SSH brutforce

Apr  5 12:44:05 IngegnereFirenze sshd[21514]: Failed password for invalid user staff from 178.128.81.125 port 33071 ssh2
...

Mar 10 06:11:09 takio sshd[15752]: Invalid user kemikaalit from 178.128.81.125 port 14010
Mar 10 06:15:04 takio sshd[15794]: Invalid user ftpuser from 178.128.81.125 port 40012
Mar 10 06:18:54 takio sshd[15831]: Invalid user kemikaalit from 178.128.81.125 port 11011

March 05 2020, 00:36:34 [sshd] - Banned from the Mad Pony WordPress hosting platform by Fail2ban.

sshd jail - ssh hack attempt

Triggered by Fail2Ban at Ares web server

Feb 17 02:53:42 localhost sshd\[1573\]: Invalid user admin from 178.128.81.125 port 50938
Feb 17 02:53:42 localhost sshd\[1573\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.81.125
Feb 17 02:53:44 localhost sshd\[1573\]: Failed password for invalid user admin from 178.128.81.125 port 50938 ssh2

Feb 16 13:47:15 game-panel sshd[830]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.81.125
Feb 16 13:47:18 game-panel sshd[830]: Failed password for invalid user admin from 178.128.81.125 port 18524 ssh2
Feb 16 13:51:06 game-panel sshd[993]: Failed password for root from 178.128.81.125 port 48528 ssh2

Feb 16 02:01:39 ks10 sshd[652542]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.81.125 
Feb 16 02:01:41 ks10 sshd[652542]: Failed password for invalid user admin from 178.128.81.125 port 38730 ssh2
...

SSH Brute-Forcing (server2)

B: f2b ssh aggressive 3x

Invalid user user5 from 178.128.81.125 port 20297

Dec 11 10:58:44 thevastnessof sshd[11844]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.81.125
...

Dec 10 14:34:28 ncomp sshd[27755]: Invalid user ftpuser from 178.128.81.125
Dec 10 14:34:28 ncomp sshd[27755]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.81.125
Dec 10 14:34:28 ncomp sshd[27755]: Invalid user ftpuser from 178.128.81.125
Dec 10 14:34:30 ncomp sshd[27755]: Failed password for invalid user ftpuser from 178.128.81.125 port 26953 ssh2

Dec  5 12:13:44 work-partkepr sshd\[21848\]: Invalid user oracle3 from 178.128.81.125 port 30857
Dec  5 12:13:44 work-partkepr sshd\[21848\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.81.125
...

Dec  3 08:55:35 marvibiene sshd[18291]: Invalid user cron from 178.128.81.125 port 64963
Dec  3 08:55:35 marvibiene sshd[18291]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.81.125
Dec  3 08:55:35 marvibiene sshd[18291]: Invalid user cron from 178.128.81.125 port 64963
Dec  3 08:55:37 marvibiene sshd[18291]: Failed password for invalid user cron from 178.128.81.125 port 64963 ssh2
...

2019-11-26T09:22:16.9036661240 sshd\[15568\]: Invalid user butter from 178.128.81.125 port 44935
2019-11-26T09:22:16.9076641240 sshd\[15568\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.81.125
2019-11-26T09:22:19.2834641240 sshd\[15568\]: Failed password for invalid user butter from 178.128.81.125 port 44935 ssh2
...

Nov 25 19:41:01 *** sshd[17405]: Failed password for invalid user scaner from 178.128.81.125 port 49063 ssh2

Oct 25 22:44:51 bouncer sshd\[11043\]: Invalid user applmgr from 178.128.81.125 port 14401
Oct 25 22:44:51 bouncer sshd\[11043\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.81.125 
Oct 25 22:44:53 bouncer sshd\[11043\]: Failed password for invalid user applmgr from 178.128.81.125 port 14401 ssh2
...

