Jun 28 05:39:36 mail sshd[16840]: Failed password for invalid user teamspeak from 118.89.69.159 port 46604 ssh2
...

Jun 27 22:13:12 mockhub sshd[26251]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.98.213.14
Jun 27 22:13:14 mockhub sshd[26251]: Failed password for invalid user debian from 14.98.213.14 port 49620 ssh2
...

Invalid user fw from 177.184.216.30 port 33028

2020-06-28T00:11:17.562272morrigan.ad5gb.com sshd[1659565]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=40.115.187.141  user=root
2020-06-28T00:11:17.564871morrigan.ad5gb.com sshd[1659564]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=40.115.187.141  user=root

Unauthorised connection attempt detected at AUO MAIN. System is sshd. Protected by AUO Stack Web Application Firewall (WAF)

(From stubbs.alejandro@outlook.com) Hello,

I’m David Domine, owner of Louisville Historic Tours that operates here in Old Louisville, Kentucky.  
Like many businesses, I’m sure you and your employees have probably been stuck at home because of the Kentucky-wide lockdown. Most restaurants and bars still aren’t accepting large groups. This is making get-togethers or outside team building exercises currently impossible. 

That’s why I’m reaching out today.  I run a Daytime Walking Tour and a Nighttime Ghost Tour right here in Louisville.  Since our tours are outside, we are operating fully, and we are able to take groups of people (as long as we follow the social distancing guidelines.)

I’ve had a huge increase in the amount of organizations booking private tours for their employees since everyone is looking for a way to get together.  I wanted to reach out to you about the same possibility.    

Here’s the Daytime Walking Tour:

https://bit.ly/DaytimeWalkingTour

And here’s a bit of detail on the

 TCP (SYN) 23.253.109.27:52433 -> port 23620, len 44

Jun 28 03:52:41 game-panel sshd[26577]: Failed password for root from 193.200.241.195 port 47394 ssh2
Jun 28 03:55:54 game-panel sshd[26817]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.200.241.195
Jun 28 03:55:55 game-panel sshd[26817]: Failed password for invalid user usuario from 193.200.241.195 port 47820 ssh2

Dovecot Invalid User Login Attempt.

Invalid user postgres from 112.196.54.35 port 47076

C2,WP GET /staging/wp-includes/wlwmanifest.xml

Jun 28 13:00:50 itachi1706steam sshd[120552]: Did not receive identification string from 87.251.74.48 port 14588
Jun 28 13:00:55 itachi1706steam sshd[120554]: Connection closed by authenticating user root 87.251.74.48 port 64520 [preauth]
Jun 28 13:00:56 itachi1706steam sshd[120553]: Connection closed by authenticating user root 87.251.74.48 port 26228 [preauth]
...

SSH Brute-Forcing (server2)

Jun 27 09:21:16 Tower sshd[18369]: refused connect from 49.233.147.108 (49.233.147.108)
Jun 28 00:25:23 Tower sshd[18369]: Connection from 51.75.29.61 port 51414 on 192.168.10.220 port 22 rdomain ""
Jun 28 00:25:24 Tower sshd[18369]: Invalid user haresh from 51.75.29.61 port 51414
Jun 28 00:25:24 Tower sshd[18369]: error: Could not get shadow information for NOUSER
Jun 28 00:25:24 Tower sshd[18369]: Failed password for invalid user haresh from 51.75.29.61 port 51414 ssh2
Jun 28 00:25:24 Tower sshd[18369]: Received disconnect from 51.75.29.61 port 51414:11: Bye Bye [preauth]
Jun 28 00:25:24 Tower sshd[18369]: Disconnected from invalid user haresh 51.75.29.61 port 51414 [preauth]

$f2bV_matches