Aug 27 05:36:42 mail.srvfarm.net postfix/smtpd[1361436]: warning: unknown[186.250.200.82]: SASL PLAIN authentication failed: 
Aug 27 05:36:43 mail.srvfarm.net postfix/smtpd[1361436]: lost connection after AUTH from unknown[186.250.200.82]
Aug 27 05:40:05 mail.srvfarm.net postfix/smtpd[1362101]: warning: unknown[186.250.200.82]: SASL PLAIN authentication failed: 
Aug 27 05:40:05 mail.srvfarm.net postfix/smtpd[1362101]: lost connection after AUTH from unknown[186.250.200.82]
Aug 27 05:45:39 mail.srvfarm.net postfix/smtps/smtpd[1362633]: warning: unknown[186.250.200.82]: SASL PLAIN authentication failed:

Sep 17 03:22:24 mail.srvfarm.net postfix/smtpd[3975920]: warning: unknown[186.250.200.77]: SASL PLAIN authentication failed: 
Sep 17 03:22:25 mail.srvfarm.net postfix/smtpd[3975920]: lost connection after AUTH from unknown[186.250.200.77]
Sep 17 03:24:18 mail.srvfarm.net postfix/smtpd[3978175]: warning: unknown[186.250.200.77]: SASL PLAIN authentication failed: 
Sep 17 03:24:18 mail.srvfarm.net postfix/smtpd[3978175]: lost connection after AUTH from unknown[186.250.200.77]
Sep 17 03:26:43 mail.srvfarm.net postfix/smtps/smtpd[3978211]: warning: unknown[186.250.200.77]: SASL PLAIN authentication failed:

Sep 17 03:22:24 mail.srvfarm.net postfix/smtpd[3975920]: warning: unknown[186.250.200.77]: SASL PLAIN authentication failed: 
Sep 17 03:22:25 mail.srvfarm.net postfix/smtpd[3975920]: lost connection after AUTH from unknown[186.250.200.77]
Sep 17 03:24:18 mail.srvfarm.net postfix/smtpd[3978175]: warning: unknown[186.250.200.77]: SASL PLAIN authentication failed: 
Sep 17 03:24:18 mail.srvfarm.net postfix/smtpd[3978175]: lost connection after AUTH from unknown[186.250.200.77]
Sep 17 03:26:43 mail.srvfarm.net postfix/smtps/smtpd[3978211]: warning: unknown[186.250.200.77]: SASL PLAIN authentication failed:

Sep 17 00:10:15 mail.srvfarm.net postfix/smtpd[3892387]: warning: unknown[186.250.200.77]: SASL PLAIN authentication failed: 
Sep 17 00:10:15 mail.srvfarm.net postfix/smtpd[3892387]: lost connection after AUTH from unknown[186.250.200.77]
Sep 17 00:11:23 mail.srvfarm.net postfix/smtpd[3892387]: warning: unknown[186.250.200.77]: SASL PLAIN authentication failed: 
Sep 17 00:11:23 mail.srvfarm.net postfix/smtpd[3892387]: lost connection after AUTH from unknown[186.250.200.77]
Sep 17 00:20:09 mail.srvfarm.net postfix/smtps/smtpd[3727776]: warning: unknown[186.250.200.77]: SASL PLAIN authentication failed:

Aug 27 04:42:07 mail.srvfarm.net postfix/smtpd[1336010]: warning: unknown[186.250.200.118]: SASL PLAIN authentication failed: 
Aug 27 04:42:08 mail.srvfarm.net postfix/smtpd[1336010]: lost connection after AUTH from unknown[186.250.200.118]
Aug 27 04:42:21 mail.srvfarm.net postfix/smtpd[1333803]: warning: unknown[186.250.200.118]: SASL PLAIN authentication failed: 
Aug 27 04:42:21 mail.srvfarm.net postfix/smtpd[1333803]: lost connection after AUTH from unknown[186.250.200.118]
Aug 27 04:51:51 mail.srvfarm.net postfix/smtps/smtpd[1335346]: warning: unknown[186.250.200.118]: SASL PLAIN authentication failed:

Aug 27 05:00:39 mail.srvfarm.net postfix/smtpd[1341996]: warning: unknown[186.250.200.112]: SASL PLAIN authentication failed: 
Aug 27 05:00:40 mail.srvfarm.net postfix/smtpd[1341996]: lost connection after AUTH from unknown[186.250.200.112]
Aug 27 05:01:46 mail.srvfarm.net postfix/smtpd[1334718]: warning: unknown[186.250.200.112]: SASL PLAIN authentication failed: 
Aug 27 05:01:47 mail.srvfarm.net postfix/smtpd[1334718]: lost connection after AUTH from unknown[186.250.200.112]
Aug 27 05:02:16 mail.srvfarm.net postfix/smtpd[1354307]: warning: unknown[186.250.200.112]: SASL PLAIN authentication failed:

