Automatic report - Port Scan Attack

Jun 13 13:43:34 124388 sshd[25835]: Failed password for root from 222.186.30.112 port 60795 ssh2
Jun 13 13:43:36 124388 sshd[25839]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.30.112  user=root
Jun 13 13:43:38 124388 sshd[25839]: Failed password for root from 222.186.30.112 port 59049 ssh2
Jun 13 13:43:45 124388 sshd[25841]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.30.112  user=root
Jun 13 13:43:47 124388 sshd[25841]: Failed password for root from 222.186.30.112 port 28077 ssh2

From: Barbara Momboeuf 
Subject: In Singapore

Jun 13 15:09:01 debian-2gb-nbg1-2 kernel: \[14312458.166751\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=45.141.84.30 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=245 ID=23225 PROTO=TCP SPT=50749 DPT=981 WINDOW=1024 RES=0x00 SYN URGP=0

Jun 13 09:19:05 plusreed sshd[12204]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.42.137  user=root
Jun 13 09:19:07 plusreed sshd[12204]: Failed password for root from 222.186.42.137 port 24797 ssh2
...

WordPress wp-login brute force :: 77.72.26.179 0.080 BYPASS [13/Jun/2020:12:59:08  0000] [censored_2] "POST /wp-login.php HTTP/1.1" 200 2287 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"

From infobounce@aquivoceconsegue.live Sat Jun 13 09:28:11 2020
Received: from [185.243.180.169] (port=35258 helo=seguemx2.aquivoceconsegue.live)

ssh intrusion attempt

2020-06-13T09:12:46.9354141495-001 sshd[19153]: Failed password for invalid user cho from 159.65.86.239 port 50088 ssh2
2020-06-13T09:16:10.6722561495-001 sshd[19308]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.65.86.239  user=root
2020-06-13T09:16:12.9302021495-001 sshd[19308]: Failed password for root from 159.65.86.239 port 50770 ssh2
2020-06-13T09:19:29.8866211495-001 sshd[19461]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.65.86.239  user=root
2020-06-13T09:19:32.1296701495-001 sshd[19461]: Failed password for root from 159.65.86.239 port 51454 ssh2
2020-06-13T09:22:44.8454761495-001 sshd[19568]: Invalid user maxreg from 159.65.86.239 port 52148
...

Unauthorised connection attempt detected at AUO FR1 NODE2. System is sshd. Protected by AUO Stack Web Application Firewall (WAF)

Jun 13 15:05:43 ns381471 sshd[8808]: Failed password for root from 112.85.42.185 port 17301 ssh2

Jun 13 14:59:43 OPSO sshd\[8056\]: Invalid user ismael from 118.24.140.195 port 45460
Jun 13 14:59:43 OPSO sshd\[8056\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.24.140.195
Jun 13 14:59:45 OPSO sshd\[8056\]: Failed password for invalid user ismael from 118.24.140.195 port 45460 ssh2
Jun 13 15:04:08 OPSO sshd\[8858\]: Invalid user c from 118.24.140.195 port 38668
Jun 13 15:04:08 OPSO sshd\[8858\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.24.140.195

2020-06-13T13:14:38.246852shield sshd\[8795\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.36.103.48  user=root
2020-06-13T13:14:40.208623shield sshd\[8795\]: Failed password for root from 103.36.103.48 port 57068 ssh2
2020-06-13T13:17:50.954922shield sshd\[9950\]: Invalid user amax from 103.36.103.48 port 52012
2020-06-13T13:17:50.958667shield sshd\[9950\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.36.103.48
2020-06-13T13:17:53.276905shield sshd\[9950\]: Failed password for invalid user amax from 103.36.103.48 port 52012 ssh2

Brute-force attempt banned

2020-06-13T15:49:39.501957n23.at sshd[16685]: Failed password for root from 218.92.0.219 port 59493 ssh2
2020-06-13T15:49:42.672594n23.at sshd[16685]: Failed password for root from 218.92.0.219 port 59493 ssh2
2020-06-13T15:49:45.510933n23.at sshd[16685]: Failed password for root from 218.92.0.219 port 59493 ssh2
...