Lines containing failures of 183.82.118.131
Oct  6 04:56:02 kopano sshd[27280]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.82.118.131  user=r.r
Oct  6 04:56:04 kopano sshd[27280]: Failed password for r.r from 183.82.118.131 port 38244 ssh2
Oct  6 04:56:04 kopano sshd[27280]: Received disconnect from 183.82.118.131 port 38244:11: Bye Bye [preauth]
Oct  6 04:56:04 kopano sshd[27280]: Disconnected from authenticating user r.r 183.82.118.131 port 38244 [preauth]
Oct  6 05:16:55 kopano sshd[28368]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.82.118.131  user=r.r
Oct  6 05:16:57 kopano sshd[28368]: Failed password for r.r from 183.82.118.131 port 46231 ssh2
Oct  6 05:16:57 kopano sshd[28368]: Received disconnect from 183.82.118.131 port 46231:11: Bye Bye [preauth]
Oct  6 05:16:57 kopano sshd[28368]: Disconnected from authenticating user r.r 183.82.118.131 port 46231 [preauth]
Oct  ........
------------------------------

Oct  9 20:28:20 MK-Soft-VM5 sshd[19479]: Failed password for root from 222.186.175.217 port 61936 ssh2
Oct  9 20:28:24 MK-Soft-VM5 sshd[19479]: Failed password for root from 222.186.175.217 port 61936 ssh2
...

port scans

PHP DIESCAN Information Disclosure Vulnerability

Oct  6 16:16:51 new sshd[16389]: Failed password for r.r from 192.99.151.33 port 56734 ssh2
Oct  6 16:16:51 new sshd[16389]: Received disconnect from 192.99.151.33: 11: Bye Bye [preauth]
Oct  6 16:26:58 new sshd[19018]: Failed password for r.r from 192.99.151.33 port 41630 ssh2
Oct  6 16:26:59 new sshd[19018]: Received disconnect from 192.99.151.33: 11: Bye Bye [preauth]
Oct  6 16:30:56 new sshd[20151]: Failed password for r.r from 192.99.151.33 port 53996 ssh2
Oct  6 16:30:57 new sshd[20151]: Received disconnect from 192.99.151.33: 11: Bye Bye [preauth]
Oct  6 16:34:59 new sshd[21260]: Failed password for r.r from 192.99.151.33 port 38254 ssh2
Oct  6 16:34:59 new sshd[21260]: Received disconnect from 192.99.151.33: 11: Bye Bye [preauth]
Oct  6 16:38:49 new sshd[22032]: Failed password for r.r from 192.99.151.33 port 50614 ssh2
Oct  6 16:38:49 new sshd[22032]: Received disconnect from 192.99.151.33: 11: Bye Bye [preauth]
Oct  6 16:42:51 new sshd[23214]: Failed password ........
-------------------------------

From: Steve [mailto:steve@kwikmat.com] 
Sent: Wednesday, October 9, 2019 11:33
To: *****
Subject: Logo Mat - USA

May I send you our new Logo-Doormats Price-List?

Thank you,
Steve Watson | Sales Manager
Custom-Logo-Mats

Automatic report - XMLRPC Attack

Oct  9 20:18:35 ns381471 sshd[9976]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.228.111.131
Oct  9 20:18:38 ns381471 sshd[9976]: Failed password for invalid user kayla from 221.228.111.131 port 57320 ssh2
Oct  9 20:27:53 ns381471 sshd[10267]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.228.111.131

Oct  9 14:30:38 diego dovecot: imap-login: Disconnected \(auth failed, 1 attempts in 8 secs\): user=\, method=PLAIN, rip=103.89.168.211, lip=172.104.242.163, TLS: Disconnected, session=\<8F/AnHiUV5FnWajT\>

IP Ban Report : https://help-dysk.pl/wordpress-firewall-plugins/ip/14.157.14.39/ 
 CN - 1H : (508)  
 Protection Against DDoS WordPress plugin :  
 "odzyskiwanie danych help-dysk" 
 IP Address Ranges by Country : CN 
 NAME ASN : ASN4134 
 
 IP : 14.157.14.39 
 
 CIDR : 14.156.0.0/14 
 
 PREFIX COUNT : 5430 
 
 UNIQUE IP COUNT : 106919680 
 
 
 WYKRYTE ATAKI Z ASN4134 :  
  1H - 9 
  3H - 30 
  6H - 63 
 12H - 114 
 24H - 215 
 
 DateTime : 2019-10-09 14:12:09 
 
 INFO : Port Scan TELNET Detected and Blocked by ADMIN  - data recovery

Oct  4 07:54:10 keyhelp sshd[29831]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.8.82.188  user=r.r
Oct  4 07:54:11 keyhelp sshd[29831]: Failed password for r.r from 193.8.82.188 port 58812 ssh2
Oct  4 07:54:12 keyhelp sshd[29831]: Received disconnect from 193.8.82.188 port 58812:11: Bye Bye [preauth]
Oct  4 07:54:12 keyhelp sshd[29831]: Disconnected from 193.8.82.188 port 58812 [preauth]
Oct  4 08:05:51 keyhelp sshd[370]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.8.82.188  user=r.r
Oct  4 08:05:54 keyhelp sshd[370]: Failed password for r.r from 193.8.82.188 port 44272 ssh2
Oct  4 08:05:54 keyhelp sshd[370]: Received disconnect from 193.8.82.188 port 44272:11: Bye Bye [preauth]
Oct  4 08:05:54 keyhelp sshd[370]: Disconnected from 193.8.82.188 port 44272 [preauth]
Oct  4 08:10:16 keyhelp sshd[1351]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh r........
-------------------------------

Oct  9 19:34:48 [HOSTNAME] sshd[24694]: User **removed** from 222.186.31.145 not allowed because not listed in AllowUsers
Oct  9 20:18:09 [HOSTNAME] sshd[25013]: User **removed** from 222.186.31.145 not allowed because not listed in AllowUsers
Oct  9 20:34:46 [HOSTNAME] sshd[25074]: User **removed** from 222.186.31.145 not allowed because not listed in AllowUsers
...

Oct  9 19:14:21 vmanager6029 sshd\[25393\]: Invalid user teamspeak from 94.23.218.10 port 40031
Oct  9 19:14:21 vmanager6029 sshd\[25393\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.23.218.10
Oct  9 19:14:23 vmanager6029 sshd\[25393\]: Failed password for invalid user teamspeak from 94.23.218.10 port 40031 ssh2

proto=tcp  .  spt=33835  .  dpt=25  .     (Found on   Dark List de Oct 09)     (698)

SpamReport