The IP has triggered Cloudflare WAF. CF-Ray: 5b5839ab29d7cf48 | WAF_Rule_ID: 1bd9f7863d3d4d8faf68c16295216fb5 | WAF_Kind: firewall | CF_Action: allow | Country: US | CF_IPClass: searchEngine | Protocol: HTTP/1.1 | Method: GET | Host: www.wevg.org | User-Agent: Mozilla/5.0 (compatible; SemrushBot/6~bl; +http://www.semrush.com/bot.html) | CF_DC: IAD. Report generated by Cloudflare-WAF-to-AbuseIPDB (https://github.com/SukkaW/Cloudflare-WAF-to-AbuseIPDB).

"fail2ban match"

(sshd) Failed SSH login from 142.93.103.141 (DE/Germany/-): 5 in the last 3600 secs

5500/tcp
[2020-07-20]1pkt

Automatic report - Banned IP Access

2020-07-20T12:26:17.266011vps2034 sshd[307]: Invalid user git from 5.134.48.17 port 54366
2020-07-20T12:26:17.269950vps2034 sshd[307]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.134.48.17
2020-07-20T12:26:17.266011vps2034 sshd[307]: Invalid user git from 5.134.48.17 port 54366
2020-07-20T12:26:19.139596vps2034 sshd[307]: Failed password for invalid user git from 5.134.48.17 port 54366 ssh2
2020-07-20T12:30:19.252255vps2034 sshd[10513]: Invalid user felix from 5.134.48.17 port 57762
...

Jul 20 18:54:44 *hidden* sshd[63426]: Invalid user web from 149.56.44.101 port 38922 Jul 20 18:54:44 *hidden* sshd[63426]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=149.56.44.101 Jul 20 18:54:45 *hidden* sshd[63426]: Failed password for invalid user web from 149.56.44.101 port 38922 ssh2

2020-07-20T13:06:22.502112hostname sshd[61366]: Failed password for invalid user test from 202.5.23.73 port 46646 ssh2
...

Jul 20 15:21:46 vps sshd[109991]: Failed password for invalid user bgs from 189.91.231.252 port 46086 ssh2
Jul 20 15:26:44 vps sshd[133119]: Invalid user postgres from 189.91.231.252 port 60360
Jul 20 15:26:44 vps sshd[133119]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189-91-231-252-wlan.lpnet.com.br
Jul 20 15:26:47 vps sshd[133119]: Failed password for invalid user postgres from 189.91.231.252 port 60360 ssh2
Jul 20 15:31:44 vps sshd[155491]: Invalid user tui from 189.91.231.252 port 46400
...

Jul 20 14:15:26 zimbra sshd[25564]: Invalid user Adminixxxr from 171.80.184.177
Jul 20 14:15:26 zimbra sshd[25564]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=171.80.184.177
Jul 20 14:15:29 zimbra sshd[25564]: Failed password for invalid user Adminixxxr from 171.80.184.177 port 43786 ssh2
Jul 20 14:15:29 zimbra sshd[25564]: Received disconnect from 171.80.184.177 port 43786:11: Bye Bye [preauth]
Jul 20 14:15:29 zimbra sshd[25564]: Disconnected from 171.80.184.177 port 43786 [preauth]
Jul 20 14:17:04 zimbra sshd[26950]: Invalid user ts3 from 171.80.184.177
Jul 20 14:17:04 zimbra sshd[26950]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=171.80.184.177
Jul 20 14:17:06 zimbra sshd[26950]: Failed password for invalid user ts3 from 171.80.184.177 port 53046 ssh2
Jul 20 14:17:06 zimbra sshd[26950]: Received disconnect from 171.80.184.177 port 53046:11: Bye Bye [preauth]
Jul 20 14:17:06 zimb........
-------------------------------

Invalid user zzw from 94.191.119.31 port 33536

Jul 20 17:40:18 *hidden* sshd[40522]: Failed password for invalid user oracle from 111.161.74.117 port 38722 ssh2 Jul 20 17:50:18 *hidden* sshd[64004]: Invalid user pad from 111.161.74.117 port 54850 Jul 20 17:50:18 *hidden* sshd[64004]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.161.74.117 Jul 20 17:50:20 *hidden* sshd[64004]: Failed password for invalid user pad from 111.161.74.117 port 54850 ssh2 Jul 20 17:56:38 *hidden* sshd[14947]: Invalid user admin from 111.161.74.117 port 58325

Event 'Ataque de red detectado' has occurred on device SRV-EXPLOTACION in Windows domain KAURKI on Monday, July 13, 2020 2:15:47 PM (GMT+00:00)
Tipo de evento:     Ataque de red detectado
Aplicación:     Kaspersky Endpoint Security para Windows
Aplicación\Ruta:     C:\Program Files (x86)\Kaspersky Lab\Kaspersky Endpoint Security for Windows\
Usuario:     SRV-EXPLOTACION\Administrador (Usuario activo)
Componente:     Protección frente a amenazas en la red
Resultado\Descripción:     Bloqueado
Resultado\Nombre:     Intrusion.Generic.CVE-2018-1273.exploit
Objeto:     TCP de 111.231.207.212 at 192.168.0.80:8080

2020-07-19T08:03:59.285112hostname sshd[25980]: Failed password for invalid user team3 from 139.199.4.219 port 46146 ssh2
...

[2020-07-20 13:12:13] NOTICE[1277] chan_sip.c: Registration from '' failed for '176.67.80.9:59669' - Wrong password
[2020-07-20 13:12:13] SECURITY[1295] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-07-20T13:12:13.235-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="3609",SessionID="0x7f1754188e58",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/176.67.80.9/59669",Challenge="66babd0c",ReceivedChallenge="66babd0c",ReceivedHash="296ddafa1c2724c0487fe86dea312694"
[2020-07-20 13:14:30] NOTICE[1277] chan_sip.c: Registration from '' failed for '176.67.80.9:57542' - Wrong password
[2020-07-20 13:14:30] SECURITY[1295] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-07-20T13:14:30.961-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="3514",SessionID="0x7f175455b408",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/176.67.80.9/57542",
...