web-1 [ssh_2] SSH Attack

Nov  4 13:28:04 www sshd[14181]: Address 176.114.14.41 maps to questionbank2017.freedomain.thehost.com.ua, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!
Nov  4 13:28:04 www sshd[14181]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=176.114.14.41  user=r.r
Nov  4 13:28:06 www sshd[14181]: Failed password for r.r from 176.114.14.41 port 41456 ssh2
Nov  4 13:28:06 www sshd[14181]: Received disconnect from 176.114.14.41: 11: Bye Bye [preauth]
Nov  4 13:48:11 www sshd[14503]: Address 176.114.14.41 maps to questionbank2017.freedomain.thehost.com.ua, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!
Nov  4 13:48:11 www sshd[14503]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=176.114.14.41  user=r.r
Nov  4 13:48:13 www sshd[14503]: Failed password for r.r from 176.114.14.41 port 44862 ssh2
Nov  4 13:48:13 www sshd[14503]: Received disconnect from 1........
-------------------------------

Nov  4 22:35:54 php1 sshd\[3147\]: Invalid user zf from 148.70.59.43
Nov  4 22:35:54 php1 sshd\[3147\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.59.43
Nov  4 22:35:56 php1 sshd\[3147\]: Failed password for invalid user zf from 148.70.59.43 port 42364 ssh2
Nov  4 22:41:14 php1 sshd\[3806\]: Invalid user guest from 148.70.59.43
Nov  4 22:41:14 php1 sshd\[3806\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.59.43

Nov  5 13:18:26 server sshd\[10827\]: Invalid user !qazxsw2edc from 212.129.135.221 port 44992
Nov  5 13:18:26 server sshd\[10827\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.129.135.221
Nov  5 13:18:28 server sshd\[10827\]: Failed password for invalid user !qazxsw2edc from 212.129.135.221 port 44992 ssh2
Nov  5 13:23:46 server sshd\[15768\]: Invalid user a from 212.129.135.221 port 34457
Nov  5 13:23:46 server sshd\[15768\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.129.135.221

Nov  5 05:51:26 debian sshd\[32062\]: Invalid user shop1 from 191.232.198.212 port 37072
Nov  5 05:51:26 debian sshd\[32062\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=191.232.198.212
Nov  5 05:51:28 debian sshd\[32062\]: Failed password for invalid user shop1 from 191.232.198.212 port 37072 ssh2
...

RDP brute force attack detected by fail2ban

2019-11-05T03:28:30.379390MailD postfix/smtpd[11680]: NOQUEUE: reject: RCPT from smtp03.inteligo.pl[193.109.225.250]: 554 5.7.1 : Relay access denied; from= to= proto=ESMTP helo=
2019-11-05T07:17:12.457740MailD postfix/smtpd[28381]: NOQUEUE: reject: RCPT from smtp03.inteligo.pl[193.109.225.250]: 554 5.7.1 : Relay access denied; from= to= proto=ESMTP helo=
2019-11-05T07:24:13.255679MailD postfix/smtpd[28952]: NOQUEUE: reject: RCPT from smtp03.inteligo.pl[193.109.225.250]: 554 5.7.1 : Relay access denied; from= to= proto=ESMTP helo=

Nov  5 11:20:46 localhost sshd\[129801\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.166.239.106  user=root
Nov  5 11:20:48 localhost sshd\[129801\]: Failed password for root from 188.166.239.106 port 52794 ssh2
Nov  5 11:25:32 localhost sshd\[129962\]: Invalid user rabe from 188.166.239.106 port 43642
Nov  5 11:25:33 localhost sshd\[129962\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.166.239.106
Nov  5 11:25:34 localhost sshd\[129962\]: Failed password for invalid user rabe from 188.166.239.106 port 43642 ssh2
...

Invalid user ops123 from 106.75.17.245 port 60422
pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.75.17.245
Failed password for invalid user ops123 from 106.75.17.245 port 60422 ssh2
Invalid user zxcasdqwe from 106.75.17.245 port 36280
pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.75.17.245

ssh brute force

Nov  5 10:35:28 MK-Soft-VM5 sshd[5418]: Failed password for root from 59.63.169.50 port 50196 ssh2
...

IP Ban Report :  
 https://help-dysk.pl/wordpress-firewall-plugins/ip/190.207.135.104/ 
 
 VE - 1H : (30)  
 Protection Against DDoS WordPress plugin :  
 "odzyskiwanie danych help-dysk" 
 IP Address Ranges by Country : VE 
 NAME ASN : ASN8048 
 
 IP : 190.207.135.104 
 
 CIDR : 190.207.128.0/19 
 
 PREFIX COUNT : 467 
 
 UNIQUE IP COUNT : 2731520 
 
 
 ATTACKS DETECTED ASN8048 :  
  1H - 3 
  3H - 5 
  6H - 6 
 12H - 13 
 24H - 29 
 
 DateTime : 2019-11-05 07:23:25 
 
 INFO : Port Scan TELNET Detected and Blocked by ADMIN  - data recovery

Honeypot attack, port: 445, PTR: 207-182-158-126.xlhdns.com.

$f2bV_matches

Port 1433 Scan