Mar  1 23:41:50 lukav-desktop sshd\[17700\]: Invalid user user3 from 221.13.203.109
Mar  1 23:41:50 lukav-desktop sshd\[17700\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.13.203.109
Mar  1 23:41:52 lukav-desktop sshd\[17700\]: Failed password for invalid user user3 from 221.13.203.109 port 2447 ssh2
Mar  1 23:46:55 lukav-desktop sshd\[17749\]: Invalid user tanghao from 221.13.203.109
Mar  1 23:46:55 lukav-desktop sshd\[17749\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.13.203.109

Automatic report - SSH Brute-Force Attack

Feb  9 05:46:39 markkoudstaal sshd[3368]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.13.203.109
Feb  9 05:46:40 markkoudstaal sshd[3368]: Failed password for invalid user tde from 221.13.203.109 port 2385 ssh2
Feb  9 05:48:41 markkoudstaal sshd[3785]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.13.203.109

Unauthorized connection attempt detected from IP address 221.13.203.109 to port 2220 [J]

Jan 23 20:48:47 localhost sshd\[16709\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.13.203.109  user=root
Jan 23 20:48:49 localhost sshd\[16709\]: Failed password for root from 221.13.203.109 port 2374 ssh2
Jan 23 20:50:39 localhost sshd\[16921\]: Invalid user noaccess from 221.13.203.109 port 2375

Unauthorized connection attempt detected from IP address 221.13.203.109 to port 2220 [J]

Unauthorized connection attempt detected from IP address 221.13.203.109 to port 2220 [J]

Unauthorized connection attempt detected from IP address 221.13.203.109 to port 2220 [J]

Jan 19 16:26:38 mout sshd[697]: Invalid user vyos from 221.13.203.109 port 2171

2020-08-30T05:56:54.130582shield sshd\[30796\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.13.203.102  user=root
2020-08-30T05:56:56.288643shield sshd\[30796\]: Failed password for root from 221.13.203.102 port 3722 ssh2
2020-08-30T06:01:40.928902shield sshd\[31380\]: Invalid user weldon from 221.13.203.102 port 3723
2020-08-30T06:01:40.947591shield sshd\[31380\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.13.203.102
2020-08-30T06:01:43.035289shield sshd\[31380\]: Failed password for invalid user weldon from 221.13.203.102 port 3723 ssh2

Aug 29 05:51:19 hcbbdb sshd\[29382\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.13.203.102  user=root
Aug 29 05:51:21 hcbbdb sshd\[29382\]: Failed password for root from 221.13.203.102 port 3480 ssh2
Aug 29 05:56:09 hcbbdb sshd\[29857\]: Invalid user look from 221.13.203.102
Aug 29 05:56:09 hcbbdb sshd\[29857\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.13.203.102
Aug 29 05:56:11 hcbbdb sshd\[29857\]: Failed password for invalid user look from 221.13.203.102 port 3481 ssh2

Aug 29 01:46:01 pkdns2 sshd\[62816\]: Invalid user hz from 221.13.203.102Aug 29 01:46:02 pkdns2 sshd\[62816\]: Failed password for invalid user hz from 221.13.203.102 port 3106 ssh2Aug 29 01:48:16 pkdns2 sshd\[62915\]: Invalid user pi from 221.13.203.102Aug 29 01:48:18 pkdns2 sshd\[62915\]: Failed password for invalid user pi from 221.13.203.102 port 3107 ssh2Aug 29 01:50:32 pkdns2 sshd\[63064\]: Invalid user rigo from 221.13.203.102Aug 29 01:50:34 pkdns2 sshd\[63064\]: Failed password for invalid user rigo from 221.13.203.102 port 3108 ssh2
...

