2020-05-07T20:22:04.967072vps751288.ovh.net sshd\[6495\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.149.46.4  user=root
2020-05-07T20:22:07.278770vps751288.ovh.net sshd\[6495\]: Failed password for root from 186.149.46.4 port 2118 ssh2
2020-05-07T20:26:14.424476vps751288.ovh.net sshd\[6523\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.149.46.4  user=root
2020-05-07T20:26:16.389978vps751288.ovh.net sshd\[6523\]: Failed password for root from 186.149.46.4 port 1894 ssh2
2020-05-07T20:30:25.556953vps751288.ovh.net sshd\[6547\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.149.46.4  user=root

Web Server Attack

May  7 19:20:21 vps639187 sshd\[26463\]: Invalid user ovidiu from 152.136.102.131 port 40708
May  7 19:20:21 vps639187 sshd\[26463\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.136.102.131
May  7 19:20:23 vps639187 sshd\[26463\]: Failed password for invalid user ovidiu from 152.136.102.131 port 40708 ssh2
...

odoo8
...

Lines containing failures of 20.36.47.241


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=20.36.47.241

[2020-05-07 15:11:03] NOTICE[1157] chan_sip.c: Registration from '' failed for '185.147.213.13:64648' - Wrong password
[2020-05-07 15:11:03] SECURITY[1173] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-05-07T15:11:03.012-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="41",SessionID="0x7f5f10518f48",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/185.147.213.13/64648",Challenge="23f889d7",ReceivedChallenge="23f889d7",ReceivedHash="0c22a1a74bbf0e3f37def0cdba42f6d1"
[2020-05-07 15:11:49] NOTICE[1157] chan_sip.c: Registration from '' failed for '185.147.213.13:63747' - Wrong password
[2020-05-07 15:11:49] SECURITY[1173] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-05-07T15:11:49.851-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="9863",SessionID="0x7f5f10898788",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/185.147.213.13
...

May  7 19:49:08 debian-2gb-nbg1-2 kernel: \[11132632.450835\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=198.108.67.19 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=32 ID=20119 PROTO=TCP SPT=45259 DPT=22 WINDOW=1024 RES=0x00 SYN URGP=0

spam

May  7 13:04:50 server1 sshd\[24784\]: Failed password for invalid user demo from 54.38.53.251 port 34556 ssh2
May  7 13:08:05 server1 sshd\[25711\]: Invalid user ajay from 54.38.53.251
May  7 13:08:05 server1 sshd\[25711\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.38.53.251 
May  7 13:08:08 server1 sshd\[25711\]: Failed password for invalid user ajay from 54.38.53.251 port 34950 ssh2
May  7 13:11:19 server1 sshd\[26695\]: Invalid user admin from 54.38.53.251
...

2020-05-07T13:20:36.312387sorsha.thespaminator.com sshd[20387]: Invalid user cyber from 2.80.168.28 port 53110
2020-05-07T13:20:38.527456sorsha.thespaminator.com sshd[20387]: Failed password for invalid user cyber from 2.80.168.28 port 53110 ssh2
...

2020-05-07T17:24:46.373284ionos.janbro.de sshd[8855]: Invalid user kuber from 180.109.35.133 port 60922
2020-05-07T17:24:49.108248ionos.janbro.de sshd[8855]: Failed password for invalid user kuber from 180.109.35.133 port 60922 ssh2
2020-05-07T17:29:15.248349ionos.janbro.de sshd[8898]: Invalid user monitor from 180.109.35.133 port 37164
2020-05-07T17:29:15.333367ionos.janbro.de sshd[8898]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.109.35.133
2020-05-07T17:29:15.248349ionos.janbro.de sshd[8898]: Invalid user monitor from 180.109.35.133 port 37164
2020-05-07T17:29:17.936315ionos.janbro.de sshd[8898]: Failed password for invalid user monitor from 180.109.35.133 port 37164 ssh2
2020-05-07T17:34:07.065340ionos.janbro.de sshd[8934]: Invalid user mattie from 180.109.35.133 port 41636
2020-05-07T17:34:07.165210ionos.janbro.de sshd[8934]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.109.35.133
2020-
...

May  7 21:02:42 hosting sshd[30698]: Invalid user xpm from 140.143.140.242 port 43654
...

DATE:2020-05-07 19:20:34, IP:85.10.21.212, PORT:telnet Telnet brute force auth on honeypot server (epe-honey1-hq)

May  7 21:34:39 debian-2gb-nbg1-2 kernel: \[11138963.375040\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=77.247.108.119 DST=195.201.40.59 LEN=40 TOS=0x08 PREC=0x20 TTL=242 ID=45564 PROTO=TCP SPT=58302 DPT=5038 WINDOW=1024 RES=0x00 SYN URGP=0

Lines containing failures of 123.21.217.79
May  7 13:11:54 neweola sshd[31844]: Invalid user admin from 123.21.217.79 port 53772
May  7 13:11:54 neweola sshd[31844]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.21.217.79 
May  7 13:11:56 neweola sshd[31844]: Failed password for invalid user admin from 123.21.217.79 port 53772 ssh2
May  7 13:11:57 neweola sshd[31844]: Connection closed by invalid user admin 123.21.217.79 port 53772 [preauth]
May  7 13:15:46 neweola sshd[31963]: Invalid user admin from 123.21.217.79 port 54142
May  7 13:15:46 neweola sshd[31963]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.21.217.79 


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=123.21.217.79