fail2ban -- 106.12.197.232
...

SSHD brute force attack detected by fail2ban

Jul  9 14:43:30 mout sshd[6338]: Invalid user kindra from 106.12.197.232 port 37720

Jun 21 08:54:23 NPSTNNYC01T sshd[28142]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.197.232
Jun 21 08:54:25 NPSTNNYC01T sshd[28142]: Failed password for invalid user testtest from 106.12.197.232 port 42618 ssh2
Jun 21 08:58:03 NPSTNNYC01T sshd[28453]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.197.232
...

Jun 13 07:40:35 ns382633 sshd\[15788\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.197.232  user=root
Jun 13 07:40:38 ns382633 sshd\[15788\]: Failed password for root from 106.12.197.232 port 51268 ssh2
Jun 13 08:02:07 ns382633 sshd\[19285\]: Invalid user luciano from 106.12.197.232 port 44496
Jun 13 08:02:07 ns382633 sshd\[19285\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.197.232
Jun 13 08:02:09 ns382633 sshd\[19285\]: Failed password for invalid user luciano from 106.12.197.232 port 44496 ssh2

Attempted connection to port 13107.

May 29 11:58:18 gw1 sshd[22928]: Failed password for root from 106.12.197.232 port 47302 ssh2
...

Apr 26 19:20:55 OPSO sshd\[22698\]: Invalid user samp from 106.12.197.232 port 43722
Apr 26 19:20:55 OPSO sshd\[22698\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.197.232
Apr 26 19:20:58 OPSO sshd\[22698\]: Failed password for invalid user samp from 106.12.197.232 port 43722 ssh2
Apr 26 19:22:20 OPSO sshd\[23580\]: Invalid user user from 106.12.197.232 port 59582
Apr 26 19:22:20 OPSO sshd\[23580\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.197.232

Invalid user yv from 106.12.197.232 port 55794

Apr 21 18:33:52 prod4 sshd\[32139\]: Invalid user ubuntu from 106.12.197.232
Apr 21 18:33:53 prod4 sshd\[32139\]: Failed password for invalid user ubuntu from 106.12.197.232 port 49762 ssh2
Apr 21 18:38:59 prod4 sshd\[1376\]: Failed password for root from 106.12.197.232 port 47000 ssh2
...

Invalid user ci from 106.12.197.232 port 38504

Apr 17 17:57:02 webhost01 sshd[4689]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.197.232
Apr 17 17:57:04 webhost01 sshd[4689]: Failed password for invalid user postgres from 106.12.197.232 port 56618 ssh2
...

Apr  9 23:43:36 ns382633 sshd\[7744\]: Invalid user admin from 106.12.197.232 port 46798
Apr  9 23:43:36 ns382633 sshd\[7744\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.197.232
Apr  9 23:43:38 ns382633 sshd\[7744\]: Failed password for invalid user admin from 106.12.197.232 port 46798 ssh2
Apr  9 23:56:36 ns382633 sshd\[10658\]: Invalid user testuser from 106.12.197.232 port 39132
Apr  9 23:56:36 ns382633 sshd\[10658\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.197.232

prod3
...

Invalid user unknown from 106.12.197.232 port 51670

web-1 [ssh_2] SSH Attack

Mar  1 20:24:30 localhost sshd[60750]: Invalid user testftp from 106.12.197.232 port 57398
Mar  1 20:24:30 localhost sshd[60750]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.197.232
Mar  1 20:24:30 localhost sshd[60750]: Invalid user testftp from 106.12.197.232 port 57398
Mar  1 20:24:32 localhost sshd[60750]: Failed password for invalid user testftp from 106.12.197.232 port 57398 ssh2
Mar  1 20:31:12 localhost sshd[61529]: Invalid user rakesh from 106.12.197.232 port 41250
...

Feb 10 01:54:03 firewall sshd[24602]: Invalid user gnf from 106.12.197.232
Feb 10 01:54:05 firewall sshd[24602]: Failed password for invalid user gnf from 106.12.197.232 port 49480 ssh2
Feb 10 01:57:29 firewall sshd[24738]: Invalid user jkn from 106.12.197.232
...

2020-01-24T05:39:08.104572linuxbox-skyline sshd[31006]: Invalid user duke from 106.12.197.232 port 38456
...

SSH authentication failure x 6 reported by Fail2Ban
...

