email spam

Oct 10 20:01:53 sshgateway sshd\[27600\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=69.171.206.254  user=root
Oct 10 20:01:56 sshgateway sshd\[27600\]: Failed password for root from 69.171.206.254 port 39329 ssh2
Oct 10 20:09:15 sshgateway sshd\[27623\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=69.171.206.254  user=root

Oct  8 17:47:42 auw2 sshd\[21690\]: Invalid user Heslo1q from 69.171.206.254
Oct  8 17:47:42 auw2 sshd\[21690\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=69.171.206.254
Oct  8 17:47:45 auw2 sshd\[21690\]: Failed password for invalid user Heslo1q from 69.171.206.254 port 6238 ssh2
Oct  8 17:55:04 auw2 sshd\[22374\]: Invalid user Inferno@123 from 69.171.206.254
Oct  8 17:55:04 auw2 sshd\[22374\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=69.171.206.254

detected by Fail2Ban

2019-09-30T20:01:19.024458abusebot-5.cloudsearch.cf sshd\[7198\]: Invalid user jenkins from 69.171.206.254 port 25730

Sep 25 16:06:38 mail sshd\[8230\]: Failed password for invalid user ts3 from 69.171.206.254 port 19306 ssh2
Sep 25 16:11:13 mail sshd\[8924\]: Invalid user zhua from 69.171.206.254 port 8002
Sep 25 16:11:13 mail sshd\[8924\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=69.171.206.254
Sep 25 16:11:15 mail sshd\[8924\]: Failed password for invalid user zhua from 69.171.206.254 port 8002 ssh2
Sep 25 16:15:55 mail sshd\[9828\]: Invalid user glassfish from 69.171.206.254 port 37596

2019-09-24T16:29:26.035346lon01.zurich-datacenter.net sshd\[22086\]: Invalid user juancarlos from 69.171.206.254 port 45239
2019-09-24T16:29:26.043088lon01.zurich-datacenter.net sshd\[22086\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=69.171.206.254
2019-09-24T16:29:28.194481lon01.zurich-datacenter.net sshd\[22086\]: Failed password for invalid user juancarlos from 69.171.206.254 port 45239 ssh2
2019-09-24T16:37:22.990907lon01.zurich-datacenter.net sshd\[22265\]: Invalid user believe from 69.171.206.254 port 22983
2019-09-24T16:37:22.997060lon01.zurich-datacenter.net sshd\[22265\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=69.171.206.254
...

2019-09-22T01:45:58.754252tmaserv sshd\[14112\]: Invalid user web1 from 69.171.206.254 port 63385
2019-09-22T01:45:58.760181tmaserv sshd\[14112\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=69.171.206.254
2019-09-22T01:46:00.858862tmaserv sshd\[14112\]: Failed password for invalid user web1 from 69.171.206.254 port 63385 ssh2
2019-09-22T01:53:25.413759tmaserv sshd\[14638\]: Invalid user squirrel from 69.171.206.254 port 41851
2019-09-22T01:53:25.418671tmaserv sshd\[14638\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=69.171.206.254
2019-09-22T01:53:27.216876tmaserv sshd\[14638\]: Failed password for invalid user squirrel from 69.171.206.254 port 41851 ssh2
...

Sep 19 10:49:29 anodpoucpklekan sshd[63033]: Invalid user gitlab-runner from 69.171.206.254 port 17537
...

Sep 15 20:50:59 localhost sshd\[3284\]: Invalid user evans from 69.171.206.254 port 65364
Sep 15 20:50:59 localhost sshd\[3284\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=69.171.206.254
Sep 15 20:51:01 localhost sshd\[3284\]: Failed password for invalid user evans from 69.171.206.254 port 65364 ssh2

Sep  9 18:02:40 hosting sshd[15257]: Invalid user ts3 from 69.171.206.254 port 38055
...

