May 24 00:58:52 firewall sshd[24040]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.105.195.243
May 24 00:58:51 firewall sshd[24040]: Invalid user admin from 116.105.195.243
May 24 00:58:54 firewall sshd[24040]: Failed password for invalid user admin from 116.105.195.243 port 59878 ssh2
...

Invalid user admin from 116.105.195.243 port 56122

99. On May 17 2020 experienced a Brute Force SSH login attempt -> 30 unique times by 116.105.195.243.

none

Invalid user admin from 116.105.195.243 port 62592

May 16 03:59:29 ajax sshd[725]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.105.195.243 
May 16 03:59:31 ajax sshd[725]: Failed password for invalid user tomcat from 116.105.195.243 port 51488 ssh2

May 15 21:38:05 rotator sshd\[31591\]: Invalid user squid from 116.105.195.243May 15 21:38:08 rotator sshd\[31591\]: Failed password for invalid user squid from 116.105.195.243 port 50796 ssh2May 15 21:38:16 rotator sshd\[31594\]: Invalid user cisco from 116.105.195.243May 15 21:38:20 rotator sshd\[31594\]: Failed password for invalid user cisco from 116.105.195.243 port 56652 ssh2May 15 21:38:47 rotator sshd\[31621\]: Invalid user 1234 from 116.105.195.243May 15 21:38:47 rotator sshd\[31619\]: Failed password for sshd from 116.105.195.243 port 6654 ssh2May 15 21:38:47 rotator sshd\[31617\]: Invalid user operator from 116.105.195.243
...

May 14 16:54:39 home sshd[15635]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.105.195.243
May 14 16:54:41 home sshd[15635]: Failed password for invalid user user from 116.105.195.243 port 11616 ssh2
May 14 16:54:43 home sshd[15640]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.105.195.243
...

2020-05-12T23:17:39.257521  sshd[25302]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.105.195.243  user=root
2020-05-12T23:17:40.586376  sshd[25302]: Failed password for root from 116.105.195.243 port 5666 ssh2
2020-05-12T23:18:43.221537  sshd[25342]: Invalid user guest from 116.105.195.243 port 48344
...

2020-05-12T09:55:22.291863shiva sshd[2039]: Invalid user user from 116.105.195.243 port 18634
2020-05-12T09:55:59.436866shiva sshd[2044]: Invalid user admin from 116.105.195.243 port 29242
2020-05-12T09:56:11.451001shiva sshd[2047]: Invalid user admin from 116.105.195.243 port 19886
2020-05-12T09:56:24.095418shiva sshd[2064]: Invalid user admin from 116.105.195.243 port 57620
...

May 11 16:00:45 pkdns2 sshd\[9542\]: Invalid user user from 116.105.195.243May 11 16:00:48 pkdns2 sshd\[9542\]: Failed password for invalid user user from 116.105.195.243 port 21016 ssh2May 11 16:01:15 pkdns2 sshd\[9593\]: Invalid user prueba from 116.105.195.243May 11 16:01:19 pkdns2 sshd\[9593\]: Failed password for invalid user prueba from 116.105.195.243 port 54894 ssh2May 11 16:01:22 pkdns2 sshd\[9598\]: Invalid user support from 116.105.195.243May 11 16:01:25 pkdns2 sshd\[9598\]: Failed password for invalid user support from 116.105.195.243 port 55048 ssh2May 11 16:01:27 pkdns2 sshd\[9601\]: Invalid user user from 116.105.195.243
...

May 10 21:25:29 bacztwo sshd[32460]: Invalid user user from 116.105.195.243 port 7380
May 10 21:25:32 bacztwo sshd[32460]: error: PAM: Authentication failure for illegal user user from 116.105.195.243
May 10 21:25:29 bacztwo sshd[32460]: Invalid user user from 116.105.195.243 port 7380
May 10 21:25:32 bacztwo sshd[32460]: error: PAM: Authentication failure for illegal user user from 116.105.195.243
May 10 21:25:29 bacztwo sshd[32460]: Invalid user user from 116.105.195.243 port 7380
May 10 21:25:32 bacztwo sshd[32460]: error: PAM: Authentication failure for illegal user user from 116.105.195.243
May 10 21:25:32 bacztwo sshd[32460]: Failed keyboard-interactive/pam for invalid user user from 116.105.195.243 port 7380 ssh2
May 10 21:25:29 bacztwo sshd[32460]: Invalid user user from 116.105.195.243 port 7380
May 10 21:25:32 bacztwo sshd[32460]: error: PAM: Authentication failure for illegal user user from 116.105.195.243
May 10 21:25:32 bacztwo sshd[32460]: Failed keyboard-interactive/pam 
...

