2019-12-08 07:10:57,282 fail2ban.actions        \[3073\]: NOTICE  \[ssh\] Ban 106.13.4.172
2019-12-08 07:34:11,885 fail2ban.actions        \[3073\]: NOTICE  \[ssh\] Ban 106.13.4.172
2019-12-08 07:55:24,975 fail2ban.actions        \[3073\]: NOTICE  \[ssh\] Ban 106.13.4.172
2019-12-08 08:17:04,968 fail2ban.actions        \[3073\]: NOTICE  \[ssh\] Ban 106.13.4.172
2019-12-08 08:38:47,867 fail2ban.actions        \[3073\]: NOTICE  \[ssh\] Ban 106.13.4.172
...

Dec  1 11:12:46 ArkNodeAT sshd\[12181\]: Invalid user admin from 106.13.4.172
Dec  1 11:12:46 ArkNodeAT sshd\[12181\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.4.172
Dec  1 11:12:48 ArkNodeAT sshd\[12181\]: Failed password for invalid user admin from 106.13.4.172 port 51736 ssh2

Nov 24 07:24:49 MK-Soft-VM8 sshd[6565]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.4.172 
Nov 24 07:24:51 MK-Soft-VM8 sshd[6565]: Failed password for invalid user danshiro from 106.13.4.172 port 56448 ssh2
...

Nov 13 14:50:47 work-partkepr sshd\[32261\]: Invalid user kick from 106.13.4.172 port 35330
Nov 13 14:50:47 work-partkepr sshd\[32261\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.4.172
...

Oct 25 06:04:50 minden010 sshd[2364]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.4.172
Oct 25 06:04:52 minden010 sshd[2364]: Failed password for invalid user 123qweasdqwe from 106.13.4.172 port 47838 ssh2
Oct 25 06:08:51 minden010 sshd[6207]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.4.172
...

Oct 23 15:20:34 legacy sshd[32434]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.4.172
Oct 23 15:20:37 legacy sshd[32434]: Failed password for invalid user file from 106.13.4.172 port 40900 ssh2
Oct 23 15:25:18 legacy sshd[32569]: Failed password for root from 106.13.4.172 port 47840 ssh2
...

2019-10-15T07:49:26.561794abusebot-3.cloudsearch.cf sshd\[23851\]: Invalid user p@ssw0rd from 106.13.4.172 port 52052

Oct  4 07:07:42 vps691689 sshd[15723]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.4.172
Oct  4 07:07:45 vps691689 sshd[15723]: Failed password for invalid user P4ssw0rt_1@3 from 106.13.4.172 port 50102 ssh2
Oct  4 07:12:30 vps691689 sshd[15818]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.4.172
...

Oct  2 08:08:43 localhost sshd\[10283\]: Invalid user letarte from 106.13.4.172 port 46668
Oct  2 08:08:44 localhost sshd\[10283\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.4.172
Oct  2 08:08:45 localhost sshd\[10283\]: Failed password for invalid user letarte from 106.13.4.172 port 46668 ssh2

2019-09-30T21:56:56.341140hub.schaetter.us sshd\[8663\]: Invalid user csgo from 106.13.4.172 port 51154
2019-09-30T21:56:56.350039hub.schaetter.us sshd\[8663\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.4.172
2019-09-30T21:56:58.836359hub.schaetter.us sshd\[8663\]: Failed password for invalid user csgo from 106.13.4.172 port 51154 ssh2
2019-09-30T22:00:07.737813hub.schaetter.us sshd\[8678\]: Invalid user bot from 106.13.4.172 port 53362
2019-09-30T22:00:07.748299hub.schaetter.us sshd\[8678\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.4.172
...

Sep 23 14:33:09 pornomens sshd\[26899\]: Invalid user admin from 106.13.4.172 port 39124
Sep 23 14:33:09 pornomens sshd\[26899\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.4.172
Sep 23 14:33:10 pornomens sshd\[26899\]: Failed password for invalid user admin from 106.13.4.172 port 39124 ssh2
...

