2019-12-22T08:45:57.776512-07:00 suse-nuc sshd[4899]: Invalid user sandbox from 118.192.66.91 port 55715
...

2019-12-21T07:25:02.164031scmdmz1 sshd[29988]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.192.66.91  user=root
2019-12-21T07:25:04.275654scmdmz1 sshd[29988]: Failed password for root from 118.192.66.91 port 42315 ssh2
2019-12-21T07:30:57.771018scmdmz1 sshd[30573]: Invalid user veronica from 118.192.66.91 port 37955
2019-12-21T07:30:57.773748scmdmz1 sshd[30573]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.192.66.91
2019-12-21T07:30:57.771018scmdmz1 sshd[30573]: Invalid user veronica from 118.192.66.91 port 37955
2019-12-21T07:30:59.619555scmdmz1 sshd[30573]: Failed password for invalid user veronica from 118.192.66.91 port 37955 ssh2
...

Dec 21 00:10:15 meumeu sshd[32300]: Failed password for root from 118.192.66.91 port 33470 ssh2
Dec 21 00:16:18 meumeu sshd[696]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.192.66.91 
Dec 21 00:16:20 meumeu sshd[696]: Failed password for invalid user takahashi from 118.192.66.91 port 60527 ssh2
...

Nov 10 02:34:33 mockhub sshd[2705]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.192.66.91
Nov 10 02:34:35 mockhub sshd[2705]: Failed password for invalid user cl from 118.192.66.91 port 45617 ssh2
...

F2B jail: sshd. Time: 2019-11-08 08:57:50, Reported by: VKReport

2019-08-20T13:09:02.642967Z 571f5923e87c New connection: 118.192.66.91:34228 (172.17.0.2:2222) [session: 571f5923e87c]
2019-08-20T13:31:12.413629Z def169a8c084 New connection: 118.192.66.91:42724 (172.17.0.2:2222) [session: def169a8c084]

Aug 16 23:24:51 php1 sshd\[8683\]: Invalid user p2ptest from 118.192.66.91
Aug 16 23:24:51 php1 sshd\[8683\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.192.66.91
Aug 16 23:24:54 php1 sshd\[8683\]: Failed password for invalid user p2ptest from 118.192.66.91 port 41754 ssh2
Aug 16 23:26:57 php1 sshd\[8858\]: Invalid user doug from 118.192.66.91
Aug 16 23:26:57 php1 sshd\[8858\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.192.66.91

IP 118.192.66.70 attacked honeypot on port: 139 at 6/8/2020 9:26:04 PM

Unauthorized connection attempt detected from IP address 118.192.66.52 to port 2220 [J]

Unauthorized connection attempt detected from IP address 118.192.66.52 to port 2220 [J]

Invalid user aman from 118.192.66.52 port 33436

Invalid user aman from 118.192.66.52 port 33436

Jan 11 20:59:58 localhost sshd\[22220\]: Invalid user Inset from 118.192.66.52
Jan 11 20:59:58 localhost sshd\[22220\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.192.66.52
Jan 11 21:00:00 localhost sshd\[22220\]: Failed password for invalid user Inset from 118.192.66.52 port 50484 ssh2
Jan 11 21:02:31 localhost sshd\[22415\]: Invalid user guest5 from 118.192.66.52
Jan 11 21:02:31 localhost sshd\[22415\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.192.66.52
...

ssh intrusion attempt

Dec 25 20:21:21 sigma sshd\[14176\]: Invalid user osvaldo from 118.192.66.52Dec 25 20:21:23 sigma sshd\[14176\]: Failed password for invalid user osvaldo from 118.192.66.52 port 50418 ssh2
...

Dec 22 14:03:35 tdfoods sshd\[25434\]: Invalid user kkkkkkkkk from 118.192.66.52
Dec 22 14:03:35 tdfoods sshd\[25434\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.192.66.52
Dec 22 14:03:36 tdfoods sshd\[25434\]: Failed password for invalid user kkkkkkkkk from 118.192.66.52 port 42282 ssh2
Dec 22 14:10:04 tdfoods sshd\[26226\]: Invalid user geda1989 from 118.192.66.52
Dec 22 14:10:04 tdfoods sshd\[26226\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.192.66.52

Dec 19 23:29:16 localhost sshd\[13629\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.192.66.52  user=root
Dec 19 23:29:18 localhost sshd\[13629\]: Failed password for root from 118.192.66.52 port 54592 ssh2
Dec 19 23:35:41 localhost sshd\[16378\]: Invalid user neonus from 118.192.66.52 port 53312
Dec 19 23:35:41 localhost sshd\[16378\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.192.66.52

Dec 12 00:42:12 loxhost sshd\[7795\]: Invalid user public from 118.192.66.52 port 39896
Dec 12 00:42:12 loxhost sshd\[7795\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.192.66.52
Dec 12 00:42:15 loxhost sshd\[7795\]: Failed password for invalid user public from 118.192.66.52 port 39896 ssh2
Dec 12 00:48:20 loxhost sshd\[7981\]: Invalid user acamenis from 118.192.66.52 port 40210
Dec 12 00:48:20 loxhost sshd\[7981\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.192.66.52
...

Dec  5 13:36:38 itv-usvr-01 sshd[11096]: Invalid user hepler from 118.192.66.52
Dec  5 13:36:38 itv-usvr-01 sshd[11096]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.192.66.52
Dec  5 13:36:38 itv-usvr-01 sshd[11096]: Invalid user hepler from 118.192.66.52
Dec  5 13:36:40 itv-usvr-01 sshd[11096]: Failed password for invalid user hepler from 118.192.66.52 port 60612 ssh2
Dec  5 13:44:08 itv-usvr-01 sshd[11507]: Invalid user test from 118.192.66.52

Nov 30 02:56:47 firewall sshd[2424]: Invalid user |||||||||| from 118.192.66.52
Nov 30 02:56:49 firewall sshd[2424]: Failed password for invalid user |||||||||| from 118.192.66.52 port 53814 ssh2
Nov 30 03:00:39 firewall sshd[2534]: Invalid user fuwuqiNet from 118.192.66.52
...

