Jan 11 00:18:02 taivassalofi sshd[112439]: Failed password for root from 5.101.51.38 port 40392 ssh2
...

SSH Brute Force

(sshd) Failed SSH login from 5.101.51.99 (RU/Russia/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Oct 10 12:16:20 server2 sshd[29565]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.101.51.99  user=cpanel
Oct 10 12:16:22 server2 sshd[29565]: Failed password for cpanel from 5.101.51.99 port 42732 ssh2
Oct 10 12:24:57 server2 sshd[31803]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.101.51.99  user=root
Oct 10 12:24:58 server2 sshd[31803]: Failed password for root from 5.101.51.99 port 39712 ssh2
Oct 10 12:28:30 server2 sshd[32394]: Invalid user vagrant from 5.101.51.99 port 43214

5.101.51.97 - - [01/Sep/2020:05:23:45 +0100] "POST /wp-login.php HTTP/1.1" 200 2369 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
5.101.51.97 - - [01/Sep/2020:05:23:46 +0100] "POST /wp-login.php HTTP/1.1" 200 2341 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
5.101.51.97 - - [01/Sep/2020:05:23:47 +0100] "POST /xmlrpc.php HTTP/1.1" 403 219 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
...

5.101.51.97 - - [10/Aug/2020:14:08:17 +0200] "GET /wp-login.php HTTP/1.1" 200 1689 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
5.101.51.97 - - [10/Aug/2020:14:08:17 +0200] "POST /wp-login.php HTTP/1.1" 200 1811 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
5.101.51.97 - - [10/Aug/2020:14:08:18 +0200] "GET /wp-login.php HTTP/1.1" 200 1689 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
5.101.51.97 - - [10/Aug/2020:14:08:18 +0200] "POST /wp-login.php HTTP/1.1" 200 1790 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
5.101.51.97 - - [10/Aug/2020:14:08:19 +0200] "GET /wp-login.php HTTP/1.1" 200 1689 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
5.101.51.97 - - [10/Aug/2020:14:08:19 +0200] "POST /wp-login.php HTTP/1.1" 200 1790 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
...

WordPress wp-login brute force :: 5.101.51.97 0.108 - [09/Aug/2020:12:15:30  0000] [censored_1] "POST /wp-login.php HTTP/1.1" 200 1837 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" "HTTP/1.1"

5.101.51.97 - - [07/Aug/2020:21:32:55 +0100] "POST /wp-login.php HTTP/1.1" 200 1949 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
5.101.51.97 - - [07/Aug/2020:21:32:56 +0100] "POST /wp-login.php HTTP/1.1" 200 1924 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
5.101.51.97 - - [07/Aug/2020:21:32:57 +0100] "POST /xmlrpc.php HTTP/1.1" 200 247 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
...

postfix (unknown user, SPF fail or relay access denied)

Lines containing failures of 5.101.51.165
Apr 27 00:00:19 mellenthin sshd[30244]: Invalid user terrence from 5.101.51.165 port 58860
Apr 27 00:00:19 mellenthin sshd[30244]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.101.51.165
Apr 27 00:00:20 mellenthin sshd[30244]: Failed password for invalid user terrence from 5.101.51.165 port 58860 ssh2
Apr 27 00:00:20 mellenthin sshd[30244]: Received disconnect from 5.101.51.165 port 58860:11: Bye Bye [preauth]
Apr 27 00:00:20 mellenthin sshd[30244]: Disconnected from invalid user terrence 5.101.51.165 port 58860 [preauth]
Apr 27 00:11:37 mellenthin sshd[30686]: User r.r from 5.101.51.165 not allowed because not listed in AllowUsers
Apr 27 00:11:37 mellenthin sshd[30686]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.101.51.165  user=r.r
Apr 27 00:11:39 mellenthin sshd[30686]: Failed password for invalid user r.r from 5.101.51.165 port 40328 s........
------------------------------

Invalid user hj from 5.101.51.71 port 55434

Mar 22 22:59:15 www_kotimaassa_fi sshd[3165]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.101.51.48
Mar 22 22:59:17 www_kotimaassa_fi sshd[3165]: Failed password for invalid user ray from 5.101.51.48 port 46466 ssh2
...

