\[2019-07-27 06:34:58\] NOTICE\[2288\] chan_sip.c: Registration from '\' failed for '5.62.41.159:3293' - Wrong password
\[2019-07-27 06:34:58\] SECURITY\[2326\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-07-27T06:34:58.702-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="9445",SessionID="0x7ff4d0447758",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/5.62.41.159/57664",Challenge="0fb95816",ReceivedChallenge="0fb95816",ReceivedHash="20f78f3d2b92218726f44c7beee54fe4"
\[2019-07-27 06:35:34\] NOTICE\[2288\] chan_sip.c: Registration from '\' failed for '5.62.41.159:3331' - Wrong password
\[2019-07-27 06:35:34\] SECURITY\[2326\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-07-27T06:35:34.883-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="1629",SessionID="0x7ff4d00a7228",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/5.62.41.159/55326

Port probing on unauthorized port 445

abuseConfidenceScore blocked for 12h

abuseConfidenceScore blocked for 12h

abuseConfidenceScore blocked for 12h

abuseConfidenceScore blocked for 12h

Wordpress malicious attack:[octablocked]

Time:     Mon Jun  8 06:05:39 2020 -0300
IP:       5.62.41.135 (DE/Germany/r-135-41-62-5.consumer-pool.prcdn.net)
Failures: 20 (WordPressBruteForcePOST)
Interval: 3600 seconds
Blocked:  Permanent Block

abuseConfidenceScore blocked for 12h

[munged]::80 5.62.41.135 - - [06/Jun/2020:14:29:10 +0200] "POST /[munged]: HTTP/1.1" 200 5565 "http://[munged]:/[munged]:" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36"
[munged]::80 5.62.41.135 - - [06/Jun/2020:14:29:11 +0200] "POST /[munged]: HTTP/1.1" 200 5564 "http://[munged]:/[munged]:" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36"
[munged]::80 5.62.41.135 - - [06/Jun/2020:14:29:11 +0200] "POST /[munged]: HTTP/1.1" 200 5564 "http://[munged]:/[munged]:" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36"
[munged]::80 5.62.41.135 - - [06/Jun/2020:14:29:11 +0200] "POST /[munged]: HTTP/1.1" 200 5564 "http://[munged]:/[munged]:" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36"
[munged]::80 5.62.41.135 - - [06/Jun/2020:14:29:11 +0200] "P

[2020-06-03 00:03:34] Exploit probing - /wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php

(From jasmin.fraire@googlemail.com) Want zero cost advertising for your website? Check out: http://www.submityourfreeads.xyz

[TueJan0722:16:06.0732602020][:error][pid19610:tid47836490135296][client5.62.41.148:15174][client5.62.41.148]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch"python-requests/"atREQUEST_HEADERS:User-Agent.[file"/etc/apache2/conf.d/modsec_rules/20_asl_useragents.conf"][line"218"][id"332039"][rev"4"][msg"Atomicorp.comWAFRules:SuspiciousUnusualUserAgent\(python-requests\).Disablethisruleifyouusepython-requests/."][severity"CRITICAL"][hostname"bbverdemare.com"][uri"/wp-content/uploads/upload_index.php"][unique_id"XhT1FmzE5ruDsFs0f8xKgQAAAE0"][TueJan0722:17:08.3627952020][:error][pid19610:tid47836502742784][client5.62.41.148:15033][client5.62.41.148]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch"python-requests/"atREQUEST_HEADERS:User-Agent.[file"/etc/apache2/conf.d/modsec_rules/20_asl_useragents.conf"][line"218"][id"332039"][rev"4"][msg"Atomicorp.comWAFRules:SuspiciousUnusualUserAgent\(python-requests\).Disablethisruleifyouusepython-requests/."][severity"CRITI

