Jun 16 05:05:27 mail.srvfarm.net postfix/smtps/smtpd[914306]: lost connection after CONNECT from unknown[41.139.11.115]
Jun 16 05:08:23 mail.srvfarm.net postfix/smtps/smtpd[935138]: lost connection after CONNECT from unknown[41.139.11.115]
Jun 16 05:11:32 mail.srvfarm.net postfix/smtpd[935207]: warning: unknown[41.139.11.115]: SASL PLAIN authentication failed: 
Jun 16 05:11:32 mail.srvfarm.net postfix/smtpd[935207]: lost connection after AUTH from unknown[41.139.11.115]
Jun 16 05:12:00 mail.srvfarm.net postfix/smtps/smtpd[938181]: lost connection after CONNECT from unknown[41.139.11.115]

Oct  8 16:33:59 mail.srvfarm.net postfix/smtps/smtpd[3748181]: warning: unknown[41.139.11.150]: SASL PLAIN authentication failed: 
Oct  8 16:33:59 mail.srvfarm.net postfix/smtps/smtpd[3748181]: lost connection after AUTH from unknown[41.139.11.150]
Oct  8 16:36:34 mail.srvfarm.net postfix/smtps/smtpd[3750954]: warning: unknown[41.139.11.150]: SASL PLAIN authentication failed: 
Oct  8 16:36:34 mail.srvfarm.net postfix/smtps/smtpd[3750954]: lost connection after AUTH from unknown[41.139.11.150]
Oct  8 16:41:40 mail.srvfarm.net postfix/smtps/smtpd[3751242]: warning: unknown[41.139.11.150]: SASL PLAIN authentication failed:

Autoban   41.139.11.150 AUTH/CONNECT

Sep 17 12:53:03 mail.srvfarm.net postfix/smtpd[18902]: warning: unknown[41.139.11.128]: SASL PLAIN authentication failed: 
Sep 17 12:53:03 mail.srvfarm.net postfix/smtpd[18902]: lost connection after AUTH from unknown[41.139.11.128]
Sep 17 12:56:00 mail.srvfarm.net postfix/smtps/smtpd[19071]: warning: unknown[41.139.11.128]: SASL PLAIN authentication failed: 
Sep 17 12:56:00 mail.srvfarm.net postfix/smtps/smtpd[19071]: lost connection after AUTH from unknown[41.139.11.128]
Sep 17 13:01:26 mail.srvfarm.net postfix/smtpd[18571]: warning: unknown[41.139.11.128]: SASL PLAIN authentication failed:

Sep 16 18:48:08 mail.srvfarm.net postfix/smtpd[3603171]: warning: unknown[41.139.11.145]: SASL PLAIN authentication failed: 
Sep 16 18:48:08 mail.srvfarm.net postfix/smtpd[3603171]: lost connection after AUTH from unknown[41.139.11.145]
Sep 16 18:49:15 mail.srvfarm.net postfix/smtpd[3602401]: warning: unknown[41.139.11.145]: SASL PLAIN authentication failed: 
Sep 16 18:49:15 mail.srvfarm.net postfix/smtpd[3602401]: lost connection after AUTH from unknown[41.139.11.145]
Sep 16 18:54:06 mail.srvfarm.net postfix/smtps/smtpd[3607473]: warning: unknown[41.139.11.145]: SASL PLAIN authentication failed:

Sep 16 18:29:59 mail.srvfarm.net postfix/smtpd[3602399]: warning: unknown[41.139.11.128]: SASL PLAIN authentication failed: 
Sep 16 18:29:59 mail.srvfarm.net postfix/smtpd[3602399]: lost connection after AUTH from unknown[41.139.11.128]
Sep 16 18:30:16 mail.srvfarm.net postfix/smtpd[3601766]: warning: unknown[41.139.11.128]: SASL PLAIN authentication failed: 
Sep 16 18:30:16 mail.srvfarm.net postfix/smtpd[3601766]: lost connection after AUTH from unknown[41.139.11.128]
Sep 16 18:35:17 mail.srvfarm.net postfix/smtps/smtpd[3601498]: warning: unknown[41.139.11.128]: SASL PLAIN authentication failed:

