Wordpress attack

$f2bV_matches

SSH bruteforce

Jul 14 21:32:50 odroid64 sshd\[28403\]: Invalid user mukund from 62.28.253.197
Jul 14 21:32:50 odroid64 sshd\[28403\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.28.253.197
...

Jul 14 09:37:55 auw2 sshd\[27810\]: Invalid user jiachen from 129.211.66.71
Jul 14 09:37:55 auw2 sshd\[27810\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.211.66.71
Jul 14 09:37:57 auw2 sshd\[27810\]: Failed password for invalid user jiachen from 129.211.66.71 port 48034 ssh2
Jul 14 09:42:34 auw2 sshd\[28263\]: Invalid user carla from 129.211.66.71
Jul 14 09:42:34 auw2 sshd\[28263\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.211.66.71

Jul 14 18:27:39 scw-6657dc sshd[31242]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=13.67.94.112
Jul 14 18:27:39 scw-6657dc sshd[31242]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=13.67.94.112
Jul 14 18:27:41 scw-6657dc sshd[31242]: Failed password for invalid user 123 from 13.67.94.112 port 12917 ssh2
...

Jul 14 12:53:48 dignus sshd[21428]: Failed password for root from 49.88.112.111 port 43471 ssh2
Jul 14 12:53:50 dignus sshd[21428]: Failed password for root from 49.88.112.111 port 43471 ssh2
Jul 14 12:53:53 dignus sshd[21428]: Failed password for root from 49.88.112.111 port 43471 ssh2
Jul 14 12:54:22 dignus sshd[21553]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.88.112.111  user=root
Jul 14 12:54:24 dignus sshd[21553]: Failed password for root from 49.88.112.111 port 48637 ssh2
...

Sendgrid 168.245.72.205 From: "Home Depot!!"  - malware links + header:
crepeguysindy.info
go.darcyprio.com
go.altakagenw.com
www.expenseplan.com
u17355174.ct.sendgrid.net
sendgrid.net
cherishyourvows.info

2020/07/14 20:42:12 [error] 20617#20617: *8210486 open() "/usr/share/nginx/html/cgi-bin/php4.cgi" failed (2: No such file or directory), client: 185.220.101.21, server: _, request: "POST /cgi-bin/php4.cgi?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69%6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D%64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%64%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%64+%63%67%69%2E%66%6F%72%63%65%5F%72%65%64%69%72%65%63%74%3D%30+%2D%64+%63%67%69%2E%72%65%64%69%72%65%63%74%5F%73%74%61%74%75%73%5F%65%6E%76%3D%30+%2D%6E HTTP/1.1", host: "hewatee.net"
2020/07/14 20:42:12 [error] 20617#20617: *8210486 open() "/usr/share/nginx/html/cgi-bin/php5.cgi" failed (2: No such file or directory), client: 185.220.101.21, server: _, request: "POST /cgi-bin/php5.cgi?%2D%64+%61%6C%6C

[2020-07-14 16:01:30] NOTICE[1150][C-00003857] chan_sip.c: Call from '' (64.145.79.106:55959) to extension '78011972595725668' rejected because extension not found in context 'public'.
[2020-07-14 16:01:30] SECURITY[1167] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-07-14T16:01:30.690-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="78011972595725668",SessionID="0x7fcb4c207f58",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/64.145.79.106/55959",ACLName="no_extension_match"
[2020-07-14 16:07:16] NOTICE[1150][C-00003859] chan_sip.c: Call from '' (64.145.79.106:56582) to extension '79011972595725668' rejected because extension not found in context 'public'.
[2020-07-14 16:07:16] SECURITY[1167] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-07-14T16:07:16.182-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="79011972595725668",SessionID="0x7fcb4c0dfe08",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="I
...

20 attempts against mh-misbehave-ban on sonic

Connection to SSH Honeypot - Detected by HoneypotDB

Jul 14 20:27:39 h2427292 sshd\[15888\]: Invalid user 123 from 52.255.206.134
Jul 14 20:27:39 h2427292 sshd\[15888\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.255.206.134 
Jul 14 20:27:41 h2427292 sshd\[15888\]: Failed password for invalid user 123 from 52.255.206.134 port 45747 ssh2
...

Honeypot attack, port: 81, PTR: static.vnpt.vn.

Unauthorized connection attempt detected from IP address 71.6.146.185 to port 9151

[Mon Jun 29 09:23:12 2020] - Syn Flood From IP: 88.155.201.110 Port: 4133