Oct  6 23:41:32 abendstille sshd\[29353\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.75.247.206  user=root
Oct  6 23:41:34 abendstille sshd\[29353\]: Failed password for root from 106.75.247.206 port 44252 ssh2
Oct  6 23:48:12 abendstille sshd\[3238\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.75.247.206  user=root
Oct  6 23:48:14 abendstille sshd\[3238\]: Failed password for root from 106.75.247.206 port 59556 ssh2
Oct  6 23:51:23 abendstille sshd\[6044\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.75.247.206  user=root
...

SSH Brute Force

SSH Brute Force

Oct  5 22:36:23 abendstille sshd\[25718\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.75.247.206  user=root
Oct  5 22:36:25 abendstille sshd\[25718\]: Failed password for root from 106.75.247.206 port 53172 ssh2
Oct  5 22:38:32 abendstille sshd\[27724\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.75.247.206  user=root
Oct  5 22:38:34 abendstille sshd\[27724\]: Failed password for root from 106.75.247.206 port 59396 ssh2
Oct  5 22:40:44 abendstille sshd\[29731\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.75.247.206  user=root
...

2020-10-05T08:43:02+0000 Failed SSH Authentication/Brute Force Attack. (Server 6)

fail2ban

Oct  3 08:50:39 php1 sshd\[30929\]: Invalid user user2 from 106.75.247.206
Oct  3 08:50:39 php1 sshd\[30929\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.75.247.206
Oct  3 08:50:42 php1 sshd\[30929\]: Failed password for invalid user user2 from 106.75.247.206 port 35762 ssh2
Oct  3 08:53:05 php1 sshd\[31085\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.75.247.206  user=root
Oct  3 08:53:07 php1 sshd\[31085\]: Failed password for root from 106.75.247.206 port 44178 ssh2

2020-10-03T12:39:12.910168mail.broermann.family sshd[11070]: Invalid user jessica from 106.75.247.206 port 58990
2020-10-03T12:39:12.917729mail.broermann.family sshd[11070]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.75.247.206
2020-10-03T12:39:12.910168mail.broermann.family sshd[11070]: Invalid user jessica from 106.75.247.206 port 58990
2020-10-03T12:39:14.683494mail.broermann.family sshd[11070]: Failed password for invalid user jessica from 106.75.247.206 port 58990 ssh2
2020-10-03T12:43:13.922551mail.broermann.family sshd[11483]: Invalid user admin from 106.75.247.206 port 57916
...

SSH Invalid Login

$f2bV_matches

$f2bV_matches

Sep 28 19:16:11 inter-technics sshd[3092]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.75.247.206  user=root
Sep 28 19:16:13 inter-technics sshd[3092]: Failed password for root from 106.75.247.206 port 48494 ssh2
Sep 28 19:20:07 inter-technics sshd[3339]: Invalid user admin from 106.75.247.206 port 46228
Sep 28 19:20:07 inter-technics sshd[3339]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.75.247.206
Sep 28 19:20:07 inter-technics sshd[3339]: Invalid user admin from 106.75.247.206 port 46228
Sep 28 19:20:08 inter-technics sshd[3339]: Failed password for invalid user admin from 106.75.247.206 port 46228 ssh2
...

Sep 28 06:12:59 nextcloud sshd\[2398\]: Invalid user template from 106.75.247.206
Sep 28 06:12:59 nextcloud sshd\[2398\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.75.247.206
Sep 28 06:13:01 nextcloud sshd\[2398\]: Failed password for invalid user template from 106.75.247.206 port 48630 ssh2

Jun 25 06:20:53 buvik sshd[14082]: Failed password for invalid user roger from 106.75.247.199 port 57962 ssh2
Jun 25 06:22:45 buvik sshd[14373]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.75.247.199  user=mysql
Jun 25 06:22:47 buvik sshd[14373]: Failed password for mysql from 106.75.247.199 port 49344 ssh2
...

Jun 17 21:43:52 h2779839 sshd[24981]: Invalid user santosh from 106.75.247.227 port 36504
Jun 17 21:43:52 h2779839 sshd[24981]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.75.247.227
Jun 17 21:43:52 h2779839 sshd[24981]: Invalid user santosh from 106.75.247.227 port 36504
Jun 17 21:43:54 h2779839 sshd[24981]: Failed password for invalid user santosh from 106.75.247.227 port 36504 ssh2
Jun 17 21:47:21 h2779839 sshd[25077]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.75.247.227  user=root
Jun 17 21:47:23 h2779839 sshd[25077]: Failed password for root from 106.75.247.227 port 46064 ssh2
Jun 17 21:50:48 h2779839 sshd[25158]: Invalid user etherpad-lite from 106.75.247.227 port 55628
Jun 17 21:50:48 h2779839 sshd[25158]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.75.247.227
Jun 17 21:50:48 h2779839 sshd[25158]: Invalid user etherpad-lite from 106.75
...

Dec 18 11:59:52 server sshd\[30385\]: Invalid user do. from 45.73.12.218
Dec 18 11:59:52 server sshd\[30385\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=modemcable218.12-73-45.static.videotron.ca 
Dec 18 11:59:54 server sshd\[30385\]: Failed password for invalid user do. from 45.73.12.218 port 32914 ssh2
Dec 18 12:08:25 server sshd\[441\]: Invalid user eric from 45.73.12.218
Dec 18 12:08:25 server sshd\[441\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=modemcable218.12-73-45.static.videotron.ca 
...

