164.68.111.62 - - [19/Sep/2020:12:06:20 +0200] "POST /xmlrpc.php HTTP/1.1" 200 427 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
164.68.111.62 - - [19/Sep/2020:12:21:34 +0200] "POST /xmlrpc.php HTTP/1.1" 200 427 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
164.68.111.62 - - [19/Sep/2020:15:22:12 +0200] "POST /xmlrpc.php HTTP/1.1" 200 427 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"

164.68.111.62 - - [19/Sep/2020:07:01:17 +0100] "POST /wp-login.php HTTP/1.1" 403 507 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
164.68.111.62 - - [19/Sep/2020:07:01:31 +0100] "POST /xmlrpc.php HTTP/1.1" 403 680 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
164.68.111.62 - - [19/Sep/2020:07:16:31 +0100] "POST /wp-login.php HTTP/1.1" 403 507 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
...

Sep 18 23:03:21 wordpress wordpress(www.ruhnke.cloud)[22252]: Blocked authentication attempt for admin from 164.68.111.62

164.68.111.62 - - [12/Sep/2020:16:52:11 +0100] "POST /wp-login.php HTTP/1.1" 200 1861 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
164.68.111.62 - - [12/Sep/2020:16:52:22 +0100] "POST /wp-login.php HTTP/1.1" 200 1880 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
164.68.111.62 - - [12/Sep/2020:16:52:35 +0100] "POST /wp-login.php HTTP/1.1" 200 1845 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
...

164.68.111.62 - - [11/Sep/2020:20:48:43 +0100] "POST /wp-login.php HTTP/1.1" 403 507 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
164.68.111.62 - - [11/Sep/2020:20:48:48 +0100] "POST /wp-login.php HTTP/1.1" 403 507 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
164.68.111.62 - - [11/Sep/2020:20:48:54 +0100] "POST /xmlrpc.php HTTP/1.1" 403 680 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
...

(PERMBLOCK) 164.68.111.62 (DE/Germany/shsrv.idwebpanel.com) has had more than 4 temp blocks in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_PERMBLOCK_COUNT; Logs:

Auto reported by IDS

164.68.111.62 - - [08/Sep/2020:18:41:53 +0100] "POST /wp-login.php HTTP/1.1" 200 2040 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
164.68.111.62 - - [08/Sep/2020:18:41:54 +0100] "POST /wp-login.php HTTP/1.1" 200 2037 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
164.68.111.62 - - [08/Sep/2020:18:41:54 +0100] "POST /xmlrpc.php HTTP/1.1" 403 219 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
...

WordPress XMLRPC scan :: 164.68.111.62 1.664 - [08/Sep/2020:11:05:45  0000] [censored_1] "POST /xmlrpc.php HTTP/1.1" 503 18231 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" "HTTP/1.1"

Jun 30 09:01:19 server1 sshd\[11039\]: Invalid user oracle from 164.68.111.13
Jun 30 09:01:20 server1 sshd\[11039\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.68.111.13 
Jun 30 09:01:22 server1 sshd\[11039\]: Failed password for invalid user oracle from 164.68.111.13 port 36092 ssh2
Jun 30 09:04:31 server1 sshd\[13264\]: Invalid user mc from 164.68.111.13
Jun 30 09:04:31 server1 sshd\[13264\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.68.111.13 
Jun 30 09:04:33 server1 sshd\[13264\]: Failed password for invalid user mc from 164.68.111.13 port 34582 ssh2
...

Lines containing failures of 164.68.111.13
Jun 25 07:45:15 majoron sshd[22182]: Invalid user bdl from 164.68.111.13 port 48970
Jun 25 07:45:15 majoron sshd[22182]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.68.111.13 
Jun 25 07:45:17 majoron sshd[22182]: Failed password for invalid user bdl from 164.68.111.13 port 48970 ssh2
Jun 25 07:45:19 majoron sshd[22182]: Received disconnect from 164.68.111.13 port 48970:11: Bye Bye [preauth]
Jun 25 07:45:19 majoron sshd[22182]: Disconnected from invalid user bdl 164.68.111.13 port 48970 [preauth]
Jun 25 08:00:48 majoron sshd[22534]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.68.111.13  user=r.r
Jun 25 08:00:50 majoron sshd[22534]: Failed password for r.r from 164.68.111.13 port 57576 ssh2
Jun 25 08:00:50 majoron sshd[22534]: Received disconnect from 164.68.111.13 port 57576:11: Bye Bye [preauth]
Jun 25 08:00:50 majoron sshd[22534]: Di........
------------------------------

" "

404 NOT FOUND

Unauthorized connection attempt from IP address 118.99.65.141 on Port 445(SMB)

[2020-06-07 23:44:21] NOTICE[1288] chan_sip.c: Registration from '' failed for '82.205.8.184:23153' - Wrong password
[2020-06-07 23:44:21] SECURITY[1303] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-06-07T23:44:21.015-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="4444444",SessionID="0x7f4d7455fd68",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/82.205.8.184/23153",Challenge="399390cd",ReceivedChallenge="399390cd",ReceivedHash="4fb7b7122f092701546f7af5a0a75ccf"
[2020-06-07 23:46:09] NOTICE[1288] chan_sip.c: Registration from '' failed for '82.205.8.184:19624' - Wrong password
[2020-06-07 23:46:09] SECURITY[1303] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-06-07T23:46:09.317-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="44444444",SessionID="0x7f4d7455fd68",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/82
...

