Aug 29 05:29:52 cho postfix/smtpd[1841803]: warning: blogkubet.com[134.209.108.33]: SASL PLAIN authentication failed: 
Aug 29 05:29:59 cho postfix/smtpd[1841805]: warning: blogkubet.com[134.209.108.33]: SASL PLAIN authentication failed: 
Aug 29 05:30:17 cho postfix/smtpd[1841803]: warning: blogkubet.com[134.209.108.33]: SASL PLAIN authentication failed: 
Aug 29 05:30:20 cho postfix/smtpd[1841805]: warning: blogkubet.com[134.209.108.33]: SASL PLAIN authentication failed: 
Aug 29 05:33:57 cho postfix/smtpd[1841803]: warning: blogkubet.com[134.209.108.33]: SASL PLAIN authentication failed: 
...

Invalid user admin from 134.209.108.97 port 55740

The IP has triggered Cloudflare WAF. CF-Ray: 540f625fdd01dddf | WAF_Rule_ID: 1aff1cdfeb5c4074965d7cd85bfc1d4e | WAF_Kind: firewall | CF_Action: challenge | Country: SG | CF_IPClass: noRecord | Protocol: HTTP/2 | Method: GET | Host: ip.skk.moe | User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.2;. en-US) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.108 Safari/537.36 Quark/3.6.2.122 | CF_DC: SIN. Report generated by Cloudflare-WAF-to-AbuseIPDB (https://github.com/SukkaW/Cloudflare-WAF-to-AbuseIPDB).

Nov  3 10:19:29 foo sshd[23529]: Invalid user Oyster from 134.209.108.30
Nov  3 10:19:29 foo sshd[23529]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.108.30 
Nov  3 10:19:32 foo sshd[23529]: Failed password for invalid user Oyster from 134.209.108.30 port 50038 ssh2
Nov  3 10:19:32 foo sshd[23529]: Received disconnect from 134.209.108.30: 11: Bye Bye [preauth]
Nov  3 10:33:06 foo sshd[23752]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.108.30  user=r.r
Nov  3 10:33:08 foo sshd[23752]: Failed password for r.r from 134.209.108.30 port 51916 ssh2
Nov  3 10:33:09 foo sshd[23752]: Received disconnect from 134.209.108.30: 11: Bye Bye [preauth]
Nov  3 10:37:28 foo sshd[23916]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.108.30  user=r.r
Nov  3 10:37:30 foo sshd[23916]: Failed password for r.r from 134.209.108.30 port 34638 ........
-------------------------------

Nov  2 02:49:39 tdfoods sshd\[18369\]: Invalid user grissom from 134.209.108.30
Nov  2 02:49:39 tdfoods sshd\[18369\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.108.30
Nov  2 02:49:40 tdfoods sshd\[18369\]: Failed password for invalid user grissom from 134.209.108.30 port 39180 ssh2
Nov  2 02:54:29 tdfoods sshd\[18737\]: Invalid user wg123 from 134.209.108.30
Nov  2 02:54:29 tdfoods sshd\[18737\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.108.30

Nov  1 02:27:06 auw2 sshd\[8336\]: Invalid user youmuyou from 134.209.108.30
Nov  1 02:27:06 auw2 sshd\[8336\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.108.30
Nov  1 02:27:07 auw2 sshd\[8336\]: Failed password for invalid user youmuyou from 134.209.108.30 port 35024 ssh2
Nov  1 02:31:54 auw2 sshd\[8707\]: Invalid user gamespot from 134.209.108.30
Nov  1 02:31:54 auw2 sshd\[8707\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.108.30

Oct 12 23:57:55 plusreed sshd[23138]: Invalid user steamuser from 134.209.108.106
...

Oct 12 15:50:42 plusreed sshd[12302]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.108.106  user=root
Oct 12 15:50:44 plusreed sshd[12302]: Failed password for root from 134.209.108.106 port 44044 ssh2
...

Oct 12 07:10:02 plusreed sshd[27045]: Invalid user rtkit from 134.209.108.106
...

Oct 11 22:43:12 plusreed sshd[27760]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.108.106  user=mail
Oct 11 22:43:14 plusreed sshd[27760]: Failed password for mail from 134.209.108.106 port 58194 ssh2
...

Oct  6 12:19:46 plusreed sshd[14357]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.108.106  user=root
Oct  6 12:19:48 plusreed sshd[14357]: Failed password for root from 134.209.108.106 port 35170 ssh2
...

Oct  6 00:26:42 wbs sshd\[13364\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.108.106  user=root
Oct  6 00:26:44 wbs sshd\[13364\]: Failed password for root from 134.209.108.106 port 53672 ssh2
Oct  6 00:27:31 wbs sshd\[13439\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.108.106  user=root
Oct  6 00:27:33 wbs sshd\[13439\]: Failed password for root from 134.209.108.106 port 57868 ssh2
Oct  6 00:28:19 wbs sshd\[13517\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.108.106  user=root

Oct  5 10:01:33 web9 sshd\[11967\]: Invalid user brandsma from 134.209.108.106
Oct  5 10:01:33 web9 sshd\[11967\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.108.106
Oct  5 10:01:34 web9 sshd\[11967\]: Failed password for invalid user brandsma from 134.209.108.106 port 38992 ssh2
Oct  5 10:01:55 web9 sshd\[12040\]: Invalid user gary from 134.209.108.106
Oct  5 10:01:55 web9 sshd\[12040\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.108.106

Sep 30 17:59:59 vps691689 sshd[12182]: Failed password for root from 134.209.108.106 port 42760 ssh2
Sep 30 18:01:01 vps691689 sshd[12192]: Failed password for root from 134.209.108.106 port 50996 ssh2
...

