Failed password for invalid user root from 125.78.160.160 port 53590 ssh2

Failed password for invalid user root from 125.78.160.160 port 53590 ssh2

Failed password for invalid user root from 125.78.160.160 port 53590 ssh2

Lines containing failures of 125.78.160.160
Oct  5 07:43:02 neweola sshd[3035]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.78.160.160  user=r.r
Oct  5 07:43:04 neweola sshd[3035]: Failed password for r.r from 125.78.160.160 port 36114 ssh2
Oct  5 07:43:04 neweola sshd[3035]: Received disconnect from 125.78.160.160 port 36114:11: Bye Bye [preauth]
Oct  5 07:43:04 neweola sshd[3035]: Disconnected from authenticating user r.r 125.78.160.160 port 36114 [preauth]
Oct  5 07:51:38 neweola sshd[3378]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.78.160.160  user=r.r
Oct  5 07:51:40 neweola sshd[3378]: Failed password for r.r from 125.78.160.160 port 59518 ssh2
Oct  5 07:51:40 neweola sshd[3378]: Received disconnect from 125.78.160.160 port 59518:11: Bye Bye [preauth]
Oct  5 07:51:40 neweola sshd[3378]: Disconnected from authenticating user r.r 125.78.160.160 port 59518 [preauth]
Oct  ........
------------------------------

Lines containing failures of 125.78.160.160
Oct  5 07:43:02 neweola sshd[3035]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.78.160.160  user=r.r
Oct  5 07:43:04 neweola sshd[3035]: Failed password for r.r from 125.78.160.160 port 36114 ssh2
Oct  5 07:43:04 neweola sshd[3035]: Received disconnect from 125.78.160.160 port 36114:11: Bye Bye [preauth]
Oct  5 07:43:04 neweola sshd[3035]: Disconnected from authenticating user r.r 125.78.160.160 port 36114 [preauth]
Oct  5 07:51:38 neweola sshd[3378]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.78.160.160  user=r.r
Oct  5 07:51:40 neweola sshd[3378]: Failed password for r.r from 125.78.160.160 port 59518 ssh2
Oct  5 07:51:40 neweola sshd[3378]: Received disconnect from 125.78.160.160 port 59518:11: Bye Bye [preauth]
Oct  5 07:51:40 neweola sshd[3378]: Disconnected from authenticating user r.r 125.78.160.160 port 59518 [preauth]
Oct  ........
------------------------------

SSH login attempts.

Lines containing failures of 125.78.160.160
Oct  5 07:43:02 neweola sshd[3035]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.78.160.160  user=r.r
Oct  5 07:43:04 neweola sshd[3035]: Failed password for r.r from 125.78.160.160 port 36114 ssh2
Oct  5 07:43:04 neweola sshd[3035]: Received disconnect from 125.78.160.160 port 36114:11: Bye Bye [preauth]
Oct  5 07:43:04 neweola sshd[3035]: Disconnected from authenticating user r.r 125.78.160.160 port 36114 [preauth]
Oct  5 07:51:38 neweola sshd[3378]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.78.160.160  user=r.r
Oct  5 07:51:40 neweola sshd[3378]: Failed password for r.r from 125.78.160.160 port 59518 ssh2
Oct  5 07:51:40 neweola sshd[3378]: Received disconnect from 125.78.160.160 port 59518:11: Bye Bye [preauth]
Oct  5 07:51:40 neweola sshd[3378]: Disconnected from authenticating user r.r 125.78.160.160 port 59518 [preauth]
Oct  ........
------------------------------

2020-10-06T13:24:32.604495server.espacesoutien.com sshd[15238]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.78.160.160  user=root
2020-10-06T13:24:34.191760server.espacesoutien.com sshd[15238]: Failed password for root from 125.78.160.160 port 37030 ssh2
2020-10-06T13:27:48.959890server.espacesoutien.com sshd[15822]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.78.160.160  user=root
2020-10-06T13:27:50.788291server.espacesoutien.com sshd[15822]: Failed password for root from 125.78.160.160 port 42078 ssh2
...

