2019-06-22T22:26:23.068713MailD postfix/smtpd[13387]: warning: unknown[74.208.18.219]: SASL LOGIN authentication failed: authentication failure
2019-06-23T01:57:09.545811MailD postfix/smtpd[29285]: warning: unknown[74.208.18.219]: SASL LOGIN authentication failed: authentication failure
2019-06-23T02:02:01.236146MailD postfix/smtpd[29687]: warning: unknown[74.208.18.219]: SASL LOGIN authentication failed: authentication failure


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=74.208.18.219

SSH login attempts.

SSH brute-force: detected 16 distinct usernames within a 24-hour window.

SSH Invalid Login

Mar 19 04:48:20 v22018086721571380 sshd[19042]: Failed password for invalid user red from 74.208.18.153 port 37154 ssh2
Mar 19 04:57:46 v22018086721571380 sshd[20687]: Failed password for invalid user docker from 74.208.18.153 port 40072 ssh2

SSH Authentication Attempts Exceeded

Mar  4 13:23:37 vps647732 sshd[29160]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=74.208.18.153
Mar  4 13:23:39 vps647732 sshd[29160]: Failed password for invalid user admin1 from 74.208.18.153 port 53352 ssh2
...

Multiple brute force RDP login attempts in last 24h

[2020-02-21 17:16:57] NOTICE[1148] chan_sip.c: Registration from '' failed for '74.208.18.250:47199' - Wrong password
[2020-02-21 17:16:57] SECURITY[1163] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-02-21T17:16:57.777-0500",Severity="Error",Service="SIP",EventVersion="2",AccountID="3551",SessionID="0x7fd82c9bc688",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/74.208.18.250/47199",Challenge="70f535c5",ReceivedChallenge="70f535c5",ReceivedHash="7cbd655159e0317e578ed042a9cb7602"
[2020-02-21 17:19:08] NOTICE[1148] chan_sip.c: Registration from '' failed for '74.208.18.250:51809' - Wrong password
[2020-02-21 17:19:08] SECURITY[1163] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-02-21T17:19:08.356-0500",Severity="Error",Service="SIP",EventVersion="2",AccountID="1001",SessionID="0x7fd82cce0268",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/74.208.18.250
...

Jan 14 14:25:17 localhost sshd\[29154\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=74.208.18.153  user=root
Jan 14 14:25:19 localhost sshd\[29154\]: Failed password for root from 74.208.18.153 port 52230 ssh2
Jan 14 14:27:10 localhost sshd\[29213\]: Invalid user master from 74.208.18.153
Jan 14 14:27:10 localhost sshd\[29213\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=74.208.18.153
Jan 14 14:27:12 localhost sshd\[29213\]: Failed password for invalid user master from 74.208.18.153 port 42506 ssh2
...

Automatic report - XMLRPC Attack

Mar  4 12:24:49 vpn sshd[31693]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=74.208.183.88
Mar  4 12:24:51 vpn sshd[31693]: Failed password for invalid user co from 74.208.183.88 port 57818 ssh2
Mar  4 12:30:56 vpn sshd[31705]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=74.208.183.88

no

Invalid user ramlan from 74.208.18.153 port 44924

Dec 23 06:05:27 lanister sshd[5892]: Failed password for invalid user ubnt from 74.208.18.153 port 43278 ssh2
Dec 23 06:11:07 lanister sshd[6001]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=74.208.18.153  user=root
Dec 23 06:11:09 lanister sshd[6001]: Failed password for root from 74.208.18.153 port 58402 ssh2
Dec 23 06:15:51 lanister sshd[6052]: Invalid user http from 74.208.18.153
...

2019-11-23T14:44:19.949010shield sshd\[12164\]: Invalid user kareenhalli from 74.208.186.39 port 39928
2019-11-23T14:44:19.953588shield sshd\[12164\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=74.208.186.39
2019-11-23T14:44:21.615214shield sshd\[12164\]: Failed password for invalid user kareenhalli from 74.208.186.39 port 39928 ssh2
2019-11-23T14:48:06.217097shield sshd\[13332\]: Invalid user docs from 74.208.186.39 port 48002
2019-11-23T14:48:06.221653shield sshd\[13332\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=74.208.186.39