Mar 20 21:13:36 reverseproxy sshd[12155]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.101.51.45
Mar 20 21:13:38 reverseproxy sshd[12155]: Failed password for invalid user sam from 5.101.51.45 port 59832 ssh2

Mar 17 21:58:43 web9 sshd\[14771\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.101.51.45  user=root
Mar 17 21:58:45 web9 sshd\[14771\]: Failed password for root from 5.101.51.45 port 35216 ssh2
Mar 17 22:02:52 web9 sshd\[15421\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.101.51.45  user=root
Mar 17 22:02:54 web9 sshd\[15421\]: Failed password for root from 5.101.51.45 port 47274 ssh2
Mar 17 22:07:12 web9 sshd\[16059\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.101.51.45  user=root

Mar 11 03:28:21 ns382633 sshd\[8016\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.101.51.124  user=root
Mar 11 03:28:23 ns382633 sshd\[8016\]: Failed password for root from 5.101.51.124 port 40510 ssh2
Mar 11 03:34:33 ns382633 sshd\[8961\]: Invalid user svn from 5.101.51.124 port 39454
Mar 11 03:34:33 ns382633 sshd\[8961\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.101.51.124
Mar 11 03:34:34 ns382633 sshd\[8961\]: Failed password for invalid user svn from 5.101.51.124 port 39454 ssh2

fail2ban

Mar  7 00:23:52 server sshd\[11984\]: Invalid user hyperic from 5.101.51.66
Mar  7 00:23:52 server sshd\[11984\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=katranlyubimec.ru 
Mar  7 00:23:53 server sshd\[11984\]: Failed password for invalid user hyperic from 5.101.51.66 port 55832 ssh2
Mar  7 01:02:21 server sshd\[20829\]: Invalid user s from 5.101.51.66
Mar  7 01:02:21 server sshd\[20829\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=katranlyubimec.ru 
...

Feb 28 16:46:55 vpn01 sshd[18304]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=110.12.8.10
Feb 28 16:46:57 vpn01 sshd[18304]: Failed password for invalid user help from 110.12.8.10 port 34592 ssh2
...

Feb 28 16:20:51 ArkNodeAT sshd\[17058\]: Invalid user david from 187.73.210.233
Feb 28 16:20:51 ArkNodeAT sshd\[17058\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.73.210.233
Feb 28 16:20:53 ArkNodeAT sshd\[17058\]: Failed password for invalid user david from 187.73.210.233 port 19217 ssh2

Feb 28 17:07:53 grey postfix/smtpd\[24434\]: NOQUEUE: reject: RCPT from unknown\[185.143.223.166\]: 554 5.7.1 Service unavailable\; Client host \[185.143.223.166\] blocked using truncate.gbudb.net\; http://www.gbudb.com/truncate/ \[185.143.223.166\]\; from=\<68brmw7uzm2r@bishopfeehan.com\> to=\ proto=ESMTP helo=\<\[185.143.223.170\]\>Feb 28 17:07:53 grey postfix/smtpd\[24434\]: NOQUEUE: reject: RCPT from unknown\[185.143.223.166\]: 554 5.7.1 Service unavailable\; Client host \[185.143.223.166\] blocked using truncate.gbudb.net\; http://www.gbudb.com/truncate/ \[185.143.223.166\]\; from=\<68brmw7uzm2r@bishopfeehan.com\> to=\ proto=ESMTP helo=\<\[185.143.223.170\]\>Feb 28 17:07:53 grey postfix/smtpd\[24434\]: NOQUEUE: reject: RCPT from unknown\[185.143.223.166\]: 554 5.7.1 Service unavailable\; Client host \[185.143.223.166\] blocked using truncate.gbudb.net\; http://www.gbudb.com/truncate/ \[185.143.223.166\]\; from=\<68brmw7uzm2r@bishopfeeha
...

