Exploited Host.

2020-07-24T00:24:59.587428afi-git.jinr.ru sshd[13495]: Invalid user taras from 128.199.220.197 port 36746
2020-07-24T00:24:59.590798afi-git.jinr.ru sshd[13495]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.220.197
2020-07-24T00:24:59.587428afi-git.jinr.ru sshd[13495]: Invalid user taras from 128.199.220.197 port 36746
2020-07-24T00:25:01.817945afi-git.jinr.ru sshd[13495]: Failed password for invalid user taras from 128.199.220.197 port 36746 ssh2
2020-07-24T00:29:21.592207afi-git.jinr.ru sshd[14723]: Invalid user panasonic from 128.199.220.197 port 51188
...

Jul 22 08:22:00 eventyay sshd[25220]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.220.197
Jul 22 08:22:02 eventyay sshd[25220]: Failed password for invalid user kim from 128.199.220.197 port 34936 ssh2
Jul 22 08:24:32 eventyay sshd[25295]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.220.197
...

Jul 21 06:58:12 ws24vmsma01 sshd[139693]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.220.197
Jul 21 06:58:14 ws24vmsma01 sshd[139693]: Failed password for invalid user mahima from 128.199.220.197 port 52888 ssh2
...

Jul 17 03:14:34 propaganda sshd[10097]: Connection from 128.199.220.232 port 33444 on 10.0.0.160 port 22 rdomain ""
Jul 17 03:14:35 propaganda sshd[10097]: Connection closed by 128.199.220.232 port 33444 [preauth]

Jul 17 06:06:37 vps687878 sshd\[14244\]: Failed password for invalid user ching from 128.199.220.197 port 51336 ssh2
Jul 17 06:10:55 vps687878 sshd\[14814\]: Invalid user rack from 128.199.220.197 port 38710
Jul 17 06:10:55 vps687878 sshd\[14814\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.220.197
Jul 17 06:10:57 vps687878 sshd\[14814\]: Failed password for invalid user rack from 128.199.220.197 port 38710 ssh2
Jul 17 06:15:25 vps687878 sshd\[15259\]: Invalid user liulei from 128.199.220.197 port 54322
Jul 17 06:15:25 vps687878 sshd\[15259\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.220.197
...

Cowrie Honeypot: 3 unauthorised SSH/Telnet login attempts between 2020-07-16T05:50:51Z and 2020-07-16T06:02:29Z

$f2bV_matches

Jul  8 14:41:23 electroncash sshd[34254]: Invalid user vagrant from 128.199.220.197 port 52880
Jul  8 14:41:23 electroncash sshd[34254]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.220.197 
Jul  8 14:41:23 electroncash sshd[34254]: Invalid user vagrant from 128.199.220.197 port 52880
Jul  8 14:41:25 electroncash sshd[34254]: Failed password for invalid user vagrant from 128.199.220.197 port 52880 ssh2
Jul  8 14:44:06 electroncash sshd[34949]: Invalid user rabbitmq from 128.199.220.197 port 39046
...

(sshd) Failed SSH login from 128.199.220.197 (SG/Singapore/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Jul  4 11:13:17 amsweb01 sshd[31070]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.220.197  user=root
Jul  4 11:13:19 amsweb01 sshd[31070]: Failed password for root from 128.199.220.197 port 54154 ssh2
Jul  4 11:14:51 amsweb01 sshd[477]: Invalid user testftp from 128.199.220.197 port 46060
Jul  4 11:14:54 amsweb01 sshd[477]: Failed password for invalid user testftp from 128.199.220.197 port 46060 ssh2
Jul  4 11:16:03 amsweb01 sshd[771]: Invalid user balaji from 128.199.220.197 port 33532

Jun 28 08:01:06 piServer sshd[31297]: Failed password for root from 128.199.220.197 port 36334 ssh2
Jun 28 08:04:43 piServer sshd[31584]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.220.197 
Jun 28 08:04:45 piServer sshd[31584]: Failed password for invalid user rachel from 128.199.220.197 port 35776 ssh2
...

(sshd) Failed SSH login from 128.199.220.197 (SG/Singapore/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Jun 27 11:30:18 amsweb01 sshd[31060]: Invalid user itd from 128.199.220.197 port 33690
Jun 27 11:30:20 amsweb01 sshd[31060]: Failed password for invalid user itd from 128.199.220.197 port 33690 ssh2
Jun 27 11:42:40 amsweb01 sshd[777]: Invalid user k from 128.199.220.197 port 59898
Jun 27 11:42:41 amsweb01 sshd[777]: Failed password for invalid user k from 128.199.220.197 port 59898 ssh2
Jun 27 11:45:54 amsweb01 sshd[1310]: Invalid user ken from 128.199.220.197 port 56404

$f2bV_matches

Jun 20 17:50:30 ovpn sshd\[23265\]: Invalid user newuser from 128.199.220.197
Jun 20 17:50:30 ovpn sshd\[23265\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.220.197
Jun 20 17:50:32 ovpn sshd\[23265\]: Failed password for invalid user newuser from 128.199.220.197 port 48126 ssh2
Jun 20 18:01:36 ovpn sshd\[25879\]: Invalid user vmuser from 128.199.220.197
Jun 20 18:01:36 ovpn sshd\[25879\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.220.197

2020-06-20T10:53:02+0200 Failed SSH Authentication/Brute Force Attack. (Server 10)

SSH login attempts.

