Sep 22 03:36:38 OPSO sshd\[20371\]: Invalid user anu from 148.66.135.173 port 33166
Sep 22 03:36:38 OPSO sshd\[20371\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.66.135.173
Sep 22 03:36:40 OPSO sshd\[20371\]: Failed password for invalid user anu from 148.66.135.173 port 33166 ssh2
Sep 22 03:41:37 OPSO sshd\[21194\]: Invalid user roger from 148.66.135.173 port 46420
Sep 22 03:41:37 OPSO sshd\[21194\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.66.135.173

Sep 21 06:57:43 MK-Soft-VM6 sshd[2824]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.66.135.173 
Sep 21 06:57:45 MK-Soft-VM6 sshd[2824]: Failed password for invalid user sqoop from 148.66.135.173 port 42414 ssh2
...

$f2bV_matches

Sep  2 15:35:25 server sshd\[8431\]: Invalid user admin from 148.66.135.173 port 55218
Sep  2 15:35:25 server sshd\[8431\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.66.135.173
Sep  2 15:35:26 server sshd\[8431\]: Failed password for invalid user admin from 148.66.135.173 port 55218 ssh2
Sep  2 15:40:04 server sshd\[25274\]: Invalid user jonny from 148.66.135.173 port 43498
Sep  2 15:40:04 server sshd\[25274\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.66.135.173

Invalid user zy from 148.66.135.173 port 43718

Aug 16 07:30:12 friendsofhawaii sshd\[29986\]: Invalid user !QAZ2wsx\#EDC from 148.66.135.173
Aug 16 07:30:12 friendsofhawaii sshd\[29986\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.66.135.173
Aug 16 07:30:13 friendsofhawaii sshd\[29986\]: Failed password for invalid user !QAZ2wsx\#EDC from 148.66.135.173 port 35138 ssh2
Aug 16 07:35:25 friendsofhawaii sshd\[30443\]: Invalid user ftptest from 148.66.135.173
Aug 16 07:35:25 friendsofhawaii sshd\[30443\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.66.135.173

Aug 16 01:44:20 vps691689 sshd[13854]: Failed password for root from 148.66.135.173 port 33094 ssh2
Aug 16 01:49:27 vps691689 sshd[13974]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.66.135.173
...

Failed password for invalid user more from 148.66.135.173 port 40744 ssh2
Invalid user beeidigung from 148.66.135.173 port 34992
pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.66.135.173
Failed password for invalid user beeidigung from 148.66.135.173 port 34992 ssh2
Invalid user dspace from 148.66.135.173 port 57412
pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.66.135.173

detected by Fail2Ban

$f2bV_matches_ltvn

148.66.135.148 - - [20/Jul/2020:04:56:10 +0100] "POST /wp-login.php HTTP/1.1" 200 1906 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
148.66.135.148 - - [20/Jul/2020:04:56:13 +0100] "POST /wp-login.php HTTP/1.1" 200 1927 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
148.66.135.148 - - [20/Jul/2020:04:56:16 +0100] "POST /wp-login.php HTTP/1.1" 200 1885 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
...

148.66.135.148 - - [16/Jul/2020:05:51:07 +0200] "GET /wp-login.php HTTP/1.1" 200 1901 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
148.66.135.148 - - [16/Jul/2020:05:51:09 +0200] "POST /wp-login.php HTTP/1.1" 200 2031 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
148.66.135.148 - - [16/Jul/2020:05:51:09 +0200] "GET /wp-login.php HTTP/1.1" 200 1901 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
148.66.135.148 - - [16/Jul/2020:05:51:10 +0200] "POST /wp-login.php HTTP/1.1" 200 2007 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
148.66.135.148 - - [16/Jul/2020:05:51:11 +0200] "GET /wp-login.php HTTP/1.1" 200 1901 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
148.66.135.148 - - [16/Jul/2020:05:51:12 +0200] "POST /wp-login.php HTTP/1.1" 200 2008 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/201001
...

148.66.135.69 - - [18/Jun/2020:22:07:08 +0100] "POST /wp-login.php HTTP/1.1" 200 1885 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
148.66.135.69 - - [18/Jun/2020:22:07:12 +0100] "POST /wp-login.php HTTP/1.1" 200 1885 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
148.66.135.69 - - [18/Jun/2020:22:07:13 +0100] "POST /xmlrpc.php HTTP/1.1" 403 219 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
...

Attacks websites by trying to access known vulnerables of plugins, brute-force of backends or probing of administrative tools

MYH,DEF GET /2020/wp-login.php

"XSS Attack Detected via libinjection - Matched Data: XSS data found within ARGS_NAMES:

Automatically reported by fail2ban report script (mx1)

Invalid user ibarra from 148.66.135.178 port 48710

148.66.135.69 - - [10/May/2020:06:56:38 +0300] "POST /wp-login.php HTTP/1.1" 200 3437 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"

148.66.135.152 - - \[28/Apr/2020:16:31:57 +0200\] "POST /wp-login.php HTTP/1.0" 200 7302 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"
148.66.135.152 - - \[28/Apr/2020:16:32:00 +0200\] "POST /wp-login.php HTTP/1.0" 200 7302 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"
148.66.135.152 - - \[28/Apr/2020:16:32:01 +0200\] "POST /xmlrpc.php HTTP/1.0" 200 802 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"

Apr 14 22:34:19 marvibiene sshd[37340]: Invalid user osboxes from 148.66.135.178 port 44276
Apr 14 22:34:19 marvibiene sshd[37340]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.66.135.178
Apr 14 22:34:19 marvibiene sshd[37340]: Invalid user osboxes from 148.66.135.178 port 44276
Apr 14 22:34:21 marvibiene sshd[37340]: Failed password for invalid user osboxes from 148.66.135.178 port 44276 ssh2
...

