(sshd) Failed SSH login from 151.16.52.6 (IT/Italy/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Feb  4 20:32:25 elude sshd[26899]: Invalid user uploader from 151.16.52.6 port 60808
Feb  4 20:32:28 elude sshd[26899]: Failed password for invalid user uploader from 151.16.52.6 port 60808 ssh2
Feb  4 20:47:10 elude sshd[27635]: Invalid user dominique from 151.16.52.6 port 46154
Feb  4 20:47:12 elude sshd[27635]: Failed password for invalid user dominique from 151.16.52.6 port 46154 ssh2
Feb  4 20:55:34 elude sshd[28065]: Invalid user omikawa from 151.16.52.6 port 48118

SQL injection:/newsites/free/pierre/search/searchSVI.php?continentName=EU+-6863+union+all+select+CONCAT(0x3a6f79753a,0x4244764877697569706b,0x3a70687a3a)1,1,1,1,1,1,1,1,1%23&country=276+&prj_typ=all&startdate=&enddate=&from=&page=1&searchSubmission=Recherche

Feb  4 21:07:38 relay postfix/smtpd\[2997\]: warning: unknown\[185.211.245.170\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Feb  4 21:07:45 relay postfix/smtpd\[2995\]: warning: unknown\[185.211.245.170\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Feb  4 21:15:02 relay postfix/smtpd\[6329\]: warning: unknown\[185.211.245.170\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Feb  4 21:15:09 relay postfix/smtpd\[3045\]: warning: unknown\[185.211.245.170\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Feb  4 21:21:02 relay postfix/smtpd\[15047\]: warning: unknown\[185.211.245.170\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
...

Honeypot attack, port: 445, PTR: PTR record not found

Lines containing failures of 123.20.11.246
Feb  4 21:02:14 jarvis sshd[24588]: Invalid user admin from 123.20.11.246 port 53673
Feb  4 21:02:14 jarvis sshd[24588]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.20.11.246 
Feb  4 21:02:16 jarvis sshd[24588]: Failed password for invalid user admin from 123.20.11.246 port 53673 ssh2
Feb  4 21:02:19 jarvis sshd[24588]: Connection closed by invalid user admin 123.20.11.246 port 53673 [preauth]
Feb  4 21:02:23 jarvis sshd[24590]: Invalid user admin from 123.20.11.246 port 47424
Feb  4 21:02:23 jarvis sshd[24590]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.20.11.246 
Feb  4 21:02:26 jarvis sshd[24590]: Failed password for invalid user admin from 123.20.11.246 port 47424 ssh2


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=123.20.11.246

Feb  4 21:08:48 srv206 sshd[30516]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.175.212  user=root
Feb  4 21:08:51 srv206 sshd[30516]: Failed password for root from 222.186.175.212 port 18102 ssh2
...

Feb  4 10:19:04 hpm sshd\[17315\]: Invalid user qwerty123456 from 94.191.78.128
Feb  4 10:19:04 hpm sshd\[17315\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.191.78.128
Feb  4 10:19:06 hpm sshd\[17315\]: Failed password for invalid user qwerty123456 from 94.191.78.128 port 39554 ssh2
Feb  4 10:21:02 hpm sshd\[17514\]: Invalid user @abc123 from 94.191.78.128
Feb  4 10:21:02 hpm sshd\[17514\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.191.78.128

Unauthorized connection attempt detected from IP address 119.252.143.68 to port 2220 [J]

2019-02-28 19:18:57 H=electric.farzamlift.com \(stir.appaie.icu\) \[134.209.1.111\]:57221 I=\[193.107.88.166\]:25 sender verify fail for \: Unrouteable address
2019-02-28 19:18:57 H=electric.farzamlift.com \(stir.appaie.icu\) \[134.209.1.111\]:57221 I=\[193.107.88.166\]:25 F=\ rejected RCPT \: Sender verify failed
2019-02-28 19:18:57 H=electric.farzamlift.com \(wild.appaie.icu\) \[134.209.1.111\]:52218 I=\[193.107.88.166\]:25 sender verify fail for \: Unrouteable address
2019-02-28 19:18:57 H=electric.farzamlift.com \(wild.appaie.icu\) \[134.209.1.111\]:52218 I=\[193.107.88.166\]:25 F=\ rejected RCPT \: Sender verify failed
2019-03-01 16:44:56 1gzkLI-0001GN-GN SMTP connection from electric.farzamlift.com \(countess.ofqnews.icu\) \[134.209.1.111\]:35892 I=\[193.107.88.166\]:25 closed by DROP in ACL
2019-03-01 16:44:56 1gzkLI-0001GM-GN SMTP connec
...

Feb  4 14:47:59 grey postfix/smtpd\[26474\]: NOQUEUE: reject: RCPT from unknown\[39.40.53.60\]: 554 5.7.1 Service unavailable\; Client host \[39.40.53.60\] blocked using cbl.abuseat.org\; Blocked - see http://www.abuseat.org/lookup.cgi\?ip=39.40.53.60\; from=\ to=\ proto=ESMTP helo=\<\[39.40.53.60\]\>
...

Feb  4 21:18:48 sd-53420 sshd\[20790\]: User root from 171.34.173.17 not allowed because none of user's groups are listed in AllowGroups
Feb  4 21:18:48 sd-53420 sshd\[20790\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=171.34.173.17  user=root
Feb  4 21:18:50 sd-53420 sshd\[20790\]: Failed password for invalid user root from 171.34.173.17 port 39806 ssh2
Feb  4 21:21:05 sd-53420 sshd\[21019\]: User root from 171.34.173.17 not allowed because none of user's groups are listed in AllowGroups
Feb  4 21:21:05 sd-53420 sshd\[21019\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=171.34.173.17  user=root
...

Unauthorized connection attempt detected from IP address 222.186.15.158 to port 22 [J]

Unauthorized connection attempt detected from IP address 202.51.111.225 to port 2220 [J]

Honeypot attack, port: 445, PTR: 219-81-64-10.static.tfn.net.tw.

Feb  4 14:47:49 grey postfix/smtpd\[26006\]: NOQUEUE: reject: RCPT from unknown\[117.96.251.130\]: 554 5.7.1 Service unavailable\; Client host \[117.96.251.130\] blocked using cbl.abuseat.org\; Blocked - see http://www.abuseat.org/lookup.cgi\?ip=117.96.251.130\; from=\ to=\ proto=ESMTP helo=\
...