2020-08-28T14:06:49+0200 Failed SSH Authentication/Brute Force Attack.(Server 2)

Invalid user tester from 221.13.203.102 port 3530

Aug 23 12:42:47 inter-technics sshd[16944]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.13.203.102  user=root
Aug 23 12:42:49 inter-technics sshd[16944]: Failed password for root from 221.13.203.102 port 3429 ssh2
Aug 23 12:47:06 inter-technics sshd[17265]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.13.203.102  user=root
Aug 23 12:47:07 inter-technics sshd[17265]: Failed password for root from 221.13.203.102 port 3430 ssh2
Aug 23 12:51:16 inter-technics sshd[17498]: Invalid user pay from 221.13.203.102 port 3431
...

SSH login attempts.

Invalid user deploy from 221.13.203.102 port 4294

2020-08-03T12:21:04.286717abusebot-8.cloudsearch.cf sshd[15674]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.13.203.102  user=root
2020-08-03T12:21:06.329834abusebot-8.cloudsearch.cf sshd[15674]: Failed password for root from 221.13.203.102 port 3305 ssh2
2020-08-03T12:22:53.515113abusebot-8.cloudsearch.cf sshd[15688]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.13.203.102  user=root
2020-08-03T12:22:55.187590abusebot-8.cloudsearch.cf sshd[15688]: Failed password for root from 221.13.203.102 port 3306 ssh2
2020-08-03T12:24:34.960690abusebot-8.cloudsearch.cf sshd[15712]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.13.203.102  user=root
2020-08-03T12:24:36.166208abusebot-8.cloudsearch.cf sshd[15712]: Failed password for root from 221.13.203.102 port 3307 ssh2
2020-08-03T12:26:23.120804abusebot-8.cloudsearch.cf sshd[15780]: pam_unix(sshd:auth): au
...

Invalid user ftptest from 221.13.203.102 port 2736

Jul 25 04:19:01 game-panel sshd[8785]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.13.203.102
Jul 25 04:19:04 game-panel sshd[8785]: Failed password for invalid user pokemon from 221.13.203.102 port 3007 ssh2
Jul 25 04:20:41 game-panel sshd[8888]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.13.203.102

Jul 19 16:02:21 jumpserver sshd[134697]: Invalid user info from 221.13.203.102 port 2969
Jul 19 16:02:24 jumpserver sshd[134697]: Failed password for invalid user info from 221.13.203.102 port 2969 ssh2
Jul 19 16:09:20 jumpserver sshd[134722]: Invalid user test from 221.13.203.102 port 2970
...

EXPLOIT Linksys E-Series Device RCE Attempt

Jul 13 21:56:24 Host-KLAX-C sshd[3665]: Disconnected from invalid user jh 221.13.203.102 port 3167 [preauth]
...

Invalid user postgres from 221.13.203.102 port 3177

May  5 11:35:55 ourumov-web sshd\[31480\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.209.0.103  user=root
May  5 11:35:55 ourumov-web sshd\[31481\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.209.0.103  user=root
May  5 11:35:57 ourumov-web sshd\[31480\]: Failed password for root from 85.209.0.103 port 12002 ssh2
...

2020-05-0511:20:541jVtl0-0003yB-1w\<=info@whatsup2013.chH=\(localhost\)[14.177.141.234]:55474P=esmtpsaX=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256CV=noA=dovecot_login:info@whatsup2013.chS=3020id=0ff611424962b7bb9cd96f3cc80f05093ad12fe3@whatsup2013.chT="Iwishtobeadored"forvoodooprince007@gmail.comjaveonjuarez38@gmail.com2020-05-0511:18:281jVtid-0003ka-6p\<=info@whatsup2013.chH=\(localhost\)[14.162.202.140]:52461P=esmtpsaX=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256CV=noA=dovecot_login:info@whatsup2013.chS=3200id=8054e2b1ba91bbb32f2a9c30d72309158dd2c1@whatsup2013.chT="Youaregood-looking"forforevermssmiley@gmail.comjacobwright705@gmail.com2020-05-0511:18:341jVtij-0003lF-Pn\<=info@whatsup2013.chH=\(localhost\)[13.77.204.123]:35502P=esmtpsaX=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256CV=noA=dovecot_login:info@whatsup2013.chS=3028id=a620863d361dc83b18e61043489ca589aa40337538@whatsup2013.chT="Iadoreyourpictures"foryaesmister@gmail.comjohnjacobs19972008@gmail.com2020-05-0511:20:051jVtkB-0003pt-DU\<=info@whatsup2013.chH=\(loc