Sep 16 18:48:08 mail.srvfarm.net postfix/smtpd[3603171]: warning: unknown[41.139.11.145]: SASL PLAIN authentication failed: 
Sep 16 18:48:08 mail.srvfarm.net postfix/smtpd[3603171]: lost connection after AUTH from unknown[41.139.11.145]
Sep 16 18:49:15 mail.srvfarm.net postfix/smtpd[3602401]: warning: unknown[41.139.11.145]: SASL PLAIN authentication failed: 
Sep 16 18:49:15 mail.srvfarm.net postfix/smtpd[3602401]: lost connection after AUTH from unknown[41.139.11.145]
Sep 16 18:54:06 mail.srvfarm.net postfix/smtps/smtpd[3607473]: warning: unknown[41.139.11.145]: SASL PLAIN authentication failed:

Aug 16 05:19:37 mail.srvfarm.net postfix/smtpd[1888825]: warning: unknown[41.139.11.61]: SASL PLAIN authentication failed: 
Aug 16 05:19:37 mail.srvfarm.net postfix/smtpd[1888825]: lost connection after AUTH from unknown[41.139.11.61]
Aug 16 05:26:25 mail.srvfarm.net postfix/smtpd[1875198]: warning: unknown[41.139.11.61]: SASL PLAIN authentication failed: 
Aug 16 05:26:25 mail.srvfarm.net postfix/smtpd[1875198]: lost connection after AUTH from unknown[41.139.11.61]
Aug 16 05:27:18 mail.srvfarm.net postfix/smtps/smtpd[1888818]: warning: unknown[41.139.11.61]: SASL PLAIN authentication failed:

Aug 15 00:27:23 mail.srvfarm.net postfix/smtpd[907544]: warning: unknown[41.139.11.159]: SASL PLAIN authentication failed: 
Aug 15 00:27:23 mail.srvfarm.net postfix/smtpd[907544]: lost connection after AUTH from unknown[41.139.11.159]
Aug 15 00:34:27 mail.srvfarm.net postfix/smtps/smtpd[908453]: warning: unknown[41.139.11.159]: SASL PLAIN authentication failed: 
Aug 15 00:34:27 mail.srvfarm.net postfix/smtps/smtpd[908453]: lost connection after AUTH from unknown[41.139.11.159]
Aug 15 00:37:03 mail.srvfarm.net postfix/smtpd[908819]: warning: unknown[41.139.11.159]: SASL PLAIN authentication failed:

Jun 16 05:01:34 mail.srvfarm.net postfix/smtps/smtpd[916122]: warning: unknown[41.139.11.35]: SASL PLAIN authentication failed: 
Jun 16 05:01:34 mail.srvfarm.net postfix/smtps/smtpd[916122]: lost connection after AUTH from unknown[41.139.11.35]
Jun 16 05:04:42 mail.srvfarm.net postfix/smtps/smtpd[913342]: warning: unknown[41.139.11.35]: SASL PLAIN authentication failed: 
Jun 16 05:04:42 mail.srvfarm.net postfix/smtps/smtpd[913342]: lost connection after AUTH from unknown[41.139.11.35]
Jun 16 05:08:20 mail.srvfarm.net postfix/smtps/smtpd[916121]: lost connection after CONNECT from unknown[41.139.11.35]

Jun 16 05:25:33 mail.srvfarm.net postfix/smtpd[921341]: warning: unknown[41.139.11.160]: SASL PLAIN authentication failed: 
Jun 16 05:25:33 mail.srvfarm.net postfix/smtpd[921341]: lost connection after AUTH from unknown[41.139.11.160]
Jun 16 05:30:56 mail.srvfarm.net postfix/smtps/smtpd[937456]: warning: unknown[41.139.11.160]: SASL PLAIN authentication failed: 
Jun 16 05:30:56 mail.srvfarm.net postfix/smtps/smtpd[937456]: lost connection after AUTH from unknown[41.139.11.160]
Jun 16 05:34:51 mail.srvfarm.net postfix/smtpd[935205]: warning: unknown[41.139.11.160]: SASL PLAIN authentication failed:

