SSH bruteforce

Aug 31 16:48:18 marvibiene sshd[30303]: Failed password for root from 134.209.149.64 port 57978 ssh2
Aug 31 16:53:03 marvibiene sshd[30558]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.149.64 
Aug 31 16:53:05 marvibiene sshd[30558]: Failed password for invalid user hadoop from 134.209.149.64 port 37620 ssh2

Invalid user szk from 134.209.149.64 port 37674

Aug 3 22:35:31 *hidden* sshd[34253]: Failed password for *hidden* from 134.209.149.64 port 56672 ssh2 Aug 3 22:40:56 *hidden* sshd[35116]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.149.64 user=root Aug 3 22:40:59 *hidden* sshd[35116]: Failed password for *hidden* from 134.209.149.64 port 39982 ssh2

Jul 30 12:03:35 *** sshd[16049]: Invalid user wzx from 134.209.149.64

Jul 28 14:13:57 inter-technics sshd[18475]: Invalid user ligl from 134.209.149.64 port 52810
Jul 28 14:13:57 inter-technics sshd[18475]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.149.64
Jul 28 14:13:57 inter-technics sshd[18475]: Invalid user ligl from 134.209.149.64 port 52810
Jul 28 14:13:59 inter-technics sshd[18475]: Failed password for invalid user ligl from 134.209.149.64 port 52810 ssh2
Jul 28 14:18:10 inter-technics sshd[18729]: Invalid user lt from 134.209.149.64 port 54450
...

Jul 27 22:56:18 XXX sshd[57863]: Invalid user yufengying from 134.209.149.64 port 38792

Jul 17 00:58:28 ws19vmsma01 sshd[206460]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.149.64
Jul 17 00:58:30 ws19vmsma01 sshd[206460]: Failed password for invalid user mt from 134.209.149.64 port 60370 ssh2
...

2020-07-15T20:02:30.394793sd-86998 sshd[42932]: Invalid user emil from 134.209.149.64 port 53642
2020-07-15T20:02:30.400079sd-86998 sshd[42932]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.149.64
2020-07-15T20:02:30.394793sd-86998 sshd[42932]: Invalid user emil from 134.209.149.64 port 53642
2020-07-15T20:02:32.056588sd-86998 sshd[42932]: Failed password for invalid user emil from 134.209.149.64 port 53642 ssh2
2020-07-15T20:06:58.347399sd-86998 sshd[43465]: Invalid user howard from 134.209.149.64 port 40030
...

2020-07-12T07:53:08.350909vps751288.ovh.net sshd\[5375\]: Invalid user bhan from 134.209.149.64 port 42482
2020-07-12T07:53:08.358368vps751288.ovh.net sshd\[5375\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.149.64
2020-07-12T07:53:09.945982vps751288.ovh.net sshd\[5375\]: Failed password for invalid user bhan from 134.209.149.64 port 42482 ssh2
2020-07-12T07:55:50.764046vps751288.ovh.net sshd\[5401\]: Invalid user lxf from 134.209.149.64 port 56034
2020-07-12T07:55:50.770872vps751288.ovh.net sshd\[5401\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.149.64

SSH Brute-Force Attack

Jun 29 10:25:08 rush sshd[12225]: Failed password for root from 134.209.149.64 port 49406 ssh2
Jun 29 10:29:06 rush sshd[12277]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.149.64
Jun 29 10:29:08 rush sshd[12277]: Failed password for invalid user usr from 134.209.149.64 port 48348 ssh2
...

351. On Jun 28 2020 experienced a Brute Force SSH login attempt -> 4 unique times by 134.209.149.64.

Jun 26 06:52:00 master sshd[2315]: Failed password for invalid user devuser from 134.209.149.64 port 48976 ssh2
Jun 26 06:58:12 master sshd[2405]: Failed password for root from 134.209.149.64 port 36252 ssh2
Jun 26 07:01:31 master sshd[2861]: Failed password for invalid user liming from 134.209.149.64 port 50952 ssh2
Jun 26 07:04:37 master sshd[2903]: Failed password for root from 134.209.149.64 port 37422 ssh2
Jun 26 07:07:33 master sshd[2961]: Failed password for invalid user zach from 134.209.149.64 port 52128 ssh2
Jun 26 07:10:34 master sshd[3087]: Failed password for invalid user aiz from 134.209.149.64 port 38598 ssh2
Jun 26 07:13:42 master sshd[3133]: Failed password for invalid user test2 from 134.209.149.64 port 53302 ssh2
Jun 26 07:16:41 master sshd[3222]: Failed password for root from 134.209.149.64 port 39772 ssh2
Jun 26 07:19:41 master sshd[3275]: Failed password for invalid user exe from 134.209.149.64 port 54496 ssh2

