Jun 19 15:07:57 ift sshd\[4637\]: Invalid user rui from 107.170.192.131Jun 19 15:07:59 ift sshd\[4637\]: Failed password for invalid user rui from 107.170.192.131 port 34282 ssh2Jun 19 15:12:04 ift sshd\[5774\]: Invalid user leonard from 107.170.192.131Jun 19 15:12:07 ift sshd\[5774\]: Failed password for invalid user leonard from 107.170.192.131 port 53607 ssh2Jun 19 15:16:17 ift sshd\[6537\]: Invalid user 123 from 107.170.192.131
...

Jun 19 12:47:45 ift sshd\[46621\]: Invalid user tiziano from 107.170.192.131Jun 19 12:47:47 ift sshd\[46621\]: Failed password for invalid user tiziano from 107.170.192.131 port 37001 ssh2Jun 19 12:52:20 ift sshd\[47364\]: Invalid user ubuntu from 107.170.192.131Jun 19 12:52:22 ift sshd\[47364\]: Failed password for invalid user ubuntu from 107.170.192.131 port 56326 ssh2Jun 19 12:56:42 ift sshd\[48010\]: Invalid user otrs from 107.170.192.131
...

Jun 14 15:24:12 inter-technics sshd[16134]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.170.192.131  user=root
Jun 14 15:24:14 inter-technics sshd[16134]: Failed password for root from 107.170.192.131 port 52111 ssh2
Jun 14 15:31:03 inter-technics sshd[16431]: Invalid user chucky from 107.170.192.131 port 53020
Jun 14 15:31:03 inter-technics sshd[16431]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.170.192.131
Jun 14 15:31:03 inter-technics sshd[16431]: Invalid user chucky from 107.170.192.131 port 53020
Jun 14 15:31:04 inter-technics sshd[16431]: Failed password for invalid user chucky from 107.170.192.131 port 53020 ssh2
...

Jun 12 17:42:59 XXXXXX sshd[38457]: Invalid user packer from 107.170.192.131 port 35741

Jun 12 16:38:51 vmi345603 sshd[2676]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.170.192.131
Jun 12 16:38:52 vmi345603 sshd[2676]: Failed password for invalid user admin from 107.170.192.131 port 40894 ssh2
...

2020-06-11T12:02:20.410996+02:00  sshd[16755]: Failed password for root from 107.170.192.131 port 35289 ssh2

Jun  6 02:12:49 cdc sshd[27997]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.170.192.131  user=root
Jun  6 02:12:51 cdc sshd[27997]: Failed password for invalid user root from 107.170.192.131 port 33726 ssh2

Jun  4 06:38:05 hosting sshd[22387]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.170.192.131  user=root
Jun  4 06:38:07 hosting sshd[22387]: Failed password for root from 107.170.192.131 port 35421 ssh2
Jun  4 06:50:53 hosting sshd[24118]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.170.192.131  user=root
Jun  4 06:50:55 hosting sshd[24118]: Failed password for root from 107.170.192.131 port 49151 ssh2
Jun  4 06:58:30 hosting sshd[24883]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.170.192.131  user=root
Jun  4 06:58:32 hosting sshd[24883]: Failed password for root from 107.170.192.131 port 51354 ssh2
...

Repeated brute force against a port

Invalid user ubuntu from 107.170.192.131 port 56573

May  3 08:19:47 ws26vmsma01 sshd[73413]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.170.192.131
May  3 08:19:49 ws26vmsma01 sshd[73413]: Failed password for invalid user emilia from 107.170.192.131 port 40799 ssh2
...

Fail2Ban Ban Triggered

Apr 23 00:07:16 ns382633 sshd\[14852\]: Invalid user vyos from 107.170.192.131 port 58911
Apr 23 00:07:16 ns382633 sshd\[14852\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.170.192.131
Apr 23 00:07:17 ns382633 sshd\[14852\]: Failed password for invalid user vyos from 107.170.192.131 port 58911 ssh2
Apr 23 00:16:50 ns382633 sshd\[16568\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.170.192.131  user=root
Apr 23 00:16:52 ns382633 sshd\[16568\]: Failed password for root from 107.170.192.131 port 39512 ssh2

$f2bV_matches

ssh brute force

'Fail2Ban'

Invalid user igor from 107.170.192.131 port 52667

Invalid user musicbot2 from 107.170.192.131 port 46392

20 attempts against mh-ssh on cloud

Unauthorized connection attempt detected from IP address 107.170.192.131 to port 2220 [J]

