spam

Honeypot attack, port: 445, PTR: static-200-94-21-27.alestra.net.mx.

(sshd) Failed SSH login from 218.245.1.169 (CN/China/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Sep  7 08:33:37 amsweb01 sshd[6756]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.245.1.169  user=root
Sep  7 08:33:39 amsweb01 sshd[6756]: Failed password for root from 218.245.1.169 port 57818 ssh2
Sep  7 08:38:45 amsweb01 sshd[7474]: Invalid user helper from 218.245.1.169 port 49957
Sep  7 08:38:48 amsweb01 sshd[7474]: Failed password for invalid user helper from 218.245.1.169 port 49957 ssh2
Sep  7 08:41:59 amsweb01 sshd[8273]: Invalid user dbadmin from 218.245.1.169 port 52871

Sep  7 10:52:00 ns382633 sshd\[19205\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.22.212.99  user=root
Sep  7 10:52:02 ns382633 sshd\[19205\]: Failed password for root from 123.22.212.99 port 64323 ssh2
Sep  7 11:02:07 ns382633 sshd\[21020\]: Invalid user kosmos from 123.22.212.99 port 58254
Sep  7 11:02:07 ns382633 sshd\[21020\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.22.212.99
Sep  7 11:02:10 ns382633 sshd\[21020\]: Failed password for invalid user kosmos from 123.22.212.99 port 58254 ssh2

Sep  7 12:48:16 vpn01 sshd[2965]: Failed password for root from 192.42.116.20 port 50110 ssh2
Sep  7 12:48:28 vpn01 sshd[2965]: error: maximum authentication attempts exceeded for root from 192.42.116.20 port 50110 ssh2 [preauth]
...

Port probing on unauthorized port 8080

Sep  6 18:20:59 cumulus sshd[19143]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.69.68.6  user=r.r
Sep  6 18:21:01 cumulus sshd[19143]: Failed password for r.r from 103.69.68.6 port 41425 ssh2
Sep  6 18:21:01 cumulus sshd[19143]: Received disconnect from 103.69.68.6 port 41425:11: Bye Bye [preauth]
Sep  6 18:21:01 cumulus sshd[19143]: Disconnected from 103.69.68.6 port 41425 [preauth]
Sep  6 18:38:30 cumulus sshd[20660]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.69.68.6  user=r.r
Sep  6 18:38:31 cumulus sshd[20660]: Failed password for r.r from 103.69.68.6 port 34637 ssh2
Sep  6 18:38:32 cumulus sshd[20660]: Received disconnect from 103.69.68.6 port 34637:11: Bye Bye [preauth]
Sep  6 18:38:32 cumulus sshd[20660]: Disconnected from 103.69.68.6 port 34637 [preauth]
Sep  6 18:39:32 cumulus sshd[20847]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ........
-------------------------------

2020-09-07T12:16:11.618297abusebot-4.cloudsearch.cf sshd[18452]: Invalid user admin from 141.98.9.163 port 34499
2020-09-07T12:16:11.624976abusebot-4.cloudsearch.cf sshd[18452]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=141.98.9.163
2020-09-07T12:16:11.618297abusebot-4.cloudsearch.cf sshd[18452]: Invalid user admin from 141.98.9.163 port 34499
2020-09-07T12:16:13.976495abusebot-4.cloudsearch.cf sshd[18452]: Failed password for invalid user admin from 141.98.9.163 port 34499 ssh2
2020-09-07T12:16:32.113233abusebot-4.cloudsearch.cf sshd[18464]: Invalid user test from 141.98.9.163 port 43637
2020-09-07T12:16:32.118881abusebot-4.cloudsearch.cf sshd[18464]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=141.98.9.163
2020-09-07T12:16:32.113233abusebot-4.cloudsearch.cf sshd[18464]: Invalid user test from 141.98.9.163 port 43637
2020-09-07T12:16:34.018756abusebot-4.cloudsearch.cf sshd[18464]: Failed password
...

Sep  7 14:21:24 vm0 sshd[11232]: Failed password for root from 51.158.111.157 port 57708 ssh2
Sep  7 14:21:37 vm0 sshd[11232]: error: maximum authentication attempts exceeded for root from 51.158.111.157 port 57708 ssh2 [preauth]
...

Sep  7 02:42:34 web9 sshd\[1422\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.169.192  user=root
Sep  7 02:42:37 web9 sshd\[1422\]: Failed password for root from 222.186.169.192 port 9752 ssh2
Sep  7 02:42:40 web9 sshd\[1422\]: Failed password for root from 222.186.169.192 port 9752 ssh2
Sep  7 02:42:42 web9 sshd\[1422\]: Failed password for root from 222.186.169.192 port 9752 ssh2
Sep  7 02:42:46 web9 sshd\[1422\]: Failed password for root from 222.186.169.192 port 9752 ssh2

171.221.210.158 (CN/China/-), 6 distributed sshd attacks on account [root] in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_DISTATTACK; Logs: Sep  7 06:07:18 server5 sshd[13322]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.16.211.200  user=root
Sep  7 06:12:34 server5 sshd[15818]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=171.221.210.158  user=root
Sep  7 06:06:23 server5 sshd[12620]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.20.90.63  user=root
Sep  7 06:06:25 server5 sshd[12620]: Failed password for root from 14.20.90.63 port 35774 ssh2
Sep  7 06:10:57 server5 sshd[15029]: Failed password for root from 144.34.193.83 port 60898 ssh2
Sep  7 06:07:19 server5 sshd[13322]: Failed password for root from 112.16.211.200 port 51734 ssh2

IP Addresses Blocked:

112.16.211.200 (CN/China/-)

Wordpress attack

(imapd) Failed IMAP login from 184.185.236.72 (US/United States/ip184-185-236-72.rn.hr.cox.net): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Sep  7 13:21:37 ir1 dovecot[3110802]: imap-login: Disconnected (auth failed, 1 attempts in 5 secs): user=, method=PLAIN, rip=184.185.236.72, lip=5.63.12.44, TLS, session=

Honeypot attack, port: 445, PTR: bkbrasil-G2-0-2-142-iacc01.cas.embratel.net.br.

SSH login attempts.