(sshd) Failed SSH login from 106.12.175.86 (CN/China/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Oct  9 12:53:28 server2 sshd[4009]: Invalid user library1 from 106.12.175.86
Oct  9 12:53:28 server2 sshd[4009]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.175.86 
Oct  9 12:53:30 server2 sshd[4009]: Failed password for invalid user library1 from 106.12.175.86 port 49934 ssh2
Oct  9 13:00:58 server2 sshd[7956]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.175.86  user=root
Oct  9 13:01:00 server2 sshd[7956]: Failed password for root from 106.12.175.86 port 55500 ssh2

Oct  9 11:09:38 scw-gallant-ride sshd[9221]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.175.86

Sep  7 14:51:19 our-server-hostname sshd[1682]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.175.86  user=r.r
Sep  7 14:51:22 our-server-hostname sshd[1682]: Failed password for r.r from 106.12.175.86 port 52997 ssh2
Sep  7 14:57:36 our-server-hostname sshd[2664]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.175.86  user=r.r
Sep  7 14:57:38 our-server-hostname sshd[2664]: Failed password for r.r from 106.12.175.86 port 56479 ssh2
Sep  7 15:08:07 our-server-hostname sshd[4409]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.175.86  user=r.r
Sep  7 15:08:09 our-server-hostname sshd[4409]: Failed password for r.r from 106.12.175.86 port 57084 ssh2
Sep  7 15:13:22 our-server-hostname sshd[5446]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.175.86  user=r.r
Sep  7 15:13:24 our-ser........
-------------------------------

Sep  8 09:44:25 home sshd[1241152]: Failed password for root from 106.12.175.86 port 42978 ssh2
Sep  8 09:48:42 home sshd[1241604]: Invalid user smmsp from 106.12.175.86 port 38395
Sep  8 09:48:42 home sshd[1241604]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.175.86 
Sep  8 09:48:42 home sshd[1241604]: Invalid user smmsp from 106.12.175.86 port 38395
Sep  8 09:48:43 home sshd[1241604]: Failed password for invalid user smmsp from 106.12.175.86 port 38395 ssh2
...

SSH login attempts.

2020-08-26T04:07:37.670282shield sshd\[25122\]: Invalid user tushar from 106.12.175.86 port 44894
2020-08-26T04:07:37.694046shield sshd\[25122\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.175.86
2020-08-26T04:07:39.829787shield sshd\[25122\]: Failed password for invalid user tushar from 106.12.175.86 port 44894 ssh2
2020-08-26T04:10:43.168804shield sshd\[25861\]: Invalid user yasmina from 106.12.175.86 port 35744
2020-08-26T04:10:43.184927shield sshd\[25861\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.175.86

Aug 26 00:26:33 db sshd[21754]: Invalid user ljl from 106.12.175.86 port 37000
...

sshd: Failed password for .... from 106.12.175.86 port 50394 ssh2 (8 attempts)

Sep 13 12:23:52 root sshd[20006]: Failed password for root from 106.12.175.38 port 56294 ssh2
Sep 13 12:29:15 root sshd[20680]: Failed password for root from 106.12.175.38 port 57610 ssh2
...

Sep 13 05:58:28 fhem-rasp sshd[31799]: Failed password for root from 106.12.175.38 port 37522 ssh2
Sep 13 05:58:30 fhem-rasp sshd[31799]: Disconnected from authenticating user root 106.12.175.38 port 37522 [preauth]
...

Sep 12 20:09:10 abendstille sshd\[19048\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.175.38  user=root
Sep 12 20:09:12 abendstille sshd\[19048\]: Failed password for root from 106.12.175.38 port 45450 ssh2
Sep 12 20:11:00 abendstille sshd\[20685\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.175.38  user=root
Sep 12 20:11:02 abendstille sshd\[20685\]: Failed password for root from 106.12.175.38 port 41330 ssh2
Sep 12 20:12:58 abendstille sshd\[22466\]: Invalid user administrator from 106.12.175.38
...

