Aug  5 08:57:43 dedicated sshd[18256]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.169.249.214  user=root
Aug  5 08:57:44 dedicated sshd[18256]: Failed password for root from 211.169.249.214 port 43064 ssh2

Jul 28 04:31:43 yabzik sshd[20054]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.169.249.214
Jul 28 04:31:45 yabzik sshd[20054]: Failed password for invalid user d05er from 211.169.249.214 port 32910 ssh2
Jul 28 04:36:40 yabzik sshd[21608]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.169.249.214

Jun  2 07:23:06 server sshd[27204]: Failed password for root from 211.169.249.231 port 44614 ssh2
Jun  2 07:27:07 server sshd[27523]: Failed password for root from 211.169.249.231 port 48752 ssh2
...

2020-05-28T11:57:24.636546shield sshd\[3008\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.169.249.231  user=root
2020-05-28T11:57:26.321577shield sshd\[3008\]: Failed password for root from 211.169.249.231 port 50152 ssh2
2020-05-28T11:58:44.294470shield sshd\[3151\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.169.249.231  user=root
2020-05-28T11:58:46.295670shield sshd\[3151\]: Failed password for root from 211.169.249.231 port 41896 ssh2
2020-05-28T12:00:17.742689shield sshd\[3293\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.169.249.231  user=root

May 26 03:16:28 sip sshd[15006]: Failed password for root from 211.169.249.231 port 33818 ssh2
May 26 03:33:07 sip sshd[21118]: Failed password for root from 211.169.249.231 port 33014 ssh2

May 24 06:24:59 ns382633 sshd\[17004\]: Invalid user pnz from 211.169.249.231 port 58670
May 24 06:24:59 ns382633 sshd\[17004\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.169.249.231
May 24 06:25:01 ns382633 sshd\[17004\]: Failed password for invalid user pnz from 211.169.249.231 port 58670 ssh2
May 24 06:29:26 ns382633 sshd\[18743\]: Invalid user wangyan from 211.169.249.231 port 55208
May 24 06:29:26 ns382633 sshd\[18743\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.169.249.231

May 14 18:29:46 ns382633 sshd\[31615\]: Invalid user oracle from 211.169.249.231 port 35582
May 14 18:29:46 ns382633 sshd\[31615\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.169.249.231
May 14 18:29:49 ns382633 sshd\[31615\]: Failed password for invalid user oracle from 211.169.249.231 port 35582 ssh2
May 14 18:34:18 ns382633 sshd\[32481\]: Invalid user dab from 211.169.249.231 port 41474
May 14 18:34:18 ns382633 sshd\[32481\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.169.249.231

prod11
...

May  4 05:55:00 electroncash sshd[26525]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.169.249.231 
May  4 05:55:00 electroncash sshd[26525]: Invalid user hduser from 211.169.249.231 port 36918
May  4 05:55:02 electroncash sshd[26525]: Failed password for invalid user hduser from 211.169.249.231 port 36918 ssh2
May  4 05:58:28 electroncash sshd[27537]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.169.249.231  user=root
May  4 05:58:30 electroncash sshd[27537]: Failed password for root from 211.169.249.231 port 35946 ssh2
...

2020-04-29T11:49:45.208040ionos.janbro.de sshd[88999]: Failed password for root from 211.169.249.231 port 37470 ssh2
2020-04-29T11:54:00.156676ionos.janbro.de sshd[89008]: Invalid user anaconda from 211.169.249.231 port 49330
2020-04-29T11:54:00.200117ionos.janbro.de sshd[89008]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.169.249.231
2020-04-29T11:54:00.156676ionos.janbro.de sshd[89008]: Invalid user anaconda from 211.169.249.231 port 49330
2020-04-29T11:54:02.304404ionos.janbro.de sshd[89008]: Failed password for invalid user anaconda from 211.169.249.231 port 49330 ssh2
2020-04-29T11:58:13.499645ionos.janbro.de sshd[89033]: Invalid user db2fenc from 211.169.249.231 port 32954
2020-04-29T11:58:13.580044ionos.janbro.de sshd[89033]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.169.249.231
2020-04-29T11:58:13.499645ionos.janbro.de sshd[89033]: Invalid user db2fenc from 211.169.249.231 port 329
...

