Invalid user turcotte from 151.80.254.75 port 47050

130.61.61.147 - - [19/Nov/2019:07:13:51 +0100] "GET /phpmyadmin/scripts/setup.php HTTP/1.1" 404 226 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0"

(From officefax2019@gmail.com) Greetings! 
 
Al Fajer Investments Private Equity LLC, I want to use this opportunity to invite you to our Project Loan programme. We are Offering Project Funding / Private Bank Loans Programme,Do you have any Lucrative Projects that can generate a good ROI within the period of funding? We offer Loan on 3% interest rate for a Minimum year duration of 3 years to Maximum of 35 years. We focus on Real Estate project, Renewable energy, Telecommunication, Hotel & Resort,Biotech, Textiles,Pharmaceuticals , Oil & Energy Industries, Mining & Metals Industry,Maritime industry, Hospital & Health Care Industry, Consumer Services Industry,Gambling & Casinos Industry, Electrical/Electronic Manufacturing Industry, Chemical industries,Agriculture, Aviation, Retail etc. 
 
Please be advise that we will provide for you the Full details on how to apply for the Loan once we receive your reply. 
 
Regards 
 
Mr.Hamad Ali Hassani 
Al Fajer Investments Private Equity LLC 
 
Email:-  alfaje

Nov 19 04:56:06 firewall sshd[3423]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.133.247
Nov 19 04:56:06 firewall sshd[3423]: Invalid user hendricks from 106.12.133.247
Nov 19 04:56:08 firewall sshd[3423]: Failed password for invalid user hendricks from 106.12.133.247 port 54982 ssh2
...

209.17.96.74 was recorded 14 times by 12 hosts attempting to connect to the following ports: 5907,8081,7547,5908,7443,4786,50070,44818,22,21,2160,5909,8080. Incident counter (4h, 24h, all-time): 14, 35, 564

2019-11-19 00:08:15 H=(126.com) [125.119.32.98]:52404 I=[192.147.25.65]:25 F= rejected RCPT : RBL: found in thrukfz5b56tq6xao6odgdyjrq.zen.dq.spamhaus.net (127.0.0.2, 127.0.0.11, 127.0.0.9, 127.0.0.4) (https://www.spamhaus.org/sbl/query/SBL464478)
2019-11-19 00:20:52 H=(126.com) [125.119.32.98]:52660 I=[192.147.25.65]:25 F= rejected RCPT : RBL: found in thrukfz5b56tq6xao6odgdyjrq.zen.dq.spamhaus.net (127.0.0.2, 127.0.0.9, 127.0.0.4, 127.0.0.11) (https://www.spamhaus.org/query/ip/125.119.32.98)
2019-11-19 00:27:49 H=(126.com) [125.119.32.98]:49550 I=[192.147.25.65]:25 F= rejected RCPT : RBL: found in thrukfz5b56tq6xao6odgdyjrq.zen.dq.spamhaus.net (127.0.0.11, 127.0.0.9, 127.0.0.2, 127.0.0.4) (https://www.spamhaus.org/sbl/query/SBL464478)
...

Nov 18 15:01:54 mx01 sshd[14546]: Invalid user vacation from 160.16.111.215
Nov 18 15:01:57 mx01 sshd[14546]: Failed password for invalid user vacation from 160.16.111.215 port 36223 ssh2
Nov 18 15:01:57 mx01 sshd[14546]: Received disconnect from 160.16.111.215: 11: Bye Bye [preauth]
Nov 18 15:21:27 mx01 sshd[16178]: Invalid user raventhiran from 160.16.111.215
Nov 18 15:21:29 mx01 sshd[16178]: Failed password for invalid user raventhiran from 160.16.111.215 port 38166 ssh2
Nov 18 15:21:30 mx01 sshd[16178]: Received disconnect from 160.16.111.215: 11: Bye Bye [preauth]
Nov 18 15:26:39 mx01 sshd[16772]: Invalid user rokhostnamea from 160.16.111.215
Nov 18 15:26:41 mx01 sshd[16772]: Failed password for invalid user rokhostnamea from 160.16.111.215 port 57556 ssh2
Nov 18 15:26:41 mx01 sshd[16772]: Received disconnect from 160.16.111.215: 11: Bye Bye [preauth]
Nov 18 15:30:33 mx01 sshd[17153]: Invalid user test from 160.16.111.215
Nov 18 15:30:34 mx01 sshd[17153]: Failed pa........
-------------------------------

2019-11-19T06:27:15.118842abusebot-5.cloudsearch.cf sshd\[26043\]: Invalid user rayl from 218.59.129.110 port 44968

$f2bV_matches

Automatic report - Port Scan Attack

IP Ban Report :  
 https://help-dysk.pl/wordpress-firewall-plugins/ip/103.144.146.250/ 
 
 AU - 1H : (39)  
 Protection Against DDoS WordPress plugin :  
 "odzyskiwanie danych help-dysk" 
 IP Address Ranges by Country : AU 
 NAME ASN : ASN0 
 
 IP : 103.144.146.250 
 
 CIDR : 103.144.0.0/12 
 
 PREFIX COUNT : 50243 
 
 UNIQUE IP COUNT : 856105392 
 
 
 ATTACKS DETECTED ASN0 :  
  1H - 2 
  3H - 4 
  6H - 6 
 12H - 8 
 24H - 13 
 
 DateTime : 2019-11-19 07:26:38 
 
 INFO : Server 403 - Looking for resource vulnerabilities Detected and Blocked by ADMIN  - data recovery

Nov 19 07:57:29 mout sshd[29787]: Invalid user floy from 31.17.14.85 port 38892

2019-11-19T08:06:08.200060abusebot-7.cloudsearch.cf sshd\[20849\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.176.113  user=sshd

php WP PHPmyadamin ABUSE blocked for 12h

Autoban   200.148.41.96 AUTH/CONNECT