Aug 24 11:52:07 WHD8 dovecot: pop3-login: Disconnected: Inactivity \(auth failed, 1 attempts in 180 secs\): user=\, method=PLAIN, rip=85.57.145.133, lip=10.64.89.208, session=\
Aug 24 12:07:04 WHD8 dovecot: pop3-login: Disconnected: Inactivity \(auth failed, 1 attempts in 180 secs\): user=\, method=PLAIN, rip=85.57.145.133, lip=10.64.89.208, session=\
Aug 24 12:07:07 WHD8 dovecot: pop3-login: Disconnected: Inactivity \(auth failed, 1 attempts in 179 secs\): user=\, method=PLAIN, rip=85.57.145.133, lip=10.64.89.208, session=\
Aug 24 12:22:04 WHD8 dovecot: pop3-login: Disconnected: Inactivity \(auth failed, 1 attempts in 180 secs\): user=\, method=PLAIN, rip=85.57.145.133, lip=10.64.89.208, session=\
Aug 24 12:22:07 WHD8 dovecot: pop3-login: Disconnected: Inactivity \(auth failed, 1 attempts in 180 secs\): user=\
...

Aug 22 19:33:34 WHD8 dovecot: pop3-login: Disconnected \(auth failed, 1 attempts in 12 secs\): user=\, method=PLAIN, rip=85.57.145.133, lip=10.64.89.208, session=\
Aug 22 19:33:34 WHD8 dovecot: pop3-login: Disconnected \(auth failed, 1 attempts in 10 secs\): user=\, method=PLAIN, rip=85.57.145.133, lip=10.64.89.208, session=\
Aug 22 19:46:28 WHD8 dovecot: pop3-login: Disconnected: Inactivity \(auth failed, 1 attempts in 180 secs\): user=\, method=PLAIN, rip=85.57.145.133, lip=10.64.89.208, session=\
Aug 22 19:46:31 WHD8 dovecot: pop3-login: Disconnected: Inactivity \(auth failed, 1 attempts in 180 secs\): user=\, method=PLAIN, rip=85.57.145.133, lip=10.64.89.208, session=\
Aug 22 19:59:33 WHD8 dovecot: pop3-login: Disconnected \(auth failed, 1 attempts in 65 secs\): user=\, method=PLA
...

Aug 13 08:31:54 WHD8 dovecot: pop3-login: Disconnected: Inactivity \(auth failed, 1 attempts in 179 secs\): user=\, method=PLAIN, rip=85.57.145.133, lip=10.64.89.208, session=\
Aug 13 08:32:02 WHD8 dovecot: pop3-login: Disconnected: Inactivity \(auth failed, 1 attempts in 180 secs\): user=\, method=PLAIN, rip=85.57.145.133, lip=10.64.89.208, session=\
Aug 13 08:46:54 WHD8 dovecot: pop3-login: Disconnected: Inactivity \(auth failed, 1 attempts in 180 secs\): user=\, method=PLAIN, rip=85.57.145.133, lip=10.64.89.208, session=\
Aug 13 08:47:02 WHD8 dovecot: pop3-login: Disconnected: Inactivity \(auth failed, 1 attempts in 180 secs\): user=\, method=PLAIN, rip=85.57.145.133, lip=10.64.89.208, session=\
Aug 13 09:01:54 WHD8 dovecot: pop3-login: Disconnected: Inactivity \(auth failed, 1 attempts in 180 secs\): user=\
...

Jul 28 10:07:15 WHD8 dovecot: pop3-login: Disconnected: Inactivity \(auth failed, 1 attempts in 180 secs\): user=\, method=PLAIN, rip=85.57.145.133, lip=10.64.89.208, session=\
Jul 28 10:37:13 WHD8 dovecot: pop3-login: Disconnected: Inactivity \(auth failed, 1 attempts in 180 secs\): user=\, method=PLAIN, rip=85.57.145.133, lip=10.64.89.208, session=\
Jul 28 10:37:15 WHD8 dovecot: pop3-login: Disconnected: Inactivity \(auth failed, 1 attempts in 179 secs\): user=\, method=PLAIN, rip=85.57.145.133, lip=10.64.89.208, session=\
Jul 28 12:45:19 WHD8 dovecot: pop3-login: Aborted login \(auth failed, 1 attempts in 3 secs\): user=\, method=PLAIN, rip=85.57.145.133, lip=10.64.89.208, session=\
Jul 28 12:57:51 WHD8 dovecot: pop3-login: Disconnected \(auth failed, 1 attempts in 6 secs\): user=\, m
...

