Dec 26 07:21:48 dev0-dcde-rnet sshd[4186]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.39.99.236
Dec 26 07:21:49 dev0-dcde-rnet sshd[4186]: Failed password for invalid user harpy from 54.39.99.236 port 45138 ssh2
Dec 26 07:28:50 dev0-dcde-rnet sshd[4234]: Failed password for root from 54.39.99.236 port 42466 ssh2

Dec 24 15:23:54 server sshd\[10146\]: Invalid user user from 54.39.99.236
Dec 24 15:23:54 server sshd\[10146\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=236.ip-54-39-99.net 
Dec 24 15:23:56 server sshd\[10146\]: Failed password for invalid user user from 54.39.99.236 port 38590 ssh2
Dec 25 00:36:50 server sshd\[27823\]: Invalid user admin from 54.39.99.236
Dec 25 00:36:50 server sshd\[27823\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=236.ip-54-39-99.net 
...

Dec  8 13:10:00 tdfoods sshd\[30589\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=236.ip-54-39-99.net  user=www-data
Dec  8 13:10:02 tdfoods sshd\[30589\]: Failed password for www-data from 54.39.99.236 port 35504 ssh2
Dec  8 13:15:13 tdfoods sshd\[31187\]: Invalid user fenton from 54.39.99.236
Dec  8 13:15:13 tdfoods sshd\[31187\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=236.ip-54-39-99.net
Dec  8 13:15:15 tdfoods sshd\[31187\]: Failed password for invalid user fenton from 54.39.99.236 port 44798 ssh2

Dec  5 01:02:19 giraffe sshd[10099]: Invalid user thuthuy from 54.39.99.236
Dec  5 01:02:19 giraffe sshd[10099]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.39.99.236
Dec  5 01:02:22 giraffe sshd[10099]: Failed password for invalid user thuthuy from 54.39.99.236 port 37938 ssh2
Dec  5 01:02:22 giraffe sshd[10099]: Received disconnect from 54.39.99.236 port 37938:11: Bye Bye [preauth]
Dec  5 01:02:22 giraffe sshd[10099]: Disconnected from 54.39.99.236 port 37938 [preauth]
Dec  5 01:10:49 giraffe sshd[10383]: Invalid user reboot from 54.39.99.236
Dec  5 01:10:49 giraffe sshd[10383]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.39.99.236
Dec  5 01:10:52 giraffe sshd[10383]: Failed password for invalid user reboot from 54.39.99.236 port 38428 ssh2
Dec  5 01:10:52 giraffe sshd[10383]: Received disconnect from 54.39.99.236 port 38428:11: Bye Bye [preauth]
Dec  5 01:10:52 giraffe sshd[........
-------------------------------

<6 unauthorized SSH connections

Dec  5 01:02:19 giraffe sshd[10099]: Invalid user thuthuy from 54.39.99.236
Dec  5 01:02:19 giraffe sshd[10099]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.39.99.236
Dec  5 01:02:22 giraffe sshd[10099]: Failed password for invalid user thuthuy from 54.39.99.236 port 37938 ssh2
Dec  5 01:02:22 giraffe sshd[10099]: Received disconnect from 54.39.99.236 port 37938:11: Bye Bye [preauth]
Dec  5 01:02:22 giraffe sshd[10099]: Disconnected from 54.39.99.236 port 37938 [preauth]
Dec  5 01:10:49 giraffe sshd[10383]: Invalid user reboot from 54.39.99.236
Dec  5 01:10:49 giraffe sshd[10383]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.39.99.236
Dec  5 01:10:52 giraffe sshd[10383]: Failed password for invalid user reboot from 54.39.99.236 port 38428 ssh2
Dec  5 01:10:52 giraffe sshd[10383]: Received disconnect from 54.39.99.236 port 38428:11: Bye Bye [preauth]
Dec  5 01:10:52 giraffe sshd[........
-------------------------------

Dec  5 03:03:34 wbs sshd\[17872\]: Invalid user cmsftp from 54.39.99.236
Dec  5 03:03:34 wbs sshd\[17872\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=236.ip-54-39-99.net
Dec  5 03:03:35 wbs sshd\[17872\]: Failed password for invalid user cmsftp from 54.39.99.236 port 40386 ssh2
Dec  5 03:10:04 wbs sshd\[18630\]: Invalid user pn from 54.39.99.236
Dec  5 03:10:04 wbs sshd\[18630\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=236.ip-54-39-99.net

