Jun 11 07:32:15 ns382633 sshd\[1435\]: Invalid user NetLinx from 191.242.188.142 port 37110
Jun 11 07:32:15 ns382633 sshd\[1435\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=191.242.188.142
Jun 11 07:32:17 ns382633 sshd\[1435\]: Failed password for invalid user NetLinx from 191.242.188.142 port 37110 ssh2
Jun 11 07:40:50 ns382633 sshd\[3010\]: Invalid user yx from 191.242.188.142 port 57130
Jun 11 07:40:50 ns382633 sshd\[3010\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=191.242.188.142

SSH/22 MH Probe, BF, Hack -

\[Jun 11 17:43:09\] NOTICE\[2019\] chan_sip.c: Registration from '"250" \' failed for '103.145.12.125:6419' - Wrong password
\[Jun 11 17:43:10\] NOTICE\[2019\] chan_sip.c: Registration from '"250" \' failed for '103.145.12.125:6419' - Wrong password
\[Jun 11 17:43:10\] NOTICE\[2019\] chan_sip.c: Registration from '"250" \' failed for '103.145.12.125:6419' - Wrong password
\[Jun 11 17:43:10\] NOTICE\[2019\] chan_sip.c: Registration from '"250" \' failed for '103.145.12.125:6419' - Wrong password
\[Jun 11 17:43:10\] NOTICE\[2019\] chan_sip.c: Registration from '"250" \' failed for '103.145.12.125:6419' - Wrong password
\[Jun 11 17:43:10\] NOTICE\[2019\] chan_sip.c: Registration from '"250" \' failed for '103.145.12.125:6419' - Wrong password
\[Jun 11 17:43:10\] NOTICE\[2019\] chan_sip.c: Registration from '"250" \

Jun 11 12:40:51 webhost01 sshd[7048]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.186.67.159
Jun 11 12:40:53 webhost01 sshd[7048]: Failed password for invalid user student from 139.186.67.159 port 43378 ssh2
...

[Thu Jun 11 10:53:54.610222 2020] [:error] [pid 1504:tid 140208259458816] [client 66.249.73.166:57222] [client 66.249.73.166] ModSecurity: Access denied with code 403 (phase 2). Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/modsecurity/owasp-modsecurity-crs-3.2.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "696"] [id "920350"] [msg "Host header is a numeric IP address"] [data "103.27.207.197"] [severity "WARNING"] [ver "OWASP_CRS/3.2.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/IP_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "karangploso.jatim.bmkg.go.id"] [uri "/index.php/prakiraan-iklim/agroklimatologi/kalender-tanam/3766-kalender-tanam-katam-terpadu-pulau-sulawesi/kalender-tanam-katam-terpadu-provinsi-sulawesi-selatan/kalender-tanam-katam-terpadu-kabupaten-bone-provinsi-sulawesi-selatan/kalender-tanam-katam-terp
...

Jun 11 07:57:02 haigwepa sshd[9854]: Failed password for root from 111.229.232.224 port 52768 ssh2
Jun 11 08:00:55 haigwepa sshd[10130]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.229.232.224 
...

Jun 11 02:16:29 ny01 sshd[29421]: Failed password for root from 203.192.219.201 port 54918 ssh2
Jun 11 02:18:39 ny01 sshd[29708]: Failed password for root from 203.192.219.201 port 57486 ssh2

06/11/2020-03:33:34.385443 185.176.27.98 Protocol: 6 ET DROP Dshield Block Listed Source group 1

Jun 11 07:50:35 pornomens sshd\[19410\]: Invalid user ob from 203.166.206.74 port 37673
Jun 11 07:50:35 pornomens sshd\[19410\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.166.206.74
Jun 11 07:50:36 pornomens sshd\[19410\]: Failed password for invalid user ob from 203.166.206.74 port 37673 ssh2
...

Jun  9 01:37:13 www sshd[6673]: Invalid user abigale from 49.233.32.169
Jun  9 01:37:13 www sshd[6673]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.233.32.169 
Jun  9 01:37:15 www sshd[6673]: Failed password for invalid user abigale from 49.233.32.169 port 41058 ssh2
Jun  9 01:37:15 www sshd[6673]: Received disconnect from 49.233.32.169: 11: Bye Bye [preauth]
Jun  9 01:44:41 www sshd[6767]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.233.32.169  user=r.r
Jun  9 01:44:43 www sshd[6767]: Failed password for r.r from 49.233.32.169 port 59364 ssh2
Jun  9 01:44:43 www sshd[6767]: Received disconnect from 49.233.32.169: 11: Bye Bye [preauth]
Jun  9 01:49:27 www sshd[6813]: Connection closed by 49.233.32.169 [preauth]
Jun  9 01:53:40 www sshd[6925]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.233.32.169  user=r.r
Jun  9 01:53:42 www sshd[........
-------------------------------

2020-06-11T05:53:34+0200 Failed SSH Authentication/Brute Force Attack. (Server 5)

Jun 11 07:51:57 sigma sshd\[21141\]: Failed password for root from 205.185.113.140 port 36766 ssh2Jun 11 08:07:43 sigma sshd\[21388\]: Invalid user beginner from 205.185.113.140
...

Jun 11 08:04:45 onepixel sshd[346804]: Failed password for invalid user wv from 54.37.136.87 port 44554 ssh2
Jun 11 08:08:01 onepixel sshd[347199]: Invalid user odoo from 54.37.136.87 port 46174
Jun 11 08:08:01 onepixel sshd[347199]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.37.136.87 
Jun 11 08:08:01 onepixel sshd[347199]: Invalid user odoo from 54.37.136.87 port 46174
Jun 11 08:08:02 onepixel sshd[347199]: Failed password for invalid user odoo from 54.37.136.87 port 46174 ssh2

" "

SSH Brute-Force Attack