Jul 22 14:55:09 WHD8 dovecot: pop3-login: Disconnected \(auth failed, 1 attempts in 8 secs\): user=\, method=PLAIN, rip=85.57.145.133, lip=10.64.89.208, session=\
Jul 22 15:08:03 WHD8 dovecot: pop3-login: Disconnected: Inactivity \(auth failed, 1 attempts in 180 secs\): user=\, method=PLAIN, rip=85.57.145.133, lip=10.64.89.208, session=\<00ZVYwerup9VOZGF\>
Jul 22 15:08:27 WHD8 dovecot: pop3-login: Disconnected: Inactivity \(auth failed, 1 attempts in 180 secs\): user=\, method=PLAIN, rip=85.57.145.133, lip=10.64.89.208, session=\
Jul 22 15:30:06 WHD8 dovecot: pop3-login: Disconnected: Inactivity \(auth failed, 1 attempts in 180 secs\): user=\, method=PLAIN, rip=85.57.145.133, lip=10.64.89.208, session=\
Jul 22 15:30:08 WHD8 dovecot: pop3-login: Disconnected: Inactivity \(auth failed, 1 attempts in 180 secs\): user=\

Jun 27 23:00:03 WHD8 dovecot: pop3-login: Disconnected: Inactivity \(auth failed, 1 attempts in 180 secs\): user=\, method=PLAIN, rip=85.57.145.133, lip=10.64.89.208, session=\<4oJOERepZ7NVOZGF\>
Jun 27 23:00:10 WHD8 dovecot: pop3-login: Disconnected: Inactivity \(auth failed, 1 attempts in 180 secs\): user=\, method=PLAIN, rip=85.57.145.133, lip=10.64.89.208, session=\
Jun 27 23:15:03 WHD8 dovecot: pop3-login: Disconnected: Inactivity \(auth failed, 1 attempts in 180 secs\): user=\, method=PLAIN, rip=85.57.145.133, lip=10.64.89.208, session=\
Jun 27 23:15:09 WHD8 dovecot: pop3-login: Disconnected: Inactivity \(auth failed, 1 attempts in 180 secs\): user=\, method=PLAIN, rip=85.57.145.133, lip=10.64.89.208, session=\
Jun 27 23:30:04 WHD8 dovecot: pop3-login: Disconnected: Inactivity \(auth failed, 1 attempts in 180 secs\): user=\
...

Jun 22 07:17:02 WHD8 dovecot: pop3-login: Disconnected \(auth failed, 1 attempts in 14 secs\): user=\, method=PLAIN, rip=85.57.145.133, lip=10.64.89.208, session=\
Jun 22 07:17:02 WHD8 dovecot: pop3-login: Disconnected \(auth failed, 1 attempts in 17 secs\): user=\, method=PLAIN, rip=85.57.145.133, lip=10.64.89.208, session=\
Jun 22 07:34:13 WHD8 dovecot: pop3-login: Disconnected \(auth failed, 1 attempts in 70 secs\): user=\, method=PLAIN, rip=85.57.145.133, lip=10.64.89.208, session=\
Jun 22 07:34:13 WHD8 dovecot: pop3-login: Disconnected \(auth failed, 1 attempts in 68 secs\): user=\, method=PLAIN, rip=85.57.145.133, lip=10.64.89.208, session=\
Jun 22 07:49:29 WHD8 dovecot: pop3-login: Disconnected: Inactivity \(auth failed, 1 attempts in 180 secs\): user=\, method=PLAIN, rip=85.57.14
...

Jun  3 22:04:07 WHD8 dovecot: pop3-login: Disconnected: Inactivity \(auth failed, 1 attempts in 179 secs\): user=\, method=PLAIN, rip=85.57.145.133, lip=10.64.89.208, session=\
Jun  3 22:04:10 WHD8 dovecot: pop3-login: Disconnected: Inactivity \(auth failed, 1 attempts in 180 secs\): user=\, method=PLAIN, rip=85.57.145.133, lip=10.64.89.208, session=\
Jun  3 22:13:53 WHD8 dovecot: pop3-login: Disconnected \(auth failed, 1 attempts in 156 secs\): user=\, method=PLAIN, rip=85.57.145.133, lip=10.64.89.208, session=\
Jun  3 22:13:53 WHD8 dovecot: pop3-login: Disconnected \(auth failed, 1 attempts in 160 secs\): user=\, method=PLAIN, rip=85.57.145.133, lip=10.64.89.208, session=\
...

2019-10-06T20:25:37.492410abusebot-6.cloudsearch.cf sshd\[25016\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.45.45.241  user=root

Automatic report - Port Scan

Oct  6 22:19:50 dedicated sshd[837]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.131.15.189  user=root
Oct  6 22:19:51 dedicated sshd[837]: Failed password for root from 104.131.15.189 port 38026 ssh2

techno.ws 188.165.250.134 \[06/Oct/2019:21:53:27 +0200\] "POST /wp-login.php HTTP/1.1" 200 5604 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"
techno.ws 188.165.250.134 \[06/Oct/2019:21:53:27 +0200\] "POST /xmlrpc.php HTTP/1.1" 200 4070 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"

Oct  6 22:53:07 sauna sshd[205100]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.64.25.207
Oct  6 22:53:08 sauna sshd[205102]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.64.25.207
...

