$f2bV_matches

SASL PLAIN auth failed: ruser=...

Unauthorized connection attempt detected from IP address 217.61.121.48 to port 2220 [J]

Dec 31 06:52:21 hosname23 sshd[13623]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.61.121.48  user=r.r
Dec 31 06:52:24 hosname23 sshd[13623]: Failed password for r.r from 217.61.121.48 port 40282 ssh2
Dec 31 06:52:24 hosname23 sshd[13623]: Received disconnect from 217.61.121.48 port 40282:11: Bye Bye [preauth]
Dec 31 06:52:24 hosname23 sshd[13623]: Disconnected from 217.61.121.48 port 40282 [preauth]
Dec 31 06:56:43 hosname23 sshd[13831]: Invalid user guest from 217.61.121.48 port 36256
Dec 31 06:56:45 hosname23 sshd[13831]: Failed password for invalid user guest from 217.61.121.48 port 36256 ssh2
Dec 31 06:56:45 hosname23 sshd[13831]: Received disconnect from 217.61.121.48 port 36256:11: Bye Bye [preauth]
Dec 31 06:56:45 hosname23 sshd[13831]: Disconnected from 217.61.121.48 port 36256 [preauth]
Dec 31 06:57:41 hosname23 sshd[13877]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2........
-------------------------------

$f2bV_matches

Dec 15 09:21:03 localhost sshd\[9766\]: Invalid user spitzer from 217.61.121.48 port 45212
Dec 15 09:21:03 localhost sshd\[9766\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.61.121.48
Dec 15 09:21:05 localhost sshd\[9766\]: Failed password for invalid user spitzer from 217.61.121.48 port 45212 ssh2

Dec 12 12:28:14 php1 sshd\[22312\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.61.121.48  user=root
Dec 12 12:28:16 php1 sshd\[22312\]: Failed password for root from 217.61.121.48 port 42730 ssh2
Dec 12 12:33:53 php1 sshd\[23027\]: Invalid user test from 217.61.121.48
Dec 12 12:33:53 php1 sshd\[23027\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.61.121.48
Dec 12 12:33:56 php1 sshd\[23027\]: Failed password for invalid user test from 217.61.121.48 port 51284 ssh2

Dec  7 08:31:06 cvbnet sshd[8576]: Failed password for uucp from 217.61.121.48 port 43454 ssh2
...

Dec  4 23:04:10 microserver sshd[58132]: Invalid user vaag from 217.61.121.48 port 38736
Dec  4 23:04:10 microserver sshd[58132]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.61.121.48
Dec  4 23:04:12 microserver sshd[58132]: Failed password for invalid user vaag from 217.61.121.48 port 38736 ssh2
Dec  4 23:09:35 microserver sshd[58975]: Invalid user dittman from 217.61.121.48 port 49508
Dec  4 23:09:35 microserver sshd[58975]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.61.121.48
Dec  4 23:20:15 microserver sshd[61028]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.61.121.48  user=ftp
Dec  4 23:20:17 microserver sshd[61028]: Failed password for ftp from 217.61.121.48 port 42820 ssh2
Dec  4 23:25:39 microserver sshd[61921]: Invalid user yeo from 217.61.121.48 port 53592
Dec  4 23:25:39 microserver sshd[61921]: pam_unix(sshd:auth): authentication failure; logname= uid=0 e

Dec  3 08:30:31 vps691689 sshd[27305]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.61.121.48
Dec  3 08:30:33 vps691689 sshd[27305]: Failed password for invalid user anisah from 217.61.121.48 port 56154 ssh2
...

