(smtpauth) Failed SMTP AUTH login from 103.114.104.140 (VN/Vietnam/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 2020-04-01 08:26:40 login authenticator failed for (User) [103.114.104.140]: 535 Incorrect authentication data (set_id=ann)

(smtpauth) Failed SMTP AUTH login from 103.114.104.140 (VN/Vietnam/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SMTPAUTH; Logs: 2020-03-30 17:50:22 login authenticator failed for (User) [103.114.104.140]: 535 Incorrect authentication data (set_id=mailnull)
2020-03-30 17:51:00 login authenticator failed for (User) [103.114.104.140]: 535 Incorrect authentication data (set_id=mailnull)
2020-03-30 17:53:24 login authenticator failed for (User) [103.114.104.140]: 535 Incorrect authentication data (set_id=mailnull)
2020-03-30 17:53:26 login authenticator failed for (User) [103.114.104.140]: 535 Incorrect authentication data (set_id=mailnull)
2020-03-30 18:27:54 login authenticator failed for (User) [103.114.104.140]: 535 Incorrect authentication data (set_id=mailnull)

Rude login attack (3 tries in 1d)

Rude login attack (10 tries in 1d)

Feb  9 17:50:17 mail postfix/smtpd\[24425\]: warning: unknown\[103.114.104.140\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6\
Feb  9 18:15:05 mail postfix/smtpd\[24799\]: warning: unknown\[103.114.104.140\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6\
Feb  9 19:04:48 mail postfix/smtpd\[25987\]: warning: unknown\[103.114.104.140\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6\
Feb  9 19:29:43 mail postfix/smtpd\[26300\]: warning: unknown\[103.114.104.140\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6\

Rude login attack (5 tries in 1d)

Jan  2 23:47:48 web1 postfix/smtpd[13868]: warning: unknown[103.114.104.140]: SASL LOGIN authentication failed: authentication failure
...

"SMTP brute force auth login attempt."

Nov 30 22:40:09 heicom postfix/smtpd\[5783\]: warning: unknown\[103.114.104.140\]: SASL LOGIN authentication failed: authentication failure
Nov 30 22:40:10 heicom postfix/smtpd\[5783\]: warning: unknown\[103.114.104.140\]: SASL LOGIN authentication failed: authentication failure
Nov 30 22:40:11 heicom postfix/smtpd\[5783\]: warning: unknown\[103.114.104.140\]: SASL LOGIN authentication failed: authentication failure
Nov 30 22:40:12 heicom postfix/smtpd\[5783\]: warning: unknown\[103.114.104.140\]: SASL LOGIN authentication failed: authentication failure
Nov 30 22:40:13 heicom postfix/smtpd\[5783\]: warning: unknown\[103.114.104.140\]: SASL LOGIN authentication failed: authentication failure
...

2019-11-07T07:24:56.098453mail01 postfix/smtpd[31940]: warning: unknown[103.114.104.140]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
2019-11-07T07:25:03.279473mail01 postfix/smtpd[31940]: warning: unknown[103.114.104.140]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
2019-11-07T07:25:14.400683mail01 postfix/smtpd[31940]: warning: unknown[103.114.104.140]: SASL LOGIN authentication failed: UGFzc3dvcmQ6

Nov  7 01:01:49 vmanager6029 postfix/smtpd\[19503\]: warning: unknown\[103.114.104.140\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Nov  7 01:01:56 vmanager6029 postfix/smtpd\[19503\]: warning: unknown\[103.114.104.140\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6

Sep 10 18:13:07 web1 postfix/smtpd[17330]: warning: unknown[103.114.104.140]: SASL LOGIN authentication failed: authentication failure
...