2020-06-20T15:48:47.4857671495-001 sshd[40709]: Failed password for invalid user git from 134.209.149.64 port 48346 ssh2
2020-06-20T15:52:44.8302181495-001 sshd[40824]: Invalid user oracle from 134.209.149.64 port 47524
2020-06-20T15:52:44.8335681495-001 sshd[40824]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.149.64
2020-06-20T15:52:44.8302181495-001 sshd[40824]: Invalid user oracle from 134.209.149.64 port 47524
2020-06-20T15:52:47.0997491495-001 sshd[40824]: Failed password for invalid user oracle from 134.209.149.64 port 47524 ssh2
2020-06-20T15:56:36.7838651495-001 sshd[40924]: Invalid user ly from 134.209.149.64 port 46696
...

bruteforce detected

2020-06-01T14:47:51.083320abusebot-6.cloudsearch.cf sshd[11575]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.69.169  user=root
2020-06-01T14:47:53.286681abusebot-6.cloudsearch.cf sshd[11575]: Failed password for root from 128.199.69.169 port 39192 ssh2
2020-06-01T14:50:20.413681abusebot-6.cloudsearch.cf sshd[11768]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.69.169  user=root
2020-06-01T14:50:22.737577abusebot-6.cloudsearch.cf sshd[11768]: Failed password for root from 128.199.69.169 port 47460 ssh2
2020-06-01T14:52:46.602218abusebot-6.cloudsearch.cf sshd[11968]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.69.169  user=root
2020-06-01T14:52:48.635283abusebot-6.cloudsearch.cf sshd[11968]: Failed password for root from 128.199.69.169 port 55726 ssh2
2020-06-01T14:55:20.279536abusebot-6.cloudsearch.cf sshd[12169]: pam_unix(sshd:auth):
...

Firewall Dropped Connection

$f2bV_matches | Triggered by Fail2Ban at Vostok web server

2020-06-01T16:42:25.695478shield sshd\[16843\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.211.93.34.bc.googleusercontent.com  user=root
2020-06-01T16:42:27.268904shield sshd\[16843\]: Failed password for root from 34.93.211.49 port 39638 ssh2
2020-06-01T16:46:12.192681shield sshd\[17525\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.211.93.34.bc.googleusercontent.com  user=root
2020-06-01T16:46:14.592060shield sshd\[17525\]: Failed password for root from 34.93.211.49 port 34426 ssh2
2020-06-01T16:49:56.966084shield sshd\[18312\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.211.93.34.bc.googleusercontent.com  user=root

Jun  1 13:42:31 ovpn sshd\[32187\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.142.134.193  user=root
Jun  1 13:42:33 ovpn sshd\[32187\]: Failed password for root from 113.142.134.193 port 44316 ssh2
Jun  1 14:02:05 ovpn sshd\[4366\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.142.134.193  user=root
Jun  1 14:02:06 ovpn sshd\[4366\]: Failed password for root from 113.142.134.193 port 45952 ssh2
Jun  1 14:05:31 ovpn sshd\[5201\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.142.134.193  user=root

Jun  1 13:43:15 web01.agentur-b-2.de postfix/smtpd[598081]: NOQUEUE: reject: RCPT from unknown[146.185.218.211]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Jun  1 13:44:11 web01.agentur-b-2.de postfix/smtpd[591656]: NOQUEUE: reject: RCPT from unknown[146.185.218.211]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Jun  1 13:44:11 web01.agentur-b-2.de postfix/smtpd[591656]: NOQUEUE: reject: RCPT from unknown[146.185.218.211]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Jun  1 13:44:12 web01.agentur-b-2.de postfix/smtpd[591656]: NOQUEUE: reject: RCPT from unknown[146.185.218.211]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=