Automatic report - Banned IP Access

\[2019-09-09 07:38:37\] NOTICE\[9368\] res_pjsip/pjsip_distributor.c: Request 'REGISTER' from '\' failed for '5.62.41.170:13190' \(callid: 1203170097-675946563-208547998\) - Failed to authenticate
\[2019-09-09 07:38:37\] SECURITY\[1715\] res_security_log.c: SecurityEvent="ChallengeResponseFailed",EventTV="2019-09-09T07:38:37.048+0200",Severity="Error",Service="PJSIP",EventVersion="1",AccountID="\",SessionID="1203170097-675946563-208547998",LocalAddress="IPV4/UDP/188.40.118.248/5060",RemoteAddress="IPV4/UDP/5.62.41.170/13190",Challenge="1568007516/caeaab6b3dc8e42027bf21bcce7af2a7",Response="6285afb57c0c154f3ebf9a6c9ab9cf39",ExpectedResponse=""
\[2019-09-09 07:38:37\] NOTICE\[1168\] res_pjsip/pjsip_distributor.c: Request 'REGISTER' from '\' failed for '5.62.41.170:13190' \(callid: 1203170097-675946563-208547998\) - Failed to authenticate
\[2019-09-09 07:38:37\] SECURITY\[1715\] res_security_log.c: SecurityEvent="ChallengeResponseFailed",

\[2019-09-07 18:30:38\] NOTICE\[603\] res_pjsip/pjsip_distributor.c: Request 'REGISTER' from '\' failed for '5.62.41.170:13069' \(callid: 1035677388-256703499-63010709\) - Failed to authenticate
\[2019-09-07 18:30:38\] SECURITY\[1715\] res_security_log.c: SecurityEvent="ChallengeResponseFailed",EventTV="2019-09-07T18:30:38.570+0200",Severity="Error",Service="PJSIP",EventVersion="1",AccountID="\",SessionID="1035677388-256703499-63010709",LocalAddress="IPV4/UDP/188.40.118.248/5060",RemoteAddress="IPV4/UDP/5.62.41.170/13069",Challenge="1567873838/e585215322fc2d45e8e6e61ead7d842f",Response="52bea22b59483ba08df50250ae5e0caa",ExpectedResponse=""
\[2019-09-07 18:30:38\] NOTICE\[25634\] res_pjsip/pjsip_distributor.c: Request 'REGISTER' from '\' failed for '5.62.41.170:13069' \(callid: 1035677388-256703499-63010709\) - Failed to authenticate
\[2019-09-07 18:30:38\] SECURITY\[1715\] res_security_log.c: SecurityEvent="ChallengeResponseFailed",Eve

SSH Brute Force, server-1 sshd[32605]: Failed password for root from 200.13.195.70 port 57706 ssh2

Dec  3 00:05:07 vtv3 sshd[9820]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.57.7 
Dec  3 00:05:09 vtv3 sshd[9820]: Failed password for invalid user vishalj from 180.76.57.7 port 57710 ssh2
Dec  3 00:13:00 vtv3 sshd[13402]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.57.7 
Dec  3 00:27:05 vtv3 sshd[20248]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.57.7 
Dec  3 00:27:07 vtv3 sshd[20248]: Failed password for invalid user test from 180.76.57.7 port 40306 ssh2
Dec  3 00:32:48 vtv3 sshd[22861]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.57.7 
Dec  3 00:43:55 vtv3 sshd[28246]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.57.7 
Dec  3 00:43:57 vtv3 sshd[28246]: Failed password for invalid user brith from 180.76.57.7 port 39222 ssh2
Dec  3 00:49:40 vtv3 sshd[30927]

Dec  3 02:16:16 server sshd\[5007\]: User root from 112.85.42.171 not allowed because listed in DenyUsers
Dec  3 02:16:16 server sshd\[5007\]: Failed none for invalid user root from 112.85.42.171 port 25349 ssh2
Dec  3 02:16:17 server sshd\[5007\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.85.42.171  user=root
Dec  3 02:16:19 server sshd\[5007\]: Failed password for invalid user root from 112.85.42.171 port 25349 ssh2
Dec  3 02:16:22 server sshd\[5007\]: Failed password for invalid user root from 112.85.42.171 port 25349 ssh2

