Registration form abuse

Aug 25 02:27:16 h2022099 sshd[27054]: Invalid user pi from 78.249.121.44
Aug 25 02:27:16 h2022099 sshd[27054]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=ces34-1-78-249-121-44.fbx.proxad.net 
Aug 25 02:27:16 h2022099 sshd[27056]: Invalid user pi from 78.249.121.44
Aug 25 02:27:16 h2022099 sshd[27056]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=ces34-1-78-249-121-44.fbx.proxad.net 
Aug 25 02:27:18 h2022099 sshd[27054]: Failed password for invalid user pi from 78.249.121.44 port 39822 ssh2
Aug 25 02:27:18 h2022099 sshd[27054]: Connection closed by 78.249.121.44 [preauth]
Aug 25 02:27:18 h2022099 sshd[27056]: Failed password for invalid user pi from 78.249.121.44 port 39830 ssh2
Aug 25 02:27:18 h2022099 sshd[27056]: Connection closed by 78.249.121.44 [preauth]


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=78.249.121.44

(From eric@talkwithwebvisitor.com) Cool website!

My name’s Eric, and I just found your site - bennettchiro.net - while surfing the net. You showed up at the top of the search results, so I checked you out. Looks like what you’re doing is pretty cool.
 
But if you don’t mind me asking – after someone like me stumbles across bennettchiro.net, what usually happens?

Is your site generating leads for your business? 
 
I’m guessing some, but I also bet you’d like more… studies show that 7 out 10 who land on a site wind up leaving without a trace.

Not good.

Here’s a thought – what if there was an easy way for every visitor to “raise their hand” to get a phone call from you INSTANTLY… the second they hit your site and said, “call me now.”

You can –
  
Talk With Web Visitor is a software widget that’s works on your site, ready to capture any visitor’s Name, Email address and Phone Number.  It lets you know IMMEDIATELY – so that you can talk to that lead while they’re literally looking over your si

Automatic report - Port Scan Attack

Attempted Brute Force (dovecot)

Brute force attempt

2020-08-27T05:48:42.937557 X postfix/smtpd[1869932]: NOQUEUE: reject: RCPT from ytw6-982.2.878.0.dclivetracks.com[173.82.104.226]: 554 5.7.1 Service unavailable; Client host [173.82.104.226] blocked using zen.spamhaus.org; https://www.spamhaus.org/sbl/query/SBLCSS; from= to= proto=ESMTP helo=

Dovecot Invalid User Login Attempt.

Automatic report - XMLRPC Attack

2020-08-27 08:24:44 auth_plain authenticator failed for (User) [45.142.120.137]: 535 Incorrect authentication data (set_id=amadeus@lavrinenko.info)
2020-08-27 08:25:27 auth_plain authenticator failed for (User) [45.142.120.137]: 535 Incorrect authentication data (set_id=munchies@lavrinenko.info)
...

2020-08-27 07:29:08 dovecot_login authenticator failed for \(User\) \[45.142.120.74\]: 535 Incorrect authentication data \(set_id=microsoftonline-p@no-server.de\)
2020-08-27 07:29:22 dovecot_login authenticator failed for \(User\) \[45.142.120.74\]: 535 Incorrect authentication data \(set_id=figaro1@no-server.de\)
2020-08-27 07:29:37 dovecot_login authenticator failed for \(User\) \[45.142.120.74\]: 535 Incorrect authentication data \(set_id=figaro1@no-server.de\)
2020-08-27 07:29:40 dovecot_login authenticator failed for \(User\) \[45.142.120.74\]: 535 Incorrect authentication data \(set_id=figaro1@no-server.de\)
2020-08-27 07:29:54 dovecot_login authenticator failed for \(User\) \[45.142.120.74\]: 535 Incorrect authentication data \(set_id=figaro1@no-server.de\)
...

2020-08-26 22:37:37.543009-0500  localhost smtpd[76455]: NOQUEUE: reject: RCPT from unknown[45.228.136.94]: 554 5.7.1 Service unavailable; Client host [45.228.136.94] blocked using zen.spamhaus.org; https://www.spamhaus.org/sbl/query/SBLCSS / https://www.spamhaus.org/query/ip/45.228.136.94; from= to= proto=ESMTP helo=<[45.228.136.94]>

Aug 26 11:40:25 db02 sshd[15196]: Invalid user admin from 75.179.24.86
Aug 26 11:40:25 db02 sshd[15196]: Received disconnect from 75.179.24.86: 11: Bye Bye [preauth]
Aug 26 11:40:26 db02 sshd[15198]: Invalid user admin from 75.179.24.86
Aug 26 11:40:26 db02 sshd[15198]: Received disconnect from 75.179.24.86: 11: Bye Bye [preauth]
Aug 26 11:40:27 db02 sshd[15200]: Invalid user admin from 75.179.24.86
Aug 26 11:40:28 db02 sshd[15200]: Received disconnect from 75.179.24.86: 11: Bye Bye [preauth]


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=75.179.24.86

Invalid user szk from 134.209.149.64 port 37674

Invalid user rustserver from 49.234.67.23 port 60482