Feb 12 10:39:19 ws24vmsma01 sshd[225396]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.187.249.41
Feb 12 10:39:21 ws24vmsma01 sshd[225396]: Failed password for invalid user openelec from 194.187.249.41 port 37457 ssh2
...

wallet.dat

Malicious/Probing: /wallet.dat

0,20-02/03 [bc02/m186] PostRequest-Spammer scoring: berlin

Jul  6 13:54:26 localhost sshd[2709503]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.187.249.38  user=root
Jul  6 13:54:28 localhost sshd[2709503]: Failed password for root from 194.187.249.38 port 35205 ssh2
...

Jun 28 23:25:19 IngegnereFirenze sshd[1615]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.187.249.38  user=root
...

(From hacker@oceangrovebeachhouse.com) PLEASE FORWARD THIS EMAIL TO SOMEONE IN YOUR COMPANY WHO IS ALLOWED TO MAKE IMPORTANT DECISIONS!

We have hacked your website http://www.superiorfamilychiropractic.com and extracted your databases.

How did this happen?
Our team has found a vulnerability within your site that we were able to exploit. After finding the vulnerability we were able to get your database credentials and extract your entire database and move the information to an offshore server.

What does this mean?

We will systematically go through a series of steps of totally damaging your reputation. First your database will be leaked or sold to the highest bidder which they will use with whatever their intentions are. Next if there are e-mails found they will be e-mailed that their information has been sold or leaked and your site http://www.superiorfamilychiropractic.com was at fault thusly damaging your reputation and having angry customers/associates with whatever angry customers/associates d

Brute forcing email accounts

(cpanel) Failed cPanel login from 194.187.249.35 (FR/France/-): 5 in the last 3600 secs

PLEASE FORWARD THIS EMAIL TO SOMEONE IN YOUR COMPANY WHO IS ALLOWED TO MAKE IMPORTANT DECISIONS! We have hacked your website

(From hacker@pandora.com) PLEASE FORWARD THIS EMAIL TO SOMEONE IN YOUR COMPANY WHO IS ALLOWED TO MAKE IMPORTANT DECISIONS!

We have hacked your website http://www.hotzchiropractic.com and extracted your databases.

How did this happen?
Our team has found a vulnerability within your site that we were able to exploit. After finding the vulnerability we were able to get your database credentials and extract your entire database and move the information to an offshore server.

What does this mean?

We will systematically go through a series of steps of totally damaging your reputation. First your database will be leaked or sold to the highest bidder which they will use with whatever their intentions are. Next if there are e-mails found they will be e-mailed that their information has been sold or leaked and your site http://www.hotzchiropractic.com was at fault thusly damaging your reputation and having angry customers/associates with whatever angry customers/associates do. Lastly any links that you have

(From hacker@andreas-ocklenburg.com) PLEASE FORWARD THIS EMAIL TO SOMEONE IN YOUR COMPANY WHO IS ALLOWED TO MAKE IMPORTANT DECISIONS!

We have hacked your website http://www.lakeside-chiro.com and extracted your databases.

How did this happen?
Our team has found a vulnerability within your site that we were able to exploit. After finding the vulnerability we were able to get your database credentials and extract your entire database and move the information to an offshore server.

What does this mean?

We will systematically go through a series of steps of totally damaging your reputation. First your database will be leaked or sold to the highest bidder which they will use with whatever their intentions are. Next if there are e-mails found they will be e-mailed that their information has been sold or leaked and your site http://www.lakeside-chiro.com was at fault thusly damaging your reputation and having angry customers/associates with whatever angry customers/associates do. Lastly any links that y

(From hacker@aletheiaricerchedimercato.com) PLEASE FORWARD THIS EMAIL TO SOMEONE IN YOUR COMPANY WHO IS ALLOWED TO MAKE IMPORTANT DECISIONS!

We have hacked your website http://www.chirowellctr.com and extracted your databases.

How did this happen?
Our team has found a vulnerability within your site that we were able to exploit. After finding the vulnerability we were able to get your database credentials and extract your entire database and move the information to an offshore server.

