SSH Brute-Force attacks

SSH bruteforce

Apr  7 21:12:04 xeon sshd[58649]: Failed password for invalid user rust from 188.166.163.92 port 48974 ssh2

Mar 31 14:44:02 minden010 sshd[11567]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.166.163.92
Mar 31 14:44:04 minden010 sshd[11567]: Failed password for invalid user 12q3wa4esz from 188.166.163.92 port 36678 ssh2
Mar 31 14:48:01 minden010 sshd[13606]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.166.163.92
...

Mar  3 08:01:10 eddieflores sshd\[1358\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.166.163.251  user=root
Mar  3 08:01:11 eddieflores sshd\[1358\]: Failed password for root from 188.166.163.251 port 53090 ssh2
Mar  3 08:01:44 eddieflores sshd\[1379\]: Invalid user oracle from 188.166.163.251
Mar  3 08:01:44 eddieflores sshd\[1379\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.166.163.251
Mar  3 08:01:46 eddieflores sshd\[1379\]: Failed password for invalid user oracle from 188.166.163.251 port 52054 ssh2

Unauthorized connection attempt detected from IP address 188.166.163.246 to port 22 [J]

2020-02-27T13:00:36.872661micro sshd[23004]: Did not receive identification string from 188.166.163.251 port 58476
2020-02-27T13:01:09.604590micro sshd[23076]: Disconnected from 188.166.163.251 port 54360 [preauth]
2020-02-27T13:01:46.934779micro sshd[23078]: Invalid user oracle from 188.166.163.251 port 55754
2020-02-27T13:01:47.032324micro sshd[23078]: Disconnected from 188.166.163.251 port 55754 [preauth]
2020-02-27T13:02:23.862675micro sshd[23137]: Disconnected from 188.166.163.251 port 56912 [preauth]
...

Invalid user oracle from 188.166.163.246 port 49286

Feb 26 01:15:08 gitlab-ci sshd\[7267\]: Invalid user oracle from 188.166.163.246Feb 26 01:15:50 gitlab-ci sshd\[7278\]: Invalid user postgres from 188.166.163.246
...

Feb 20 17:58:13 XXX sshd[29208]: Did not receive identification string from 188.166.163.251
Feb 20 17:58:57 XXX sshd[29373]: User r.r from 188.166.163.251 not allowed because none of user's groups are listed in AllowGroups
Feb 20 17:58:57 XXX sshd[29373]: Received disconnect from 188.166.163.251: 11: Normal Shutdown, Thank you for playing [preauth]
Feb 20 17:59:35 XXX sshd[29393]: Invalid user oracle from 188.166.163.251
Feb 20 17:59:35 XXX sshd[29393]: Received disconnect from 188.166.163.251: 11: Normal Shutdown, Thank you for playing [preauth]
Feb 20 18:00:14 XXX sshd[29538]: User r.r from 188.166.163.251 not allowed because none of user's groups are listed in AllowGroups
Feb 20 18:00:14 XXX sshd[29538]: Received disconnect from 188.166.163.251: 11: Normal Shutdown, Thank you for playing [preauth]
Feb 20 18:00:50 XXX sshd[29707]: User postgres from 188.166.163.251 not allowed because none of user's groups are listed in AllowGroups
Feb 20 18:00:50 XXX sshd[29707]: Rec........
-------------------------------

frenzy

Feb 21 21:28:08 MK-Soft-VM5 sshd[26112]: Failed password for root from 188.166.163.246 port 34324 ssh2
Feb 21 21:28:33 MK-Soft-VM5 sshd[26114]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.166.163.246 
...

