Mar 26 04:29:45 xxxxxxx0 sshd[24892]: Invalid user informix from 106.54.102.140 port 51750
Mar 26 04:29:45 xxxxxxx0 sshd[24892]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.54.102.140
Mar 26 04:29:47 xxxxxxx0 sshd[24892]: Failed password for invalid user informix from 106.54.102.140 port 51750 ssh2
Mar 26 04:42:16 xxxxxxx0 sshd[3450]: Invalid user informix from 106.54.102.140 port 34848
Mar 26 04:42:16 xxxxxxx0 sshd[3450]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.54.102.140

........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=106.54.102.140

2020-01-15T13:06:50.981283shield sshd\[26929\]: Invalid user service from 106.54.102.127 port 57908
2020-01-15T13:06:50.989565shield sshd\[26929\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.54.102.127
2020-01-15T13:06:53.089054shield sshd\[26929\]: Failed password for invalid user service from 106.54.102.127 port 57908 ssh2
2020-01-15T13:09:20.651712shield sshd\[27557\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.54.102.127  user=root
2020-01-15T13:09:22.686486shield sshd\[27557\]: Failed password for root from 106.54.102.127 port 46482 ssh2

Jan 15 07:55:42 vps58358 sshd\[6280\]: Invalid user qt from 106.54.102.127Jan 15 07:55:44 vps58358 sshd\[6280\]: Failed password for invalid user qt from 106.54.102.127 port 40670 ssh2Jan 15 07:59:18 vps58358 sshd\[6315\]: Invalid user webmaster from 106.54.102.127Jan 15 07:59:19 vps58358 sshd\[6315\]: Failed password for invalid user webmaster from 106.54.102.127 port 40286 ssh2Jan 15 08:03:24 vps58358 sshd\[6350\]: Invalid user king from 106.54.102.127Jan 15 08:03:26 vps58358 sshd\[6350\]: Failed password for invalid user king from 106.54.102.127 port 39900 ssh2
...

2020-01-12T21:37:18.435399shield sshd\[3927\]: Invalid user transfer from 106.54.102.127 port 38600
2020-01-12T21:37:18.440966shield sshd\[3927\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.54.102.127
2020-01-12T21:37:20.919990shield sshd\[3927\]: Failed password for invalid user transfer from 106.54.102.127 port 38600 ssh2
2020-01-12T21:41:13.185984shield sshd\[5187\]: Invalid user user from 106.54.102.127 port 35558
2020-01-12T21:41:13.190067shield sshd\[5187\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.54.102.127

$f2bV_matches

$f2bV_matches

Dec 30 23:09:48 server sshd\[25715\]: Invalid user deploy from 106.54.102.127
Dec 30 23:09:48 server sshd\[25715\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.54.102.127 
Dec 30 23:09:49 server sshd\[25715\]: Failed password for invalid user deploy from 106.54.102.127 port 43966 ssh2
Dec 30 23:13:49 server sshd\[26691\]: Invalid user dragonx from 106.54.102.127
Dec 30 23:13:49 server sshd\[26691\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.54.102.127 
...

Dec 25 17:40:50 sd-53420 sshd\[31649\]: User mysql from 106.54.102.127 not allowed because none of user's groups are listed in AllowGroups
Dec 25 17:40:50 sd-53420 sshd\[31649\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.54.102.127  user=mysql
Dec 25 17:40:52 sd-53420 sshd\[31649\]: Failed password for invalid user mysql from 106.54.102.127 port 54494 ssh2
Dec 25 17:46:51 sd-53420 sshd\[1509\]: Invalid user nfs from 106.54.102.127
Dec 25 17:46:51 sd-53420 sshd\[1509\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.54.102.127
...

Unauthorized connection attempt detected from IP address 106.54.102.94 to port 22

SSH brutforce

Nov 20 19:00:53 lnxded64 sshd[11377]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.54.102.94
Nov 20 19:00:55 lnxded64 sshd[11377]: Failed password for invalid user heinrik from 106.54.102.94 port 47176 ssh2
Nov 20 19:06:24 lnxded64 sshd[12728]: Failed password for mysql from 106.54.102.94 port 43728 ssh2

Lines containing failures of 106.54.102.94
Nov 18 15:55:30 www sshd[29223]: Invalid user allaman from 106.54.102.94 port 47096
Nov 18 15:55:30 www sshd[29223]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.54.102.94
Nov 18 15:55:32 www sshd[29223]: Failed password for invalid user allaman from 106.54.102.94 port 47096 ssh2
Nov 18 15:55:33 www sshd[29223]: Received disconnect from 106.54.102.94 port 47096:11: Bye Bye [preauth]
Nov 18 15:55:33 www sshd[29223]: Disconnected from invalid user allaman 106.54.102.94 port 47096 [preauth]
Nov 18 16:15:41 www sshd[31757]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.54.102.94  user=r.r
Nov 18 16:15:43 www sshd[31757]: Failed password for r.r from 106.54.102.94 port 36950 ssh2
Nov 18 16:15:43 www sshd[31757]: Received disconnect from 106.54.102.94 port 36950:11: Bye Bye [preauth]
Nov 18 16:15:43 www sshd[31757]: Disconnected from authentic........
------------------------------

106.54.102.94 was recorded 5 times by 2 hosts attempting to connect to the following ports: 22. Incident counter (4h, 24h, all-time): 5, 5, 9

SSH bruteforce

invalid user zhangkun from 106.12.198.236 port 55484 ssh2

2020-08-04T13:00:01.024933morrigan.ad5gb.com sshd[2735585]: Failed password for root from 51.77.213.136 port 59258 ssh2
2020-08-04T13:00:02.927785morrigan.ad5gb.com sshd[2735585]: Disconnected from authenticating user root 51.77.213.136 port 59258 [preauth]

