Mar 23 21:19:32 v22018086721571380 sshd[25323]: Failed password for invalid user ir from 113.161.1.111 port 46976 ssh2
Mar 23 21:22:56 v22018086721571380 sshd[25991]: Failed password for invalid user cacti from 113.161.1.111 port 45766 ssh2

detected by Fail2Ban

Feb 22 05:08:01 game-panel sshd[10633]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.161.1.111
Feb 22 05:08:03 game-panel sshd[10633]: Failed password for invalid user takamatsu from 113.161.1.111 port 46736 ssh2
Feb 22 05:11:22 game-panel sshd[10796]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.161.1.111

"SSH brute force auth login attempt."

Unauthorized connection attempt detected from IP address 113.161.1.111 to port 2220 [J]

Jan 11 23:16:55 meumeu sshd[28260]: Failed password for root from 113.161.1.111 port 51552 ssh2
Jan 11 23:19:49 meumeu sshd[28777]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.161.1.111 
Jan 11 23:19:50 meumeu sshd[28777]: Failed password for invalid user os from 113.161.1.111 port 35915 ssh2
...

Dec  1 23:43:50 MainVPS sshd[17402]: Invalid user bind from 113.161.1.111 port 54934
Dec  1 23:43:50 MainVPS sshd[17402]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.161.1.111
Dec  1 23:43:50 MainVPS sshd[17402]: Invalid user bind from 113.161.1.111 port 54934
Dec  1 23:43:52 MainVPS sshd[17402]: Failed password for invalid user bind from 113.161.1.111 port 54934 ssh2
Dec  1 23:50:14 MainVPS sshd[28514]: Invalid user NetLinx from 113.161.1.111 port 60883
...

Nov 25 17:52:29 h2177944 sshd\[25529\]: Invalid user wiroll from 113.161.1.111 port 36976
Nov 25 17:52:29 h2177944 sshd\[25529\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.161.1.111
Nov 25 17:52:31 h2177944 sshd\[25529\]: Failed password for invalid user wiroll from 113.161.1.111 port 36976 ssh2
Nov 25 17:59:25 h2177944 sshd\[25942\]: Invalid user ching from 113.161.1.111 port 54125
...

Nov 25 08:20:36 pkdns2 sshd\[43542\]: Address 113.161.1.111 maps to static.vnpt.vn, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!Nov 25 08:20:36 pkdns2 sshd\[43542\]: Invalid user dorri from 113.161.1.111Nov 25 08:20:38 pkdns2 sshd\[43542\]: Failed password for invalid user dorri from 113.161.1.111 port 34220 ssh2Nov 25 08:27:43 pkdns2 sshd\[43824\]: Address 113.161.1.111 maps to static.vnpt.vn, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!Nov 25 08:27:43 pkdns2 sshd\[43824\]: Invalid user kazmer from 113.161.1.111Nov 25 08:27:46 pkdns2 sshd\[43824\]: Failed password for invalid user kazmer from 113.161.1.111 port 51834 ssh2
...

Oct 28 19:02:37 tdfoods sshd\[10591\]: Invalid user 123 from 113.161.1.111
Oct 28 19:02:37 tdfoods sshd\[10591\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.161.1.111
Oct 28 19:02:39 tdfoods sshd\[10591\]: Failed password for invalid user 123 from 113.161.1.111 port 39428 ssh2
Oct 28 19:07:13 tdfoods sshd\[10952\]: Invalid user 1a2b3c4d5e6f7g from 113.161.1.111
Oct 28 19:07:13 tdfoods sshd\[10952\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.161.1.111

Oct 25 16:13:36 vps01 sshd[25220]: Failed password for root from 113.161.1.111 port 35204 ssh2

Oct 18 09:48:57 web9 sshd\[32067\]: Invalid user luka123 from 113.161.1.111
Oct 18 09:48:57 web9 sshd\[32067\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.161.1.111
Oct 18 09:48:59 web9 sshd\[32067\]: Failed password for invalid user luka123 from 113.161.1.111 port 45467 ssh2
Oct 18 09:53:39 web9 sshd\[32684\]: Invalid user changeme from 113.161.1.111
Oct 18 09:53:39 web9 sshd\[32684\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.161.1.111

Sep 17 11:38:50 eventyay sshd[19563]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.161.1.111
Sep 17 11:38:52 eventyay sshd[19563]: Failed password for invalid user hp from 113.161.1.111 port 54981 ssh2
Sep 17 11:43:41 eventyay sshd[19678]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.161.1.111
...

