Sep 26 03:22:36 web1 sshd[21549]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.183.140.132  user=root
Sep 26 03:22:38 web1 sshd[21549]: Failed password for root from 68.183.140.132 port 48526 ssh2
Sep 26 03:31:12 web1 sshd[4639]: Invalid user xiao from 68.183.140.132 port 44832
Sep 26 03:31:12 web1 sshd[4639]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.183.140.132
Sep 26 03:31:12 web1 sshd[4639]: Invalid user xiao from 68.183.140.132 port 44832
Sep 26 03:31:13 web1 sshd[4639]: Failed password for invalid user xiao from 68.183.140.132 port 44832 ssh2
Sep 26 03:34:38 web1 sshd[5707]: Invalid user oper from 68.183.140.132 port 39918
Sep 26 03:34:38 web1 sshd[5707]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.183.140.132
Sep 26 03:34:38 web1 sshd[5707]: Invalid user oper from 68.183.140.132 port 39918
Sep 26 03:34:41 web1 sshd[5707]: Failed password f
...

2020-09-25T09:44:20+0000 Failed SSH Authentication/Brute Force Attack. (Server 6)

Sep 25 00:52:55 XXX sshd[64923]: Invalid user info from 68.183.140.132 port 45628

[2020-03-13 20:13:00] NOTICE[1148][C-00011658] chan_sip.c: Call from '' (68.183.140.62:62083) to extension '901146213724635' rejected because extension not found in context 'public'.
[2020-03-13 20:13:00] SECURITY[1163] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-03-13T20:13:00.954-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="901146213724635",SessionID="0x7fd82c43c848",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/68.183.140.62/62083",ACLName="no_extension_match"
[2020-03-13 20:15:33] NOTICE[1148][C-0001165e] chan_sip.c: Call from '' (68.183.140.62:59685) to extension '01146213724635' rejected because extension not found in context 'public'.
[2020-03-13 20:15:33] SECURITY[1163] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-03-13T20:15:33.692-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="01146213724635",SessionID="0x7fd82c43c848",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/68
...

[2020-03-10 18:03:01] NOTICE[1148][C-00010aaa] chan_sip.c: Call from '' (68.183.140.62:65356) to extension '80046213724635' rejected because extension not found in context 'public'.
[2020-03-10 18:03:01] SECURITY[1163] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-03-10T18:03:01.445-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="80046213724635",SessionID="0x7fd82c530768",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/68.183.140.62/65356",ACLName="no_extension_match"
[2020-03-10 18:05:00] NOTICE[1148][C-00010aad] chan_sip.c: Call from '' (68.183.140.62:56679) to extension '946213724635' rejected because extension not found in context 'public'.
[2020-03-10 18:05:00] SECURITY[1163] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-03-10T18:05:00.735-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="946213724635",SessionID="0x7fd82ca9d388",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/68.183.1
...

[2020-03-10 06:45:31] NOTICE[1148][C-00010875] chan_sip.c: Call from '' (68.183.140.62:59448) to extension '+46213724635' rejected because extension not found in context 'public'.
[2020-03-10 06:45:31] SECURITY[1163] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-03-10T06:45:31.705-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="+46213724635",SessionID="0x7fd82cdb8718",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/68.183.140.62/59448",ACLName="no_extension_match"
[2020-03-10 06:48:12] NOTICE[1148][C-0001087b] chan_sip.c: Call from '' (68.183.140.62:50198) to extension '00046213724635' rejected because extension not found in context 'public'.
[2020-03-10 06:48:12] SECURITY[1163] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-03-10T06:48:12.209-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="00046213724635",SessionID="0x7fd82ca712e8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/68.183.1
...

