Oct  9 01:11:02 elp-server sshd[85411]: Unable to negotiate with 185.132.53.14 port 48206: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
Oct  9 01:11:19 elp-server sshd[85417]: Unable to negotiate with 185.132.53.14 port 48212: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
Oct  9 01:11:36 elp-server sshd[85423]: Unable to negotiate with 185.132.53.14 port 48258: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
...

(sshd) Failed SSH login from 185.132.53.14 (DE/Germany/vps32.virtual4host.pt): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Oct  8 11:51:30 server sshd[22256]: Did not receive identification string from 185.132.53.14 port 55218
Oct  8 11:51:58 server sshd[22312]: Failed password for root from 185.132.53.14 port 33202 ssh2
Oct  8 11:52:15 server sshd[22379]: Invalid user oracle from 185.132.53.14 port 33402
Oct  8 11:52:16 server sshd[22379]: Failed password for invalid user oracle from 185.132.53.14 port 33402 ssh2
Oct  8 11:52:35 server sshd[22457]: Failed password for root from 185.132.53.14 port 33592 ssh2

Oct  8 09:38:37 sd-69548 sshd[84133]: Unable to negotiate with 185.132.53.14 port 35272: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
Oct  8 09:38:55 sd-69548 sshd[84153]: Unable to negotiate with 185.132.53.14 port 58052: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
...

[N3.H3.VM3] Port Scanner Detected Blocked by UFW

2020-10-04 10:40:34.849649-0500  localhost sshd[74206]: Failed password for root from 185.132.53.14 port 35032 ssh2

Oct  4 10:17:28 server2 sshd\[32424\]: User root from vps32.virtual4host.pt not allowed because not listed in AllowUsers
Oct  4 10:17:45 server2 sshd\[32427\]: User root from vps32.virtual4host.pt not allowed because not listed in AllowUsers
Oct  4 10:18:01 server2 sshd\[32431\]: User root from vps32.virtual4host.pt not allowed because not listed in AllowUsers
Oct  4 10:18:18 server2 sshd\[32462\]: User root from vps32.virtual4host.pt not allowed because not listed in AllowUsers
Oct  4 10:18:36 server2 sshd\[32464\]: Invalid user telnet from 185.132.53.14
Oct  4 10:18:53 server2 sshd\[32470\]: Invalid user ubnt from 185.132.53.14

The sucker tried to brute force my teeny tiny SSH server

Sep 29 16:55:37 XXX sshd[41741]: Invalid user oracle from 185.132.53.14 port 40844

Sep 28 20:06:02 OPSO sshd\[1962\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.132.53.14  user=root
Sep 28 20:06:04 OPSO sshd\[1962\]: Failed password for root from 185.132.53.14 port 48780 ssh2
Sep 28 20:06:18 OPSO sshd\[2032\]: Invalid user oracle from 185.132.53.14 port 43816
Sep 28 20:06:18 OPSO sshd\[2032\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.132.53.14
Sep 28 20:06:20 OPSO sshd\[2032\]: Failed password for invalid user oracle from 185.132.53.14 port 43816 ssh2

Time:     Mon Sep 28 12:03:01 2020 +0200
IP:       185.132.53.14 (DE/Germany/32.virtual4host.pt)
Failures: 5 (sshd)
Interval: 3600 seconds
Blocked:  Permanent Block [LF_SSHD]

Log entries:

Sep 28 12:01:36 3-1 sshd[5014]: Did not receive identification string from 185.132.53.14 port 47220
Sep 28 12:02:23 3-1 sshd[5054]: Failed password for root from 185.132.53.14 port 53030 ssh2
Sep 28 12:02:38 3-1 sshd[5072]: Invalid user oracle from 185.132.53.14 port 47438
Sep 28 12:02:39 3-1 sshd[5072]: Failed password for invalid user oracle from 185.132.53.14 port 47438 ssh2
Sep 28 12:02:57 3-1 sshd[5081]: Failed password for root from 185.132.53.14 port 41860 ssh2

Invalid user admin from 185.132.53.115 port 35110

Oct 13 10:06:29 ns1 sshd[78677]: Did not receive identification string from 185.132.53.115 port 44168
Oct 13 10:06:33 ns1 sshd[78678]: Unable to negotiate with 185.132.53.115 port 40660: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
Oct 13 10:06:49 ns1 sshd[78680]: Unable to negotiate with 185.132.53.115 port 41618: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
Oct 13 10:07:05 ns1 sshd[78682]: Unable to negotiate with 185.132.53.115 port 42644: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
Oct 13 10:07:20 ns1 sshd[78684]: Unable to negotiate with 185.132.53.115 port 43726: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-e
...

Oct 12 20:59:42 targaryen sshd[6336]: Invalid user admin from 185.132.53.115
Oct 12 20:59:56 targaryen sshd[6338]: Invalid user admin from 185.132.53.115
Oct 12 21:00:12 targaryen sshd[6343]: Invalid user admin from 185.132.53.115
Oct 12 21:00:27 targaryen sshd[6345]: Invalid user admin from 185.132.53.115
...

SSH Brute Force (V)

Unauthorized connection attempt detected from IP address 185.132.53.85 to port 22

Oct  6 22:25:15 nas sshd[30358]: Failed password for root from 185.132.53.115 port 42610 ssh2
Oct  6 22:25:31 nas sshd[30780]: Failed password for root from 185.132.53.115 port 40618 ssh2
...

