ZmEu vulnerability scanner used to probe for vulnerable PHPMyAdmin installations and guess SSH passwords.

106.12.200.160 - - [29/Apr/2020:22:00:16 +0000] "GET /w00tw00t.at.blackhats.romanian.anti-sec:) HTTP/1.1" 403 154 "-" "ZmEu"

(sshd) Failed SSH login from 106.12.200.160 (CN/China/-): 5 in the last 3600 secs

2020-04-22T14:32:27.567011mail.broermann.family sshd[14407]: Invalid user aj from 106.12.200.160 port 41250
2020-04-22T14:32:27.573538mail.broermann.family sshd[14407]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.200.160
2020-04-22T14:32:27.567011mail.broermann.family sshd[14407]: Invalid user aj from 106.12.200.160 port 41250
2020-04-22T14:32:29.549501mail.broermann.family sshd[14407]: Failed password for invalid user aj from 106.12.200.160 port 41250 ssh2
2020-04-22T14:36:00.590682mail.broermann.family sshd[14585]: User root from 106.12.200.160 not allowed because not listed in AllowUsers
...

2020-04-04T09:31:30.113255dmca.cloudsearch.cf sshd[20370]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.200.160  user=root
2020-04-04T09:31:32.070449dmca.cloudsearch.cf sshd[20370]: Failed password for root from 106.12.200.160 port 44798 ssh2
2020-04-04T09:34:24.880783dmca.cloudsearch.cf sshd[20665]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.200.160  user=root
2020-04-04T09:34:27.058691dmca.cloudsearch.cf sshd[20665]: Failed password for root from 106.12.200.160 port 51484 ssh2
2020-04-04T09:37:20.423062dmca.cloudsearch.cf sshd[20860]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.200.160  user=root
2020-04-04T09:37:22.430306dmca.cloudsearch.cf sshd[20860]: Failed password for root from 106.12.200.160 port 58170 ssh2
2020-04-04T09:40:14.625209dmca.cloudsearch.cf sshd[21070]: pam_unix(sshd:auth): authentication failure; logname= uid=0 eu
...

Mar 24 22:16:55 vps46666688 sshd[27413]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.200.160
Mar 24 22:16:57 vps46666688 sshd[27413]: Failed password for invalid user apimobile from 106.12.200.160 port 57132 ssh2
...

SSH bruteforce

2020-09-28T09:12:44.909681linuxbox-skyline sshd[202304]: Invalid user www from 106.12.200.239 port 54772
...

Aug  7 05:47:57 rotator sshd\[10543\]: Invalid user \<\;stddef.h\>\; from 106.12.200.239Aug  7 05:47:59 rotator sshd\[10543\]: Failed password for invalid user \<\;stddef.h\>\; from 106.12.200.239 port 39542 ssh2Aug  7 05:51:39 rotator sshd\[11356\]: Invalid user asd!@\#$ from 106.12.200.239Aug  7 05:51:41 rotator sshd\[11356\]: Failed password for invalid user asd!@\#$ from 106.12.200.239 port 57202 ssh2Aug  7 05:55:29 rotator sshd\[12141\]: Invalid user $cann3r123 from 106.12.200.239Aug  7 05:55:30 rotator sshd\[12141\]: Failed password for invalid user $cann3r123 from 106.12.200.239 port 46620 ssh2
...

Aug  1 23:39:20 vps647732 sshd[26676]: Failed password for root from 106.12.200.239 port 51628 ssh2
...

2020-07-21T22:16:05+0200 Failed SSH Authentication/Brute Force Attack. (Server 10)

2020-07-15 16:15:12,048 fail2ban.actions: WARNING [ssh] Ban 106.12.200.239

1593741323 - 07/03/2020 03:55:23 Host: 106.12.200.145/106.12.200.145 Port: 8080 TCP Blocked

leo_www

May 26 23:53:30 pixelmemory sshd[3978342]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.200.70 
May 26 23:53:30 pixelmemory sshd[3978342]: Invalid user office from 106.12.200.70 port 50130
May 26 23:53:32 pixelmemory sshd[3978342]: Failed password for invalid user office from 106.12.200.70 port 50130 ssh2
May 26 23:59:06 pixelmemory sshd[3987286]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.200.70  user=root
May 26 23:59:08 pixelmemory sshd[3987286]: Failed password for root from 106.12.200.70 port 60162 ssh2
...

May 21 09:04:00 santamaria sshd\[5942\]: Invalid user irv from 106.12.200.70
May 21 09:04:00 santamaria sshd\[5942\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.200.70
May 21 09:04:02 santamaria sshd\[5942\]: Failed password for invalid user irv from 106.12.200.70 port 36538 ssh2
...

Wordpress malicious attack:[sshd]

Apr 23 08:13:25 OPSO sshd\[408\]: Invalid user nw from 106.12.200.70 port 44526
Apr 23 08:13:25 OPSO sshd\[408\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.200.70
Apr 23 08:13:28 OPSO sshd\[408\]: Failed password for invalid user nw from 106.12.200.70 port 44526 ssh2
Apr 23 08:17:28 OPSO sshd\[1320\]: Invalid user testor from 106.12.200.70 port 51216
Apr 23 08:17:28 OPSO sshd\[1320\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.200.70

Mar  4 08:17:41 vpn01 sshd[31935]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.200.213
Mar  4 08:17:43 vpn01 sshd[31935]: Failed password for invalid user yuly from 106.12.200.213 port 51730 ssh2
...

