2020/07/14 20:42:12 [error] 20617#20617: *8210486 open() "/usr/share/nginx/html/cgi-bin/php4.cgi" failed (2: No such file or directory), client: 185.220.101.21, server: _, request: "POST /cgi-bin/php4.cgi?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69%6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D%64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%64%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%64+%63%67%69%2E%66%6F%72%63%65%5F%72%65%64%69%72%65%63%74%3D%30+%2D%64+%63%67%69%2E%72%65%64%69%72%65%63%74%5F%73%74%61%74%75%73%5F%65%6E%76%3D%30+%2D%6E HTTP/1.1", host: "hewatee.net"
2020/07/14 20:42:12 [error] 20617#20617: *8210486 open() "/usr/share/nginx/html/cgi-bin/php5.cgi" failed (2: No such file or directory), client: 185.220.101.21, server: _, request: "POST /cgi-bin/php5.cgi?%2D%64+%61%6C%6C

Jul 14 22:25:08 eventyay sshd[20000]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=191.232.241.15
Jul 14 22:25:10 eventyay sshd[20000]: Failed password for invalid user shashank from 191.232.241.15 port 43658 ssh2
Jul 14 22:31:21 eventyay sshd[20170]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=191.232.241.15
...

[Wed Jul 15 01:17:09 2020] - DDoS Attack From IP: 170.106.81.211 Port: 45861

invalid user

Connection to SSH Honeypot - Detected by HoneypotDB

Jul 14 21:29:13 vpn01 sshd[25293]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.28.174.147
Jul 14 21:29:15 vpn01 sshd[25293]: Failed password for invalid user cassandra from 129.28.174.147 port 35604 ssh2
...

Jul 14 20:05:30 localhost sshd\[9421\]: Invalid user host from 52.188.2.125 port 41875
Jul 14 20:05:30 localhost sshd\[9421\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.188.2.125
Jul 14 20:05:33 localhost sshd\[9421\]: Failed password for invalid user host from 52.188.2.125 port 41875 ssh2
...

Sendgrid 168.245.72.205 From: "Home Depot!!"  - malware links + header:
crepeguysindy.info
go.darcyprio.com
go.altakagenw.com
www.expenseplan.com
u17355174.ct.sendgrid.net
sendgrid.net
cherishyourvows.info

1594757450 - 07/14/2020 22:10:50 Host: 60.217.72.12/60.217.72.12 Port: 21 TCP Blocked

Jul 14 20:57:47 srv-ubuntu-dev3 sshd[71617]: Invalid user admln from 165.22.40.147
Jul 14 20:57:47 srv-ubuntu-dev3 sshd[71617]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.40.147
Jul 14 20:57:47 srv-ubuntu-dev3 sshd[71617]: Invalid user admln from 165.22.40.147
Jul 14 20:57:49 srv-ubuntu-dev3 sshd[71617]: Failed password for invalid user admln from 165.22.40.147 port 48768 ssh2
Jul 14 21:00:44 srv-ubuntu-dev3 sshd[72126]: Invalid user fieke from 165.22.40.147
Jul 14 21:00:44 srv-ubuntu-dev3 sshd[72126]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.40.147
Jul 14 21:00:44 srv-ubuntu-dev3 sshd[72126]: Invalid user fieke from 165.22.40.147
Jul 14 21:00:46 srv-ubuntu-dev3 sshd[72126]: Failed password for invalid user fieke from 165.22.40.147 port 46424 ssh2
Jul 14 21:03:54 srv-ubuntu-dev3 sshd[72622]: Invalid user shiv from 165.22.40.147
...

Attempted Brute Force (dovecot)

Jul 14 22:32:44 vps639187 sshd\[8384\]: Invalid user Nicole from 93.64.5.34 port 19033
Jul 14 22:32:44 vps639187 sshd\[8384\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=93.64.5.34
Jul 14 22:32:47 vps639187 sshd\[8384\]: Failed password for invalid user Nicole from 93.64.5.34 port 19033 ssh2
...

SSH login attempts brute force.

Jul 14 21:31:04 nextcloud sshd\[22011\]: Invalid user erika from 106.12.196.118
Jul 14 21:31:04 nextcloud sshd\[22011\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.196.118
Jul 14 21:31:05 nextcloud sshd\[22011\]: Failed password for invalid user erika from 106.12.196.118 port 33948 ssh2

Jul 14 18:30:34 ws25vmsma01 sshd[122073]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.101.174.188
Jul 14 18:30:36 ws25vmsma01 sshd[122073]: Failed password for invalid user oracle from 46.101.174.188 port 37322 ssh2
...