Nov  3 13:10:46 debian sshd\[7717\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.175.155  user=root
Nov  3 13:10:47 debian sshd\[7717\]: Failed password for root from 222.186.175.155 port 64954 ssh2
Nov  3 13:10:51 debian sshd\[7717\]: Failed password for root from 222.186.175.155 port 64954 ssh2
...

Automatic report - Banned IP Access

Nov  3 16:56:16 work-partkepr sshd\[21783\]: Invalid user dang from 106.13.101.129 port 33978
Nov  3 16:56:16 work-partkepr sshd\[21783\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.101.129
...

Automatic report - XMLRPC Attack

Nov  3 06:29:12 web9 sshd\[15660\]: Invalid user 0g from 197.248.205.53
Nov  3 06:29:12 web9 sshd\[15660\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=197.248.205.53
Nov  3 06:29:14 web9 sshd\[15660\]: Failed password for invalid user 0g from 197.248.205.53 port 40220 ssh2
Nov  3 06:33:41 web9 sshd\[16204\]: Invalid user aiaiai from 197.248.205.53
Nov  3 06:33:41 web9 sshd\[16204\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=197.248.205.53

2019-11-03T17:55:49.040902abusebot-8.cloudsearch.cf sshd\[13851\]: Invalid user yb123456 from 181.49.117.31 port 44718

Nov  3 17:28:48 sd-53420 sshd\[17275\]: Invalid user abbis from 49.234.62.144
Nov  3 17:28:48 sd-53420 sshd\[17275\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.234.62.144
Nov  3 17:28:50 sd-53420 sshd\[17275\]: Failed password for invalid user abbis from 49.234.62.144 port 48612 ssh2
Nov  3 17:32:58 sd-53420 sshd\[17599\]: Invalid user paula from 49.234.62.144
Nov  3 17:32:58 sd-53420 sshd\[17599\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.234.62.144
...

IP Ban Report :  
 https://help-dysk.pl/wordpress-firewall-plugins/ip/194.110.6.99/ 
 
 UA - 1H : (31)  
 Protection Against DDoS WordPress plugin :  
 "odzyskiwanie danych help-dysk" 
 IP Address Ranges by Country : UA 
 NAME ASN : ASN57686 
 
 IP : 194.110.6.99 
 
 CIDR : 194.110.6.0/24 
 
 PREFIX COUNT : 1 
 
 UNIQUE IP COUNT : 256 
 
 
 ATTACKS DETECTED ASN57686 :  
  1H - 1 
  3H - 1 
  6H - 1 
 12H - 1 
 24H - 1 
 
 DateTime : 2019-11-03 15:33:17 
 
 INFO :  HACK ! - Looking for resource vulnerabilities Scan Detected and Blocked by ADMIN  - data recovery

Oct 20 11:45:04 vtv3 sshd\[6888\]: Invalid user cloud from 190.25.232.2 port 59521
Oct 20 11:45:04 vtv3 sshd\[6888\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.25.232.2
Oct 20 11:45:06 vtv3 sshd\[6888\]: Failed password for invalid user cloud from 190.25.232.2 port 59521 ssh2
Oct 20 11:49:28 vtv3 sshd\[9236\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.25.232.2  user=root
Oct 20 11:49:30 vtv3 sshd\[9236\]: Failed password for root from 190.25.232.2 port 51237 ssh2
Oct 20 12:02:36 vtv3 sshd\[16194\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.25.232.2  user=root
Oct 20 12:02:38 vtv3 sshd\[16194\]: Failed password for root from 190.25.232.2 port 54629 ssh2
Oct 20 12:07:12 vtv3 sshd\[18586\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.25.232.2  user=root
Oct 20 12:07:14 vtv3 sshd\[18586\]: Failed password f

Nov  3 17:45:48 hcbbdb sshd\[11037\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.74.238  user=root
Nov  3 17:45:50 hcbbdb sshd\[11037\]: Failed password for root from 106.12.74.238 port 44698 ssh2
Nov  3 17:50:32 hcbbdb sshd\[11518\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.74.238  user=root
Nov  3 17:50:34 hcbbdb sshd\[11518\]: Failed password for root from 106.12.74.238 port 53698 ssh2
Nov  3 17:55:14 hcbbdb sshd\[12008\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.74.238  user=root

2019-11-03T18:20:49.231620host3.slimhost.com.ua dovecot[2479259]: pop3-login: Aborted login (auth failed, 1 attempts in 2 secs): user=, method=PLAIN, rip=94.102.57.169, lip=207.180.241.50, session=
2019-11-03T18:21:14.385060host3.slimhost.com.ua dovecot[2479259]: pop3-login: Aborted login (auth failed, 1 attempts in 2 secs): user=, method=PLAIN, rip=94.102.57.169, lip=207.180.241.50, session=
2019-11-03T18:23:23.280610host3.slimhost.com.ua dovecot[2479259]: pop3-login: Aborted login (auth failed, 1 attempts in 2 secs): user=, method=PLAIN, rip=94.102.57.169, lip=207.180.241.50, session=
2019-11-03T18:23:56.330978host3.slimhost.com.ua dovecot[2479259]: pop3-login: Aborted login (auth failed, 1 attempts in 2 secs): user=, method=PLAIN, rip=94.102.57.169, lip=207.180.241.50, session=
2019-11-03T18:25:04.360118host3.slimhost.com.
...

80.82.70.239 was recorded 20 times by 6 hosts attempting to connect to the following ports: 33839,33859,33829,33849,33869,33819,33879,33809. Incident counter (4h, 24h, all-time): 20, 90, 225

2019-11-03T17:38:06.629621abusebot-5.cloudsearch.cf sshd\[5508\]: Invalid user lukasz from 59.10.5.156 port 33810

Nov  3 19:12:31 meumeu sshd[30708]: Failed password for root from 222.186.180.8 port 2392 ssh2
Nov  3 19:12:36 meumeu sshd[30708]: Failed password for root from 222.186.180.8 port 2392 ssh2
Nov  3 19:12:41 meumeu sshd[30708]: Failed password for root from 222.186.180.8 port 2392 ssh2
Nov  3 19:12:51 meumeu sshd[30708]: error: maximum authentication attempts exceeded for root from 222.186.180.8 port 2392 ssh2 [preauth]
...

xmlrpc attack