2020-06-17T00:03:36.067695mail.standpoint.com.ua sshd[31174]: Invalid user silvio from 142.93.140.242 port 43750
2020-06-17T00:03:36.070299mail.standpoint.com.ua sshd[31174]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.140.242
2020-06-17T00:03:36.067695mail.standpoint.com.ua sshd[31174]: Invalid user silvio from 142.93.140.242 port 43750
2020-06-17T00:03:37.535152mail.standpoint.com.ua sshd[31174]: Failed password for invalid user silvio from 142.93.140.242 port 43750 ssh2
2020-06-17T00:06:56.112872mail.standpoint.com.ua sshd[31629]: Invalid user teamspeak3 from 142.93.140.242 port 45070
...

Jun 15 18:54:18 php1 sshd\[21780\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.140.214  user=root
Jun 15 18:54:20 php1 sshd\[21780\]: Failed password for root from 142.93.140.214 port 35010 ssh2
Jun 15 18:57:30 php1 sshd\[21985\]: Invalid user lia from 142.93.140.214
Jun 15 18:57:30 php1 sshd\[21985\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.140.214
Jun 15 18:57:32 php1 sshd\[21985\]: Failed password for invalid user lia from 142.93.140.214 port 36260 ssh2

142.93.140.240 - - [14/Jun/2020:14:48:50 +0200] "GET /wp-login.php HTTP/1.1" 200 6433 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
142.93.140.240 - - [14/Jun/2020:14:48:52 +0200] "POST /wp-login.php HTTP/1.1" 200 6684 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
142.93.140.240 - - [14/Jun/2020:14:48:53 +0200] "POST /xmlrpc.php HTTP/1.1" 200 427 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"

$f2bV_matches

Jun 12 08:32:17 web1 sshd[32760]: Invalid user aogola from 142.93.140.242 port 37724
Jun 12 08:32:17 web1 sshd[32760]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.140.242
Jun 12 08:32:17 web1 sshd[32760]: Invalid user aogola from 142.93.140.242 port 37724
Jun 12 08:32:19 web1 sshd[32760]: Failed password for invalid user aogola from 142.93.140.242 port 37724 ssh2
Jun 12 08:37:35 web1 sshd[1569]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.140.242  user=root
Jun 12 08:37:37 web1 sshd[1569]: Failed password for root from 142.93.140.242 port 51662 ssh2
Jun 12 08:39:32 web1 sshd[2032]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.140.242  user=root
Jun 12 08:39:34 web1 sshd[2032]: Failed password for root from 142.93.140.242 port 59994 ssh2
Jun 12 08:41:29 web1 sshd[2548]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 t
...

May 22 04:46:57 gw1 sshd[10458]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.140.242
May 22 04:46:59 gw1 sshd[10458]: Failed password for invalid user gtx from 142.93.140.242 port 44392 ssh2
...

May 15 21:33:44 ws22vmsma01 sshd[5973]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.140.242
May 15 21:33:46 ws22vmsma01 sshd[5973]: Failed password for invalid user test from 142.93.140.242 port 32810 ssh2
...

May 15 08:54:57 ns382633 sshd\[24679\]: Invalid user yarn from 142.93.140.242 port 54916
May 15 08:54:57 ns382633 sshd\[24679\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.140.242
May 15 08:54:58 ns382633 sshd\[24679\]: Failed password for invalid user yarn from 142.93.140.242 port 54916 ssh2
May 15 08:59:36 ns382633 sshd\[25584\]: Invalid user hang from 142.93.140.242 port 42012
May 15 08:59:36 ns382633 sshd\[25584\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.140.242

May 13 08:10:04 OPSO sshd\[9009\]: Invalid user weblogic from 142.93.140.242 port 45790
May 13 08:10:04 OPSO sshd\[9009\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.140.242
May 13 08:10:06 OPSO sshd\[9009\]: Failed password for invalid user weblogic from 142.93.140.242 port 45790 ssh2
May 13 08:13:37 OPSO sshd\[9825\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.140.242  user=admin
May 13 08:13:38 OPSO sshd\[9825\]: Failed password for admin from 142.93.140.242 port 53730 ssh2