Jan  3 12:56:53 ip-172-31-62-245 sshd\[23247\]: Invalid user jdu from 107.170.192.131\
Jan  3 12:56:55 ip-172-31-62-245 sshd\[23247\]: Failed password for invalid user jdu from 107.170.192.131 port 38144 ssh2\
Jan  3 13:00:40 ip-172-31-62-245 sshd\[23347\]: Invalid user prosper from 107.170.192.131\
Jan  3 13:00:42 ip-172-31-62-245 sshd\[23347\]: Failed password for invalid user prosper from 107.170.192.131 port 54379 ssh2\
Jan  3 13:04:33 ip-172-31-62-245 sshd\[23417\]: Invalid user Waschlappen from 107.170.192.131\

Jan  1 08:30:05 vpn01 sshd[24240]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.170.192.131
Jan  1 08:30:08 vpn01 sshd[24240]: Failed password for invalid user sinclair from 107.170.192.131 port 35797 ssh2
...

Dec 28 11:50:53 MK-Soft-Root1 sshd[25194]: Failed password for root from 107.170.192.131 port 36766 ssh2
Dec 28 11:55:19 MK-Soft-Root1 sshd[26135]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.170.192.131 
...

$f2bV_matches

Dec 22 05:43:09 firewall sshd[13107]: Failed password for invalid user scorpion from 107.170.192.131 port 40438 ssh2
Dec 22 05:51:12 firewall sshd[13262]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.170.192.131  user=backup
Dec 22 05:51:13 firewall sshd[13262]: Failed password for backup from 107.170.192.131 port 42670 ssh2
...

Dec 11 11:36:19 loxhost sshd\[6464\]: Invalid user mysql from 107.170.192.131 port 34826
Dec 11 11:36:19 loxhost sshd\[6464\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.170.192.131
Dec 11 11:36:21 loxhost sshd\[6464\]: Failed password for invalid user mysql from 107.170.192.131 port 34826 ssh2
Dec 11 11:45:35 loxhost sshd\[6857\]: Invalid user redmine from 107.170.192.131 port 39561
Dec 11 11:45:35 loxhost sshd\[6857\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.170.192.131
...

Dec  7 14:24:19 cvbnet sshd[10757]: Failed password for root from 107.170.192.131 port 49100 ssh2
Dec  7 14:30:00 cvbnet sshd[10837]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.170.192.131 
...

2019-12-06T13:14:51.116739  sshd[17123]: Invalid user westli from 107.170.192.131 port 43506
2019-12-06T13:14:51.132505  sshd[17123]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.170.192.131
2019-12-06T13:14:51.116739  sshd[17123]: Invalid user westli from 107.170.192.131 port 43506
2019-12-06T13:14:52.773551  sshd[17123]: Failed password for invalid user westli from 107.170.192.131 port 43506 ssh2
2019-12-06T13:23:21.924250  sshd[17341]: Invalid user gheest from 107.170.192.131 port 48826
...

Dec  3 11:30:58 hpm sshd\[7983\]: Invalid user refvik from 107.170.192.131
Dec  3 11:30:58 hpm sshd\[7983\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.170.192.131
Dec  3 11:31:00 hpm sshd\[7983\]: Failed password for invalid user refvik from 107.170.192.131 port 52252 ssh2
Dec  3 11:39:49 hpm sshd\[9093\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.170.192.131  user=root
Dec  3 11:39:51 hpm sshd\[9093\]: Failed password for root from 107.170.192.131 port 57999 ssh2

2019-12-02T06:15:45.676602scmdmz1 sshd\[28155\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.170.192.131  user=root
2019-12-02T06:15:47.682313scmdmz1 sshd\[28155\]: Failed password for root from 107.170.192.131 port 49857 ssh2
2019-12-02T06:23:45.811461scmdmz1 sshd\[28942\]: Invalid user sedated from 107.170.192.131 port 56462
...

