Feb 13 09:15:19 XXX sshd[8104]: reveeclipse mapping checking getaddrinfo for 187-111-221-83.virt.com.br [187.111.221.83] failed - POSSIBLE BREAK-IN ATTEMPT!
Feb 13 09:15:19 XXX sshd[8104]: User r.r from 187.111.221.83 not allowed because none of user's groups are listed in AllowGroups
Feb 13 09:15:28 XXX sshd[8108]: reveeclipse mapping checking getaddrinfo for 187-111-221-83.virt.com.br [187.111.221.83] failed - POSSIBLE BREAK-IN ATTEMPT!
Feb 13 09:15:28 XXX sshd[8108]: User r.r from 187.111.221.83 not allowed because none of user's groups are listed in AllowGroups
Feb 13 09:15:36 XXX sshd[8111]: reveeclipse mapping checking getaddrinfo for 187-111-221-83.virt.com.br [187.111.221.83] failed - POSSIBLE BREAK-IN ATTEMPT!
Feb 13 09:15:36 XXX sshd[8111]: User r.r from 187.111.221.83 not allowed because none of user's groups are listed in AllowGroups
Feb 13 09:15:37 XXX sshd[8111]: Received disconnect from 187.111.221.83: 11: disconnected by user [preauth]
Feb 13 09:15:44 XX........
-------------------------------

ICMP MH Probe, Scan /Distributed -

Tried sshing with brute force.

[2020-02-13 09:55:45] NOTICE[1148] chan_sip.c: Registration from '' failed for '173.245.202.210:63069' - Wrong password
[2020-02-13 09:55:45] SECURITY[1163] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-02-13T09:55:45.012-0500",Severity="Error",Service="SIP",EventVersion="2",AccountID="17454",SessionID="0x7fd82ca712e8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/173.245.202.210/63069",Challenge="16092da7",ReceivedChallenge="16092da7",ReceivedHash="b2ab3c9c3890b1acedf2be7802d85821"
[2020-02-13 09:56:10] NOTICE[1148] chan_sip.c: Registration from '' failed for '173.245.202.210:64140' - Wrong password
[2020-02-13 09:56:10] SECURITY[1163] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-02-13T09:56:10.518-0500",Severity="Error",Service="SIP",EventVersion="2",AccountID="13750",SessionID="0x7fd82c57aa58",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/173
...

Feb 13 15:32:21 sd-84780 sshd[24423]: Failed password for root from 222.186.190.92 port 45722 ssh2
Feb 13 15:32:24 sd-84780 sshd[24423]: Failed password for root from 222.186.190.92 port 45722 ssh2
Feb 13 15:32:28 sd-84780 sshd[24423]: Failed password for root from 222.186.190.92 port 45722 ssh2
...

ICMP MH Probe, Scan /Distributed -

ICMP MH Probe, Scan /Distributed -

RDP brute forcing (d)

Lines containing failures of 117.213.254.102
Feb 13 10:22:39 shared04 sshd[28380]: Did not receive identification string from 117.213.254.102 port 52071
Feb 13 10:22:43 shared04 sshd[28387]: Invalid user avanthi from 117.213.254.102 port 54033
Feb 13 10:22:43 shared04 sshd[28387]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.213.254.102
Feb 13 10:22:45 shared04 sshd[28387]: Failed password for invalid user avanthi from 117.213.254.102 port 54033 ssh2
Feb 13 10:22:45 shared04 sshd[28387]: Connection closed by invalid user avanthi 117.213.254.102 port 54033 [preauth]


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=117.213.254.102

Website hacking attempt: Wordpress admin access [wp-login.php]

Feb 13 04:36:53 web9 sshd\[16284\]: Invalid user veda from 49.234.216.52
Feb 13 04:36:53 web9 sshd\[16284\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.234.216.52
Feb 13 04:36:55 web9 sshd\[16284\]: Failed password for invalid user veda from 49.234.216.52 port 50098 ssh2
Feb 13 04:40:00 web9 sshd\[16777\]: Invalid user rodge from 49.234.216.52
Feb 13 04:40:00 web9 sshd\[16777\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.234.216.52

Automatic report - Port Scan Attack

Lines containing failures of 182.52.229.178 (max 1000)
Feb 13 15:21:43 Server sshd[27261]: Did not receive identification string from 182.52.229.178 port 50800
Feb 13 15:21:45 Server sshd[27262]: Invalid user system from 182.52.229.178 port 55732
Feb 13 15:21:45 Server sshd[27262]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.52.229.178
Feb 13 15:21:46 Server sshd[27262]: Failed password for invalid user system from 182.52.229.178 port 55732 ssh2
Feb 13 15:21:47 Server sshd[27262]: Connection closed by invalid user system 182.52.229.178 port 55732 [preauth]


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=182.52.229.178

Lines containing failures of 183.81.121.184
Feb 13 10:22:03 shared01 sshd[8583]: Did not receive identification string from 183.81.121.184 port 21993
Feb 13 10:22:03 shared01 sshd[8584]: Did not receive identification string from 183.81.121.184 port 60669
Feb 13 10:22:06 shared01 sshd[8588]: Invalid user sniffer from 183.81.121.184 port 22423
Feb 13 10:22:06 shared01 sshd[8588]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.121.184
Feb 13 10:22:08 shared01 sshd[8590]: Invalid user sniffer from 183.81.121.184 port 62877
Feb 13 10:22:08 shared01 sshd[8588]: Failed password for invalid user sniffer from 183.81.121.184 port 22423 ssh2
Feb 13 10:22:08 shared01 sshd[8590]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.121.184
Feb 13 10:22:08 shared01 sshd[8588]: Connection closed by invalid user sniffer 183.81.121.184 port 22423 [preauth]


........
-----------------------------------------------
https://www.blocklist.

Feb 13 15:43:45 vps647732 sshd[29867]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=137.74.53.155
Feb 13 15:43:48 vps647732 sshd[29867]: Failed password for invalid user admin from 137.74.53.155 port 31753 ssh2
...