Dec  1 23:25:20 auw2 sshd\[6558\]: Invalid user server from 217.61.121.48
Dec  1 23:25:20 auw2 sshd\[6558\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.61.121.48
Dec  1 23:25:22 auw2 sshd\[6558\]: Failed password for invalid user server from 217.61.121.48 port 40116 ssh2
Dec  1 23:32:39 auw2 sshd\[7211\]: Invalid user raamatukogu from 217.61.121.48
Dec  1 23:32:39 auw2 sshd\[7211\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.61.121.48

Dec  2 10:23:17 vibhu-HP-Z238-Microtower-Workstation sshd\[11229\]: Invalid user tjones from 217.61.121.48
Dec  2 10:23:17 vibhu-HP-Z238-Microtower-Workstation sshd\[11229\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.61.121.48
Dec  2 10:23:19 vibhu-HP-Z238-Microtower-Workstation sshd\[11229\]: Failed password for invalid user tjones from 217.61.121.48 port 34644 ssh2
Dec  2 10:29:10 vibhu-HP-Z238-Microtower-Workstation sshd\[11807\]: Invalid user zipperle from 217.61.121.48
Dec  2 10:29:10 vibhu-HP-Z238-Microtower-Workstation sshd\[11807\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.61.121.48
...

Invalid user langenberg from 217.61.121.48 port 59346

2019-11-29T11:29:06.4558091495-001 sshd\[33449\]: Failed password for invalid user zyromski from 217.61.121.48 port 43928 ssh2
2019-11-29T12:31:40.1821861495-001 sshd\[35840\]: Invalid user vu from 217.61.121.48 port 35108
2019-11-29T12:31:40.1861311495-001 sshd\[35840\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.61.121.48
2019-11-29T12:31:42.2598551495-001 sshd\[35840\]: Failed password for invalid user vu from 217.61.121.48 port 35108 ssh2
2019-11-29T12:34:49.3829621495-001 sshd\[35933\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.61.121.48  user=root
2019-11-29T12:34:51.4018121495-001 sshd\[35933\]: Failed password for root from 217.61.121.48 port 43140 ssh2
...

2019-11-12T08:31:54.9618951240 sshd\[4412\]: Invalid user usuario from 217.61.121.48 port 53638
2019-11-12T08:31:54.9647121240 sshd\[4412\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.61.121.48
2019-11-12T08:31:56.7917701240 sshd\[4412\]: Failed password for invalid user usuario from 217.61.121.48 port 53638 ssh2
...

Jun 12 19:50:23 localhost postfix/smtpd\[31467\]: warning: unknown\[217.61.121.23\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jun 12 19:50:27 localhost postfix/smtpd\[31629\]: warning: unknown\[217.61.121.23\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jun 12 19:50:28 localhost postfix/smtpd\[31631\]: warning: unknown\[217.61.121.23\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jun 12 19:50:28 localhost postfix/smtpd\[31630\]: warning: unknown\[217.61.121.23\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jun 12 19:50:29 localhost postfix/smtpd\[31467\]: warning: unknown\[217.61.121.23\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jun 12 19:50:29 localhost postfix/smtpd\[31632\]: warning: unknown\[217.61.121.23\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
...

10 mislukte aanmeldingspogingen voor aanmelding bij Mail Server

Brute-force attempt banned

May  7 20:20:53 sip sshd[155476]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.61.121.57 
May  7 20:20:53 sip sshd[155476]: Invalid user postgres from 217.61.121.57 port 36392
May  7 20:20:56 sip sshd[155476]: Failed password for invalid user postgres from 217.61.121.57 port 36392 ssh2
...

May  5 21:23:09 tuxlinux sshd[54884]: Invalid user admin from 217.61.121.57 port 39744
May  5 21:23:09 tuxlinux sshd[54884]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.61.121.57 
May  5 21:23:09 tuxlinux sshd[54884]: Invalid user admin from 217.61.121.57 port 39744
May  5 21:23:09 tuxlinux sshd[54884]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.61.121.57 
...

Invalid user git from 217.61.121.57 port 36882

Apr 17 23:50:37 rotator sshd\[10694\]: Invalid user ftpadmin from 217.61.121.57Apr 17 23:50:39 rotator sshd\[10694\]: Failed password for invalid user ftpadmin from 217.61.121.57 port 58614 ssh2Apr 17 23:55:31 rotator sshd\[11482\]: Invalid user lb from 217.61.121.57Apr 17 23:55:33 rotator sshd\[11482\]: Failed password for invalid user lb from 217.61.121.57 port 38752 ssh2Apr 18 00:00:10 rotator sshd\[11832\]: Invalid user tn from 217.61.121.57Apr 18 00:00:13 rotator sshd\[11832\]: Failed password for invalid user tn from 217.61.121.57 port 46980 ssh2
...