VPN fraud

firewall-block, port(s): 587/tcp

2019-08-13 13:20:06 Deny 107.170.192.190 xxx.xxx.xxx.xxx rdp/tcp 60470 3389 2-External-1 1-Trusted IPS detected 40 47 (Remote Desktop Services-00) proc_id="firewall" rc="301" msg_id="3000-0150" dst_ip_nat="xxx.xxx.xxx.xxx" tcp_info="offset 5 R 2914096797 win 0" geo_src="USA" geo_dst="USA" signature_id="1057269" signature_name="RDP Microsoft Windows Remote Desktop Server Denial of Service (" signature_cat="DoS/DDoS" severity="4"

23/tcp 2362/udp 7777/tcp...
[2019-06-12/08-11]71pkt,55pt.(tcp),4pt.(udp)

2362/udp 47808/tcp 19601/tcp...
[2019-06-11/08-11]46pkt,41pt.(tcp),4pt.(udp)

44517/tcp 995/tcp 102/tcp...
[2019-06-04/08-04]50pkt,46pt.(tcp),3pt.(udp)

Port scan: Attack repeated for 24 hours

MultiHost/MultiPort Probe, Scan, Hack -

137/udp 53662/tcp 1723/tcp...
[2019-05-26/07-26]54pkt,43pt.(tcp),4pt.(udp)

53662/tcp 1723/tcp 27017/tcp...
[2019-05-24/07-25]56pkt,45pt.(tcp),3pt.(udp)

" "

Port scan: Attack repeated for 24 hours

Port scan: Attack repeated for 24 hours

@LucianNitescu Personal Honeypot Network <<<>>> Donate at paypal.me/LNitescu <<<>>> 2019-07-19 04:33:58,259 INFO [amun_request_handler] PortScan Detected on Port: 1080 (107.170.192.236)

Port scan attempt detected by AWS-CCS, CTS, India

23/tcp 23/tcp
[2019-10-20/12-13]2pkt

Dec 13 17:08:58 microserver sshd[61289]: Invalid user fourkas from 94.191.122.149 port 40464
Dec 13 17:08:58 microserver sshd[61289]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.191.122.149
Dec 13 17:09:00 microserver sshd[61289]: Failed password for invalid user fourkas from 94.191.122.149 port 40464 ssh2
Dec 13 17:14:26 microserver sshd[62170]: Invalid user ftpuser from 94.191.122.149 port 50828
Dec 13 17:14:26 microserver sshd[62170]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.191.122.149
Dec 13 17:25:14 microserver sshd[64148]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.191.122.149  user=backup
Dec 13 17:25:15 microserver sshd[64148]: Failed password for backup from 94.191.122.149 port 43320 ssh2
Dec 13 17:29:56 microserver sshd[64502]: Invalid user guest from 94.191.122.149 port 53678
Dec 13 17:29:56 microserver sshd[64502]: pam_unix(sshd:auth): authentication fai

Dec 13 06:55:49 kapalua sshd\[17106\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.89.163.178  user=root
Dec 13 06:55:51 kapalua sshd\[17106\]: Failed password for root from 36.89.163.178 port 52559 ssh2
Dec 13 07:03:35 kapalua sshd\[17880\]: Invalid user squid from 36.89.163.178
Dec 13 07:03:35 kapalua sshd\[17880\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.89.163.178
Dec 13 07:03:37 kapalua sshd\[17880\]: Failed password for invalid user squid from 36.89.163.178 port 56189 ssh2

Unauthorized IMAP connection attempt

Dec 13 22:44:47 ArkNodeAT sshd\[14282\]: Invalid user test from 128.199.178.188
Dec 13 22:44:47 ArkNodeAT sshd\[14282\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.178.188
Dec 13 22:44:49 ArkNodeAT sshd\[14282\]: Failed password for invalid user test from 128.199.178.188 port 54642 ssh2

Dec 13 22:28:19 ncomp sshd[24954]: Invalid user info from 151.80.60.151
Dec 13 22:28:19 ncomp sshd[24954]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=151.80.60.151
Dec 13 22:28:19 ncomp sshd[24954]: Invalid user info from 151.80.60.151
Dec 13 22:28:21 ncomp sshd[24954]: Failed password for invalid user info from 151.80.60.151 port 52878 ssh2

122.228.19.80 was recorded 83 times by 25 hosts attempting to connect to the following ports: 8123,19,3310,4369,5269,3306,2086,10243,16992,990,8086,626,9080,8112,443,8087,4949,10554,7474,5222,548,40001,520,500,8500,55553,9600,79,5061,50070,9090,16993,9160,1194,50100,5050,83,2152,6881,37779,18245,2455,37778,1883,902,427,1521,6668,9191,444,1200,5001,623,28784,32400,37,80,3389,8333,1701,4911,6000,3299,28015,873,5901,21,4000. Incident counter (4h, 24h, all-time): 83, 516, 17981