Sep  9 06:37:36 ncomp postfix/smtpd[8059]: warning: unknown[103.114.104.140]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Sep  9 06:37:45 ncomp postfix/smtpd[8059]: warning: unknown[103.114.104.140]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Sep  9 06:37:58 ncomp postfix/smtpd[8059]: warning: unknown[103.114.104.140]: SASL LOGIN authentication failed: UGFzc3dvcmQ6

Invalid user admin from 103.114.104.68 port 56999

Invalid user admin from 103.114.104.68 port 56999

port scan and connect, tcp 22 (ssh)

Invalid user test from 103.114.104.35

(sshd) Failed SSH login from 103.114.104.68 (VN/Vietnam/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Aug 25 13:02:15 badguy sshd[11699]: Invalid user admin from 103.114.104.68 port 56226
Aug 25 13:02:17 badguy sshd[11701]: Invalid user admin from 103.114.104.68 port 56473
Aug 25 13:02:19 badguy sshd[11708]: Invalid user PlcmSpIp from 103.114.104.68 port 56921
Aug 25 13:02:21 badguy sshd[11717]: Invalid user ubnt from 103.114.104.68 port 57349
Aug 25 13:02:22 badguy sshd[11720]: Invalid user RPM from 103.114.104.68 port 57599

Aug 20 09:09:54 srv-ubuntu-dev3 sshd[79072]: fatal: Unable to negotiate with 103.114.104.68 port 60171: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth]
Aug 20 09:09:55 srv-ubuntu-dev3 sshd[79074]: fatal: Unable to negotiate with 103.114.104.68 port 60578: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth]
Aug 20 09:09:56 srv-ubuntu-dev3 sshd[79077]: fatal: Unable to negotiate with 103.114.104.68 port 60989: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth]
Aug 20 09:09:57 srv-ubuntu-dev3 sshd[79085]: fatal: Unable to negotiate with 103.114.104.68 port 61411: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth]
Aug 20 09:09:59 srv-ubuntu-dev3 sshd[79096]: fatal: Unable to negotiate with 103.114.104.68 port 61915: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth]
...

There is IP Brute Force My Server

Aug 13 12:20:07 ip-172-31-16-56 sshd\[3291\]: Invalid user user from 103.114.104.68\
Aug 13 12:20:09 ip-172-31-16-56 sshd\[3291\]: Failed password for invalid user user from 103.114.104.68 port 51084 ssh2\
Aug 13 12:20:13 ip-172-31-16-56 sshd\[3294\]: Invalid user admin from 103.114.104.68\
Aug 13 12:20:15 ip-172-31-16-56 sshd\[3294\]: Failed password for invalid user admin from 103.114.104.68 port 52339 ssh2\
Aug 13 12:20:20 ip-172-31-16-56 sshd\[3296\]: Invalid user admin from 103.114.104.68\

ET CINS Active Threat Intelligence Poor Reputation IP group 95 - port: 22 proto: tcp cat: Misc Attackbytes: 60

Lines containing failures of 103.114.104.62
Jul 27 05:41:03 www sshd[9702]: Did not receive identification string from 103.114.104.62 port 63948
Jul 27 05:41:04 www sshd[9703]: Invalid user support from 103.114.104.62 port 64180
Jul 27 05:41:04 www sshd[9703]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.114.104.62
Jul 27 05:41:07 www sshd[9703]: Failed password for invalid user support from 103.114.104.62 port 64180 ssh2
Jul 27 05:41:07 www sshd[9703]: error: Received disconnect from 103.114.104.62 port 64180:3: com.jcraft.jsch.JSchException: Auth fail [preauth]
Jul 27 05:41:07 www sshd[9703]: Disconnected from invalid user support 103.114.104.62 port 64180 [preauth]
Jul 27 05:41:16 www sshd[9775]: Invalid user user from 103.114.104.62 port 50062
Jul 27 05:41:17 www sshd[9775]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.114.104.62


........
-----------------------------------------------
https://www.blocklist.de/

Jul 19 16:04:04 ip-172-31-62-245 sshd\[12727\]: Invalid user guest from 103.114.104.68\
Jul 19 16:04:06 ip-172-31-62-245 sshd\[12727\]: Failed password for invalid user guest from 103.114.104.68 port 59684 ssh2\
Jul 19 16:04:09 ip-172-31-62-245 sshd\[12729\]: Invalid user user from 103.114.104.68\
Jul 19 16:04:11 ip-172-31-62-245 sshd\[12729\]: Failed password for invalid user user from 103.114.104.68 port 60804 ssh2\
Jul 19 16:04:13 ip-172-31-62-245 sshd\[12733\]: Invalid user admin from 103.114.104.68\

2020-07-17T23:28:02+0200 Failed SSH Authentication/Brute Force Attack. (Server 10)

Jul  8 22:35:19 itachi1706steam sshd[118986]: Unable to negotiate with 103.114.104.68 port 60700: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth]
Jul  8 22:35:23 itachi1706steam sshd[119030]: Unable to negotiate with 103.114.104.68 port 61829: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth]
Jul  8 22:35:26 itachi1706steam sshd[119044]: Unable to negotiate with 103.114.104.68 port 62934: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [preauth]
...

