Invalid user demo from 203.195.132.128 port 43174

Jun 20 12:38:55 vps639187 sshd\[11331\]: Invalid user user0 from 64.227.67.106 port 33938
Jun 20 12:38:55 vps639187 sshd\[11331\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.67.106
Jun 20 12:38:57 vps639187 sshd\[11331\]: Failed password for invalid user user0 from 64.227.67.106 port 33938 ssh2
...

Jun 20 13:10:16 ift sshd\[26371\]: Failed password for root from 218.92.0.172 port 48814 ssh2Jun 20 13:10:21 ift sshd\[26371\]: Failed password for root from 218.92.0.172 port 48814 ssh2Jun 20 13:10:24 ift sshd\[26371\]: Failed password for root from 218.92.0.172 port 48814 ssh2Jun 20 13:10:28 ift sshd\[26371\]: Failed password for root from 218.92.0.172 port 48814 ssh2Jun 20 13:10:32 ift sshd\[26371\]: Failed password for root from 218.92.0.172 port 48814 ssh2
...

2020-06-20T08:52:13.9615351240 sshd\[22915\]: Invalid user testing from 13.71.21.123 port 1024
2020-06-20T08:52:13.9659311240 sshd\[22915\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=13.71.21.123
2020-06-20T08:52:16.4839671240 sshd\[22915\]: Failed password for invalid user testing from 13.71.21.123 port 1024 ssh2
...

REQUESTED PAGE: /ads.txt

Jun 20 11:57:00 srv01 dovecot: pop3-login: Aborted login \(auth failed, 1 attempts in 2 secs\): user=\, method=PLAIN, rip=193.169.255.18, lip=144.76.89.190, session=\
Jun 20 11:57:36 srv01 dovecot: pop3-login: Aborted login \(auth failed, 1 attempts in 2 secs\): user=\, method=PLAIN, rip=193.169.255.18, lip=144.76.89.190, session=\
Jun 20 11:58:44 srv01 dovecot: pop3-login: Aborted login \(auth failed, 1 attempts in 2 secs\): user=\, method=PLAIN, rip=193.169.255.18, lip=144.76.89.190, session=\
Jun 20 11:59:02 srv01 dovecot: pop3-login: Aborted login \(auth failed, 1 attempts in 6 secs\): user=\, method=PLAIN, rip=193.169.255.18, lip=144.76.89.188, session=\
Jun 20 11:59:23 srv01 dovecot: pop3-login: Aborted login \(auth failed, 1 attempts in 10 secs\): user=\, method=PLAIN, rip=193.169.255.18, lip=14
...

2020-06-20T09:06:43.598892abusebot.cloudsearch.cf sshd[19826]: Invalid user mrm from 187.189.37.174 port 15457
2020-06-20T09:06:43.606606abusebot.cloudsearch.cf sshd[19826]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=fixed-187-189-37-174.totalplay.net
2020-06-20T09:06:43.598892abusebot.cloudsearch.cf sshd[19826]: Invalid user mrm from 187.189.37.174 port 15457
2020-06-20T09:06:44.997969abusebot.cloudsearch.cf sshd[19826]: Failed password for invalid user mrm from 187.189.37.174 port 15457 ssh2
2020-06-20T09:11:39.205016abusebot.cloudsearch.cf sshd[20170]: Invalid user ftpuser from 187.189.37.174 port 37249
2020-06-20T09:11:39.211874abusebot.cloudsearch.cf sshd[20170]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=fixed-187-189-37-174.totalplay.net
2020-06-20T09:11:39.205016abusebot.cloudsearch.cf sshd[20170]: Invalid user ftpuser from 187.189.37.174 port 37249
2020-06-20T09:11:41.907008abusebot.cloud
...

[2020-06-20 06:25:49] NOTICE[1273][C-00003255] chan_sip.c: Call from '' (92.246.84.185:50085) to extension '900546313113308' rejected because extension not found in context 'public'.
[2020-06-20 06:25:49] SECURITY[1288] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-06-20T06:25:49.797-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="900546313113308",SessionID="0x7f31c02f97a8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/92.246.84.185/50085",ACLName="no_extension_match"
[2020-06-20 06:30:30] NOTICE[1273][C-00003256] chan_sip.c: Call from '' (92.246.84.185:52943) to extension '001546313113308' rejected because extension not found in context 'public'.
[2020-06-20 06:30:30] SECURITY[1288] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-06-20T06:30:30.780-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="001546313113308",SessionID="0x7f31c018ea98",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/
...

Invalid user ntt from 129.226.59.53 port 39712

Exploit Attempt

Jun 19 15:29:10 django sshd[6765]: reveeclipse mapping checking getaddrinfo for badc429b.virtua.com.br [186.220.66.155] failed - POSSIBLE BREAK-IN ATTEMPT!
Jun 19 15:29:10 django sshd[6765]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.220.66.155  user=r.r
Jun 19 15:29:12 django sshd[6765]: Failed password for r.r from 186.220.66.155 port 39592 ssh2
Jun 19 15:29:12 django sshd[6766]: Received disconnect from 186.220.66.155: 11: Bye Bye
Jun 19 15:38:14 django sshd[8589]: reveeclipse mapping checking getaddrinfo for badc429b.virtua.com.br [186.220.66.155] failed - POSSIBLE BREAK-IN ATTEMPT!
Jun 19 15:38:14 django sshd[8589]: Invalid user rtest from 186.220.66.155
Jun 19 15:38:14 django sshd[8589]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.220.66.155 
Jun 19 15:38:16 django sshd[8589]: Failed password for invalid user rtest from 186.220.66.155 port 59602 ssh2
Jun 19 15:38:17 dj........
-------------------------------

Jun 20 10:57:01 dev0-dcde-rnet sshd[6632]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.232.65
Jun 20 10:57:03 dev0-dcde-rnet sshd[6632]: Failed password for invalid user kr from 106.13.232.65 port 46502 ssh2
Jun 20 11:00:06 dev0-dcde-rnet sshd[6658]: Failed password for root from 106.13.232.65 port 60168 ssh2

Unauthorized connection attempt detected from IP address 106.75.3.52 to port 3333

Jun 20 15:27:01 gw1 sshd[4601]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.156.216.51
Jun 20 15:27:03 gw1 sshd[4601]: Failed password for invalid user dani from 182.156.216.51 port 41487 ssh2
...

(sshd) Failed SSH login from 104.236.224.69 (US/United States/-): 5 in the last 3600 secs