srv02 Mass scanning activity detected Target: 24408  ..

Invalid user reader from 134.122.117.231 port 48958

Invalid user test from 134.122.117.231 port 33812

Invalid user test from 134.122.117.231 port 33812

Jul 14 23:04:58 vps46666688 sshd[14519]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.122.117.231
Jul 14 23:05:01 vps46666688 sshd[14519]: Failed password for invalid user amino from 134.122.117.231 port 60370 ssh2
...

Jul  6 20:58:00 pbkit sshd[77881]: Invalid user david from 134.122.117.231 port 59232
Jul  6 20:58:02 pbkit sshd[77881]: Failed password for invalid user david from 134.122.117.231 port 59232 ssh2
Jul  6 21:03:14 pbkit sshd[78086]: Invalid user imm from 134.122.117.231 port 38996
...

Jul  5 18:58:56 ns381471 sshd[5853]: Failed password for root from 134.122.117.231 port 49126 ssh2

Jul  5 06:55:30 h1745522 sshd[23186]: Invalid user minecraft from 134.122.117.231 port 60570
Jul  5 06:55:30 h1745522 sshd[23186]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.122.117.231
Jul  5 06:55:30 h1745522 sshd[23186]: Invalid user minecraft from 134.122.117.231 port 60570
Jul  5 06:55:32 h1745522 sshd[23186]: Failed password for invalid user minecraft from 134.122.117.231 port 60570 ssh2
Jul  5 06:57:43 h1745522 sshd[23308]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.122.117.231  user=root
Jul  5 06:57:45 h1745522 sshd[23308]: Failed password for root from 134.122.117.231 port 38100 ssh2
Jul  5 07:00:02 h1745522 sshd[23424]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.122.117.231  user=root
Jul  5 07:00:04 h1745522 sshd[23424]: Failed password for root from 134.122.117.231 port 43864 ssh2
Jul  5 07:02:22 h1745522 sshd[24800]: Invalid us
...

Jun 27 08:08:20 ns382633 sshd\[10339\]: Invalid user pascal from 134.122.117.231 port 53248
Jun 27 08:08:20 ns382633 sshd\[10339\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.122.117.231
Jun 27 08:08:21 ns382633 sshd\[10339\]: Failed password for invalid user pascal from 134.122.117.231 port 53248 ssh2
Jun 27 08:18:26 ns382633 sshd\[12080\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.122.117.231  user=root
Jun 27 08:18:29 ns382633 sshd\[12080\]: Failed password for root from 134.122.117.231 port 58956 ssh2

Invalid user test from 134.122.117.231 port 46576

Jun 23 08:52:31 ajax sshd[13989]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.122.117.231 
Jun 23 08:52:33 ajax sshd[13989]: Failed password for invalid user zahid from 134.122.117.231 port 57512 ssh2

$f2bV_matches

Jun 18 14:05:36 gestao sshd[13579]: Failed password for root from 134.122.117.231 port 38338 ssh2
Jun 18 14:09:03 gestao sshd[13709]: Failed password for root from 134.122.117.231 port 38144 ssh2
...

Invalid user git from 134.122.117.231 port 44188

Jun 11 12:39:53 Tower sshd[20008]: refused connect from 187.120.0.22 (187.120.0.22)
Jun 12 02:26:10 Tower sshd[20008]: Connection from 134.122.117.231 port 52802 on 192.168.10.220 port 22 rdomain ""
Jun 12 02:26:12 Tower sshd[20008]: Invalid user vid from 134.122.117.231 port 52802
Jun 12 02:26:12 Tower sshd[20008]: error: Could not get shadow information for NOUSER
Jun 12 02:26:12 Tower sshd[20008]: Failed password for invalid user vid from 134.122.117.231 port 52802 ssh2
Jun 12 02:26:12 Tower sshd[20008]: Received disconnect from 134.122.117.231 port 52802:11: Bye Bye [preauth]
Jun 12 02:26:12 Tower sshd[20008]: Disconnected from invalid user vid 134.122.117.231 port 52802 [preauth]

SSH auth scanning - multiple failed logins

Bot attacker IP

Brute forcing email accounts

Brute forcing email accounts

firewall-block, port(s): 10796/tcp

Fail2Ban Ban Triggered

Jun 22 01:23:58 aragorn sshd[19606]: Invalid user admin from 134.122.117.27
Jun 22 01:23:58 aragorn sshd[19610]: Invalid user ubnt from 134.122.117.27
Jun 22 01:23:58 aragorn sshd[19612]: Invalid user guest from 134.122.117.27
Jun 22 01:23:59 aragorn sshd[19614]: Invalid user support from 134.122.117.27
...