2019-09-05T03:24:22.529910abusebot-8.cloudsearch.cf sshd\[23514\]: Invalid user userftp from 113.161.1.111 port 51979

Invalid user jayden from 113.161.1.111 port 36056

$f2bV_matches

Aug 15 07:08:03 microserver sshd[30875]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.161.1.111  user=root
Aug 15 07:08:04 microserver sshd[30875]: Failed password for root from 113.161.1.111 port 42167 ssh2
Aug 15 07:13:23 microserver sshd[31657]: Invalid user teamspeak from 113.161.1.111 port 37754
Aug 15 07:13:23 microserver sshd[31657]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.161.1.111
Aug 15 07:13:24 microserver sshd[31657]: Failed password for invalid user teamspeak from 113.161.1.111 port 37754 ssh2
Aug 15 07:23:52 microserver sshd[33227]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.161.1.111  user=root
Aug 15 07:23:54 microserver sshd[33227]: Failed password for root from 113.161.1.111 port 57158 ssh2
Aug 15 07:29:12 microserver sshd[34001]: Invalid user guest from 113.161.1.111 port 52747
Aug 15 07:29:12 microserver sshd[34001]: pam_unix(sshd:auth): authen

ssh failed login

Jul 31 08:27:21 site3 sshd\[121370\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.161.1.111  user=root
Jul 31 08:27:24 site3 sshd\[121370\]: Failed password for root from 113.161.1.111 port 33812 ssh2
Jul 31 08:32:27 site3 sshd\[121479\]: Invalid user aleja from 113.161.1.111
Jul 31 08:32:27 site3 sshd\[121479\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.161.1.111
Jul 31 08:32:29 site3 sshd\[121479\]: Failed password for invalid user aleja from 113.161.1.111 port 58930 ssh2
...

Jul 18 15:01:43 aat-srv002 sshd[18906]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.161.1.111
Jul 18 15:01:45 aat-srv002 sshd[18906]: Failed password for invalid user test from 113.161.1.111 port 48252 ssh2
Jul 18 15:07:23 aat-srv002 sshd[19022]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.161.1.111
Jul 18 15:07:24 aat-srv002 sshd[19022]: Failed password for invalid user temp from 113.161.1.111 port 46959 ssh2
...

Jul 18 09:15:50 vps691689 sshd[31287]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.161.1.111
Jul 18 09:15:52 vps691689 sshd[31287]: Failed password for invalid user simon from 113.161.1.111 port 39648 ssh2
Jul 18 09:21:41 vps691689 sshd[31352]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.161.1.111
...

Jul 17 18:47:06 vps691689 sshd[19559]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.161.1.111
Jul 17 18:47:08 vps691689 sshd[19559]: Failed password for invalid user oracle from 113.161.1.111 port 48432 ssh2
...

ssh failed login

TCP ports : 445 / 1433

TCP ports : 445 / 1433

firewall-block, port(s): 1433/tcp

(imapd) Failed IMAP login from 113.161.151.29 (VN/Vietnam/static.vnpt.vn): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Sep 11 19:38:39 ir1 dovecot[3110802]: imap-login: Disconnected (auth failed, 1 attempts in 4 secs): user=, method=PLAIN, rip=113.161.151.29, lip=5.63.12.44, TLS: Connection closed, session=

Distributed brute force attack

Distributed brute force attack

Icarus honeypot on github

445/tcp 445/tcp 445/tcp...
[2020-07-06/08-28]4pkt,1pt.(tcp)

firewall-block, port(s): 445/tcp

20/8/23@23:52:07: FAIL: Alarm-Network address from=113.161.128.158
...

Aug 22 05:51:45 root sshd[2872]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.161.144.254 
Aug 22 05:51:47 root sshd[2872]: Failed password for invalid user divya from 113.161.144.254 port 2442 ssh2
Aug 22 05:55:47 root sshd[3385]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.161.144.254 
...

srvr1: (mod_security) mod_security (id:942100) triggered by 113.161.128.192 (VN/-/static.vnpt.vn): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: 2020/08/21 12:05:47 [error] 482759#0: *840589 [client 113.161.128.192] ModSecurity: Access denied with code 406 (phase 2).  [file "/etc/modsecurity.d/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "45"] [id "942100"] [rev ""] [msg ""] [redacted] [severity "0"] [ver "OWASP_CRS/3.3.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [redacted] [uri "/forum/viewthread.php"] [unique_id "159801154742.003820"] [ref ""], client: 113.161.128.192, [redacted] request: "GET /forum/viewthread.php?thread_id=1122%27%29%29+OR+++%28%286544%3D0 HTTP/1.1" [redacted]

2 Attack(s) Detected
[DoS Attack: RST Scan] from source: 113.161.186.193, port 38380, Wednesday, August 19, 2020 04:51:25