Dec  3 01:16:20 OPSO sshd\[2424\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.30.236.149  user=root
Dec  3 01:16:22 OPSO sshd\[2424\]: Failed password for root from 123.30.236.149 port 55730 ssh2
Dec  3 01:23:05 OPSO sshd\[3971\]: Invalid user saravanos from 123.30.236.149 port 58882
Dec  3 01:23:05 OPSO sshd\[3971\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.30.236.149
Dec  3 01:23:07 OPSO sshd\[3971\]: Failed password for invalid user saravanos from 123.30.236.149 port 58882 ssh2

Unauthorised access (Dec  2) SRC=119.152.133.91 LEN=52 TTL=114 ID=28471 DF TCP DPT=445 WINDOW=8192 SYN

Dec  2 18:56:54 ny01 sshd[15581]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.170.65.115
Dec  2 18:56:56 ny01 sshd[15581]: Failed password for invalid user cssserver from 107.170.65.115 port 43330 ssh2
Dec  2 19:02:32 ny01 sshd[16358]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.170.65.115

Dec  3 01:40:04 hosting sshd[15552]: Invalid user tn from 219.166.85.146 port 60596
...

$f2bV_matches

Dec  2 12:41:32 kapalua sshd\[28388\]: Invalid user escape from 198.50.197.217
Dec  2 12:41:32 kapalua sshd\[28388\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ip217.ip-198-50-197.net
Dec  2 12:41:34 kapalua sshd\[28388\]: Failed password for invalid user escape from 198.50.197.217 port 54722 ssh2
Dec  2 12:47:05 kapalua sshd\[28945\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ip217.ip-198-50-197.net  user=root
Dec  2 12:47:07 kapalua sshd\[28945\]: Failed password for root from 198.50.197.217 port 39126 ssh2

Dec  2 23:43:00 pi sshd\[22719\]: Failed password for invalid user zp from 140.143.130.52 port 52468 ssh2
Dec  2 23:50:26 pi sshd\[23142\]: Invalid user balmont from 140.143.130.52 port 55472
Dec  2 23:50:26 pi sshd\[23142\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=140.143.130.52
Dec  2 23:50:28 pi sshd\[23142\]: Failed password for invalid user balmont from 140.143.130.52 port 55472 ssh2
Dec  3 00:04:38 pi sshd\[23891\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=140.143.130.52  user=www-data
...

Dec  2 17:29:49 XXX sshd[63595]: Invalid user hung from 176.31.182.125 port 34704

Dec  3 02:54:02 server sshd\[17029\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=198.211.110.133  user=root
Dec  3 02:54:04 server sshd\[17029\]: Failed password for root from 198.211.110.133 port 44850 ssh2
Dec  3 02:59:52 server sshd\[18501\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=198.211.110.133  user=root
Dec  3 02:59:54 server sshd\[18501\]: Failed password for root from 198.211.110.133 port 59488 ssh2
Dec  3 03:04:50 server sshd\[21127\]: Invalid user ruma from 198.211.110.133
Dec  3 03:04:50 server sshd\[21127\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=198.211.110.133 
...

port scan and connect, tcp 23 (telnet)

Dec  2 14:00:40 tdfoods sshd\[29307\]: Invalid user cronkright from 181.127.196.226
Dec  2 14:00:40 tdfoods sshd\[29307\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.127.196.226
Dec  2 14:00:42 tdfoods sshd\[29307\]: Failed password for invalid user cronkright from 181.127.196.226 port 39092 ssh2
Dec  2 14:08:43 tdfoods sshd\[30090\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.127.196.226  user=root
Dec  2 14:08:45 tdfoods sshd\[30090\]: Failed password for root from 181.127.196.226 port 52208 ssh2

Wordpress Attacks [Scanning for wp-login.php] @ 2019-12-02 23:12:40