"XSS Attack Detected via libinjection - Matched Data: XSS data found within ARGS_NAMES:

SSH Brute-Force attacks

(pop3d) Failed POP3 login from 89.248.172.123 (NL/Netherlands/no-reverse-dns-configured.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Jun  9 16:39:06 ir1 dovecot[2885757]: pop3-login: Aborted login (auth failed, 1 attempts in 2 secs): user=, method=PLAIN, rip=89.248.172.123, lip=5.63.12.44, session=

[MK-VM4] Blocked by UFW

Jun  9 17:35:21 dhoomketu sshd[601752]: Failed password for root from 51.255.30.7 port 53646 ssh2
Jun  9 17:38:49 dhoomketu sshd[601826]: Invalid user youtrack from 51.255.30.7 port 56954
Jun  9 17:38:49 dhoomketu sshd[601826]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.255.30.7 
Jun  9 17:38:49 dhoomketu sshd[601826]: Invalid user youtrack from 51.255.30.7 port 56954
Jun  9 17:38:50 dhoomketu sshd[601826]: Failed password for invalid user youtrack from 51.255.30.7 port 56954 ssh2
...

Jun  9 14:02:35 h2779839 sshd[12167]: Invalid user factorio from 124.156.132.183 port 52618
Jun  9 14:02:35 h2779839 sshd[12167]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=124.156.132.183
Jun  9 14:02:35 h2779839 sshd[12167]: Invalid user factorio from 124.156.132.183 port 52618
Jun  9 14:02:37 h2779839 sshd[12167]: Failed password for invalid user factorio from 124.156.132.183 port 52618 ssh2
Jun  9 14:05:51 h2779839 sshd[12225]: Invalid user zhusengbin from 124.156.132.183 port 47208
Jun  9 14:05:51 h2779839 sshd[12225]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=124.156.132.183
Jun  9 14:05:51 h2779839 sshd[12225]: Invalid user zhusengbin from 124.156.132.183 port 47208
Jun  9 14:05:53 h2779839 sshd[12225]: Failed password for invalid user zhusengbin from 124.156.132.183 port 47208 ssh2
Jun  9 14:09:08 h2779839 sshd[12350]: Invalid user charlene from 124.156.132.183 port 41798
...

Jun  9 14:04:36 eventyay sshd[20822]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.199.41.211
Jun  9 14:04:38 eventyay sshd[20822]: Failed password for invalid user auditor from 113.199.41.211 port 24587 ssh2
Jun  9 14:08:48 eventyay sshd[20966]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.199.41.211
...

Jun  9 08:06:54 ny01 sshd[24891]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.134.15.194
Jun  9 08:06:55 ny01 sshd[24891]: Failed password for invalid user Pa$$ from 181.134.15.194 port 36848 ssh2
Jun  9 08:08:52 ny01 sshd[25162]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.134.15.194

Probing for prohibited files and paths.

Dovecot Invalid User Login Attempt.

Jun  9 17:41:25 dhoomketu sshd[601972]: Invalid user benutzer from 149.202.150.128 port 59118
Jun  9 17:41:25 dhoomketu sshd[601972]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=149.202.150.128 
Jun  9 17:41:25 dhoomketu sshd[601972]: Invalid user benutzer from 149.202.150.128 port 59118
Jun  9 17:41:28 dhoomketu sshd[601972]: Failed password for invalid user benutzer from 149.202.150.128 port 59118 ssh2
Jun  9 17:44:41 dhoomketu sshd[602036]: Invalid user tech from 149.202.150.128 port 33062
...

2020-06-09T12:37:17.052857shield sshd\[16416\]: Invalid user admin from 141.98.9.157 port 41885
2020-06-09T12:37:17.057877shield sshd\[16416\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=141.98.9.157
2020-06-09T12:37:19.508793shield sshd\[16416\]: Failed password for invalid user admin from 141.98.9.157 port 41885 ssh2
2020-06-09T12:37:57.525470shield sshd\[16620\]: Invalid user test from 141.98.9.157 port 41581
2020-06-09T12:37:57.530008shield sshd\[16620\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=141.98.9.157

Jun  9 04:11:34 datentool sshd[24735]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.194.80.7  user=r.r
Jun  9 04:11:37 datentool sshd[24735]: Failed password for r.r from 222.194.80.7 port 56948 ssh2
Jun  9 04:11:44 datentool sshd[24735]: Failed password for r.r from 222.194.80.7 port 56948 ssh2
Jun  9 04:11:46 datentool sshd[24735]: Failed password for r.r from 222.194.80.7 port 56948 ssh2
Jun  9 04:11:49 datentool sshd[24735]: Failed password for r.r from 222.194.80.7 port 56948 ssh2
Jun  9 04:12:02 datentool sshd[24735]: PAM 3 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.194.80.7  user=r.r
Jun  9 04:12:04 datentool sshd[24753]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.194.80.7  user=r.r
Jun  9 04:12:06 datentool sshd[24753]: Failed password for r.r from 222.194.80.7 port 56948 ssh2
Jun  9 04:12:12 datentool sshd[24753]: Failed password for........
-------------------------------

2020-06-09T11:58:54.542802abusebot.cloudsearch.cf sshd[25803]: Invalid user tovana from 211.159.147.188 port 43608
2020-06-09T11:58:54.548894abusebot.cloudsearch.cf sshd[25803]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.159.147.188
2020-06-09T11:58:54.542802abusebot.cloudsearch.cf sshd[25803]: Invalid user tovana from 211.159.147.188 port 43608
2020-06-09T11:58:56.503230abusebot.cloudsearch.cf sshd[25803]: Failed password for invalid user tovana from 211.159.147.188 port 43608 ssh2
2020-06-09T12:05:32.420563abusebot.cloudsearch.cf sshd[26227]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.159.147.188  user=root
2020-06-09T12:05:34.348567abusebot.cloudsearch.cf sshd[26227]: Failed password for root from 211.159.147.188 port 41218 ssh2
2020-06-09T12:08:47.669869abusebot.cloudsearch.cf sshd[26422]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.159.1
...

SSH Brute Force