(sshd) Failed SSH login from 125.78.160.160 (CN/China/Fujian/Quanzhou/160.160.78.125.broad.qz.fj.dynamic.163data.com.cn): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Oct  6 00:02:43 atlas sshd[24850]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.78.160.160  user=root
Oct  6 00:02:45 atlas sshd[24850]: Failed password for root from 125.78.160.160 port 51340 ssh2
Oct  6 00:16:11 atlas sshd[28111]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.78.160.160  user=root
Oct  6 00:16:13 atlas sshd[28111]: Failed password for root from 125.78.160.160 port 58996 ssh2
Oct  6 00:20:25 atlas sshd[29162]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.78.160.160  user=root

MYH,DEF GET /downloader/

Jul  7 15:22:51 localhost postfix/smtpd\[13653\]: warning: unknown\[125.78.166.134\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jul  7 15:23:06 localhost postfix/smtpd\[13653\]: warning: unknown\[125.78.166.134\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jul  7 15:23:20 localhost postfix/smtpd\[13653\]: warning: unknown\[125.78.166.134\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jul  7 15:23:40 localhost postfix/smtpd\[13653\]: warning: unknown\[125.78.166.134\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jul  7 15:23:52 localhost postfix/smtpd\[13653\]: warning: unknown\[125.78.166.134\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
...

Mar 20 18:30:16 web9 sshd\[7299\]: Invalid user admin from 118.99.104.147
Mar 20 18:30:16 web9 sshd\[7299\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.99.104.147
Mar 20 18:30:18 web9 sshd\[7299\]: Failed password for invalid user admin from 118.99.104.147 port 35128 ssh2
Mar 20 18:31:36 web9 sshd\[7524\]: Invalid user ag from 118.99.104.147
Mar 20 18:31:36 web9 sshd\[7524\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.99.104.147

Mar 21 05:07:52 h2779839 sshd[23724]: Invalid user alessio from 210.183.21.48 port 14647
Mar 21 05:07:52 h2779839 sshd[23724]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.183.21.48
Mar 21 05:07:52 h2779839 sshd[23724]: Invalid user alessio from 210.183.21.48 port 14647
Mar 21 05:07:54 h2779839 sshd[23724]: Failed password for invalid user alessio from 210.183.21.48 port 14647 ssh2
Mar 21 05:12:26 h2779839 sshd[23851]: Invalid user hobbit from 210.183.21.48 port 20068
Mar 21 05:12:26 h2779839 sshd[23851]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.183.21.48
Mar 21 05:12:26 h2779839 sshd[23851]: Invalid user hobbit from 210.183.21.48 port 20068
Mar 21 05:12:28 h2779839 sshd[23851]: Failed password for invalid user hobbit from 210.183.21.48 port 20068 ssh2
Mar 21 05:16:51 h2779839 sshd[23913]: Invalid user wusifan from 210.183.21.48 port 6878
...

Mar 21 04:51:02 SilenceServices sshd[11903]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.23.204.130
Mar 21 04:51:05 SilenceServices sshd[11903]: Failed password for invalid user admin from 94.23.204.130 port 18992 ssh2
Mar 21 04:54:43 SilenceServices sshd[12906]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.23.204.130

