frenzy

2020-04-04T15:48:59.662965v22018076590370373 sshd[24710]: Failed password for root from 34.66.151.141 port 35648 ssh2
2020-04-04T15:52:48.900598v22018076590370373 sshd[1595]: Invalid user cq from 34.66.151.141 port 46698
2020-04-04T15:52:48.907133v22018076590370373 sshd[1595]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.66.151.141
2020-04-04T15:52:48.900598v22018076590370373 sshd[1595]: Invalid user cq from 34.66.151.141 port 46698
2020-04-04T15:52:50.847916v22018076590370373 sshd[1595]: Failed password for invalid user cq from 34.66.151.141 port 46698 ssh2
...

$f2bV_matches

Amazon ID Phishing Website

http://flame.forshana2a.net.cn/
103.44.28.186
301	server_redirect	permanent

https://forshana1a.top/
89.35.39.6	
302 server_redirect	temporary

https://forshana1a.top/pc/


Return-Path: 
Received: from yusheng25.yushengserver02.top (yusheng25.yushengserver02.top [107.179.65.90])
From: "" 
Subject: Amazon. co. jp にご登録のアカウント（名前、パスワード、その他個人情報）の確認
Date: Sat, 4 Apr 2020 21:17:31 +0800
X-mailer: Lbb 1

Apr  4 17:31:06 game-panel sshd[19866]: Failed password for root from 62.110.11.66 port 52608 ssh2
Apr  4 17:34:54 game-panel sshd[20046]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.110.11.66
Apr  4 17:34:56 game-panel sshd[20046]: Failed password for invalid user sunfang from 62.110.11.66 port 35256 ssh2

Tried sshing with brute force.

Apr  4 20:18:24 ks10 sshd[2517310]: Failed password for root from 218.92.0.175 port 57916 ssh2
Apr  4 20:18:28 ks10 sshd[2517310]: Failed password for root from 218.92.0.175 port 57916 ssh2
...

Automatic report - Port Scan Attack

Honeypot attack, port: 445, PTR: 93-54-126-195.ip129.fastwebnet.it.

Apr  4 09:37:49 Tower sshd[946]: Connection from 129.28.150.45 port 38232 on 192.168.10.220 port 22 rdomain ""
Apr  4 09:37:51 Tower sshd[946]: Failed password for root from 129.28.150.45 port 38232 ssh2
Apr  4 09:37:52 Tower sshd[946]: Received disconnect from 129.28.150.45 port 38232:11: Bye Bye [preauth]
Apr  4 09:37:52 Tower sshd[946]: Disconnected from authenticating user root 129.28.150.45 port 38232 [preauth]

Apr  4 20:11:09 plex sshd[15839]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.173.201  user=root
Apr  4 20:11:11 plex sshd[15839]: Failed password for root from 222.186.173.201 port 7660 ssh2

Apr  3 15:32:42 cumulus sshd[26436]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.253.68.122  user=r.r
Apr  3 15:32:44 cumulus sshd[26436]: Failed password for r.r from 182.253.68.122 port 41594 ssh2
Apr  3 15:32:44 cumulus sshd[26436]: Received disconnect from 182.253.68.122 port 41594:11: Bye Bye [preauth]
Apr  3 15:32:44 cumulus sshd[26436]: Disconnected from 182.253.68.122 port 41594 [preauth]
Apr  3 15:45:47 cumulus sshd[27267]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.253.68.122  user=r.r
Apr  3 15:45:48 cumulus sshd[27267]: Failed password for r.r from 182.253.68.122 port 44170 ssh2
Apr  3 15:45:49 cumulus sshd[27267]: Received disconnect from 182.253.68.122 port 44170:11: Bye Bye [preauth]
Apr  3 15:45:49 cumulus sshd[27267]: Disconnected from 182.253.68.122 port 44170 [preauth]
Apr  3 15:50:02 cumulus sshd[27443]: pam_unix(sshd:auth): authentication failure; lognam........
-------------------------------

Apr  4 16:13:40 eventyay sshd[416]: Failed password for root from 114.67.69.85 port 39754 ssh2
Apr  4 16:16:45 eventyay sshd[498]: Failed password for root from 114.67.69.85 port 41334 ssh2
...

20 attempts against mh-ssh on cloud

Apr  4 17:54:41 dev0-dcde-rnet sshd[2680]: Failed password for root from 162.243.55.188 port 46030 ssh2
Apr  4 18:06:29 dev0-dcde-rnet sshd[2708]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.243.55.188
Apr  4 18:06:31 dev0-dcde-rnet sshd[2708]: Failed password for invalid user hadoop from 162.243.55.188 port 52234 ssh2