195.154.133.163 - - [03/May/2020:12:18:30 +0400] "POST /GponForm/diag_Form?style/ HTTP/1.1" 502 157 "-" "curl/7.3.2"
...

ssh brute force

May  3 08:00:44 nextcloud sshd\[15814\]: Invalid user huangliang from 118.24.99.161
May  3 08:00:44 nextcloud sshd\[15814\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.24.99.161
May  3 08:00:46 nextcloud sshd\[15814\]: Failed password for invalid user huangliang from 118.24.99.161 port 41064 ssh2

(imapd) Failed IMAP login from 211.67.66.214 (CN/China/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: May  3 08:20:25 ir1 dovecot[264309]: imap-login: Disconnected (auth failed, 1 attempts in 6 secs): user=, method=PLAIN, rip=211.67.66.214, lip=5.63.12.44, TLS: Connection closed, session=

2020-05-03T07:16:58.138478abusebot-8.cloudsearch.cf sshd[15647]: Invalid user tiewenbin from 182.75.216.74 port 49053
2020-05-03T07:16:58.146230abusebot-8.cloudsearch.cf sshd[15647]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.75.216.74
2020-05-03T07:16:58.138478abusebot-8.cloudsearch.cf sshd[15647]: Invalid user tiewenbin from 182.75.216.74 port 49053
2020-05-03T07:16:59.531537abusebot-8.cloudsearch.cf sshd[15647]: Failed password for invalid user tiewenbin from 182.75.216.74 port 49053 ssh2
2020-05-03T07:23:30.736611abusebot-8.cloudsearch.cf sshd[16023]: Invalid user hydro from 182.75.216.74 port 33927
2020-05-03T07:23:30.747489abusebot-8.cloudsearch.cf sshd[16023]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.75.216.74
2020-05-03T07:23:30.736611abusebot-8.cloudsearch.cf sshd[16023]: Invalid user hydro from 182.75.216.74 port 33927
2020-05-03T07:23:32.950289abusebot-8.cloudsearch.cf sshd[16
...

no

May  3 05:50:42 vpn01 sshd[19381]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.21.99.227
May  3 05:50:44 vpn01 sshd[19381]: Failed password for invalid user suporte from 111.21.99.227 port 47552 ssh2
...

May  3 09:11:26 piServer sshd[12358]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.160.158 
May  3 09:11:28 piServer sshd[12358]: Failed password for invalid user yanjun from 128.199.160.158 port 38406 ssh2
May  3 09:14:59 piServer sshd[12711]: Failed password for root from 128.199.160.158 port 54284 ssh2
...

May  3 08:41:35 h1745522 sshd[23050]: Invalid user reshma from 133.242.52.96 port 51163
May  3 08:41:35 h1745522 sshd[23050]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=133.242.52.96
May  3 08:41:35 h1745522 sshd[23050]: Invalid user reshma from 133.242.52.96 port 51163
May  3 08:41:37 h1745522 sshd[23050]: Failed password for invalid user reshma from 133.242.52.96 port 51163 ssh2
May  3 08:45:31 h1745522 sshd[23121]: Invalid user mne from 133.242.52.96 port 56366
May  3 08:45:31 h1745522 sshd[23121]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=133.242.52.96
May  3 08:45:31 h1745522 sshd[23121]: Invalid user mne from 133.242.52.96 port 56366
May  3 08:45:33 h1745522 sshd[23121]: Failed password for invalid user mne from 133.242.52.96 port 56366 ssh2
May  3 08:49:40 h1745522 sshd[23201]: Invalid user denise from 133.242.52.96 port 33339
May  3 08:49:40 h1745522 sshd[23201]: pam_unix(sshd:auth): auth
...

WordPress wp-login brute force :: 68.183.225.93 0.100 - [03/May/2020:06:56:41  0000] [censored_1] "POST /wp-login.php HTTP/1.1" 200 1837 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" "HTTP/1.1"

192.241.224.117 - - \[03/May/2020:09:44:15 +0200\] "POST /wp-login.php HTTP/1.0" 200 7318 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"
192.241.224.117 - - \[03/May/2020:09:44:17 +0200\] "POST /wp-login.php HTTP/1.0" 200 7318 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"
192.241.224.117 - - \[03/May/2020:09:44:18 +0200\] "POST /xmlrpc.php HTTP/1.0" 200 802 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"

May  3 10:45:07 dcd-gentoo sshd[26127]: User root from 218.92.0.199 not allowed because none of user's groups are listed in AllowGroups
May  3 10:45:10 dcd-gentoo sshd[26127]: error: PAM: Authentication failure for illegal user root from 218.92.0.199
May  3 10:45:07 dcd-gentoo sshd[26127]: User root from 218.92.0.199 not allowed because none of user's groups are listed in AllowGroups
May  3 10:45:10 dcd-gentoo sshd[26127]: error: PAM: Authentication failure for illegal user root from 218.92.0.199
May  3 10:45:07 dcd-gentoo sshd[26127]: User root from 218.92.0.199 not allowed because none of user's groups are listed in AllowGroups
May  3 10:45:10 dcd-gentoo sshd[26127]: error: PAM: Authentication failure for illegal user root from 218.92.0.199
May  3 10:45:10 dcd-gentoo sshd[26127]: Failed keyboard-interactive/pam for invalid user root from 218.92.0.199 port 47101 ssh2
...

2020-05-03T15:29:03.327594vivaldi2.tree2.info sshd[15585]: Failed password for invalid user yhl from 132.145.242.238 port 45105 ssh2
2020-05-03T15:33:12.152994vivaldi2.tree2.info sshd[15880]: Invalid user justin from 132.145.242.238
2020-05-03T15:33:12.165861vivaldi2.tree2.info sshd[15880]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=132.145.242.238
2020-05-03T15:33:12.152994vivaldi2.tree2.info sshd[15880]: Invalid user justin from 132.145.242.238
2020-05-03T15:33:14.048700vivaldi2.tree2.info sshd[15880]: Failed password for invalid user justin from 132.145.242.238 port 51500 ssh2
...

Invalid user test from 213.32.67.160 port 41156

Fail2Ban Ban Triggered