54.39.99.123 - - [14/Nov/2019:07:20:49 +0100] "GET /wp-admin/install.php HTTP/1.1" 301 255 "-" "Mozilla/5.0 (Linux; Android 5.1.1; SM-J111F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.90 Mobile Safari/537.36"
54.39.99.123 - - [14/Nov/2019:07:20:49 +0100] "GET /wp-admin/install.php HTTP/1.1" 404 4264 "-" "Mozilla/5.0 (Linux; Android 5.1.1; SM-J111F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.90 Mobile Safari/537.36"

Sep 25 16:04:15 mail sshd\[7916\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.39.99.184
Sep 25 16:04:17 mail sshd\[7916\]: Failed password for invalid user ubnt from 54.39.99.184 port 17584 ssh2
Sep 25 16:07:52 mail sshd\[8368\]: Invalid user rk from 54.39.99.184 port 57328
Sep 25 16:07:52 mail sshd\[8368\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.39.99.184
Sep 25 16:07:54 mail sshd\[8368\]: Failed password for invalid user rk from 54.39.99.184 port 57328 ssh2

Sep 23 02:52:57 eddieflores sshd\[5140\]: Invalid user pi from 54.39.99.184
Sep 23 02:52:57 eddieflores sshd\[5140\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=apps.gendapro.com
Sep 23 02:52:59 eddieflores sshd\[5140\]: Failed password for invalid user pi from 54.39.99.184 port 46542 ssh2
Sep 23 02:56:39 eddieflores sshd\[5435\]: Invalid user strom from 54.39.99.184
Sep 23 02:56:39 eddieflores sshd\[5435\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=apps.gendapro.com

2019-09-22T00:47:02.3073211495-001 sshd\[53234\]: Failed password for invalid user insanos from 54.39.99.184 port 9606 ssh2
2019-09-22T00:58:37.4506111495-001 sshd\[54251\]: Invalid user template from 54.39.99.184 port 7086
2019-09-22T00:58:37.4537051495-001 sshd\[54251\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=apps.gendapro.com
2019-09-22T00:58:39.3864281495-001 sshd\[54251\]: Failed password for invalid user template from 54.39.99.184 port 7086 ssh2
2019-09-22T01:02:36.4727211495-001 sshd\[54617\]: Invalid user backend from 54.39.99.184 port 48592
2019-09-22T01:02:36.4763361495-001 sshd\[54617\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=apps.gendapro.com
...

Sep 20 08:24:09 SilenceServices sshd[19733]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.39.99.184
Sep 20 08:24:10 SilenceServices sshd[19733]: Failed password for invalid user 123456 from 54.39.99.184 port 13350 ssh2
Sep 20 08:28:12 SilenceServices sshd[21289]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.39.99.184

Sep 19 16:41:25 master sshd[14550]: Failed password for invalid user adcox from 54.39.99.184 port 16706 ssh2
Sep 19 16:57:14 master sshd[14567]: Failed password for invalid user pokemon from 54.39.99.184 port 25744 ssh2
Sep 19 17:01:01 master sshd[14873]: Failed password for invalid user uniform from 54.39.99.184 port 3048 ssh2
Sep 19 17:04:44 master sshd[14877]: Failed password for invalid user co from 54.39.99.184 port 43890 ssh2
Sep 19 17:08:22 master sshd[14881]: Failed password for invalid user nc from 54.39.99.184 port 21200 ssh2
Sep 19 17:12:04 master sshd[14887]: Failed password for invalid user scorbett from 54.39.99.184 port 62044 ssh2
Sep 19 17:15:51 master sshd[14900]: Failed password for invalid user sbrown from 54.39.99.184 port 39352 ssh2
Sep 19 17:19:31 master sshd[14907]: Failed password for invalid user 123 from 54.39.99.184 port 16656 ssh2
Sep 19 17:23:13 master sshd[14909]: Failed password for invalid user admin from 54.39.99.184 port 57498 ssh2
Sep 19 17:26:58 master sshd[14911]: Failed p

Sep  2 19:38:08 mail sshd\[28502\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.39.99.184
Sep  2 19:38:09 mail sshd\[28502\]: Failed password for invalid user stefan from 54.39.99.184 port 29366 ssh2
Sep  2 19:41:57 mail sshd\[29174\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.39.99.184  user=root
Sep  2 19:41:59 mail sshd\[29174\]: Failed password for root from 54.39.99.184 port 11004 ssh2
Sep  2 19:46:01 mail sshd\[29811\]: Invalid user lucio from 54.39.99.184 port 56186