Aug  2 21:16:01 fv15 sshd[19510]: Failed password for invalid user toshi from 180.159.3.46 port 54716 ssh2
Aug  2 21:16:01 fv15 sshd[19510]: Received disconnect from 180.159.3.46: 11: Bye Bye [preauth]
Aug  2 21:52:03 fv15 sshd[7669]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.159.3.46  user=r.r
Aug  2 21:52:05 fv15 sshd[7669]: Failed password for r.r from 180.159.3.46 port 41518 ssh2
Aug  2 21:52:05 fv15 sshd[7669]: Received disconnect from 180.159.3.46: 11: Bye Bye [preauth]
Aug  2 21:57:39 fv15 sshd[16899]: Failed password for invalid user usuario from 180.159.3.46 port 53878 ssh2
Aug  2 21:57:39 fv15 sshd[16899]: Received disconnect from 180.159.3.46: 11: Bye Bye [preauth]
Aug  2 22:01:39 fv15 sshd[1170]: Failed password for invalid user gus from 180.159.3.46 port 37958 ssh2
Aug  2 22:01:39 fv15 sshd[1170]: Received disconnect from 180.159.3.46: 11: Bye Bye [preauth]
Aug  2 22:05:30 fv15 sshd[1500]: Failed password fo........
-------------------------------

$f2bV_matches

Aug  3 01:47:00 TORMINT sshd\[2697\]: Invalid user zonaWifi from 139.227.218.198
Aug  3 01:47:00 TORMINT sshd\[2697\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.227.218.198
Aug  3 01:47:01 TORMINT sshd\[2697\]: Failed password for invalid user zonaWifi from 139.227.218.198 port 56580 ssh2
...

Aug  3 07:41:50 ncomp sshd[31207]: Invalid user web from 123.231.61.180
Aug  3 07:41:50 ncomp sshd[31207]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.231.61.180
Aug  3 07:41:50 ncomp sshd[31207]: Invalid user web from 123.231.61.180
Aug  3 07:41:53 ncomp sshd[31207]: Failed password for invalid user web from 123.231.61.180 port 21585 ssh2

20 attempts against mh-misbehave-ban on pluto.magehost.pro

WordPress login Brute force / Web App Attack on client site.

\[2019-08-03 02:12:06\] NOTICE\[2288\] chan_sip.c: Registration from '\' failed for '5.62.41.134:12332' - Wrong password
\[2019-08-03 02:12:06\] SECURITY\[2326\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-08-03T02:12:06.012-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="29188",SessionID="0x7ff4d07952f8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/5.62.41.134/60558",Challenge="6d27ca27",ReceivedChallenge="6d27ca27",ReceivedHash="dc5ac1545e5c8ce1a0731d1d4cd9b34b"
\[2019-08-03 02:12:55\] NOTICE\[2288\] chan_sip.c: Registration from '\' failed for '5.62.41.134:12337' - Wrong password
\[2019-08-03 02:12:55\] SECURITY\[2326\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-08-03T02:12:55.523-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="47914",SessionID="0x7ff4d05ad438",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/5.62.41.134

Aug  3 06:52:34 ns3367391 sshd\[28204\]: Invalid user zhong from 220.134.154.230 port 55482
Aug  3 06:52:35 ns3367391 sshd\[28204\]: Failed password for invalid user zhong from 220.134.154.230 port 55482 ssh2
...

2019-08-03T05:17:44.057184abusebot-7.cloudsearch.cf sshd\[14511\]: Invalid user corinna from 141.154.52.87 port 57808

Aug  3 08:07:20 MainVPS sshd[21089]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.163.116  user=root
Aug  3 08:07:23 MainVPS sshd[21089]: Failed password for root from 175.126.163.116 port 59382 ssh2
Aug  3 08:07:25 MainVPS sshd[21095]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.163.116  user=root
Aug  3 08:07:27 MainVPS sshd[21095]: Failed password for root from 175.126.163.116 port 60659 ssh2
Aug  3 08:07:29 MainVPS sshd[21110]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.163.116  user=root
Aug  3 08:07:31 MainVPS sshd[21110]: Failed password for root from 175.126.163.116 port 61821 ssh2
...

Aug  3 08:14:30 lnxded63 sshd[25760]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.99.176.168

[portscan] Port scan

Aug  3 08:54:44 srv-4 sshd\[20215\]: Invalid user toi from 45.117.83.118
Aug  3 08:54:44 srv-4 sshd\[20215\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.117.83.118
Aug  3 08:54:46 srv-4 sshd\[20215\]: Failed password for invalid user toi from 45.117.83.118 port 59232 ssh2
...

Aug  3 07:21:02 debian sshd\[8205\]: Invalid user sony from 218.69.91.84 port 33056
Aug  3 07:21:02 debian sshd\[8205\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.69.91.84
...

WordPress wp-login brute force :: 2a03:b0c0:1:d0::c1b:2001 0.048 BYPASS [03/Aug/2019:14:51:25  1000] [censored_2] "POST /wp-login.php HTTP/1.1" 200 4630 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"