(sshd) Failed SSH login from 139.59.135.84 (DE/Germany/-): 10 in the last 3600 secs

 UDP 80.82.77.245:59588 -> port 997, len 57

Sep  7 12:25:01 pkdns2 sshd\[11584\]: Invalid user roadstar from 119.254.12.66Sep  7 12:25:03 pkdns2 sshd\[11584\]: Failed password for invalid user roadstar from 119.254.12.66 port 50992 ssh2Sep  7 12:28:44 pkdns2 sshd\[11793\]: Invalid user iloveyou6 from 119.254.12.66Sep  7 12:28:46 pkdns2 sshd\[11793\]: Failed password for invalid user iloveyou6 from 119.254.12.66 port 53328 ssh2Sep  7 12:32:19 pkdns2 sshd\[11986\]: Invalid user PACKER from 119.254.12.66Sep  7 12:32:21 pkdns2 sshd\[11986\]: Failed password for invalid user PACKER from 119.254.12.66 port 55664 ssh2
...

Cluster member 67.227.229.95 (US/United States/host.cjthedj97.me) said, DENY 14.231.239.215, Reason:[(sshd) Failed SSH login from 14.231.239.215 (VN/Vietnam/static.vnpt.vn): 1 in the last 3600 secs]; Ports: *; Direction: inout; Trigger: LF_CLUSTER

176.122.169.95 (US/United States/-), 6 distributed sshd attacks on account [root] in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_DISTATTACK; Logs: Sep  7 10:01:35 server4 sshd[25246]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.206.45.16  user=root
Sep  7 09:55:33 server4 sshd[22065]: Failed password for root from 176.122.169.95 port 41296 ssh2
Sep  7 09:50:11 server4 sshd[19237]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=101.89.92.230  user=root
Sep  7 09:50:13 server4 sshd[19237]: Failed password for root from 101.89.92.230 port 59948 ssh2
Sep  7 09:49:41 server4 sshd[18977]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.192.204  user=root
Sep  7 09:49:42 server4 sshd[18977]: Failed password for root from 106.12.192.204 port 48552 ssh2

IP Addresses Blocked:

123.206.45.16 (CN/China/-)

Sep  7 16:46:16 l02a sshd[19968]: Invalid user admin from 62.210.37.82
Sep  7 16:46:16 l02a sshd[19968]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62-210-37-82.rev.poneytelecom.eu 
Sep  7 16:46:16 l02a sshd[19968]: Invalid user admin from 62.210.37.82
Sep  7 16:46:18 l02a sshd[19968]: Failed password for invalid user admin from 62.210.37.82 port 36308 ssh2

Sep  7 06:56:40 [host] sshd[18020]: Invalid user a
Sep  7 06:56:40 [host] sshd[18020]: pam_unix(sshd:
Sep  7 06:56:42 [host] sshd[18020]: Failed passwor

20/9/6@16:13:51: FAIL: Alarm-Network address from=220.132.72.176
20/9/6@16:13:51: FAIL: Alarm-Network address from=220.132.72.176
...

detected by Fail2Ban

Received: from 10.197.32.140
 by atlas116.free.mail.bf1.yahoo.com with HTTP; Sat, 5 Sep 2020 18:48:07 +0000
Return-Path: 
Received: from 209.85.217.66 (EHLO mail-vs1-f66.google.com)
 by 10.197.32.140 with SMTPs; Sat, 5 Sep 2020 18:48:07 +0000
X-Originating-Ip: [209.85.217.66]
Received-SPF: pass (domain of gmail.com designates 209.85.217.66 as permitted sender)
Authentication-Results: atlas116.free.mail.bf1.yahoo.com;
 dkim=pass header.i=@gmail.com header.s=20161025;
 spf=pass smtp.mailfrom=gmail.com;
 dmarc=success(p=NONE,sp=QUARANTINE) header.from=gmail.com;
X-Apparently-To: ledlib@yahoo.com; Sat, 5 Sep 2020 18:48:0

2020-09-07T12:33:47.231943abusebot-6.cloudsearch.cf sshd[14888]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.88.112.71  user=root
2020-09-07T12:33:49.221767abusebot-6.cloudsearch.cf sshd[14888]: Failed password for root from 49.88.112.71 port 35164 ssh2
2020-09-07T12:33:51.359788abusebot-6.cloudsearch.cf sshd[14888]: Failed password for root from 49.88.112.71 port 35164 ssh2
2020-09-07T12:33:47.231943abusebot-6.cloudsearch.cf sshd[14888]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.88.112.71  user=root
2020-09-07T12:33:49.221767abusebot-6.cloudsearch.cf sshd[14888]: Failed password for root from 49.88.112.71 port 35164 ssh2
2020-09-07T12:33:51.359788abusebot-6.cloudsearch.cf sshd[14888]: Failed password for root from 49.88.112.71 port 35164 ssh2
2020-09-07T12:33:47.231943abusebot-6.cloudsearch.cf sshd[14888]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rho
...

1599410837 - 09/06/2020 18:47:17 Host: 178.138.193.31/178.138.193.31 Port: 445 TCP Blocked

Sep  7 17:49:34 rancher-0 sshd[1483491]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.238.19  user=root
Sep  7 17:49:36 rancher-0 sshd[1483491]: Failed password for root from 180.76.238.19 port 60824 ssh2
...

SSH_scan

Automatic report - Banned IP Access