Sep  7 17:14:15 tux-35-217 sshd\[16919\]: Invalid user systest from 69.171.206.254 port 28653
Sep  7 17:14:15 tux-35-217 sshd\[16919\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=69.171.206.254
Sep  7 17:14:17 tux-35-217 sshd\[16919\]: Failed password for invalid user systest from 69.171.206.254 port 28653 ssh2
Sep  7 17:21:56 tux-35-217 sshd\[16960\]: Invalid user servermc from 69.171.206.254 port 55701
Sep  7 17:21:56 tux-35-217 sshd\[16960\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=69.171.206.254
...

Sep  5 18:10:06 xtremcommunity sshd\[12440\]: Invalid user q3server from 69.171.206.254 port 7166
Sep  5 18:10:06 xtremcommunity sshd\[12440\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=69.171.206.254
Sep  5 18:10:08 xtremcommunity sshd\[12440\]: Failed password for invalid user q3server from 69.171.206.254 port 7166 ssh2
Sep  5 18:18:00 xtremcommunity sshd\[12670\]: Invalid user 1 from 69.171.206.254 port 37481
Sep  5 18:18:00 xtremcommunity sshd\[12670\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=69.171.206.254
...

Sep  4 15:50:42 hcbbdb sshd\[10551\]: Invalid user test123 from 69.171.206.254
Sep  4 15:50:42 hcbbdb sshd\[10551\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=69.171.206.254
Sep  4 15:50:45 hcbbdb sshd\[10551\]: Failed password for invalid user test123 from 69.171.206.254 port 15899 ssh2
Sep  4 15:58:58 hcbbdb sshd\[11477\]: Invalid user hellen from 69.171.206.254
Sep  4 15:58:58 hcbbdb sshd\[11477\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=69.171.206.254

Aug 29 21:45:07 itv-usvr-01 sshd[6899]: Invalid user chang from 69.171.206.254
Aug 29 21:45:07 itv-usvr-01 sshd[6899]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=69.171.206.254
Aug 29 21:45:07 itv-usvr-01 sshd[6899]: Invalid user chang from 69.171.206.254
Aug 29 21:45:09 itv-usvr-01 sshd[6899]: Failed password for invalid user chang from 69.171.206.254 port 63945 ssh2
Aug 29 21:54:37 itv-usvr-01 sshd[8487]: Invalid user eight from 69.171.206.254

Oct 11 06:36:13 MainVPS sshd[26538]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.173.142  user=root
Oct 11 06:36:15 MainVPS sshd[26538]: Failed password for root from 222.186.173.142 port 61848 ssh2
Oct 11 06:36:32 MainVPS sshd[26538]: error: maximum authentication attempts exceeded for root from 222.186.173.142 port 61848 ssh2 [preauth]
Oct 11 06:36:13 MainVPS sshd[26538]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.173.142  user=root
Oct 11 06:36:15 MainVPS sshd[26538]: Failed password for root from 222.186.173.142 port 61848 ssh2
Oct 11 06:36:32 MainVPS sshd[26538]: error: maximum authentication attempts exceeded for root from 222.186.173.142 port 61848 ssh2 [preauth]
Oct 11 06:36:40 MainVPS sshd[26570]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.173.142  user=root
Oct 11 06:36:42 MainVPS sshd[26570]: Failed password for root from 222.186.173.142 port

Oct 10 18:10:34 hanapaa sshd\[24588\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ns523909.ip-158-69-121.net  user=root
Oct 10 18:10:36 hanapaa sshd\[24588\]: Failed password for root from 158.69.121.157 port 52992 ssh2
Oct 10 18:14:28 hanapaa sshd\[24906\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ns523909.ip-158-69-121.net  user=root
Oct 10 18:14:31 hanapaa sshd\[24906\]: Failed password for root from 158.69.121.157 port 36472 ssh2
Oct 10 18:18:22 hanapaa sshd\[25249\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ns523909.ip-158-69-121.net  user=root