May 11 09:21:42 onepixel sshd[2975521]: Invalid user student02 from 142.93.140.242 port 33052
May 11 09:21:42 onepixel sshd[2975521]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.140.242 
May 11 09:21:42 onepixel sshd[2975521]: Invalid user student02 from 142.93.140.242 port 33052
May 11 09:21:44 onepixel sshd[2975521]: Failed password for invalid user student02 from 142.93.140.242 port 33052 ssh2
May 11 09:25:21 onepixel sshd[2975940]: Invalid user jeremy from 142.93.140.242 port 41636

Automatic report - XMLRPC Attack

May  8 14:12:08 electroncash sshd[33246]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.140.242 
May  8 14:12:08 electroncash sshd[33246]: Invalid user asd from 142.93.140.242 port 54534
May  8 14:12:10 electroncash sshd[33246]: Failed password for invalid user asd from 142.93.140.242 port 54534 ssh2
May  8 14:15:53 electroncash sshd[34290]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.140.242  user=root
May  8 14:15:55 electroncash sshd[34290]: Failed password for root from 142.93.140.242 port 35814 ssh2
...

Attempt to hack Wordpress Login, XMLRPC or other login

Apr 29 13:57:10 ns382633 sshd\[19948\]: Invalid user regina from 142.93.140.242 port 37402
Apr 29 13:57:10 ns382633 sshd\[19948\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.140.242
Apr 29 13:57:12 ns382633 sshd\[19948\]: Failed password for invalid user regina from 142.93.140.242 port 37402 ssh2
Apr 29 14:07:45 ns382633 sshd\[21935\]: Invalid user email from 142.93.140.242 port 54264
Apr 29 14:07:45 ns382633 sshd\[21935\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.140.242

no

2020-06-02T03:45:50.787513abusebot-6.cloudsearch.cf sshd[27691]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.166.155.45  user=root
2020-06-02T03:45:53.537240abusebot-6.cloudsearch.cf sshd[27691]: Failed password for root from 61.166.155.45 port 49140 ssh2
2020-06-02T03:49:06.175602abusebot-6.cloudsearch.cf sshd[27917]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.166.155.45  user=root
2020-06-02T03:49:08.163004abusebot-6.cloudsearch.cf sshd[27917]: Failed password for root from 61.166.155.45 port 23354 ssh2
2020-06-02T03:51:57.767608abusebot-6.cloudsearch.cf sshd[28075]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.166.155.45  user=root
2020-06-02T03:52:00.231525abusebot-6.cloudsearch.cf sshd[28075]: Failed password for root from 61.166.155.45 port 62084 ssh2
2020-06-02T03:54:50.753808abusebot-6.cloudsearch.cf sshd[28238]: pam_unix(sshd:auth): authe
...

Multiple SSH login attempts.

2020-06-02T05:50:02.030684  sshd[6418]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.171.165  user=root
2020-06-02T05:50:03.707162  sshd[6418]: Failed password for root from 122.51.171.165 port 51586 ssh2
2020-06-02T05:55:13.821591  sshd[6533]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.171.165  user=root
2020-06-02T05:55:15.527594  sshd[6533]: Failed password for root from 122.51.171.165 port 50390 ssh2
...

