2020-08-22 10:07:49.161901-0500  localhost sshd[13203]: Failed password for invalid user user from 213.55.2.212 port 48298 ssh2

2020-06-19T18:12:28.136919galaxy.wi.uni-potsdam.de sshd[29158]: Invalid user autologin from 213.55.2.212 port 46560
2020-06-19T18:12:28.142173galaxy.wi.uni-potsdam.de sshd[29158]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.2.55.213.rev.sfr.net
2020-06-19T18:12:28.136919galaxy.wi.uni-potsdam.de sshd[29158]: Invalid user autologin from 213.55.2.212 port 46560
2020-06-19T18:12:30.200769galaxy.wi.uni-potsdam.de sshd[29158]: Failed password for invalid user autologin from 213.55.2.212 port 46560 ssh2
2020-06-19T18:15:37.012541galaxy.wi.uni-potsdam.de sshd[29518]: Invalid user bot from 213.55.2.212 port 44238
2020-06-19T18:15:37.017671galaxy.wi.uni-potsdam.de sshd[29518]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.2.55.213.rev.sfr.net
2020-06-19T18:15:37.012541galaxy.wi.uni-potsdam.de sshd[29518]: Invalid user bot from 213.55.2.212 port 44238
2020-06-19T18:15:38.689589galaxy.wi.uni-potsdam.de ss
...

5x Failed Password

2020-06-15T15:34:59.752830mail.standpoint.com.ua sshd[17586]: Failed password for invalid user caddy from 213.55.2.212 port 36908 ssh2
2020-06-15T15:38:08.057790mail.standpoint.com.ua sshd[18182]: Invalid user samir from 213.55.2.212 port 38524
2020-06-15T15:38:08.060740mail.standpoint.com.ua sshd[18182]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.2.55.213.rev.sfr.net
2020-06-15T15:38:08.057790mail.standpoint.com.ua sshd[18182]: Invalid user samir from 213.55.2.212 port 38524
2020-06-15T15:38:09.499360mail.standpoint.com.ua sshd[18182]: Failed password for invalid user samir from 213.55.2.212 port 38524 ssh2
...

2020-06-14T04:32:40.667090abusebot-7.cloudsearch.cf sshd[17297]: Invalid user teresa from 213.55.2.212 port 44320
2020-06-14T04:32:40.674066abusebot-7.cloudsearch.cf sshd[17297]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.2.55.213.rev.sfr.net
2020-06-14T04:32:40.667090abusebot-7.cloudsearch.cf sshd[17297]: Invalid user teresa from 213.55.2.212 port 44320
2020-06-14T04:32:42.771390abusebot-7.cloudsearch.cf sshd[17297]: Failed password for invalid user teresa from 213.55.2.212 port 44320 ssh2
2020-06-14T04:37:32.121491abusebot-7.cloudsearch.cf sshd[17745]: Invalid user admin from 213.55.2.212 port 56852
2020-06-14T04:37:32.128073abusebot-7.cloudsearch.cf sshd[17745]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.2.55.213.rev.sfr.net
2020-06-14T04:37:32.121491abusebot-7.cloudsearch.cf sshd[17745]: Invalid user admin from 213.55.2.212 port 56852
2020-06-14T04:37:34.646889abusebot-7.cloudsearch.cf
...

Jun 12 20:01:14 lnxweb62 sshd[15819]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=213.55.2.212

Jun  9 03:54:58 scw-6657dc sshd[26214]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=213.55.2.212
Jun  9 03:54:58 scw-6657dc sshd[26214]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=213.55.2.212
Jun  9 03:55:00 scw-6657dc sshd[26214]: Failed password for invalid user liyongqi from 213.55.2.212 port 50504 ssh2
...

$f2bV_matches

Apr 27 21:22:31 itv-usvr-01 sshd[21581]: Invalid user gw from 213.55.2.212
Apr 27 21:22:31 itv-usvr-01 sshd[21581]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=213.55.2.212
Apr 27 21:22:31 itv-usvr-01 sshd[21581]: Invalid user gw from 213.55.2.212
Apr 27 21:22:33 itv-usvr-01 sshd[21581]: Failed password for invalid user gw from 213.55.2.212 port 59712 ssh2

prod3
...

