Aug 29 05:29:52 cho postfix/smtpd[1841803]: warning: blogkubet.com[134.209.108.33]: SASL PLAIN authentication failed: 
Aug 29 05:29:59 cho postfix/smtpd[1841805]: warning: blogkubet.com[134.209.108.33]: SASL PLAIN authentication failed: 
Aug 29 05:30:17 cho postfix/smtpd[1841803]: warning: blogkubet.com[134.209.108.33]: SASL PLAIN authentication failed: 
Aug 29 05:30:20 cho postfix/smtpd[1841805]: warning: blogkubet.com[134.209.108.33]: SASL PLAIN authentication failed: 
Aug 29 05:33:57 cho postfix/smtpd[1841803]: warning: blogkubet.com[134.209.108.33]: SASL PLAIN authentication failed: 
...

Invalid user admin from 134.209.108.97 port 55740

The IP has triggered Cloudflare WAF. CF-Ray: 540f625fdd01dddf | WAF_Rule_ID: 1aff1cdfeb5c4074965d7cd85bfc1d4e | WAF_Kind: firewall | CF_Action: challenge | Country: SG | CF_IPClass: noRecord | Protocol: HTTP/2 | Method: GET | Host: ip.skk.moe | User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.2;. en-US) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.108 Safari/537.36 Quark/3.6.2.122 | CF_DC: SIN. Report generated by Cloudflare-WAF-to-AbuseIPDB (https://github.com/SukkaW/Cloudflare-WAF-to-AbuseIPDB).

Nov  3 10:19:29 foo sshd[23529]: Invalid user Oyster from 134.209.108.30
Nov  3 10:19:29 foo sshd[23529]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.108.30 
Nov  3 10:19:32 foo sshd[23529]: Failed password for invalid user Oyster from 134.209.108.30 port 50038 ssh2
Nov  3 10:19:32 foo sshd[23529]: Received disconnect from 134.209.108.30: 11: Bye Bye [preauth]
Nov  3 10:33:06 foo sshd[23752]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.108.30  user=r.r
Nov  3 10:33:08 foo sshd[23752]: Failed password for r.r from 134.209.108.30 port 51916 ssh2
Nov  3 10:33:09 foo sshd[23752]: Received disconnect from 134.209.108.30: 11: Bye Bye [preauth]
Nov  3 10:37:28 foo sshd[23916]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.108.30  user=r.r
Nov  3 10:37:30 foo sshd[23916]: Failed password for r.r from 134.209.108.30 port 34638 ........
-------------------------------

Nov  2 02:49:39 tdfoods sshd\[18369\]: Invalid user grissom from 134.209.108.30
Nov  2 02:49:39 tdfoods sshd\[18369\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.108.30
Nov  2 02:49:40 tdfoods sshd\[18369\]: Failed password for invalid user grissom from 134.209.108.30 port 39180 ssh2
Nov  2 02:54:29 tdfoods sshd\[18737\]: Invalid user wg123 from 134.209.108.30
Nov  2 02:54:29 tdfoods sshd\[18737\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.108.30

Nov  1 02:27:06 auw2 sshd\[8336\]: Invalid user youmuyou from 134.209.108.30
Nov  1 02:27:06 auw2 sshd\[8336\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.108.30
Nov  1 02:27:07 auw2 sshd\[8336\]: Failed password for invalid user youmuyou from 134.209.108.30 port 35024 ssh2
Nov  1 02:31:54 auw2 sshd\[8707\]: Invalid user gamespot from 134.209.108.30
Nov  1 02:31:54 auw2 sshd\[8707\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.108.30

Oct 12 23:57:55 plusreed sshd[23138]: Invalid user steamuser from 134.209.108.106
...

Oct 12 15:50:42 plusreed sshd[12302]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.108.106  user=root
Oct 12 15:50:44 plusreed sshd[12302]: Failed password for root from 134.209.108.106 port 44044 ssh2
...

Oct 12 07:10:02 plusreed sshd[27045]: Invalid user rtkit from 134.209.108.106
...

