Automated report - ssh fail2ban:
Aug 7 19:41:57 authentication failure 
Aug 7 19:41:59 wrong password, user=livechat, port=48102, ssh2

Aug  7 19:46:59 server postfix/smtpd[24645]: NOQUEUE: reject: RCPT from unknown[190.147.207.75]: 554 5.7.1 Service unavailable; Client host [190.147.207.75] blocked using zen.spamhaus.org; https://www.spamhaus.org/query/ip/190.147.207.75; from= to= proto=ESMTP helo=

Unauthorised access (Aug  7) SRC=177.47.24.226 LEN=40 TTL=241 ID=44246 TCP DPT=445 WINDOW=1024 SYN

C1,DEF GET /shell?busybox

Aug  7 19:47:32 vps65 sshd\[14101\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.234.154.64  user=root
Aug  7 19:47:34 vps65 sshd\[14101\]: Failed password for root from 62.234.154.64 port 54274 ssh2
...

Aug  7 17:52:04 XXX sshd[1192]: Invalid user comfort from 144.217.86.226 port 37726

Aug  7 19:33:51 server6 sshd[15114]: Bad protocol version identification '' from 14.203.183.7 port 56650
Aug  7 19:33:57 server6 sshd[15116]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14-203-183-7.tpgi.com.au
Aug  7 19:33:59 server6 sshd[15116]: Failed password for invalid user osboxes from 14.203.183.7 port 58548 ssh2
Aug  7 19:34:07 server6 sshd[15255]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14-203-183-7.tpgi.com.au
Aug  7 19:34:09 server6 sshd[15255]: Failed password for invalid user openhabian from 14.203.183.7 port 44296 ssh2
Aug  7 19:34:10 server6 sshd[15255]: Connection closed by 14.203.183.7 [preauth]
Aug  7 19:34:16 server6 sshd[15514]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14-203-183-7.tpgi.com.au
Aug  7 19:34:18 server6 sshd[15514]: Failed password for invalid user nexthink from 14.203.183.7 port 56524 ssh2


........
-------------------------------------

185.70.187.223  


ISP
Hostkey B.V.  

Usage Type
Data Center/Web Hosting/Transit  

Hostname(s)
from.smartana.net 
 

Domain Name
hostkey.com  

Country
 Netherlands  

City
Amsterdam, Noord-Holland

SSH bruteforce

Aug  7 19:51:26 bouncer sshd\[18037\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=77.247.181.162  user=root
Aug  7 19:51:28 bouncer sshd\[18037\]: Failed password for root from 77.247.181.162 port 50468 ssh2
Aug  7 19:51:31 bouncer sshd\[18037\]: Failed password for root from 77.247.181.162 port 50468 ssh2
...

Aug  7 20:37:10 pkdns2 sshd\[55144\]: Invalid user marcia from 49.249.243.235Aug  7 20:37:12 pkdns2 sshd\[55144\]: Failed password for invalid user marcia from 49.249.243.235 port 56782 ssh2Aug  7 20:42:02 pkdns2 sshd\[55335\]: Invalid user jan from 49.249.243.235Aug  7 20:42:04 pkdns2 sshd\[55335\]: Failed password for invalid user jan from 49.249.243.235 port 53733 ssh2Aug  7 20:46:46 pkdns2 sshd\[55524\]: Invalid user www from 49.249.243.235Aug  7 20:46:47 pkdns2 sshd\[55524\]: Failed password for invalid user www from 49.249.243.235 port 50717 ssh2
...

Aug  7 19:30:29 db01 sshd[18809]: reveeclipse mapping checking getaddrinfo for hn.kd.ny.adsl [123.10.66.30] failed - POSSIBLE BREAK-IN ATTEMPT!
Aug  7 19:30:29 db01 sshd[18809]: Invalid user support from 123.10.66.30
Aug  7 19:30:29 db01 sshd[18809]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.10.66.30 
Aug  7 19:30:31 db01 sshd[18809]: Failed password for invalid user support from 123.10.66.30 port 59065 ssh2
Aug  7 19:30:33 db01 sshd[18809]: Failed password for invalid user support from 123.10.66.30 port 59065 ssh2
Aug  7 19:30:35 db01 sshd[18809]: Failed password for invalid user support from 123.10.66.30 port 59065 ssh2
Aug  7 19:30:38 db01 sshd[18809]: Failed password for invalid user support from 123.10.66.30 port 59065 ssh2
Aug  7 19:30:40 db01 sshd[18809]: Failed password for invalid user support from 123.10.66.30 port 59065 ssh2


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=123.10.66.30

Attack on wp-login.php with a forced redirection to a page on the website. Looks like it is attempting to hack in and modify the page. The IP resolves to PSI Net inc BOT that is masquerading as a new search engine. It is linked with Grier Forensics in USA. They may be security testing but they do not have our permission. I will be writing to them about this asap.

08/07/2019-13:47:23.257440 89.248.162.168 Protocol: 6 ET DROP Dshield Block Listed Source group 1

Aug  7 08:31:58 garuda postfix/smtpd[61998]: connect from unknown[122.246.35.197]
Aug  7 08:31:58 garuda postfix/smtpd[61999]: connect from unknown[122.246.35.197]
Aug  7 08:32:02 garuda postfix/smtpd[61999]: warning: unknown[122.246.35.197]: SASL LOGIN authentication failed: authentication failure
Aug  7 08:32:02 garuda postfix/smtpd[61999]: lost connection after AUTH from unknown[122.246.35.197]
Aug  7 08:32:02 garuda postfix/smtpd[61999]: disconnect from unknown[122.246.35.197] ehlo=1 auth=0/1 commands=1/2
Aug  7 08:32:02 garuda postfix/smtpd[61999]: connect from unknown[122.246.35.197]
Aug  7 08:32:05 garuda postfix/smtpd[61999]: warning: unknown[122.246.35.197]: SASL LOGIN authentication failed: authentication failure
Aug  7 08:32:06 garuda postfix/smtpd[61999]: lost connection after AUTH from unknown[122.246.35.197]
Aug  7 08:32:06 garuda postfix/smtpd[61999]: disconnect from unknown[122.246.35.197] ehlo=1 auth=0/1 commands=1/2
Aug  7 08:32:06 garuda postfix/smtpd........
-------------------------------