SSH brute-force attempt

SSH brutforce

SSH Brute-Force reported by Fail2Ban

May  8 23:08:40 OPSO sshd\[3699\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.105.195.243  user=admin
May  8 23:08:42 OPSO sshd\[3699\]: Failed password for admin from 116.105.195.243 port 42076 ssh2
May  8 23:13:06 OPSO sshd\[4604\]: Invalid user 1234 from 116.105.195.243 port 57222
May  8 23:13:09 OPSO sshd\[4604\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.105.195.243
May  8 23:13:11 OPSO sshd\[4604\]: Failed password for invalid user 1234 from 116.105.195.243 port 57222 ssh2

IP blocked

Mar 13 01:19:11 karger sshd[29635]: Connection from 221.228.72.222 port 39777 on 188.68.60.164 port 22
Mar 13 01:19:12 karger sshd[29635]: Invalid user temp from 221.228.72.222 port 39777
Mar 13 01:24:15 karger sshd[30880]: Connection from 221.228.72.222 port 6008 on 188.68.60.164 port 22
Mar 13 01:24:16 karger sshd[30880]: Invalid user joseluis from 221.228.72.222 port 6008
Mar 13 01:31:33 karger sshd[32632]: Connection from 221.228.72.222 port 1972 on 188.68.60.164 port 22
Mar 13 01:31:35 karger sshd[32632]: Invalid user gpadmin from 221.228.72.222 port 1972
Mar 13 01:34:07 karger sshd[922]: Connection from 221.228.72.222 port 32094 on 188.68.60.164 port 22
Mar 13 01:34:08 karger sshd[922]: Invalid user nagios from 221.228.72.222 port 32094
Mar 13 01:36:56 karger sshd[1463]: Connection from 221.228.72.222 port 54024 on 188.68.60.164 port 22
Mar 13 01:36:57 karger sshd[1463]: Invalid user gpadmin from 221.228.72.222 port 54024
...

2020-03-13T01:35:38.925166  sshd[31806]: Invalid user operator from 92.63.194.7 port 37232
2020-03-13T01:35:38.934226  sshd[31806]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.63.194.7
2020-03-13T01:35:38.925166  sshd[31806]: Invalid user operator from 92.63.194.7 port 37232
2020-03-13T01:35:41.248887  sshd[31806]: Failed password for invalid user operator from 92.63.194.7 port 37232 ssh2
...

Mar 12 19:40:24 NPSTNNYC01T sshd[11987]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.191.84.38
Mar 12 19:40:26 NPSTNNYC01T sshd[11987]: Failed password for invalid user oracle from 94.191.84.38 port 55432 ssh2
Mar 12 19:45:20 NPSTNNYC01T sshd[12197]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.191.84.38
...

(sshd) Failed SSH login from 206.189.132.8 (IN/India/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Mar 12 21:59:00 amsweb01 sshd[5889]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.132.8  user=root
Mar 12 21:59:02 amsweb01 sshd[5889]: Failed password for root from 206.189.132.8 port 40090 ssh2
Mar 12 22:05:32 amsweb01 sshd[6462]: Invalid user test from 206.189.132.8 port 35744
Mar 12 22:05:33 amsweb01 sshd[6462]: Failed password for invalid user test from 206.189.132.8 port 35744 ssh2
Mar 12 22:07:08 amsweb01 sshd[6592]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.132.8  user=root