2020-05-0511:20:541jVtl0-0003yB-1w\<=info@whatsup2013.chH=\(localhost\)[14.177.141.234]:55474P=esmtpsaX=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256CV=noA=dovecot_login:info@whatsup2013.chS=3020id=0ff611424962b7bb9cd96f3cc80f05093ad12fe3@whatsup2013.chT="Iwishtobeadored"forvoodooprince007@gmail.comjaveonjuarez38@gmail.com2020-05-0511:18:281jVtid-0003ka-6p\<=info@whatsup2013.chH=\(localhost\)[14.162.202.140]:52461P=esmtpsaX=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256CV=noA=dovecot_login:info@whatsup2013.chS=3200id=8054e2b1ba91bbb32f2a9c30d72309158dd2c1@whatsup2013.chT="Youaregood-looking"forforevermssmiley@gmail.comjacobwright705@gmail.com2020-05-0511:18:341jVtij-0003lF-Pn\<=info@whatsup2013.chH=\(localhost\)[13.77.204.123]:35502P=esmtpsaX=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256CV=noA=dovecot_login:info@whatsup2013.chS=3028id=a620863d361dc83b18e61043489ca589aa40337538@whatsup2013.chT="Iadoreyourpictures"foryaesmister@gmail.comjohnjacobs19972008@gmail.com2020-05-0511:20:051jVtkB-0003pt-DU\<=info@whatsup2013.chH=\(loc

Scanning

Unauthorised connection attempt detected at AUO MAIN. System is sshd. Protected by AUO Stack Web Application Firewall (WAF)

May  5 06:20:46 vps46666688 sshd[27391]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.108.139.242
May  5 06:20:48 vps46666688 sshd[27391]: Failed password for invalid user lisp from 200.108.139.242 port 58021 ssh2
...

May  5 06:16:32 dns1 sshd[19301]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.55.81.99 
May  5 06:16:35 dns1 sshd[19301]: Failed password for invalid user sergio from 157.55.81.99 port 51304 ssh2
May  5 06:20:58 dns1 sshd[19524]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.55.81.99

May  5 15:04:55 gw1 sshd[29020]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.129.112
May  5 15:04:57 gw1 sshd[29020]: Failed password for invalid user nagios from 148.70.129.112 port 20002 ssh2
...

Automatic report - Port Scan Attack

May  5 11:11:24 server sshd[5985]: Failed password for root from 103.242.56.182 port 37443 ssh2
May  5 11:16:22 server sshd[10196]: Failed password for invalid user tet from 103.242.56.182 port 42045 ssh2
May  5 11:21:00 server sshd[14346]: Failed password for invalid user ts3 from 103.242.56.182 port 46645 ssh2

May  5 12:04:18 home sshd[28058]: Failed password for root from 222.186.30.35 port 14674 ssh2
May  5 12:04:20 home sshd[28058]: Failed password for root from 222.186.30.35 port 14674 ssh2
May  5 12:04:22 home sshd[28058]: Failed password for root from 222.186.30.35 port 14674 ssh2
...

2020-05-05T09:21:04Z - RDP login failed multiple times. (185.202.1.38)

May  5 09:20:59 scw-6657dc sshd[30482]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.81.162  user=root
May  5 09:20:59 scw-6657dc sshd[30482]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.81.162  user=root
May  5 09:21:01 scw-6657dc sshd[30482]: Failed password for root from 138.68.81.162 port 38124 ssh2
...

May  5 11:20:35 haigwepa sshd[6380]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=109.95.182.42 
May  5 11:20:37 haigwepa sshd[6380]: Failed password for invalid user tor from 109.95.182.42 port 56042 ssh2
...

05/05/2020-11:36:59.821291 185.216.140.252 Protocol: 6 ET DROP Dshield Block Listed Source group 1