MYH,DEF GET /magmi/web/magmi.php

Jun 13 08:35:46 h1745522 sshd[9100]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.18.54.30  user=root
Jun 13 08:35:48 h1745522 sshd[9100]: Failed password for root from 14.18.54.30 port 35924 ssh2
Jun 13 08:37:17 h1745522 sshd[9182]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.18.54.30  user=root
Jun 13 08:37:19 h1745522 sshd[9182]: Failed password for root from 14.18.54.30 port 44059 ssh2
Jun 13 08:38:41 h1745522 sshd[9302]: Invalid user der from 14.18.54.30 port 52194
Jun 13 08:38:41 h1745522 sshd[9302]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.18.54.30
Jun 13 08:38:41 h1745522 sshd[9302]: Invalid user der from 14.18.54.30 port 52194
Jun 13 08:38:43 h1745522 sshd[9302]: Failed password for invalid user der from 14.18.54.30 port 52194 ssh2
Jun 13 08:40:09 h1745522 sshd[9513]: Invalid user admin from 14.18.54.30 port 60332
...

Brute-force attempt banned

Jun 13 09:17:51 piServer sshd[21440]: Failed password for root from 176.57.75.165 port 35316 ssh2
Jun 13 09:21:22 piServer sshd[21785]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=176.57.75.165 
Jun 13 09:21:24 piServer sshd[21785]: Failed password for invalid user sababo from 176.57.75.165 port 34604 ssh2
...

k+ssh-bruteforce

Tried sshing with brute force.

Brute-force attempt banned

Jun 13 08:47:55 minden010 sshd[17937]: Failed password for root from 112.85.42.174 port 59110 ssh2
Jun 13 08:48:09 minden010 sshd[17937]: error: maximum authentication attempts exceeded for root from 112.85.42.174 port 59110 ssh2 [preauth]
Jun 13 08:48:15 minden010 sshd[18047]: Failed password for root from 112.85.42.174 port 22854 ssh2
...

Lines containing failures of 219.94.243.91
Jun 10 22:15:12 newdogma sshd[8819]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=219.94.243.91  user=r.r
Jun 10 22:15:14 newdogma sshd[8819]: Failed password for r.r from 219.94.243.91 port 41917 ssh2
Jun 10 22:15:15 newdogma sshd[8819]: Received disconnect from 219.94.243.91 port 41917:11: Bye Bye [preauth]
Jun 10 22:15:15 newdogma sshd[8819]: Disconnected from authenticating user r.r 219.94.243.91 port 41917 [preauth]
Jun 10 22:19:26 newdogma sshd[8859]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=219.94.243.91  user=r.r
Jun 10 22:19:28 newdogma sshd[8859]: Failed password for r.r from 219.94.243.91 port 39612 ssh2
Jun 10 22:19:29 newdogma sshd[8859]: Received disconnect from 219.94.243.91 port 39612:11: Bye Bye [preauth]
Jun 10 22:19:29 newdogma sshd[8859]: Disconnected from authenticating user r.r 219.94.243.91 port 39612 [preauth]
Jun 10........
------------------------------

[2020-06-13 03:31:17] NOTICE[1273] chan_sip.c: Registration from '' failed for '45.89.174.46:50594' - Wrong password
[2020-06-13 03:31:17] SECURITY[1288] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-06-13T03:31:17.483-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="9991",SessionID="0x7f31c02f7128",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/45.89.174.46/50594",Challenge="6c3510dc",ReceivedChallenge="6c3510dc",ReceivedHash="c03a4b9d511f6160d1c371cff5c2edfd"
[2020-06-13 03:32:05] NOTICE[1273] chan_sip.c: Registration from '' failed for '45.89.174.46:51965' - Wrong password
...

Jun 13 08:51:34 abendstille sshd\[25435\]: Invalid user jxjd from 157.245.47.152
Jun 13 08:51:34 abendstille sshd\[25435\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.47.152
Jun 13 08:51:35 abendstille sshd\[25442\]: Invalid user jxjd from 157.245.47.152
Jun 13 08:51:35 abendstille sshd\[25442\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.47.152
Jun 13 08:51:36 abendstille sshd\[25435\]: Failed password for invalid user jxjd from 157.245.47.152 port 39280 ssh2
...

Unauthorized IMAP connection attempt

 TCP (SYN) 115.76.57.135:54806 -> port 1080, len 52

Portscan or hack attempt detected by psad/fwsnort

This client attempted to login to an administrator account on a Website, or abused from another resource.