Mar 21 05:53:39 elektron postfix/smtpd\[24523\]: NOQUEUE: reject: RCPT from unknown\[112.84.61.17\]: 450 4.7.1 Client host rejected: cannot find your hostname, \[112.84.61.17\]\; from=\ to=\ proto=ESMTP helo=\
Mar 21 05:54:33 elektron postfix/smtpd\[24523\]: NOQUEUE: reject: RCPT from unknown\[112.84.61.17\]: 450 4.7.1 Client host rejected: cannot find your hostname, \[112.84.61.17\]\; from=\ to=\ proto=ESMTP helo=\
Mar 21 05:55:20 elektron postfix/smtpd\[24523\]: NOQUEUE: reject: RCPT from unknown\[112.84.61.17\]: 450 4.7.1 Client host rejected: cannot find your hostname, \[112.84.61.17\]\; from=\ to=\ proto=ESMTP helo=\
Mar 21 05:56:17 elektron postfix/smtpd\[24523\]: NOQUEUE: reject: RCPT from unknown\[112.84.61.17\]: 450 4.7.1 Client host rejected: cannot find your hostname, \[112.84.61.17\]\; from=\ to=\ proto=ESMTP helo=\
Mar

Mar 20 18:27:15 hanapaa sshd\[25577\]: Invalid user glenys from 125.213.191.73
Mar 20 18:27:15 hanapaa sshd\[25577\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.213.191.73
Mar 20 18:27:17 hanapaa sshd\[25577\]: Failed password for invalid user glenys from 125.213.191.73 port 57314 ssh2
Mar 20 18:31:49 hanapaa sshd\[25928\]: Invalid user jaye from 125.213.191.73
Mar 20 18:31:49 hanapaa sshd\[25928\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.213.191.73

Port probing on unauthorized port 445

Mar 21 00:12:52 plusreed sshd[6444]: Invalid user administrator from 80.211.9.57
Mar 21 00:12:52 plusreed sshd[6444]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.9.57
Mar 21 00:12:52 plusreed sshd[6444]: Invalid user administrator from 80.211.9.57
Mar 21 00:12:53 plusreed sshd[6444]: Failed password for invalid user administrator from 80.211.9.57 port 51422 ssh2
...

Mar 21 04:48:01 sd-53420 sshd\[6231\]: Invalid user jinna from 211.253.24.250
Mar 21 04:48:01 sd-53420 sshd\[6231\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.253.24.250
Mar 21 04:48:03 sd-53420 sshd\[6231\]: Failed password for invalid user jinna from 211.253.24.250 port 53472 ssh2
Mar 21 04:55:05 sd-53420 sshd\[8460\]: Invalid user reunion2 from 211.253.24.250
Mar 21 04:55:05 sd-53420 sshd\[8460\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.253.24.250
...

Mar 21 04:23:51 vlre-nyc-1 sshd\[30914\]: Invalid user support from 92.222.156.151
Mar 21 04:23:51 vlre-nyc-1 sshd\[30914\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.222.156.151
Mar 21 04:23:53 vlre-nyc-1 sshd\[30914\]: Failed password for invalid user support from 92.222.156.151 port 57312 ssh2
Mar 21 04:27:33 vlre-nyc-1 sshd\[31074\]: Invalid user student from 92.222.156.151
Mar 21 04:27:33 vlre-nyc-1 sshd\[31074\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.222.156.151
...

"SMTP brute force auth login attempt."

SSH bruteforce

89.248.167.131 was recorded 5 times by 5 hosts attempting to connect to the following ports: 995,25565,13579,5009,4730. Incident counter (4h, 24h, all-time): 5, 19, 3322

Attempted connection to port 22.

Mar 21 10:50:44 itv-usvr-02 sshd[20756]: Invalid user jingyun from 159.65.144.64 port 38282
Mar 21 10:50:44 itv-usvr-02 sshd[20756]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.65.144.64
Mar 21 10:50:44 itv-usvr-02 sshd[20756]: Invalid user jingyun from 159.65.144.64 port 38282
Mar 21 10:50:46 itv-usvr-02 sshd[20756]: Failed password for invalid user jingyun from 159.65.144.64 port 38282 ssh2
Mar 21 10:55:13 itv-usvr-02 sshd[20866]: Invalid user au from 159.65.144.64 port 56386

*Port Scan* detected from 67.205.135.65 (US/United States/New Jersey/North Bergen/-). 4 hits in the last 276 seconds