Oct 11 22:43:12 plusreed sshd[27760]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.108.106  user=mail
Oct 11 22:43:14 plusreed sshd[27760]: Failed password for mail from 134.209.108.106 port 58194 ssh2
...

Oct  6 12:19:46 plusreed sshd[14357]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.108.106  user=root
Oct  6 12:19:48 plusreed sshd[14357]: Failed password for root from 134.209.108.106 port 35170 ssh2
...

Oct  6 00:26:42 wbs sshd\[13364\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.108.106  user=root
Oct  6 00:26:44 wbs sshd\[13364\]: Failed password for root from 134.209.108.106 port 53672 ssh2
Oct  6 00:27:31 wbs sshd\[13439\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.108.106  user=root
Oct  6 00:27:33 wbs sshd\[13439\]: Failed password for root from 134.209.108.106 port 57868 ssh2
Oct  6 00:28:19 wbs sshd\[13517\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.108.106  user=root

Oct  5 10:01:33 web9 sshd\[11967\]: Invalid user brandsma from 134.209.108.106
Oct  5 10:01:33 web9 sshd\[11967\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.108.106
Oct  5 10:01:34 web9 sshd\[11967\]: Failed password for invalid user brandsma from 134.209.108.106 port 38992 ssh2
Oct  5 10:01:55 web9 sshd\[12040\]: Invalid user gary from 134.209.108.106
Oct  5 10:01:55 web9 sshd\[12040\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.108.106

Sep 30 17:59:59 vps691689 sshd[12182]: Failed password for root from 134.209.108.106 port 42760 ssh2
Sep 30 18:01:01 vps691689 sshd[12192]: Failed password for root from 134.209.108.106 port 50996 ssh2
...

Sep 11 10:23:25 hiderm sshd\[5816\]: Invalid user 1234567 from 134.209.108.13
Sep 11 10:23:25 hiderm sshd\[5816\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=b360mm.com
Sep 11 10:23:27 hiderm sshd\[5816\]: Failed password for invalid user 1234567 from 134.209.108.13 port 53106 ssh2
Sep 11 10:29:28 hiderm sshd\[6352\]: Invalid user sammy123 from 134.209.108.13
Sep 11 10:29:28 hiderm sshd\[6352\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=b360mm.com

Dec 16 14:19:57 tux-35-217 sshd\[7930\]: Invalid user etchell from 77.20.107.79 port 38740
Dec 16 14:19:57 tux-35-217 sshd\[7930\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=77.20.107.79
Dec 16 14:19:58 tux-35-217 sshd\[7930\]: Failed password for invalid user etchell from 77.20.107.79 port 38740 ssh2
Dec 16 14:26:38 tux-35-217 sshd\[7986\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=77.20.107.79  user=mail
...

proto=tcp  .  spt=28865  .  dpt=3389  .  src=45.141.85.101  .  dst=xx.xx.4.1  .     (Found on   CINS badguys  Dec 16)     (466)

2019-12-16 00:22:48 H=(ylmf-pc) [117.31.76.149]:61155 I=[192.147.25.65]:25 rejected EHLO or HELO ylmf-pc: CHECK_HELO: ylmf-pc
2019-12-16 00:22:48 H=(ylmf-pc) [117.31.76.149]:52213 I=[192.147.25.65]:25 rejected EHLO or HELO ylmf-pc: CHECK_HELO: ylmf-pc
2019-12-16 00:22:56 H=(ylmf-pc) [117.31.76.149]:50201 I=[192.147.25.65]:25 rejected EHLO or HELO ylmf-pc: CHECK_HELO: ylmf-pc
...

Dec 16 03:21:01 php1 sshd\[31334\]: Invalid user graf from 45.55.155.224
Dec 16 03:21:01 php1 sshd\[31334\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=mail.mailcnx.com
Dec 16 03:21:04 php1 sshd\[31334\]: Failed password for invalid user graf from 45.55.155.224 port 43288 ssh2
Dec 16 03:29:20 php1 sshd\[32443\]: Invalid user qn from 45.55.155.224
Dec 16 03:29:20 php1 sshd\[32443\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=mail.mailcnx.com

Dec 16 15:49:41 server sshd\[8002\]: Invalid user lavey from 104.131.84.59
Dec 16 15:49:41 server sshd\[8002\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.131.84.59 
Dec 16 15:49:42 server sshd\[8002\]: Failed password for invalid user lavey from 104.131.84.59 port 55836 ssh2
Dec 16 15:56:24 server sshd\[10230\]: Invalid user curavo from 104.131.84.59
Dec 16 15:56:24 server sshd\[10230\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.131.84.59 
...

