Attempted to establish connection to non opened port 55553

Honeypot attack, port: 5555, PTR: PTR record not found

2087/tcp 2082/tcp 20000/tcp...
[2020-04-20/06-18]74pkt,15pt.(tcp)

Honeypot attack, port: 2000, PTR: PTR record not found

Jan 15 05:54:03 debian-2gb-nbg1-2 kernel: \[1323342.057689\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=117.50.65.167 DST=195.201.40.59 LEN=44 TOS=0x00 PREC=0x00 TTL=236 ID=59592 PROTO=TCP SPT=58914 DPT=4064 WINDOW=1024 RES=0x00 SYN URGP=0

Jan  1 15:46:43 debian-2gb-nbg1-2 kernel: \[149335.256261\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=117.50.65.167 DST=195.201.40.59 LEN=44 TOS=0x00 PREC=0x00 TTL=236 ID=2667 PROTO=TCP SPT=58914 DPT=636 WINDOW=1024 RES=0x00 SYN URGP=0

port scan and connect, tcp 3128 (squid-http)

 TCP (SYN) 117.50.65.85:53863 -> port 23, len 40

$f2bV_matches

Jul  5 18:09:15 server1 sshd\[27354\]: Invalid user ajay from 117.50.65.85
Jul  5 18:09:15 server1 sshd\[27354\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.50.65.85 
Jul  5 18:09:17 server1 sshd\[27354\]: Failed password for invalid user ajay from 117.50.65.85 port 36852 ssh2
Jul  5 18:12:20 server1 sshd\[28388\]: Invalid user justin from 117.50.65.85
Jul  5 18:12:20 server1 sshd\[28388\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.50.65.85 
...

Jun 27 21:07:00 dignus sshd[29801]: Failed password for invalid user jmiguel from 117.50.65.85 port 54320 ssh2
Jun 27 21:09:00 dignus sshd[29946]: Invalid user bsh from 117.50.65.85 port 55134
Jun 27 21:09:00 dignus sshd[29946]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.50.65.85
Jun 27 21:09:03 dignus sshd[29946]: Failed password for invalid user bsh from 117.50.65.85 port 55134 ssh2
Jun 27 21:11:01 dignus sshd[30101]: Invalid user mantis from 117.50.65.85 port 55954
...

2020-06-08T02:58:23.094791afi-git.jinr.ru sshd[8607]: Failed password for root from 117.50.65.85 port 48450 ssh2
2020-06-08T02:59:48.970954afi-git.jinr.ru sshd[8865]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.50.65.85  user=root
2020-06-08T02:59:51.182370afi-git.jinr.ru sshd[8865]: Failed password for root from 117.50.65.85 port 43328 ssh2
2020-06-08T03:01:17.141745afi-git.jinr.ru sshd[9361]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.50.65.85  user=root
2020-06-08T03:01:18.570478afi-git.jinr.ru sshd[9361]: Failed password for root from 117.50.65.85 port 38206 ssh2
...

SSH Brute-Force attacks

Jun  2 00:03:58 ns382633 sshd\[21842\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.50.65.85  user=root
Jun  2 00:03:59 ns382633 sshd\[21842\]: Failed password for root from 117.50.65.85 port 60330 ssh2
Jun  2 00:16:11 ns382633 sshd\[24538\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.50.65.85  user=root
Jun  2 00:16:13 ns382633 sshd\[24538\]: Failed password for root from 117.50.65.85 port 52882 ssh2
Jun  2 00:19:20 ns382633 sshd\[24860\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.50.65.85  user=root

May 23 14:02:03 piServer sshd[20578]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.50.65.85 
May 23 14:02:06 piServer sshd[20578]: Failed password for invalid user znp from 117.50.65.85 port 42192 ssh2
May 23 14:04:02 piServer sshd[20755]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.50.65.85 
...