Nov  1 07:17:52 server2 sshd\[7669\]: Invalid user baker from 188.166.163.98
Nov  1 07:17:52 server2 sshd\[7674\]: Invalid user baker from 188.166.163.98
Nov  1 07:17:52 server2 sshd\[7671\]: Invalid user baker from 188.166.163.98
Nov  1 07:17:52 server2 sshd\[7672\]: Invalid user baker from 188.166.163.98
Nov  1 07:17:52 server2 sshd\[7677\]: Invalid user baker from 188.166.163.98
Nov  1 07:17:52 server2 sshd\[7679\]: Invalid user bitrix from 188.166.163.98

2019-10-17T04:40:39.760961shield sshd\[10745\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.166.163.92  user=root
2019-10-17T04:40:41.417551shield sshd\[10745\]: Failed password for root from 188.166.163.92 port 50302 ssh2
2019-10-17T04:44:34.598592shield sshd\[11497\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.166.163.92  user=root
2019-10-17T04:44:36.516177shield sshd\[11497\]: Failed password for root from 188.166.163.92 port 33368 ssh2
2019-10-17T04:48:32.293656shield sshd\[12379\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.166.163.92  user=root

Sep 24 18:38:44 php1 sshd\[8953\]: Invalid user ulrick from 188.166.163.92
Sep 24 18:38:44 php1 sshd\[8953\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.166.163.92
Sep 24 18:38:45 php1 sshd\[8953\]: Failed password for invalid user ulrick from 188.166.163.92 port 45598 ssh2
Sep 24 18:42:49 php1 sshd\[9459\]: Invalid user tchai from 188.166.163.92
Sep 24 18:42:49 php1 sshd\[9459\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.166.163.92

Feb 19 22:58:47 grey postfix/smtpd\[15315\]: NOQUEUE: reject: RCPT from unknown\[222.252.125.103\]: 554 5.7.1 Service unavailable\; Client host \[222.252.125.103\] blocked using dul.dnsbl.sorbs.net\; Dynamic IP Addresses See: http://www.sorbs.net/lookup.shtml\?222.252.125.103\; from=\ to=\ proto=SMTP helo=\
...

Feb 19 22:55:50 sd-53420 sshd\[28293\]: User root from 186.122.149.144 not allowed because none of user's groups are listed in AllowGroups
Feb 19 22:55:50 sd-53420 sshd\[28293\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.122.149.144  user=root
Feb 19 22:55:52 sd-53420 sshd\[28293\]: Failed password for invalid user root from 186.122.149.144 port 37432 ssh2
Feb 19 22:58:37 sd-53420 sshd\[28549\]: Invalid user jenkins from 186.122.149.144
Feb 19 22:58:37 sd-53420 sshd\[28549\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.122.149.144
...

Fail2Ban Ban Triggered

Unauthorized connection attempt from IP address 120.138.125.2 on Port 445(SMB)

Feb 19 11:56:17 wbs sshd\[26710\]: Invalid user postgres from 178.88.115.126
Feb 19 11:56:17 wbs sshd\[26710\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.88.115.126
Feb 19 11:56:19 wbs sshd\[26710\]: Failed password for invalid user postgres from 178.88.115.126 port 43466 ssh2
Feb 19 11:58:56 wbs sshd\[27010\]: Invalid user user from 178.88.115.126
Feb 19 11:58:56 wbs sshd\[27010\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.88.115.126

Feb 19 22:58:15 cvbnet sshd[12136]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.57.140.10 
Feb 19 22:58:18 cvbnet sshd[12136]: Failed password for invalid user Michelle from 189.57.140.10 port 45152 ssh2
...

$f2bV_matches

firewall-block, port(s): 5061/tcp

Feb 19 22:58:41 debian-2gb-nbg1-2 kernel: \[4408733.538013\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=223.71.167.166 DST=195.201.40.59 LEN=36 TOS=0x04 PREC=0x00 TTL=114 ID=64371 PROTO=UDP SPT=36305 DPT=4800 LEN=16

(sshd) Failed SSH login from 200.141.223.79 (BR/Brazil/200-141-223-79.user.veloxzone.com.br): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Feb 20 00:03:23 s1 sshd[24392]: Invalid user nijian from 200.141.223.79 port 55765
Feb 20 00:03:25 s1 sshd[24392]: Failed password for invalid user nijian from 200.141.223.79 port 55765 ssh2
Feb 20 00:04:16 s1 sshd[24429]: Invalid user daniel from 200.141.223.79 port 60751
Feb 20 00:04:18 s1 sshd[24429]: Failed password for invalid user daniel from 200.141.223.79 port 60751 ssh2
Feb 20 00:04:51 s1 sshd[24446]: Invalid user jenkins from 200.141.223.79 port 64149