[DoS Attack: RST Scan] from source: 113.161.186.193, port 36684, Wednesday, August 19, 2020 04:49:48

Aug 19 23:58:08 itv-usvr-01 sshd[6697]: Invalid user document from 113.161.144.254
Aug 19 23:58:08 itv-usvr-01 sshd[6697]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.161.144.254
Aug 19 23:58:08 itv-usvr-01 sshd[6697]: Invalid user document from 113.161.144.254
Aug 19 23:58:10 itv-usvr-01 sshd[6697]: Failed password for invalid user document from 113.161.144.254 port 47062 ssh2

1597722501 - 08/18/2020 05:48:21 Host: 113.161.198.166/113.161.198.166 Port: 445 TCP Blocked

Oct  8 14:53:50 vps647732 sshd[8787]: Failed password for root from 51.75.205.122 port 45656 ssh2
...

2019-10-08T13:05:29.642830abusebot-4.cloudsearch.cf sshd\[23871\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.226.182.209  user=root

Jun 20 17:55:43 ubuntu sshd[6637]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.11.92.82
Jun 20 17:55:44 ubuntu sshd[6637]: Failed password for invalid user nuo from 221.11.92.82 port 40497 ssh2
Jun 20 17:56:26 ubuntu sshd[6646]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.11.92.82
Jun 20 17:56:28 ubuntu sshd[6646]: Failed password for invalid user sha from 221.11.92.82 port 43618 ssh2

The IP address [178.19.108.162] experienced 5 failed attempts when attempting to log into SSH

Oct  8 13:55:32 vmanager6029 sshd\[17541\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.199  user=root
Oct  8 13:55:34 vmanager6029 sshd\[17541\]: Failed password for root from 218.92.0.199 port 62982 ssh2
Oct  8 13:55:37 vmanager6029 sshd\[17541\]: Failed password for root from 218.92.0.199 port 62982 ssh2

Oct  8 15:56:55 www sshd\[75000\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.18.93.114  user=root
Oct  8 15:56:57 www sshd\[75000\]: Failed password for root from 14.18.93.114 port 43242 ssh2
Oct  8 16:02:37 www sshd\[75028\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.18.93.114  user=root
...

2019-10-08T12:27:56.363658abusebot-3.cloudsearch.cf sshd\[13519\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.40.66.179  user=root

SMB Server BruteForce Attack

Oct  8 16:00:00 sauna sshd[21429]: Failed password for root from 222.186.42.15 port 62480 ssh2
Oct  8 16:00:02 sauna sshd[21429]: Failed password for root from 222.186.42.15 port 62480 ssh2
...

Oct  8 14:22:09 mail sshd[15268]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.228.19.86 
Oct  8 14:22:11 mail sshd[15268]: Failed password for invalid user Losenord1234 from 103.228.19.86 port 10200 ssh2
Oct  8 14:27:43 mail sshd[17280]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.228.19.86

Oct  8 13:37:43 ovpn sshd\[10236\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=223.25.101.76  user=root
Oct  8 13:37:45 ovpn sshd\[10236\]: Failed password for root from 223.25.101.76 port 38050 ssh2
Oct  8 13:51:54 ovpn sshd\[12932\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=223.25.101.76  user=root
Oct  8 13:51:55 ovpn sshd\[12932\]: Failed password for root from 223.25.101.76 port 34982 ssh2
Oct  8 13:56:16 ovpn sshd\[13752\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=223.25.101.76  user=root

2019-10-08T12:26:35.780204abusebot-5.cloudsearch.cf sshd\[3580\]: Invalid user alm from 178.128.215.148 port 53894

2019-10-08T12:40:11.671218shield sshd\[24226\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=70.ip-151-80-61.eu  user=root
2019-10-08T12:40:13.959705shield sshd\[24226\]: Failed password for root from 151.80.61.70 port 53372 ssh2
2019-10-08T12:43:58.333716shield sshd\[24590\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=70.ip-151-80-61.eu  user=root
2019-10-08T12:44:00.113988shield sshd\[24590\]: Failed password for root from 151.80.61.70 port 36644 ssh2
2019-10-08T12:47:38.121969shield sshd\[25211\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=70.ip-151-80-61.eu  user=root

Oct  2 21:31:11 dallas01 sshd[23877]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.122.78.202
Oct  2 21:31:13 dallas01 sshd[23877]: Failed password for invalid user iiiii from 221.122.78.202 port 48009 ssh2
Oct  2 21:34:06 dallas01 sshd[24312]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.122.78.202

excessive spam againt server; faking old user agents etc.