Sep 11 10:23:25 hiderm sshd\[5816\]: Invalid user 1234567 from 134.209.108.13
Sep 11 10:23:25 hiderm sshd\[5816\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=b360mm.com
Sep 11 10:23:27 hiderm sshd\[5816\]: Failed password for invalid user 1234567 from 134.209.108.13 port 53106 ssh2
Sep 11 10:29:28 hiderm sshd\[6352\]: Invalid user sammy123 from 134.209.108.13
Sep 11 10:29:28 hiderm sshd\[6352\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=b360mm.com

Jan  1 08:04:33 mout sshd[32627]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=132.232.52.60  user=root
Jan  1 08:04:35 mout sshd[32627]: Failed password for root from 132.232.52.60 port 48346 ssh2

Dec 17 02:47:09 nexus sshd[12204]: Invalid user halejak from 96.255.36.251 port 57184
Dec 17 02:47:09 nexus sshd[12204]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=96.255.36.251
Dec 17 02:47:11 nexus sshd[12204]: Failed password for invalid user halejak from 96.255.36.251 port 57184 ssh2
Dec 17 02:47:11 nexus sshd[12204]: Received disconnect from 96.255.36.251 port 57184:11: Bye Bye [preauth]
Dec 17 02:47:11 nexus sshd[12204]: Disconnected from 96.255.36.251 port 57184 [preauth]
Dec 19 07:47:41 nexus sshd[3341]: Connection closed by 96.255.36.251 port 39008 [preauth]
Dec 20 21:56:54 nexus sshd[31137]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=96.255.36.251  user=r.r
Dec 20 21:56:56 nexus sshd[31137]: Failed password for r.r from 96.255.36.251 port 37279 ssh2
Dec 20 21:56:56 nexus sshd[31137]: Received disconnect from 96.255.36.251 port 37279:11: Bye Bye [preauth]
Dec 20 21:56:56 n........
-------------------------------

Lines containing failures of 139.219.0.20
Dec 31 02:21:43 shared06 sshd[19150]: Invalid user seremet from 139.219.0.20 port 52094
Dec 31 02:21:43 shared06 sshd[19150]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.219.0.20
Dec 31 02:21:45 shared06 sshd[19150]: Failed password for invalid user seremet from 139.219.0.20 port 52094 ssh2
Dec 31 02:21:45 shared06 sshd[19150]: Received disconnect from 139.219.0.20 port 52094:11: Bye Bye [preauth]
Dec 31 02:21:45 shared06 sshd[19150]: Disconnected from invalid user seremet 139.219.0.20 port 52094 [preauth]


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=139.219.0.20

Scanning random ports - tries to find possible vulnerable services

Host Scan

Jan  1 08:48:41 debian-2gb-nbg1-2 kernel: \[124253.398323\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=92.118.37.99 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=247 ID=47427 PROTO=TCP SPT=42890 DPT=7189 WINDOW=1024 RES=0x00 SYN URGP=0

MultiHost/MultiPort Probe, Scan, Hack -

2020-01-01T07:23:28.574607shield sshd\[29507\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.86.123.242  user=nobody
2020-01-01T07:23:30.699835shield sshd\[29507\]: Failed password for nobody from 218.86.123.242 port 54407 ssh2
2020-01-01T07:27:02.595819shield sshd\[31165\]: Invalid user test from 218.86.123.242 port 14241
2020-01-01T07:27:02.600711shield sshd\[31165\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.86.123.242
2020-01-01T07:27:04.103771shield sshd\[31165\]: Failed password for invalid user test from 218.86.123.242 port 14241 ssh2

Jan  1 07:02:27 server sshd[22568]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.149.149.75  user=r.r
Jan  1 07:02:29 server sshd[22568]: Failed password for r.r from 119.149.149.75 port 44880 ssh2
Jan  1 07:15:34 server sshd[22916]: Invalid user einaeclipsen from 119.149.149.75 port 43124
Jan  1 07:15:34 server sshd[22916]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.149.149.75 n

........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=119.149.149.75

01/01/2020-07:30:11.650502 185.209.0.91 Protocol: 6 ET DROP Dshield Block Listed Source group 1

Host Scan

Jan  1 07:27:27 vps647732 sshd[13264]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.165.204.150
Jan  1 07:27:29 vps647732 sshd[13264]: Failed password for invalid user admin from 217.165.204.150 port 41164 ssh2
...

Attempt to attack host OS, exploiting network vulnerabilities, on 01-01-2020 08:05:23.

Jan  1 06:28:16 flomail dovecot: imap-login: Disconnected (auth failed, 1 attempts in 5 secs): user=, method=PLAIN, rip=176.15.4.13, lip=10.140.194.78, TLS, session=

(From RosalieBuchanan129@gmail.com) Hello.

I'm an expert in search engine optimization and can have your website dominate in the rankings of major search engines like Google. Are you getting a good amount of traffic and potential leads from your website? If not, I can help you achieve that and more. 

It's been proven that search engine optimization plays a major part in creating the success of the best-known websites to this day. This can be a great opportunity to have your site promoted and taken care of by professionals. I'd like to accomplish the same for you and take you on as a client. I'm a freelance professional and my fees are affordable for just about anyone. 

I'll show you the data about your website's potential and get into details if you are interested. Please write back with your contact info and your preferred time for a free consultation over the phone. Talk to you soon! 

Sincerely,
Rosalie Buchanan