Invalid user samir from 213.55.2.212 port 60444

2020-04-13 10:00:13 server sshd[64904]: Failed password for invalid user root from 213.55.2.212 port 33142 ssh2

Apr 13 19:33:07 auw2 sshd\[8856\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.2.55.213.rev.sfr.net  user=root
Apr 13 19:33:08 auw2 sshd\[8856\]: Failed password for root from 213.55.2.212 port 40544 ssh2
Apr 13 19:40:52 auw2 sshd\[9340\]: Invalid user jllmarcom from 213.55.2.212
Apr 13 19:40:52 auw2 sshd\[9340\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.2.55.213.rev.sfr.net
Apr 13 19:40:55 auw2 sshd\[9340\]: Failed password for invalid user jllmarcom from 213.55.2.212 port 43218 ssh2

Email rejected due to spam filtering

May 01 07:35:17 tcp        0      0 r.ca:22            213.55.236.153:6118         SYN_RECV

2020-04-03 x@x
2020-04-03 23:36:36 unexpected disconnection while reading SMTP command from ([213.55.224.125]) [213.55.224.125]:57036 I=[10.100.18.22]:25 (error: Connection reset by peer)
2020-04-03 23:37:33 unexpected disconnection while reading SMTP command from ([213.55.224.125]) [213.55.224.125]:57066 I=[10.100.18.22]:25 (error: Connection reset by peer)

........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=213.55.224.125

''

Jul2610:52:07server4dovecot:imap-login:Disconnected\(authfailed\,1attemptsin6secs\):user=\\,method=PLAIN\,rip=213.55.225.121\,lip=148.251.104.70\,TLS\,session=\Jul2610:52:17server4dovecot:imap-login:Disconnected\(authfailed\,1attemptsin2secs\):user=\\,method=PLAIN\,rip=213.55.225.121\,lip=148.251.104.70\,TLS\,session=\Jul2610:52:20server4dovecot:imap-login:Disconnected\(authfailed\,1attemptsin2secs\):user=\\,method=PLAIN\,rip=213.55.225.121\,lip=148.251.104.70\,TLS\,session=\Jul2610:52:20server4dovecot:imap-login:Disconnected\(authfailed\,1attemptsin12secs\):user=\\,method=PLAIN\,rip=213.55.225.121\,lip=148.251.104.70\,TLS:read\(size=344\)failed:Connectionresetbypeer\,session=\Jul2610:52:20server4dovecot:imap-login:Disconnected\(authfailed\,1attemptsin22secs\):user=\\,method=PLAIN\,rip=213.55.225.121\,lip=1

Jul1908:13:41server4dovecot:imap-login:Disconnected\(authfailed\,1attemptsin2secs\):user=\\,method=PLAIN\,rip=213.55.225.80\,lip=148.251.104.70\,TLS\,session=\<1hmioAKOvb3VN FQ\>Jul1908:13:54server4dovecot:imap-login:Disconnected\(authfailed\,1attemptsin6secs\):user=\\,method=PLAIN\,rip=213.55.225.80\,lip=148.251.104.70\,TLS\,session=\Jul1908:14:00server4dovecot:imap-login:Disconnected\(authfailed\,1attemptsin2secs\):user=\\,method=PLAIN\,rip=213.55.225.80\,lip=148.251.104.70\,TLS\,session=\<8N 9oQKOwr3VN FQ\>Jul1908:14:03server4dovecot:imap-login:Disconnected\(authfailed\,1attemptsin2secs\):user=\\,method=PLAIN\,rip=213.55.225.80\,lip=148.251.104.70\,TLS\,session=\<6VPqoQKOw73VN FQ\>Jul1908:16:41server4dovecot:imap-login:Disconnected:Inactivity\(authfailed\,1attemptsin180secs\):user=\\,method=PLAIN\,rip=213.55.225.80\,lip=148.251.104.70\,TLS\,session=\

''

Path Traversal Attack (/../)
Pattern match "(?i)(?:\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW.