[2020-03-09 17:38:28] NOTICE[1148][C-00010558] chan_sip.c: Call from '' (68.183.140.62:52166) to extension '90046213724635' rejected because extension not found in context 'public'.
[2020-03-09 17:38:28] SECURITY[1163] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-03-09T17:38:28.904-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="90046213724635",SessionID="0x7fd82ca712e8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/68.183.140.62/52166",ACLName="no_extension_match"
[2020-03-09 17:40:32] NOTICE[1148][C-0001055a] chan_sip.c: Call from '' (68.183.140.62:55788) to extension '46213724635' rejected because extension not found in context 'public'.
[2020-03-09 17:40:32] SECURITY[1163] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-03-09T17:40:32.350-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="46213724635",SessionID="0x7fd82ca712e8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/68.183.140
...

[2020-03-06 07:15:27] NOTICE[1148][C-0000eb3d] chan_sip.c: Call from '' (68.183.140.62:61801) to extension '95546812111443' rejected because extension not found in context 'public'.
[2020-03-06 07:15:27] SECURITY[1163] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-03-06T07:15:27.910-0500",Severity="Error",Service="SIP",EventVersion="1",AccountID="95546812111443",SessionID="0x7fd82cd2af88",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/68.183.140.62/61801",ACLName="no_extension_match"
[2020-03-06 07:19:26] NOTICE[1148][C-0000eb46] chan_sip.c: Call from '' (68.183.140.62:64138) to extension '95646812111443' rejected because extension not found in context 'public'.
[2020-03-06 07:19:26] SECURITY[1163] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-03-06T07:19:26.164-0500",Severity="Error",Service="SIP",EventVersion="1",AccountID="95646812111443",SessionID="0x7fd82c530768",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/68.1
...

Dec 30 05:54:56 grey postfix/smtpd\[14432\]: NOQUEUE: reject: RCPT from unknown\[68.183.140.246\]: 554 5.7.1 Service unavailable\; Client host \[68.183.140.246\] blocked using truncate.gbudb.net\; http://www.gbudb.com/truncate/ \[68.183.140.246\]\; from=\<64nx4@lfuzemail.co\> to=\ proto=ESMTP helo=\
...

F2B jail: sshd. Time: 2019-09-28 08:39:42, Reported by: VKReport

Attempt to attack host OS, exploiting network vulnerabilities, on 28-09-2019 04:51:11.

Invalid user fnd from 188.254.0.224 port 38988

Sep 26 08:24:36 mxgate1 postfix/postscreen[14972]: CONNECT from [59.100.169.211]:49291 to [176.31.12.44]:25
Sep 26 08:24:36 mxgate1 postfix/dnsblog[14976]: addr 59.100.169.211 listed by domain b.barracudacentral.org as 127.0.0.2
Sep 26 08:24:42 mxgate1 postfix/postscreen[14972]: PASS NEW [59.100.169.211]:49291
Sep 26 08:24:47 mxgate1 postfix/smtpd[14978]: connect from 59-100-169-211.cust.static-ipl.aapt.com.au[59.100.169.211]
Sep x@x
Sep 26 08:24:53 mxgate1 postfix/smtpd[14978]: disconnect from 59-100-169-211.cust.static-ipl.aapt.com.au[59.100.169.211] ehlo=2 starttls=1 mail=1 rcpt=0/1 data=0/1 eclipset=1 quhostname=1 commands=6/8
Sep 26 09:36:49 mxgate1 postfix/postscreen[17680]: CONNECT from [59.100.169.211]:58386 to [176.31.12.44]:25
Sep 26 09:36:49 mxgate1 postfix/dnsblog[17683]: addr 59.100.169.211 listed by domain b.barracudacentral.org as 127.0.0.2
Sep 26 09:36:49 mxgate1 postfix/postscreen[17680]: PASS OLD [59.100.169.211]:58386
Sep 26 09:36:49 mxgate1 postfix/s........
-------------------------------

