2020-08-07T14:02:44.484997amanda2.illicoweb.com sshd\[43402\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=host-212-18-22-236.customer.m-online.net  user=root
2020-08-07T14:02:47.044682amanda2.illicoweb.com sshd\[43402\]: Failed password for root from 212.18.22.236 port 34696 ssh2
2020-08-07T14:04:36.186799amanda2.illicoweb.com sshd\[43650\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=host-212-18-22-236.customer.m-online.net  user=root
2020-08-07T14:04:38.455320amanda2.illicoweb.com sshd\[43650\]: Failed password for root from 212.18.22.236 port 46232 ssh2
2020-08-07T14:06:24.704813amanda2.illicoweb.com sshd\[44024\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=host-212-18-22-236.customer.m-online.net  user=root
...

(imapd) Failed IMAP login from 189.59.5.81 (BR/Brazil/centershop.static.gvt.net.br): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Aug  7 16:35:56 ir1 dovecot[3110802]: imap-login: Disconnected (auth failed, 1 attempts in 10 secs): user=, method=PLAIN, rip=189.59.5.81, lip=5.63.12.44, TLS, session=

2020-08-07 17:13:21 dovecot_login authenticator failed for \(\[5.188.206.197\]\) \[5.188.206.197\]: 535 Incorrect authentication data \(set_id=postmaster@nophost.com\)
2020-08-07 17:13:30 dovecot_login authenticator failed for \(\[5.188.206.197\]\) \[5.188.206.197\]: 535 Incorrect authentication data
2020-08-07 17:13:41 dovecot_login authenticator failed for \(\[5.188.206.197\]\) \[5.188.206.197\]: 535 Incorrect authentication data
2020-08-07 17:13:57 dovecot_login authenticator failed for \(\[5.188.206.197\]\) \[5.188.206.197\]: 535 Incorrect authentication data
2020-08-07 17:14:00 dovecot_login authenticator failed for \(\[5.188.206.197\]\) \[5.188.206.197\]: 535 Incorrect authentication data \(set_id=postmaster\)

2020-08-07T13:57:29.916332amanda2.illicoweb.com sshd\[42471\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=99-185-76-161.lightspeed.clmasc.sbcglobal.net  user=root
2020-08-07T13:57:31.898821amanda2.illicoweb.com sshd\[42471\]: Failed password for root from 99.185.76.161 port 47794 ssh2
2020-08-07T14:02:18.746684amanda2.illicoweb.com sshd\[43334\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=99-185-76-161.lightspeed.clmasc.sbcglobal.net  user=root
2020-08-07T14:02:20.865396amanda2.illicoweb.com sshd\[43334\]: Failed password for root from 99.185.76.161 port 43456 ssh2
2020-08-07T14:05:43.629543amanda2.illicoweb.com sshd\[43940\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=99-185-76-161.lightspeed.clmasc.sbcglobal.net  user=root
...

Unauthorized connection attempt from IP address 192.241.234.107 on Port 139(NETBIOS)

 TCP (SYN) 156.96.128.222:48011 -> port 443, len 44

Aug  7 14:20:10 localhost sshd[26556]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.172.196.255  user=root
Aug  7 14:20:12 localhost sshd[26556]: Failed password for root from 167.172.196.255 port 62790 ssh2
Aug  7 14:24:34 localhost sshd[26981]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.172.196.255  user=root
Aug  7 14:24:37 localhost sshd[26981]: Failed password for root from 167.172.196.255 port 21530 ssh2
Aug  7 14:28:48 localhost sshd[27367]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.172.196.255  user=root
Aug  7 14:28:50 localhost sshd[27367]: Failed password for root from 167.172.196.255 port 35270 ssh2
...

SSH Brute Force

Aug  7 17:08:43 ucs sshd\[3005\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.42.155  user=root
Aug  7 17:08:46 ucs sshd\[3001\]: error: PAM: User not known to the underlying authentication module for root from 222.186.42.155
Aug  7 17:08:47 ucs sshd\[3009\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.42.155  user=root
...

(sshd) Failed SSH login from 190.255.222.2 (CO/Colombia/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Aug  7 15:17:17 amsweb01 sshd[26812]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.255.222.2  user=root
Aug  7 15:17:19 amsweb01 sshd[26812]: Failed password for root from 190.255.222.2 port 50416 ssh2
Aug  7 15:29:00 amsweb01 sshd[28200]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.255.222.2  user=root
Aug  7 15:29:02 amsweb01 sshd[28200]: Failed password for root from 190.255.222.2 port 60093 ssh2
Aug  7 15:36:25 amsweb01 sshd[29280]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.255.222.2  user=root

Aug  7 16:29:18 minden010 sshd[6269]: Failed password for root from 222.186.180.147 port 15202 ssh2
Aug  7 16:29:21 minden010 sshd[6269]: Failed password for root from 222.186.180.147 port 15202 ssh2
Aug  7 16:29:25 minden010 sshd[6269]: Failed password for root from 222.186.180.147 port 15202 ssh2
Aug  7 16:29:29 minden010 sshd[6269]: Failed password for root from 222.186.180.147 port 15202 ssh2
...

2020-08-07T14:30:02.124864shield sshd\[12342\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=school.asazs.co.uk  user=root
2020-08-07T14:30:03.998207shield sshd\[12342\]: Failed password for root from 80.244.179.6 port 51420 ssh2
2020-08-07T14:33:17.555643shield sshd\[12627\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=school.asazs.co.uk  user=root
2020-08-07T14:33:19.530047shield sshd\[12627\]: Failed password for root from 80.244.179.6 port 46382 ssh2
2020-08-07T14:36:36.920445shield sshd\[12833\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=school.asazs.co.uk  user=root

Aug  7 16:31:22 ip40 sshd[24028]: Failed password for root from 218.92.0.250 port 16254 ssh2
Aug  7 16:31:28 ip40 sshd[24028]: Failed password for root from 218.92.0.250 port 16254 ssh2
...

 TCP (SYN) 1.160.129.170:25751 -> port 2323, len 40

Aug  7 12:04:59 baguette sshd\[25487\]: Invalid user minecraft from 202.70.66.228 port 52416
Aug  7 12:04:59 baguette sshd\[25487\]: Invalid user minecraft from 202.70.66.228 port 52416
Aug  7 12:05:19 baguette sshd\[25492\]: Invalid user minecraft from 202.70.66.228 port 53993
Aug  7 12:05:19 baguette sshd\[25492\]: Invalid user minecraft from 202.70.66.228 port 53993
Aug  7 12:05:38 baguette sshd\[25494\]: Invalid user ubuntu from 202.70.66.228 port 55624
Aug  7 12:05:38 baguette sshd\[25494\]: Invalid user ubuntu from 202.70.66.228 port 55624
...