Nov 29 08:31:07 MK-Soft-VM6 sshd[3229]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.95.12 
Nov 29 08:31:10 MK-Soft-VM6 sshd[3229]: Failed password for invalid user skylar from 51.38.95.12 port 37440 ssh2
...

Portscan or hack attempt detected by psad/fwsnort

Masscan Port Scanning Tool Detection (56115) PA

Unauthorized SSH login attempts

Nov 29 09:22:13 server sshd\[27021\]: Invalid user f090 from 106.13.57.239
Nov 29 09:22:13 server sshd\[27021\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.57.239 
Nov 29 09:22:15 server sshd\[27021\]: Failed password for invalid user f090 from 106.13.57.239 port 52722 ssh2
Nov 29 09:29:20 server sshd\[28616\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.57.239  user=root
Nov 29 09:29:22 server sshd\[28616\]: Failed password for root from 106.13.57.239 port 58108 ssh2
...

Nov 29 08:05:59 vps666546 sshd\[22259\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.215.121.36  user=root
Nov 29 08:06:01 vps666546 sshd\[22259\]: Failed password for root from 58.215.121.36 port 23218 ssh2
Nov 29 08:10:29 vps666546 sshd\[22434\]: Invalid user ivanova from 58.215.121.36 port 42730
Nov 29 08:10:29 vps666546 sshd\[22434\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.215.121.36
Nov 29 08:10:30 vps666546 sshd\[22434\]: Failed password for invalid user ivanova from 58.215.121.36 port 42730 ssh2
...

2019-11-29T07:32:20.398015shield sshd\[30357\]: Invalid user test from 49.235.18.9 port 47448
2019-11-29T07:32:20.401302shield sshd\[30357\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.235.18.9
2019-11-29T07:32:22.790842shield sshd\[30357\]: Failed password for invalid user test from 49.235.18.9 port 47448 ssh2
2019-11-29T07:36:05.674206shield sshd\[30871\]: Invalid user cvs123 from 49.235.18.9 port 51332
2019-11-29T07:36:05.678301shield sshd\[30871\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.235.18.9

SSH invalid-user multiple login try

Nov 28 21:33:26 tdfoods sshd\[16106\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.24.114.205  user=root
Nov 28 21:33:28 tdfoods sshd\[16106\]: Failed password for root from 118.24.114.205 port 55854 ssh2
Nov 28 21:39:06 tdfoods sshd\[16586\]: Invalid user lohrmann from 118.24.114.205
Nov 28 21:39:06 tdfoods sshd\[16586\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.24.114.205
Nov 28 21:39:08 tdfoods sshd\[16586\]: Failed password for invalid user lohrmann from 118.24.114.205 port 58094 ssh2

2019-11-29 07:29:54 H=(2e33bb93.flatbellyfixplus.fun) [23.254.204.146] F= rejected RCPT : relay not permitted
2019-11-29 07:29:55 H=(2e63f878.flatbellyfixplus.fun) [23.254.204.146] F= rejected RCPT : relay not permitted
...

Nov 29 08:39:34 ks10 sshd[8349]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.76.91 
Nov 29 08:39:37 ks10 sshd[8349]: Failed password for invalid user webadmin from 106.12.76.91 port 33778 ssh2
...

2019-11-29 05:16:33,093 fail2ban.actions        \[14488\]: NOTICE  \[sshd\] Ban 23.91.101.216
2019-11-29 05:50:38,805 fail2ban.actions        \[14488\]: NOTICE  \[sshd\] Ban 23.91.101.216
2019-11-29 06:22:56,138 fail2ban.actions        \[14488\]: NOTICE  \[sshd\] Ban 23.91.101.216
2019-11-29 06:55:22,010 fail2ban.actions        \[14488\]: NOTICE  \[sshd\] Ban 23.91.101.216
2019-11-29 07:29:53,730 fail2ban.actions        \[14488\]: NOTICE  \[sshd\] Ban 23.91.101.216
...

postfix (unknown user, SPF fail or relay access denied)

Nov 29 07:23:22 ns382633 sshd\[7938\]: Invalid user salkilld from 27.50.162.82 port 46556
Nov 29 07:23:22 ns382633 sshd\[7938\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.50.162.82
Nov 29 07:23:24 ns382633 sshd\[7938\]: Failed password for invalid user salkilld from 27.50.162.82 port 46556 ssh2
Nov 29 07:49:54 ns382633 sshd\[12698\]: Invalid user 1984 from 27.50.162.82 port 43212
Nov 29 07:49:54 ns382633 sshd\[12698\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.50.162.82

SQL APT attack
Reported by AND  credit to nic@wlink.biz from IP 118.69.71.82
Cha mẹ các ku không dạy cho các ku cách hành xử cho tử tế à ?
Làm người đàng hoàng không chịu, lại chịu đi làm ăn trộm, ăn cướp, lưu manh!