SSH brute-force attempt

2020-08-30T11:04:54.103690correo.[domain] sshd[45580]: Failed password for invalid user ubuntu from 106.12.175.226 port 48534 ssh2 2020-08-30T11:25:35.872252correo.[domain] sshd[47878]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.175.226 user=root 2020-08-30T11:25:37.614525correo.[domain] sshd[47878]: Failed password for root from 106.12.175.226 port 49432 ssh2 ...

Aug 30 15:36:40 NPSTNNYC01T sshd[29528]: Failed password for root from 106.12.175.226 port 45024 ssh2
Aug 30 15:39:01 NPSTNNYC01T sshd[29750]: Failed password for root from 106.12.175.226 port 52276 ssh2
Aug 30 15:41:21 NPSTNNYC01T sshd[29947]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.175.226
...

Invalid user wlp from 106.12.175.38 port 52960

Aug 26 13:52:59 mockhub sshd[29432]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.175.218
Aug 26 13:53:01 mockhub sshd[29432]: Failed password for invalid user and from 106.12.175.218 port 39430 ssh2
...

Aug 25 17:26:34 server sshd[62120]: Failed password for root from 106.12.175.218 port 36784 ssh2
Aug 25 17:29:47 server sshd[63574]: Failed password for root from 106.12.175.218 port 42074 ssh2
Aug 25 17:33:01 server sshd[65165]: Failed password for invalid user ocp from 106.12.175.218 port 47344 ssh2

Aug 24 17:20:25 instance-2 sshd[21153]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.175.82 
Aug 24 17:20:28 instance-2 sshd[21153]: Failed password for invalid user ccm from 106.12.175.82 port 41276 ssh2
Aug 24 17:22:40 instance-2 sshd[21179]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.175.82

Aug 24 09:52:21 vps46666688 sshd[26669]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.175.38
Aug 24 09:52:23 vps46666688 sshd[26669]: Failed password for invalid user upload from 106.12.175.38 port 36472 ssh2
...

2020-08-20T14:33:18.660559ionos.janbro.de sshd[45994]: Invalid user business from 106.12.175.38 port 34654
2020-08-20T14:33:18.720896ionos.janbro.de sshd[45994]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.175.38
2020-08-20T14:33:18.660559ionos.janbro.de sshd[45994]: Invalid user business from 106.12.175.38 port 34654
2020-08-20T14:33:21.624058ionos.janbro.de sshd[45994]: Failed password for invalid user business from 106.12.175.38 port 34654 ssh2
2020-08-20T14:38:41.085943ionos.janbro.de sshd[46001]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.175.38  user=root
2020-08-20T14:38:43.330677ionos.janbro.de sshd[46001]: Failed password for root from 106.12.175.38 port 35752 ssh2
2020-08-20T14:44:21.600813ionos.janbro.de sshd[46016]: Invalid user platform from 106.12.175.38 port 36848
2020-08-20T14:44:21.731973ionos.janbro.de sshd[46016]: pam_unix(sshd:auth): authentication failure; logname
...

Aug 15 22:27:51 myvps sshd[21021]: Failed password for root from 106.12.175.38 port 44710 ssh2
Aug 15 22:43:31 myvps sshd[30957]: Failed password for root from 106.12.175.38 port 39068 ssh2
...

2020-08-15T05:39:50.988767morrigan.ad5gb.com sshd[3821877]: Failed password for root from 106.12.175.38 port 53508 ssh2
2020-08-15T05:39:51.330348morrigan.ad5gb.com sshd[3821877]: Disconnected from authenticating user root 106.12.175.38 port 53508 [preauth]

Aug 12 06:17:45 eventyay sshd[4318]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.175.226
Aug 12 06:17:47 eventyay sshd[4318]: Failed password for invalid user yd2008slkui from 106.12.175.226 port 35470 ssh2
Aug 12 06:23:10 eventyay sshd[4479]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.175.226
...