Aug 27 05:13:48 mail.srvfarm.net postfix/smtpd[1339899]: warning: unknown[186.250.200.71]: SASL PLAIN authentication failed: 
Aug 27 05:13:48 mail.srvfarm.net postfix/smtpd[1339899]: lost connection after AUTH from unknown[186.250.200.71]
Aug 27 05:21:01 mail.srvfarm.net postfix/smtps/smtpd[1356766]: warning: unknown[186.250.200.71]: SASL PLAIN authentication failed: 
Aug 27 05:21:01 mail.srvfarm.net postfix/smtps/smtpd[1356766]: lost connection after AUTH from unknown[186.250.200.71]
Aug 27 05:21:21 mail.srvfarm.net postfix/smtpd[1347878]: warning: unknown[186.250.200.71]: SASL PLAIN authentication failed:

Aug 27 05:53:49 mail.srvfarm.net postfix/smtpd[1362764]: warning: unknown[186.250.200.87]: SASL PLAIN authentication failed: 
Aug 27 05:53:50 mail.srvfarm.net postfix/smtpd[1362764]: lost connection after AUTH from unknown[186.250.200.87]
Aug 27 05:54:51 mail.srvfarm.net postfix/smtps/smtpd[1364783]: warning: unknown[186.250.200.87]: SASL PLAIN authentication failed: 
Aug 27 05:54:52 mail.srvfarm.net postfix/smtps/smtpd[1364783]: lost connection after AUTH from unknown[186.250.200.87]
Aug 27 05:59:01 mail.srvfarm.net postfix/smtps/smtpd[1365298]: warning: unknown[186.250.200.87]: SASL PLAIN authentication failed:

SASL PLAIN auth failed: ruser=...

(smtpauth) Failed SMTP AUTH login from 186.250.200.87 (BR/Brazil/186-250-200-87.ibl.com.br): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 2020-07-07 16:29:16 plain authenticator failed for ([186.250.200.87]) [186.250.200.87]: 535 Incorrect authentication data (set_id=info)

Jun 18 10:36:47 mail.srvfarm.net postfix/smtps/smtpd[1392804]: warning: unknown[186.250.200.93]: SASL PLAIN authentication failed: 
Jun 18 10:36:47 mail.srvfarm.net postfix/smtps/smtpd[1392804]: lost connection after AUTH from unknown[186.250.200.93]
Jun 18 10:42:37 mail.srvfarm.net postfix/smtps/smtpd[1393813]: warning: unknown[186.250.200.93]: SASL PLAIN authentication failed: 
Jun 18 10:42:38 mail.srvfarm.net postfix/smtps/smtpd[1393813]: lost connection after AUTH from unknown[186.250.200.93]
Jun 18 10:45:03 mail.srvfarm.net postfix/smtpd[1388354]: warning: unknown[186.250.200.93]: SASL PLAIN authentication failed:

Jun 18 11:38:21 mail.srvfarm.net postfix/smtpd[1425131]: warning: unknown[186.250.200.87]: SASL PLAIN authentication failed: 
Jun 18 11:38:22 mail.srvfarm.net postfix/smtpd[1425131]: lost connection after AUTH from unknown[186.250.200.87]
Jun 18 11:38:57 mail.srvfarm.net postfix/smtps/smtpd[1427307]: warning: unknown[186.250.200.87]: SASL PLAIN authentication failed: 
Jun 18 11:38:58 mail.srvfarm.net postfix/smtps/smtpd[1427307]: lost connection after AUTH from unknown[186.250.200.87]
Jun 18 11:41:29 mail.srvfarm.net postfix/smtps/smtpd[1426824]: warning: unknown[186.250.200.87]: SASL PLAIN authentication failed:

Brute force attempt

Automatic report - XMLRPC Attack

IP Ban Report :  
 https://help-dysk.pl/wordpress-firewall-plugins/ip/201.235.251.10/ 
 
 AR - 1H : (70)  
 Protection Against DDoS WordPress plugin :  
 "odzyskiwanie danych help-dysk" 
 IP Address Ranges by Country : AR 
 NAME ASN : ASN27871 
 
 IP : 201.235.251.10 
 
 CIDR : 201.235.224.0/19 
 
 PREFIX COUNT : 137 
 
 UNIQUE IP COUNT : 958208 
 
 
 ATTACKS DETECTED ASN27871 :  
  1H - 1 
  3H - 1 
  6H - 1 
 12H - 1 
 24H - 1 
 
 DateTime : 2019-11-09 15:57:26 
 
 INFO :  HACK ! - Looking for resource vulnerabilities Scan Detected and Blocked by ADMIN  - data recovery