Lines containing failures of 120.39.2.34
Jun  1 00:25:44 cdb sshd[11068]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.39.2.34  user=r.r
Jun  1 00:25:46 cdb sshd[11068]: Failed password for r.r from 120.39.2.34 port 58640 ssh2
Jun  1 00:25:46 cdb sshd[11068]: Received disconnect from 120.39.2.34 port 58640:11: Bye Bye [preauth]
Jun  1 00:25:46 cdb sshd[11068]: Disconnected from authenticating user r.r 120.39.2.34 port 58640 [preauth]
Jun  1 00:36:55 cdb sshd[12496]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.39.2.34  user=r.r
Jun  1 00:36:57 cdb sshd[12496]: Failed password for r.r from 120.39.2.34 port 60674 ssh2
Jun  1 00:36:57 cdb sshd[12496]: Received disconnect from 120.39.2.34 port 60674:11: Bye Bye [preauth]
Jun  1 00:36:57 cdb sshd[12496]: Disconnected from authenticating user r.r 120.39.2.34 port 60674 [preauth]
Jun  1 00:39:52 cdb sshd[12978]: pam_unix(sshd:auth): au........
------------------------------

[2020-06-01 13:12:17] NOTICE[1157][C-0000b078] chan_sip.c: Call from '' (62.173.147.225:55903) to extension '01148748379001' rejected because extension not found in context 'public'.
[2020-06-01 13:12:17] SECURITY[1173] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-06-01T13:12:17.397-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="01148748379001",SessionID="0x7f5f100266a8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/62.173.147.225/55903",ACLName="no_extension_match"
[2020-06-01 13:12:22] NOTICE[1157][C-0000b079] chan_sip.c: Call from '' (62.173.147.225:59784) to extension '901148748379001' rejected because extension not found in context 'public'.
[2020-06-01 13:12:22] SECURITY[1173] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-06-01T13:12:22.467-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="901148748379001",SessionID="0x7f5f1039ca78",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP
...

1591013120 - 06/01/2020 14:05:20 Host: 201.24.3.66/201.24.3.66 Port: 445 TCP Blocked

2020-06-01 07:00:46.907636-0500  localhost sshd[60522]: Failed password for root from 34.96.138.177 port 15898 ssh2

Jun  1 14:01:03 jane sshd[27926]: Failed password for root from 61.152.70.126 port 33434 ssh2
...

2020-06-01T18:20[Censored Hostname] sshd[12536]: Failed password for root from 139.59.2.184 port 58634 ssh2
2020-06-01T18:22[Censored Hostname] sshd[13171]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.2.184  user=root
2020-06-01T18:22[Censored Hostname] sshd[13171]: Failed password for root from 139.59.2.184 port 58078 ssh2[...]

Jun  1 23:49:59 webhost01 sshd[2659]: Failed password for root from 178.128.150.158 port 51510 ssh2
...

Lines containing failures of 188.166.185.157
Jun  1 04:06:57 nexus sshd[14558]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.166.185.157  user=r.r
Jun  1 04:06:59 nexus sshd[14558]: Failed password for r.r from 188.166.185.157 port 34316 ssh2
Jun  1 04:06:59 nexus sshd[14558]: Received disconnect from 188.166.185.157 port 34316:11: Bye Bye [preauth]
Jun  1 04:06:59 nexus sshd[14558]: Disconnected from 188.166.185.157 port 34316 [preauth]
Jun  1 04:16:25 nexus sshd[14694]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.166.185.157  user=r.r
Jun  1 04:16:27 nexus sshd[14694]: Failed password for r.r from 188.166.185.157 port 43776 ssh2
Jun  1 04:16:27 nexus sshd[14694]: Received disconnect from 188.166.185.157 port 43776:11: Bye Bye [preauth]
Jun  1 04:16:27 nexus sshd[14694]: Disconnected from 188.166.185.157 port 43776 [preauth]
Jun  1 04:20:26 nexus sshd[14740]: pam_unix(sshd:aut........
------------------------------