Apr 27 10:43:27 v22018086721571380 sshd[23587]: Failed password for invalid user bagus from 211.169.249.231 port 41762 ssh2
Apr 27 11:46:35 v22018086721571380 sshd[17825]: Failed password for invalid user appuser from 211.169.249.231 port 35656 ssh2

2020-04-21T11:28:38.374548shield sshd\[10026\]: Invalid user admin from 211.169.249.231 port 46180
2020-04-21T11:28:38.378699shield sshd\[10026\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.169.249.231
2020-04-21T11:28:40.149865shield sshd\[10026\]: Failed password for invalid user admin from 211.169.249.231 port 46180 ssh2
2020-04-21T11:31:00.601254shield sshd\[10376\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.169.249.231  user=root
2020-04-21T11:31:02.533081shield sshd\[10376\]: Failed password for root from 211.169.249.231 port 54356 ssh2

Apr 18 05:57:55  sshd\[23869\]: Invalid user admin from 211.169.249.156Apr 18 05:57:57  sshd\[23869\]: Failed password for invalid user admin from 211.169.249.156 port 52344 ssh2
...

$f2bV_matches

Apr 17 04:14:28 vlre-nyc-1 sshd\[6606\]: Invalid user ol from 211.169.249.231
Apr 17 04:14:28 vlre-nyc-1 sshd\[6606\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.169.249.231
Apr 17 04:14:30 vlre-nyc-1 sshd\[6606\]: Failed password for invalid user ol from 211.169.249.231 port 43596 ssh2
Apr 17 04:18:34 vlre-nyc-1 sshd\[6735\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.169.249.231  user=root
Apr 17 04:18:36 vlre-nyc-1 sshd\[6735\]: Failed password for root from 211.169.249.231 port 52210 ssh2
...

SSH Brute Force

$f2bV_matches

Apr  4 15:30:19 ncomp sshd[676]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.64.21.78  user=root
Apr  4 15:30:21 ncomp sshd[676]: Failed password for root from 212.64.21.78 port 54921 ssh2
Apr  4 15:37:28 ncomp sshd[766]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.64.21.78  user=root
Apr  4 15:37:30 ncomp sshd[766]: Failed password for root from 212.64.21.78 port 2111 ssh2

Apr  4 18:23:59 rotator sshd\[9207\]: Invalid user kl from 51.91.108.15Apr  4 18:24:01 rotator sshd\[9207\]: Failed password for invalid user kl from 51.91.108.15 port 39050 ssh2Apr  4 18:27:54 rotator sshd\[10003\]: Invalid user zcx from 51.91.108.15Apr  4 18:27:56 rotator sshd\[10003\]: Failed password for invalid user zcx from 51.91.108.15 port 48876 ssh2Apr  4 18:31:44 rotator sshd\[10798\]: Invalid user zwang from 51.91.108.15Apr  4 18:31:45 rotator sshd\[10798\]: Failed password for invalid user zwang from 51.91.108.15 port 58696 ssh2
...

Amazon ID Phishing Website

http://flame.forshana2a.net.cn/
103.44.28.186
301	server_redirect	permanent

https://forshana1a.top/
89.35.39.6	
302 server_redirect	temporary

https://forshana1a.top/pc/


Return-Path: 
Received: from yusheng25.yushengserver02.top (yusheng25.yushengserver02.top [107.179.65.90])
From: "" 
Subject: Amazon. co. jp にご登録のアカウント（名前、パスワード、その他個人情報）の確認
Date: Sat, 4 Apr 2020 21:17:31 +0800
X-mailer: Lbb 1