What does this mean?

We will systematically go through a series of steps of totally damaging your reputation. First your database will be leaked or sold to the highest bidder which they will use with whatever their intentions are. Next if there are e-mails found they will be e-mailed that their information has been sold or leaked and your site http://www.chirowellctr.com was at fault thusly damaging your reputation and having angry customers/associates with whatever angry customers/associates do. Lastly any links tha

0,20-03/03 [bc03/m152] PostRequest-Spammer scoring: essen

scanner, scan for phpmyadmin database files

(cpanel) Failed cPanel login from 194.187.249.36 (FR/France/-): 5 in the last 3600 secs

Oct 27 07:07:38 server sshd[17910]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.119.166.168  user=r.r
Oct 27 07:07:40 server sshd[17910]: Failed password for r.r from 185.119.166.168 port 49040 ssh2
Oct 27 07:07:40 server sshd[17910]: Received disconnect from 185.119.166.168: 11: Bye Bye [preauth]
Oct 27 07:31:59 server sshd[18980]: Failed password for invalid user scaner from 185.119.166.168 port 32782 ssh2
Oct 27 07:32:00 server sshd[18980]: Received disconnect from 185.119.166.168: 11: Bye Bye [preauth]
Oct 27 07:35:48 server sshd[19193]: Failed password for invalid user sub from 185.119.166.168 port 39802 ssh2
Oct 27 07:35:48 server sshd[19193]: Received disconnect from 185.119.166.168: 11: Bye Bye [preauth]
Oct 27 07:39:32 server sshd[19405]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.119.166.168  user=r.r
Oct 27 07:39:34 server sshd[19405]: Failed password for r.r from........
-------------------------------

$f2bV_matches

Lines containing failures of 62.210.72.161
Oct 27 12:34:21 shared11 sshd[18489]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.210.72.161  user=r.r
Oct 27 12:34:24 shared11 sshd[18489]: Failed password for r.r from 62.210.72.161 port 48384 ssh2
Oct 27 12:34:24 shared11 sshd[18489]: Received disconnect from 62.210.72.161 port 48384:11: Bye Bye [preauth]
Oct 27 12:34:24 shared11 sshd[18489]: Disconnected from authenticating user r.r 62.210.72.161 port 48384 [preauth]
Oct 27 12:53:59 shared11 sshd[24227]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.210.72.161  user=r.r
Oct 27 12:54:01 shared11 sshd[24227]: Failed password for r.r from 62.210.72.161 port 60086 ssh2
Oct 27 12:54:01 shared11 sshd[24227]: Received disconnect from 62.210.72.161 port 60086:11: Bye Bye [preauth]
Oct 27 12:54:01 shared11 sshd[24227]: Disconnected from authenticating user r.r 62.210.72.161 port 60086 [preauth........
------------------------------

Oct 27 21:48:17 localhost sshd\[21245\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.70.85.206  user=root
Oct 27 21:48:19 localhost sshd\[21245\]: Failed password for root from 193.70.85.206 port 59603 ssh2
Oct 27 21:51:57 localhost sshd\[21583\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.70.85.206  user=root

2019-10-27T17:45:17.2777441495-001 sshd\[51005\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.15.230  user=root
2019-10-27T17:45:19.6135841495-001 sshd\[51005\]: Failed password for root from 106.12.15.230 port 55600 ssh2
2019-10-27T17:49:19.9213901495-001 sshd\[51169\]: Invalid user blessed from 106.12.15.230 port 35316
2019-10-27T17:49:19.9311151495-001 sshd\[51169\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.15.230
2019-10-27T17:49:21.1537091495-001 sshd\[51169\]: Failed password for invalid user blessed from 106.12.15.230 port 35316 ssh2
2019-10-27T17:53:26.7926561495-001 sshd\[51308\]: Invalid user te from 106.12.15.230 port 43230
2019-10-27T17:53:26.7980411495-001 sshd\[51308\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.15.230
...

