Exploited Host.

2020-06-08T15:13:57.554814vps773228.ovh.net sshd[8541]: Failed password for root from 134.175.219.41 port 41580 ssh2
2020-06-08T15:19:41.389537vps773228.ovh.net sshd[8629]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.175.219.41  user=root
2020-06-08T15:19:43.204127vps773228.ovh.net sshd[8629]: Failed password for root from 134.175.219.41 port 43925 ssh2
2020-06-08T15:24:56.983614vps773228.ovh.net sshd[8755]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.175.219.41  user=root
2020-06-08T15:24:58.376163vps773228.ovh.net sshd[8755]: Failed password for root from 134.175.219.41 port 46266 ssh2
...

This client attempted to login to an administrator account on a Website, or abused from another resource.

2020-05-31T22:16:11.979733tekno.at sshd[6668]: Failed password for root from 134.175.219.41 port 23312 ssh2
2020-05-31T22:21:54.648969tekno.at sshd[7196]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.175.219.41  user=root
2020-05-31T22:21:56.856118tekno.at sshd[7196]: Failed password for root from 134.175.219.41 port 27125 ssh2
...

ssh brute force

$f2bV_matches

2020-04-18T15:47:09.502943abusebot.cloudsearch.cf sshd[662]: Invalid user qv from 134.175.219.41 port 21185
2020-04-18T15:47:09.509070abusebot.cloudsearch.cf sshd[662]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.175.219.41
2020-04-18T15:47:09.502943abusebot.cloudsearch.cf sshd[662]: Invalid user qv from 134.175.219.41 port 21185
2020-04-18T15:47:11.360119abusebot.cloudsearch.cf sshd[662]: Failed password for invalid user qv from 134.175.219.41 port 21185 ssh2
2020-04-18T15:52:04.932293abusebot.cloudsearch.cf sshd[960]: Invalid user ftpuser from 134.175.219.41 port 16008
2020-04-18T15:52:04.939897abusebot.cloudsearch.cf sshd[960]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.175.219.41
2020-04-18T15:52:04.932293abusebot.cloudsearch.cf sshd[960]: Invalid user ftpuser from 134.175.219.41 port 16008
2020-04-18T15:52:06.956375abusebot.cloudsearch.cf sshd[960]: Failed password for invalid user ftp
...

SSH bruteforce (Triggered fail2ban)

Apr 10 05:57:38 DAAP sshd[23846]: Invalid user toro from 134.175.219.41 port 42200
Apr 10 05:57:38 DAAP sshd[23846]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.175.219.41
Apr 10 05:57:38 DAAP sshd[23846]: Invalid user toro from 134.175.219.41 port 42200
Apr 10 05:57:39 DAAP sshd[23846]: Failed password for invalid user toro from 134.175.219.41 port 42200 ssh2
Apr 10 05:58:29 DAAP sshd[23885]: Invalid user mongo from 134.175.219.41 port 50466
...

SSH bruteforce (Triggered fail2ban)

Brute force SMTP login attempted.
...

Mar 26 19:42:02 webhost01 sshd[23783]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.175.219.41
Mar 26 19:42:04 webhost01 sshd[23783]: Failed password for invalid user cipy from 134.175.219.41 port 28699 ssh2
...

Oct  3 20:27:05 marvibiene sshd[16158]: Failed password for root from 134.175.219.148 port 56684 ssh2
Oct  3 20:28:06 marvibiene sshd[16231]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.175.219.148 
Oct  3 20:28:07 marvibiene sshd[16231]: Failed password for invalid user www from 134.175.219.148 port 34152 ssh2

Invalid user pen from 134.175.219.148 port 54900

Mar 17 02:34:09 hell sshd[30057]: Failed password for root from 134.175.219.128 port 47734 ssh2
Mar 17 02:46:34 hell sshd[32717]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.175.219.128
...

Triggered by Fail2Ban at Vostok web server

Dec  3 19:30:27 gw1 sshd[27077]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.175.219.96
Dec  3 19:30:29 gw1 sshd[27077]: Failed password for invalid user disabled from 134.175.219.96 port 49556 ssh2
...

Aug 19 02:11:35 mail sshd\[12372\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.175.219.34
Aug 19 02:11:37 mail sshd\[12372\]: Failed password for invalid user user from 134.175.219.34 port 48526 ssh2
Aug 19 02:16:23 mail sshd\[12946\]: Invalid user m from 134.175.219.34 port 36909
Aug 19 02:16:23 mail sshd\[12946\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.175.219.34
Aug 19 02:16:25 mail sshd\[12946\]: Failed password for invalid user m from 134.175.219.34 port 36909 ssh2

SSH invalid-user multiple login attempts

Brute force SMTP login attempted.
...

2019-08-02T14:26:34.636363abusebot-6.cloudsearch.cf sshd\[28018\]: Invalid user guest from 134.175.219.34 port 18979

Aug  1 06:07:31 dedicated sshd[4112]: Invalid user pramod from 134.175.219.34 port 18962

Jul 23 11:12:04 icinga sshd[10069]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.175.219.34
Jul 23 11:12:06 icinga sshd[10069]: Failed password for invalid user dispecer from 134.175.219.34 port 60113 ssh2
...

Jul 15 02:32:05 meumeu sshd[7528]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.175.219.34 
Jul 15 02:32:07 meumeu sshd[7528]: Failed password for invalid user telefon from 134.175.219.34 port 52048 ssh2
Jul 15 02:37:44 meumeu sshd[8661]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.175.219.34 
...

