Unauthorised access (Nov 20) SRC=92.118.37.91 LEN=40 TTL=73 ID=11300 DF TCP DPT=23 WINDOW=29200 SYN 
Unauthorised access (Nov 19) SRC=92.118.37.91 LEN=40 TTL=86 ID=57572 DF TCP DPT=21 WINDOW=29200 SYN 
Unauthorised access (Nov 19) SRC=92.118.37.91 LEN=40 TTL=86 ID=49515 DF TCP DPT=23 WINDOW=29200 SYN 
Unauthorised access (Nov 19) SRC=92.118.37.91 LEN=40 TTL=61 ID=12129 DF TCP DPT=21 WINDOW=29200 SYN 
Unauthorised access (Nov 19) SRC=92.118.37.91 LEN=40 TTL=78 ID=51623 DF TCP DPT=21 WINDOW=29200 SYN 
Unauthorised access (Nov 18) SRC=92.118.37.91 LEN=40 TTL=61 ID=45830 DF TCP DPT=21 WINDOW=29200 SYN 
Unauthorised access (Nov 17) SRC=92.118.37.91 LEN=40 TTL=249 ID=54321 TCP DPT=21 WINDOW=65535 SYN

\[2019-11-19 17:03:21\] NOTICE\[2601\] chan_sip.c: Registration from '"3229" \' failed for '37.49.230.14:5063' - Wrong password
\[2019-11-19 17:03:21\] SECURITY\[2634\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-11-19T17:03:21.505-0500",Severity="Error",Service="SIP",EventVersion="2",AccountID="3229",SessionID="0x7fdf2c17b738",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.230.14/5063",Challenge="7007c956",ReceivedChallenge="7007c956",ReceivedHash="6f87d4c53b37042ca3ad1be3599ad4ca"
\[2019-11-19 17:05:42\] NOTICE\[2601\] chan_sip.c: Registration from '"235" \' failed for '37.49.230.14:5258' - Wrong password
\[2019-11-19 17:05:42\] SECURITY\[2634\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-11-19T17:05:42.579-0500",Severity="Error",Service="SIP",EventVersion="2",AccountID="235",SessionID="0x7fdf2c13bc28",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.4

Port scan: Attack repeated for 24 hours

Automatic report - Port Scan Attack

2019-11-19T23:22:07.483086+01:00 lumpi kernel: [4024495.642522] INPUT:DROP:SPAMHAUS_EDROP:IN=eth0 OUT= MAC=52:54:a2:01:a5:04:d2:74:7f:6e:37:e3:08:00 SRC=81.22.45.104 DST=172.31.1.100 LEN=40 TOS=0x00 PREC=0x00 TTL=243 ID=60621 PROTO=TCP SPT=50387 DPT=3389 WINDOW=1024 RES=0x00 SYN URGP=0 
...

Nov 19 11:09:26 wbs sshd\[16420\]: Invalid user mehaque from 145.239.198.218
Nov 19 11:09:26 wbs sshd\[16420\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.ip-145-239-198.eu
Nov 19 11:09:28 wbs sshd\[16420\]: Failed password for invalid user mehaque from 145.239.198.218 port 33910 ssh2
Nov 19 11:12:56 wbs sshd\[16740\]: Invalid user Pa\$s1 from 145.239.198.218
Nov 19 11:12:56 wbs sshd\[16740\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.ip-145-239-198.eu

Nov 19 23:10:13 nextcloud sshd\[8910\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.125.60.208  user=root
Nov 19 23:10:15 nextcloud sshd\[8910\]: Failed password for root from 113.125.60.208 port 47306 ssh2
Nov 19 23:20:33 nextcloud sshd\[23341\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.125.60.208  user=root
...

63.88.23.245 was recorded 15 times by 9 hosts attempting to connect to the following ports: 80. Incident counter (4h, 24h, all-time): 15, 90, 334

11/19/2019-16:13:39.731340 67.217.157.3 Protocol: 6 ET SCAN Suspicious inbound to MSSQL port 1433

Nov 19 22:56:18 minden010 sshd[13578]: Failed password for root from 222.186.175.220 port 16772 ssh2
Nov 19 22:56:31 minden010 sshd[13578]: Failed password for root from 222.186.175.220 port 16772 ssh2
Nov 19 22:56:31 minden010 sshd[13578]: error: maximum authentication attempts exceeded for root from 222.186.175.220 port 16772 ssh2 [preauth]
...

loopsrockreggae.com 178.62.95.188 \[19/Nov/2019:22:13:00 +0100\] "POST /wp-login.php HTTP/1.1" 200 6312 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"
loopsrockreggae.com 178.62.95.188 \[19/Nov/2019:22:13:00 +0100\] "POST /wp-login.php HTTP/1.1" 200 6283 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"
loopsrockreggae.com 178.62.95.188 \[19/Nov/2019:22:13:01 +0100\] "POST /xmlrpc.php HTTP/1.1" 200 4105 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"

Nov 19 23:11:00 markkoudstaal sshd[12303]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=145.239.10.217
Nov 19 23:11:03 markkoudstaal sshd[12303]: Failed password for invalid user nordeen from 145.239.10.217 port 45142 ssh2
Nov 19 23:14:26 markkoudstaal sshd[12577]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=145.239.10.217

(From projobnetwork2@outlook.com) I came across your website (https://www.highlandfamilycare.com/page/contact.html) and just wanted to reach
out to see if you're hiring? 

If so, I'd like to extend an offer to post to top job sites like
ZipRecruiter, Glassdoor, TopUSAJobs, and more at no cost
for two weeks. 

Here are some of the key benefits: 

-- Post to top job sites with one click 
-- Manage all candidates in one place 
-- No cost for two weeks 

You can post your job openings now by going to our website below: 

>> http://www.TryProJob.com

* Please use offer code 987FREE -- Expires Soon * 

Thanks for your time, 
Ryan C. 

Pro Job Network 
10451 Twin Rivers Rd #279 
Columbia, MD 21044 

To OPT OUT, please email ryanc [at] pjnmail [dot] com
with "REMOVE highlandfamilycare.com" in the subject line.

11/19/2019-23:07:37.580355 185.176.27.6 Protocol: 6 ET DROP Dshield Block Listed Source group 1

Connection by 196.52.43.115 on port: 5910 got caught by honeypot at 11/19/2019 8:13:31 PM