k+ssh-bruteforce

Jul  4 23:39:21 dev0-dcde-rnet sshd[25760]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.254.220.207
Jul  4 23:39:23 dev0-dcde-rnet sshd[25760]: Failed password for invalid user jlr from 43.254.220.207 port 31902 ssh2
Jul  4 23:41:28 dev0-dcde-rnet sshd[25819]: Failed password for root from 43.254.220.207 port 50197 ssh2

Jun 27 17:02:37 server sshd[27501]: Failed password for invalid user ubuntu from 43.254.220.207 port 33314 ssh2
Jun 27 17:19:51 server sshd[40492]: Failed password for root from 43.254.220.207 port 62773 ssh2
Jun 27 17:22:26 server sshd[42598]: Failed password for invalid user dxz from 43.254.220.207 port 14631 ssh2

frenzy

Jun 16 00:07:40 NPSTNNYC01T sshd[27633]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.254.220.207
Jun 16 00:07:42 NPSTNNYC01T sshd[27633]: Failed password for invalid user jump from 43.254.220.207 port 55439 ssh2
Jun 16 00:11:45 NPSTNNYC01T sshd[27957]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.254.220.207
...

2020-06-05T13:13:40.914350shield sshd\[27055\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.254.220.207  user=root
2020-06-05T13:13:42.855872shield sshd\[27055\]: Failed password for root from 43.254.220.207 port 25851 ssh2
2020-06-05T13:18:30.671035shield sshd\[27511\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.254.220.207  user=root
2020-06-05T13:18:33.093895shield sshd\[27511\]: Failed password for root from 43.254.220.207 port 58640 ssh2
2020-06-05T13:23:16.548885shield sshd\[28003\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.254.220.207  user=root

May 25 16:23:17 [host] sshd[4660]: Invalid user rp
May 25 16:23:17 [host] sshd[4660]: pam_unix(sshd:a
May 25 16:23:19 [host] sshd[4660]: Failed password

May  5 13:08:18 eventyay sshd[7216]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.254.220.207
May  5 13:08:20 eventyay sshd[7216]: Failed password for invalid user react from 43.254.220.207 port 38068 ssh2
May  5 13:14:12 eventyay sshd[7435]: Failed password for root from 43.254.220.207 port 11008 ssh2
...

2020-05-01T18:08:47.795442dmca.cloudsearch.cf sshd[6609]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.254.220.207  user=root
2020-05-01T18:08:50.070032dmca.cloudsearch.cf sshd[6609]: Failed password for root from 43.254.220.207 port 15425 ssh2
2020-05-01T18:12:27.754594dmca.cloudsearch.cf sshd[6883]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.254.220.207  user=root
2020-05-01T18:12:30.229704dmca.cloudsearch.cf sshd[6883]: Failed password for root from 43.254.220.207 port 40849 ssh2
2020-05-01T18:16:05.360699dmca.cloudsearch.cf sshd[7149]: Invalid user jc from 43.254.220.207 port 1684
2020-05-01T18:16:05.365983dmca.cloudsearch.cf sshd[7149]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.254.220.207
2020-05-01T18:16:05.360699dmca.cloudsearch.cf sshd[7149]: Invalid user jc from 43.254.220.207 port 1684
2020-05-01T18:16:07.770880dmca.cloudsearch.cf ssh
...

Apr 28 08:47:02 hosting sshd[3561]: Invalid user liu from 43.254.220.207 port 19913
...

