May 14 08:55:32 NPSTNNYC01T sshd[14068]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.139.121
May 14 08:55:34 NPSTNNYC01T sshd[14068]: Failed password for invalid user user from 104.248.139.121 port 49288 ssh2
May 14 08:59:01 NPSTNNYC01T sshd[14354]: Failed password for root from 104.248.139.121 port 56564 ssh2
...

May  3 06:22:00 legacy sshd[5370]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.139.121
May  3 06:22:02 legacy sshd[5370]: Failed password for invalid user mf from 104.248.139.121 port 40166 ssh2
May  3 06:25:38 legacy sshd[5637]: Failed password for root from 104.248.139.121 port 49638 ssh2
...

SSH auth scanning - multiple failed logins

2020-04-27T13:03:38.800886abusebot-3.cloudsearch.cf sshd[30948]: Invalid user hung from 104.248.139.121 port 41966
2020-04-27T13:03:38.810081abusebot-3.cloudsearch.cf sshd[30948]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.139.121
2020-04-27T13:03:38.800886abusebot-3.cloudsearch.cf sshd[30948]: Invalid user hung from 104.248.139.121 port 41966
2020-04-27T13:03:40.381859abusebot-3.cloudsearch.cf sshd[30948]: Failed password for invalid user hung from 104.248.139.121 port 41966 ssh2
2020-04-27T13:07:22.168837abusebot-3.cloudsearch.cf sshd[31229]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.139.121  user=root
2020-04-27T13:07:24.161636abusebot-3.cloudsearch.cf sshd[31229]: Failed password for root from 104.248.139.121 port 53746 ssh2
2020-04-27T13:11:04.475551abusebot-3.cloudsearch.cf sshd[31503]: Invalid user znc from 104.248.139.121 port 37302
...

Apr 27 11:44:11 dev0-dcde-rnet sshd[22559]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.139.121
Apr 27 11:44:14 dev0-dcde-rnet sshd[22559]: Failed password for invalid user udp from 104.248.139.121 port 52906 ssh2
Apr 27 11:50:16 dev0-dcde-rnet sshd[22729]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.139.121

Unauthorised connection attempt detected at AUO NODE 1. System is sshd. Protected by AUO Stack Web Application Firewall (WAF)

Invalid user od from 104.248.139.121 port 53734

Wordpress malicious attack:[sshd]

Apr 20 00:12:29 debian-2gb-nbg1-2 kernel: \[9593314.391754\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=104.248.139.121 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=23968 PROTO=TCP SPT=59620 DPT=19842 WINDOW=1024 RES=0x00 SYN URGP=0

scans once in preceeding hours on the ports (in chronological order) 19153 resulting in total of 5 scans from 104.248.0.0/16 block.

Apr 17 13:56:38 sso sshd[29563]: Failed password for root from 104.248.139.121 port 42032 ssh2
Apr 17 14:00:28 sso sshd[30000]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.139.121
...

Apr 17 09:49:30 vpn01 sshd[24030]: Failed password for root from 104.248.139.121 port 47328 ssh2
...

Apr  8 06:00:12 sso sshd[10238]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.139.121
Apr  8 06:00:14 sso sshd[10238]: Failed password for invalid user aman from 104.248.139.121 port 60516 ssh2
...

(sshd) Failed SSH login from 104.248.139.121 (DE/Germany/-): 2 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Apr  4 09:34:42 ubnt-55d23 sshd[17241]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.139.121  user=root
Apr  4 09:34:44 ubnt-55d23 sshd[17241]: Failed password for root from 104.248.139.121 port 43664 ssh2

Mar 28 16:31:05 dev0-dcde-rnet sshd[3144]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.139.121
Mar 28 16:31:06 dev0-dcde-rnet sshd[3144]: Failed password for invalid user oracle from 104.248.139.121 port 41678 ssh2
Mar 28 16:41:28 dev0-dcde-rnet sshd[3230]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.139.121

Jul  4 03:18:18 server sshd[20619]: Failed none for root from 61.177.172.168 port 27744 ssh2
Jul  4 03:18:21 server sshd[20619]: Failed password for root from 61.177.172.168 port 27744 ssh2
Jul  4 03:18:25 server sshd[20619]: Failed password for root from 61.177.172.168 port 27744 ssh2

(From wanda.kellermann@msn.com) Hi,

Do you have a Website? Of course you do because I am looking at your website expresslifechiro.com now.

Are you struggling for Leads and Sales?

You’re not the only one.

So many Website owners struggle to convert their Visitors into Leads & Sales.

There’s a simple way to fix this problem.

You could use a Live Chat app on your Website expresslifechiro.com and hire Chat Agents.

But only if you’ve got deep pockets and you’re happy to fork out THOUSANDS of dollars for the quality you need.

=====

But what if you could automate Live Chat so it’s HUMAN-FREE?

What if you could exploit NEW “AI” Technology to engage with your Visitors INSTANTLY.

And AUTOMATICALLY convert them into Leads & Sales.

WITHOUT spending THOUSANDS of dollars on Live Chat Agents.

And WITHOUT hiring expensive coders.

In fact, all you need to do to activate this LATEST “AI” Website Tech..

..is to COPY & PASTE a single line of “Website Code”.

==> http://www.zoomsoft.n

Jul  4 03:44:14 relay postfix/smtpd\[10244\]: warning: unknown\[185.143.75.153\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jul  4 03:44:34 relay postfix/smtpd\[7187\]: warning: unknown\[185.143.75.153\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jul  4 03:45:05 relay postfix/smtpd\[5171\]: warning: unknown\[185.143.75.153\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jul  4 03:45:31 relay postfix/smtpd\[7430\]: warning: unknown\[185.143.75.153\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jul  4 03:45:56 relay postfix/smtpd\[5171\]: warning: unknown\[185.143.75.153\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
...