Unauthorized connection attempt from IP address 176.88.249.35 on Port 445(SMB)

2020-02-28T15:17:25.874085abusebot-4.cloudsearch.cf sshd[26859]: Invalid user black from 130.162.66.249 port 13416
2020-02-28T15:17:25.880165abusebot-4.cloudsearch.cf sshd[26859]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=oc-130-162-66-249.compute.oraclecloud.com
2020-02-28T15:17:25.874085abusebot-4.cloudsearch.cf sshd[26859]: Invalid user black from 130.162.66.249 port 13416
2020-02-28T15:17:28.063191abusebot-4.cloudsearch.cf sshd[26859]: Failed password for invalid user black from 130.162.66.249 port 13416 ssh2
2020-02-28T15:25:58.568382abusebot-4.cloudsearch.cf sshd[27293]: Invalid user rr from 130.162.66.249 port 32589
2020-02-28T15:25:58.574348abusebot-4.cloudsearch.cf sshd[27293]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=oc-130-162-66-249.compute.oraclecloud.com
2020-02-28T15:25:58.568382abusebot-4.cloudsearch.cf sshd[27293]: Invalid user rr from 130.162.66.249 port 32589
2020-02-28T15:26
...

pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.30.76  user=root
Failed password for root from 222.186.30.76 port 18854 ssh2
Failed password for root from 222.186.30.76 port 18854 ssh2
Failed password for root from 222.186.30.76 port 18854 ssh2
pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.30.76  user=root

Unauthorized connection attempt from IP address 94.243.140.90 on Port 445(SMB)

20/2/28@08:31:29: FAIL: Alarm-Telnet address from=42.117.125.29
...

Feb 28 15:50:21 pornomens sshd\[15365\]: Invalid user rustserver from 196.27.127.61 port 57072
Feb 28 15:50:21 pornomens sshd\[15365\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=196.27.127.61
Feb 28 15:50:24 pornomens sshd\[15365\]: Failed password for invalid user rustserver from 196.27.127.61 port 57072 ssh2
...

Feb 28 14:26:29 srv-ubuntu-dev3 sshd[20533]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.189.209.143  user=root
Feb 28 14:26:31 srv-ubuntu-dev3 sshd[20533]: Failed password for root from 177.189.209.143 port 64930 ssh2
Feb 28 14:28:07 srv-ubuntu-dev3 sshd[20663]: Invalid user altibase from 177.189.209.143
Feb 28 14:28:07 srv-ubuntu-dev3 sshd[20663]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.189.209.143
Feb 28 14:28:07 srv-ubuntu-dev3 sshd[20663]: Invalid user altibase from 177.189.209.143
Feb 28 14:28:10 srv-ubuntu-dev3 sshd[20663]: Failed password for invalid user altibase from 177.189.209.143 port 42689 ssh2
Feb 28 14:29:49 srv-ubuntu-dev3 sshd[20787]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.189.209.143  user=root
Feb 28 14:29:51 srv-ubuntu-dev3 sshd[20787]: Failed password for root from 177.189.209.143 port 27234 ssh2
Feb 28 14:31:32 s
...

Feb 28 15:38:17 nextcloud sshd\[16149\]: Invalid user minecraft from 111.231.142.79
Feb 28 15:38:17 nextcloud sshd\[16149\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.142.79
Feb 28 15:38:19 nextcloud sshd\[16149\]: Failed password for invalid user minecraft from 111.231.142.79 port 39530 ssh2

kp-sea2-01 recorded 2 login violations from 103.120.168.126 and was blocked at 2020-02-28 13:31:21. 103.120.168.126 has been blocked on 0 previous occasions. 103.120.168.126's first attempt was recorded at 2020-02-28 13:31:21

Unauthorized connection attempt from IP address 183.82.0.20 on Port 445(SMB)

SSH bruteforce

Feb 28 15:44:42 server sshd[2390052]: Failed password for invalid user direction from 150.223.17.130 port 59990 ssh2
Feb 28 16:11:01 server sshd[2395557]: Failed password for invalid user atan from 150.223.17.130 port 47271 ssh2
Feb 28 16:28:50 server sshd[2399334]: Failed password for invalid user kiban01 from 150.223.17.130 port 48202 ssh2