(sshd) Failed SSH login from 182.61.163.131 (CN/China/-): 3 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Dec 11 06:53:26 andromeda sshd[23483]: Invalid user weir from 182.61.163.131 port 32654
Dec 11 06:53:28 andromeda sshd[23483]: Failed password for invalid user weir from 182.61.163.131 port 32654 ssh2
Dec 11 07:03:49 andromeda sshd[24790]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.163.131  user=root

Dec 11 08:05:15 debian-2gb-nbg1-2 kernel: \[24329460.598549\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=185.184.79.30 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=244 ID=18372 PROTO=TCP SPT=60000 DPT=33891 WINDOW=1024 RES=0x00 SYN URGP=0

Dec 11 07:28:44 herz-der-gamer sshd[26689]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.42.94  user=vmail
Dec 11 07:28:46 herz-der-gamer sshd[26689]: Failed password for vmail from 104.248.42.94 port 56192 ssh2
...

2019-12-11T08:57:00.477910abusebot-5.cloudsearch.cf sshd\[12412\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=191.ip-54-38-214.eu  user=root

Dec 11 08:44:36 sso sshd[4407]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.199.164.21
Dec 11 08:44:37 sso sshd[4407]: Failed password for invalid user guest from 139.199.164.21 port 59554 ssh2
...

Dec 11 08:14:22 zeus sshd[26190]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.13.195.70 
Dec 11 08:14:24 zeus sshd[26190]: Failed password for invalid user lieuth from 200.13.195.70 port 45900 ssh2
Dec 11 08:20:24 zeus sshd[26377]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.13.195.70 
Dec 11 08:20:26 zeus sshd[26377]: Failed password for invalid user abate from 200.13.195.70 port 54690 ssh2

Cryptocurrency Fraud Spam

Return-Path: 
Received: from source:[109.169.0.103] helo:server36.festiveseasondeals.com
Subject:  Bitcoins are driving people out of 9-5 Jobs - Here's Why!
Message-ID: 
Date: Tue, 10 Dec 2019 14:51:53 +0000
From: "Charlotte Clark" 
Reply-To: admin@marketsconnects.com

Did you know that early investors and adopters of Bitcoins are comfortably living a remarkable life style with billions of dollars invested in the real estate markets? 25 % of the World's Population have already quit their 9-5 Jobs to build a fortune of their own using Bitcoins. In today's article we uncover the mystery about Bitcoins and how to profit from them using a simple formula for success. Watch a short presentation by accessing the links given below in your preferred language.

ENGLISH >> VISIT HERE
PORTUGAL >> VISIT HERE
ITALY >> VISIT HERE
FINLAND >> VISIT HERE
POLAND >> VISIT HERE
WEDEN >> VISIT HERE

RDP brute force attack detected by fail2ban

Fail2Ban Ban Triggered

(mod_security) mod_security (id:920440) triggered by 23.129.64.151 (US/United States/-): 5 in the last 3600 secs

Dec 10 22:21:11 hanapaa sshd\[16283\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=asepmaulanaismail.com  user=root
Dec 10 22:21:13 hanapaa sshd\[16283\]: Failed password for root from 128.199.82.144 port 56494 ssh2
Dec 10 22:27:06 hanapaa sshd\[16792\]: Invalid user schnaithman from 128.199.82.144
Dec 10 22:27:06 hanapaa sshd\[16792\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=asepmaulanaismail.com
Dec 10 22:27:08 hanapaa sshd\[16792\]: Failed password for invalid user schnaithman from 128.199.82.144 port 34034 ssh2

Unauthorised access (Dec 11) SRC=172.126.155.149 LEN=40 TTL=241 ID=31647 DF TCP DPT=23 WINDOW=14600 SYN

Dec 10 23:54:02 shadeyouvpn sshd[31014]: reveeclipse mapping checking getaddrinfo for reveeclipse231.independent.ie [83.71.187.231] failed - POSSIBLE BREAK-IN ATTEMPT!
Dec 10 23:54:02 shadeyouvpn sshd[31014]: Invalid user dqzheng from 83.71.187.231
Dec 10 23:54:02 shadeyouvpn sshd[31014]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=83.71.187.231 
Dec 10 23:54:03 shadeyouvpn sshd[31014]: Failed password for invalid user dqzheng from 83.71.187.231 port 40356 ssh2
Dec 10 23:54:03 shadeyouvpn sshd[31014]: Received disconnect from 83.71.187.231: 11: Bye Bye [preauth]
Dec 10 23:57:07 shadeyouvpn sshd[452]: reveeclipse mapping checking getaddrinfo for reveeclipse231.independent.ie [83.71.187.231] failed - POSSIBLE BREAK-IN ATTEMPT!
Dec 10 23:57:07 shadeyouvpn sshd[452]: Invalid user dra from 83.71.187.231
Dec 10 23:57:07 shadeyouvpn sshd[452]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=83.........
-------------------------------

Unauthorised access (Dec 11) SRC=45.254.26.48 LEN=52 TTL=119 ID=943 DF TCP DPT=445 WINDOW=8192 SYN

Dec 11 08:35:17 fr01 sshd[28043]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.16.26  user=ftp
Dec 11 08:35:19 fr01 sshd[28043]: Failed password for ftp from 80.211.16.26 port 60812 ssh2
Dec 11 08:41:04 fr01 sshd[29135]: Invalid user phongsri from 80.211.16.26
Dec 11 08:41:04 fr01 sshd[29135]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.16.26
Dec 11 08:41:04 fr01 sshd[29135]: Invalid user phongsri from 80.211.16.26
Dec 11 08:41:06 fr01 sshd[29135]: Failed password for invalid user phongsri from 80.211.16.26 port 48248 ssh2
...