Apr 21 02:52:15 amida sshd[336354]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.254.220.207  user=r.r
Apr 21 02:52:17 amida sshd[336354]: Failed password for r.r from 43.254.220.207 port 4798 ssh2
Apr 21 02:52:17 amida sshd[336354]: Received disconnect from 43.254.220.207: 11: Bye Bye [preauth]
Apr 21 03:05:51 amida sshd[339850]: Invalid user re from 43.254.220.207
Apr 21 03:05:51 amida sshd[339850]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.254.220.207 
Apr 21 03:05:53 amida sshd[339850]: Failed password for invalid user re from 43.254.220.207 port 37184 ssh2
Apr 21 03:05:53 amida sshd[339850]: Received disconnect from 43.254.220.207: 11: Bye Bye [preauth]
Apr 21 03:11:55 amida sshd[341571]: Invalid user guest from 43.254.220.207
Apr 21 03:11:55 amida sshd[341571]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.254.220.207 
Apr 21 ........
-------------------------------

2020-04-21 UTC: (10x) - ft,git,root(5x),test(3x)

Unauthorised access (Sep  3) SRC=43.254.220.13 LEN=40 TOS=0x10 PREC=0x40 TTL=239 ID=24407 TCP DPT=445 WINDOW=1024 SYN

Aug 27 18:42:09 localhost kernel: [683545.507132] iptables_INPUT_denied: IN=eth0 OUT= MAC=f2:3c:91:84:83:95:84:78:ac:57:a8:41:08:00 SRC=43.254.220.13 DST=[mungedIP2] LEN=40 TOS=0x08 PREC=0x20 TTL=234 ID=19997 PROTO=TCP SPT=47068 DPT=445 WINDOW=1024 RES=0x00 SYN URGP=0 
Aug 27 18:42:09 localhost kernel: [683545.507139] iptables_INPUT_denied: IN=eth0 OUT= MAC=f2:3c:91:84:83:95:84:78:ac:57:a8:41:08:00 SRC=43.254.220.13 DST=[mungedIP2] LEN=40 TOS=0x08 PREC=0x20 TTL=234 ID=19997 PROTO=TCP SPT=47068 DPT=445 SEQ=2866032606 ACK=0 WINDOW=1024 RES=0x00 SYN URGP=0 
Aug 29 05:19:53 localhost kernel: [808209.217996] iptables_INPUT_denied: IN=eth0 OUT= MAC=f2:3c:91:84:83:95:84:78:ac:57:aa:c1:08:00 SRC=43.254.220.13 DST=[mungedIP2] LEN=40 TOS=0x08 PREC=0x20 TTL=234 ID=61913 PROTO=TCP SPT=47678 DPT=445 WINDOW=1024 RES=0x00 SYN URGP=0 
Aug 29 05:19:53 localhost kernel: [808209.218019] iptables_INPUT_denied: IN=eth0 OUT= MAC=f2:3c:91:84:83:95:84:78:ac:57:aa:c1:08:00 SRC=43.254.220.13 DST=[mungedIP2] LEN=40 TOS=0x08 PREC=0x20 T

2019-11-03T10:26:40.855394shield sshd\[28682\]: Invalid user gaowen from 164.132.107.245 port 58618
2019-11-03T10:26:40.859624shield sshd\[28682\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=245.ip-164-132-107.eu
2019-11-03T10:26:43.300856shield sshd\[28682\]: Failed password for invalid user gaowen from 164.132.107.245 port 58618 ssh2
2019-11-03T10:30:22.593956shield sshd\[29550\]: Invalid user zoom from 164.132.107.245 port 40216
2019-11-03T10:30:22.598623shield sshd\[29550\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=245.ip-164-132-107.eu

3389BruteforceFW23

Nov  3 01:40:51 eddieflores sshd\[2688\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=108.ip-51-38-51.eu  user=root
Nov  3 01:40:53 eddieflores sshd\[2688\]: Failed password for root from 51.38.51.108 port 40468 ssh2
Nov  3 01:45:01 eddieflores sshd\[3030\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=108.ip-51-38-51.eu  user=root
Nov  3 01:45:03 eddieflores sshd\[3030\]: Failed password for root from 51.38.51.108 port 50526 ssh2
Nov  3 01:49:04 eddieflores sshd\[3354\]: Invalid user betteti from 51.38.51.108
Nov  3 01:49:04 eddieflores sshd\[3354\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=108.ip-51-38-51.eu

SSH invalid-user multiple login try

(From francoedward98@gmail.com) Hi!