10/06/2019-21:53:15.162007 162.158.118.132 Protocol: 6 ET WEB_SERVER HTTP POST Generic eval of base64_decode

Oct  6 20:05:37 game-panel sshd[5431]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=109.94.82.149
Oct  6 20:05:39 game-panel sshd[5431]: Failed password for invalid user Circus@123 from 109.94.82.149 port 34156 ssh2
Oct  6 20:09:41 game-panel sshd[5600]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=109.94.82.149

2019-10-06 14:53:27 H=(210.181.86.177.lemnet.com.br) [177.86.181.210]:34659 I=[192.147.25.65]:25 F= rejected RCPT : RBL: found in thrukfz5b56tq6xao6odgdyjrq.zen.dq.spamhaus.net (127.0.0.3, 127.0.0.4) (https://www.spamhaus.org/query/ip/177.86.181.210)
2019-10-06 14:53:28 H=(210.181.86.177.lemnet.com.br) [177.86.181.210]:34659 I=[192.147.25.65]:25 F= rejected RCPT : RBL: found in thrukfz5b56tq6xao6odgdyjrq.zen.dq.spamhaus.net (127.0.0.3, 127.0.0.4) (https://www.spamhaus.org/sbl/query/SBLCSS)
2019-10-06 14:53:29 H=(210.181.86.177.lemnet.com.br) [177.86.181.210]:34659 I=[192.147.25.65]:25 F= rejected RCPT : RBL: found in thrukfz5b56tq6xao6odgdyjrq.zen.dq.spamhaus.net (127.0.0.3, 127.0.0.4) (https://www.spamhaus.org/query/ip/177.86.181.210)
...

Automatic report - Port Scan Attack

Tried sshing with brute force.

Oct  3 13:20:30 microserver sshd[18150]: Failed none for root from 222.186.173.215 port 15020 ssh2
Oct  3 13:20:31 microserver sshd[18150]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.173.215  user=root
Oct  3 13:20:33 microserver sshd[18150]: Failed password for root from 222.186.173.215 port 15020 ssh2
Oct  3 13:20:37 microserver sshd[18150]: Failed password for root from 222.186.173.215 port 15020 ssh2
Oct  3 13:20:41 microserver sshd[18150]: Failed password for root from 222.186.173.215 port 15020 ssh2
Oct  4 20:10:37 microserver sshd[6958]: Failed none for root from 222.186.173.215 port 50950 ssh2
Oct  4 20:10:38 microserver sshd[6958]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.173.215  user=root
Oct  4 20:10:40 microserver sshd[6958]: Failed password for root from 222.186.173.215 port 50950 ssh2
Oct  4 20:10:44 microserver sshd[6958]: Failed password for root from 222.186.173.215 port 50950 ssh2
Oct

Oct  6 22:35:09 nextcloud sshd\[12811\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.190.2  user=root
Oct  6 22:35:10 nextcloud sshd\[12811\]: Failed password for root from 222.186.190.2 port 45108 ssh2
Oct  6 22:35:24 nextcloud sshd\[12811\]: Failed password for root from 222.186.190.2 port 45108 ssh2
...

Oct  6 22:53:42 hosting sshd[21696]: Invalid user pi from 49.205.203.159 port 45704
Oct  6 22:53:42 hosting sshd[21695]: Invalid user pi from 49.205.203.159 port 45698
Oct  6 22:53:42 hosting sshd[21696]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.205.203.159
Oct  6 22:53:42 hosting sshd[21696]: Invalid user pi from 49.205.203.159 port 45704
Oct  6 22:53:44 hosting sshd[21696]: Failed password for invalid user pi from 49.205.203.159 port 45704 ssh2
Oct  6 22:53:42 hosting sshd[21695]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.205.203.159
Oct  6 22:53:42 hosting sshd[21695]: Invalid user pi from 49.205.203.159 port 45698
Oct  6 22:53:44 hosting sshd[21695]: Failed password for invalid user pi from 49.205.203.159 port 45698 ssh2
...

Fail2Ban Ban Triggered
HTTP SQL Injection Attempt

Oct  6 16:24:39 ny01 sshd[4640]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.55.241.3
Oct  6 16:24:42 ny01 sshd[4640]: Failed password for invalid user 1qaz2wsx3edc4rfv5tgb6yhn from 117.55.241.3 port 33880 ssh2
Oct  6 16:29:13 ny01 sshd[5870]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.55.241.3