May 13 07:16:52 server1 sshd\[23115\]: Invalid user telcel3 from 117.50.65.85
May 13 07:16:52 server1 sshd\[23115\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.50.65.85 
May 13 07:16:54 server1 sshd\[23115\]: Failed password for invalid user telcel3 from 117.50.65.85 port 36926 ssh2
May 13 07:19:17 server1 sshd\[23746\]: Invalid user hance from 117.50.65.85
May 13 07:19:17 server1 sshd\[23746\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.50.65.85 
...

Invalid user admin from 117.50.65.85 port 59328

SSH Authentication Attempts Exceeded

Invalid user mythic from 117.50.65.217 port 43894

Mar 17 01:05:29 lnxweb62 sshd[29545]: Failed password for root from 117.50.65.217 port 33844 ssh2
Mar 17 01:05:29 lnxweb62 sshd[29545]: Failed password for root from 117.50.65.217 port 33844 ssh2

Mar 14 05:33:58 vps647732 sshd[18549]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.50.65.217
Mar 14 05:34:00 vps647732 sshd[18549]: Failed password for invalid user admin1 from 117.50.65.217 port 49000 ssh2
...

Feb 20 21:58:00 clarabelen sshd[23896]: Invalid user asterisk from 117.50.65.85
Feb 20 21:58:00 clarabelen sshd[23896]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.50.65.85 
Feb 20 21:58:02 clarabelen sshd[23896]: Failed password for invalid user asterisk from 117.50.65.85 port 48810 ssh2
Feb 20 21:58:02 clarabelen sshd[23896]: Received disconnect from 117.50.65.85: 11: Bye Bye [preauth]
Feb 20 22:25:19 clarabelen sshd[27412]: Invalid user vmail from 117.50.65.85
Feb 20 22:25:19 clarabelen sshd[27412]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.50.65.85 
Feb 20 22:25:21 clarabelen sshd[27412]: Failed password for invalid user vmail from 117.50.65.85 port 48190 ssh2
Feb 20 22:25:21 clarabelen sshd[27412]: Received disconnect from 117.50.65.85: 11: Bye Bye [preauth]
Feb 20 22:28:43 clarabelen sshd[27694]: Invalid user user11 from 117.50.65.85
Feb 20 22:28:43 clarabelen sshd[27........
-------------------------------

145.239.29.217 - - [21/Sep/2020:06:50:02 +0100] "POST /wp-login.php HTTP/1.1" 200 1861 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
145.239.29.217 - - [21/Sep/2020:06:50:02 +0100] "POST /wp-login.php HTTP/1.1" 200 1839 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
145.239.29.217 - - [21/Sep/2020:06:50:03 +0100] "POST /xmlrpc.php HTTP/1.1" 403 219 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
...

(sshd) Failed SSH login from 60.167.182.184 (CN/China/Anhui/Rongcheng/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Sep 21 01:37:21 atlas sshd[23537]: Invalid user system from 60.167.182.184 port 50658
Sep 21 01:37:23 atlas sshd[23537]: Failed password for invalid user system from 60.167.182.184 port 50658 ssh2
Sep 21 02:10:43 atlas sshd[31842]: Invalid user admin from 60.167.182.184 port 47442
Sep 21 02:10:45 atlas sshd[31842]: Failed password for invalid user admin from 60.167.182.184 port 47442 ssh2
Sep 21 02:24:01 atlas sshd[2977]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=60.167.182.184  user=root

Unauthorized connection attempt from IP address 103.90.202.230 on Port 445(SMB)

118.89.108.152 (CN/China/-), 7 distributed sshd attacks on account [postgres] in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_DISTATTACK; Logs: Sep 21 00:12:05 jbs1 sshd[2366]: Invalid user postgres from 118.89.108.152
Sep 21 00:12:07 jbs1 sshd[2366]: Failed password for invalid user postgres from 118.89.108.152 port 59136 ssh2
Sep 21 00:02:46 jbs1 sshd[26066]: Invalid user postgres from 111.231.243.21
Sep 21 00:02:49 jbs1 sshd[26066]: Failed password for invalid user postgres from 111.231.243.21 port 54978 ssh2
Sep 21 00:12:29 jbs1 sshd[2607]: Invalid user postgres from 101.71.28.72
Sep 21 00:09:30 jbs1 sshd[32328]: Invalid user postgres from 175.24.17.53
Sep 21 00:09:32 jbs1 sshd[32328]: Failed password for invalid user postgres from 175.24.17.53 port 42246 ssh2