Feb 25 10:33:34 sd-53420 sshd\[18358\]: Invalid user ns2 from 106.12.200.213
Feb 25 10:33:34 sd-53420 sshd\[18358\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.200.213
Feb 25 10:33:36 sd-53420 sshd\[18358\]: Failed password for invalid user ns2 from 106.12.200.213 port 33092 ssh2
Feb 25 10:40:53 sd-53420 sshd\[19194\]: Invalid user debian from 106.12.200.213
Feb 25 10:40:53 sd-53420 sshd\[19194\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.200.213
...

Feb 21 18:11:28 plusreed sshd[28942]: Invalid user ns2server from 106.12.200.213
...

2019-12-09T04:51:05.272720shield sshd\[19985\]: Invalid user rpm from 51.91.122.140 port 53320
2019-12-09T04:51:05.277346shield sshd\[19985\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=140.ip-51-91-122.eu
2019-12-09T04:51:07.619169shield sshd\[19985\]: Failed password for invalid user rpm from 51.91.122.140 port 53320 ssh2
2019-12-09T04:56:49.666802shield sshd\[22023\]: Invalid user aleidis from 51.91.122.140 port 34248
2019-12-09T04:56:49.671299shield sshd\[22023\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=140.ip-51-91-122.eu

2019-12-08T23:52:23.283192homeassistant sshd[22344]: Failed password for invalid user wehnnetta from 193.112.4.12 port 37390 ssh2
2019-12-09T04:56:40.626877homeassistant sshd[31157]: Invalid user mnbvcxz from 193.112.4.12 port 43502
2019-12-09T04:56:40.633665homeassistant sshd[31157]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.112.4.12
...

Dec  9 05:50:25 dev0-dcde-rnet sshd[11661]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.119.3.77
Dec  9 05:50:27 dev0-dcde-rnet sshd[11661]: Failed password for invalid user sdunning from 58.119.3.77 port 53844 ssh2
Dec  9 05:56:23 dev0-dcde-rnet sshd[11826]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.119.3.77

Dec  9 05:49:40 meumeu sshd[12684]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=171.244.51.114 
Dec  9 05:49:43 meumeu sshd[12684]: Failed password for invalid user anneheidi from 171.244.51.114 port 45206 ssh2
Dec  9 05:56:52 meumeu sshd[13901]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=171.244.51.114 
...

Dec  8 19:37:28 web9 sshd\[25540\]: Invalid user user1 from 171.110.123.41
Dec  8 19:37:28 web9 sshd\[25540\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=171.110.123.41
Dec  8 19:37:30 web9 sshd\[25540\]: Failed password for invalid user user1 from 171.110.123.41 port 54205 ssh2
Dec  8 19:43:50 web9 sshd\[26687\]: Invalid user yoyo from 171.110.123.41
Dec  8 19:43:50 web9 sshd\[26687\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=171.110.123.41

Dec  8 19:09:50 web9 sshd\[20896\]: Invalid user kingfish from 187.58.65.21
Dec  8 19:09:50 web9 sshd\[20896\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.58.65.21
Dec  8 19:09:52 web9 sshd\[20896\]: Failed password for invalid user kingfish from 187.58.65.21 port 56461 ssh2
Dec  8 19:16:29 web9 sshd\[22077\]: Invalid user ubnt from 187.58.65.21
Dec  8 19:16:29 web9 sshd\[22077\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.58.65.21

Dec  8 18:49:45 php1 sshd\[22583\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.72.5.46  user=root
Dec  8 18:49:47 php1 sshd\[22583\]: Failed password for root from 177.72.5.46 port 53180 ssh2
Dec  8 18:56:47 php1 sshd\[23235\]: Invalid user jovaughn from 177.72.5.46
Dec  8 18:56:47 php1 sshd\[23235\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.72.5.46
Dec  8 18:56:49 php1 sshd\[23235\]: Failed password for invalid user jovaughn from 177.72.5.46 port 34186 ssh2

2019-12-09T05:30:09.703759talon auth[2071822]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=admin@catram.org rhost=45.82.153.140
2019-12-09T05:30:33.891460talon auth[2071822]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=admin@catram.org rhost=45.82.153.140
2019-12-09T05:30:49.362468talon auth[2071822]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=admin@catram.org rhost=45.82.153.140

Dec  9 05:56:36 mintao sshd\[32144\]: Invalid user pi from 85.195.52.41\
Dec  9 05:56:36 mintao sshd\[32146\]: Invalid user pi from 85.195.52.41\

SASL broute force

SSH bruteforce

Dec  9 05:56:13 vpn01 sshd[27513]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.165.102
Dec  9 05:56:15 vpn01 sshd[27513]: Failed password for invalid user 123456 from 138.68.165.102 port 48194 ssh2
...

Dec  9 04:55:05 web8 sshd\[31605\]: Invalid user britto from 104.225.223.31
Dec  9 04:55:05 web8 sshd\[31605\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.225.223.31
Dec  9 04:55:07 web8 sshd\[31605\]: Failed password for invalid user britto from 104.225.223.31 port 53194 ssh2
Dec  9 05:01:06 web8 sshd\[2348\]: Invalid user follis from 104.225.223.31
Dec  9 05:01:06 web8 sshd\[2348\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.225.223.31

12/08/2019-23:56:33.660490 93.174.93.26 Protocol: 6 ET SCAN NMAP -sS window 1024

Dec  9 06:20:24 localhost sshd\[27561\]: Invalid user work from 159.65.149.114
Dec  9 06:20:24 localhost sshd\[27561\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.65.149.114
Dec  9 06:20:26 localhost sshd\[27561\]: Failed password for invalid user work from 159.65.149.114 port 41136 ssh2
Dec  9 06:26:47 localhost sshd\[28204\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.65.149.114  user=root
Dec  9 06:26:49 localhost sshd\[28204\]: Failed password for root from 159.65.149.114 port 51024 ssh2
...