Unauthorized connection attempt from IP address 190.204.165.172 on Port 445(SMB)

Honeypot attack, port: 81, PTR: 114-34-94-64.HINET-IP.hinet.net.

2020-07-04 01:18:25 auth_plain authenticator failed for (User) [46.38.150.191]: 535 Incorrect authentication data (set_id=auth2@mail.csmailer.org)
2020-07-04 01:19:02 auth_plain authenticator failed for (User) [46.38.150.191]: 535 Incorrect authentication data (set_id=1qaz2wsx@mail.csmailer.org)
2020-07-04 01:19:38 auth_plain authenticator failed for (User) [46.38.150.191]: 535 Incorrect authentication data (set_id=c21@mail.csmailer.org)
2020-07-04 01:20:25 auth_plain authenticator failed for (User) [46.38.150.191]: 535 Incorrect authentication data (set_id=margret@mail.csmailer.org)
2020-07-04 01:20:55 auth_plain authenticator failed for (User) [46.38.150.191]: 535 Incorrect authentication data (set_id=pacific@mail.csmailer.org)
...

Jul  4 02:57:30 ns381471 sshd[12171]: Failed password for root from 112.85.42.89 port 63351 ssh2

Unauthorized connection attempt detected from IP address 162.247.74.201 to port 443

Jul  4 03:07:50 mail.srvfarm.net postfix/smtpd[8402]: warning: unknown[46.38.150.132]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jul  4 03:08:32 mail.srvfarm.net postfix/smtpd[8406]: warning: unknown[46.38.150.132]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jul  4 03:09:16 mail.srvfarm.net postfix/smtpd[8414]: warning: unknown[46.38.150.132]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jul  4 03:09:59 mail.srvfarm.net postfix/smtpd[8413]: warning: unknown[46.38.150.132]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jul  4 03:10:44 mail.srvfarm.net postfix/smtpd[8406]: warning: unknown[46.38.150.132]: SASL LOGIN authentication failed: UGFzc3dvcmQ6

2020-07-04T01:15:53.206028ks3355764 sshd[590]: Invalid user git from 111.229.104.94 port 58124
2020-07-04T01:15:55.288824ks3355764 sshd[590]: Failed password for invalid user git from 111.229.104.94 port 58124 ssh2
...

Jul  4 03:28:15 srv01 postfix/smtpd\[14888\]: warning: unknown\[185.143.73.93\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jul  4 03:28:53 srv01 postfix/smtpd\[14888\]: warning: unknown\[185.143.73.93\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jul  4 03:29:29 srv01 postfix/smtpd\[8046\]: warning: unknown\[185.143.73.93\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jul  4 03:30:10 srv01 postfix/smtpd\[21836\]: warning: unknown\[185.143.73.93\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jul  4 03:30:48 srv01 postfix/smtpd\[21836\]: warning: unknown\[185.143.73.93\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
...

Jul  4 06:03:59 dhoomketu sshd[1262571]: Failed password for invalid user yr from 106.53.85.121 port 34538 ssh2
Jul  4 06:07:57 dhoomketu sshd[1262683]: Invalid user test from 106.53.85.121 port 53294
Jul  4 06:07:57 dhoomketu sshd[1262683]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.53.85.121 
Jul  4 06:07:57 dhoomketu sshd[1262683]: Invalid user test from 106.53.85.121 port 53294
Jul  4 06:07:59 dhoomketu sshd[1262683]: Failed password for invalid user test from 106.53.85.121 port 53294 ssh2
...

2020-07-03T23:28:11.414320shield sshd\[21337\]: Invalid user chetan from 178.128.162.10 port 58018
2020-07-03T23:28:11.417692shield sshd\[21337\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.162.10
2020-07-03T23:28:13.133069shield sshd\[21337\]: Failed password for invalid user chetan from 178.128.162.10 port 58018 ssh2
2020-07-03T23:31:11.919641shield sshd\[21979\]: Invalid user cv from 178.128.162.10 port 54696
2020-07-03T23:31:11.923737shield sshd\[21979\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.162.10

Jul  4 02:35:33 vps sshd[849081]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=vps-6245e5c9.vps.ovh.ca  user=root
Jul  4 02:35:34 vps sshd[849081]: Failed password for root from 51.222.13.37 port 42176 ssh2
Jul  4 02:37:44 vps sshd[858545]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=vps-6245e5c9.vps.ovh.ca  user=root
Jul  4 02:37:46 vps sshd[858545]: Failed password for root from 51.222.13.37 port 50962 ssh2
Jul  4 02:39:59 vps sshd[869241]: Invalid user carbon from 51.222.13.37 port 59758
...

Jul  3 18:37:36 dignus sshd[3313]: error: maximum authentication attempts exceeded for root from 61.177.172.41 port 15612 ssh2 [preauth]
Jul  3 18:37:42 dignus sshd[3336]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.177.172.41  user=root
Jul  3 18:37:44 dignus sshd[3336]: Failed password for root from 61.177.172.41 port 46722 ssh2
Jul  3 18:38:01 dignus sshd[3336]: Failed password for root from 61.177.172.41 port 46722 ssh2
Jul  3 18:38:01 dignus sshd[3336]: error: maximum authentication attempts exceeded for root from 61.177.172.41 port 46722 ssh2 [preauth]
...