IP Addresses Blocked:

20 attempts against mh-ssh on echoip

Sep 21 08:10:23 web-main sshd[3631728]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.77.105.98 
Sep 21 08:10:23 web-main sshd[3631728]: Invalid user mysql from 202.77.105.98 port 38102
Sep 21 08:10:25 web-main sshd[3631728]: Failed password for invalid user mysql from 202.77.105.98 port 38102 ssh2

Sep 20 19:40:42 sachi sshd\[23404\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.198.228.2  user=root
Sep 20 19:40:44 sachi sshd\[23404\]: Failed password for root from 104.198.228.2 port 54182 ssh2
Sep 20 19:44:32 sachi sshd\[23663\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.198.228.2  user=root
Sep 20 19:44:35 sachi sshd\[23663\]: Failed password for root from 104.198.228.2 port 36632 ssh2
Sep 20 19:48:20 sachi sshd\[23991\]: Invalid user alex from 104.198.228.2

20/9/20@13:00:56: FAIL: Alarm-Network address from=14.241.212.142
20/9/20@13:00:57: FAIL: Alarm-Network address from=14.241.212.142
...

Sep 20 17:01:06 scw-focused-cartwright sshd[23363]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=135.181.41.225
Sep 20 17:01:08 scw-focused-cartwright sshd[23363]: Failed password for invalid user admin from 135.181.41.225 port 50664 ssh2

Sep 21 08:54:38 rotator sshd\[7217\]: Invalid user demo from 61.188.18.141Sep 21 08:54:41 rotator sshd\[7217\]: Failed password for invalid user demo from 61.188.18.141 port 43026 ssh2Sep 21 08:57:56 rotator sshd\[8012\]: Failed password for root from 61.188.18.141 port 59134 ssh2Sep 21 09:01:32 rotator sshd\[8793\]: Invalid user ubuntu from 61.188.18.141Sep 21 09:01:34 rotator sshd\[8793\]: Failed password for invalid user ubuntu from 61.188.18.141 port 46981 ssh2Sep 21 09:04:29 rotator sshd\[8822\]: Failed password for root from 61.188.18.141 port 34813 ssh2
...

Sep 20 19:00:59 roki-contabo sshd\[26089\]: Invalid user support from 219.77.178.241
Sep 20 19:01:00 roki-contabo sshd\[26089\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=219.77.178.241
Sep 20 19:01:01 roki-contabo sshd\[26089\]: Failed password for invalid user support from 219.77.178.241 port 42056 ssh2
Sep 20 19:01:09 roki-contabo sshd\[26117\]: Invalid user ubnt from 219.77.178.241
Sep 20 19:01:09 roki-contabo sshd\[26117\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=219.77.178.241
...

Sep 21 09:23:11 theomazars sshd[30078]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.175.154  user=root
Sep 21 09:23:13 theomazars sshd[30078]: Failed password for root from 222.186.175.154 port 2672 ssh2

Sep 21 00:02:14 root sshd[11720]: Invalid user netman from 54.37.6.190
...

(sshd) Failed SSH login from 121.204.59.179 (CN/China/179.59.204.121.board.fz.fj.dynamic.163data.com.cn): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Sep 20 19:01:16 rainbow sshd[7503]: Invalid user nagios from 121.204.59.179 port 44007
Sep 20 19:01:16 rainbow sshd[7503]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.204.59.179 
Sep 20 19:01:16 rainbow sshd[7501]: Invalid user cablecom from 121.204.59.179 port 43995
Sep 20 19:01:16 rainbow sshd[7501]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.204.59.179 
Sep 20 19:01:17 rainbow sshd[7507]: Invalid user netman from 121.204.59.179 port 44010

ET DROP Dshield Block Listed Source group 1 - port: 45063 proto: tcp cat: Misc Attackbytes: 60