Jan  9 14:03:52 ns381471 sshd[24258]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.197.232
Jan  9 14:03:54 ns381471 sshd[24258]: Failed password for invalid user 1proxy from 106.12.197.232 port 49876 ssh2

Unauthorized connection attempt detected from IP address 106.12.197.232 to port 22 [T]

SSH/22 MH Probe, BF, Hack -

Invalid user support1 from 106.12.197.37 port 34940

Invalid user deginal from 106.12.197.37 port 56416

SCAN: Host Sweep CloudCIX Reconnaissance Scan Detected, PTR: PTR record not found

SCAN: Host Sweep CloudCIX Reconnaissance Scan Detected, PTR: PTR record not found

Aug 17 12:27:36 vps1 sshd[13462]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.197.165 
Aug 17 12:27:38 vps1 sshd[13462]: Failed password for invalid user hyegyeong from 106.12.197.165 port 47606 ssh2
Aug 17 12:30:39 vps1 sshd[13495]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.197.165 
Aug 17 12:30:41 vps1 sshd[13495]: Failed password for invalid user wangjing from 106.12.197.165 port 58938 ssh2
Aug 17 12:33:47 vps1 sshd[13542]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.197.165 
Aug 17 12:33:48 vps1 sshd[13542]: Failed password for invalid user kea from 106.12.197.165 port 42076 ssh2
Aug 17 12:36:54 vps1 sshd[13574]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.197.165 
...

Aug 13 23:41:45 hosting sshd[31269]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.197.165  user=root
Aug 13 23:41:48 hosting sshd[31269]: Failed password for root from 106.12.197.165 port 52304 ssh2
Aug 13 23:46:23 hosting sshd[31859]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.197.165  user=root
Aug 13 23:46:25 hosting sshd[31859]: Failed password for root from 106.12.197.165 port 60046 ssh2
...

Aug 13 08:02:51 mellenthin sshd[15596]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.197.165  user=root
Aug 13 08:02:54 mellenthin sshd[15596]: Failed password for invalid user root from 106.12.197.165 port 58016 ssh2

Aug 11 02:55:54 xxxxxxx5185820 sshd[1579]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.197.37  user=r.r
Aug 11 02:55:57 xxxxxxx5185820 sshd[1579]: Failed password for r.r from 106.12.197.37 port 42416 ssh2
Aug 11 02:55:57 xxxxxxx5185820 sshd[1579]: Received disconnect from 106.12.197.37 port 42416:11: Bye Bye [preauth]
Aug 11 02:55:57 xxxxxxx5185820 sshd[1579]: Disconnected from 106.12.197.37 port 42416 [preauth]
Aug 11 02:58:27 xxxxxxx5185820 sshd[1856]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.197.37  user=r.r
Aug 11 02:58:29 xxxxxxx5185820 sshd[1856]: Failed password for r.r from 106.12.197.37 port 48240 ssh2
Aug 11 02:58:29 xxxxxxx5185820 sshd[1856]: Received disconnect from 106.12.197.37 port 48240:11: Bye Bye [preauth]
Aug 11 02:58:29 xxxxxxx5185820 sshd[1856]: Disconnected from 106.12.197.37 port 48240 [preauth]
Aug 11 03:00:54 xxxxxxx5185820 sshd[3452]: pam_u........
-------------------------------

<6 unauthorized SSH connections

Aug  4 22:40:04 ip40 sshd[7844]: Failed password for root from 106.12.197.165 port 36592 ssh2
...

Jul 31 17:36:09 vmd36147 sshd[13581]: Failed password for root from 106.12.197.165 port 60880 ssh2
Jul 31 17:40:19 vmd36147 sshd[22629]: Failed password for root from 106.12.197.165 port 44464 ssh2
...

Automatic Fail2ban report - Trying login SSH

2020-07-12T08:36:18.489376morrigan.ad5gb.com sshd[1254326]: Failed password for invalid user yk from 106.12.197.165 port 41884 ssh2
2020-07-12T08:36:18.857927morrigan.ad5gb.com sshd[1254326]: Disconnected from invalid user yk 106.12.197.165 port 41884 [preauth]

Jul 11 05:54:29 ajax sshd[21264]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.197.67 
Jul 11 05:54:30 ajax sshd[21264]: Failed password for invalid user darleen from 106.12.197.67 port 55102 ssh2

Jul  9 16:14:21 h1745522 sshd[10529]: Invalid user riza from 106.12.197.130 port 45142
Jul  9 16:14:21 h1745522 sshd[10529]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.197.130
Jul  9 16:14:21 h1745522 sshd[10529]: Invalid user riza from 106.12.197.130 port 45142
Jul  9 16:14:24 h1745522 sshd[10529]: Failed password for invalid user riza from 106.12.197.130 port 45142 ssh2
Jul  9 16:18:32 h1745522 sshd[10781]: Invalid user nwang from 106.12.197.130 port 60924
Jul  9 16:18:32 h1745522 sshd[10781]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.197.130
Jul  9 16:18:32 h1745522 sshd[10781]: Invalid user nwang from 106.12.197.130 port 60924
Jul  9 16:18:35 h1745522 sshd[10781]: Failed password for invalid user nwang from 106.12.197.130 port 60924 ssh2
Jul  9 16:22:39 h1745522 sshd[11025]: Invalid user liaohaoran from 106.12.197.130 port 48466
...

