srvr3: (mod_security) mod_security (id:920350) triggered by 139.162.106.181 (US/United States/scan-67.security.ipip.net): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: 2020/09/10 02:24:05 [error] 277189#0: *1327 [client 139.162.106.181] ModSecurity: Access denied with code 406 (phase 2). Matched "Operator `Rx' with parameter `^[\d.:]+$' against variable `REQUEST_HEADERS:Host'  [redacted] [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "718"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [redacted] [severity "4"] [ver "OWASP_CRS/3.3.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [redacted] [uri "/"] [unique_id "159969744587.159482"] [ref "o0,11v21,11"], client: 139.162.106.181, [redacted] request: "GET / HTTP/1.1" [redacted]

2020-09-09 09:51:27 server sshd[21645]: Failed password for invalid user nagios from 139.59.40.240 port 60838 ssh2

Icarus honeypot on github

 UDP 106.75.141.223:58914 -> port 30311, len 72

$f2bV_matches

Sep 10 07:48:07 lnxmysql61 sshd[24099]: Failed password for root from 195.206.105.217 port 45888 ssh2
Sep 10 07:48:09 lnxmysql61 sshd[24099]: Failed password for root from 195.206.105.217 port 45888 ssh2
Sep 10 07:48:11 lnxmysql61 sshd[24099]: Failed password for root from 195.206.105.217 port 45888 ssh2
Sep 10 07:48:14 lnxmysql61 sshd[24099]: Failed password for root from 195.206.105.217 port 45888 ssh2

Sep 10 06:11:48 haigwepa sshd[14655]: Failed password for root from 45.232.244.5 port 49920 ssh2
...

2020-09-10T05:24:00.290942shield sshd\[5126\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.89.188.167  user=root
2020-09-10T05:24:02.483790shield sshd\[5126\]: Failed password for root from 159.89.188.167 port 38058 ssh2
2020-09-10T05:28:28.634789shield sshd\[5351\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.89.188.167  user=root
2020-09-10T05:28:30.621447shield sshd\[5351\]: Failed password for root from 159.89.188.167 port 43648 ssh2
2020-09-10T05:32:57.918077shield sshd\[5878\]: Invalid user service from 159.89.188.167 port 49248
2020-09-10T05:32:57.925013shield sshd\[5878\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.89.188.167

Port scan on 1 port(s): 4899

Icarus honeypot on github

Sep 10 04:18:24 vlre-nyc-1 sshd\[9456\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=101.71.251.202  user=root
Sep 10 04:18:25 vlre-nyc-1 sshd\[9456\]: Failed password for root from 101.71.251.202 port 53496 ssh2
Sep 10 04:21:47 vlre-nyc-1 sshd\[9497\]: Invalid user natasha from 101.71.251.202
Sep 10 04:21:47 vlre-nyc-1 sshd\[9497\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=101.71.251.202
Sep 10 04:21:50 vlre-nyc-1 sshd\[9497\]: Failed password for invalid user natasha from 101.71.251.202 port 60314 ssh2
...

1599670549 - 09/09/2020 18:55:49 Host: 203.210.134.7/203.210.134.7 Port: 445 TCP Blocked

 TCP (SYN) 183.83.217.190:46611 -> port 22, len 44

(sshd) Failed SSH login from 193.228.91.123 (GB/United Kingdom/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Sep 10 05:57:42 cloud16 sshd[29863]: Did not receive identification string from 193.228.91.123
Sep 10 06:02:20 cloud16 sshd[1061]: Invalid user user from 193.228.91.123
Sep 10 06:02:47 cloud16 sshd[1378]: Invalid user git from 193.228.91.123
Sep 10 06:03:15 cloud16 sshd[1448]: Invalid user postgres from 193.228.91.123
Sep 10 06:03:44 cloud16 sshd[1701]: Invalid user oracle from 193.228.91.123

SSH Brute-Force reported by Fail2Ban