Aug  4 17:43:04 XXX sshd[5261]: Invalid user admin from 51.38.57.78 port 57286

Aug  4 21:04:52 OPSO sshd\[16548\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.172.201.94  user=root
Aug  4 21:04:54 OPSO sshd\[16548\]: Failed password for root from 167.172.201.94 port 36846 ssh2
Aug  4 21:08:31 OPSO sshd\[17555\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.172.201.94  user=root
Aug  4 21:08:33 OPSO sshd\[17555\]: Failed password for root from 167.172.201.94 port 42922 ssh2
Aug  4 21:12:13 OPSO sshd\[18320\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.172.201.94  user=root

Aug  4 19:51:23 h2779839 sshd[26947]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=4.7.94.244  user=root
Aug  4 19:51:25 h2779839 sshd[26947]: Failed password for root from 4.7.94.244 port 33886 ssh2
Aug  4 19:53:41 h2779839 sshd[27010]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=4.7.94.244  user=root
Aug  4 19:53:43 h2779839 sshd[27010]: Failed password for root from 4.7.94.244 port 42546 ssh2
Aug  4 19:55:52 h2779839 sshd[27172]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=4.7.94.244  user=root
Aug  4 19:55:54 h2779839 sshd[27172]: Failed password for root from 4.7.94.244 port 51204 ssh2
Aug  4 19:58:03 h2779839 sshd[27227]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=4.7.94.244  user=root
Aug  4 19:58:05 h2779839 sshd[27227]: Failed password for root from 4.7.94.244 port 59862 ssh2
Aug  4 20:00:16 h2779839 ssh
...

Aug  4 19:23:29 Ubuntu-1404-trusty-64-minimal sshd\[24968\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.114.98.229  user=root
Aug  4 19:23:31 Ubuntu-1404-trusty-64-minimal sshd\[24968\]: Failed password for root from 167.114.98.229 port 39636 ssh2
Aug  4 19:57:15 Ubuntu-1404-trusty-64-minimal sshd\[14880\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.114.98.229  user=root
Aug  4 19:57:17 Ubuntu-1404-trusty-64-minimal sshd\[14880\]: Failed password for root from 167.114.98.229 port 41494 ssh2
Aug  4 20:00:14 Ubuntu-1404-trusty-64-minimal sshd\[18442\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.114.98.229  user=root

Automatic report - XMLRPC Attack

Auto Detect Rule!
proto TCP (SYN), 222.208.119.107:43716->gjan.info:1433, len 44

Aug  4 19:45:34 ns382633 sshd\[32743\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.82.126.48  user=root
Aug  4 19:45:36 ns382633 sshd\[32743\]: Failed password for root from 185.82.126.48 port 47076 ssh2
Aug  4 19:56:18 ns382633 sshd\[2153\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.82.126.48  user=root
Aug  4 19:56:20 ns382633 sshd\[2153\]: Failed password for root from 185.82.126.48 port 53210 ssh2
Aug  4 20:00:17 ns382633 sshd\[2972\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.82.126.48  user=root

Aug  4 21:27:24 buvik sshd[6153]: Failed password for root from 159.203.63.125 port 56097 ssh2
Aug  4 21:32:12 buvik sshd[6737]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.203.63.125  user=root
Aug  4 21:32:14 buvik sshd[6737]: Failed password for root from 159.203.63.125 port 33586 ssh2
...

Aug  4 14:56:13 aragorn sshd[22872]: Invalid user misp from 81.199.122.12
Aug  4 14:56:17 aragorn sshd[22874]: Invalid user osbash from 81.199.122.12
Aug  4 14:56:21 aragorn sshd[22876]: Invalid user plexuser from 81.199.122.12
Aug  4 15:15:36 aragorn sshd[26730]: Invalid user pi from 81.199.122.12
...

Port probing on unauthorized port 7001

Aug  4 20:41:25 debian-2gb-nbg1-2 kernel: \[18824950.128621\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=94.102.51.17 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=247 ID=55364 PROTO=TCP SPT=46377 DPT=7461 WINDOW=1024 RES=0x00 SYN URGP=0

2020-08-05T01:49:19.016297billing sshd[21116]: Failed password for root from 110.80.17.26 port 28753 ssh2
2020-08-05T01:53:16.249694billing sshd[29527]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=110.80.17.26  user=root
2020-08-05T01:53:18.375624billing sshd[29527]: Failed password for root from 110.80.17.26 port 33560 ssh2
...

Aug  4 16:11:24 WHD8 dovecot: pop3-login: Disconnected \(auth failed, 1 attempts in 6 secs\): user=\, method=PLAIN, rip=84.78.22.160, lip=10.64.89.208, session=\
Aug  4 16:33:14 WHD8 dovecot: pop3-login: Disconnected \(auth failed, 1 attempts in 8 secs\): user=\, method=PLAIN, rip=84.78.22.160, lip=10.64.89.208, session=\
Aug  4 16:33:14 WHD8 dovecot: pop3-login: Disconnected \(auth failed, 1 attempts in 6 secs\): user=\, method=PLAIN, rip=84.78.22.160, lip=10.64.89.208, session=\
Aug  4 17:05:25 WHD8 dovecot: pop3-login: Disconnected \(auth failed, 1 attempts in 8 secs\): user=\, method=PLAIN, rip=84.78.22.160, lip=10.64.89.208, session=\
Aug  4 17:05:25 WHD8 dovecot: pop3-login: Disconnected \(auth failed, 1 attempts in 6 secs\): user=\, method=PLAIN, rip=84.78.22.160, lip=10.64.89.
...