Return-Path: 
Received: from mail-a.webstudiosixtysix.com (HELO mail.orchardloop.com) (144.172.92.92)
  by .com with SMTP; 12 Mar 2020 21:18:28 -0000
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=dkim; d=orchardloop.com;
 h=Date:From:To:Subject:MIME-Version:Content-Type:List-Unsubscribe:Message-ID; i=provide-insurance@orchardloop.com;
 bh=3QRn2RNBZAInujHuZ8hqR0E95ig=;
 b=UV8bwqnmBxF+/dJtN20mKAtJtsRUYT8Ge/BTyJxvZI0pfPQ09bfqRNvr3zg0wE1zIxPQqQV0Tkqr
   gP56iFHdcuX6DcbHeQ4ZwN+COKFC84U/PH8jkiU0mhmo8crrmBI+qhwp7tKbIqO2k1w8mLfsNNeX
   8I1qR5faBLfCdiEoZnA=
DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=dkim; d=orchardloop.com;
 b=ChrCikL5eCCbJL1/LAe+xPmbnKlBG1xlFTMRpgjYqOLEFz8ELB42k2791u/xbww8DqG1Tzxy3TDU
   THbbiVQMqB+PAlBgvLKL8bYUMRZS6KHkfTaXaLti4KNh4ohCVMf0tyClSgweigreoNmOpuwGVhqL
   grNZQ9Pr14p4g159/ts=;
Received: by mail.orchardloop.com id hdaji80001ge for <>; Thu, 12 Mar 2020 16:52:14 -0400 (envelope-from )

(sshd) Failed SSH login from 87.138.254.133 (DE/Germany/p578afe85.dip0.t-ipconnect.de): 3 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Mar 12 20:53:50 andromeda sshd[10909]: Invalid user info from 87.138.254.133 port 36456
Mar 12 20:53:52 andromeda sshd[10909]: Failed password for invalid user info from 87.138.254.133 port 36456 ssh2
Mar 12 21:07:55 andromeda sshd[11393]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=87.138.254.133  user=root

1584047261 - 03/12/2020 22:07:41 Host: 78.109.71.193/78.109.71.193 Port: 445 TCP Blocked

Lines containing failures of 223.73.57.221
Mar 10 22:31:46 neweola sshd[9454]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=223.73.57.221  user=r.r
Mar 10 22:31:47 neweola sshd[9454]: Failed password for r.r from 223.73.57.221 port 33616 ssh2
Mar 10 22:31:48 neweola sshd[9454]: Received disconnect from 223.73.57.221 port 33616:11: Bye Bye [preauth]
Mar 10 22:31:48 neweola sshd[9454]: Disconnected from authenticating user r.r 223.73.57.221 port 33616 [preauth]
Mar 10 22:36:08 neweola sshd[9542]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=223.73.57.221  user=r.r
Mar 10 22:36:11 neweola sshd[9542]: Failed password for r.r from 223.73.57.221 port 33411 ssh2
Mar 10 22:36:13 neweola sshd[9542]: Received disconnect from 223.73.57.221 port 33411:11: Bye Bye [preauth]
Mar 10 22:36:13 neweola sshd[9542]: Disconnected from authenticating user r.r 223.73.57.221 port 33411 [preauth]
Mar 10 22:40:4........
------------------------------

Mar 13 06:11:11 areeb-Workstation sshd[21969]: Failed password for root from 112.85.42.186 port 35602 ssh2
Mar 13 06:11:14 areeb-Workstation sshd[21969]: Failed password for root from 112.85.42.186 port 35602 ssh2
...

B: Magento admin pass test (wrong country)

Port scan: Attack repeated for 24 hours

Scanning random ports - tries to find possible vulnerable services

Mar 13 00:45:21 mail sshd[17731]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.1.168.36  user=root
Mar 13 00:45:23 mail sshd[17731]: Failed password for root from 194.1.168.36 port 33440 ssh2
Mar 13 00:48:00 mail sshd[17978]: Invalid user market from 194.1.168.36
Mar 13 00:48:00 mail sshd[17978]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.1.168.36
Mar 13 00:48:00 mail sshd[17978]: Invalid user market from 194.1.168.36
Mar 13 00:48:02 mail sshd[17978]: Failed password for invalid user market from 194.1.168.36 port 51028 ssh2
...

Mar 13 00:23:58 mail sshd\[742\]: Invalid user diego from 51.68.65.174
Mar 13 00:23:58 mail sshd\[742\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.68.65.174
Mar 13 00:24:00 mail sshd\[742\]: Failed password for invalid user diego from 51.68.65.174 port 60136 ssh2
...