Jun 12 05:46:34 inter-technics sshd[14245]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=89.163.132.37  user=root
Jun 12 05:46:36 inter-technics sshd[14245]: Failed password for root from 89.163.132.37 port 52268 ssh2
Jun 12 05:51:41 inter-technics sshd[14472]: Invalid user admin from 89.163.132.37 port 47561
Jun 12 05:51:41 inter-technics sshd[14472]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=89.163.132.37
Jun 12 05:51:41 inter-technics sshd[14472]: Invalid user admin from 89.163.132.37 port 47561
Jun 12 05:51:43 inter-technics sshd[14472]: Failed password for invalid user admin from 89.163.132.37 port 47561 ssh2
...

2020-06-09T23:07:36.374712ns386461 sshd\[11662\]: Invalid user admin from 89.163.132.37 port 36709
2020-06-09T23:07:36.379737ns386461 sshd\[11662\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=rs003578.fastrootserver.de
2020-06-09T23:07:38.285059ns386461 sshd\[11662\]: Failed password for invalid user admin from 89.163.132.37 port 36709 ssh2
2020-06-09T23:17:43.106269ns386461 sshd\[20583\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=rs003578.fastrootserver.de  user=root
2020-06-09T23:17:44.674943ns386461 sshd\[20583\]: Failed password for root from 89.163.132.37 port 54284 ssh2
...

Unauthorised connection attempt detected at AUO FR1 NODE2. System is sshd. Protected by AUO Stack Web Application Firewall (WAF)

[ssh] SSH attack

May 28 22:16:00 pixelmemory sshd[130754]: Failed password for invalid user ubuntu from 89.163.132.37 port 58066 ssh2
May 28 22:17:07 pixelmemory sshd[132936]: Invalid user football from 89.163.132.37 port 39785
May 28 22:17:07 pixelmemory sshd[132936]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=89.163.132.37 
May 28 22:17:07 pixelmemory sshd[132936]: Invalid user football from 89.163.132.37 port 39785
May 28 22:17:09 pixelmemory sshd[132936]: Failed password for invalid user football from 89.163.132.37 port 39785 ssh2
...

May 23 22:31:22 pkdns2 sshd\[15775\]: Invalid user luj from 89.163.132.37May 23 22:31:24 pkdns2 sshd\[15775\]: Failed password for invalid user luj from 89.163.132.37 port 46463 ssh2May 23 22:34:28 pkdns2 sshd\[15887\]: Invalid user ncx from 89.163.132.37May 23 22:34:31 pkdns2 sshd\[15887\]: Failed password for invalid user ncx from 89.163.132.37 port 48887 ssh2May 23 22:37:21 pkdns2 sshd\[16077\]: Invalid user cfa from 89.163.132.37May 23 22:37:23 pkdns2 sshd\[16077\]: Failed password for invalid user cfa from 89.163.132.37 port 51345 ssh2
...

May 23 10:07:31 ns382633 sshd\[24529\]: Invalid user zuu from 89.163.132.37 port 54739
May 23 10:07:31 ns382633 sshd\[24529\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=89.163.132.37
May 23 10:07:33 ns382633 sshd\[24529\]: Failed password for invalid user zuu from 89.163.132.37 port 54739 ssh2
May 23 10:23:23 ns382633 sshd\[27297\]: Invalid user fxi from 89.163.132.37 port 59355
May 23 10:23:23 ns382633 sshd\[27297\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=89.163.132.37

2020-05-12T11:40:01.259472shield sshd\[9494\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=rs003578.fastrootserver.de  user=root
2020-05-12T11:40:02.987889shield sshd\[9494\]: Failed password for root from 89.163.132.37 port 58396 ssh2
2020-05-12T11:45:38.330472shield sshd\[11203\]: Invalid user ashish from 89.163.132.37 port 33725
2020-05-12T11:45:38.334339shield sshd\[11203\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=rs003578.fastrootserver.de
2020-05-12T11:45:40.663290shield sshd\[11203\]: Failed password for invalid user ashish from 89.163.132.37 port 33725 ssh2