Dec 16 08:28:40 game-panel sshd[16006]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=66.181.167.115
Dec 16 08:28:42 game-panel sshd[16006]: Failed password for invalid user enrique from 66.181.167.115 port 60916 ssh2
Dec 16 08:35:04 game-panel sshd[16300]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=66.181.167.115

2019-12-16T13:06:05.662414  sshd[30497]: Invalid user carbonne from 51.89.68.141 port 58896
2019-12-16T13:06:05.676586  sshd[30497]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.89.68.141
2019-12-16T13:06:05.662414  sshd[30497]: Invalid user carbonne from 51.89.68.141 port 58896
2019-12-16T13:06:07.924523  sshd[30497]: Failed password for invalid user carbonne from 51.89.68.141 port 58896 ssh2
2019-12-16T13:11:43.207891  sshd[30591]: Invalid user davinder from 51.89.68.141 port 38118
...

Dec 16 02:52:14 web1 sshd\[14473\]: Invalid user Admin from 172.81.253.175
Dec 16 02:52:14 web1 sshd\[14473\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=172.81.253.175
Dec 16 02:52:17 web1 sshd\[14473\]: Failed password for invalid user Admin from 172.81.253.175 port 60162 ssh2
Dec 16 02:59:19 web1 sshd\[15182\]: Invalid user kretzschmar from 172.81.253.175
Dec 16 02:59:19 web1 sshd\[15182\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=172.81.253.175

Automated report (2019-12-16T07:06:41+00:00). Misbehaving bot detected at this address.

2019-12-16T13:38:53.466359shield sshd\[14189\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.88.112.61  user=root
2019-12-16T13:38:55.105864shield sshd\[14189\]: Failed password for root from 49.88.112.61 port 36142 ssh2
2019-12-16T13:38:58.377742shield sshd\[14189\]: Failed password for root from 49.88.112.61 port 36142 ssh2
2019-12-16T13:39:01.726799shield sshd\[14189\]: Failed password for root from 49.88.112.61 port 36142 ssh2
2019-12-16T13:39:04.824984shield sshd\[14189\]: Failed password for root from 49.88.112.61 port 36142 ssh2

Dec 16 15:16:42 nextcloud sshd\[18314\]: Invalid user 100000000 from 45.55.80.186
Dec 16 15:16:42 nextcloud sshd\[18314\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.55.80.186
Dec 16 15:16:43 nextcloud sshd\[18314\]: Failed password for invalid user 100000000 from 45.55.80.186 port 45457 ssh2
...

[portscan] Port scan

Dec 16 14:57:56 vps58358 sshd\[3450\]: Invalid user swistak from 62.210.205.155Dec 16 14:57:58 vps58358 sshd\[3450\]: Failed password for invalid user swistak from 62.210.205.155 port 52286 ssh2Dec 16 15:02:52 vps58358 sshd\[3499\]: Invalid user alinus from 62.210.205.155Dec 16 15:02:53 vps58358 sshd\[3499\]: Failed password for invalid user alinus from 62.210.205.155 port 55331 ssh2Dec 16 15:07:39 vps58358 sshd\[3557\]: Invalid user ident from 62.210.205.155Dec 16 15:07:41 vps58358 sshd\[3557\]: Failed password for invalid user ident from 62.210.205.155 port 58377 ssh2
...

SSH Brute Force

WordPress XMLRPC scan :: 90.163.75.138 0.116 - [16/Dec/2019:06:22:39  0000] www.[censored_1] "GET /xmlrpc.php HTTP/1.1" 405 53 "-" "Mozilla/5.0 (X11; Linux i686; rv:2.0.1) Gecko/20100101 Firefox/4.0.1" "HTTP/1.1"