Did you know that the first page of Goggle search results is where all potential clients will be looking at if they're searching for products/services? Does your website appear on the first page of Google search results when you try searching for your products/services? Most of the time, they would just ignore page 2 and so on since the results listed on the first page seem more relevant and are more credible.

I'm very familiar with all the algorithms and methods that search engines use and I am an expert on how to get the most out of it. I'm a freelance online marketing specialist, and I have helped my clients bring their websites to the first page of web searches for more than 10 years now. Also, the cost of my services is something that small businesses can afford.

I can give you a free consultation so you can be better informed of how your website is doing right now, what can be done and what to expect after if this is something that interests you. Kindly write

Invalid user main from 42.104.97.228 port 2861

IP Ban Report :  
 https://help-dysk.pl/wordpress-firewall-plugins/ip/181.1.137.52/ 
 
 US - 1H : (238)  
 Protection Against DDoS WordPress plugin :  
 "odzyskiwanie danych help-dysk" 
 IP Address Ranges by Country : US 
 NAME ASN : ASN7303 
 
 IP : 181.1.137.52 
 
 CIDR : 181.1.136.0/21 
 
 PREFIX COUNT : 1591 
 
 UNIQUE IP COUNT : 4138752 
 
 
 ATTACKS DETECTED ASN7303 :  
  1H - 1 
  3H - 3 
  6H - 3 
 12H - 4 
 24H - 6 
 
 DateTime : 2019-11-03 06:48:27 
 
 INFO : Port Scan TELNET Detected and Blocked by ADMIN  - data recovery

(sshd) Failed SSH login from 111.230.185.56 (CN/China/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Nov  3 06:12:57 server2 sshd[24281]: Invalid user yamamoto from 111.230.185.56 port 30342
Nov  3 06:13:00 server2 sshd[24281]: Failed password for invalid user yamamoto from 111.230.185.56 port 30342 ssh2
Nov  3 06:41:42 server2 sshd[25008]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.230.185.56  user=root
Nov  3 06:41:44 server2 sshd[25008]: Failed password for root from 111.230.185.56 port 39914 ssh2
Nov  3 06:47:32 server2 sshd[25127]: Invalid user ru from 111.230.185.56 port 10755

Nov  3 10:15:36 mail sshd[31190]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.24.114.192  user=root
Nov  3 10:15:38 mail sshd[31190]: Failed password for root from 118.24.114.192 port 60162 ssh2
Nov  3 10:36:19 mail sshd[31330]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.24.114.192  user=root
Nov  3 10:36:21 mail sshd[31330]: Failed password for root from 118.24.114.192 port 46848 ssh2
...

Unauthorised access (Nov  3) SRC=62.138.22.143 LEN=40 TTL=244 ID=5534 TCP DPT=1433 WINDOW=1024 SYN

Nov  3 03:48:57 mockhub sshd[26758]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.90.248.107
Nov  3 03:48:59 mockhub sshd[26758]: Failed password for invalid user hyx123456 from 103.90.248.107 port 43354 ssh2
...

Nov  3 07:47:45 vps647732 sshd[26609]: Failed password for root from 198.50.197.217 port 59330 ssh2
...

Automatic report - Port Scan Attack

Nov  3 12:08:41 MK-Soft-VM4 sshd[17654]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.128.230.14 
Nov  3 12:08:42 MK-Soft-VM4 sshd[17654]: Failed password for invalid user vv from 190.128.230.14 port 37153 ssh2
...

Nov  3 07:56:30 firewall sshd[7847]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.15.33  user=root
Nov  3 07:56:32 firewall sshd[7847]: Failed password for root from 222.186.15.33 port 16310 ssh2
Nov  3 07:56:35 firewall sshd[7847]: Failed password for root from 222.186.15.33 port 16310 ssh2
...