Sep 16 01:13:14 rotator sshd\[17788\]: Invalid user pdfbox from 106.13.4.172Sep 16 01:13:16 rotator sshd\[17788\]: Failed password for invalid user pdfbox from 106.13.4.172 port 54202 ssh2Sep 16 01:17:12 rotator sshd\[18574\]: Invalid user my from 106.13.4.172Sep 16 01:17:15 rotator sshd\[18574\]: Failed password for invalid user my from 106.13.4.172 port 36260 ssh2Sep 16 01:21:07 rotator sshd\[19339\]: Invalid user kb from 106.13.4.172Sep 16 01:21:09 rotator sshd\[19339\]: Failed password for invalid user kb from 106.13.4.172 port 46526 ssh2
...

Sep  1 18:05:36 mail sshd[13165]: Invalid user paps from 106.13.4.172
Sep  1 18:05:36 mail sshd[13165]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.4.172
Sep  1 18:05:36 mail sshd[13165]: Invalid user paps from 106.13.4.172
Sep  1 18:05:38 mail sshd[13165]: Failed password for invalid user paps from 106.13.4.172 port 34854 ssh2
Sep  1 18:23:37 mail sshd[8681]: Invalid user pos1 from 106.13.4.172
...

SSH 15 Failed Logins

Aug  6 11:16:47 thevastnessof sshd[5928]: Failed password for invalid user lea from 106.13.4.172 port 39056 ssh2
Aug  6 11:34:31 thevastnessof sshd[6120]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.4.172
...

Aug  6 02:04:52 thevastnessof sshd[31366]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.4.172
...

DATE:2019-07-27 01:40:19, IP:106.13.4.172, PORT:ssh brute force auth on SSH service (patata)

SSH Bruteforce attack

Jul  7 05:51:31 unicornsoft sshd\[10743\]: Invalid user admin1 from 106.13.4.172
Jul  7 05:51:31 unicornsoft sshd\[10743\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.4.172
Jul  7 05:51:32 unicornsoft sshd\[10743\]: Failed password for invalid user admin1 from 106.13.4.172 port 53790 ssh2

2019-06-26 08:39:28 server sshd[86018]: Failed password for invalid user tomcat from 106.13.4.172 port 42476 ssh2

Oct 12 17:40:14 buvik sshd[7813]: Failed password for invalid user velarde from 106.13.46.123 port 54450 ssh2
Oct 12 17:44:39 buvik sshd[8406]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.46.123  user=root
Oct 12 17:44:41 buvik sshd[8406]: Failed password for root from 106.13.46.123 port 44970 ssh2
...

2020-10-12T13:35:54+0200 Failed SSH Authentication/Brute Force Attack. (Server 5)

Repeated brute force against a port

$f2bV_matches

Oct 11 22:12:43 ip-172-31-16-56 sshd\[26755\]: Invalid user ion from 106.13.42.140\
Oct 11 22:12:45 ip-172-31-16-56 sshd\[26755\]: Failed password for invalid user ion from 106.13.42.140 port 59816 ssh2\
Oct 11 22:15:55 ip-172-31-16-56 sshd\[26810\]: Invalid user oracle from 106.13.42.140\
Oct 11 22:15:57 ip-172-31-16-56 sshd\[26810\]: Failed password for invalid user oracle from 106.13.42.140 port 57116 ssh2\
Oct 11 22:19:12 ip-172-31-16-56 sshd\[26875\]: Invalid user jjonglee from 106.13.42.140\

Oct 11 15:24:05 serwer sshd\[24282\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.42.140  user=root
Oct 11 15:24:08 serwer sshd\[24282\]: Failed password for root from 106.13.42.140 port 35530 ssh2
Oct 11 15:29:06 serwer sshd\[24929\]: Invalid user ellen from 106.13.42.140 port 58314
Oct 11 15:29:06 serwer sshd\[24929\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.42.140
...

leo_www

5x Failed Password

2020-10-10T21:33:05.633586hostname sshd[29936]: Failed password for invalid user ark from 106.13.41.87 port 39526 ssh2
2020-10-10T21:36:13.475247hostname sshd[31217]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.41.87  user=root
2020-10-10T21:36:15.718396hostname sshd[31217]: Failed password for root from 106.13.41.87 port 38682 ssh2
...