[2020-04-02 04:37:55] NOTICE[12114] chan_sip.c: Registration from '' failed for '185.147.212.8:49387' - Wrong password
[2020-04-02 04:37:55] SECURITY[12128] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-04-02T04:37:55.208-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="370",SessionID="0x7f020c05ea88",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/185.147.212.8/49387",Challenge="1a7d024f",ReceivedChallenge="1a7d024f",ReceivedHash="714222b30dfc523e45f8f3c67a17bcfb"
[2020-04-02 04:38:51] NOTICE[12114] chan_sip.c: Registration from '' failed for '185.147.212.8:63035' - Wrong password
[2020-04-02 04:38:51] SECURITY[12128] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-04-02T04:38:51.891-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="8753",SessionID="0x7f020c04de18",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/185.147.212
...

Apr  2 09:53:22 vmd26974 sshd[26706]: Failed password for root from 163.44.159.123 port 37334 ssh2
...

Automatic report - Port Scan Attack

2020-04-02T05:48:46.948757struts4.enskede.local sshd\[11319\]: Failed password for root from 180.76.245.228 port 43740 ssh2
2020-04-02T05:51:31.891544struts4.enskede.local sshd\[11376\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.245.228  user=root
2020-04-02T05:51:34.539242struts4.enskede.local sshd\[11376\]: Failed password for root from 180.76.245.228 port 50074 ssh2
2020-04-02T05:54:07.079356struts4.enskede.local sshd\[11454\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.245.228  user=root
2020-04-02T05:54:08.853480struts4.enskede.local sshd\[11454\]: Failed password for root from 180.76.245.228 port 56416 ssh2
...

Apr  2 10:19:36 vps333114 sshd[8313]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.6.231.122
Apr  2 10:19:38 vps333114 sshd[8313]: Failed password for invalid user 151.59.136.4 from 194.6.231.122 port 57565 ssh2
...

2020-04-02T08:39:28.617687shield sshd\[28562\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.177.172.158  user=root
2020-04-02T08:39:30.215109shield sshd\[28562\]: Failed password for root from 61.177.172.158 port 40900 ssh2
2020-04-02T08:39:32.979867shield sshd\[28562\]: Failed password for root from 61.177.172.158 port 40900 ssh2
2020-04-02T08:39:35.487898shield sshd\[28562\]: Failed password for root from 61.177.172.158 port 40900 ssh2
2020-04-02T08:40:18.185427shield sshd\[28862\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.177.172.158  user=root

2020-04-02T08:17:52.356906abusebot.cloudsearch.cf sshd[11331]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=223.223.188.208  user=root
2020-04-02T08:17:54.034983abusebot.cloudsearch.cf sshd[11331]: Failed password for root from 223.223.188.208 port 55639 ssh2
2020-04-02T08:20:01.917203abusebot.cloudsearch.cf sshd[11446]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=223.223.188.208  user=root
2020-04-02T08:20:04.307433abusebot.cloudsearch.cf sshd[11446]: Failed password for root from 223.223.188.208 port 37482 ssh2
2020-04-02T08:22:22.087303abusebot.cloudsearch.cf sshd[11576]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=223.223.188.208  user=root
2020-04-02T08:22:23.830651abusebot.cloudsearch.cf sshd[11576]: Failed password for root from 223.223.188.208 port 47556 ssh2
2020-04-02T08:24:32.775391abusebot.cloudsearch.cf sshd[11699]: pam_unix(sshd:auth): authent
...

Apr  2 04:03:08 NPSTNNYC01T sshd[24111]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=213.251.41.225
Apr  2 04:03:09 NPSTNNYC01T sshd[24111]: Failed password for invalid user oracle from 213.251.41.225 port 33508 ssh2
Apr  2 04:08:47 NPSTNNYC01T sshd[24480]: Failed password for root from 213.251.41.225 port 45494 ssh2
...

'Fail2Ban'

Apr  2 09:34:22 ArkNodeAT sshd\[16892\]: Invalid user wangpei from 111.231.82.175
Apr  2 09:34:22 ArkNodeAT sshd\[16892\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.82.175
Apr  2 09:34:23 ArkNodeAT sshd\[16892\]: Failed password for invalid user wangpei from 111.231.82.175 port 39454 ssh2

[2020-04-02 01:27:03] NOTICE[1148][C-0001a6b3] chan_sip.c: Call from '' (192.210.233.194:59378) to extension '+46520458218' rejected because extension not found in context 'public'.
[2020-04-02 01:27:03] SECURITY[1163] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-04-02T01:27:03.491-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="+46520458218",SessionID="0x7fd82c530768",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/192.210.233.194/59378",ACLName="no_extension_match"
[2020-04-02 01:28:00] NOTICE[1148][C-0001a6b6] chan_sip.c: Call from '' (192.210.233.194:55396) to extension '801146520458218' rejected because extension not found in context 'public'.
[2020-04-02 01:28:00] SECURITY[1163] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-04-02T01:28:00.442-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="801146520458218",SessionID="0x7fd82c43c848",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/
...

<6 unauthorized SSH connections

[ssh] SSH attack

$f2bV_matches