboy sshd[31520]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=8.208.11.176
Sep 27 02:41:03 toyboy sshd[31520]: Failed password for invalid user server from 8.208.11.176 port 60064 ssh2
Sep 27 02:41:03 toyboy sshd[31520]: Received disconnect from 8.208.11.176: 11: Bye Bye [preauth]
Sep 27 02:49:53 toyboy sshd[32009]: Invalid user romeo from 8.208.11.176
Sep 27 02:49:53 toyboy sshd[32009]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=8.208.11.176
Sep 27 02:49:55 toyboy sshd[32009]: Failed password for invalid user romeo from 8.208.11.176 port 45444 ssh2
Sep 27 02:49:55 toyboy sshd[32009]: Received disconnect from 8.208.11.176: 11: Bye Bye [preauth]
Sep 27 02:53:34 toyboy sshd[32141]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=8.208.11.176  user=backup
........
-------------------------------

Sep 28 01:34:16 vps01 sshd[15989]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.5.35
Sep 28 01:34:18 vps01 sshd[15989]: Failed password for invalid user user from 106.12.5.35 port 33310 ssh2

Aug 30 15:10:07 vtv3 sshd\[664\]: Invalid user library from 180.66.207.67 port 41339
Aug 30 15:10:07 vtv3 sshd\[664\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.66.207.67
Aug 30 15:10:09 vtv3 sshd\[664\]: Failed password for invalid user library from 180.66.207.67 port 41339 ssh2
Aug 30 15:16:31 vtv3 sshd\[4157\]: Invalid user vin from 180.66.207.67 port 42762
Aug 30 15:16:31 vtv3 sshd\[4157\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.66.207.67
Aug 30 15:30:39 vtv3 sshd\[11235\]: Invalid user veeam from 180.66.207.67 port 55106
Aug 30 15:30:39 vtv3 sshd\[11235\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.66.207.67
Aug 30 15:30:41 vtv3 sshd\[11235\]: Failed password for invalid user veeam from 180.66.207.67 port 55106 ssh2
Aug 30 15:35:25 vtv3 sshd\[13570\]: Invalid user kj from 180.66.207.67 port 49807
Aug 30 15:35:25 vtv3 sshd\[13570\]: pam_unix\(sshd