2020-04-04 21:08:35 dovecot_login authenticator failed for \(\[78.128.113.73\]\) \[78.128.113.73\]: 535 Incorrect authentication data \(set_id=ms@opso.it\)
2020-04-04 21:08:48 dovecot_login authenticator failed for \(\[78.128.113.73\]\) \[78.128.113.73\]: 535 Incorrect authentication data
2020-04-04 21:09:03 dovecot_login authenticator failed for \(\[78.128.113.73\]\) \[78.128.113.73\]: 535 Incorrect authentication data
2020-04-04 21:09:19 dovecot_login authenticator failed for \(\[78.128.113.73\]\) \[78.128.113.73\]: 535 Incorrect authentication data
2020-04-04 21:09:28 dovecot_login authenticator failed for \(\[78.128.113.73\]\) \[78.128.113.73\]: 535 Incorrect authentication data

Malicious Network Traffic Host  - Botnet UA: Go-http-client/1.1

1586007413 - 04/04/2020 15:36:53 Host: 156.203.193.108/156.203.193.108 Port: 445 TCP Blocked

Apr  4 20:55:52 vpn01 sshd[18375]: Failed password for root from 222.186.175.169 port 9792 ssh2
Apr  4 20:55:55 vpn01 sshd[18375]: Failed password for root from 222.186.175.169 port 9792 ssh2
...

Apr 04 12:57:47 askasleikir sshd[96928]: Failed password for invalid user ruoxi from 134.209.100.146 port 57130 ssh2

Honeypot attack, port: 445, PTR: PTR record not found

DigitalOcean BotNet attack - 10s of requests to non- pages - :443/app-ads.txt - typically bursts of 8 requests per second - undefined, XSS attacks
UA removed

2020-04-04T17:53:07.711151abusebot-3.cloudsearch.cf sshd[8827]: Invalid user fedora from 94.229.66.131 port 58098
2020-04-04T17:53:07.717471abusebot-3.cloudsearch.cf sshd[8827]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.229.66.131
2020-04-04T17:53:07.711151abusebot-3.cloudsearch.cf sshd[8827]: Invalid user fedora from 94.229.66.131 port 58098
2020-04-04T17:53:09.470185abusebot-3.cloudsearch.cf sshd[8827]: Failed password for invalid user fedora from 94.229.66.131 port 58098 ssh2
2020-04-04T18:03:04.610398abusebot-3.cloudsearch.cf sshd[9488]: Invalid user com from 94.229.66.131 port 54880
2020-04-04T18:03:04.618062abusebot-3.cloudsearch.cf sshd[9488]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.229.66.131
2020-04-04T18:03:04.610398abusebot-3.cloudsearch.cf sshd[9488]: Invalid user com from 94.229.66.131 port 54880
2020-04-04T18:03:06.325777abusebot-3.cloudsearch.cf sshd[9488]: Failed password
...

Apr  4 15:55:26 vlre-nyc-1 sshd\[16809\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.49.86.54  user=root
Apr  4 15:55:28 vlre-nyc-1 sshd\[16809\]: Failed password for root from 185.49.86.54 port 33016 ssh2
Apr  4 15:59:54 vlre-nyc-1 sshd\[16896\]: Invalid user fr from 185.49.86.54
Apr  4 15:59:54 vlre-nyc-1 sshd\[16896\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.49.86.54
Apr  4 15:59:56 vlre-nyc-1 sshd\[16896\]: Failed password for invalid user fr from 185.49.86.54 port 43692 ssh2
...

Apr  4 18:24:22 game-panel sshd[23009]: Failed password for root from 180.76.97.180 port 60004 ssh2
Apr  4 18:27:15 game-panel sshd[23209]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.97.180
Apr  4 18:27:17 game-panel sshd[23209]: Failed password for invalid user atkina from 180.76.97.180 port 38364 ssh2

Wordpress attack

Apr  4 20:35:33 pve sshd[12295]: Failed password for root from 222.186.180.17 port 55976 ssh2
Apr  4 20:35:37 pve sshd[12295]: Failed password for root from 222.186.180.17 port 55976 ssh2
Apr  4 20:35:41 pve sshd[12295]: Failed password for root from 222.186.180.17 port 55976 ssh2
Apr  4 20:35:44 pve sshd[12295]: Failed password for root from 222.186.180.17 port 55976 ssh2