Apr 13 21:05:33 eventyay sshd[6690]: Failed password for root from 148.66.135.178 port 34444 ssh2
Apr 13 21:09:49 eventyay sshd[6976]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.66.135.178
Apr 13 21:09:51 eventyay sshd[6976]: Failed password for invalid user clamav from 148.66.135.178 port 43920 ssh2
...

WordPress wp-login brute force :: 148.66.135.152 0.096 BYPASS [11/Apr/2020:05:54:54  0000] [censored_2] "POST /wp-login.php HTTP/1.1" 200 2287 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"

148.66.135.152 - - [10/Apr/2020:16:18:46 +0200] "POST /wp-login.php HTTP/1.0" 200 2504 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
148.66.135.152 - - [10/Apr/2020:16:18:47 +0200] "POST /wp-login.php HTTP/1.0" 200 2508 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
...

Automatic report - XMLRPC Attack

This IP is associated with RDP abuse. It was found in a paste by https://twitter.com/RdpSnitch - https://pastebin.com/4Ddmuksx  
For more information, or to report interesting/incorrect findings, contact us - bot@tines.io

Unauthorized connection attempt detected from IP address 222.186.15.158 to port 22

This IP is associated with RDP abuse. It was found in a paste by https://twitter.com/RdpSnitch - https://pastebin.com/4Ddmuksx  
For more information, or to report interesting/incorrect findings, contact us - bot@tines.io

Apr 26 14:07:52 PorscheCustomer sshd[22022]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=101.231.154.154
Apr 26 14:07:53 PorscheCustomer sshd[22022]: Failed password for invalid user bot from 101.231.154.154 port 5693 ssh2
Apr 26 14:12:00 PorscheCustomer sshd[22104]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=101.231.154.154
...

sshd login attampt

Apr 26 17:32:59 gw1 sshd[319]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=93.66.78.18
Apr 26 17:33:01 gw1 sshd[319]: Failed password for invalid user monit from 93.66.78.18 port 55242 ssh2
...

This IP is associated with RDP abuse. It was found in a paste by https://twitter.com/RdpSnitch - https://pastebin.com/4Ddmuksx  
For more information, or to report interesting/incorrect findings, contact us - bot@tines.io

(sshd) Failed SSH login from 36.111.182.133 (CN/China/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Apr 26 14:51:03 s1 sshd[20348]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.111.182.133  user=root
Apr 26 14:51:05 s1 sshd[20348]: Failed password for root from 36.111.182.133 port 58462 ssh2
Apr 26 14:58:30 s1 sshd[20488]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.111.182.133  user=root
Apr 26 14:58:33 s1 sshd[20488]: Failed password for root from 36.111.182.133 port 38740 ssh2
Apr 26 15:03:29 s1 sshd[20794]: Invalid user ftp_test from 36.111.182.133 port 55174

RDP brute forcing (r)

Apr 26 09:02:48 server sshd[17992]: Failed password for invalid user fafa from 167.71.40.65 port 53862 ssh2
Apr 26 09:02:48 server sshd[17992]: Received disconnect from 167.71.40.65: 11: Bye Bye [preauth]
Apr 26 09:08:09 server sshd[18306]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.40.65  user=r.r
Apr 26 09:08:11 server sshd[18306]: Failed password for r.r from 167.71.40.65 port 32806 ssh2
Apr 26 09:08:11 server sshd[18306]: Received disconnect from 167.71.40.65: 11: Bye Bye [preauth]
Apr 26 09:11:49 server sshd[18520]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.40.65  user=r.r
Apr 26 09:11:51 server sshd[18520]: Failed password for r.r from 167.71.40.65 port 48294 ssh2
Apr 26 09:11:51 server sshd[18520]: Received disconnect from 167.71.40.65: 11: Bye Bye [preauth]
Apr 26 09:15:54 server sshd[18733]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 ........
-------------------------------

scans 6 times in preceeding hours on the ports (in chronological order) 3407 3400 3381 3386 3389 3389 resulting in total of 55 scans from 92.118.37.0/24 block.

SSH brutforce

This IP is associated with RDP abuse. It was found in a paste by https://twitter.com/RdpSnitch - https://pastebin.com/4Ddmuksx  
For more information, or to report interesting/incorrect findings, contact us - bot@tines.io

This IP is associated with RDP abuse. It was found in a paste by https://twitter.com/RdpSnitch - https://pastebin.com/4Ddmuksx  
For more information, or to report interesting/incorrect findings, contact us - bot@tines.io

Apr 26 15:51:41 hosting sshd[6763]: Invalid user jv from 123.207.156.64 port 53124
...