Dec 13 07:11:11 web1 sshd\[1649\]: Invalid user baloran from 95.241.44.156
Dec 13 07:11:11 web1 sshd\[1649\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=95.241.44.156
Dec 13 07:11:13 web1 sshd\[1649\]: Failed password for invalid user baloran from 95.241.44.156 port 60957 ssh2
Dec 13 07:20:47 web1 sshd\[2563\]: Invalid user amano from 95.241.44.156
Dec 13 07:20:47 web1 sshd\[2563\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=95.241.44.156

12/13/2019-22:32:27.531780 80.82.65.74 Protocol: 6 ET DROP Dshield Block Listed Source group 1

Dec 13 15:07:02 *** sshd[21907]: Failed password for invalid user degezelle from 104.248.227.130 port 45950 ssh2
Dec 13 15:12:08 *** sshd[22055]: Failed password for invalid user www from 104.248.227.130 port 55258 ssh2
Dec 13 15:17:22 *** sshd[22149]: Failed password for invalid user coin from 104.248.227.130 port 36324 ssh2
Dec 13 15:27:56 *** sshd[22404]: Failed password for invalid user knoot from 104.248.227.130 port 54578 ssh2
Dec 13 15:33:10 *** sshd[22502]: Failed password for invalid user mingxin from 104.248.227.130 port 35930 ssh2
Dec 13 15:38:26 *** sshd[22579]: Failed password for invalid user Maaria from 104.248.227.130 port 45200 ssh2
Dec 13 15:49:00 *** sshd[22872]: Failed password for invalid user 1 from 104.248.227.130 port 35958 ssh2
Dec 13 15:54:23 *** sshd[22949]: Failed password for invalid user 124680 from 104.248.227.130 port 45322 ssh2
Dec 13 15:59:46 *** sshd[23028]: Failed password for invalid user hardison from 104.248.227.130 port 54672 ssh2
Dec 13 16:04:56 *** sshd[23199]: Failed

Dec 13 21:45:59 heissa sshd\[7552\]: Invalid user josh from 173.241.21.82 port 33096
Dec 13 21:45:59 heissa sshd\[7552\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.241.21.82
Dec 13 21:46:01 heissa sshd\[7552\]: Failed password for invalid user josh from 173.241.21.82 port 33096 ssh2
Dec 13 21:51:39 heissa sshd\[8527\]: Invalid user ef from 173.241.21.82 port 41812
Dec 13 21:51:39 heissa sshd\[8527\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.241.21.82

Dec 13 23:29:53 tux-35-217 sshd\[32692\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.175.148  user=root
Dec 13 23:29:56 tux-35-217 sshd\[32692\]: Failed password for root from 222.186.175.148 port 19848 ssh2
Dec 13 23:30:00 tux-35-217 sshd\[32692\]: Failed password for root from 222.186.175.148 port 19848 ssh2
Dec 13 23:30:03 tux-35-217 sshd\[32692\]: Failed password for root from 222.186.175.148 port 19848 ssh2
...

Dec 13 06:23:57 hpm sshd\[10530\]: Invalid user admin from 167.71.223.191
Dec 13 06:23:57 hpm sshd\[10530\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.223.191
Dec 13 06:23:59 hpm sshd\[10530\]: Failed password for invalid user admin from 167.71.223.191 port 37084 ssh2
Dec 13 06:30:02 hpm sshd\[11990\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.223.191  user=mysql
Dec 13 06:30:04 hpm sshd\[11990\]: Failed password for mysql from 167.71.223.191 port 41044 ssh2

Dec 13 16:06:06 linuxvps sshd\[49290\]: Invalid user abehassera from 181.127.196.226
Dec 13 16:06:06 linuxvps sshd\[49290\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.127.196.226
Dec 13 16:06:09 linuxvps sshd\[49290\]: Failed password for invalid user abehassera from 181.127.196.226 port 39230 ssh2
Dec 13 16:13:31 linuxvps sshd\[53836\]: Invalid user fazio from 181.127.196.226
Dec 13 16:13:31 linuxvps sshd\[53836\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.127.196.226

Dec 13 23:22:29 ns41 sshd[21930]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=131.114.98.64
Dec 13 23:22:29 ns41 sshd[21930]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=131.114.98.64