Sep 18 08:08:14 localhost sshd[2443711]: Failed password for root from 111.230.248.93 port 47590 ssh2
Sep 18 08:12:29 localhost sshd[2452623]: Invalid user fbl from 111.230.248.93 port 39074
Sep 18 08:12:29 localhost sshd[2452623]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.230.248.93 
Sep 18 08:12:29 localhost sshd[2452623]: Invalid user fbl from 111.230.248.93 port 39074
Sep 18 08:12:31 localhost sshd[2452623]: Failed password for invalid user fbl from 111.230.248.93 port 39074 ssh2
...

Sep  1 05:51:32 santamaria sshd\[19398\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.230.248.93  user=root
Sep  1 05:51:34 santamaria sshd\[19398\]: Failed password for root from 111.230.248.93 port 51718 ssh2
Sep  1 05:53:19 santamaria sshd\[19400\]: Invalid user testlab from 111.230.248.93
Sep  1 05:53:19 santamaria sshd\[19400\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.230.248.93
...

Invalid user squid from 111.230.248.93 port 51324

Invalid user technical from 111.230.248.93 port 33292

Jun 24 05:59:14 rotator sshd\[16898\]: Invalid user zv from 111.230.248.93Jun 24 05:59:16 rotator sshd\[16898\]: Failed password for invalid user zv from 111.230.248.93 port 54736 ssh2Jun 24 06:03:01 rotator sshd\[17677\]: Invalid user ubuntu from 111.230.248.93Jun 24 06:03:03 rotator sshd\[17677\]: Failed password for invalid user ubuntu from 111.230.248.93 port 41326 ssh2Jun 24 06:06:40 rotator sshd\[18443\]: Invalid user mae from 111.230.248.93Jun 24 06:06:42 rotator sshd\[18443\]: Failed password for invalid user mae from 111.230.248.93 port 56156 ssh2
...

Jun  1 08:06:24 pve1 sshd[30457]: Failed password for root from 111.230.248.93 port 52702 ssh2
...

May 29 06:09:47 vps647732 sshd[16681]: Failed password for root from 111.230.248.93 port 54492 ssh2
...

Unauthorised connection attempt detected at AUO NODE 1. System is sshd. Protected by AUO Stack Web Application Firewall (WAF)

Mar 28 04:54:57 * sshd[8187]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.230.248.93
Mar 28 04:54:59 * sshd[8187]: Failed password for invalid user cmf from 111.230.248.93 port 35784 ssh2

Feb 14 22:42:46 hpm sshd\[27474\]: Invalid user db4web from 111.230.248.93
Feb 14 22:42:46 hpm sshd\[27474\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.230.248.93
Feb 14 22:42:48 hpm sshd\[27474\]: Failed password for invalid user db4web from 111.230.248.93 port 52698 ssh2
Feb 14 22:45:39 hpm sshd\[27790\]: Invalid user ts from 111.230.248.93
Feb 14 22:45:39 hpm sshd\[27790\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.230.248.93

lfd: (smtpauth) Failed SMTP AUTH login from 111.230.248.202 (-): 5 in the last 3600 secs - Wed Jan  2 21:29:39 2019

Dec  1 21:00:55 server sshd\[9237\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.230.248.125  user=root
Dec  1 21:00:57 server sshd\[9237\]: Failed password for root from 111.230.248.125 port 56842 ssh2
Dec  1 21:36:33 server sshd\[18602\]: Invalid user vbox from 111.230.248.125
Dec  1 21:36:33 server sshd\[18602\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.230.248.125 
Dec  1 21:36:35 server sshd\[18602\]: Failed password for invalid user vbox from 111.230.248.125 port 48902 ssh2
...

2019-11-25T03:32:23.8620781495-001 sshd\[16057\]: Invalid user criminal from 111.230.248.125 port 56036
2019-11-25T03:32:23.8707271495-001 sshd\[16057\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.230.248.125
2019-11-25T03:32:26.3626841495-001 sshd\[16057\]: Failed password for invalid user criminal from 111.230.248.125 port 56036 ssh2
2019-11-25T03:40:17.5740231495-001 sshd\[16333\]: Invalid user huu from 111.230.248.125 port 34174
2019-11-25T03:40:17.5822551495-001 sshd\[16333\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.230.248.125
2019-11-25T03:40:19.1458581495-001 sshd\[16333\]: Failed password for invalid user huu from 111.230.248.125 port 34174 ssh2
...

Brute-force attempt banned

$f2bV_matches

Nov  4 16:22:27 xeon sshd[12389]: Failed password for invalid user wpyan from 111.230.248.125 port 52634 ssh2

Nov  2 10:55:47 ovpn sshd\[18302\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.230.248.125  user=root
Nov  2 10:55:49 ovpn sshd\[18302\]: Failed password for root from 111.230.248.125 port 47468 ssh2
Nov  2 11:09:12 ovpn sshd\[20798\]: Invalid user admin from 111.230.248.125
Nov  2 11:09:12 ovpn sshd\[20798\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.230.248.125
Nov  2 11:09:14 ovpn sshd\[20798\]: Failed password for invalid user admin from 111.230.248.125 port 47696 ssh2

Invalid user taiga from 111.230.248.125 port 42480

Oct 22 07:00:17 vps691689 sshd[9464]: Failed password for root from 111.230.248.125 port 58244 ssh2
Oct 22 07:05:14 vps691689 sshd[9542]: Failed password for root from 111.230.248.125 port 38948 ssh2
...