Automatic report - Port Scan Attack

Sep 23 18:46:57 microserver sshd[9279]: Invalid user qwerty from 112.64.34.165 port 44199
Sep 23 18:46:57 microserver sshd[9279]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.64.34.165
Sep 23 18:46:59 microserver sshd[9279]: Failed password for invalid user qwerty from 112.64.34.165 port 44199 ssh2
Sep 23 18:51:58 microserver sshd[9999]: Invalid user p@55w0rd from 112.64.34.165 port 59103
Sep 23 18:51:58 microserver sshd[9999]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.64.34.165
Sep 23 19:02:11 microserver sshd[11447]: Invalid user sx from 112.64.34.165 port 60678
Sep 23 19:02:11 microserver sshd[11447]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.64.34.165
Sep 23 19:02:12 microserver sshd[11447]: Failed password for invalid user sx from 112.64.34.165 port 60678 ssh2
Sep 23 19:07:08 microserver sshd[12153]: Invalid user gb@123 from 112.64.34.165 port 47347
Sep 23 19:

Sep 23 12:53:34 thevastnessof sshd[1052]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=74.83.196.67
...

IP Ban Report : https://help-dysk.pl/wordpress-firewall-plugins/ip/114.43.24.86/ 
 TW - 1H : (2813)  
 Protection Against DDoS WordPress plugin :  
 "odzyskiwanie danych help-dysk" 
 IP Address Ranges by Country : TW 
 NAME ASN : ASN3462 
 
 IP : 114.43.24.86 
 
 CIDR : 114.43.0.0/16 
 
 PREFIX COUNT : 390 
 
 UNIQUE IP COUNT : 12267520 
 
 
 WYKRYTE ATAKI Z ASN3462 :  
  1H - 285 
  3H - 1106 
  6H - 2240 
 12H - 2716 
 24H - 2725 
 
 INFO : Port Scan TELNET Detected and Blocked by ADMIN  - data recovery

IP Ban Report : https://help-dysk.pl/wordpress-firewall-plugins/ip/114.40.233.37/ 
 TW - 1H : (2811)  
 Protection Against DDoS WordPress plugin :  
 "odzyskiwanie danych help-dysk" 
 IP Address Ranges by Country : TW 
 NAME ASN : ASN3462 
 
 IP : 114.40.233.37 
 
 CIDR : 114.40.0.0/16 
 
 PREFIX COUNT : 390 
 
 UNIQUE IP COUNT : 12267520 
 
 
 WYKRYTE ATAKI Z ASN3462 :  
  1H - 285 
  3H - 1106 
  6H - 2238 
 12H - 2714 
 24H - 2723 
 
 INFO : Port Scan TELNET Detected and Blocked by ADMIN  - data recovery

IP Ban Report : https://help-dysk.pl/wordpress-firewall-plugins/ip/114.38.187.19/ 
 TW - 1H : (2809)  
 Protection Against DDoS WordPress plugin :  
 "odzyskiwanie danych help-dysk" 
 IP Address Ranges by Country : TW 
 NAME ASN : ASN3462 
 
 IP : 114.38.187.19 
 
 CIDR : 114.38.0.0/16 
 
 PREFIX COUNT : 390 
 
 UNIQUE IP COUNT : 12267520 
 
 
 WYKRYTE ATAKI Z ASN3462 :  
  1H - 283 
  3H - 1104 
  6H - 2236 
 12H - 2712 
 24H - 2721 
 
 INFO : Port Scan TELNET Detected and Blocked by ADMIN  - data recovery

Sep 23 06:48:59 friendsofhawaii sshd\[26726\]: Invalid user ax from 142.93.232.222
Sep 23 06:48:59 friendsofhawaii sshd\[26726\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.232.222
Sep 23 06:49:01 friendsofhawaii sshd\[26726\]: Failed password for invalid user ax from 142.93.232.222 port 47088 ssh2
Sep 23 06:53:14 friendsofhawaii sshd\[27090\]: Invalid user nagios from 142.93.232.222
Sep 23 06:53:14 friendsofhawaii sshd\[27090\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.232.222

Sep 23 12:52:47 ny01 sshd[17643]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=67.205.177.0
Sep 23 12:52:49 ny01 sshd[17643]: Failed password for invalid user testftp from 67.205.177.0 port 51994 ssh2
Sep 23 12:57:16 ny01 sshd[18767]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=67.205.177.0