Jun  8 11:34:06 MainVPS sshd[9562]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=172.81.243.232  user=root
Jun  8 11:34:07 MainVPS sshd[9562]: Failed password for root from 172.81.243.232 port 37374 ssh2
Jun  8 11:38:20 MainVPS sshd[13222]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=172.81.243.232  user=root
Jun  8 11:38:22 MainVPS sshd[13222]: Failed password for root from 172.81.243.232 port 54462 ssh2
Jun  8 11:42:25 MainVPS sshd[16926]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=172.81.243.232  user=root
Jun  8 11:42:27 MainVPS sshd[16926]: Failed password for root from 172.81.243.232 port 43422 ssh2
...

SSH authentication failure x 6 reported by Fail2Ban
...

Unauthorized connection attempt from IP address 94.255.36.163 on Port 445(SMB)

Jun  8 12:10:13 rotator sshd\[8041\]: Failed password for root from 175.118.126.81 port 47838 ssh2Jun  8 12:12:10 rotator sshd\[8587\]: Failed password for root from 175.118.126.81 port 45884 ssh2Jun  8 12:14:11 rotator sshd\[8633\]: Failed password for root from 175.118.126.81 port 43930 ssh2Jun  8 12:16:06 rotator sshd\[9423\]: Failed password for root from 175.118.126.81 port 41982 ssh2Jun  8 12:18:04 rotator sshd\[9472\]: Failed password for root from 175.118.126.81 port 40036 ssh2Jun  8 12:19:54 rotator sshd\[9508\]: Failed password for root from 175.118.126.81 port 38072 ssh2
...

$f2bV_matches

Jun  7 16:17:27 host sshd[2674]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=223.72.85.117  user=r.r
Jun  7 16:17:29 host sshd[2674]: Failed password for r.r from 223.72.85.117 port 23122 ssh2
Jun  7 16:17:29 host sshd[2674]: Received disconnect from 223.72.85.117: 11: Bye Bye [preauth]
Jun  7 16:31:57 host sshd[11805]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=223.72.85.117  user=r.r
Jun  7 16:31:59 host sshd[11805]: Failed password for r.r from 223.72.85.117 port 23425 ssh2
Jun  7 16:31:59 host sshd[11805]: Received disconnect from 223.72.85.117: 11: Bye Bye [preauth]
Jun  7 16:36:11 host sshd[24955]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=223.72.85.117  user=r.r
Jun  7 16:36:13 host sshd[24955]: Failed password for r.r from 223.72.85.117 port 23543 ssh2
Jun  7 16:36:13 host sshd[24955]: Received disconnect from 223.72.85.117: 11: ........
-------------------------------

Unauthorized connection attempt from IP address 193.227.38.243 on Port 445(SMB)

Lines containing failures of 144.217.46.42
Jun  8 05:13:30 icinga sshd[11043]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=144.217.46.42  user=r.r
Jun  8 05:13:33 icinga sshd[11043]: Failed password for r.r from 144.217.46.42 port 57350 ssh2
Jun  8 05:13:33 icinga sshd[11043]: Received disconnect from 144.217.46.42 port 57350:11: Bye Bye [preauth]
Jun  8 05:13:33 icinga sshd[11043]: Disconnected from authenticating user r.r 144.217.46.42 port 57350 [preauth]
Jun  8 05:25:41 icinga sshd[14685]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=144.217.46.42  user=r.r
Jun  8 05:25:42 icinga sshd[14685]: Failed password for r.r from 144.217.46.42 port 44916 ssh2
Jun  8 05:25:43 icinga sshd[14685]: Received disconnect from 144.217.46.42 port 44916:11: Bye Bye [preauth]
Jun  8 05:25:43 icinga sshd[14685]: Disconnected from authenticating user r.r 144.217.46.42 port 44916 [preauth]
Jun  8 05:31:2........
------------------------------

Jun  8 03:32:20 pixelmemory sshd[823957]: Failed password for root from 192.95.6.110 port 60720 ssh2
Jun  8 03:35:44 pixelmemory sshd[828247]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.95.6.110  user=root
Jun  8 03:35:45 pixelmemory sshd[828247]: Failed password for root from 192.95.6.110 port 34210 ssh2
Jun  8 03:38:57 pixelmemory sshd[831903]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.95.6.110  user=root
Jun  8 03:38:59 pixelmemory sshd[831903]: Failed password for root from 192.95.6.110 port 35899 ssh2
...

Jun  8 13:36:36 vps647732 sshd[2560]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.227.69.39
Jun  8 13:36:38 vps647732 sshd[2560]: Failed password for invalid user business\r from 165.227.69.39 port 33927 ssh2
...

Unauthorized connection attempt from IP address 46.224.209.166 on Port 445(SMB)

Unauthorized connection attempt from IP address 36.90.10.189 on Port 445(SMB)

Jun  8 18:13:37 itv-usvr-01 sshd[31193]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.254.68.159  user=root
Jun  8 18:13:39 itv-usvr-01 sshd[31193]: Failed password for root from 52.254.68.159 port 48516 ssh2
Jun  8 18:16:06 itv-usvr-01 sshd[31292]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.254.68.159  user=root
Jun  8 18:16:08 itv-usvr-01 sshd[31292]: Failed password for root from 52.254.68.159 port 48356 ssh2
Jun  8 18:17:09 itv-usvr-01 sshd[31356]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.254.68.159  user=root
Jun  8 18:17:11 itv-usvr-01 sshd[31356]: Failed password for root from 52.254.68.159 port 33498 ssh2