Sep 27 22:40:27 hiderm sshd\[17612\]: Invalid user tab from 106.12.86.240
Sep 27 22:40:27 hiderm sshd\[17612\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.86.240
Sep 27 22:40:29 hiderm sshd\[17612\]: Failed password for invalid user tab from 106.12.86.240 port 55828 ssh2
Sep 27 22:45:47 hiderm sshd\[18042\]: Invalid user helpdesk from 106.12.86.240
Sep 27 22:45:47 hiderm sshd\[18042\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.86.240

445/tcp 445/tcp 445/tcp...
[2019-08-25/09-27]23pkt,1pt.(tcp)

2019-09-28T05:46:57.828123  sshd[15698]: Invalid user ilaria from 213.32.65.111 port 56344
2019-09-28T05:46:57.841627  sshd[15698]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=213.32.65.111
2019-09-28T05:46:57.828123  sshd[15698]: Invalid user ilaria from 213.32.65.111 port 56344
2019-09-28T05:46:59.750459  sshd[15698]: Failed password for invalid user ilaria from 213.32.65.111 port 56344 ssh2
2019-09-28T05:51:13.488640  sshd[15758]: Invalid user www from 213.32.65.111 port 46260
...

Sep 27 19:52:16 sachi sshd\[1503\]: Invalid user fluffy from 79.137.84.144
Sep 27 19:52:16 sachi sshd\[1503\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=144.ip-79-137-84.eu
Sep 27 19:52:18 sachi sshd\[1503\]: Failed password for invalid user fluffy from 79.137.84.144 port 49742 ssh2
Sep 27 19:56:46 sachi sshd\[1865\]: Invalid user sl from 79.137.84.144
Sep 27 19:56:46 sachi sshd\[1865\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=144.ip-79-137-84.eu

firewall-block, port(s): 23/tcp

2019-09-28T05:55:31.255139mizuno.rwx.ovh sshd[2800652]: Connection from 116.203.202.45 port 35012 on 78.46.61.178 port 22
2019-09-28T05:55:31.367747mizuno.rwx.ovh sshd[2800652]: Invalid user dbps from 116.203.202.45 port 35012
2019-09-28T05:55:31.370733mizuno.rwx.ovh sshd[2800652]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.203.202.45
2019-09-28T05:55:31.255139mizuno.rwx.ovh sshd[2800652]: Connection from 116.203.202.45 port 35012 on 78.46.61.178 port 22
2019-09-28T05:55:31.367747mizuno.rwx.ovh sshd[2800652]: Invalid user dbps from 116.203.202.45 port 35012
2019-09-28T05:55:33.597734mizuno.rwx.ovh sshd[2800652]: Failed password for invalid user dbps from 116.203.202.45 port 35012 ssh2
...

Sep 27 22:31:42 wbs sshd\[7366\]: Invalid user teamspeak3 from 51.83.46.178
Sep 27 22:31:42 wbs sshd\[7366\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.ip-51-83-46.eu
Sep 27 22:31:44 wbs sshd\[7366\]: Failed password for invalid user teamspeak3 from 51.83.46.178 port 57690 ssh2
Sep 27 22:35:45 wbs sshd\[7724\]: Invalid user grid from 51.83.46.178
Sep 27 22:35:45 wbs sshd\[7724\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.ip-51-83-46.eu

Sep 27 22:21:50 php1 sshd\[15965\]: Invalid user Password from 104.40.4.51
Sep 27 22:21:50 php1 sshd\[15965\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.40.4.51
Sep 27 22:21:52 php1 sshd\[15965\]: Failed password for invalid user Password from 104.40.4.51 port 54185 ssh2
Sep 27 22:27:34 php1 sshd\[16592\]: Invalid user 123 from 104.40.4.51
Sep 27 22:27:34 php1 sshd\[16592\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.40.4.51

C2,WP GET /wp-login.php

Unauthorised access (Sep 28) SRC=175.163.223.115 LEN=40 TTL=49 ID=36254 TCP DPT=8080 WINDOW=56934 SYN

Automatic report - Banned IP Access