Apr  6 09:13:23 server sshd\[26978\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=213.195.120.166  user=root
Apr  6 09:13:26 server sshd\[26978\]: Failed password for root from 213.195.120.166 port 55234 ssh2
Apr  6 09:18:39 server sshd\[28610\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=213.195.120.166  user=root
Apr  6 09:18:42 server sshd\[28610\]: Failed password for root from 213.195.120.166 port 38090 ssh2
Apr  6 09:19:59 server sshd\[28827\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=213.195.120.166  user=root
...

06.04.2020 06:59:12 SSH access blocked by firewall

(sshd) Failed SSH login from 129.204.147.84 (CN/China/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Apr  6 09:40:38 srv sshd[3090]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.204.147.84  user=root
Apr  6 09:40:40 srv sshd[3090]: Failed password for root from 129.204.147.84 port 59380 ssh2
Apr  6 09:42:34 srv sshd[3108]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.204.147.84  user=root
Apr  6 09:42:37 srv sshd[3108]: Failed password for root from 129.204.147.84 port 47236 ssh2
Apr  6 09:43:57 srv sshd[3121]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.204.147.84  user=root

web-1 [ssh] SSH Attack

(imapd) Failed IMAP login from 94.72.20.206 (RU/Russia/mx.o2svet.ru): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Apr  6 08:24:35 ir1 dovecot[566034]: imap-login: Disconnected (auth failed, 1 attempts in 4 secs): user=, method=PLAIN, rip=94.72.20.206, lip=5.63.12.44, TLS, session=<021zOZei99VeSBTO>

Attempt to attack host OS, exploiting network vulnerabilities, on 06-04-2020 04:55:09.

2020-04-06T03:45:39.789743shield sshd\[16009\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.144.77.24  user=root
2020-04-06T03:45:42.094334shield sshd\[16009\]: Failed password for root from 103.144.77.24 port 54326 ssh2
2020-04-06T03:50:24.924660shield sshd\[16975\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.144.77.24  user=root
2020-04-06T03:50:26.687502shield sshd\[16975\]: Failed password for root from 103.144.77.24 port 37864 ssh2
2020-04-06T03:55:16.165871shield sshd\[17942\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.144.77.24  user=root

Total attacks: 7

Brute forcing RDP port 3389

2020-04-06T07:34:40.498535vps751288.ovh.net sshd\[16090\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.85.42.195  user=root
2020-04-06T07:34:42.436150vps751288.ovh.net sshd\[16090\]: Failed password for root from 112.85.42.195 port 31853 ssh2
2020-04-06T07:34:44.723638vps751288.ovh.net sshd\[16090\]: Failed password for root from 112.85.42.195 port 31853 ssh2
2020-04-06T07:34:46.792125vps751288.ovh.net sshd\[16090\]: Failed password for root from 112.85.42.195 port 31853 ssh2
2020-04-06T07:35:55.415876vps751288.ovh.net sshd\[16104\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.85.42.195  user=root

Automatic report BANNED IP

(sshd) Failed SSH login from 176.31.116.214 (FR/France/kingdoms.easycreadoc.com): 5 in the last 3600 secs

Apr  6 02:58:02 Tower sshd[7229]: Connection from 115.159.149.136 port 59342 on 192.168.10.220 port 22 rdomain ""
Apr  6 02:58:14 Tower sshd[7229]: Failed password for root from 115.159.149.136 port 59342 ssh2
Apr  6 02:58:17 Tower sshd[7229]: Received disconnect from 115.159.149.136 port 59342:11: Bye Bye [preauth]
Apr  6 02:58:17 Tower sshd[7229]: Disconnected from authenticating user root 115.159.149.136 port 59342 [preauth]

Apr  6 06:25:12 eventyay sshd[30852]: Failed password for root from 185.98.114.69 port 39288 ssh2
Apr  6 06:29:02 eventyay sshd[31102]: Failed password for root from 185.98.114.69 port 40382 ssh2
...

1586145277 - 04/06/2020 05:54:37 Host: 14.176.231.151/14.176.231.151 Port: 445 TCP Blocked