Unauthorised access (Dec  4) SRC=179.178.18.24 LEN=52 TOS=0x10 PREC=0x40 TTL=110 ID=22708 DF TCP DPT=445 WINDOW=8192 SYN

2019-12-04T20:21:02.121630  sshd[17669]: Invalid user backup from 118.25.129.144 port 57888
2019-12-04T20:21:02.135902  sshd[17669]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.25.129.144
2019-12-04T20:21:02.121630  sshd[17669]: Invalid user backup from 118.25.129.144 port 57888
2019-12-04T20:21:03.799888  sshd[17669]: Failed password for invalid user backup from 118.25.129.144 port 57888 ssh2
2019-12-04T20:27:56.930839  sshd[17787]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.25.129.144  user=sshd
2019-12-04T20:27:59.096656  sshd[17787]: Failed password for sshd from 118.25.129.144 port 39104 ssh2
...

2019-12-04T19:42:17.667701shield sshd\[2027\]: Invalid user furukawa from 203.128.242.166 port 36550
2019-12-04T19:42:17.672467shield sshd\[2027\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.128.242.166
2019-12-04T19:42:20.038234shield sshd\[2027\]: Failed password for invalid user furukawa from 203.128.242.166 port 36550 ssh2
2019-12-04T19:49:21.867853shield sshd\[4170\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.128.242.166  user=root
2019-12-04T19:49:23.441064shield sshd\[4170\]: Failed password for root from 203.128.242.166 port 41915 ssh2

Dec  4 12:13:52 mailserver dovecot: auth-worker(41141): sql([hidden],109.136.242.203,): unknown user
Dec  4 12:13:54 mailserver dovecot: imap-login: Aborted login (auth failed, 1 attempts in 2 secs): user=<[hidden]>, method=PLAIN, rip=109.136.242.203, lip=[hidden], TLS, session=
Dec  4 12:13:58 mailserver dovecot: auth-worker(41141): sql([hidden],109.136.242.203,): unknown user
Dec  4 12:14:00 mailserver dovecot: imap-login: Aborted login (auth failed, 1 attempts in 6 secs): user=<[hidden]>, method=PLAIN, rip=109.136.242.203, lip=[hidden], TLS, session=
Dec  4 12:14:04 mailserver dovecot: auth-worker(41141): sql([hidden],109.136.242.203,): unknown user
Dec  4 12:14:06 mailserver dovecot: imap-login: Aborted login (auth failed, 1 attempts in 6 secs): user=<[hidden]>, method=PLAIN, rip=109.136.242.203, lip=[hidden], TLS, session=
Dec  4 15:05:18 mailserver dovecot: auth-worker(43210): sql([hidden],109.136

Dec  4 09:42:35 auw2 sshd\[16457\]: Invalid user wwwadmin from 139.59.14.239
Dec  4 09:42:35 auw2 sshd\[16457\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.14.239
Dec  4 09:42:37 auw2 sshd\[16457\]: Failed password for invalid user wwwadmin from 139.59.14.239 port 33406 ssh2
Dec  4 09:49:52 auw2 sshd\[17159\]: Invalid user server from 139.59.14.239
Dec  4 09:49:52 auw2 sshd\[17159\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.14.239

Dec  4 14:43:58 TORMINT sshd\[24302\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=67.205.135.65  user=root
Dec  4 14:44:00 TORMINT sshd\[24302\]: Failed password for root from 67.205.135.65 port 54008 ssh2
Dec  4 14:51:05 TORMINT sshd\[24879\]: Invalid user lamrini from 67.205.135.65
Dec  4 14:51:05 TORMINT sshd\[24879\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=67.205.135.65
...

Repeated brute force against a port

Exploit Attempt

Dec  4 20:19:04 ns37 sshd[32115]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.239.50
Dec  4 20:19:06 ns37 sshd[32115]: Failed password for invalid user alysa from 51.38.239.50 port 34342 ssh2
Dec  4 20:28:06 ns37 sshd[32599]: Failed password for root from 51.38.239.50 port 44360 ssh2

Dec  4 08:06:42 kapalua sshd\[4317\]: Invalid user coe from 34.95.205.251
Dec  4 08:06:42 kapalua sshd\[4317\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=251.205.95.34.bc.googleusercontent.com
Dec  4 08:06:44 kapalua sshd\[4317\]: Failed password for invalid user coe from 34.95.205.251 port 44544 ssh2
Dec  4 08:13:31 kapalua sshd\[5081\]: Invalid user crichard from 34.95.205.251
Dec  4 08:13:31 kapalua sshd\[5081\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=251.205.95.34.bc.googleusercontent.com

Lines containing failures of 122.51.140.164
Dec  3 09:37:19 myhost sshd[19470]: Invalid user cussey from 122.51.140.164 port 55846
Dec  3 09:37:19 myhost sshd[19470]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.140.164
Dec  3 09:37:21 myhost sshd[19470]: Failed password for invalid user cussey from 122.51.140.164 port 55846 ssh2
Dec  3 09:37:21 myhost sshd[19470]: Received disconnect from 122.51.140.164 port 55846:11: Bye Bye [preauth]
Dec  3 09:37:21 myhost sshd[19470]: Disconnected from invalid user cussey 122.51.140.164 port 55846 [preauth]
Dec  3 09:51:23 myhost sshd[19544]: User r.r from 122.51.140.164 not allowed because not listed in AllowUsers
Dec  3 09:51:23 myhost sshd[19544]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.140.164  user=r.r
Dec  3 09:51:25 myhost sshd[19544]: Failed password for invalid user r.r from 122.51.140.164 port 46762 ssh2
Dec  3 09:51:25 ........
------------------------------

Received: from localhost (5.9.36.180) by ExchangeServer.*.* (10.0.7.78) with Microsoft SMTP Server id 14.3.468.0; Wed, 4 Dec 2019 
11:01:** +0100
Received: by localhost (Postfix, from userid 0)            id B2E2EA*****; Wed,  4 Dec 2019 04:00:** -0500 (EST)
To: <*@*.de>
Subject: Der Einweisungsprozess ist obligatorisch #DE1D22H11788Z*..*
From: DeutscheBank  
MIME-Version: 1.0
Content-Type: text/html; charset="UTF-8"
Date: Wed, 4 Dec 2019 04:00:* -0500
Return-Path: root@localhost

Dec  4 20:22:01 vps691689 sshd[31053]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=150.109.6.70
Dec  4 20:22:03 vps691689 sshd[31053]: Failed password for invalid user myren from 150.109.6.70 port 45358 ssh2
Dec  4 20:28:19 vps691689 sshd[31190]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=150.109.6.70
...

Dec  4 14:46:33 TORMINT sshd\[24540\]: Invalid user tubasa from 58.87.124.196
Dec  4 14:46:33 TORMINT sshd\[24540\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.87.124.196
Dec  4 14:46:35 TORMINT sshd\[24540\]: Failed password for invalid user tubasa from 58.87.124.196 port 52696 ssh2
...

Dec  4 20:22:58 MK-Soft-VM5 sshd[2816]: Failed password for root from 80.211.133.238 port 54098 ssh2
...