[Thu Oct 08 11:15:08.616869 2020] [:error] [pid 986:tid 140536564381440] [client 185.191.171.3:55392] [client 185.191.171.3] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "SemrushBot" at REQUEST_HEADERS:User-Agent. [file "/etc/modsecurity/coreruleset-3.3.0/rules/REQUEST-913-SCANNER-DETECTION.conf"] [line "181"] [id "913102"] [msg "Found User-Agent associated with web crawler/bot"] [data "Matched Data: SemrushBot found within REQUEST_HEADERS:User-Agent: mozilla/5.0 (compatible; semrushbot/6~bl; +http://www.semrush.com/bot.html)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-crawler"] [tag "OWASP_CRS"] [tag "capec/1000/118/224/541/310"] [tag "PCI/6.5.10"] [tag "paranoia-level/2"] [hostname "karangploso.jatim.bmkg.go.id"] [uri "/index.php/buku/492-buku-edisi-setiap-1-bulan-sekali/buku-analisis-dan-prakiraan-bulanan-jawa-timur/buku-analisis-dan-prakiraan-bulanan-jawa-timur-
...

Lines containing failures of 154.85.51.137
Oct  5 15:03:17 shared07 sshd[26577]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=154.85.51.137  user=r.r
Oct  5 15:03:19 shared07 sshd[26577]: Failed password for r.r from 154.85.51.137 port 50834 ssh2
Oct  5 15:03:20 shared07 sshd[26577]: Received disconnect from 154.85.51.137 port 50834:11: Bye Bye [preauth]
Oct  5 15:03:20 shared07 sshd[26577]: Disconnected from authenticating user r.r 154.85.51.137 port 50834 [preauth]
Oct  5 15:20:02 shared07 sshd[32273]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=154.85.51.137  user=r.r
Oct  5 15:20:04 shared07 sshd[32273]: Failed password for r.r from 154.85.51.137 port 46868 ssh2
Oct  5 15:20:04 shared07 sshd[32273]: Received disconnect from 154.85.51.137 port 46868:11: Bye Bye [preauth]
Oct  5 15:20:04 shared07 sshd[32273]: Disconnected from authenticating user r.r 154.85.51.137 port 46868 [preauth........
------------------------------

Oct  8 11:20:49 v22019058497090703 postfix/smtpd[1946]: warning: unknown[45.142.120.15]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Oct  8 11:20:55 v22019058497090703 postfix/smtpd[1958]: warning: unknown[45.142.120.15]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Oct  8 11:20:56 v22019058497090703 postfix/smtpd[1951]: warning: unknown[45.142.120.15]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
...

Oct  8 05:41:52 *** sshd[32046]: User root from 89.179.247.249 not allowed because not listed in AllowUsers

(sshd) Failed SSH login from 2.57.122.186 (RO/Romania/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Oct  8 05:04:28 optimus sshd[11041]: Did not receive identification string from 2.57.122.186
Oct  8 05:05:06 optimus sshd[11194]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.57.122.186  user=root
Oct  8 05:05:08 optimus sshd[11194]: Failed password for root from 2.57.122.186 port 55220 ssh2
Oct  8 05:05:40 optimus sshd[11343]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.57.122.186  user=root
Oct  8 05:05:42 optimus sshd[11343]: Failed password for root from 2.57.122.186 port 52626 ssh2

Unauthorised connection attempt detected at AUO NODE 4. System is sshd. Protected by AUO Stack Web Application Firewall (WAF)

Oct  8 10:50:30 galaxy event: galaxy/lswi: smtp: alexine@uni-potsdam.de [212.70.149.5] authentication failure using internet password
Oct  8 10:50:51 galaxy event: galaxy/lswi: smtp: alexis@uni-potsdam.de [212.70.149.5] authentication failure using internet password
Oct  8 10:51:12 galaxy event: galaxy/lswi: smtp: alexus@uni-potsdam.de [212.70.149.5] authentication failure using internet password
Oct  8 10:51:33 galaxy event: galaxy/lswi: smtp: alf@uni-potsdam.de [212.70.149.5] authentication failure using internet password
Oct  8 10:51:54 galaxy event: galaxy/lswi: smtp: alfi@uni-potsdam.de [212.70.149.5] authentication failure using internet password
...

fail2ban

Oct  7 23:10:11 vm0 sshd[32059]: Failed password for root from 101.36.160.91 port 32774 ssh2
...

C1,WP GET /wp-login.php

Oct  8 01:04:18 sticky sshd\[11208\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.218.3.2  user=root
Oct  8 01:04:20 sticky sshd\[11208\]: Failed password for root from 103.218.3.2 port 60158 ssh2
Oct  8 01:08:05 sticky sshd\[11236\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.218.3.2  user=root
Oct  8 01:08:07 sticky sshd\[11236\]: Failed password for root from 103.218.3.2 port 38002 ssh2
Oct  8 01:11:58 sticky sshd\[11317\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.218.3.2  user=root

[2020-10-08 04:11:48] NOTICE[1182] chan_sip.c: Registration from '' failed for '148.72.158.192:58355' - Wrong password
[2020-10-08 04:11:48] SECURITY[1204] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-10-08T04:11:48.450-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="2000000",SessionID="0x7f22f8572958",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/148.72.158.192/58355",Challenge="7ba74d30",ReceivedChallenge="7ba74d30",ReceivedHash="48c949f61c9d64cd98c26241f3e4eee7"
[2020-10-08 04:12:42] NOTICE[1182] chan_sip.c: Registration from '' failed for '148.72.158.192:56110' - Wrong password
...

Oct  8 04:47:05 firewall sshd[17042]: Failed password for root from 165.22.206.182 port 35720 ssh2
Oct  8 04:50:30 firewall sshd[17144]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.206.182  user=root
Oct  8 04:50:32 firewall sshd[17144]: Failed password for root from 165.22.206.182 port 41774 ssh2
...

2020-10-08T04:38:00.787232devel sshd[11462]: Failed password for root from 104.248.165.138 port 59648 ssh2
2020-10-08T04:38:24.234947devel sshd[11531]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.165.138  user=root
2020-10-08T04:38:25.835949devel sshd[11531]: Failed password for root from 104.248.165.138 port 60070 ssh2

Oct  8 00:18:33 srv01 postfix/smtpd\[24324\]: warning: unknown\[183.155.199.114\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Oct  8 00:18:45 srv01 postfix/smtpd\[24324\]: warning: unknown\[183.155.199.114\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Oct  8 00:19:01 srv01 postfix/smtpd\[24324\]: warning: unknown\[183.155.199.114\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Oct  8 00:19:20 srv01 postfix/smtpd\[24324\]: warning: unknown\[183.155.199.114\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Oct  8 00:19:32 srv01 postfix/smtpd\[24324\]: warning: unknown\[183.155.199.114\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
...