WordPress wp-login brute force :: 2607:5300:203:29d:: 0.048 BYPASS [28/Sep/2019:09:17:46  1000] [censored_4] "POST /wp-login.php HTTP/1.1" 200 3989 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"

xmlrpc attack

Oct  4 06:59:31 www sshd\[227114\]: Invalid user Test@2016 from 14.21.7.162
Oct  4 06:59:31 www sshd\[227114\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.21.7.162
Oct  4 06:59:33 www sshd\[227114\]: Failed password for invalid user Test@2016 from 14.21.7.162 port 4724 ssh2
...

Oct  3 18:29:04 hanapaa sshd\[5266\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.51.80.198  user=root
Oct  3 18:29:06 hanapaa sshd\[5266\]: Failed password for root from 106.51.80.198 port 40434 ssh2
Oct  3 18:33:36 hanapaa sshd\[5636\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.51.80.198  user=root
Oct  3 18:33:38 hanapaa sshd\[5636\]: Failed password for root from 106.51.80.198 port 52470 ssh2
Oct  3 18:38:01 hanapaa sshd\[6065\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.51.80.198  user=root

Forbidden directory scan :: 2019/10/04 13:59:13 [error] 14664#14664: *861569 access forbidden by rule, client: 35.247.153.73, server: [censored_4], request: "GET //bak.sql HTTP/1.1", host: "[censored_4]", referrer: "http://[censored_4]:80//bak.sql"

\[2019-10-03 23:59:09\] NOTICE\[1948\] chan_sip.c: Registration from '"379" \' failed for '77.247.108.220:5247' - Wrong password
\[2019-10-03 23:59:09\] SECURITY\[2006\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-10-03T23:59:09.112-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="379",SessionID="0x7f1e1c3b69e8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/77.247.108.220/5247",Challenge="185bed2d",ReceivedChallenge="185bed2d",ReceivedHash="623cf3e0b9e09b5b13179037a49ba3a7"
\[2019-10-03 23:59:09\] NOTICE\[1948\] chan_sip.c: Registration from '"379" \' failed for '77.247.108.220:5247' - Wrong password
\[2019-10-03 23:59:09\] SECURITY\[2006\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-10-03T23:59:09.276-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="379",SessionID="0x7f1e1cb9f6d8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/7

Automated report - ssh fail2ban:
Oct 4 05:54:10 authentication failure 
Oct 4 05:54:12 wrong password, user=Kansas2017, port=50488, ssh2
Oct 4 05:58:35 authentication failure

1,30-01/01 [bc01/m20] concatform PostRequest-Spammer scoring: brussels

2019-10-04T03:50:32.237054shield sshd\[13992\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.142.0  user=root
2019-10-04T03:50:33.951686shield sshd\[13992\]: Failed password for root from 128.199.142.0 port 59152 ssh2
2019-10-04T03:55:03.491313shield sshd\[14497\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.142.0  user=root
2019-10-04T03:55:06.078769shield sshd\[14497\]: Failed password for root from 128.199.142.0 port 43248 ssh2
2019-10-04T03:59:35.885980shield sshd\[15175\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.142.0  user=root

" "

Unauthorised access (Oct  4) SRC=196.188.241.51 LEN=48 TTL=112 ID=1244 DF TCP DPT=445 WINDOW=8192 SYN

Oct  4 05:52:50 h2177944 sshd\[12427\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=41.230.23.169  user=root
Oct  4 05:52:52 h2177944 sshd\[12427\]: Failed password for root from 41.230.23.169 port 43227 ssh2
Oct  4 05:58:49 h2177944 sshd\[12718\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=41.230.23.169  user=root
Oct  4 05:58:51 h2177944 sshd\[12718\]: Failed password for root from 41.230.23.169 port 35506 ssh2
...

port scan and connect, tcp 23 (telnet)

Oct  3 18:13:01 php1 sshd\[370\]: Invalid user P@sswd123!@\# from 106.12.213.162
Oct  3 18:13:01 php1 sshd\[370\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.213.162
Oct  3 18:13:03 php1 sshd\[370\]: Failed password for invalid user P@sswd123!@\# from 106.12.213.162 port 48116 ssh2
Oct  3 18:18:01 php1 sshd\[845\]: Invalid user Qw3rty@123 from 106.12.213.162
Oct  3 18:18:01 php1 sshd\[845\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.213.162

Automatic report - Banned IP Access

Oct  4 04:30:47 web8 sshd\[30863\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.50.249.92  user=root
Oct  4 04:30:49 web8 sshd\[30863\]: Failed password for root from 92.50.249.92 port 50286 ssh2
Oct  4 04:35:05 web8 sshd\[971\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.50.249.92  user=root
Oct  4 04:35:07 web8 sshd\[971\]: Failed password for root from 92.50.249.92 port 33838 ssh2
Oct  4 04:39:07 web8 sshd\[3042\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.50.249.92  user=root

Unauthorised access (Oct  4) SRC=116.104.93.88 LEN=40 TTL=45 ID=9516 TCP DPT=23 WINDOW=64190 SYN