Oct 14 20:17:23 localhost sshd\[89572\]: Invalid user user from 111.230.248.125 port 53258
Oct 14 20:17:23 localhost sshd\[89572\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.230.248.125
Oct 14 20:17:25 localhost sshd\[89572\]: Failed password for invalid user user from 111.230.248.125 port 53258 ssh2
Oct 14 20:21:53 localhost sshd\[89729\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.230.248.125  user=root
Oct 14 20:21:55 localhost sshd\[89729\]: Failed password for root from 111.230.248.125 port 37334 ssh2
...

Oct 12 15:51:10 venus sshd\[20603\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.230.248.125  user=root
Oct 12 15:51:12 venus sshd\[20603\]: Failed password for root from 111.230.248.125 port 44122 ssh2
Oct 12 15:56:55 venus sshd\[20645\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.230.248.125  user=root
...

[SatOct1207:52:46.2501482019][:error][pid26369:tid47845820368640][client111.230.248.96:15030][client111.230.248.96]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch"\(\?:\\\\\\\\\(chr\?\\\\\\\\\(\?[0-9]{1\,3}\?\\\\\\\\\)\|\?=\?f\(\?:open\|write\)\?\\\\\\\\\(\|\\\\\\\\b\(\?:passthru\|serialize\|php_uname\|phpinfo\|shell_exec\|preg_\\\\\\\\w \|mysql_query\|exec\|eval\|base64_decode\|decode_base64\|rot13\|base64_url_decode\|gz\(\?:inflate\|decode\|uncompress\)\|strrev\|zlib_\\\\\\\\w \)\\\\\\\\b\?\(\?..."atARGS:widgetConfig[code].[file"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf"][line"767"][id"340095"][rev"53"][msg"Atomicorp.comWAFRules:AttackBlocked-PHPfunctioninArgument-thismaybeanattack."][data"die\(@md5\,ARGS:widgetConfig[code]"][severity"CRITICAL"][hostname"81.17.25.251"][uri"/index.php"][unique_id"XaFqLm8swyF4eychWu378gAAAVA"][SatOct1207:52:46.7472832019][:error][pid26437:tid47845820368640][client111.230.248.96:15107][client111.230.248.96]ModSecurity:Accessdeniedwithc

Oct 11 14:13:14 vps01 sshd[18348]: Failed password for root from 111.230.248.125 port 32838 ssh2

ECShop Remote Code Execution Vulnerability

Sep 20 20:39:21 SilenceServices sshd[29520]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.230.248.125
Sep 20 20:39:23 SilenceServices sshd[29520]: Failed password for invalid user suporte from 111.230.248.125 port 55030 ssh2
Sep 20 20:42:37 SilenceServices sshd[31966]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.230.248.125

Attempted Brute Force (dovecot)

Aug 31 09:58:29 vm1 sshd[20516]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.64.90.27
...

Port probing on unauthorized port 27443

Unauthorized connection attempt detected from IP address 198.20.99.130 to port 9300 [T]

Aug 31 05:57:56 eventyay sshd[10996]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.54.203.54
Aug 31 05:57:58 eventyay sshd[10996]: Failed password for invalid user sofia from 106.54.203.54 port 36368 ssh2
Aug 31 06:01:45 eventyay sshd[11123]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.54.203.54
...

Invalid user zhangfan from 180.76.107.10 port 45526

2020-08-30 07:25 Unauthorized connection attempt to IMAP/POP

Aug 31 05:48:45 sip sshd[1473771]: Failed password for invalid user pi from 111.231.120.22 port 54848 ssh2
Aug 31 05:51:53 sip sshd[1473791]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.120.22  user=root
Aug 31 05:51:54 sip sshd[1473791]: Failed password for root from 111.231.120.22 port 51960 ssh2
...

Invalid user mns from 113.88.15.166 port 2423

Aug 31 08:19:56 electroncash sshd[18371]: Invalid user ljq from 91.134.147.146 port 43918
Aug 31 08:19:56 electroncash sshd[18371]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.134.147.146 
Aug 31 08:19:56 electroncash sshd[18371]: Invalid user ljq from 91.134.147.146 port 43918
Aug 31 08:19:58 electroncash sshd[18371]: Failed password for invalid user ljq from 91.134.147.146 port 43918 ssh2
Aug 31 08:23:37 electroncash sshd[19299]: Invalid user user01 from 91.134.147.146 port 53736
...

Time:     Mon Aug 31 03:50:45 2020 +0000
IP:       205.185.127.217 (US/United States/tor-exit.monoxyde.org)
Failures: 5 (sshd)
Interval: 3600 seconds
Blocked:  Permanent Block [LF_SSHD]

Log entries:

Aug 31 03:50:32 vps3 sshd[6141]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=205.185.127.217  user=root
Aug 31 03:50:34 vps3 sshd[6141]: Failed password for root from 205.185.127.217 port 40167 ssh2
Aug 31 03:50:36 vps3 sshd[6141]: Failed password for root from 205.185.127.217 port 40167 ssh2
Aug 31 03:50:39 vps3 sshd[6141]: Failed password for root from 205.185.127.217 port 40167 ssh2
Aug 31 03:50:41 vps3 sshd[6141]: Failed password for root from 205.185.127.217 port 40167 ssh2

Automatic report - Port Scan Attack

 TCP (SYN) 137.220.135.50:1024 -> port 22, len 40

Aug 31 09:10:19 server sshd[18858]: Failed password for root from 111.230.181.82 port 46418 ssh2
Aug 31 09:14:29 server sshd[20702]: Failed password for invalid user gpl from 111.230.181.82 port 33808 ssh2
Aug 31 09:18:39 server sshd[22647]: Failed password for invalid user bix from 111.230.181.82 port 49798 ssh2

Unauthorized connection attempt detected from IP address 156.96.106.18 to port 6333 [T]