Time:     Mon Mar  9 09:06:48 2020 -0300
IP:       217.61.121.23 (IT/Italy/betterbies.com)
Failures: 30 (smtpauth)
Interval: 3600 seconds
Blocked:  Permanent Block

2019-08-27T00:33:23.336328beta postfix/smtpd[4702]: warning: unknown[217.61.121.23]: SASL LOGIN authentication failed: authentication failure
2019-08-27T00:33:26.013273beta postfix/smtpd[4702]: warning: unknown[217.61.121.23]: SASL LOGIN authentication failed: authentication failure
2019-08-27T00:33:28.441159beta postfix/smtpd[4702]: warning: unknown[217.61.121.23]: SASL LOGIN authentication failed: authentication failure
...

Honeypot attack, port: 445, PTR: PTR record not found

Jul  9 10:48:10 itv-usvr-01 sshd[31332]: Invalid user mick from 190.144.135.118
Jul  9 10:48:10 itv-usvr-01 sshd[31332]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.144.135.118
Jul  9 10:48:10 itv-usvr-01 sshd[31332]: Invalid user mick from 190.144.135.118
Jul  9 10:48:12 itv-usvr-01 sshd[31332]: Failed password for invalid user mick from 190.144.135.118 port 44797 ssh2
Jul  9 10:51:02 itv-usvr-01 sshd[31430]: Invalid user andrew from 190.144.135.118

09.07.2020 05:51:15 - Wordpress fail 
Detected by ELinOX-ALM

2020-07-09T07:01:12.027562abusebot.cloudsearch.cf sshd[5098]: Invalid user point from 176.186.77.215 port 50210
2020-07-09T07:01:12.032580abusebot.cloudsearch.cf sshd[5098]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=i19-les01-ntr-176-186-77-215.sfr.lns.abo.bbox.fr
2020-07-09T07:01:12.027562abusebot.cloudsearch.cf sshd[5098]: Invalid user point from 176.186.77.215 port 50210
2020-07-09T07:01:14.452308abusebot.cloudsearch.cf sshd[5098]: Failed password for invalid user point from 176.186.77.215 port 50210 ssh2
2020-07-09T07:02:11.186923abusebot.cloudsearch.cf sshd[5100]: Invalid user myndy from 176.186.77.215 port 58778
2020-07-09T07:02:11.192655abusebot.cloudsearch.cf sshd[5100]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=i19-les01-ntr-176-186-77-215.sfr.lns.abo.bbox.fr
2020-07-09T07:02:11.186923abusebot.cloudsearch.cf sshd[5100]: Invalid user myndy from 176.186.77.215 port 58778
2020-07-09T07:02:
...

/wp-config.bak

Email rejected due to spam filtering

B: Abusive ssh attack

Honeypot attack, port: 445, PTR: PTR record not found

Honeypot attack, port: 445, PTR: 179.184.184.18.static.gvt.net.br.

Honeypot attack, port: 445, PTR: 186-94-220-71.genericrev.cantv.net.

Jul  9 05:50:53 smtp postfix/smtpd[35300]: NOQUEUE: reject: RCPT from unknown[213.230.90.55]: 554 5.7.1 Service unavailable; Client host [213.230.90.55] blocked using bl.spamcop.net; Blocked - see https://www.spamcop.net/bl.shtml?213.230.90.55; from= to= proto=ESMTP helo=<[213.230.90.55]>
...

[MK-VM6] Blocked by UFW

$f2bV_matches

Jul  9 11:43:43 nextcloud sshd\[21264\]: Invalid user jack from 159.89.202.176
Jul  9 11:43:43 nextcloud sshd\[21264\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.89.202.176
Jul  9 11:43:45 nextcloud sshd\[21264\]: Failed password for invalid user jack from 159.89.202.176 port 51066 ssh2

07/09/2020-06:06:55.265879 185.175.93.4 Protocol: 6 ET DROP Dshield Block Listed Source group 1