SSH Brute Force, server-1 sshd[29191]: Failed password for invalid user 2010 from 42.200.66.164 port 58288 ssh2

Oct 27 12:13:41 tdfoods sshd\[24721\]: Invalid user hotsales\$\&\*edongoweb from 98.126.88.107
Oct 27 12:13:41 tdfoods sshd\[24721\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=98.126.88.107
Oct 27 12:13:44 tdfoods sshd\[24721\]: Failed password for invalid user hotsales\$\&\*edongoweb from 98.126.88.107 port 53190 ssh2
Oct 27 12:17:38 tdfoods sshd\[25029\]: Invalid user 77777 from 98.126.88.107
Oct 27 12:17:38 tdfoods sshd\[25029\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=98.126.88.107

" "

Unauthorized SSH login attempts

Oct 27 08:25:10 ovpn sshd[19118]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.91.92.82  user=r.r
Oct 27 08:25:12 ovpn sshd[19118]: Failed password for r.r from 103.91.92.82 port 54838 ssh2
Oct 27 08:25:12 ovpn sshd[19118]: Received disconnect from 103.91.92.82 port 54838:11: Bye Bye [preauth]
Oct 27 08:25:12 ovpn sshd[19118]: Disconnected from 103.91.92.82 port 54838 [preauth]
Oct 27 08:33:30 ovpn sshd[20692]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.91.92.82  user=r.r
Oct 27 08:33:32 ovpn sshd[20692]: Failed password for r.r from 103.91.92.82 port 55235 ssh2
Oct 27 08:33:32 ovpn sshd[20692]: Received disconnect from 103.91.92.82 port 55235:11: Bye Bye [preauth]
Oct 27 08:33:32 ovpn sshd[20692]: Disconnected from 103.91.92.82 port 55235 [preauth]
Oct 27 08:38:29 ovpn sshd[21617]: Invalid user jw from 103.91.92.82
Oct 27 08:38:29 ovpn sshd[21617]: pam_unix(sshd:auth): authen........
------------------------------

xmlrpc attack

RDP Bruteforce

Oct 27 08:09:03 DNS-2 sshd[10372]: User r.r from 45.114.171.92 not allowed because not listed in AllowUsers
Oct 27 08:09:03 DNS-2 sshd[10372]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.114.171.92  user=r.r
Oct 27 08:09:05 DNS-2 sshd[10372]: Failed password for invalid user r.r from 45.114.171.92 port 60631 ssh2
Oct 27 08:09:07 DNS-2 sshd[10372]: Received disconnect from 45.114.171.92 port 60631:11: Bye Bye [preauth]
Oct 27 08:09:07 DNS-2 sshd[10372]: Disconnected from invalid user r.r 45.114.171.92 port 60631 [preauth]
Oct 27 08:32:10 DNS-2 sshd[11568]: Invalid user abisset from 45.114.171.92 port 45725
Oct 27 08:32:10 DNS-2 sshd[11568]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.114.171.92 
Oct 27 08:32:11 DNS-2 sshd[11568]: Failed password for invalid user abisset from 45.114.171.92 port 45725 ssh2
Oct 27 08:32:13 DNS-2 sshd[11568]: Received disconnect from 45.114.171.92 p........
-------------------------------

2019-10-27T16:18:58.384263ns525875 sshd\[19602\]: Invalid user hazen from 212.64.28.77 port 57710
2019-10-27T16:18:58.392667ns525875 sshd\[19602\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.64.28.77
2019-10-27T16:19:00.738588ns525875 sshd\[19602\]: Failed password for invalid user hazen from 212.64.28.77 port 57710 ssh2
2019-10-27T16:26:50.500876ns525875 sshd\[30119\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.64.28.77  user=root
...

abcdata-sys.de:80 50.62.176.116 - - \[27/Oct/2019:21:27:36 +0100\] "POST /xmlrpc.php HTTP/1.1" 301 441 "-" "WordPress/5.2.2\; https://thinktobehappy.com"
www.goldgier.de 50.62.176.116 \[27/Oct/2019:21:27:36 +0100\] "POST /xmlrpc.php HTTP/1.1" 200 4484 "-" "WordPress/5.2.2\; https://thinktobehappy.com"