Aug 24 21:41:38 rocket sshd[17325]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.225.77.52
Aug 24 21:41:39 rocket sshd[17325]: Failed password for invalid user mircea from 91.225.77.52 port 44468 ssh2
...

Aug 24 23:42:11 sticky sshd\[26469\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.237.25.126  user=root
Aug 24 23:42:13 sticky sshd\[26469\]: Failed password for root from 189.237.25.126 port 59752 ssh2
Aug 24 23:46:11 sticky sshd\[26543\]: Invalid user linaro from 189.237.25.126 port 40082
Aug 24 23:46:11 sticky sshd\[26543\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.237.25.126
Aug 24 23:46:12 sticky sshd\[26543\]: Failed password for invalid user linaro from 189.237.25.126 port 40082 ssh2

IP 192.241.223.250 attacked honeypot on port: 22 at 8/24/2020 1:14:46 PM

SSH Brute-Force. Ports scanning.

Aug 24 22:14:26 marvibiene sshd[12049]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=101.50.2.70 
Aug 24 22:14:28 marvibiene sshd[12049]: Failed password for invalid user nexus from 101.50.2.70 port 51034 ssh2

Aug 24 23:40:42 sticky sshd\[26461\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.62.182  user=root
Aug 24 23:40:44 sticky sshd\[26461\]: Failed password for root from 104.248.62.182 port 34758 ssh2
Aug 24 23:44:26 sticky sshd\[26508\]: Invalid user daxiao from 104.248.62.182 port 42398
Aug 24 23:44:26 sticky sshd\[26508\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.62.182
Aug 24 23:44:28 sticky sshd\[26508\]: Failed password for invalid user daxiao from 104.248.62.182 port 42398 ssh2

2020-08-25 01:13:00 auth_plain authenticator failed for (User) [212.70.149.83]: 535 Incorrect authentication data (set_id=preview1@com.ua)
2020-08-25 01:13:27 auth_plain authenticator failed for (User) [212.70.149.83]: 535 Incorrect authentication data (set_id=prev@com.ua)
...

2020-08-25T01:35:34.399160afi-git.jinr.ru sshd[16735]: Failed password for root from 112.85.42.172 port 42761 ssh2
2020-08-25T01:35:38.060464afi-git.jinr.ru sshd[16735]: Failed password for root from 112.85.42.172 port 42761 ssh2
2020-08-25T01:35:41.269656afi-git.jinr.ru sshd[16735]: Failed password for root from 112.85.42.172 port 42761 ssh2
2020-08-25T01:35:41.269829afi-git.jinr.ru sshd[16735]: error: maximum authentication attempts exceeded for root from 112.85.42.172 port 42761 ssh2 [preauth]
2020-08-25T01:35:41.269843afi-git.jinr.ru sshd[16735]: Disconnecting: Too many authentication failures [preauth]
...

Aug 25 00:15:03 vpn01 sshd[881]: Failed password for root from 195.206.105.217 port 58930 ssh2
Aug 25 00:15:05 vpn01 sshd[881]: Failed password for root from 195.206.105.217 port 58930 ssh2
...

(From eric@talkwithwebvisitor.com) My name’s Eric and I just came across your website - brown4chiro.com - in the search results.

Here’s what that means to me…

Your SEO’s working.

You’re getting eyeballs – mine at least.

Your content’s pretty good, wouldn’t change a thing.

BUT…

Eyeballs don’t pay the bills.

CUSTOMERS do.

And studies show that 7 out of 10 visitors to a site like brown4chiro.com will drop by, take a gander, and then head for the hills without doing anything else.

It’s like they never were even there.

You can fix this.

You can make it super-simple for them to raise their hand, say, “okay, let’s talk” without requiring them to even pull their cell phone from their pocket… thanks to Talk With Web Visitor.

Talk With Web Visitor is a software widget that sits on your site, ready and waiting to capture any visitor’s Name, Email address and Phone Number.  It lets you know immediately – so you can talk to that lead immediately… without delay… BEFORE they head for thos

Aug 24 18:15:38 vps46666688 sshd[25113]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.250.95.186
Aug 24 18:15:40 vps46666688 sshd[25113]: Failed password for invalid user darrell from 186.250.95.186 port 62636 ssh2
...

2020-08-24T22:15:19.754297shield sshd\[6801\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.4.127.228  user=root
2020-08-24T22:15:21.793377shield sshd\[6801\]: Failed password for root from 81.4.127.228 port 58706 ssh2
2020-08-24T22:18:47.149607shield sshd\[7228\]: Invalid user test from 81.4.127.228 port 58108
2020-08-24T22:18:47.160031shield sshd\[7228\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.4.127.228
2020-08-24T22:18:49.088381shield sshd\[7228\]: Failed password for invalid user test from 81.4.127.228 port 58108 ssh2

SSH brute force attempt

[Tue Aug 25 03:14:51.658211 2020] [:error] [pid 26844:tid 139693576779520] [client 66.249.68.52:62139] [client 66.249.68.52] ModSecurity: Access denied with code 403 (phase 2). Pattern match "((?:[~!@#\\\\$%\\\\^&\\\\*\\\\(\\\\)\\\\-\\\\+=\\\\{\\\\}\\\\[\\\\]\\\\|:;\"'\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98`<>][^~!@#\\\\$%\\\\^&\\\\*\\\\(\\\\)\\\\-\\\\+=\\\\{\\\\}\\\\[\\\\]\\\\|:;\"'\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98`<>]*?){6})" at ARGS:id. [file "/etc/modsecurity/owasp-modsecurity-crs-3.2.0/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "1526"] [id "942431"] [msg "Restricted SQL Character Anomaly Detection (args): # of special characters exceeded (6)"] [data "Matched Data: :analisis-dinamika-atmosfer-dan-laut- found within ARGS:id: 656:analisis-dinamika-atmosfer-dan-laut-dasarian-i-agustus-2017"] [severity "WARNING"] [ver "OWASP_CRS/3.2.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "OWASP_CRS"] [tag "OWASP_CRS/WEB
...

Aug 25 00:22:14 pve1 sshd[22390]: Failed password for root from 203.128.242.166 port 35620 ssh2
...