SSH Brute Force

Oct  7 18:45:26 vps691689 sshd[8281]: Failed password for root from 106.12.116.237 port 33782 ssh2
Oct  7 18:50:45 vps691689 sshd[8390]: Failed password for root from 106.12.116.237 port 41266 ssh2
...

Oct  4 00:26:52 markkoudstaal sshd[2169]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.116.237
Oct  4 00:26:54 markkoudstaal sshd[2169]: Failed password for invalid user nakamuranakamura. from 106.12.116.237 port 60964 ssh2
Oct  4 00:31:07 markkoudstaal sshd[2580]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.116.237

Oct  2 15:54:09 areeb-Workstation sshd[23904]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.116.237
Oct  2 15:54:11 areeb-Workstation sshd[23904]: Failed password for invalid user admin from 106.12.116.237 port 36974 ssh2
...

Sep 27 21:34:34 auw2 sshd\[18620\]: Invalid user geert from 106.12.116.237
Sep 27 21:34:34 auw2 sshd\[18620\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.116.237
Sep 27 21:34:36 auw2 sshd\[18620\]: Failed password for invalid user geert from 106.12.116.237 port 40438 ssh2
Sep 27 21:40:03 auw2 sshd\[19247\]: Invalid user share from 106.12.116.237
Sep 27 21:40:03 auw2 sshd\[19247\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.116.237

2019-09-22T05:00:01.461256abusebot-7.cloudsearch.cf sshd\[20882\]: Invalid user ks from 106.12.116.237 port 58940

Sep 13 23:56:25 rpi sshd[15347]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.116.237 
Sep 13 23:56:27 rpi sshd[15347]: Failed password for invalid user mcserver from 106.12.116.237 port 40678 ssh2

Automatic report - Banned IP Access

Aug 31 01:00:32 plusreed sshd[25625]: Invalid user musikbot from 106.12.116.237
...

Aug 27 14:32:18 vps691689 sshd[2805]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.116.237
Aug 27 14:32:19 vps691689 sshd[2805]: Failed password for invalid user ubnt from 106.12.116.237 port 51616 ssh2
...

Invalid user bruna from 106.12.116.237 port 43640

Invalid user bruna from 106.12.116.237 port 43640

Invalid user izumin from 106.12.116.75 port 45404

Oct 12 22:58:28 mavik sshd[13372]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.116.75
Oct 12 22:58:30 mavik sshd[13372]: Failed password for invalid user nishida from 106.12.116.75 port 49788 ssh2
Oct 12 23:02:48 mavik sshd[14180]: Invalid user test from 106.12.116.75
Oct 12 23:02:48 mavik sshd[14180]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.116.75
Oct 12 23:02:50 mavik sshd[14180]: Failed password for invalid user test from 106.12.116.75 port 52676 ssh2
...

Aug 24 00:00:07 plex-server sshd[2398342]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.116.75 
Aug 24 00:00:07 plex-server sshd[2398342]: Invalid user jdc from 106.12.116.75 port 47352
Aug 24 00:00:09 plex-server sshd[2398342]: Failed password for invalid user jdc from 106.12.116.75 port 47352 ssh2
Aug 24 00:05:09 plex-server sshd[2400373]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.116.75  user=root
Aug 24 00:05:10 plex-server sshd[2400373]: Failed password for root from 106.12.116.75 port 54128 ssh2
...