Invalid user test from 178.128.81.125 port 48374

Invalid user cacti from 178.128.81.125 port 12311

Jul 20 09:50:09 XXXXXX sshd[1190]: Invalid user ashley from 178.128.81.125 port 19144

Invalid user pass from 178.128.81.125 port 12109

Jul 12 06:01:33 XXX sshd[44557]: Invalid user hacker from 178.128.81.125 port 56563

Jul  8 23:35:02 sshgateway sshd\[23225\]: Invalid user jboss from 178.128.81.125
Jul  8 23:35:02 sshgateway sshd\[23225\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.81.125
Jul  8 23:35:03 sshgateway sshd\[23225\]: Failed password for invalid user jboss from 178.128.81.125 port 55694 ssh2

Jul  5 20:42:05 XXX sshd[11433]: Invalid user user from 178.128.81.125 port 34817

Jul  1 17:29:58 nextcloud sshd\[10609\]: Invalid user sybase from 178.128.81.125
Jul  1 17:29:58 nextcloud sshd\[10609\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.81.125
Jul  1 17:30:00 nextcloud sshd\[10609\]: Failed password for invalid user sybase from 178.128.81.125 port 13099 ssh2
...

$f2bV_matches

IP attempted unauthorised action

Invalid user josh from 178.128.81.125 port 44862

Jun 17 06:29:47 ws26vmsma01 sshd[56776]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.81.60
Jun 17 06:29:49 ws26vmsma01 sshd[56776]: Failed password for invalid user jv from 178.128.81.60 port 47222 ssh2
...

Jun 14 21:41:52 l02a sshd[19828]: Invalid user girish from 178.128.81.60
Jun 14 21:41:52 l02a sshd[19828]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.81.60 
Jun 14 21:41:52 l02a sshd[19828]: Invalid user girish from 178.128.81.60
Jun 14 21:41:55 l02a sshd[19828]: Failed password for invalid user girish from 178.128.81.60 port 50468 ssh2

$f2bV_matches

May 14 09:16:51 ny01 sshd[22921]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.81.60
May 14 09:16:53 ny01 sshd[22921]: Failed password for invalid user bitcoinj from 178.128.81.60 port 52124 ssh2
May 14 09:21:35 ny01 sshd[23453]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.81.60

May  6 06:07:55 vps58358 sshd\[15612\]: Invalid user newuser from 178.128.81.60May  6 06:07:56 vps58358 sshd\[15612\]: Failed password for invalid user newuser from 178.128.81.60 port 55470 ssh2May  6 06:10:42 vps58358 sshd\[15698\]: Invalid user lhm from 178.128.81.60May  6 06:10:44 vps58358 sshd\[15698\]: Failed password for invalid user lhm from 178.128.81.60 port 41076 ssh2May  6 06:13:40 vps58358 sshd\[15726\]: Invalid user apptest from 178.128.81.60May  6 06:13:41 vps58358 sshd\[15726\]: Failed password for invalid user apptest from 178.128.81.60 port 55058 ssh2
...

Apr 28 13:00:51 XXXXXX sshd[61273]: Invalid user marjorie from 178.128.81.60 port 39080

25798/tcp 22420/tcp 9104/tcp...
[2020-04-12/26]20pkt,8pt.(tcp)

Apr 22 05:57:06 debian-2gb-nbg1-2 kernel: \[9786781.431201\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=178.128.81.150 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x40 TTL=242 ID=10196 PROTO=TCP SPT=41862 DPT=14708 WINDOW=1024 RES=0x00 SYN URGP=0

Apr 20 07:37:53 vps sshd[25266]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.81.60 
Apr 20 07:37:55 vps sshd[25266]: Failed password for invalid user test from 178.128.81.60 port 34640 ssh2
Apr 20 07:44:55 vps sshd[25720]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.81.60 
...

Apr 18 07:50:43 vps647732 sshd[29510]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.81.60
Apr 18 07:50:45 vps647732 sshd[29510]: Failed password for invalid user postgres from 178.128.81.60 port 37530 ssh2
...

Apr 16 08:06:32 ws26vmsma01 sshd[219281]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.81.60
Apr 16 08:06:34 ws26vmsma01 sshd[219281]: Failed password for invalid user oper from 178.128.81.60 port 35820 ssh2
...

Invalid user matt from 178.128.81.60 port 48804

Apr 13 06:11:19 markkoudstaal sshd[1143]: Failed password for root from 178.128.81.60 port 59644 ssh2
Apr 13 06:15:16 markkoudstaal sshd[1831]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.81.60
Apr 13 06:15:17 markkoudstaal sshd[1831]: Failed password for invalid user git from 178.128.81.60 port 39596 ssh2

Apr  6 03:22:37 gw1 sshd[26648]: Failed password for root from 178.128.81.60 port 47924 ssh2
...

