[SatJun2920:48:28.0520392019][:error][pid29926:tid47129061897984][client51.75.169.169:52558][client51.75.169.169]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch"python-requests/"atREQUEST_HEADERS:User-Agent.[file"/etc/apache2/conf.d/modsec_rules/20_asl_useragents.conf"][line"206"][id"332039"][rev"4"][msg"Atomicorp.comWAFRules:SuspiciousUnusualUserAgent\(python-requests\).Disablethisruleifyouusepython-requests/."][severity"CRITICAL"][hostname"archivioamarca.ch"][uri"/administrator/index.php"][unique_id"XReyfJfcWKlFwIVqgC7m5wAAAI0"][SatJun2920:48:28.3314512019][:error][pid29922:tid47129072404224][client51.75.169.169:52712][client51.75.169.169]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch"python-requests/"atREQUEST_HEADERS:User-Agent.[file"/etc/apache2/conf.d/modsec_rules/20_asl_useragents.conf"][line"206"][id"332039"][rev"4"][msg"Atomicorp.comWAFRules:SuspiciousUnusualUserAgent\(python-requests\).Disablethisruleifyouusepython-requests/."][severity"CRITICA

(sshd) Failed SSH login from 51.75.169.128 (GB/United Kingdom/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Sep 14 18:37:21 server sshd[17717]: Invalid user admin from 51.75.169.128
Sep 14 18:37:21 server sshd[17717]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.169.128 
Sep 14 18:37:23 server sshd[17717]: Failed password for invalid user admin from 51.75.169.128 port 43114 ssh2
Sep 14 18:51:13 server sshd[19941]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.169.128  user=root
Sep 14 18:51:16 server sshd[19941]: Failed password for root from 51.75.169.128 port 56960 ssh2

Sep 14 09:48:02 ns382633 sshd\[11742\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.169.128  user=root
Sep 14 09:48:04 ns382633 sshd\[11742\]: Failed password for root from 51.75.169.128 port 44590 ssh2
Sep 14 09:55:35 ns382633 sshd\[13433\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.169.128  user=root
Sep 14 09:55:37 ns382633 sshd\[13433\]: Failed password for root from 51.75.169.128 port 42006 ssh2
Sep 14 09:59:45 ns382633 sshd\[13861\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.169.128  user=root

2020-09-11T20:47:27.495608hostname sshd[21218]: Failed password for root from 51.75.169.128 port 45478 ssh2
2020-09-11T20:50:48.499938hostname sshd[22493]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.169.128  user=root
2020-09-11T20:50:50.738609hostname sshd[22493]: Failed password for root from 51.75.169.128 port 46844 ssh2
...

SSH/22 MH Probe, BF, Hack -

SSH Invalid Login

Dec  8 07:20:29 host sshd[39318]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.169.236
Dec  8 07:20:29 host sshd[39318]: Invalid user thisner from 51.75.169.236 port 48801
Dec  8 07:20:31 host sshd[39318]: Failed password for invalid user thisner from 51.75.169.236 port 48801 ssh2
...

Nov 21 20:10:52 wbs sshd\[1656\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.169.236  user=root
Nov 21 20:10:54 wbs sshd\[1656\]: Failed password for root from 51.75.169.236 port 55355 ssh2
Nov 21 20:14:25 wbs sshd\[1987\]: Invalid user guest from 51.75.169.236
Nov 21 20:14:25 wbs sshd\[1987\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.169.236
Nov 21 20:14:27 wbs sshd\[1987\]: Failed password for invalid user guest from 51.75.169.236 port 44935 ssh2

Nov 17 07:47:22 vps666546 sshd\[22257\]: Invalid user mercure from 51.75.169.236 port 46340
Nov 17 07:47:22 vps666546 sshd\[22257\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.169.236
Nov 17 07:47:23 vps666546 sshd\[22257\]: Failed password for invalid user mercure from 51.75.169.236 port 46340 ssh2
Nov 17 07:50:53 vps666546 sshd\[22341\]: Invalid user guest12346 from 51.75.169.236 port 36688
Nov 17 07:50:53 vps666546 sshd\[22341\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.169.236
...

Nov 15 07:05:43 web9 sshd\[4914\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.169.236  user=news
Nov 15 07:05:46 web9 sshd\[4914\]: Failed password for news from 51.75.169.236 port 58113 ssh2
Nov 15 07:09:32 web9 sshd\[5493\]: Invalid user simonian from 51.75.169.236
Nov 15 07:09:32 web9 sshd\[5493\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.169.236
Nov 15 07:09:34 web9 sshd\[5493\]: Failed password for invalid user simonian from 51.75.169.236 port 48546 ssh2

Nov 15 14:32:23 ks10 sshd[9354]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.169.236 
Nov 15 14:32:25 ks10 sshd[9354]: Failed password for invalid user miner1 from 51.75.169.236 port 56560 ssh2
...

2019-11-11T07:35:58.309584shield sshd\[6821\]: Invalid user diogenes from 51.75.169.236 port 53822
2019-11-11T07:35:58.315598shield sshd\[6821\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.169.236
2019-11-11T07:36:00.092726shield sshd\[6821\]: Failed password for invalid user diogenes from 51.75.169.236 port 53822 ssh2
2019-11-11T07:39:30.822670shield sshd\[7410\]: Invalid user gina123 from 51.75.169.236 port 43537
2019-11-11T07:39:30.828567shield sshd\[7410\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.169.236

Oct 27 17:17:22 MainVPS sshd[32646]: Invalid user cd from 51.75.169.236 port 47073
Oct 27 17:17:22 MainVPS sshd[32646]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.169.236
Oct 27 17:17:22 MainVPS sshd[32646]: Invalid user cd from 51.75.169.236 port 47073
Oct 27 17:17:24 MainVPS sshd[32646]: Failed password for invalid user cd from 51.75.169.236 port 47073 ssh2
Oct 27 17:20:44 MainVPS sshd[654]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.169.236  user=root
Oct 27 17:20:46 MainVPS sshd[654]: Failed password for root from 51.75.169.236 port 37639 ssh2
...