Oct 11 05:31:58 ncomp sshd[12272]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.136.105.74  user=root
Oct 11 05:32:00 ncomp sshd[12272]: Failed password for root from 211.136.105.74 port 4081 ssh2
Oct 11 05:57:54 ncomp sshd[12563]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.136.105.74  user=root
Oct 11 05:57:55 ncomp sshd[12563]: Failed password for root from 211.136.105.74 port 1353 ssh2

Oct 11 06:18:27 legacy sshd[22468]: Failed password for root from 150.242.213.189 port 49898 ssh2
Oct 11 06:22:26 legacy sshd[22529]: Failed password for root from 150.242.213.189 port 54844 ssh2
...

Oct 11 03:57:47 *** sshd[21526]: User root from 112.94.2.65 not allowed because not listed in AllowUsers

Automatic report - XMLRPC Attack

IP Ban Report : https://help-dysk.pl/wordpress-firewall-plugins/ip/111.252.212.31/ 
 TW - 1H : (330)  
 Protection Against DDoS WordPress plugin :  
 "odzyskiwanie danych help-dysk" 
 IP Address Ranges by Country : TW 
 NAME ASN : ASN3462 
 
 IP : 111.252.212.31 
 
 CIDR : 111.252.0.0/16 
 
 PREFIX COUNT : 390 
 
 UNIQUE IP COUNT : 12267520 
 
 
 WYKRYTE ATAKI Z ASN3462 :  
  1H - 40 
  3H - 60 
  6H - 98 
 12H - 172 
 24H - 321 
 
 DateTime : 2019-10-11 05:58:34 
 
 INFO : Port Scan TELNET Detected and Blocked by ADMIN  - data recovery

SSH bruteforce

Oct 11 06:24:07 vps01 sshd[9440]: Failed password for root from 181.110.240.194 port 41064 ssh2

/wp-login.php

Oct 11 06:39:50 legacy sshd[22961]: Failed password for root from 222.186.175.8 port 32620 ssh2
Oct 11 06:40:07 legacy sshd[22961]: error: maximum authentication attempts exceeded for root from 222.186.175.8 port 32620 ssh2 [preauth]
Oct 11 06:40:19 legacy sshd[22965]: Failed password for root from 222.186.175.8 port 41576 ssh2
...

Oct 11 06:23:58 ns341937 sshd[30858]: Failed password for root from 106.12.74.123 port 56784 ssh2
Oct 11 06:31:28 ns341937 sshd[1036]: Failed password for root from 106.12.74.123 port 45834 ssh2
...

slow and persistent scanner

Oct 11 06:33:47 SilenceServices sshd[22452]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.39.75.1
Oct 11 06:33:50 SilenceServices sshd[22452]: Failed password for invalid user mashby from 54.39.75.1 port 52496 ssh2
Oct 11 06:36:23 SilenceServices sshd[23150]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.39.75.1

Sep 12 07:30:05 microserver sshd[46736]: Invalid user minecraft from 103.205.68.2 port 48268
Sep 12 07:30:05 microserver sshd[46736]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.205.68.2
Sep 12 07:30:07 microserver sshd[46736]: Failed password for invalid user minecraft from 103.205.68.2 port 48268 ssh2
Sep 12 07:36:52 microserver sshd[47938]: Invalid user test from 103.205.68.2 port 53722
Sep 12 07:36:52 microserver sshd[47938]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.205.68.2
Sep 12 07:50:20 microserver sshd[49648]: Invalid user admin from 103.205.68.2 port 36376
Sep 12 07:50:20 microserver sshd[49648]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.205.68.2
Sep 12 07:50:22 microserver sshd[49648]: Failed password for invalid user admin from 103.205.68.2 port 36376 ssh2
Sep 12 07:57:13 microserver sshd[50767]: Invalid user ftpuser2 from 103.205.68.2 port 41818
Sep