(sshd) Failed SSH login from 106.12.166.167 (CN/China/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Sep 10 09:06:14 server5 sshd[13612]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.166.167  user=root
Sep 10 09:06:16 server5 sshd[13612]: Failed password for root from 106.12.166.167 port 28239 ssh2
Sep 10 09:08:13 server5 sshd[14652]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.166.167  user=root
Sep 10 09:08:15 server5 sshd[14652]: Failed password for root from 106.12.166.167 port 47445 ssh2
Sep 10 09:09:49 server5 sshd[15440]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.166.167  user=root

2020-09-09T16:49:02.423739abusebot.cloudsearch.cf sshd[21557]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.166.167  user=root
2020-09-09T16:49:03.993938abusebot.cloudsearch.cf sshd[21557]: Failed password for root from 106.12.166.167 port 49962 ssh2
2020-09-09T16:53:26.434033abusebot.cloudsearch.cf sshd[21658]: Invalid user db from 106.12.166.167 port 38951
2020-09-09T16:53:26.438493abusebot.cloudsearch.cf sshd[21658]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.166.167
2020-09-09T16:53:26.434033abusebot.cloudsearch.cf sshd[21658]: Invalid user db from 106.12.166.167 port 38951
2020-09-09T16:53:28.249717abusebot.cloudsearch.cf sshd[21658]: Failed password for invalid user db from 106.12.166.167 port 38951 ssh2
2020-09-09T16:57:42.255786abusebot.cloudsearch.cf sshd[21725]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.166.167  user=root
2
...

2020-09-09T16:49:02.423739abusebot.cloudsearch.cf sshd[21557]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.166.167  user=root
2020-09-09T16:49:03.993938abusebot.cloudsearch.cf sshd[21557]: Failed password for root from 106.12.166.167 port 49962 ssh2
2020-09-09T16:53:26.434033abusebot.cloudsearch.cf sshd[21658]: Invalid user db from 106.12.166.167 port 38951
2020-09-09T16:53:26.438493abusebot.cloudsearch.cf sshd[21658]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.166.167
2020-09-09T16:53:26.434033abusebot.cloudsearch.cf sshd[21658]: Invalid user db from 106.12.166.167 port 38951
2020-09-09T16:53:28.249717abusebot.cloudsearch.cf sshd[21658]: Failed password for invalid user db from 106.12.166.167 port 38951 ssh2
2020-09-09T16:57:42.255786abusebot.cloudsearch.cf sshd[21725]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.166.167  user=root
2
...

Aug 28 14:05:46 root sshd[15349]: Failed password for root from 106.12.166.167 port 25023 ssh2
Aug 28 14:07:29 root sshd[15565]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.166.167 
Aug 28 14:07:31 root sshd[15565]: Failed password for invalid user portal from 106.12.166.167 port 41863 ssh2
...

Aug 15 01:12:23 buvik sshd[20909]: Failed password for root from 106.12.166.167 port 36328 ssh2
Aug 15 01:14:52 buvik sshd[21214]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.166.167  user=root
Aug 15 01:14:55 buvik sshd[21214]: Failed password for root from 106.12.166.167 port 13331 ssh2
...

Invalid user hosts from 106.12.166.167 port 27895

Jul 25 23:41:38 game-panel sshd[2456]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.166.167
Jul 25 23:41:40 game-panel sshd[2456]: Failed password for invalid user tim from 106.12.166.167 port 62452 ssh2
Jul 25 23:46:15 game-panel sshd[2761]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.166.167

2020-07-24T21:55:33.417371dmca.cloudsearch.cf sshd[30439]: Invalid user vae from 106.12.166.167 port 15659
2020-07-24T21:55:33.422467dmca.cloudsearch.cf sshd[30439]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.166.167
2020-07-24T21:55:33.417371dmca.cloudsearch.cf sshd[30439]: Invalid user vae from 106.12.166.167 port 15659
2020-07-24T21:55:35.307569dmca.cloudsearch.cf sshd[30439]: Failed password for invalid user vae from 106.12.166.167 port 15659 ssh2
2020-07-24T22:01:00.095060dmca.cloudsearch.cf sshd[30532]: Invalid user jing from 106.12.166.167 port 25662
2020-07-24T22:01:00.100275dmca.cloudsearch.cf sshd[30532]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.166.167
2020-07-24T22:01:00.095060dmca.cloudsearch.cf sshd[30532]: Invalid user jing from 106.12.166.167 port 25662
2020-07-24T22:01:02.878395dmca.cloudsearch.cf sshd[30532]: Failed password for invalid user jing from 106.12.166.1
...