2019-10-25T15:46:48.067189abusebot-4.cloudsearch.cf sshd\[7490\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.169.236  user=root

Oct 24 06:26:46 cp sshd[18745]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.169.236
Oct 24 06:26:46 cp sshd[18745]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.169.236

Oct 21 14:06:41 eventyay sshd[16783]: Failed password for root from 51.75.169.236 port 60059 ssh2
Oct 21 14:10:44 eventyay sshd[16889]: Failed password for root from 51.75.169.236 port 51482 ssh2
Oct 21 14:14:47 eventyay sshd[16978]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.169.236
...

Dec  2 19:31:42 gw1 sshd[29432]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.24.2.69
Dec  2 19:31:45 gw1 sshd[29432]: Failed password for invalid user kennel from 118.24.2.69 port 46588 ssh2
...

Dec  2 15:38:58 MK-Soft-VM7 sshd[15687]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.148.3.212 
Dec  2 15:39:00 MK-Soft-VM7 sshd[15687]: Failed password for invalid user hoshi from 5.148.3.212 port 51090 ssh2
...

Dec  2 14:29:35 hcbbdb sshd\[10946\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.180.17  user=root
Dec  2 14:29:38 hcbbdb sshd\[10946\]: Failed password for root from 222.186.180.17 port 60724 ssh2
Dec  2 14:29:41 hcbbdb sshd\[10946\]: Failed password for root from 222.186.180.17 port 60724 ssh2
Dec  2 14:29:55 hcbbdb sshd\[10993\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.180.17  user=root
Dec  2 14:29:57 hcbbdb sshd\[10993\]: Failed password for root from 222.186.180.17 port 1720 ssh2

Automatic report - XMLRPC Attack

Dec  2 04:31:22 php1 sshd\[17472\]: Invalid user pork from 122.225.230.10
Dec  2 04:31:22 php1 sshd\[17472\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.225.230.10
Dec  2 04:31:24 php1 sshd\[17472\]: Failed password for invalid user pork from 122.225.230.10 port 14529 ssh2
Dec  2 04:37:35 php1 sshd\[18300\]: Invalid user password from 122.225.230.10
Dec  2 04:37:35 php1 sshd\[18300\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.225.230.10

Dec  2 09:43:24 ny01 sshd[9640]: Failed password for root from 58.162.140.172 port 50013 ssh2
Dec  2 09:51:55 ny01 sshd[10495]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.162.140.172
Dec  2 09:51:57 ny01 sshd[10495]: Failed password for invalid user couden from 58.162.140.172 port 56003 ssh2

CloudCIX Reconnaissance Scan Detected, PTR: host200-232-177-94.static.arubacloud.fr.

Dec 02 16:35:52 auth-worker(31761): Info: sql(mobobmen-minsk@htcd.gov.by,41.41.0.14,): Password mismatch (given password: minskmobobmen)
Dec 02 16:35:52 auth: Info: checkpassword(mobobmen-minsk@htcd.gov.by,41.41.0.14,): Login failed (status=1)
Dec 02 16:35:55 imap-login: Info: Disconnected (auth failed, 1 attempts in 5 secs): user=, method=PLAIN, rip=41.41.0.14, lip=192.168.216.3, TLS: Disconnected

Dec  2 19:37:36 areeb-Workstation sshd[6790]: Failed password for root from 104.131.8.137 port 52122 ssh2
...

Unauthorised access (Dec  2) SRC=117.3.71.224 LEN=52 TTL=109 ID=21946 DF TCP DPT=445 WINDOW=8192 SYN

Dec  2 15:09:31 ns381471 sshd[28804]: Failed password for mysql from 46.101.105.55 port 41214 ssh2

Dec  2 10:36:15 ldap01vmsma01 sshd[72757]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.47.31.87
Dec  2 10:36:17 ldap01vmsma01 sshd[72757]: Failed password for invalid user admin from 106.47.31.87 port 1535 ssh2
...

Dec  2 04:19:11 wbs sshd\[2283\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.24.173.104  user=www-data
Dec  2 04:19:13 wbs sshd\[2283\]: Failed password for www-data from 118.24.173.104 port 57304 ssh2
Dec  2 04:28:15 wbs sshd\[3111\]: Invalid user vahle from 118.24.173.104
Dec  2 04:28:15 wbs sshd\[3111\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.24.173.104
Dec  2 04:28:17 wbs sshd\[3111\]: Failed password for invalid user vahle from 118.24.173.104 port 32949 ssh2

Dec  2 13:52:17 hcbbdb sshd\[6688\]: Invalid user test from 106.12.16.234
Dec  2 13:52:17 hcbbdb sshd\[6688\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.16.234
Dec  2 13:52:20 hcbbdb sshd\[6688\]: Failed password for invalid user test from 106.12.16.234 port 45634 ssh2
Dec  2 14:00:11 hcbbdb sshd\[7619\]: Invalid user tsmuse from 106.12.16.234
Dec  2 14:00:11 hcbbdb sshd\[7619\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.16.234

Dec  2 15:21:17 v22018053744266470 sshd[21620]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.215.207.40
Dec  2 15:21:20 v22018053744266470 sshd[21620]: Failed password for invalid user ross from 125.215.207.40 port 41411 ssh2
Dec  2 15:28:58 v22018053744266470 sshd[22126]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.215.207.40
...