Jan 19 05:41:21 mercury wordpress(www.learnargentinianspanish.com)[25117]: XML-RPC authentication failure for josh from 103.1.92.108
...

suspicious action Tue, 03 Mar 2020 10:22:41 -0300

Mar  3 03:06:25 host sshd[25015]: Invalid user first from 137.74.167.228 port 40066
Mar  3 03:06:25 host sshd[25015]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=137.74.167.228
Mar  3 03:06:27 host sshd[25015]: Failed password for invalid user first from 137.74.167.228 port 40066 ssh2
Mar  3 03:06:27 host sshd[25015]: Received disconnect from 137.74.167.228 port 40066:11: Bye Bye [preauth]
Mar  3 03:06:27 host sshd[25015]: Disconnected from invalid user first 137.74.167.228 port 40066 [preauth]
Mar  3 03:23:47 host sshd[25315]: User r.r from 137.74.167.228 not allowed because none of user's groups are listed in AllowGroups
Mar  3 03:23:47 host sshd[25315]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=137.74.167.228  user=r.r
Mar  3 03:23:48 host sshd[25315]: Failed password for invalid user r.r from 137.74.167.228 port 47548 ssh2
Mar  3 03:23:48 host sshd[25315]: Received disconnect f........
-------------------------------

Nov 12 08:21:48 mercury smtpd[4606]: bd49036e1f7d3b35 smtp event=failed-command address=109.202.138.236 host=109.202.138.236 command="RCPT TO:" result="550 Invalid recipient"
...

2020-01-20T22:25:33.246Z CLOSE host=102.114.10.224 port=8306 fd=4 time=20.020 bytes=29
...

2019-11-27T06:49:35.567Z CLOSE host=102.133.168.208 port=44076 fd=4 time=40.037 bytes=43
2019-11-27T06:49:35.583Z CLOSE host=102.133.168.208 port=47838 fd=5 time=30.000 bytes=39
...

Oct 28 17:17:51 mercury kernel: [UFW ALLOW] IN=eth0 OUT= MAC=f2:3c:91:bc:4d:f8:84:78:ac:0d:8f:41:08:00 SRC=104.152.52.28 DST=109.74.200.221 LEN=76 TOS=0x00 PREC=0x00 TTL=243 ID=29604 PROTO=UDP SPT=42981 DPT=123 LEN=56 
...

Mar  3 17:07:44 localhost sshd[81889]: Invalid user blue from 167.99.107.202 port 45664
Mar  3 17:07:44 localhost sshd[81889]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.99.107.202
Mar  3 17:07:44 localhost sshd[81889]: Invalid user blue from 167.99.107.202 port 45664
Mar  3 17:07:46 localhost sshd[81889]: Failed password for invalid user blue from 167.99.107.202 port 45664 ssh2
Mar  3 17:16:30 localhost sshd[82821]: Invalid user RCadmin from 167.99.107.202 port 56772
...

Mar  3 16:52:44 dev0-dcde-rnet sshd[1759]: Failed password for root from 153.149.12.73 port 33542 ssh2
Mar  3 17:00:55 dev0-dcde-rnet sshd[1815]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=153.149.12.73
Mar  3 17:00:57 dev0-dcde-rnet sshd[1815]: Failed password for invalid user surya from 153.149.12.73 port 44544 ssh2

Feb 12 16:53:21 mercury wordpress(www.learnargentinianspanish.com)[2918]: XML-RPC authentication attempt for unknown user silvina from 103.12.161.196
...

SSH Bruteforce attempt

Mar  3 08:44:09 wbs sshd\[19093\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.88.112.114  user=root
Mar  3 08:44:11 wbs sshd\[19093\]: Failed password for root from 49.88.112.114 port 23701 ssh2
Mar  3 08:45:02 wbs sshd\[19174\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.88.112.114  user=root
Mar  3 08:45:04 wbs sshd\[19174\]: Failed password for root from 49.88.112.114 port 21909 ssh2
Mar  3 08:45:06 wbs sshd\[19174\]: Failed password for root from 49.88.112.114 port 21909 ssh2

Nov 13 05:47:01 mercury kernel: [UFW ALLOW] IN=eth0 OUT= MAC=f2:3c:91:bc:4d:f8:84:78:ac:0d:8f:41:08:00 SRC=104.152.52.25 DST=109.74.200.221 LEN=76 TOS=0x00 PREC=0x00 TTL=243 ID=56150 PROTO=UDP SPT=43956 DPT=123 LEN=56 
...

1583241755 - 03/03/2020 14:22:35 Host: 49.145.235.132/49.145.235.132 Port: 445 TCP Blocked

Automatic report - Banned IP Access