web-1 [ssh] SSH Attack

Jun 30 17:53:34 lukav-desktop sshd\[9714\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.166.167  user=root
Jun 30 17:53:35 lukav-desktop sshd\[9714\]: Failed password for root from 106.12.166.167 port 58176 ssh2
Jun 30 17:57:56 lukav-desktop sshd\[9767\]: Invalid user demo from 106.12.166.167
Jun 30 17:57:56 lukav-desktop sshd\[9767\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.166.167
Jun 30 17:57:58 lukav-desktop sshd\[9767\]: Failed password for invalid user demo from 106.12.166.167 port 47993 ssh2

Jun 30 08:43:29 roki-contabo sshd\[14082\]: Invalid user ubuntu from 106.12.166.167
Jun 30 08:43:29 roki-contabo sshd\[14082\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.166.167
Jun 30 08:43:31 roki-contabo sshd\[14082\]: Failed password for invalid user ubuntu from 106.12.166.167 port 18181 ssh2
Jun 30 08:50:12 roki-contabo sshd\[14227\]: Invalid user virtual from 106.12.166.167
Jun 30 08:50:12 roki-contabo sshd\[14227\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.166.167
...

Jun  2 16:59:41 ny01 sshd[27294]: Failed password for root from 106.12.166.167 port 47942 ssh2
Jun  2 17:03:29 ny01 sshd[27901]: Failed password for root from 106.12.166.167 port 46027 ssh2

2020-06-01T12:31:29.116719abusebot-2.cloudsearch.cf sshd[31909]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.166.166  user=root
2020-06-01T12:31:31.070617abusebot-2.cloudsearch.cf sshd[31909]: Failed password for root from 106.12.166.166 port 47490 ssh2
2020-06-01T12:35:39.059360abusebot-2.cloudsearch.cf sshd[31938]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.166.166  user=root
2020-06-01T12:35:40.998436abusebot-2.cloudsearch.cf sshd[31938]: Failed password for root from 106.12.166.166 port 59140 ssh2
2020-06-01T12:37:35.509165abusebot-2.cloudsearch.cf sshd[31996]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.166.166  user=root
2020-06-01T12:37:37.708848abusebot-2.cloudsearch.cf sshd[31996]: Failed password for root from 106.12.166.166 port 53064 ssh2
2020-06-01T12:39:13.199731abusebot-2.cloudsearch.cf sshd[32044]: pam_unix(sshd:auth):
...

May 31 06:58:55 jane sshd[5158]: Failed password for backup from 106.12.166.166 port 49286 ssh2
May 31 07:02:54 jane sshd[9172]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.166.166 
...

2020-05-29T10:54:52.679092billing sshd[29711]: Failed password for root from 106.12.166.166 port 60388 ssh2
2020-05-29T10:58:42.687280billing sshd[6007]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.166.166  user=root
2020-05-29T10:58:44.887690billing sshd[6007]: Failed password for root from 106.12.166.166 port 59312 ssh2
...

Invalid user zsh from 68.183.148.159 port 52488

Jun 18 20:52:20 pve1 sshd[7175]: Failed password for root from 222.186.175.182 port 59176 ssh2
Jun 18 20:52:25 pve1 sshd[7175]: Failed password for root from 222.186.175.182 port 59176 ssh2
...

[Tue Dec 10 00:07:35.418765 2019] [access_compat:error] [pid 22626] [client 49.235.83.106:52991] AH01797: client denied by server configuration: /var/www/html/josh/wp-login.php
...

