\[2019-11-06 05:13:44\] SECURITY\[1204\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-11-06T05:13:44.315+0100",Severity="Error",Service="SIP",EventVersion="2",AccountID="701146455378010",SessionID="0x7fe264314c68",LocalAddress="IPV4/UDP/204.8.216.89/5060",RemoteAddress="IPV4/UDP/45.143.220.16/57217",Challenge="3e67c247",ReceivedChallenge="3e67c247",ReceivedHash="0d76744cd2e5c7496eeebf08171b484b"
\[2019-11-06 05:28:31\] SECURITY\[1204\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-11-06T05:28:31.938+0100",Severity="Error",Service="SIP",EventVersion="2",AccountID="+46455378010",SessionID="0x7fe26411ade8",LocalAddress="IPV4/UDP/204.8.216.89/5060",RemoteAddress="IPV4/UDP/45.143.220.16/62995",Challenge="3c4ea60b",ReceivedChallenge="3c4ea60b",ReceivedHash="7e58f902426dd0c305555ddf3f1d0c2f"
\[2019-11-06 08:41:46\] SECURITY\[1204\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-11-06T08:41:46.592+0100",Severity="Error",Service="SIP",
...

(From projobnetwork1@outlook.com) I came across your website and just wanted to reach
out to see if you're hiring? 

If so, I'd like to extend an offer to post to top job sites like
ZipRecruiter, Glassdoor, TopUSAJobs, and more at no cost
for two weeks. 

Here are some of the key benefits: 

-- Post to top job sites with one click 
-- Manage all candidates in one place 
-- No cost for two weeks 

You can post your job openings now by going to our website below: 

>> TryProJob [dot] com 

* Please use offer code 987FREE -- Expires Soon * 

Thanks for your time, 
Ryan C. 

Pro Job Network 
10451 Twin Rivers Rd #279 
Columbia, MD 21044 

To OPT OUT, please email ryanc [at] pjnmail [dot] com
with "REMOVE southernctchiro.com" in the subject line.

[06/Nov/2019:07:25:49 +0100] Web-Request: "GET /wp-login.php", User-Agent: "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
[06/Nov/2019:07:25:55 +0100] Web-Request: "GET /wp-login.php", User-Agent: "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"

Nov  5 07:51:37 mx01 sshd[4581]: Invalid user test from 62.234.145.195
Nov  5 07:51:37 mx01 sshd[4581]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.234.145.195 
Nov  5 07:51:39 mx01 sshd[4581]: Failed password for invalid user test from 62.234.145.195 port 47030 ssh2
Nov  5 07:51:39 mx01 sshd[4581]: Received disconnect from 62.234.145.195: 11: Bye Bye [preauth]
Nov  5 08:01:26 mx01 sshd[5717]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.234.145.195  user=r.r
Nov  5 08:01:28 mx01 sshd[5717]: Failed password for r.r from 62.234.145.195 port 46968 ssh2
Nov  5 08:01:28 mx01 sshd[5717]: Received disconnect from 62.234.145.195: 11: Bye Bye [preauth]
Nov  5 08:07:19 mx01 sshd[6296]: Invalid user io from 62.234.145.195
Nov  5 08:07:19 mx01 sshd[6296]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.234.145.195 
Nov  5 08:07:21 mx01 sshd[6296]:........
-------------------------------

Microsoft Windows Terminal server RDP over non-standard port attempt - 235

Nov  6 09:24:23 meumeu sshd[26258]: Failed password for root from 117.50.50.44 port 56636 ssh2
Nov  6 09:29:16 meumeu sshd[26839]: Failed password for root from 117.50.50.44 port 56768 ssh2
...

CloudCIX Reconnaissance Scan Detected, PTR: ns6126234.ip-51-77-86.eu.

$f2bV_matches

Automatic report - XMLRPC Attack

ET DROP Dshield Block Listed Source group 1 - port: 8089 proto: TCP cat: Misc Attack

Nov  4 14:45:50 twattle sshd[16908]: Received disconnect from 118.213.9=
5.50: 11: Bye Bye [preauth]
Nov  4 14:45:56 twattle sshd[16910]: Received disconnect from 118.213.9=
5.50: 11: Bye Bye [preauth]
Nov  4 14:46:03 twattle sshd[16912]: Received disconnect from 118.213.9=
5.50: 11: Bye Bye [preauth]
Nov  4 14:46:12 twattle sshd[16914]: Received disconnect from 118.213.9=
5.50: 11: Bye Bye [preauth]
Nov  4 14:46:19 twattle sshd[16918]: Received disconnect from 118.213.9=
5.50: 11: Bye Bye [preauth]
Nov  4 14:46:26 twattle sshd[16920]: Received disconnect from 118.213.9=
5.50: 11: Bye Bye [preauth]
Nov  4 14:46:33 twattle sshd[16922]: Received disconnect from 118.213.9=
5.50: 11: Bye Bye [preauth]
Nov  4 14:46:39 twattle sshd[16924]: Invalid user dasusr1 from 118.213.=
95.50
Nov  4 14:46:40 twattle sshd[16924]: Received disconnect from 118.213.9=
5.50: 11: Bye Bye [preauth]
Nov  4 14:46:48 twattle sshd[16926]: Invalid user dasusr1 from 118.213.=
95.50
Nov  4 14:46:48 tw........
-------------------------------

Nov  6 10:02:06 dev0-dcde-rnet sshd[16335]: Failed password for root from 106.13.63.134 port 48242 ssh2
Nov  6 10:06:38 dev0-dcde-rnet sshd[16350]: Failed password for root from 106.13.63.134 port 55488 ssh2
Nov  6 10:10:58 dev0-dcde-rnet sshd[16357]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.63.134

CloudCIX Reconnaissance Scan Detected, PTR: PTR record not found

Nov  6 09:58:51 cvbnet sshd[12175]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.228.3.191 
Nov  6 09:58:54 cvbnet sshd[12175]: Failed password for invalid user nguy from 194.228.3.191 port 42895 ssh2
...

CloudCIX Reconnaissance Scan Detected, PTR: host167-2-61-217.static.arubacloud.de.