2020-08-06T23:49:21.551625amanda2.illicoweb.com sshd\[17073\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=syd-dbd2204b.bluella.net  user=root
2020-08-06T23:49:23.831465amanda2.illicoweb.com sshd\[17073\]: Failed password for root from 139.99.238.150 port 38140 ssh2
2020-08-06T23:53:20.281792amanda2.illicoweb.com sshd\[17771\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=syd-dbd2204b.bluella.net  user=root
2020-08-06T23:53:23.038399amanda2.illicoweb.com sshd\[17771\]: Failed password for root from 139.99.238.150 port 34302 ssh2
2020-08-06T23:55:13.929181amanda2.illicoweb.com sshd\[18080\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=syd-dbd2204b.bluella.net  user=root
...

Too many connections or unauthorized access detected from Arctic banned ip

Aug  6 14:52:50 mockhub sshd[11856]: Failed password for root from 94.102.54.82 port 48256 ssh2
...

Brute-force attempt banned

2020-08-07T00:05:05.479015ns386461 sshd\[3335\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.169.192  user=root
2020-08-07T00:05:07.686638ns386461 sshd\[3335\]: Failed password for root from 222.186.169.192 port 8562 ssh2
2020-08-07T00:05:10.503811ns386461 sshd\[3335\]: Failed password for root from 222.186.169.192 port 8562 ssh2
2020-08-07T00:05:13.730521ns386461 sshd\[3335\]: Failed password for root from 222.186.169.192 port 8562 ssh2
2020-08-07T00:05:17.614578ns386461 sshd\[3335\]: Failed password for root from 222.186.169.192 port 8562 ssh2
...

Received: from namescombined.host (70.35.196.60) 
From: Rotorazer Saw, hbh_fr1_one0011/zvt 
subject: Get The Saw That's 7 Different Saws in 1

9990/tcp 17155/tcp 8998/tcp...
[2020-06-25/08-05]30pkt,28pt.(tcp)

SMB Server BruteForce Attack

(From amanda.mulroy@onlinechatservices.com) Hello there,

I hope you're doing well. We realize the current environment has pushed companies to rapidly move online to better service their customers. To help with the transition, we work with businesses to install Live Chat software and offer it free for six months with no commitment at all.

You will be able to live chat with your customers on johnsonchiropracticwy.com, display important messages via various popups, and send automated emails for an improved customer experience.

Would you be interested in learning more? I'd be happy to answer any questions you have. My name is Amanda, and I look forward to connecting with you!

Amanda Mulroy
Online Chat Services, Tyipe LLC (pronounced "type")
500 Westover Dr #15391 Sanford, NC 27330

If you're not interested, you can opt out here http://eroutemgr.com/remove?q=johnsonchiropracticwy.com&i=13

[2020-08-06 17:45:31] NOTICE[1248][C-0000467f] chan_sip.c: Call from '' (185.53.88.221:5071) to extension '011972595778361' rejected because extension not found in context 'public'.
[2020-08-06 17:45:31] SECURITY[1275] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-08-06T17:45:31.240-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="011972595778361",SessionID="0x7f272002e0a8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/185.53.88.221/5071",ACLName="no_extension_match"
[2020-08-06 17:55:20] NOTICE[1248][C-00004686] chan_sip.c: Call from '' (185.53.88.221:5071) to extension '9011972595778361' rejected because extension not found in context 'public'.
[2020-08-06 17:55:20] SECURITY[1275] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-08-06T17:55:20.469-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="9011972595778361",SessionID="0x7f2720161a78",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/1
...

2020-08-06T23:47:02.074242amanda2.illicoweb.com sshd\[16702\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.108.52.58  user=root
2020-08-06T23:47:03.937341amanda2.illicoweb.com sshd\[16702\]: Failed password for root from 218.108.52.58 port 40328 ssh2
2020-08-06T23:51:00.466101amanda2.illicoweb.com sshd\[17344\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.108.52.58  user=root
2020-08-06T23:51:02.668971amanda2.illicoweb.com sshd\[17344\]: Failed password for root from 218.108.52.58 port 42806 ssh2
2020-08-06T23:55:13.730103amanda2.illicoweb.com sshd\[18076\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.108.52.58  user=root
...

Aug  6 22:51:44 ajax sshd[28562]: Failed password for root from 109.24.144.69 port 56222 ssh2

SSH auth scanning - multiple failed logins

Aug  6 23:55:58 vpn01 sshd[16311]: Failed password for root from 218.92.0.223 port 31468 ssh2
Aug  6 23:56:02 vpn01 sshd[16311]: Failed password for root from 218.92.0.223 port 31468 ssh2
...

2020-08-06T23:51:17.159583amanda2.illicoweb.com sshd\[17420\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ip-208-109-12-104.ip.secureserver.net  user=root
2020-08-06T23:51:19.364108amanda2.illicoweb.com sshd\[17420\]: Failed password for root from 208.109.12.104 port 60172 ssh2
2020-08-06T23:53:27.120495amanda2.illicoweb.com sshd\[17857\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ip-208-109-12-104.ip.secureserver.net  user=root
2020-08-06T23:53:28.838169amanda2.illicoweb.com sshd\[17857\]: Failed password for root from 208.109.12.104 port 46510 ssh2
2020-08-06T23:55:31.145793amanda2.illicoweb.com sshd\[18143\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ip-208-109-12-104.ip.secureserver.net  user=root
...