2020-08-17T15:06:00.618799vps-d63064a2 sshd[1017063]: Invalid user chen from 106.12.116.75 port 35212
2020-08-17T15:06:03.232545vps-d63064a2 sshd[1017063]: Failed password for invalid user chen from 106.12.116.75 port 35212 ssh2
2020-08-17T15:10:49.617548vps-d63064a2 sshd[1024011]: Invalid user bot from 106.12.116.75 port 57132
2020-08-17T15:10:49.631775vps-d63064a2 sshd[1024011]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.116.75
2020-08-17T15:10:49.617548vps-d63064a2 sshd[1024011]: Invalid user bot from 106.12.116.75 port 57132
2020-08-17T15:10:51.577875vps-d63064a2 sshd[1024011]: Failed password for invalid user bot from 106.12.116.75 port 57132 ssh2
...

ssh brute force

2020-04-28T17:10:27.380201amanda2.illicoweb.com sshd\[17266\]: Invalid user sonbol from 106.12.116.209 port 53836
2020-04-28T17:10:27.386354amanda2.illicoweb.com sshd\[17266\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.116.209
2020-04-28T17:10:29.759043amanda2.illicoweb.com sshd\[17266\]: Failed password for invalid user sonbol from 106.12.116.209 port 53836 ssh2
2020-04-28T17:14:31.434946amanda2.illicoweb.com sshd\[17383\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.116.209  user=root
2020-04-28T17:14:33.637123amanda2.illicoweb.com sshd\[17383\]: Failed password for root from 106.12.116.209 port 36166 ssh2
...

Apr 25 11:49:40 nextcloud sshd\[32627\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.116.185  user=root
Apr 25 11:49:42 nextcloud sshd\[32627\]: Failed password for root from 106.12.116.185 port 49840 ssh2
Apr 25 11:57:49 nextcloud sshd\[9697\]: Invalid user admin from 106.12.116.185
Apr 25 11:57:49 nextcloud sshd\[9697\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.116.185

Apr 24 22:40:33 sso sshd[10577]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.116.185
Apr 24 22:40:35 sso sshd[10577]: Failed password for invalid user augustine from 106.12.116.185 port 38940 ssh2
...

Invalid user ihc from 106.12.116.209 port 37110

$f2bV_matches

SSH login attempts.

Mar 22 14:40:55 sd-53420 sshd\[30177\]: Invalid user pengliang from 106.12.116.185
Mar 22 14:40:55 sd-53420 sshd\[30177\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.116.185
Mar 22 14:40:58 sd-53420 sshd\[30177\]: Failed password for invalid user pengliang from 106.12.116.185 port 43934 ssh2
Mar 22 14:43:51 sd-53420 sshd\[31030\]: Invalid user hadoop from 106.12.116.185
Mar 22 14:43:51 sd-53420 sshd\[31030\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.116.185
...

Invalid user attachments from 106.12.116.209 port 39940

5x Failed Password

Lines containing failures of 106.12.116.209
Jan 28 01:39:19 shared11 sshd[12712]: Invalid user malik from 106.12.116.209 port 57950
Jan 28 01:39:19 shared11 sshd[12712]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.116.209
Jan 28 01:39:21 shared11 sshd[12712]: Failed password for invalid user malik from 106.12.116.209 port 57950 ssh2
Jan 28 01:39:21 shared11 sshd[12712]: Received disconnect from 106.12.116.209 port 57950:11: Bye Bye [preauth]
Jan 28 01:39:21 shared11 sshd[12712]: Disconnected from invalid user malik 106.12.116.209 port 57950 [preauth]


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=106.12.116.209

SSH invalid-user multiple login try

Apr 23 19:59:06 mail sshd[28164]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.93.251
Apr 23 19:59:08 mail sshd[28164]: Failed password for invalid user rk from 106.12.93.251 port 36276 ssh2
Apr 23 20:05:12 mail sshd[29438]: Failed password for root from 106.12.93.251 port 51692 ssh2

Apr 23 18:28:46 ns382633 sshd\[29054\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.229.116.227  user=root
Apr 23 18:28:48 ns382633 sshd\[29054\]: Failed password for root from 111.229.116.227 port 53710 ssh2
Apr 23 18:38:20 ns382633 sshd\[30784\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.229.116.227  user=root
Apr 23 18:38:22 ns382633 sshd\[30784\]: Failed password for root from 111.229.116.227 port 49128 ssh2
Apr 23 18:44:37 ns382633 sshd\[31903\]: Invalid user up from 111.229.116.227 port 34544
Apr 23 18:44:37 ns382633 sshd\[31903\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.229.116.227