Jun  2 05:54:55 debian-2gb-nbg1-2 kernel: \[13328864.140005\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=139.59.211.245 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=61300 PROTO=TCP SPT=32767 DPT=8545 WINDOW=1024 RES=0x00 SYN URGP=0

20 attempts against mh-misbehave-ban on storm

Jun  2 05:55:01 debian-2gb-nbg1-2 kernel: \[13328869.756568\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=103.46.14.29 DST=195.201.40.59 LEN=52 TOS=0x00 PREC=0x00 TTL=109 ID=15269 DF PROTO=TCP SPT=63474 DPT=1433 WINDOW=8192 RES=0x00 SYN URGP=0

Jun  2 05:55:08 h1655903 dovecot: pop3-login: Aborted login \(auth failed, 1 attempts in 2 secs\): user=\, method=PLAIN, rip=52.178.192.68, lip=85.214.28.7, session=\
Jun  2 05:55:14 h1655903 dovecot: pop3-login: Aborted login \(auth failed, 1 attempts in 6 secs\): user=\, method=PLAIN, rip=52.178.192.68, lip=85.214.28.7, session=\
Jun  2 05:55:17 h1655903 dovecot: pop3-login: Aborted login \(auth failed, 1 attempts in 6 secs\): user=\, method=PLAIN, rip=52.178.192.68, lip=85.214.28.7, session=\
...

trying to access non-authorized port

Jun  2 05:48:11 eventyay sshd[27919]: Failed password for root from 159.65.59.41 port 38360 ssh2
Jun  2 05:51:37 eventyay sshd[27991]: Failed password for root from 159.65.59.41 port 42736 ssh2
...

2020-06-02T00:21:03.2655751495-001 sshd[2779]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=57.140.96.34.bc.googleusercontent.com  user=root
2020-06-02T00:21:04.7840331495-001 sshd[2779]: Failed password for root from 34.96.140.57 port 17554 ssh2
2020-06-02T00:24:11.2667141495-001 sshd[2926]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=57.140.96.34.bc.googleusercontent.com  user=root
2020-06-02T00:24:13.2511091495-001 sshd[2926]: Failed password for root from 34.96.140.57 port 55686 ssh2
2020-06-02T00:27:33.5007061495-001 sshd[3047]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=57.140.96.34.bc.googleusercontent.com  user=root
2020-06-02T00:27:35.8860021495-001 sshd[3047]: Failed password for root from 34.96.140.57 port 29842 ssh2
...

2020-06-01T23:31:56.4402921495-001 sshd[991]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.231.156.236  user=root
2020-06-01T23:31:58.6936551495-001 sshd[991]: Failed password for root from 115.231.156.236 port 51464 ssh2
2020-06-01T23:34:05.4689081495-001 sshd[1064]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.231.156.236  user=root
2020-06-01T23:34:07.4317171495-001 sshd[1064]: Failed password for root from 115.231.156.236 port 53308 ssh2
2020-06-01T23:36:16.7085171495-001 sshd[1131]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.231.156.236  user=root
2020-06-01T23:36:18.6557761495-001 sshd[1131]: Failed password for root from 115.231.156.236 port 55154 ssh2
...

Jun  2 07:12:39 eventyay sshd[29876]: Failed password for root from 222.186.30.76 port 40897 ssh2
Jun  2 07:12:47 eventyay sshd[29878]: Failed password for root from 222.186.30.76 port 11713 ssh2
...

2020-06-02T04:06:06.298962shield sshd\[8883\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.53.20.111  user=root
2020-06-02T04:06:07.648596shield sshd\[8883\]: Failed password for root from 120.53.20.111 port 38750 ssh2
2020-06-02T04:07:21.583337shield sshd\[9199\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.53.20.111  user=root
2020-06-02T04:07:23.896426shield sshd\[9199\]: Failed password for root from 120.53.20.111 port 55030 ssh2
2020-06-02T04:08:36.672335shield sshd\[9471\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.53.20.111  user=root

Automatic report - Banned IP Access

2020-06-01T23:21:33.779459morrigan.ad5gb.com sshd[18499]: Disconnected from authenticating user root 211.137.254.221 port 29437 [preauth]
2020-06-01T23:28:02.961383morrigan.ad5gb.com sshd[19418]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.137.254.221  user=root
2020-06-01T23:28:04.641905morrigan.ad5gb.com sshd[19418]: Failed password for root from 211.137.254.221 port 50779 ssh2