Oct  6 11:27:26 alfc-lms-prod01 sshd\[25821\]: Invalid user user from 185.132.53.124
Oct  6 11:27:33 alfc-lms-prod01 sshd\[25825\]: Invalid user git from 185.132.53.124
Oct  6 11:27:41 alfc-lms-prod01 sshd\[25827\]: Invalid user postgres from 185.132.53.124
...

Icarus honeypot on github

Oct  6 11:27:26 alfc-lms-prod01 sshd\[25821\]: Invalid user user from 185.132.53.124
Oct  6 11:27:33 alfc-lms-prod01 sshd\[25825\]: Invalid user git from 185.132.53.124
Oct  6 11:27:41 alfc-lms-prod01 sshd\[25827\]: Invalid user postgres from 185.132.53.124
...

Oct  6 06:18:41 ns382633 sshd\[16857\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.132.53.115  user=root
Oct  6 06:18:43 ns382633 sshd\[16857\]: Failed password for root from 185.132.53.115 port 39806 ssh2
Oct  6 06:18:55 ns382633 sshd\[16861\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.132.53.115  user=root
Oct  6 06:18:58 ns382633 sshd\[16861\]: Failed password for root from 185.132.53.115 port 33824 ssh2
Oct  6 06:19:11 ns382633 sshd\[17121\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.132.53.115  user=root

[N10.H2.VM2] Port Scanner Detected Blocked by UFW

fail2ban detected bruce force on ssh iptables

frenzy

 TCP (SYN) 185.132.53.124:58330 -> port 22, len 48

Oct  4 23:48:13 vps647732 sshd[7976]: Failed password for root from 185.132.53.85 port 51540 ssh2
...

May 24 22:27:06 legacy sshd[11601]: Failed password for root from 64.225.25.59 port 43720 ssh2
May 24 22:30:34 legacy sshd[11742]: Failed password for root from 64.225.25.59 port 48906 ssh2
May 24 22:34:01 legacy sshd[11843]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.225.25.59
...

May 24 22:46:35 vps sshd[696659]: Failed password for root from 109.173.108.35 port 49200 ssh2
May 24 22:50:15 vps sshd[715009]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=broadband-109-173-108-35.ip.moscow.rt.ru  user=root
May 24 22:50:17 vps sshd[715009]: Failed password for root from 109.173.108.35 port 55360 ssh2
May 24 22:53:53 vps sshd[727930]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=broadband-109-173-108-35.ip.moscow.rt.ru  user=root
May 24 22:53:55 vps sshd[727930]: Failed password for root from 109.173.108.35 port 33288 ssh2
...

May 24 22:56:45 PorscheCustomer sshd[24537]: Failed password for root from 106.12.175.218 port 40964 ssh2
May 24 23:00:58 PorscheCustomer sshd[24674]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.175.218
May 24 23:01:00 PorscheCustomer sshd[24674]: Failed password for invalid user camera from 106.12.175.218 port 40064 ssh2
...

SSH Brute-Forcing (server2)

Unauthorized connection attempt detected from IP address 113.204.148.2 to port 6378

May 24 22:58:40 abendstille sshd\[5406\]: Invalid user hunter from 150.109.34.190
May 24 22:58:40 abendstille sshd\[5406\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=150.109.34.190
May 24 22:58:42 abendstille sshd\[5406\]: Failed password for invalid user hunter from 150.109.34.190 port 45128 ssh2
May 24 23:02:41 abendstille sshd\[9532\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=150.109.34.190  user=root
May 24 23:02:43 abendstille sshd\[9532\]: Failed password for root from 150.109.34.190 port 51624 ssh2
...

May 24 22:32:01 wordpress wordpress(www.ruhnke.cloud)[98824]: Blocked authentication attempt for admin from ::ffff:134.209.123.101

Unauthorized connection attempt from IP address 167.71.159.202 on Port 3389(RDP)

May 24 22:31:39 pve1 sshd[2470]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.233.182.23 
May 24 22:31:41 pve1 sshd[2470]: Failed password for invalid user hung from 49.233.182.23 port 32972 ssh2
...

May 24 23:46:57 pkdns2 sshd\[20462\]: Failed password for root from 112.85.42.72 port 26241 ssh2May 24 23:47:00 pkdns2 sshd\[20462\]: Failed password for root from 112.85.42.72 port 26241 ssh2May 24 23:47:03 pkdns2 sshd\[20462\]: Failed password for root from 112.85.42.72 port 26241 ssh2May 24 23:49:30 pkdns2 sshd\[20571\]: Failed password for root from 112.85.42.72 port 58606 ssh2May 24 23:49:33 pkdns2 sshd\[20571\]: Failed password for root from 112.85.42.72 port 58606 ssh2May 24 23:49:35 pkdns2 sshd\[20571\]: Failed password for root from 112.85.42.72 port 58606 ssh2
...

Wordpress_xmlrpc_attack

May 24 22:45:04 vps647732 sshd[25905]: Failed password for root from 189.62.69.106 port 41632 ssh2
...

May 24 22:26:29 home sshd[30358]: Failed password for root from 152.32.252.251 port 40048 ssh2
May 24 22:32:01 home sshd[30844]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.32.252.251
May 24 22:32:02 home sshd[30844]: Failed password for invalid user postfix from 152.32.252.251 port 46788 ssh2
...

May 24 22:27:50 melroy-server sshd[19567]: Failed password for root from 202.154.63.70 port 48776 ssh2
...

Port probing on unauthorized port 23