Aug 30 10:53:20 pkdns2 sshd\[52313\]: Invalid user ftptest from 54.39.99.184Aug 30 10:53:23 pkdns2 sshd\[52313\]: Failed password for invalid user ftptest from 54.39.99.184 port 55228 ssh2Aug 30 10:57:28 pkdns2 sshd\[52504\]: Invalid user ltsp from 54.39.99.184Aug 30 10:57:30 pkdns2 sshd\[52504\]: Failed password for invalid user ltsp from 54.39.99.184 port 37354 ssh2Aug 30 11:01:41 pkdns2 sshd\[52690\]: Invalid user jking from 54.39.99.184Aug 30 11:01:43 pkdns2 sshd\[52690\]: Failed password for invalid user jking from 54.39.99.184 port 19484 ssh2
...

Aug 25 05:32:07 rpi sshd[23650]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.39.99.184 
Aug 25 05:32:09 rpi sshd[23650]: Failed password for invalid user ernste from 54.39.99.184 port 21732 ssh2

Aug 23 01:08:22 server sshd\[26070\]: Invalid user ales from 54.39.99.184 port 6590
Aug 23 01:08:22 server sshd\[26070\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.39.99.184
Aug 23 01:08:24 server sshd\[26070\]: Failed password for invalid user ales from 54.39.99.184 port 6590 ssh2
Aug 23 01:12:13 server sshd\[23922\]: User root from 54.39.99.184 not allowed because listed in DenyUsers
Aug 23 01:12:13 server sshd\[23922\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.39.99.184  user=root

Aug 11 13:50:07 srv-4 sshd\[16253\]: Invalid user sjnystro from 54.39.99.184
Aug 11 13:50:07 srv-4 sshd\[16253\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.39.99.184
Aug 11 13:50:09 srv-4 sshd\[16253\]: Failed password for invalid user sjnystro from 54.39.99.184 port 61308 ssh2
...

Nov 20 13:01:26 ns41 sshd[9777]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=219.142.140.2

Nov 20 09:04:47 ns382633 sshd\[32333\]: Invalid user server from 186.10.64.2 port 54746
Nov 20 09:04:47 ns382633 sshd\[32333\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.10.64.2
Nov 20 09:04:49 ns382633 sshd\[32333\]: Failed password for invalid user server from 186.10.64.2 port 54746 ssh2
Nov 20 09:23:05 ns382633 sshd\[3671\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.10.64.2  user=root
Nov 20 09:23:07 ns382633 sshd\[3671\]: Failed password for root from 186.10.64.2 port 47634 ssh2

BAD

MultiHost/MultiPort Probe, Scan, Hack -

Nov 20 09:28:19 sauna sshd[112020]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.37.155.165
Nov 20 09:28:20 sauna sshd[112020]: Failed password for invalid user ofori from 54.37.155.165 port 43202 ssh2
...

scan z

LAMP,DEF GET /wordpress/123456.rar

Nov 20 06:56:44 game-panel sshd[17396]: Failed password for sshd from 140.143.198.170 port 51612 ssh2
Nov 20 07:02:06 game-panel sshd[17582]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=140.143.198.170
Nov 20 07:02:08 game-panel sshd[17582]: Failed password for invalid user kelly from 140.143.198.170 port 33630 ssh2

badbot

92.118.37.86 was recorded 118 times by 35 hosts attempting to connect to the following ports: 195,722,155,925,418,405,107,59,247,796,512,594,47,566,856,416,199,263,464,938,948,118,602,996,814,644,390,415,622,908,604,535,499,776,953,114,798,471,867,559,282,868,626,31,877,533,725,806,79,723,609,601,270,505,844,70,403,189,871,766,642,547,182,797,775,780,688,735,962,974,421,426,137,899,128,833,915,582,804,807,610,878,316,859,748,135,69,542,478,126,934,112,175,511,62,589,462,134,51,203,246,703,239,148,997,694,784,886. Incident counter (4h, 24h, all-time): 118, 735, 9943

SSH bruteforce

2019-11-20T08:57:07.644570abusebot-3.cloudsearch.cf sshd\[25901\]: Invalid user test from 62.234.101.62 port 50896

Brute force VPN server

Web App Attack

badbot