Oct  9 01:11:02 elp-server sshd[85411]: Unable to negotiate with 185.132.53.14 port 48206: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
Oct  9 01:11:19 elp-server sshd[85417]: Unable to negotiate with 185.132.53.14 port 48212: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
Oct  9 01:11:36 elp-server sshd[85423]: Unable to negotiate with 185.132.53.14 port 48258: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
...

(sshd) Failed SSH login from 185.132.53.14 (DE/Germany/vps32.virtual4host.pt): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Oct  8 11:51:30 server sshd[22256]: Did not receive identification string from 185.132.53.14 port 55218
Oct  8 11:51:58 server sshd[22312]: Failed password for root from 185.132.53.14 port 33202 ssh2
Oct  8 11:52:15 server sshd[22379]: Invalid user oracle from 185.132.53.14 port 33402
Oct  8 11:52:16 server sshd[22379]: Failed password for invalid user oracle from 185.132.53.14 port 33402 ssh2
Oct  8 11:52:35 server sshd[22457]: Failed password for root from 185.132.53.14 port 33592 ssh2

Oct  8 09:38:37 sd-69548 sshd[84133]: Unable to negotiate with 185.132.53.14 port 35272: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
Oct  8 09:38:55 sd-69548 sshd[84153]: Unable to negotiate with 185.132.53.14 port 58052: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
...

[N3.H3.VM3] Port Scanner Detected Blocked by UFW

2020-10-04 10:40:34.849649-0500  localhost sshd[74206]: Failed password for root from 185.132.53.14 port 35032 ssh2

Oct  4 10:17:28 server2 sshd\[32424\]: User root from vps32.virtual4host.pt not allowed because not listed in AllowUsers
Oct  4 10:17:45 server2 sshd\[32427\]: User root from vps32.virtual4host.pt not allowed because not listed in AllowUsers
Oct  4 10:18:01 server2 sshd\[32431\]: User root from vps32.virtual4host.pt not allowed because not listed in AllowUsers
Oct  4 10:18:18 server2 sshd\[32462\]: User root from vps32.virtual4host.pt not allowed because not listed in AllowUsers
Oct  4 10:18:36 server2 sshd\[32464\]: Invalid user telnet from 185.132.53.14
Oct  4 10:18:53 server2 sshd\[32470\]: Invalid user ubnt from 185.132.53.14

The sucker tried to brute force my teeny tiny SSH server

Sep 29 16:55:37 XXX sshd[41741]: Invalid user oracle from 185.132.53.14 port 40844

Sep 28 20:06:02 OPSO sshd\[1962\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.132.53.14  user=root
Sep 28 20:06:04 OPSO sshd\[1962\]: Failed password for root from 185.132.53.14 port 48780 ssh2
Sep 28 20:06:18 OPSO sshd\[2032\]: Invalid user oracle from 185.132.53.14 port 43816
Sep 28 20:06:18 OPSO sshd\[2032\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.132.53.14
Sep 28 20:06:20 OPSO sshd\[2032\]: Failed password for invalid user oracle from 185.132.53.14 port 43816 ssh2

Time:     Mon Sep 28 12:03:01 2020 +0200
IP:       185.132.53.14 (DE/Germany/32.virtual4host.pt)
Failures: 5 (sshd)
Interval: 3600 seconds
Blocked:  Permanent Block [LF_SSHD]

Log entries:

Sep 28 12:01:36 3-1 sshd[5014]: Did not receive identification string from 185.132.53.14 port 47220
Sep 28 12:02:23 3-1 sshd[5054]: Failed password for root from 185.132.53.14 port 53030 ssh2
Sep 28 12:02:38 3-1 sshd[5072]: Invalid user oracle from 185.132.53.14 port 47438
Sep 28 12:02:39 3-1 sshd[5072]: Failed password for invalid user oracle from 185.132.53.14 port 47438 ssh2
Sep 28 12:02:57 3-1 sshd[5081]: Failed password for root from 185.132.53.14 port 41860 ssh2

Invalid user admin from 185.132.53.115 port 35110

Oct 13 10:06:29 ns1 sshd[78677]: Did not receive identification string from 185.132.53.115 port 44168
Oct 13 10:06:33 ns1 sshd[78678]: Unable to negotiate with 185.132.53.115 port 40660: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
Oct 13 10:06:49 ns1 sshd[78680]: Unable to negotiate with 185.132.53.115 port 41618: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
Oct 13 10:07:05 ns1 sshd[78682]: Unable to negotiate with 185.132.53.115 port 42644: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
Oct 13 10:07:20 ns1 sshd[78684]: Unable to negotiate with 185.132.53.115 port 43726: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-e
...

Oct 12 20:59:42 targaryen sshd[6336]: Invalid user admin from 185.132.53.115
Oct 12 20:59:56 targaryen sshd[6338]: Invalid user admin from 185.132.53.115
Oct 12 21:00:12 targaryen sshd[6343]: Invalid user admin from 185.132.53.115
Oct 12 21:00:27 targaryen sshd[6345]: Invalid user admin from 185.132.53.115
...

SSH Brute Force (V)

Unauthorized connection attempt detected from IP address 185.132.53.85 to port 22

Oct  6 22:25:15 nas sshd[30358]: Failed password for root from 185.132.53.115 port 42610 ssh2
Oct  6 22:25:31 nas sshd[30780]: Failed password for root from 185.132.53.115 port 40618 ssh2
...

Oct  6 11:27:26 alfc-lms-prod01 sshd\[25821\]: Invalid user user from 185.132.53.124
Oct  6 11:27:33 alfc-lms-prod01 sshd\[25825\]: Invalid user git from 185.132.53.124
Oct  6 11:27:41 alfc-lms-prod01 sshd\[25827\]: Invalid user postgres from 185.132.53.124
...