2020-04-04T13:33:11.947786shield sshd\[23006\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.81.60  user=root
2020-04-04T13:33:13.641810shield sshd\[23006\]: Failed password for root from 178.128.81.60 port 42040 ssh2
2020-04-04T13:37:30.911621shield sshd\[23696\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.81.60  user=root
2020-04-04T13:37:32.159389shield sshd\[23696\]: Failed password for root from 178.128.81.60 port 53858 ssh2
2020-04-04T13:41:51.525063shield sshd\[24386\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.81.60  user=root

Brute-force attempt banned

Port probing on unauthorized port 23

B: Magento admin pass test (wrong country)

Mar 8 08:41:11 *host* sshd\[10181\]: Unable to negotiate with 45.148.10.92 port 58460: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 \[preauth\]

Brute force 74 attempts

Mar  8 09:27:08 sd-53420 sshd\[6597\]: User root from 222.186.169.194 not allowed because none of user's groups are listed in AllowGroups
Mar  8 09:27:09 sd-53420 sshd\[6597\]: Failed none for invalid user root from 222.186.169.194 port 17554 ssh2
Mar  8 09:27:09 sd-53420 sshd\[6597\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.169.194  user=root
Mar  8 09:27:11 sd-53420 sshd\[6597\]: Failed password for invalid user root from 222.186.169.194 port 17554 ssh2
Mar  8 09:27:15 sd-53420 sshd\[6597\]: Failed password for invalid user root from 222.186.169.194 port 17554 ssh2
...

port scan and connect, tcp 23 (telnet)

*Port Scan* detected from 192.241.223.140 (US/United States/zg-0229i-422.stretchoid.com). 4 hits in the last 220 seconds

(From storybitestudio14@gmail.com) Hey! I came across your website and wanted to get in touch. 
 
I run an animation studio that makes animated explainer videos helping companies to better explain their offering and why potential customers should work with them over the competition. 
 
Watch some of our work here: http://www.story-bite.com/ - what do you think? 
 
Our team works out of Denmark to create high quality videos made from scratch, designed to make your business stand out and get results. No templates, no cookie cutter animation that tarnishes your brand. 
 
I would love to work on an awesome animated video for you guys. 
 
We have a smooth production process and handle everything needed for a high-quality video that typically takes us 6 weeks to produce from start to finish. 
 
First, we nail the script, design storyboards you can’t wait to see animated. Voice actors in your native language that capture your brand and animation that screams premium with sound design that brings it all t

Honeypot attack, port: 5555, PTR: PTR record not found

Honeypot attack, port: 445, PTR: dsl-189-183-241-233-dyn.prod-infinitum.com.mx.

Attempt to attack host OS, exploiting network vulnerabilities, on 08-03-2020 04:55:10.

Mar  8 06:45:14 mail.srvfarm.net postfix/smtpd[3252860]: NOQUEUE: reject: RCPT from unknown[217.112.142.92]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar  8 06:45:14 mail.srvfarm.net postfix/smtpd[3252859]: NOQUEUE: reject: RCPT from unknown[217.112.142.92]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar  8 06:45:14 mail.srvfarm.net postfix/smtpd[3251595]: NOQUEUE: reject: RCPT from unknown[217.112.142.92]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar  8 06:46:06 mail.srvfarm.net postfix/smtpd[3252862]: NOQUEUE: reject: RCPT fro

Honeypot attack, port: 81, PTR: 59-126-178-70.HINET-IP.hinet.net.

[Sun Mar 08 11:55:04.037861 2020] [:error] [pid 20175:tid 139798653499136] [client 106.53.10.48:54728] [client 106.53.10.48] ModSecurity: Access denied with code 403 (phase 2). Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/modsecurity/owasp-modsecurity-crs-3.2.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "696"] [id "920350"] [msg "Host header is a numeric IP address"] [data "103.27.207.197"] [severity "WARNING"] [ver "OWASP_CRS/3.2.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/IP_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "103.27.207.197"] [uri "/"] [unique_id "XmR6qHxZvY2nxCF3wIa3QAAAAYI"]
...