Apr 29 12:29:51 mout sshd[20010]: Invalid user lsc from 111.229.15.228 port 57344

[Aegis] @ 2019-07-02 06:58:58  0100 -> Attempted Administrator Privilege Gain: ET SCAN LibSSH Based Frequent SSH Connections Likely BruteForce Attack

Apr 29 00:52:22 ws22vmsma01 sshd[21936]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.14.123.196
...

Apr 29 09:00:42 ns382633 sshd\[26636\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.57.247.86  user=root
Apr 29 09:00:44 ns382633 sshd\[26636\]: Failed password for root from 119.57.247.86 port 57338 ssh2
Apr 29 09:07:13 ns382633 sshd\[27706\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.57.247.86  user=root
Apr 29 09:07:15 ns382633 sshd\[27706\]: Failed password for root from 119.57.247.86 port 39360 ssh2
Apr 29 09:11:25 ns382633 sshd\[28593\]: Invalid user design2 from 119.57.247.86 port 54106
Apr 29 09:11:25 ns382633 sshd\[28593\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.57.247.86

Brute Force - Postfix

Invalid user develop from 152.67.67.89 port 57116

(imapd) Failed IMAP login from 183.89.237.134 (TH/Thailand/mx-ll-183.89.237-134.dynamic.3bb.in.th): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Apr 29 14:42:54 ir1 dovecot[264309]: imap-login: Disconnected (auth failed, 1 attempts in 7 secs): user=, method=PLAIN, rip=183.89.237.134, lip=5.63.12.44, session=

This IP has repeatedly tried to hack my Yahoo mail account from Vietnam

Apr 29 08:09:22 l03 sshd[17521]: Invalid user tuan from 51.38.238.165 port 56670
...

[2020-04-29 06:46:23] NOTICE[1170] chan_sip.c: Registration from '' failed for '185.147.215.13:60970' - Wrong password
[2020-04-29 06:46:23] SECURITY[1184] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-04-29T06:46:23.473-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="1072",SessionID="0x7f6c08064098",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/185.147.215.13/60970",Challenge="542cf54f",ReceivedChallenge="542cf54f",ReceivedHash="d5d77ef8d9bf19d21278866449c6b350"
[2020-04-29 06:46:56] NOTICE[1170] chan_sip.c: Registration from '' failed for '185.147.215.13:56756' - Wrong password
[2020-04-29 06:46:56] SECURITY[1184] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-04-29T06:46:56.518-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="8828",SessionID="0x7f6c086f7488",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/185.147.21
...

Unauthorized connection attempt detected from IP address 1.53.64.240 to port 23 [T]

Apr 28 23:25:28 web9 sshd\[19357\]: Invalid user virtuoso from 195.231.1.153
Apr 28 23:25:28 web9 sshd\[19357\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.231.1.153
Apr 28 23:25:30 web9 sshd\[19357\]: Failed password for invalid user virtuoso from 195.231.1.153 port 50982 ssh2
Apr 28 23:29:45 web9 sshd\[20171\]: Invalid user ils from 195.231.1.153
Apr 28 23:29:45 web9 sshd\[20171\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.231.1.153

(imapd) Failed IMAP login from 117.7.239.10 (VN/Vietnam/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Apr 29 11:18:31 ir1 dovecot[264309]: imap-login: Disconnected (auth failed, 1 attempts in 7 secs): user=, method=PLAIN, rip=117.7.239.10, lip=5.63.12.44, TLS: Connection closed, session=

Website hacking attempt: Improper php file access [php file]

$f2bV_matches