$f2bV_matches

Oct 8 21:59:31 *hidden* sshd[4418]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.48.9 Oct 8 21:59:33 *hidden* sshd[4418]: Failed password for invalid user kevin from 106.13.48.9 port 40514 ssh2 Oct 8 22:16:27 *hidden* sshd[11400]: Invalid user info from 106.13.48.9 port 38028

SSH bruteforce

2020-10-09T04:48:40+0200 Failed SSH Authentication/Brute Force Attack.(Server 2)

2020-10-07T18:58:06.178811abusebot-4.cloudsearch.cf sshd[29305]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.47.78  user=root
2020-10-07T18:58:07.888553abusebot-4.cloudsearch.cf sshd[29305]: Failed password for root from 106.13.47.78 port 59938 ssh2
2020-10-07T19:00:56.752007abusebot-4.cloudsearch.cf sshd[29323]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.47.78  user=root
2020-10-07T19:00:58.466828abusebot-4.cloudsearch.cf sshd[29323]: Failed password for root from 106.13.47.78 port 41708 ssh2
2020-10-07T19:03:53.790334abusebot-4.cloudsearch.cf sshd[29440]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.47.78  user=root
2020-10-07T19:03:56.135880abusebot-4.cloudsearch.cf sshd[29440]: Failed password for root from 106.13.47.78 port 51712 ssh2
2020-10-07T19:06:14.010121abusebot-4.cloudsearch.cf sshd[29458]: pam_unix(sshd:auth): authenticat
...

5x Failed Password

2020-09-19T14:12:14.802728abusebot.cloudsearch.cf sshd[9613]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.168.47.238  user=root
2020-09-19T14:12:17.302573abusebot.cloudsearch.cf sshd[9613]: Failed password for root from 180.168.47.238 port 46492 ssh2
2020-09-19T14:15:55.379935abusebot.cloudsearch.cf sshd[9703]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.168.47.238  user=root
2020-09-19T14:15:57.216666abusebot.cloudsearch.cf sshd[9703]: Failed password for root from 180.168.47.238 port 56977 ssh2
2020-09-19T14:19:49.155520abusebot.cloudsearch.cf sshd[9792]: Invalid user arkserver from 180.168.47.238 port 41612
2020-09-19T14:19:49.160855abusebot.cloudsearch.cf sshd[9792]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.168.47.238
2020-09-19T14:19:49.155520abusebot.cloudsearch.cf sshd[9792]: Invalid user arkserver from 180.168.47.238 port 41612
2020-
...

RDP Bruteforce

Sep 18 13:08:42 roki-contabo sshd\[21612\]: Invalid user osmc from 42.98.45.163
Sep 18 13:08:43 roki-contabo sshd\[21612\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.98.45.163
Sep 18 13:08:44 roki-contabo sshd\[21612\]: Failed password for invalid user osmc from 42.98.45.163 port 49341 ssh2
Sep 19 09:07:48 roki-contabo sshd\[22955\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.98.45.163  user=root
Sep 19 09:07:50 roki-contabo sshd\[22955\]: Failed password for root from 42.98.45.163 port 45493 ssh2
...

RDP Bruteforce

Email rejected due to spam filtering

4 SSH login attempts.

Port scan: Attack repeated for 24 hours

Invalid user admin from 176.122.156.32 port 48520

Sep 19 00:00:16 webhost01 sshd[32711]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.61.180.138
...

$f2bV_matches

Unauthorized connection attempt from IP address 123.24.7.115 on Port 445(SMB)

2020-09-19T15:34:25Z - RDP login failed multiple times. (185.202.2.17)

WordPress wp-login brute force :: 103.235.3.139 0.124 - [18/Sep/2020:17:00:21  0000] [censored_1] "POST /wp-login.php HTTP/1.1" 200 2414 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" "HTTP/1.1"

Repeated RDP login failures. Last user: Administrator

[N10.H2.VM2] Port Scanner Detected Blocked by UFW