2020-02-19 15:58:09 dovecot_login authenticator failed for ec2-52-14-10-218.us-east-2.compute.amazonaws.com (xftXkhXO) [52.14.10.218]:61290 I=[192.147.25.65]:587: 535 Incorrect authentication data (set_id=mrm@lerctr.org)
2020-02-19 15:58:26 dovecot_login authenticator failed for ec2-52-14-10-218.us-east-2.compute.amazonaws.com (GgcaVVFA) [52.14.10.218]:62221 I=[192.147.25.65]:587: 535 Incorrect authentication data (set_id=mrm@lerctr.org)
2020-02-19 15:58:44 dovecot_login authenticator failed for ec2-52-14-10-218.us-east-2.compute.amazonaws.com (r1mnI2) [52.14.10.218]:62893 I=[192.147.25.65]:587: 535 Incorrect authentication data (set_id=mrm@lerctr.org)
...

2020-02-19T15:36:48.8545651495-001 sshd[49158]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.49.150
2020-02-19T15:36:48.8468311495-001 sshd[49158]: Invalid user nagios from 106.12.49.150 port 48948
2020-02-19T15:36:50.1745311495-001 sshd[49158]: Failed password for invalid user nagios from 106.12.49.150 port 48948 ssh2
2020-02-19T16:39:02.0137291495-001 sshd[52566]: Invalid user jigang from 106.12.49.150 port 43088
2020-02-19T16:39:02.0219441495-001 sshd[52566]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.49.150
2020-02-19T16:39:02.0137291495-001 sshd[52566]: Invalid user jigang from 106.12.49.150 port 43088
2020-02-19T16:39:03.9539761495-001 sshd[52566]: Failed password for invalid user jigang from 106.12.49.150 port 43088 ssh2
2020-02-19T16:42:00.9964151495-001 sshd[52698]: Invalid user speech-dispatcher from 106.12.49.150 port 35740
2020-02-19T16:42:01.0056901495-001 sshd[52698]: pam
...

2020-02-19T21:55:13.710725abusebot-2.cloudsearch.cf sshd[13167]: Invalid user debian-spamd from 177.130.110.70 port 40106
2020-02-19T21:55:13.717632abusebot-2.cloudsearch.cf sshd[13167]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.130.110.70
2020-02-19T21:55:13.710725abusebot-2.cloudsearch.cf sshd[13167]: Invalid user debian-spamd from 177.130.110.70 port 40106
2020-02-19T21:55:15.954644abusebot-2.cloudsearch.cf sshd[13167]: Failed password for invalid user debian-spamd from 177.130.110.70 port 40106 ssh2
2020-02-19T21:58:33.041823abusebot-2.cloudsearch.cf sshd[13381]: Invalid user freeswitch from 177.130.110.70 port 39814
2020-02-19T21:58:33.050158abusebot-2.cloudsearch.cf sshd[13381]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.130.110.70
2020-02-19T21:58:33.041823abusebot-2.cloudsearch.cf sshd[13381]: Invalid user freeswitch from 177.130.110.70 port 39814
2020-02-19T21:58:35.076534abusebo
...

Port probing on unauthorized port 445

Feb 19 11:55:17 php1 sshd\[18290\]: Invalid user ec2-user from 62.234.66.50
Feb 19 11:55:17 php1 sshd\[18290\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.234.66.50
Feb 19 11:55:20 php1 sshd\[18290\]: Failed password for invalid user ec2-user from 62.234.66.50 port 38727 ssh2
Feb 19 11:58:38 php1 sshd\[18613\]: Invalid user vmail from 62.234.66.50
Feb 19 11:58:38 php1 sshd\[18613\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.234.66.50