Unauthorized SSH login attempts

 TCP (SYN) 185.132.53.85:45782 -> port 22, len 44

Jun  4 14:39:23 [host] sshd[24249]: pam_unix(sshd:
Jun  4 14:39:25 [host] sshd[24249]: Failed passwor
Jun  4 14:43:53 [host] sshd[24452]: pam_unix(sshd:

Jun  4 15:09:15 nextcloud sshd\[6238\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.125.71  user=root
Jun  4 15:09:17 nextcloud sshd\[6238\]: Failed password for root from 122.51.125.71 port 45402 ssh2
Jun  4 15:13:09 nextcloud sshd\[12763\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.125.71  user=root

(sshd) Failed SSH login from 103.242.200.38 (CN/China/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Jun  4 13:55:36 amsweb01 sshd[30781]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.242.200.38  user=root
Jun  4 13:55:38 amsweb01 sshd[30781]: Failed password for root from 103.242.200.38 port 25988 ssh2
Jun  4 14:02:14 amsweb01 sshd[32282]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.242.200.38  user=root
Jun  4 14:02:16 amsweb01 sshd[32282]: Failed password for root from 103.242.200.38 port 42100 ssh2
Jun  4 14:05:17 amsweb01 sshd[346]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.242.200.38  user=root

86.109.170.96 - - [04/Jun/2020:17:49:51 +0200] "GET /wp-login.php HTTP/1.1" 200 6106 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
86.109.170.96 - - [04/Jun/2020:17:49:53 +0200] "POST /wp-login.php HTTP/1.1" 200 6390 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
86.109.170.96 - - [04/Jun/2020:17:49:55 +0200] "POST /xmlrpc.php HTTP/1.1" 200 427 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"

 TCP (SYN) 113.104.205.102:64170 -> port 23, len 44

06/04/2020-08:05:35.672591 131.196.169.137 Protocol: 6 ET SCAN Suspicious inbound to MSSQL port 1433

Jun  4 17:46:03 nas sshd[20081]: Failed password for root from 218.92.0.173 port 32357 ssh2
Jun  4 17:46:13 nas sshd[20081]: Failed password for root from 218.92.0.173 port 32357 ssh2
Jun  4 17:46:32 nas sshd[20089]: Failed password for root from 218.92.0.173 port 63973 ssh2
...

(From hacker@aletheiaricerchedimercato.com) PLEASE FORWARD THIS EMAIL TO SOMEONE IN YOUR COMPANY WHO IS ALLOWED TO MAKE IMPORTANT DECISIONS!

We have hacked your website http://www.chirowellctr.com and extracted your databases.

How did this happen?
Our team has found a vulnerability within your site that we were able to exploit. After finding the vulnerability we were able to get your database credentials and extract your entire database and move the information to an offshore server.

What does this mean?

We will systematically go through a series of steps of totally damaging your reputation. First your database will be leaked or sold to the highest bidder which they will use with whatever their intentions are. Next if there are e-mails found they will be e-mailed that their information has been sold or leaked and your site http://www.chirowellctr.com was at fault thusly damaging your reputation and having angry customers/associates with whatever angry customers/associates do. Lastly any links tha

SMB Server BruteForce Attack

165.22.35.21 - - \[04/Jun/2020:17:38:26 +0200\] "POST /wp-login.php HTTP/1.1" 200 9952 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"
165.22.35.21 - - \[04/Jun/2020:17:38:27 +0200\] "POST /wp-login.php HTTP/1.1" 200 9852 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"
...

Jun  4 16:12:51 game-panel sshd[26996]: Failed password for root from 35.220.187.55 port 38690 ssh2
Jun  4 16:13:41 game-panel sshd[27030]: Failed password for root from 35.220.187.55 port 48400 ssh2

" "

Jun  4 16:09:57 vps647732 sshd[14810]: Failed password for root from 128.199.95.163 port 52362 ssh2
...