Nov  5 07:20:02 DAAP sshd[19158]: Invalid user pp from 111.93.235.210 port 34971
Nov  5 07:20:02 DAAP sshd[19158]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.93.235.210
Nov  5 07:20:02 DAAP sshd[19158]: Invalid user pp from 111.93.235.210 port 34971
Nov  5 07:20:04 DAAP sshd[19158]: Failed password for invalid user pp from 111.93.235.210 port 34971 ssh2
Nov  5 07:25:40 DAAP sshd[19215]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.93.235.210  user=root
Nov  5 07:25:42 DAAP sshd[19215]: Failed password for root from 111.93.235.210 port 52906 ssh2
...

Oct 29 07:11:08 sauna sshd[66828]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.93.235.210
Oct 29 07:11:11 sauna sshd[66828]: Failed password for invalid user jboss from 111.93.235.210 port 45943 ssh2
...

$f2bV_matches

Automatic report - Banned IP Access

Oct 20 05:51:51 cvbnet sshd[1635]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.93.235.210 
Oct 20 05:51:53 cvbnet sshd[1635]: Failed password for invalid user sudyka from 111.93.235.210 port 34750 ssh2
...

Oct  6 17:20:17 eola sshd[2441]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.93.235.210  user=r.r
Oct  6 17:20:19 eola sshd[2441]: Failed password for r.r from 111.93.235.210 port 36568 ssh2
Oct  6 17:20:19 eola sshd[2441]: Received disconnect from 111.93.235.210 port 36568:11: Bye Bye [preauth]
Oct  6 17:20:19 eola sshd[2441]: Disconnected from 111.93.235.210 port 36568 [preauth]
Oct  6 17:29:21 eola sshd[2569]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.93.235.210  user=r.r
Oct  6 17:29:23 eola sshd[2569]: Failed password for r.r from 111.93.235.210 port 44201 ssh2
Oct  6 17:29:23 eola sshd[2569]: Received disconnect from 111.93.235.210 port 44201:11: Bye Bye [preauth]
Oct  6 17:29:23 eola sshd[2569]: Disconnected from 111.93.235.210 port 44201 [preauth]
Oct  6 17:33:38 eola sshd[2630]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost........
-------------------------------

Oct  6 17:20:17 eola sshd[2441]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.93.235.210  user=r.r
Oct  6 17:20:19 eola sshd[2441]: Failed password for r.r from 111.93.235.210 port 36568 ssh2
Oct  6 17:20:19 eola sshd[2441]: Received disconnect from 111.93.235.210 port 36568:11: Bye Bye [preauth]
Oct  6 17:20:19 eola sshd[2441]: Disconnected from 111.93.235.210 port 36568 [preauth]
Oct  6 17:29:21 eola sshd[2569]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.93.235.210  user=r.r
Oct  6 17:29:23 eola sshd[2569]: Failed password for r.r from 111.93.235.210 port 44201 ssh2
Oct  6 17:29:23 eola sshd[2569]: Received disconnect from 111.93.235.210 port 44201:11: Bye Bye [preauth]
Oct  6 17:29:23 eola sshd[2569]: Disconnected from 111.93.235.210 port 44201 [preauth]
Oct  6 17:33:38 eola sshd[2630]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost........
-------------------------------

Oct  8 11:17:04 MK-Soft-Root2 sshd[31452]: Failed password for root from 111.93.235.210 port 50856 ssh2
...

Oct  7 05:28:09 microserver sshd[25518]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.93.235.210  user=root
Oct  7 05:28:11 microserver sshd[25518]: Failed password for root from 111.93.235.210 port 42342 ssh2
Oct  7 05:32:46 microserver sshd[26185]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.93.235.210  user=root
Oct  7 05:32:47 microserver sshd[26185]: Failed password for root from 111.93.235.210 port 34156 ssh2
Oct  7 05:37:16 microserver sshd[26837]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.93.235.210  user=root
Oct  7 05:50:32 microserver sshd[28803]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.93.235.210  user=root
Oct  7 05:50:34 microserver sshd[28803]: Failed password for root from 111.93.235.210 port 57872 ssh2
Oct  7 05:54:55 microserver sshd[29082]: pam_unix(sshd:auth): authentication failure; logname= uid

Sep 27 17:45:47 XXXXXX sshd[24504]: Invalid user guest from 111.93.235.74 port 4899

Sep 27 13:08:48 vm1 sshd[6067]: Failed password for root from 111.93.235.74 port 26499 ssh2
...

Sep 16 20:08:32 vps647732 sshd[2790]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.93.235.74
Sep 16 20:08:34 vps647732 sshd[2790]: Failed password for invalid user cs from 111.93.235.74 port 52272 ssh2
...

Invalid user d from 111.93.235.74 port 50052

pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.93.235.74
Invalid user order from 111.93.235.74 port 30751
Failed password for invalid user order from 111.93.235.74 port 30751 ssh2
pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.93.235.74  user=root
Failed password for root from 111.93.235.74 port 40096 ssh2

Sep 13 06:06:44  sshd\[19853\]: User root from 111.93.235.74 not allowed because not listed in AllowUsersSep 13 06:06:46  sshd\[19853\]: Failed password for invalid user root from 111.93.235.74 port 45664 ssh2
...

Sep 13 00:04:35 gw1 sshd[16545]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.93.235.74
Sep 13 00:04:37 gw1 sshd[16545]: Failed password for invalid user aombeva from 111.93.235.74 port 46710 ssh2
...

