54.37.235.40 - - [03/Nov/2019:23:21:58 +0100] "GET /wp-login.php HTTP/1.1" 301 178 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
54.37.235.40 - - [03/Nov/2019:23:21:59 +0100] "GET /wp-login.php HTTP/1.1" 200 1238 "http://thinklarge.fr/wp-login.php" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
54.37.235.40 - - [03/Nov/2019:23:21:59 +0100] "GET /wp-login.php HTTP/1.1" 200 1238 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
54.37.235.40 - - [03/Nov/2019:23:21:59 +0100] "POST /wp-login.php HTTP/1.1" 200 1635 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
54.37.235.40 - - [03/Nov/2019:23:29:16 +0100] "GET /wp-login.php HTTP/1.1" 301 178 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
54.37.235.40 - - [03/Nov/2019:23:29:16 +0100] "GET /wp-login.php HTTP/1.1" 200 1238 "http://thinklarge.fr/wp-login.php" "Mozilla/5.0 (X11; Ubuntu; Linux x86_6

54.37.235.40 - - [02/Nov/2019:21:08:17 +0100] "GET /wp-login.php HTTP/1.1" 301 178 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
54.37.235.40 - - [02/Nov/2019:21:08:17 +0100] "GET /wp-login.php HTTP/1.1" 200 1238 "http://thinklarge.fr/wp-login.php" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
54.37.235.40 - - [02/Nov/2019:21:08:17 +0100] "GET /wp-login.php HTTP/1.1" 200 1238 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
54.37.235.40 - - [02/Nov/2019:21:08:17 +0100] "POST /wp-login.php HTTP/1.1" 200 1635 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
54.37.235.40 - - [02/Nov/2019:21:18:06 +0100] "GET /wp-login.php HTTP/1.1" 301 178 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
54.37.235.40 - - [02/Nov/2019:21:18:06 +0100] "GET /wp-login.php HTTP/1.1" 200 1238 "http://thinklarge.fr/wp-login.php" "Mozilla/5.0 (X11; Ubuntu; Linux x86_6

Sep 22 17:07:45 piServer sshd[32385]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.37.235.183 
Sep 22 17:07:47 piServer sshd[32385]: Failed password for invalid user q from 54.37.235.183 port 59560 ssh2
Sep 22 17:12:02 piServer sshd[611]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.37.235.183 
...

Sep 22 09:47:31 mellenthin sshd[16932]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.37.235.183  user=root
Sep 22 09:47:33 mellenthin sshd[16932]: Failed password for invalid user root from 54.37.235.183 port 59148 ssh2

2020-09-21T22:05:51.044983randservbullet-proofcloud-66.localdomain sshd[6314]: Invalid user dasusr1 from 54.37.235.183 port 35398
2020-09-21T22:05:51.049963randservbullet-proofcloud-66.localdomain sshd[6314]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.ip-54-37-235.eu
2020-09-21T22:05:51.044983randservbullet-proofcloud-66.localdomain sshd[6314]: Invalid user dasusr1 from 54.37.235.183 port 35398
2020-09-21T22:05:52.812980randservbullet-proofcloud-66.localdomain sshd[6314]: Failed password for invalid user dasusr1 from 54.37.235.183 port 35398 ssh2
...

Sep 14 08:53:38 rush sshd[28267]: Failed password for root from 54.37.235.183 port 32830 ssh2
Sep 14 08:57:52 rush sshd[28353]: Failed password for root from 54.37.235.183 port 45386 ssh2
...

Sep 14 04:52:41 django-0 sshd[27509]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.ip-54-37-235.eu  user=root
Sep 14 04:52:43 django-0 sshd[27509]: Failed password for root from 54.37.235.183 port 50236 ssh2
...

2020-09-13T16:31:25.251237dreamphreak.com sshd[290539]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.37.235.183  user=root
2020-09-13T16:31:27.659469dreamphreak.com sshd[290539]: Failed password for root from 54.37.235.183 port 40602 ssh2
...

SSH Brute-Forcing (server1)

Aug 31 22:41:28 funkybot sshd[12868]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.37.235.183 
Aug 31 22:41:30 funkybot sshd[12868]: Failed password for invalid user wxl from 54.37.235.183 port 47680 ssh2
...

Aug 20 15:03:18 dignus sshd[10893]: Invalid user admin from 54.37.235.183 port 34242
Aug 20 15:03:18 dignus sshd[10893]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.37.235.183
Aug 20 15:03:20 dignus sshd[10893]: Failed password for invalid user admin from 54.37.235.183 port 34242 ssh2
Aug 20 15:07:27 dignus sshd[11427]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.37.235.183  user=root
Aug 20 15:07:29 dignus sshd[11427]: Failed password for root from 54.37.235.183 port 42720 ssh2
...

Invalid user dal from 54.37.235.183 port 54648

Cowrie Honeypot: 3 unauthorised SSH/Telnet login attempts between 2020-08-16T15:00:53Z and 2020-08-16T15:13:09Z

WordPress brute force

Jul 27 10:50:39 * sshd[13042]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.37.235.183
Jul 27 10:50:41 * sshd[13042]: Failed password for invalid user jessica from 54.37.235.183 port 42380 ssh2

Jul 24 07:08:16 journals sshd\[112323\]: Invalid user nag from 54.37.235.183
Jul 24 07:08:16 journals sshd\[112323\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.37.235.183
Jul 24 07:08:19 journals sshd\[112323\]: Failed password for invalid user nag from 54.37.235.183 port 53444 ssh2
Jul 24 07:12:40 journals sshd\[112607\]: Invalid user teamspeak from 54.37.235.183
Jul 24 07:12:40 journals sshd\[112607\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.37.235.183
...