Jul  5 00:56:38 ncomp sshd[28974]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.175.219.34  user=root
Jul  5 00:56:39 ncomp sshd[28974]: Failed password for root from 134.175.219.34 port 39120 ssh2
Jul  5 00:59:45 ncomp sshd[29021]: Invalid user laraht from 134.175.219.34

$f2bV_matches

Brute-Force attack detected (85) and blocked by Fail2Ban.

163.172.42.123 - - [29/Apr/2020:10:43:26 +0200] "GET /wp-login.php HTTP/1.1" 200 6108 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
163.172.42.123 - - [29/Apr/2020:10:43:28 +0200] "POST /wp-login.php HTTP/1.1" 200 6338 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
163.172.42.123 - - [29/Apr/2020:10:43:29 +0200] "POST /xmlrpc.php HTTP/1.1" 200 427 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"

Apr 29 11:11:01 server sshd[43734]: Failed none for root from 222.186.180.41 port 9634 ssh2
Apr 29 11:11:04 server sshd[43734]: Failed password for root from 222.186.180.41 port 9634 ssh2
Apr 29 11:11:06 server sshd[43734]: Failed password for root from 222.186.180.41 port 9634 ssh2

Invalid user media from 218.232.135.95 port 37086

port scan and connect, tcp 23 (telnet)

2020-04-29T16:42:40.571972vivaldi2.tree2.info sshd[16333]: Invalid user fahad from 51.75.248.241
2020-04-29T16:42:40.589613vivaldi2.tree2.info sshd[16333]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=241.ip-51-75-248.eu
2020-04-29T16:42:40.571972vivaldi2.tree2.info sshd[16333]: Invalid user fahad from 51.75.248.241
2020-04-29T16:42:42.481587vivaldi2.tree2.info sshd[16333]: Failed password for invalid user fahad from 51.75.248.241 port 37616 ssh2
2020-04-29T16:46:29.062892vivaldi2.tree2.info sshd[16413]: Invalid user mysql from 51.75.248.241
...

Apr 29 10:40:15 debian-2gb-nbg1-2 kernel: \[10408537.582842\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=103.145.12.61 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=245 ID=6384 PROTO=TCP SPT=51574 DPT=81 WINDOW=1024 RES=0x00 SYN URGP=0

2020-04-29T06:38:50.068939shield sshd\[24962\]: Invalid user ts3 from 125.220.210.185 port 51624
2020-04-29T06:38:50.072610shield sshd\[24962\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.220.210.185
2020-04-29T06:38:52.162607shield sshd\[24962\]: Failed password for invalid user ts3 from 125.220.210.185 port 51624 ssh2
2020-04-29T06:42:03.289031shield sshd\[25378\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.220.210.185  user=root
2020-04-29T06:42:05.539861shield sshd\[25378\]: Failed password for root from 125.220.210.185 port 54072 ssh2

[Aegis] @ 2019-07-01 14:18:51  0100 -> Attempted Administrator Privilege Gain: ET SCAN LibSSH Based Frequent SSH Connections Likely BruteForce Attack

" "

port scan and connect, tcp 1433 (ms-sql-s)

[2020-04-29 05:18:26] NOTICE[1170][C-00008022] chan_sip.c: Call from '' (142.93.73.124:57119) to extension '10046462607543' rejected because extension not found in context 'public'.
[2020-04-29 05:18:26] SECURITY[1184] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-04-29T05:18:26.401-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="10046462607543",SessionID="0x7f6c083b5ae8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/142.93.73.124/57119",ACLName="no_extension_match"
[2020-04-29 05:18:53] NOTICE[1170][C-00008025] chan_sip.c: Call from '' (142.93.73.124:62866) to extension '001146462607543' rejected because extension not found in context 'public'.
[2020-04-29 05:18:53] SECURITY[1184] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-04-29T05:18:53.147-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="001146462607543",SessionID="0x7f6c086f7488",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/14
...

Apr 29 08:54:45 scw-6657dc sshd[4935]: Failed password for root from 222.186.52.39 port 10519 ssh2
Apr 29 08:54:45 scw-6657dc sshd[4935]: Failed password for root from 222.186.52.39 port 10519 ssh2
Apr 29 08:54:48 scw-6657dc sshd[4935]: Failed password for root from 222.186.52.39 port 10519 ssh2
...

Dovecot Invalid User Login Attempt.

failed root login

(From barbaratysonhw@yahoo.com) Hi,

We'd like to introduce to you our explainer video service which we feel can benefit your site plinkechiropractic.com.

Check out some of our existing videos here:
https://www.youtube.com/watch?v=oYoUQjxvhA0
https://www.youtube.com/watch?v=MOnhn77TgDE
https://www.youtube.com/watch?v=NKY4a3hvmUc

All of our videos are in a similar animated format as the above examples and we have voice over artists with US/UK/Australian accents.

They can show a solution to a problem or simply promote one of your products or services. They are concise, can be uploaded to video such as Youtube, and can be embedded into your website or featured on landing pages.

Our prices are as follows depending on video length:
0-1 minutes = $159
1-2 minutes = $269

*All prices above are in USD and include a custom video, full script and a voice-over.

If this is something you would like to discuss further, don't hesitate to get in touch.
If you are not interested, simply delete this me