Unauthorized connection attempt from IP address 125.212.172.122 on Port 445(SMB)

Unauthorised access (Apr 23) SRC=46.98.48.113 LEN=52 TTL=120 ID=3318 DF TCP DPT=445 WINDOW=8192 SYN

RU_INSITINVEST-MNT_<177>1587660303 [1:2010935:3] ET SCAN Suspicious inbound to MSSQL port 1433 [Classification: Potentially Bad Traffic] [Priority: 2]:  {TCP} 185.7.180.47:22013

2020-04-23T17:06:32.099444ionos.janbro.de sshd[56852]: Invalid user zx from 121.204.208.167 port 45355
2020-04-23T17:06:34.079735ionos.janbro.de sshd[56852]: Failed password for invalid user zx from 121.204.208.167 port 45355 ssh2
2020-04-23T17:10:33.601575ionos.janbro.de sshd[56861]: Invalid user tester from 121.204.208.167 port 37228
2020-04-23T17:10:33.876727ionos.janbro.de sshd[56861]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.204.208.167
2020-04-23T17:10:33.601575ionos.janbro.de sshd[56861]: Invalid user tester from 121.204.208.167 port 37228
2020-04-23T17:10:36.446029ionos.janbro.de sshd[56861]: Failed password for invalid user tester from 121.204.208.167 port 37228 ssh2
2020-04-23T17:14:36.035036ionos.janbro.de sshd[56865]: Invalid user if from 121.204.208.167 port 57334
2020-04-23T17:14:36.214269ionos.janbro.de sshd[56865]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.204.208.167
20
...

SSH brute-force: detected 61 distinct usernames within a 24-hour window.

Unauthorized connection attempt detected from IP address 1.222.126.235 to port 445 [T]

Apr 23 19:48:21 MainVPS sshd[30411]: Invalid user admin from 40.117.137.177 port 49494
Apr 23 19:48:21 MainVPS sshd[30411]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=40.117.137.177
Apr 23 19:48:21 MainVPS sshd[30411]: Invalid user admin from 40.117.137.177 port 49494
Apr 23 19:48:23 MainVPS sshd[30411]: Failed password for invalid user admin from 40.117.137.177 port 49494 ssh2
Apr 23 19:54:31 MainVPS sshd[3254]: Invalid user ubuntu from 40.117.137.177 port 41318
...

"Unauthorized connection attempt on SSHD detected"

Dear Sir / Madam, 

Yesterday, my close friend (Simona Simova) was contacted via fake Facebook profile to be informed that she has a profile on a escort website. While researching via the German phone number used in the advert, we have came across more ads. These profiles are created without her permission and she is now very upset. 

Here is a list of the profiles we have found: 

- https://escortsitesofia.com/de/eleonora-7/ (5.45.69.188)
- https://escortsitesofia.com/de/sia-9/ (5.45.69.188)


We have already hired a lawyer in Germany who will escalate the issue to the authorities.

$f2bV_matches

Honeypot attack, port: 445, PTR: static-62-12-115-155.ips.angani.co.

Apr 23 19:45:50 DAAP sshd[24898]: Invalid user zj from 80.211.245.129 port 58328
Apr 23 19:45:50 DAAP sshd[24898]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.245.129
Apr 23 19:45:50 DAAP sshd[24898]: Invalid user zj from 80.211.245.129 port 58328
Apr 23 19:45:52 DAAP sshd[24898]: Failed password for invalid user zj from 80.211.245.129 port 58328 ssh2
Apr 23 19:51:42 DAAP sshd[24978]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.245.129  user=root
Apr 23 19:51:44 DAAP sshd[24978]: Failed password for root from 80.211.245.129 port 44152 ssh2
...