[WedApr0805:59:47.4206582020][:error][pid17283:tid47788983097088][client52.147.10.203:54324][client52.147.10.203]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch"\\\\\\\\.php"atARGS:img.[file"/etc/apache2/conf.d/modsec_rules/99_asl_jitp.conf"][line"791"][id"337479"][rev"2"][msg"Atomicorp.comWAFRules-VirtualJustInTimePatch:WordpressRevslidernon-imagefiledownloadAttack"][severity"CRITICAL"][hostname"www.startappsa.ch"][uri"/wp-admin/admin-ajax.php"][unique_id"Xo1MM97SEfPGuewg7w5RfwAAAAM"][WedApr0805:59:48.6652692020][:error][pid17306:tid47788976793344][client52.147.10.203:54344][client52.147.10.203]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorEQmatched0atARGS.[file"/etc/apache2/conf.d/modsec_rules/99_asl_jitp.conf"][line"784"][id"337469"][rev"3"][msg"Atomicorp.comWAFRules-VirtualJustInTimePatch:WordpressRevslideruploadAttack"][severity"CRITICAL"][hostname"www.startappsa.ch"][uri"/wp-admin/admin-ajax.php"][unique_id"Xo1MM@NdH7reToa2Lw7eEAAAAEA"]

Apr  8 05:55:47 MainVPS sshd[13430]: Invalid user sap from 51.68.227.98 port 43864
Apr  8 05:55:47 MainVPS sshd[13430]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.68.227.98
Apr  8 05:55:47 MainVPS sshd[13430]: Invalid user sap from 51.68.227.98 port 43864
Apr  8 05:55:50 MainVPS sshd[13430]: Failed password for invalid user sap from 51.68.227.98 port 43864 ssh2
Apr  8 05:59:11 MainVPS sshd[19992]: Invalid user user from 51.68.227.98 port 53208
...

Apr  8 06:55:18 host sshd[59035]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.67.101.203  user=root
Apr  8 06:55:21 host sshd[59035]: Failed password for root from 114.67.101.203 port 39668 ssh2
...

Apr  8 03:05:36 XXX sshd[26242]: Invalid user ubuntu from 51.91.77.217 port 44848

[MK-VM3] SSH login failed

Apr  7 04:29:19 nxxxxxxx sshd[22136]: Invalid user user from 45.134.82.71
Apr  7 04:29:21 nxxxxxxx sshd[22136]: Failed password for invalid user user from 45.134.82.71 port 59104 ssh2
Apr  7 04:46:46 nxxxxxxx sshd[24063]: Invalid user admin from 45.134.82.71


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=45.134.82.71

Apr  8 07:00:31 vpn01 sshd[6632]: Failed password for root from 51.178.28.196 port 32800 ssh2
...

Unauthorized connection attempt from IP address 36.72.43.108 on Port 445(SMB)

B: Abusive ssh attack

Apr  8 05:59:32 ArkNodeAT sshd\[12935\]: Invalid user cristina from 45.79.20.188
Apr  8 05:59:32 ArkNodeAT sshd\[12935\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.79.20.188
Apr  8 05:59:34 ArkNodeAT sshd\[12935\]: Failed password for invalid user cristina from 45.79.20.188 port 57700 ssh2

Apr  8 06:31:18 vmd38886 sshd\[22821\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.85.42.185  user=root
Apr  8 06:31:20 vmd38886 sshd\[22821\]: Failed password for root from 112.85.42.185 port 61329 ssh2
Apr  8 06:31:25 vmd38886 sshd\[22821\]: Failed password for root from 112.85.42.185 port 61329 ssh2

Automatic report - Port Scan Attack

Apr  7 19:12:09 web9 sshd\[4038\]: Invalid user admin from 82.149.13.45
Apr  7 19:12:09 web9 sshd\[4038\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.149.13.45
Apr  7 19:12:11 web9 sshd\[4038\]: Failed password for invalid user admin from 82.149.13.45 port 37114 ssh2
Apr  7 19:15:55 web9 sshd\[4582\]: Invalid user admin from 82.149.13.45
Apr  7 19:15:55 web9 sshd\[4582\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.149.13.45

Apr  8 05:58:57  exim[7624]: [1\44] 1jM1rc-0001yy-Ca H=wine.tactatek.com (wine.vanciity.com) [67.219.148.148] F= rejected after DATA: This message scored 101.5 spam points.

Apr  8 05:12:10 XXX sshd[26385]: Invalid user demo from 45.122.220.170 port 49226