(smtpauth) Failed SMTP AUTH login from 121.66.35.37 (KR/South Korea/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SMTPAUTH; Logs: 2020-10-09 08:13:08 dovecot_login authenticator failed for (grandbajahotel.com) [121.66.35.37]:56748: 535 Incorrect authentication data (set_id=nologin)
2020-10-09 08:13:31 dovecot_login authenticator failed for (grandbajahotel.com) [121.66.35.37]:34084: 535 Incorrect authentication data (set_id=test@grandbajahotel.com)
2020-10-09 08:13:54 dovecot_login authenticator failed for (grandbajahotel.com) [121.66.35.37]:39792: 535 Incorrect authentication data (set_id=test)
2020-10-09 08:47:46 dovecot_login authenticator failed for (rosaritosbest.com) [121.66.35.37]:35372: 535 Incorrect authentication data (set_id=nologin)
2020-10-09 08:48:09 dovecot_login authenticator failed for (rosaritosbest.com) [121.66.35.37]:40886: 535 Incorrect authentication data (set_id=test@rosaritosbest.com)

Oct  9 17:31:22 srv-ubuntu-dev3 sshd[51734]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.194.229.37  user=root
Oct  9 17:31:23 srv-ubuntu-dev3 sshd[51734]: Failed password for root from 122.194.229.37 port 8750 ssh2
Oct  9 17:31:27 srv-ubuntu-dev3 sshd[51734]: Failed password for root from 122.194.229.37 port 8750 ssh2
Oct  9 17:31:22 srv-ubuntu-dev3 sshd[51734]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.194.229.37  user=root
Oct  9 17:31:23 srv-ubuntu-dev3 sshd[51734]: Failed password for root from 122.194.229.37 port 8750 ssh2
Oct  9 17:31:27 srv-ubuntu-dev3 sshd[51734]: Failed password for root from 122.194.229.37 port 8750 ssh2
Oct  9 17:31:22 srv-ubuntu-dev3 sshd[51734]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.194.229.37  user=root
Oct  9 17:31:23 srv-ubuntu-dev3 sshd[51734]: Failed password for root from 122.194.229.37 port 8750 ssh
...

1602219766 - 10/09/2020 07:02:46 Host: 189.2.182.226/189.2.182.226 Port: 445 TCP Blocked

$f2bV_matches

Unauthorized connection attempt from IP address 113.190.242.110 on Port 445(SMB)

2020-10-09T08:11:25.344757shield sshd\[16648\]: Invalid user Jessa from 128.199.76.76 port 2242
2020-10-09T08:11:25.354291shield sshd\[16648\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.76.76
2020-10-09T08:11:27.459332shield sshd\[16648\]: Failed password for invalid user Jessa from 128.199.76.76 port 2242 ssh2
2020-10-09T08:15:05.537047shield sshd\[16961\]: Invalid user Elgie from 128.199.76.76 port 43356
2020-10-09T08:15:05.545200shield sshd\[16961\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.76.76

ET SCAN NMAP -sS window 1024

php WP PHPmyadamin ABUSE blocked for 12h

 TCP (SYN) 74.120.14.17:33514 -> port 23, len 44

Oct  7 04:52:33 datentool sshd[4173]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=110.164.163.54  user=r.r
Oct  7 04:52:35 datentool sshd[4173]: Failed password for r.r from 110.164.163.54 port 44540 ssh2
Oct  7 05:05:55 datentool sshd[4453]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=110.164.163.54  user=r.r
Oct  7 05:05:57 datentool sshd[4453]: Failed password for r.r from 110.164.163.54 port 44684 ssh2
Oct  7 05:12:30 datentool sshd[4509]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=110.164.163.54  user=r.r
Oct  7 05:12:31 datentool sshd[4509]: Failed password for r.r from 110.164.163.54 port 49714 ssh2
Oct  7 05:18:52 datentool sshd[4609]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=110.164.163.54  user=r.r
Oct  7 05:18:53 datentool sshd[4609]: Failed password for r.r from 110.164.163.54 port........
-------------------------------

Unauthorized connection attempt from IP address 31.135.44.108 on Port 445(SMB)

Unauthorized connection attempt from IP address 138.94.203.70 on Port 445(SMB)

Oct  9 08:41:52 ns37 sshd[9106]: Failed password for root from 128.1.138.214 port 53310 ssh2
Oct  9 08:41:52 ns37 sshd[9106]: Failed password for root from 128.1.138.214 port 53310 ssh2

Icarus honeypot on github

Unauthorized connection attempt from IP address 183.82.96.113 on Port 445(SMB)