Triggered by Fail2Ban at Ares web server

(From eric@talkwithcustomer.com) 
Hi,

Let’s take a quick trip to Tomorrow-land.

I’m not talking about a theme park, I’m talking about your business’s future…

Don’t worry, we won’t even need a crystal ball.  

Just imagine… 

… a future where the money you invest in driving traffic to your site drjeffarnel.com pays off with tons of calls from qualified leads.
 
And the difference between what you experienced in the past is staggering – you’re seeing 10X, 20X, 50X, even up to a 100X more leads coming from your website drjeffarnel.com.  Leads that are already engaged with what you have to offer and are ready to learn more and even open their wallets.

Seeing all this taking place in your business, you think back: What did I do only a short time ago that made such a huge difference?

And then it hits you: You took advantage of a free 14 day Test Drive of TalkWithCustomer.

You installed TalkWithCustomer on drjeffarnel.com – it was a snap.

And practically overnight customers started engagi

Dec 29 09:30:55 mail sshd\[37497\]: Invalid user wwwrun from 103.254.120.222
Dec 29 09:30:55 mail sshd\[37497\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.254.120.222
...

Dec 29 15:53:51 h2177944 sshd\[32695\]: Invalid user bob from 54.37.197.94 port 52042
Dec 29 15:53:51 h2177944 sshd\[32695\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.37.197.94
Dec 29 15:53:53 h2177944 sshd\[32695\]: Failed password for invalid user bob from 54.37.197.94 port 52042 ssh2
Dec 29 15:55:11 h2177944 sshd\[32741\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.37.197.94  user=root
...

$f2bV_matches

Malicious/Probing: /wp-login.php

Dec 29 15:52:38 SilenceServices sshd[5405]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.37.230.164
Dec 29 15:52:40 SilenceServices sshd[5405]: Failed password for invalid user jianqi from 54.37.230.164 port 50888 ssh2
Dec 29 15:55:00 SilenceServices sshd[6098]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.37.230.164

//public_html/wp-login.php

Fail2Ban Ban Triggered

*Port Scan* detected from 159.203.201.23 (US/United States/zg-0911b-41.stretchoid.com). 4 hits in the last 296 seconds

Dec 29 20:25:02 areeb-Workstation sshd[24437]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=59.124.228.54 
Dec 29 20:25:04 areeb-Workstation sshd[24437]: Failed password for invalid user slemer from 59.124.228.54 port 45138 ssh2
...

12/29/2019-07:24:03.385117 159.203.201.39 Protocol: 6 ET DROP Dshield Block Listed Source group 1

Dec 29 15:23:59 sd-53420 sshd\[9938\]: Invalid user ctjgood from 54.38.176.121
Dec 29 15:23:59 sd-53420 sshd\[9938\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.38.176.121
Dec 29 15:24:01 sd-53420 sshd\[9938\]: Failed password for invalid user ctjgood from 54.38.176.121 port 58824 ssh2
Dec 29 15:27:42 sd-53420 sshd\[11439\]: Invalid user ybchae from 54.38.176.121
Dec 29 15:27:42 sd-53420 sshd\[11439\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.38.176.121
...

Dec 29 07:23:54 grey postfix/smtpd\[1445\]: NOQUEUE: reject: RCPT from unknown\[223.242.229.17\]: 554 5.7.1 Service unavailable\; Client host \[223.242.229.17\] blocked using dul.dnsbl.sorbs.net\; Dynamic IP Addresses See: http://www.sorbs.net/lookup.shtml\?223.242.229.17\; from=\ to=\ proto=SMTP helo=\
...

Dec 29 11:26:43 legacy sshd[17837]: Failed password for root from 106.13.87.133 port 37712 ssh2
Dec 29 11:30:28 legacy sshd[17931]: Failed password for root from 106.13.87.133 port 34982 ssh2
Dec 29 11:33:58 legacy sshd[18033]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.87.133
...