''

Jul415:13:29server2dovecot:imap-login:Abortedlogin\(authfailed\,1attemptsin2secs\):user=\\,method=PLAIN\,rip=213.55.221.65\,lip=136.243.224.50\,TLS\,session=\Jul415:13:35server2dovecot:imap-login:Abortedlogin\(authfailed\,1attemptsin6secs\):user=\\,method=PLAIN\,rip=213.55.221.65\,lip=136.243.224.50\,TLS\,session=\Jul415:13:47server2dovecot:imap-login:Abortedlogin\(authfailed\,1attemptsin6secs\):user=\\,method=PLAIN\,rip=213.55.221.65\,lip=136.243.224.50\,TLS\,session=\<51Iuv9qMPXnVN91B\>Jul415:13:49server2dovecot:imap-login:Abortedlogin\(authfailed\,1attemptsin2secs\):user=\\,method=PLAIN\,rip=213.55.221.65\,lip=136.243.224.50\,TLS\,session=\Jul415:16:20server2dovecot:imap-login:Abortedlogin\(authfailed\,1attemptsin2secs\):user=\\,method=PLAIN\,rip=213.55.221.65\,lip=136.243.224.50\,TLS\,session=\Jul415:16:26se

Jul  2 23:25:19 MK-Soft-VM3 sshd\[9887\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.195.200.14  user=root
Jul  2 23:25:21 MK-Soft-VM3 sshd\[9887\]: Failed password for root from 122.195.200.14 port 29864 ssh2
Jul  2 23:25:24 MK-Soft-VM3 sshd\[9887\]: Failed password for root from 122.195.200.14 port 29864 ssh2
...

Rude login attack (3 tries in 1d)

2019-07-03T01:20:14.285067mail01 postfix/smtpd[21760]: warning: unknown[123.160.19.226]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
2019-07-03T01:20:21.444025mail01 postfix/smtpd[16706]: warning: unknown[123.160.19.226]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
2019-07-03T01:20:32.240302mail01 postfix/smtpd[21760]: warning: unknown[123.160.19.226]: SASL LOGIN authentication failed: UGFzc3dvcmQ6

Rude login attack (4 tries in 1d)

Rude login attack (20 tries in 1d)

Jul  2 13:58:41 db sshd\[5790\]: Invalid user qia from 179.189.235.228
Jul  2 13:58:41 db sshd\[5790\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=179.189.235.228 
Jul  2 13:58:43 db sshd\[5790\]: Failed password for invalid user qia from 179.189.235.228 port 53714 ssh2
Jul  2 14:04:10 db sshd\[5935\]: Invalid user platnosci from 179.189.235.228
Jul  2 14:04:10 db sshd\[5935\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=179.189.235.228 
...

Rude login attack (23 tries in 1d)

Port scan

Rude login attack (22 tries in 1d)

Honeypot attack, port: 23, PTR: PTR record not found

Feb 23 00:18:42 motanud sshd\[19393\]: Invalid user teamspeak3 from 88.84.200.139 port 48881
Feb 23 00:18:42 motanud sshd\[19393\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=88.84.200.139
Feb 23 00:18:43 motanud sshd\[19393\]: Failed password for invalid user teamspeak3 from 88.84.200.139 port 48881 ssh2

Jul  3 01:34:18 dev0-dcde-rnet sshd[25470]: Failed password for root from 153.36.242.114 port 51450 ssh2
Jul  3 01:34:29 dev0-dcde-rnet sshd[25472]: Failed password for root from 153.36.242.114 port 45231 ssh2

" "

Jan  2 22:22:33 motanud sshd\[14267\]: Invalid user test from 88.99.112.212 port 41422
Jan  2 22:22:33 motanud sshd\[14267\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=88.99.112.212
Jan  2 22:22:35 motanud sshd\[14267\]: Failed password for invalid user test from 88.99.112.212 port 41422 ssh2

Jul  3 01:20:37 ns3042688 proftpd\[21131\]: 127.0.0.1 \(180.156.246.240\[180.156.246.240\]\) - USER anonymous: no such user found from 180.156.246.240 \[180.156.246.240\] to 51.254.197.112:21
Jul  3 01:20:40 ns3042688 proftpd\[21163\]: 127.0.0.1 \(180.156.246.240\[180.156.246.240\]\) - USER www: no such user found from 180.156.246.240 \[180.156.246.240\] to 51.254.197.112:21
Jul  3 01:20:43 ns3042688 proftpd\[21191\]: 127.0.0.1 \(180.156.246.240\[180.156.246.240\]\) - USER www: no such user found from 180.156.246.240 \[180.156.246.240\] to 51.254.197.112:21
Jul  3 01:20:46 ns3042688 proftpd\[21197\]: 127.0.0.1 \(180.156.246.240\[180.156.246.240\]\) - USER cesumin \(Login failed\): Incorrect password
Jul  3 01:20:48 ns3042688 proftpd\[21212\]: 127.0.0.1 \(180.156.246.240\[180.156.246.240\]\) - USER cesumin \(Login failed\): Incorrect password
...