Oct 13 00:21:08 andromeda sshd\[8530\]: Invalid user admin from 193.32.163.182 port 50853
Oct 13 00:21:08 andromeda sshd\[8530\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.163.182
Oct 13 00:21:08 andromeda sshd\[8531\]: Invalid user admin from 193.32.163.182 port 55176
Oct 13 00:21:08 andromeda sshd\[8531\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.163.182

19/10/12@18:29:37: FAIL: IoT-SSH address from=113.172.214.48
...

Automatic report - XMLRPC Attack

detected by Fail2Ban

19/10/12@18:29:36: FAIL: IoT-SSH address from=144.131.203.79
...

Oct 13 00:25:36 vps691689 sshd[21799]: Failed password for root from 178.128.21.38 port 36592 ssh2
Oct 13 00:29:47 vps691689 sshd[21855]: Failed password for root from 178.128.21.38 port 47966 ssh2
...

Oct 12 17:40:53 localhost sshd\[12897\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=132.248.192.9  user=root
Oct 12 17:40:56 localhost sshd\[12897\]: Failed password for root from 132.248.192.9 port 41520 ssh2
Oct 12 17:54:41 localhost sshd\[13108\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=132.248.192.9  user=root
...

Oct 13 01:29:39 www sshd\[160911\]: Invalid user P@$$W0RD@2017 from 159.203.216.157
Oct 13 01:29:39 www sshd\[160911\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.203.216.157
Oct 13 01:29:41 www sshd\[160911\]: Failed password for invalid user P@$$W0RD@2017 from 159.203.216.157 port 40794 ssh2
...

\[2019-10-12 15:59:34\] SECURITY\[1898\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-10-12T15:59:34.651-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="5591201148443071003",SessionID="0x7fc3ad578188",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/77.247.110.227/57869",ACLName="no_extension_match"
\[2019-10-12 15:59:49\] SECURITY\[1898\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-10-12T15:59:49.294-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="60116401148672520013",SessionID="0x7fc3ac5226d8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/77.247.110.227/59070",ACLName="no_extension_match"
\[2019-10-12 15:59:58\] SECURITY\[1898\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-10-12T15:59:58.669-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="5171401148243625006",SessionID="0x7fc3ac7f93a8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/77.247.110.227/51388"

WordPress brute force

Oct 13 00:20:14 ns381471 sshd[11695]: Failed password for root from 125.213.150.6 port 50514 ssh2
Oct 13 00:24:59 ns381471 sshd[11797]: Failed password for root from 125.213.150.6 port 32878 ssh2

Lines containing failures of 104.248.126.170
Oct 10 11:30:26 mx-in-01 sshd[29092]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.126.170  user=r.r
Oct 10 11:30:27 mx-in-01 sshd[29092]: Failed password for r.r from 104.248.126.170 port 48978 ssh2
Oct 10 11:30:28 mx-in-01 sshd[29092]: Received disconnect from 104.248.126.170 port 48978:11: Bye Bye [preauth]
Oct 10 11:30:28 mx-in-01 sshd[29092]: Disconnected from authenticating user r.r 104.248.126.170 port 48978 [preauth]
Oct 10 11:43:56 mx-in-01 sshd[30262]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.126.170  user=r.r
Oct 10 11:43:59 mx-in-01 sshd[30262]: Failed password for r.r from 104.248.126.170 port 56814 ssh2
Oct 10 11:43:59 mx-in-01 sshd[30262]: Received disconnect from 104.248.126.170 port 56814:11: Bye Bye [preauth]
Oct 10 11:43:59 mx-in-01 sshd[30262]: Disconnected from authenticating user r.r 104.248.126.170 p........
------------------------------

Oct 12 22:21:29 localhost sshd\[16876\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.68.226.66  user=root
Oct 12 22:21:32 localhost sshd\[16876\]: Failed password for root from 51.68.226.66 port 46858 ssh2
Oct 12 22:29:53 localhost sshd\[17019\]: Invalid user 123 from 51.68.226.66 port 56096
...

Unauthorized IMAP connection attempt

Hello!

As you may have noticed, I sent you an email from your account.
This means that I have full access to your device.

I've been watching you for a few months now.
The fact is that you were infected with malware through an adult site that you visited.

If you are not familiar with this, I will explain.
Trojan Virus gives me full access and control over a computer or other device.
This means that I can see everything on your screen, turn on the camera and microphone, but you do not know about it.

I also have access to all your contacts and all your correspondence.

Why your antivirus did not detect malware?
Answer: My malware uses the driver, I update its signatures every 4 hours so that your antivirus is silent.

I made a video showing how you satisfy yourself in the left half of the screen, and in the right half you see the video that you watched.
With one click of the mouse, I can send this video to all your emails and contacts on social networks...