Port scan on 6 port(s): 1500 20001 20008 40005 40006 40007

May 19 16:30:31 webhost01 sshd[7345]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.114.104.241
May 19 16:30:33 webhost01 sshd[7345]: Failed password for invalid user admin from 103.114.104.241 port 49510 ssh2
...

Invalid user postgres from 182.148.12.252 port 53938

Aug 26 02:52:30 dignus sshd[1698]: Failed password for root from 222.186.180.142 port 31310 ssh2
Aug 26 02:52:34 dignus sshd[1727]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.180.142  user=root
Aug 26 02:52:36 dignus sshd[1727]: Failed password for root from 222.186.180.142 port 60987 ssh2
Aug 26 02:52:43 dignus sshd[1745]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.180.142  user=root
Aug 26 02:52:45 dignus sshd[1745]: Failed password for root from 222.186.180.142 port 32047 ssh2
...

Cowrie Honeypot: 3 unauthorised SSH/Telnet login attempts between 2020-08-26T06:51:26Z and 2020-08-26T06:57:54Z

Aug 26 08:28:53 django-0 sshd[25179]: Invalid user alexis from 35.226.132.241
...

Aug 26 01:59:26 host sshd\[17748\]: Failed password for root from 206.189.73.164 port 58958 ssh2
Aug 26 02:06:00 host sshd\[19690\]: Failed password for root from 206.189.73.164 port 38190 ssh2
Aug 26 02:12:40 host sshd\[20751\]: Failed password for root from 206.189.73.164 port 45654 ssh2
...

firewall-block, port(s): 37776/tcp

 TCP (SYN) 42.6.212.124:41343 -> port 8080, len 44

Aug 26 04:49:54 NPSTNNYC01T sshd[27144]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.166.78.16
Aug 26 04:49:56 NPSTNNYC01T sshd[27144]: Failed password for invalid user cali from 188.166.78.16 port 52523 ssh2
Aug 26 04:53:42 NPSTNNYC01T sshd[27700]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.166.78.16
...

2020-08-26T08:40:10.445112ns386461 sshd\[10134\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.25.44.66  user=root
2020-08-26T08:40:12.126581ns386461 sshd\[10134\]: Failed password for root from 118.25.44.66 port 57876 ssh2
2020-08-26T08:52:49.201143ns386461 sshd\[22890\]: Invalid user cmsadmin from 118.25.44.66 port 52326
2020-08-26T08:52:49.205923ns386461 sshd\[22890\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.25.44.66
2020-08-26T08:52:51.084797ns386461 sshd\[22890\]: Failed password for invalid user cmsadmin from 118.25.44.66 port 52326 ssh2
...

Aug 25 23:08:37 host sshd[11301]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.92.109.191
Aug 25 23:08:37 host sshd[11301]: Invalid user ams from 120.92.109.191 port 34584
Aug 25 23:08:39 host sshd[11301]: Failed password for invalid user ams from 120.92.109.191 port 34584 ssh2
...

Invalid user admin from 138.197.217.164 port 39348

Aug 26 14:31:25 gw1 sshd[1155]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.227.100.17
Aug 26 14:31:27 gw1 sshd[1155]: Failed password for invalid user pic from 1.227.100.17 port 43544 ssh2
...

2020-08-26T12:41:16.767587snf-827550 sshd[26410]: Failed password for invalid user hxn from 138.197.136.30 port 58790 ssh2
2020-08-26T12:51:06.675287snf-827550 sshd[26435]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.136.30  user=root
2020-08-26T12:51:08.066895snf-827550 sshd[26435]: Failed password for root from 138.197.136.30 port 52754 ssh2
...

Brute forcing email accounts

WordPress login Brute force / Web App Attack on client site.