firewall-block, port(s): 23/tcp

[Tue Jul 23 16:20:34.190777 2019] [:error] [pid 11523:tid 140230380140288] [client 185.176.222.37:44100] [client 185.176.222.37] ModSecurity: Access denied with code 403 (phase 2). Match of "within %{tx.allowed_methods}" against "REQUEST_METHOD" required. [file "/etc/modsecurity/owasp-modsecurity-crs-3.1.1/rules/REQUEST-911-METHOD-ENFORCEMENT.conf"] [line "46"] [id "911100"] [msg "Method is not allowed by policy"] [data "CONNECT"] [severity "CRITICAL"] [ver "OWASP_CRS/3.1.1"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [tag "OWASP_CRS/POLICY/METHOD_NOT_ALLOWED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A6"] [tag "OWASP_AppSensor/RE1"] [tag "PCI/12.1"] [hostname "www.drom.ru"] [uri "/"] [unique_id "XTbRYg2C4Znz8gBBmLoONwAAAFU"]
...

Jul 23 13:18:37 SilenceServices sshd[4068]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.237.207.106
Jul 23 13:18:39 SilenceServices sshd[4068]: Failed password for invalid user karolina from 46.237.207.106 port 58162 ssh2
Jul 23 13:23:32 SilenceServices sshd[7758]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.237.207.106

SSH Brute Force, server-1 sshd[24426]: Failed password for invalid user oracle from 218.186.178.140 port 39556 ssh2

SS5,WP GET /wp-includes/js/tinymce/plugins/wpdialogs/statistics_menu.php

2019-07-23 04:20:02 H=990794.soborka.net [94.158.151.113]:35648 I=[192.147.25.65]:25 F= rejected RCPT : RBL: found in thrukfz5b56tq6xao6odgdyjrq.zen.dq.spamhaus.net (127.0.0.3, 127.0.0.4) (https://www.spamhaus.org/sbl/query/SBLCSS)
2019-07-23 04:20:02 H=990794.soborka.net [94.158.151.113]:35648 I=[192.147.25.65]:25 F= rejected RCPT : RBL: found in thrukfz5b56tq6xao6odgdyjrq.zen.dq.spamhaus.net (127.0.0.3, 127.0.0.4) (https://www.spamhaus.org/query/ip/94.158.151.113)
2019-07-23 04:20:02 H=990794.soborka.net [94.158.151.113]:35648 I=[192.147.25.65]:25 F= rejected RCPT : RBL: found in thrukfz5b56tq6xao6odgdyjrq.zen.dq.spamhaus.net (127.0.0.3, 127.0.0.4) (https://www.spamhaus.org/query/ip/94.158.151.113)
...

Jul 23 10:44:15 MK-Soft-VM5 sshd\[3792\]: Invalid user hosting from 129.211.52.70 port 51774
Jul 23 10:44:15 MK-Soft-VM5 sshd\[3792\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.211.52.70
Jul 23 10:44:17 MK-Soft-VM5 sshd\[3792\]: Failed password for invalid user hosting from 129.211.52.70 port 51774 ssh2
...

Hit on /wp-login.php

Jul 23 11:13:34 cvbmail sshd\[11378\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.119.212.105  user=root
Jul 23 11:13:36 cvbmail sshd\[11378\]: Failed password for root from 45.119.212.105 port 59804 ssh2
Jul 23 11:20:16 cvbmail sshd\[11403\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.119.212.105  user=root

REQUESTED PAGE: /plus/bookfeedback.php

2019-07-23T10:55:25.018224abusebot-2.cloudsearch.cf sshd\[27979\]: Invalid user julian from 208.58.129.131 port 41624

Jul 23 16:54:52 areeb-Workstation sshd\[28679\]: Invalid user testuser from 51.68.46.156
Jul 23 16:54:52 areeb-Workstation sshd\[28679\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.68.46.156
Jul 23 16:54:54 areeb-Workstation sshd\[28679\]: Failed password for invalid user testuser from 51.68.46.156 port 34906 ssh2
...

firewall-block, port(s): 55555/tcp

Jul 23 13:25:09 minden010 sshd[25868]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.203.73.181
Jul 23 13:25:12 minden010 sshd[25868]: Failed password for invalid user tester from 159.203.73.181 port 58039 ssh2
Jul 23 13:29:32 minden010 sshd[27308]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.203.73.181
...

Bruteforcing port 3389 (Remote Desktop) - Exceed maximum 10 attempts/hour