2019-11-24T08:44:59.638938homeassistant sshd[28113]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.192.66.52  user=root
2019-11-24T08:45:01.369342homeassistant sshd[28113]: Failed password for root from 118.192.66.52 port 57758 ssh2
...

Nov 22 12:43:13 lnxded63 sshd[9095]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.192.66.52
Nov 22 12:43:15 lnxded63 sshd[9095]: Failed password for invalid user hung from 118.192.66.52 port 41176 ssh2
Nov 22 12:49:02 lnxded63 sshd[9452]: Failed password for bin from 118.192.66.52 port 47536 ssh2

CF RAY ID: 5be49580d9f60de2 IP Class: noRecord URI: /xmlrpc.php

<6 unauthorized SSH connections

2020-08-09T09:29:27.926237+02:00  sshd[29580]: Failed password for root from 82.99.206.18 port 54162 ssh2

Aug  9 02:13:33 NPSTNNYC01T sshd[1551]: Failed password for root from 222.179.205.14 port 42060 ssh2
Aug  9 02:16:09 NPSTNNYC01T sshd[2857]: Failed password for root from 222.179.205.14 port 53122 ssh2
...

 TCP (SYN) 123.126.77.34:31817 -> port 221, len 44

2020-08-08 UTC: (25x) - !#$123,!@#QWE12345,!qaz3wsx,123@QWEA,qwerty_!@#$%^,root(18x),sync,~#$%^&*(),.;

Lines containing failures of 81.27.254.86
Aug  4 19:32:55 new sshd[8117]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.27.254.86  user=r.r
Aug  4 19:32:57 new sshd[8117]: Failed password for r.r from 81.27.254.86 port 39084 ssh2
Aug  4 19:32:58 new sshd[8117]: Received disconnect from 81.27.254.86 port 39084:11: Bye Bye [preauth]
Aug  4 19:32:58 new sshd[8117]: Disconnected from authenticating user r.r 81.27.254.86 port 39084 [preauth]
Aug  4 19:51:50 new sshd[14070]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.27.254.86  user=r.r
Aug  4 19:51:52 new sshd[14070]: Failed password for r.r from 81.27.254.86 port 42326 ssh2
Aug  4 19:51:53 new sshd[14070]: Received disconnect from 81.27.254.86 port 42326:11: Bye Bye [preauth]
Aug  4 19:51:53 new sshd[14070]: Disconnected from authenticating user r.r 81.27.254.86 port 42326 [preauth]
Aug  4 19:57:44 new sshd[15748]: pam_unix(sshd:auth........
------------------------------

Aug  8 19:55:49 php1 sshd\[30732\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.132.47.139  user=root
Aug  8 19:55:51 php1 sshd\[30732\]: Failed password for root from 164.132.47.139 port 36998 ssh2
Aug  8 19:59:58 php1 sshd\[31046\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.132.47.139  user=root
Aug  8 20:00:01 php1 sshd\[31046\]: Failed password for root from 164.132.47.139 port 47972 ssh2
Aug  8 20:04:04 php1 sshd\[31346\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.132.47.139  user=root

Aug  9 04:49:42 jumpserver sshd[79699]: Failed password for root from 117.51.137.113 port 57126 ssh2
Aug  9 04:51:05 jumpserver sshd[79717]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.51.137.113  user=root
Aug  9 04:51:07 jumpserver sshd[79717]: Failed password for root from 117.51.137.113 port 43060 ssh2
...

UDP port : 123

Aug  9 00:34:09 ws24vmsma01 sshd[228815]: Failed password for root from 51.91.110.170 port 38578 ssh2
...

[2020-08-09 06:56:20] NOTICE[1248] chan_sip.c: Registration from '"60003" ' failed for '103.145.12.209:6052' - Wrong password
[2020-08-09 06:56:20] SECURITY[1275] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-08-09T06:56:20.358-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="60003",SessionID="0x7f2720621db8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/103.145.12.209/6052",Challenge="0acdf3f8",ReceivedChallenge="0acdf3f8",ReceivedHash="a86503e9f1b3dbb7ee745cff72db8224"
[2020-08-09 06:56:20] NOTICE[1248] chan_sip.c: Registration from '"60003" ' failed for '103.145.12.209:6052' - Wrong password
[2020-08-09 06:56:20] SECURITY[1275] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-08-09T06:56:20.515-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="60003",SessionID="0x7f2720362608",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IP
...

Cowrie Honeypot: 3 unauthorised SSH/Telnet login attempts between 2020-08-09T11:12:36Z and 2020-08-09T11:19:26Z

Aug  9 06:06:31 srv01 postfix/smtpd\[7676\]: warning: unknown\[111.72.196.243\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Aug  9 06:06:43 srv01 postfix/smtpd\[7676\]: warning: unknown\[111.72.196.243\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Aug  9 06:07:00 srv01 postfix/smtpd\[7676\]: warning: unknown\[111.72.196.243\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Aug  9 06:07:18 srv01 postfix/smtpd\[7676\]: warning: unknown\[111.72.196.243\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Aug  9 06:07:30 srv01 postfix/smtpd\[7676\]: warning: unknown\[111.72.196.243\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
...

Hacking