Sep  8 13:15:23 vm1 sshd[25757]: Failed password for root from 111.93.235.74 port 24814 ssh2
...

SSH Brute-Force attacks

Sep  7 22:27:04 v22019038103785759 sshd\[27783\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.93.235.74  user=root
Sep  7 22:27:07 v22019038103785759 sshd\[27783\]: Failed password for root from 111.93.235.74 port 9376 ssh2
Sep  7 22:31:10 v22019038103785759 sshd\[28166\]: Invalid user butter from 111.93.235.74 port 13549
Sep  7 22:31:10 v22019038103785759 sshd\[28166\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.93.235.74
Sep  7 22:31:12 v22019038103785759 sshd\[28166\]: Failed password for invalid user butter from 111.93.235.74 port 13549 ssh2
...

111.93.235.74 (IN/India/static-74.235.93.111-tataidc.co.in), 3 distributed sshd attacks on account [admin] in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_DISTATTACK; Logs: Sep  6 08:21:07 internal2 sshd[14235]: Invalid user admin from 67.209.248.34 port 35781
Sep  6 08:21:07 internal2 sshd[14244]: Invalid user admin from 67.209.248.34 port 35807
Sep  6 08:19:01 internal2 sshd[12561]: Invalid user admin from 111.93.235.74 port 59313

IP Addresses Blocked:

67.209.248.34 (US/United States/-)

ssh brute force

Sep  5 20:39:55 ip-172-31-16-56 sshd\[22345\]: Invalid user ventas123 from 111.93.235.74\
Sep  5 20:39:57 ip-172-31-16-56 sshd\[22345\]: Failed password for invalid user ventas123 from 111.93.235.74 port 53319 ssh2\
Sep  5 20:43:46 ip-172-31-16-56 sshd\[22357\]: Invalid user vector from 111.93.235.74\
Sep  5 20:43:49 ip-172-31-16-56 sshd\[22357\]: Failed password for invalid user vector from 111.93.235.74 port 15197 ssh2\
Sep  5 20:47:37 ip-172-31-16-56 sshd\[22376\]: Invalid user oracle123!@\# from 111.93.235.74\

Aug 31 13:17:46 melroy-server sshd[29930]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.93.235.74 
Aug 31 13:17:48 melroy-server sshd[29930]: Failed password for invalid user terry from 111.93.235.74 port 44713 ssh2
...

Unauthorised connection attempt detected at AUO MAIN. System is sshd. Protected by AUO Stack Web Application Firewall (WAF)

prod6
...

Jun  6 12:48:56 santamaria sshd\[17231\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.173.226  user=root
Jun  6 12:48:58 santamaria sshd\[17231\]: Failed password for root from 222.186.173.226 port 43058 ssh2
Jun  6 12:49:16 santamaria sshd\[17234\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.173.226  user=root
...

Brute force attempt

Automatic report - Banned IP Access

 TCP (SYN) 198.108.67.18:49612 -> port 22, len 44

SmallBizIT.US 1 packets to tcp(23)

20/6/6@00:14:37: FAIL: Alarm-Network address from=183.89.245.30
...

Jun  6 16:05:31 gw1 sshd[31303]: Failed password for root from 222.186.52.39 port 28024 ssh2
...

Jun  6 11:28:31 server sshd[28348]: Failed password for root from 51.38.238.165 port 43394 ssh2
Jun  6 11:32:01 server sshd[28581]: Failed password for root from 51.38.238.165 port 47198 ssh2
...

Jun  6 12:25:34 inter-technics sshd[816]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.109.222  user=root
Jun  6 12:25:36 inter-technics sshd[816]: Failed password for root from 122.51.109.222 port 39418 ssh2
Jun  6 12:27:21 inter-technics sshd[918]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.109.222  user=root
Jun  6 12:27:23 inter-technics sshd[918]: Failed password for root from 122.51.109.222 port 58816 ssh2
Jun  6 12:29:13 inter-technics sshd[999]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.109.222  user=root
Jun  6 12:29:14 inter-technics sshd[999]: Failed password for root from 122.51.109.222 port 49988 ssh2
...

Jun  6 12:39:48 abendstille sshd\[21369\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.232.174.219  user=root
Jun  6 12:39:50 abendstille sshd\[21369\]: Failed password for root from 49.232.174.219 port 15324 ssh2
Jun  6 12:44:40 abendstille sshd\[26389\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.232.174.219  user=root
Jun  6 12:44:43 abendstille sshd\[26389\]: Failed password for root from 49.232.174.219 port 3515 ssh2
Jun  6 12:49:27 abendstille sshd\[30986\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.232.174.219  user=root
...

Jun  6 06:00:55 nas sshd[30336]: Failed password for root from 54.223.114.32 port 40164 ssh2
Jun  6 06:11:03 nas sshd[30623]: Failed password for root from 54.223.114.32 port 55334 ssh2
...

SSH brute-force attempt

SSH invalid-user multiple login attempts

(sshd) Failed SSH login from 195.84.49.20 (SE/Sweden/20.0-24.49.84.195.host.songnetworks.se): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Jun  6 10:34:54 amsweb01 sshd[21257]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.84.49.20  user=root
Jun  6 10:34:56 amsweb01 sshd[21257]: Failed password for root from 195.84.49.20 port 44284 ssh2
Jun  6 10:43:46 amsweb01 sshd[22575]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.84.49.20  user=root
Jun  6 10:43:48 amsweb01 sshd[22575]: Failed password for root from 195.84.49.20 port 44840 ssh2
Jun  6 10:46:48 amsweb01 sshd[23000]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.84.49.20  user=root