IP Ban Report : https://help-dysk.pl/wordpress-firewall-plugins/ip/114.45.235.58/ 
 TW - 1H : (2990)  
 Protection Against DDoS WordPress plugin :  
 "odzyskiwanie danych help-dysk" 
 IP Address Ranges by Country : TW 
 NAME ASN : ASN3462 
 
 IP : 114.45.235.58 
 
 CIDR : 114.45.0.0/16 
 
 PREFIX COUNT : 390 
 
 UNIQUE IP COUNT : 12267520 
 
 
 WYKRYTE ATAKI Z ASN3462 :  
  1H - 304 
  3H - 1027 
  6H - 2187 
 12H - 2890 
 24H - 2899 
 
 INFO : Port Scan TELNET Detected and Blocked by ADMIN  - data recovery

IP Ban Report : https://help-dysk.pl/wordpress-firewall-plugins/ip/187.173.153.239/ 
 MX - 1H : (429)  
 Protection Against DDoS WordPress plugin :  
 "odzyskiwanie danych help-dysk" 
 IP Address Ranges by Country : MX 
 NAME ASN : ASN8151 
 
 IP : 187.173.153.239 
 
 CIDR : 187.173.128.0/19 
 
 PREFIX COUNT : 6397 
 
 UNIQUE IP COUNT : 13800704 
 
 
 WYKRYTE ATAKI Z ASN8151 :  
  1H - 9 
  3H - 26 
  6H - 47 
 12H - 65 
 24H - 77 
 
 INFO : Port Scan TELNET Detected and Blocked by ADMIN  - data recovery

2019-09-23T17:02:39.893960abusebot-7.cloudsearch.cf sshd\[31323\]: Invalid user 123456 from 138.68.128.80 port 49924

2019-09-23T18:37:50.298155  sshd[29711]: Invalid user yarn@123 from 198.23.228.223 port 43301
2019-09-23T18:37:50.311199  sshd[29711]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=198.23.228.223
2019-09-23T18:37:50.298155  sshd[29711]: Invalid user yarn@123 from 198.23.228.223 port 43301
2019-09-23T18:37:52.543140  sshd[29711]: Failed password for invalid user yarn@123 from 198.23.228.223 port 43301 ssh2
2019-09-23T18:41:58.269448  sshd[29735]: Invalid user duplicity from 198.23.228.223 port 35892
...

Sep 23 05:42:14 hiderm sshd\[21065\]: Invalid user p@Ssw0rd from 23.94.205.209
Sep 23 05:42:14 hiderm sshd\[21065\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.94.205.209
Sep 23 05:42:16 hiderm sshd\[21065\]: Failed password for invalid user p@Ssw0rd from 23.94.205.209 port 56862 ssh2
Sep 23 05:46:14 hiderm sshd\[21388\]: Invalid user whirwind from 23.94.205.209
Sep 23 05:46:14 hiderm sshd\[21388\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.94.205.209

104.140.73.203 - - [23/Sep/2019:08:17:49 -0400] "GET /?page=products&action=view&manufacturerID=1&productID=../etc/passwd%00&linkID=3128 HTTP/1.1" 302 - "https://baldwinbrasshardware.com/?page=products&action=view&manufacturerID=1&productID=../etc/passwd%00&linkID=3128" "Mozilla/5.0 (Windows NT 10.0; WOW64; Rv:50.0) Gecko/20100101 Firefox/50.0"
...

IP Ban Report : https://help-dysk.pl/wordpress-firewall-plugins/ip/41.242.65.32/ 
 NG - 1H : (6)  
 Protection Against DDoS WordPress plugin :  
 "odzyskiwanie danych help-dysk" 
 IP Address Ranges by Country : NG 
 NAME ASN : ASN37605 
 
 IP : 41.242.65.32 
 
 CIDR : 41.242.65.0/24 
 
 PREFIX COUNT : 15 
 
 UNIQUE IP COUNT : 4096 
 
 
 WYKRYTE ATAKI Z ASN37605 :  
  1H - 1 
  3H - 1 
  6H - 1 
 12H - 1 
 24H - 1 
 
 INFO : SERVER - Looking for resource vulnerabilities Detected and Blocked by ADMIN  - data recovery