Requesting log review of possible attack

Greetings. I have been seeing some strange listings in my General SysLog. I added line feeds & emphasis to make it clearer to read. I think what's happening is the actual user name (replaced by _USERNAME_ below) may be compromised. I can't tell from this if the password is also compromised or is under attack. The ip's come back to Russia & rotate. This has been going on since 20-Jan.

If I blacklist the entire apparent attacking network, 92.63.194., in Firewall>URL Filter (leaving...

Requesting log review of possible attack