Dec 18 13:25:54 ns37 sshd[27936]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.23.198

...

2019-12-18T12:35:08.216441  sshd[3923]: Invalid user mongod from 129.211.11.107 port 58013
2019-12-18T12:35:08.230388  sshd[3923]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.211.11.107
2019-12-18T12:35:08.216441  sshd[3923]: Invalid user mongod from 129.211.11.107 port 58013
2019-12-18T12:35:09.975658  sshd[3923]: Failed password for invalid user mongod from 129.211.11.107 port 58013 ssh2
2019-12-18T12:44:58.535400  sshd[4082]: Invalid user baslem from 129.211.11.107 port 33450
...

1576650358 - 12/18/2019 07:25:58 Host: 121.52.146.105/121.52.146.105 Port: 445 TCP Blocked

Honeypot attack, port: 5555, PTR: PTR record not found

Invalid user perrine from 192.144.151.30 port 50642

Dec 18 01:25:40 Tower sshd[31330]: Connection from 51.68.189.69 port 55412 on 192.168.10.220 port 22
Dec 18 01:25:41 Tower sshd[31330]: Invalid user anjela from 51.68.189.69 port 55412
Dec 18 01:25:41 Tower sshd[31330]: error: Could not get shadow information for NOUSER
Dec 18 01:25:41 Tower sshd[31330]: Failed password for invalid user anjela from 51.68.189.69 port 55412 ssh2
Dec 18 01:25:41 Tower sshd[31330]: Received disconnect from 51.68.189.69 port 55412:11: Bye Bye [preauth]
Dec 18 01:25:41 Tower sshd[31330]: Disconnected from invalid user anjela 51.68.189.69 port 55412 [preauth]

Dec 18 09:30:12 lnxded64 sshd[1703]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.191.28.110

\[2019-12-18 06:50:13\] SECURITY\[2857\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-12-18T06:50:13.117-0500",Severity="Error",Service="SIP",EventVersion="1",AccountID="94011972592277524",SessionID="0x7f0fb4a5a908",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/163.172.207.104/55225",ACLName="no_extension_match"
\[2019-12-18 06:54:52\] SECURITY\[2857\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-12-18T06:54:52.105-0500",Severity="Error",Service="SIP",EventVersion="1",AccountID="95011972592277524",SessionID="0x7f0fb4a5a908",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/163.172.207.104/60659",ACLName="no_extension_match"
\[2019-12-18 06:59:29\] SECURITY\[2857\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-12-18T06:59:29.158-0500",Severity="Error",Service="SIP",EventVersion="1",AccountID="96011972592277524",SessionID="0x7f0fb4a5a908",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/163.172.207.104/54668",ACL

Dec 18 11:50:25 lnxweb61 sshd[6499]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.47.250.93

Unauthorized connection attempt detected from IP address 180.244.174.4 to port 445

2019-12-18T09:36:47.143280  sshd[32282]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=143.192.97.178  user=wwwrun
2019-12-18T09:36:49.159762  sshd[32282]: Failed password for wwwrun from 143.192.97.178 port 27822 ssh2
2019-12-18T09:43:38.768931  sshd[32420]: Invalid user system from 143.192.97.178 port 19996
2019-12-18T09:43:38.781820  sshd[32420]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=143.192.97.178
2019-12-18T09:43:38.768931  sshd[32420]: Invalid user system from 143.192.97.178 port 19996
2019-12-18T09:43:40.557993  sshd[32420]: Failed password for invalid user system from 143.192.97.178 port 19996 ssh2
...

\[2019-12-18 07:13:58\] NOTICE\[2839\] chan_sip.c: Registration from '"808" \' failed for '37.49.230.81:5294' - Wrong password
\[2019-12-18 07:13:58\] SECURITY\[2857\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-12-18T07:13:58.085-0500",Severity="Error",Service="SIP",EventVersion="2",AccountID="808",SessionID="0x7f0fb4287008",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.230.81/5294",Challenge="36e89487",ReceivedChallenge="36e89487",ReceivedHash="196886df6a842e039194c5c1a0c3832c"
\[2019-12-18 07:13:58\] NOTICE\[2839\] chan_sip.c: Registration from '"808" \' failed for '37.49.230.81:5294' - Wrong password
\[2019-12-18 07:13:58\] SECURITY\[2857\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-12-18T07:13:58.210-0500",Severity="Error",Service="SIP",EventVersion="2",AccountID="808",SessionID="0x7f0fb4123628",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.2

Dec 18 11:41:36 pi sshd\[29249\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=223.220.159.78
Dec 18 11:41:38 pi sshd\[29249\]: Failed password for invalid user wilming from 223.220.159.78 port 33564 ssh2
Dec 18 11:50:17 pi sshd\[29743\]: Invalid user gdm from 223.220.159.78 port 32909
Dec 18 11:50:17 pi sshd\[29743\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=223.220.159.78
Dec 18 11:50:19 pi sshd\[29743\]: Failed password for invalid user gdm from 223.220.159.78 port 32909 ssh2
...