detected by Fail2Ban

Sep 19 20:44:14 srv01 postfix/smtpd\[6186\]: warning: unknown\[111.72.194.75\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Sep 19 20:44:26 srv01 postfix/smtpd\[6186\]: warning: unknown\[111.72.194.75\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Sep 19 20:44:42 srv01 postfix/smtpd\[6186\]: warning: unknown\[111.72.194.75\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Sep 19 20:45:01 srv01 postfix/smtpd\[6186\]: warning: unknown\[111.72.194.75\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Sep 19 20:45:12 srv01 postfix/smtpd\[6186\]: warning: unknown\[111.72.194.75\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
...

port scan and connect, tcp 3128 (squid-http)

 TCP (SYN) 122.117.38.144:3738 -> port 80, len 44

Sep 20 16:40:20 dcd-gentoo sshd[3936]: User root from 218.92.0.191 not allowed because none of user's groups are listed in AllowGroups
Sep 20 16:40:23 dcd-gentoo sshd[3936]: error: PAM: Authentication failure for illegal user root from 218.92.0.191
Sep 20 16:40:23 dcd-gentoo sshd[3936]: Failed keyboard-interactive/pam for invalid user root from 218.92.0.191 port 48784 ssh2
...

Email rejected due to spam filtering

Unauthorized connection attempt from IP address 185.134.232.118 on Port 445(SMB)

Automatic report - Port Scan Attack

[2020-09-20 01:39:21] NOTICE[1239][C-00005812] chan_sip.c: Call from '' (51.89.98.81:5060) to extension '8110061870897106' rejected because extension not found in context 'public'.
[2020-09-20 01:39:21] SECURITY[1264] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-09-20T01:39:21.588-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="8110061870897106",SessionID="0x7f4d48338208",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/51.89.98.81/5060",ACLName="no_extension_match"
[2020-09-20 01:43:27] NOTICE[1239][C-00005816] chan_sip.c: Call from '' (51.89.98.81:5060) to extension '08190061870897106' rejected because extension not found in context 'public'.
[2020-09-20 01:43:27] SECURITY[1264] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-09-20T01:43:27.015-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="08190061870897106",SessionID="0x7f4d48338208",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/51.
...

2020-09-20T12:01:22.528723afi-git.jinr.ru sshd[4553]: Failed password for root from 51.255.173.70 port 35970 ssh2
2020-09-20T12:05:18.120575afi-git.jinr.ru sshd[5463]: Invalid user test1 from 51.255.173.70 port 46972
2020-09-20T12:05:18.123886afi-git.jinr.ru sshd[5463]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=70.ip-51-255-173.eu
2020-09-20T12:05:18.120575afi-git.jinr.ru sshd[5463]: Invalid user test1 from 51.255.173.70 port 46972
2020-09-20T12:05:20.309220afi-git.jinr.ru sshd[5463]: Failed password for invalid user test1 from 51.255.173.70 port 46972 ssh2
...

Connection to SSH Honeypot - Detected by HoneypotDB

Brute-force attempt banned

1600534899 - 09/19/2020 19:01:39 Host: 113.190.82.110/113.190.82.110 Port: 445 TCP Blocked

Unauthorized connection attempt from IP address 186.94.69.163 on Port 445(SMB)

2020-09-20T09:12:09.829139vps773228.ovh.net sshd[7240]: Invalid user test123 from 210.245.110.9 port 61437
2020-09-20T09:12:12.343285vps773228.ovh.net sshd[7240]: Failed password for invalid user test123 from 210.245.110.9 port 61437 ssh2
2020-09-20T09:17:40.818049vps773228.ovh.net sshd[7296]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.245.110.9  user=root
2020-09-20T09:17:43.099469vps773228.ovh.net sshd[7296]: Failed password for root from 210.245.110.9 port 44679 ssh2
2020-09-20T09:23:12.744627vps773228.ovh.net sshd[7342]: Invalid user ubuntu from 210.245.110.9 port 56221
...