2020-02-13T16:53:37.019Z CLOSE host=131.0.244.14 port=61134 fd=4 time=20.014 bytes=14
...

Jun 18 11:12:40 mail.srvfarm.net postfix/smtps/smtpd[1409843]: warning: unknown[200.46.43.122]: SASL PLAIN authentication failed: 
Jun 18 11:12:40 mail.srvfarm.net postfix/smtps/smtpd[1409843]: lost connection after AUTH from unknown[200.46.43.122]
Jun 18 11:15:30 mail.srvfarm.net postfix/smtpd[1408941]: warning: unknown[200.46.43.122]: SASL PLAIN authentication failed: 
Jun 18 11:15:30 mail.srvfarm.net postfix/smtpd[1408941]: lost connection after AUTH from unknown[200.46.43.122]
Jun 18 11:20:16 mail.srvfarm.net postfix/smtpd[1409762]: warning: unknown[200.46.43.122]: SASL PLAIN authentication failed:

Jun 18 18:26:23 hosting sshd[22848]: Invalid user akt from 140.143.208.213 port 60564
Jun 18 18:26:23 hosting sshd[22848]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=140.143.208.213
Jun 18 18:26:23 hosting sshd[22848]: Invalid user akt from 140.143.208.213 port 60564
Jun 18 18:26:24 hosting sshd[22848]: Failed password for invalid user akt from 140.143.208.213 port 60564 ssh2
Jun 18 18:29:23 hosting sshd[22921]: Invalid user deploy from 140.143.208.213 port 55708
...

Brute forcing RDP port 3389

2020-06-18T10:37:18.9639271495-001 sshd[44763]: Invalid user hadoop from 129.211.85.214 port 49910
2020-06-18T10:37:18.9668931495-001 sshd[44763]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.211.85.214
2020-06-18T10:37:18.9639271495-001 sshd[44763]: Invalid user hadoop from 129.211.85.214 port 49910
2020-06-18T10:37:21.2613701495-001 sshd[44763]: Failed password for invalid user hadoop from 129.211.85.214 port 49910 ssh2
2020-06-18T10:40:15.5204671495-001 sshd[44841]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.211.85.214  user=root
2020-06-18T10:40:17.7799741495-001 sshd[44841]: Failed password for root from 129.211.85.214 port 49582 ssh2
...

Jun 18 14:14:48 relay dovecot: imap-login: Disconnected: Inactivity \(auth failed, 1 attempts in 180 secs\): user=\, method=PLAIN, rip=185.22.142.197, lip=176.9.177.164, session=\
Jun 18 14:14:50 relay dovecot: imap-login: Disconnected: Inactivity \(auth failed, 1 attempts in 180 secs\): user=\, method=PLAIN, rip=185.22.142.197, lip=176.9.177.164, session=\<3wxwrlqoHHe5Fo7F\>
Jun 18 14:15:13 relay dovecot: imap-login: Disconnected: Inactivity \(auth failed, 1 attempts in 180 secs\): user=\, method=PLAIN, rip=185.22.142.197, lip=176.9.177.164, session=\
Jun 18 14:20:52 relay dovecot: imap-login: Disconnected: Inactivity \(auth failed, 1 attempts in 180 secs\): user=\, method=PLAIN, rip=185.22.142.197, lip=176.9.177.164, session=\
Jun 18 14:20:54 relay dovecot: imap-login: Disconnected: Inactivity \(auth failed, 1 attempts in 180
...

[Sun Feb 16 13:05:36.574946 2020] [authz_core:error] [pid 28553] [client 49.233.171.215:33165] AH01630: client denied by server configuration: /var/www/html/luke/.php
...

Unauthorized connection attempt from IP address 183.82.138.131 on Port 445(SMB)

2020-04-20T18:09:07.974Z CLOSE host=130.61.246.78 port=18184 fd=4 time=30.007 bytes=39
...

GET /?q=user

May  5 18:15:21 mercury wordpress(www.learnargentinianspanish.com)[27874]: XML-RPC authentication failure for josh from 198.187.29.100
...

Unauthorized connection attempt from IP address 93.90.44.26 on Port 445(SMB)