(sshd) Failed SSH login from 89.163.132.37 (DE/Germany/rs003578.fastrootserver.de): 2 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: May  9 22:28:43 ubnt-55d23 sshd[3795]: Invalid user jenkins from 89.163.132.37 port 50495
May  9 22:28:45 ubnt-55d23 sshd[3795]: Failed password for invalid user jenkins from 89.163.132.37 port 50495 ssh2

2020-05-09T20:00:04.552689vivaldi2.tree2.info sshd[3213]: Invalid user bouncer from 89.163.132.37
2020-05-09T20:00:04.570534vivaldi2.tree2.info sshd[3213]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=rs003578.fastrootserver.de
2020-05-09T20:00:04.552689vivaldi2.tree2.info sshd[3213]: Invalid user bouncer from 89.163.132.37
2020-05-09T20:00:09.819046vivaldi2.tree2.info sshd[3213]: Failed password for invalid user bouncer from 89.163.132.37 port 44313 ssh2
2020-05-09T20:03:34.517337vivaldi2.tree2.info sshd[3409]: Invalid user ts3server from 89.163.132.37
...

5x Failed Password

Invalid user echo from 89.163.132.37 port 52727

Apr 26 15:40:35 vps sshd[262477]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=rs003578.fastrootserver.de  user=root
Apr 26 15:40:38 vps sshd[262477]: Failed password for root from 89.163.132.37 port 38564 ssh2
Apr 26 15:44:45 vps sshd[279893]: Invalid user admin from 89.163.132.37 port 44499
Apr 26 15:44:45 vps sshd[279893]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=rs003578.fastrootserver.de
Apr 26 15:44:47 vps sshd[279893]: Failed password for invalid user admin from 89.163.132.37 port 44499 ssh2
...

Apr  7 23:31:32 roki sshd[4233]: Invalid user user from 89.163.132.37
Apr  7 23:31:32 roki sshd[4233]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=89.163.132.37
Apr  7 23:31:34 roki sshd[4233]: Failed password for invalid user user from 89.163.132.37 port 40430 ssh2
Apr  7 23:45:51 roki sshd[5322]: Invalid user user from 89.163.132.37
Apr  7 23:45:51 roki sshd[5322]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=89.163.132.37
...

5x Failed Password

SSH Brute Force

DATE:2020-02-25 23:43:01, IP:89.163.132.37, PORT:ssh SSH brute force auth (docker-dc)

Invalid user root

Invalid user uis from 89.163.132.37 port 40924

Invalid user uis from 89.163.132.37 port 40924

Unauthorized connection attempt detected from IP address 89.163.132.37 to port 2220 [J]

Feb  1 02:34:36 gw1 sshd[27948]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=89.163.132.37
Feb  1 02:34:38 gw1 sshd[27948]: Failed password for invalid user minecraft from 89.163.132.37 port 53572 ssh2
...

email spam

www.rbtierfotografie.de 89.163.132.92 \[30/Sep/2019:14:54:48 +0200\] "POST /wp-login.php HTTP/1.1" 200 5867 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"
www.rbtierfotografie.de 89.163.132.92 \[30/Sep/2019:14:54:49 +0200\] "POST /wp-login.php HTTP/1.1" 200 5815 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"

WordPress brute force

Jun  2 14:35:50 webhost01 sshd[12493]: Failed password for root from 183.82.2.22 port 59430 ssh2
...

Jun  2 05:36:33 Ubuntu-1404-trusty-64-minimal sshd\[26695\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=124.160.96.249  user=root
Jun  2 05:36:35 Ubuntu-1404-trusty-64-minimal sshd\[26695\]: Failed password for root from 124.160.96.249 port 59051 ssh2
Jun  2 05:48:01 Ubuntu-1404-trusty-64-minimal sshd\[32315\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=124.160.96.249  user=root
Jun  2 05:48:04 Ubuntu-1404-trusty-64-minimal sshd\[32315\]: Failed password for root from 124.160.96.249 port 53316 ssh2
Jun  2 05:50:57 Ubuntu-1404-trusty-64-minimal sshd\[1632\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=124.160.96.249  user=root

Jun  2 06:58:42 abendstille sshd\[18052\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.99.105.138  user=root
Jun  2 06:58:44 abendstille sshd\[18052\]: Failed password for root from 139.99.105.138 port 40736 ssh2
Jun  2 07:02:38 abendstille sshd\[21801\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.99.105.138  user=root
Jun  2 07:02:39 abendstille sshd\[21801\]: Failed password for root from 139.99.105.138 port 44066 ssh2
Jun  2 07:06:32 abendstille sshd\[25889\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.99.105.138  user=root
...