Icarus honeypot on github

Oct  6 11:27:26 alfc-lms-prod01 sshd\[25821\]: Invalid user user from 185.132.53.124
Oct  6 11:27:33 alfc-lms-prod01 sshd\[25825\]: Invalid user git from 185.132.53.124
Oct  6 11:27:41 alfc-lms-prod01 sshd\[25827\]: Invalid user postgres from 185.132.53.124
...

Oct  6 06:18:41 ns382633 sshd\[16857\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.132.53.115  user=root
Oct  6 06:18:43 ns382633 sshd\[16857\]: Failed password for root from 185.132.53.115 port 39806 ssh2
Oct  6 06:18:55 ns382633 sshd\[16861\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.132.53.115  user=root
Oct  6 06:18:58 ns382633 sshd\[16861\]: Failed password for root from 185.132.53.115 port 33824 ssh2
Oct  6 06:19:11 ns382633 sshd\[17121\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.132.53.115  user=root

[N10.H2.VM2] Port Scanner Detected Blocked by UFW

fail2ban detected bruce force on ssh iptables

frenzy

 TCP (SYN) 185.132.53.124:58330 -> port 22, len 48

Oct  4 23:48:13 vps647732 sshd[7976]: Failed password for root from 185.132.53.85 port 51540 ssh2
...

167.71.137.237 - - [06/Jun/2020:00:28:29 +0100] "POST /wp-login.php HTTP/1.1" 200 2020 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
167.71.137.237 - - [06/Jun/2020:00:28:35 +0100] "POST /wp-login.php HTTP/1.1" 200 2019 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
167.71.137.237 - - [06/Jun/2020:00:28:35 +0100] "POST /xmlrpc.php HTTP/1.1" 403 219 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
...

(smtpauth) Failed SMTP AUTH login from 52.247.115.98 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 2020-06-06 07:00:33 login authenticator failed for (ADMIN) [52.247.115.98]: 535 Incorrect authentication data (set_id=renate@sanabelco.com)

2020-06-05T23:43:34.4157171495-001 sshd[13121]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=48.ip-54-38-190.eu  user=root
2020-06-05T23:43:35.6841011495-001 sshd[13121]: Failed password for root from 54.38.190.48 port 46216 ssh2
2020-06-05T23:47:13.0071951495-001 sshd[13243]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=48.ip-54-38-190.eu  user=root
2020-06-05T23:47:14.9810511495-001 sshd[13243]: Failed password for root from 54.38.190.48 port 49898 ssh2
2020-06-05T23:50:39.1033391495-001 sshd[13344]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=48.ip-54-38-190.eu  user=root
2020-06-05T23:50:41.0536251495-001 sshd[13344]: Failed password for root from 54.38.190.48 port 53582 ssh2
...

Jun  5 18:24:34 ny01 sshd[1184]: Failed password for root from 76.214.112.45 port 22216 ssh2
Jun  5 18:28:08 ny01 sshd[2469]: Failed password for root from 76.214.112.45 port 52086 ssh2

This IP address tried to sign into my Facebook page on numerous occasions- stop hacking my account!

Jun  5 23:32:58 ny01 sshd[15139]: Failed password for root from 106.12.175.226 port 56188 ssh2
Jun  5 23:36:21 ny01 sshd[15599]: Failed password for root from 106.12.175.226 port 49916 ssh2

Jun  6 05:40:15 nextcloud sshd\[9522\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=171.244.51.114  user=root
Jun  6 05:40:18 nextcloud sshd\[9522\]: Failed password for root from 171.244.51.114 port 49262 ssh2
Jun  6 05:46:09 nextcloud sshd\[11638\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=171.244.51.114  user=root

Jun  6 05:40:34 debian-2gb-nbg1-2 kernel: \[13673584.667953\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=185.39.11.57 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=247 ID=8336 PROTO=TCP SPT=52342 DPT=30010 WINDOW=1024 RES=0x00 SYN URGP=0

2020-06-06T05:37:33.945294+02:00  sshd[22557]: Failed password for root from 132.232.31.157 port 57806 ssh2

2020-06-05T23:32:44.575571abusebot-4.cloudsearch.cf sshd[9958]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.211.174.145  user=root
2020-06-05T23:32:46.743249abusebot-4.cloudsearch.cf sshd[9958]: Failed password for root from 129.211.174.145 port 45820 ssh2
2020-06-05T23:35:09.881844abusebot-4.cloudsearch.cf sshd[10086]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.211.174.145  user=root
2020-06-05T23:35:11.958708abusebot-4.cloudsearch.cf sshd[10086]: Failed password for root from 129.211.174.145 port 59076 ssh2
2020-06-05T23:37:39.430550abusebot-4.cloudsearch.cf sshd[10216]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.211.174.145  user=root
2020-06-05T23:37:41.763686abusebot-4.cloudsearch.cf sshd[10216]: Failed password for root from 129.211.174.145 port 44140 ssh2
2020-06-05T23:40:04.107569abusebot-4.cloudsearch.cf sshd[10343]: pam_unix(sshd:au
...

 TCP (SYN) 185.176.27.26:44662 -> port 17593, len 44

Unauthorised connection attempt detected at AUO FR1 NODE2. System is sshd. Protected by AUO Stack Web Application Firewall (WAF)

Jun  5 22:34:29 legacy sshd[7541]: Failed password for root from 106.12.60.246 port 49992 ssh2
Jun  5 22:38:50 legacy sshd[7651]: Failed password for root from 106.12.60.246 port 49620 ssh2
...

2020-06-05T22:22:46+0200 Failed SSH Authentication/Brute Force Attack. (Server 4)

IP 84.161.180.96 attacked honeypot on port: 88 at 6/5/2020 11:00:47 PM