2019-11-09T15:55:52.870725  sshd[14162]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.140.140.2  user=mysql
2019-11-09T15:55:54.987646  sshd[14162]: Failed password for mysql from 182.140.140.2 port 50332 ssh2
2019-11-09T16:01:28.841579  sshd[14259]: Invalid user service from 182.140.140.2 port 54630
2019-11-09T16:01:28.854569  sshd[14259]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.140.140.2
2019-11-09T16:01:28.841579  sshd[14259]: Invalid user service from 182.140.140.2 port 54630
2019-11-09T16:01:30.765321  sshd[14259]: Failed password for invalid user service from 182.140.140.2 port 54630 ssh2
...

Nov  9 16:09:23 vmanager6029 postfix/smtpd\[18847\]: warning: unknown\[46.38.144.179\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Nov  9 16:10:33 vmanager6029 postfix/smtpd\[18847\]: warning: unknown\[46.38.144.179\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6

port 23 attempt blocked

Nov  9 16:45:23 SilenceServices sshd[2693]: Failed password for root from 222.186.30.59 port 61242 ssh2
Nov  9 16:45:25 SilenceServices sshd[2707]: Failed password for root from 222.186.30.59 port 21777 ssh2
Nov  9 16:45:25 SilenceServices sshd[2693]: Failed password for root from 222.186.30.59 port 61242 ssh2

51.68.228.85 - - [09/Nov/2019:16:02:37 +0100] "GET /wp-login.php HTTP/1.1" 200 1122 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
51.68.228.85 - - [09/Nov/2019:16:02:38 +0100] "POST /wp-login.php HTTP/1.1" 200 1503 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
51.68.228.85 - - [09/Nov/2019:16:02:38 +0100] "GET /wp-login.php HTTP/1.1" 200 1122 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
51.68.228.85 - - [09/Nov/2019:16:02:39 +0100] "POST /wp-login.php HTTP/1.1" 200 1489 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
51.68.228.85 - - [09/Nov/2019:16:02:39 +0100] "GET /wp-login.php HTTP/1.1" 200 1122 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
51.68.228.85 - - [09/Nov/2019:16:02:39 +0100] "POST /wp-login.php HTTP/1.1" 200 1491 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
...

Nov  9 15:56:54 lnxded64 sshd[30318]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.163.190.49
Nov  9 15:56:54 lnxded64 sshd[30318]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.163.190.49

11/09/2019-10:02:57.038995 80.82.64.171 Protocol: 6 ET SCAN NMAP -sS window 1024

Nov  9 15:56:37 smtp postfix/smtpd[89986]: NOQUEUE: reject: RCPT from weight.stop-snore-de.com[81.28.107.16]: 554 5.7.1 Service unavailable; Client host [81.28.107.16] blocked using zen.spamhaus.org; https://www.spamhaus.org/sbl/query/SBLCSS; from= to= proto=ESMTP helo=
...

F2B jail: sshd. Time: 2019-11-09 16:44:40, Reported by: VKReport

Nov  9 14:49:02 hcbbdb sshd\[2568\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=110.35.173.2  user=root
Nov  9 14:49:04 hcbbdb sshd\[2568\]: Failed password for root from 110.35.173.2 port 13180 ssh2
Nov  9 14:53:16 hcbbdb sshd\[3021\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=110.35.173.2  user=root
Nov  9 14:53:18 hcbbdb sshd\[3021\]: Failed password for root from 110.35.173.2 port 3063 ssh2
Nov  9 14:57:31 hcbbdb sshd\[3427\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=110.35.173.2  user=root

2019-11-09T14:52:51.170234shield sshd\[30144\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=124.42.117.243  user=root
2019-11-09T14:52:53.105836shield sshd\[30144\]: Failed password for root from 124.42.117.243 port 47056 ssh2
2019-11-09T14:57:35.441579shield sshd\[30573\]: Invalid user muriel from 124.42.117.243 port 52858
2019-11-09T14:57:35.445961shield sshd\[30573\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=124.42.117.243
2019-11-09T14:57:37.371231shield sshd\[30573\]: Failed password for invalid user muriel from 124.42.117.243 port 52858 ssh2

2019-11-09T16:09:12.313947scmdmz1 sshd\[26775\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.166.117.213  user=root
2019-11-09T16:09:14.926318scmdmz1 sshd\[26775\]: Failed password for root from 188.166.117.213 port 44680 ssh2
2019-11-09T16:12:50.098527scmdmz1 sshd\[27040\]: Invalid user kristen from 188.166.117.213 port 53822
...

port 23 attempt blocked