Unauthorized connection attempt from IP address 116.105.227.65 on Port 445(SMB)

spam

2020-06-02T09:25:29.251521struts4.enskede.local sshd\[2302\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.152.204.42  user=root
2020-06-02T09:25:32.244634struts4.enskede.local sshd\[2302\]: Failed password for root from 122.152.204.42 port 40298 ssh2
2020-06-02T09:30:07.811918struts4.enskede.local sshd\[2328\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.152.204.42  user=root
2020-06-02T09:30:10.549373struts4.enskede.local sshd\[2328\]: Failed password for root from 122.152.204.42 port 59672 ssh2
2020-06-02T09:34:43.412842struts4.enskede.local sshd\[2356\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.152.204.42  user=root
...

Jun  2 09:59:08 melroy-server sshd[27533]: Failed password for root from 222.186.175.148 port 31726 ssh2
Jun  2 09:59:13 melroy-server sshd[27533]: Failed password for root from 222.186.175.148 port 31726 ssh2
...

Unauthorized IMAP connection attempt

(sshd) Failed SSH login from 157.245.207.198 (SG/Singapore/mail.courier-integrator.com): 2 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Jun  2 05:50:49 ubnt-55d23 sshd[3170]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.207.198  user=root
Jun  2 05:50:51 ubnt-55d23 sshd[3170]: Failed password for root from 157.245.207.198 port 46476 ssh2

Jun  2 05:58:33 hcbbdb sshd\[14987\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.60.214.234  user=root
Jun  2 05:58:35 hcbbdb sshd\[14987\]: Failed password for root from 187.60.214.234 port 41128 ssh2
Jun  2 06:03:15 hcbbdb sshd\[15411\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.60.214.234  user=root
Jun  2 06:03:16 hcbbdb sshd\[15411\]: Failed password for root from 187.60.214.234 port 45820 ssh2
Jun  2 06:07:49 hcbbdb sshd\[15809\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.60.214.234  user=root

Jun  2 06:17:34 ajax sshd[30188]: Failed password for root from 59.36.83.249 port 50735 ssh2

 TCP (SYN) 195.54.166.128:52222 -> port 3389, len 44

Jun  1 19:19:58 tdfoods sshd\[8179\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=207.154.229.50  user=root
Jun  1 19:20:00 tdfoods sshd\[8179\]: Failed password for root from 207.154.229.50 port 52906 ssh2
Jun  1 19:23:27 tdfoods sshd\[8455\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=207.154.229.50  user=root
Jun  1 19:23:28 tdfoods sshd\[8455\]: Failed password for root from 207.154.229.50 port 56934 ssh2
Jun  1 19:26:54 tdfoods sshd\[8705\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=207.154.229.50  user=root

(imapd) Failed IMAP login from 78.140.7.9 (RU/Russia/n7-c9.client.tomica.ru): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Jun  2 11:22:58 ir1 dovecot[2885757]: imap-login: Disconnected (auth failed, 1 attempts in 6 secs): user=, method=PLAIN, rip=78.140.7.9, lip=5.63.12.44, session=

Jun  2 09:44:51 abendstille sshd\[13218\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.175.23  user=root
Jun  2 09:44:52 abendstille sshd\[13164\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.175.23  user=root
Jun  2 09:44:53 abendstille sshd\[13218\]: Failed password for root from 222.186.175.23 port 56603 ssh2
Jun  2 09:44:54 abendstille sshd\[13164\]: Failed password for root from 222.186.175.23 port 23025 ssh2
Jun  2 09:44:55 abendstille sshd\[13218\]: Failed password for root from 222.186.175.23 port 56603 ssh2
...