Oct 10 15:15:34 eventyay sshd[21814]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.236.112.52
Oct 10 15:15:36 eventyay sshd[21814]: Failed password for invalid user 123Crispy from 104.236.112.52 port 45493 ssh2
Oct 10 15:20:00 eventyay sshd[21854]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.236.112.52
...

Oct 10 07:36:25 wbs sshd\[32283\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.232.35.211  user=root
Oct 10 07:36:27 wbs sshd\[32283\]: Failed password for root from 49.232.35.211 port 56088 ssh2
Oct 10 07:40:54 wbs sshd\[32761\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.232.35.211  user=root
Oct 10 07:40:56 wbs sshd\[32761\]: Failed password for root from 49.232.35.211 port 57438 ssh2
Oct 10 07:45:08 wbs sshd\[708\]: Invalid user 123 from 49.232.35.211

Dovecot Brute-Force

2019-10-10T15:44:37.575965abusebot.cloudsearch.cf sshd\[20339\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.ip-164-132-51.eu  user=root

Multiport scan : 36 ports scanned 10 30 40 103 104 264 400 752 1761 2233 2259 2944 3034 5050 5093 6257 6379 6884 6900 8888 9043 10027 11444 13380 20300 33388 33912 33916 38000 39999 42024 49494 50005 50800 58585 63380

Automatic report - Banned IP Access

2019-10-10T17:34:17.423805abusebot-6.cloudsearch.cf sshd\[14618\]: Invalid user 123 from 213.32.91.37 port 37030
2019-10-10T17:34:17.428614abusebot-6.cloudsearch.cf sshd\[14618\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.ip-213-32-91.eu

Wordpress XMLRPC attack

Received: from smtphub10.us.aosmd.com (10.10.10.88) by Nugget.us.aosmd.com
 (172.16.20.10) with Microsoft SMTP Server (TLS) id 14.3.439.0; Thu, 10 Oct
 2019 09:54:37 -0700
Received: from Pickup by smtphub10.us.aosmd.com with Microsoft SMTP Server id
 14.3.439.0; Thu, 10 Oct 2019 16:54:34 +0000
X-GFI-METKTSID: 33f1c7e1-3f10-4eb1-a095-5d0116673e37
X-GFI-METKTSIG: GBRbdzNhBLWj3pl6JwYlSAlZqa7lDYWftvWlRTAy5pwOo/G5WTdUdFt7Rh/ue4wFVaFD3NbmoMVG86ooD0o3FztBsM4rtQaoUKE+4AiB7EVbhwO3WVe83T7gcwsGlVyAbNrGplpIJVt8FF3dXc6kFDNiuOKc6Z8nprm4eZOwSaI=
x-gfi-rh: from 77.49.165.66.dsl.dyn.forthnet.gr (77.49.165.66) by smtphub10.us.aosmd.com (10.10.10.88)
 with Microsoft SMTP Server id 14.3.439.0; Thu, 10 Oct 2019 09:54:33 -0700
Message-ID: 
Date: Thu, 10 Oct 2019 21:54:24 +0200
From: 
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.23) Gecko/20110922 Thunderbird/3.1.15
MIME-Version: 1.0
To: 
Subject: Your account was under attack! Change your access data! - [Detected by **SpamRazer**]
Return-Path: dan.brownlee@us.aosmd.com
X-GFI-SMTP-Submission: 1
X-GFI-SMTP-HelloDomain: 77.49.165.66.dsl.dyn.forthnet.gr
X-GFI-SMTP-RemoteIP: 77.49.165.66
X-GFIME-MASPAM: SPAM
X-GFIME-BLOCK-REASON: Message was found to be spam: (100%) Sender has spammy reputation,
X-GFI-MOVETOJUNK: 1
Old-Message-ID: <5D9F8C70.9060102@us.aosmd.com>
X-MS-Exchange-Organization-AuthSource: smtphub10.us.aosmd.com
X-MS-Exchange-Organization-AuthAs: Anonymous
X-MS-Exchange-Organization-SCL: 9
Content-type: text/plain;
	charset="UTF-8"
Content-transfer-encoding: 7bit


This was an extortion email sent to me from your IP address

Oct 10 19:25:30 localhost sshd\[9330\]: Invalid user Pa\$\$word@2016 from 5.39.67.154 port 36332
Oct 10 19:25:30 localhost sshd\[9330\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.39.67.154
Oct 10 19:25:32 localhost sshd\[9330\]: Failed password for invalid user Pa\$\$word@2016 from 5.39.67.154 port 36332 ssh2

2019-10-10T14:15:33.6681901240 sshd\[21968\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.56.9.5  user=root
2019-10-10T14:15:35.4758281240 sshd\[21968\]: Failed password for root from 58.56.9.5 port 60820 ssh2
2019-10-10T14:20:00.5591731240 sshd\[22150\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.56.9.5  user=root
...

Oct 10 19:08:01 vpn01 sshd[8054]: Failed password for root from 51.75.248.241 port 37446 ssh2
...

Automatic report - Port Scan Attack

2019-10-09 17:40:02 server sshd[67589]: Failed password for invalid user root from 164.132.145.70 port 50510 ssh2

SSH-bruteforce attempts