*Port Scan* detected from 54.37.235.183 (PL/Poland/Lower Silesia/Wroc?aw (Krzyki)/183.ip-54-37-235.eu). 4 hits in the last 290 seconds

Oct  5 22:45:48 gospond sshd[30654]: Failed password for root from 201.17.130.156 port 38194 ssh2
Oct  5 22:45:47 gospond sshd[30654]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.17.130.156  user=root
Oct  5 22:45:48 gospond sshd[30654]: Failed password for root from 201.17.130.156 port 38194 ssh2
...

Oct  6 17:38:08 eventyay sshd[15556]: Failed password for root from 31.129.173.162 port 59430 ssh2
Oct  6 17:41:58 eventyay sshd[15678]: Failed password for root from 31.129.173.162 port 36294 ssh2
...

Automatic report - Port Scan Attack

2020-10-06T19:19:45.742150shield sshd\[13438\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.35.92.130  user=root
2020-10-06T19:19:47.567883shield sshd\[13438\]: Failed password for root from 125.35.92.130 port 37017 ssh2
2020-10-06T19:24:11.367831shield sshd\[14042\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.35.92.130  user=root
2020-10-06T19:24:13.042841shield sshd\[14042\]: Failed password for root from 125.35.92.130 port 11524 ssh2
2020-10-06T19:28:29.682804shield sshd\[14609\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.35.92.130  user=root

2020-10-06T14:58:50.842974hostname sshd[6386]: Failed password for root from 106.12.185.102 port 45744 ssh2
...

Brute forcing email accounts

(sshd) Failed SSH login from 157.97.80.205 (ES/Spain/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Oct  6 10:24:45 optimus sshd[8361]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.97.80.205  user=root
Oct  6 10:24:47 optimus sshd[8361]: Failed password for root from 157.97.80.205 port 58038 ssh2
Oct  6 10:40:55 optimus sshd[12997]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.97.80.205  user=root
Oct  6 10:40:57 optimus sshd[12997]: Failed password for root from 157.97.80.205 port 40717 ssh2
Oct  6 10:44:42 optimus sshd[13967]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.97.80.205  user=root

 UDP 181.214.88.151:11211 -> port 1434, len 52

Cowrie Honeypot: Unauthorised SSH/Telnet login attempt with user "root" at 2020-10-06T12:55:24Z

Oct  6 20:44:39 host2 sshd[1567792]: Failed password for root from 68.183.126.143 port 48418 ssh2
Oct  6 20:46:23 host2 sshd[1567828]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.183.126.143  user=root
Oct  6 20:46:25 host2 sshd[1567828]: Failed password for root from 68.183.126.143 port 49426 ssh2
Oct  6 20:46:23 host2 sshd[1567828]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.183.126.143  user=root
Oct  6 20:46:25 host2 sshd[1567828]: Failed password for root from 68.183.126.143 port 49426 ssh2
...

(eximsyntax) Exim syntax errors from 113.172.172.228 (VN/Vietnam/static.vnpt.vn): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 2020-10-06 00:07:41 SMTP call from [113.172.172.228] dropped: too many syntax or protocol errors (last command was "?\034?\032?\027?\031?\034?\033?\030?\032?\026?\016?\r?\v?\f?	?")

163.172.40.236 - - [06/Oct/2020:22:58:32 +0400] "POST /GponForm/diag_Form?style/ HTTP/1.1" 502 157 "-" "curl/7.3.2"
...

Oct  6 14:03:35 web8 sshd\[20661\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.0.200.227  user=root
Oct  6 14:03:37 web8 sshd\[20661\]: Failed password for root from 107.0.200.227 port 41028 ssh2
Oct  6 14:07:20 web8 sshd\[22405\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.0.200.227  user=root
Oct  6 14:07:22 web8 sshd\[22405\]: Failed password for root from 107.0.200.227 port 46880 ssh2
Oct  6 14:11:10 web8 sshd\[24173\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.0.200.227  user=root

Dear Customer,
we inform you that the domain bleta.net   , to which this mail account is linked, will expire on 10/07/2020.
We wish to remind you that, if the domain is not renewed by that date, these and all associated services, including mailboxes, will be deactivated and can no longer be used for sending and receiving.
HOW TO RENEW THE DOMAIN?
The Β؜؜؜l؜؜؜u؜؜؜е؜؜؜h؜؜؜s؜؜؜ο؜؜؜t customer who has the login and password to access the domain, will be able to renew simply by placing an order online.
RENEW THE DOMAIN  
Thank you for choosing Β؜؜؜l؜؜؜u؜؜؜е؜؜؜h؜؜؜s؜؜؜ο؜؜؜t !
Sincerely,
Β؜؜؜l؜؜؜u؜؜؜е؜؜؜h؜؜؜s؜؜؜ο؜؜؜t Customer Care

Brute forcing email accounts