 TCP (SYN) 134.122.117.242:40999 -> port 649, len 44

firewall-block, port(s): 10612/tcp

Port scan denied

16592/tcp 2822/tcp 18666/tcp...
[2020-04-12/05-01]62pkt,21pt.(tcp)

May  1 09:58:13 h1745522 sshd[2465]: Invalid user ike from 134.122.117.242 port 50734
May  1 09:58:13 h1745522 sshd[2465]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.122.117.242
May  1 09:58:13 h1745522 sshd[2465]: Invalid user ike from 134.122.117.242 port 50734
May  1 09:58:15 h1745522 sshd[2465]: Failed password for invalid user ike from 134.122.117.242 port 50734 ssh2
May  1 10:01:59 h1745522 sshd[2648]: Invalid user elasticsearch from 134.122.117.242 port 34182
May  1 10:01:59 h1745522 sshd[2648]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.122.117.242
May  1 10:01:59 h1745522 sshd[2648]: Invalid user elasticsearch from 134.122.117.242 port 34182
May  1 10:02:01 h1745522 sshd[2648]: Failed password for invalid user elasticsearch from 134.122.117.242 port 34182 ssh2
May  1 10:05:33 h1745522 sshd[2800]: Invalid user readuser from 134.122.117.242 port 45862
...

Apr 22 14:14:33 meumeu sshd[4781]: Failed password for root from 134.122.117.242 port 33880 ssh2
Apr 22 14:18:24 meumeu sshd[5342]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.122.117.242 
Apr 22 14:18:26 meumeu sshd[5342]: Failed password for invalid user ubuntu from 134.122.117.242 port 47560 ssh2
...

2020-04-17T04:57:12.463478linuxbox-skyline sshd[192241]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.122.117.242  user=root
2020-04-17T04:57:14.458927linuxbox-skyline sshd[192241]: Failed password for root from 134.122.117.242 port 43664 ssh2
...

SSH Scan

Lines containing failures of 134.122.117.230
Apr  3 22:02:03 shared02 sshd[16809]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.122.117.230  user=r.r
Apr  3 22:02:05 shared02 sshd[16809]: Failed password for r.r from 134.122.117.230 port 39038 ssh2
Apr  3 22:02:05 shared02 sshd[16809]: Received disconnect from 134.122.117.230 port 39038:11: Bye Bye [preauth]
Apr  3 22:02:05 shared02 sshd[16809]: Disconnected from authenticating user r.r 134.122.117.230 port 39038 [preauth]
Apr  3 22:06:37 shared02 sshd[18591]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.122.117.230  user=r.r
Apr  3 22:06:39 shared02 sshd[18591]: Failed password for r.r from 134.122.117.230 port 36422 ssh2
Apr  3 22:06:39 shared02 sshd[18591]: Received disconnect from 134.122.117.230 port 36422:11: Bye Bye [preauth]
Apr  3 22:06:39 shared02 sshd[18591]: Disconnected from authenticating user r.r 134.122.117.230 p........
------------------------------

Automatic report - XMLRPC Attack

[SunDec0105:58:48.0294412019][:error][pid21774:tid140174470133504][client103.39.213.171:3716][client103.39.213.171]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch"\(\?:\\\\\\\\\(chr\?\\\\\\\\\(\?[0-9]{1\,3}\?\\\\\\\\\)\|\?=\?f\(\?:open\|write\)\?\\\\\\\\\(\|\\\\\\\\b\(\?:passthru\|serialize\|php_uname\|phpinfo\|shell_exec\|preg_\\\\\\\\w \|mysql_query\|exec\|eval\|base64_decode\|decode_base64\|rot13\|base64_url_decode\|gz\(\?:inflate\|decode\|uncompress\)\|strrev\|zlib_\\\\\\\\w \)\\\\\\\\b\?\(\?..."atARGS:admin.[file"/usr/local/apache.ea3/conf/modsec_rules/10_asl_rules.conf"][line"767"][id"340095"][rev"53"][msg"Atomicorp.comWAFRules:AttackBlocked-PHPfunctioninArgument-thismaybeanattack."][data"die\(@md5\,ARGS:admin"][severity"CRITICAL"][hostname"81.17.25.230"][uri"/Admine6191151/Login.php"][unique_id"XeNIiDy5c9RTM9RJnXdB1QAAAAY"][SunDec0105:58:51.5799702019][:error][pid21582:tid140174344255232][client103.39.213.171:4536][client103.39.213.171]ModSecurity:Accessdeniedwithcode40

F2B jail: sshd. Time: 2019-12-01 01:33:27, Reported by: VKReport

Apr 14 21:00:49 meumeu sshd[19477]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.247.210.176 
Apr 14 21:00:50 meumeu sshd[19477]: Failed password for invalid user pu from 49.247.210.176 port 56218 ssh2
Apr 14 21:04:39 meumeu sshd[20024]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.247.210.176 
...

Nov 30 23:42:36 ip-172-31-62-245 sshd\[20951\]: Invalid user smmsp from 54.38.33.178\
Nov 30 23:42:38 ip-172-31-62-245 sshd\[20951\]: Failed password for invalid user smmsp from 54.38.33.178 port 50430 ssh2\
Nov 30 23:45:16 ip-172-31-62-245 sshd\[20990\]: Invalid user mathonnet from 54.38.33.178\
Nov 30 23:45:18 ip-172-31-62-245 sshd\[20990\]: Failed password for invalid user mathonnet from 54.38.33.178 port 57156 ssh2\
Nov 30 23:48:31 ip-172-31-62-245 sshd\[21007\]: Invalid user jimson from 54.38.33.178\

Dec  1 01:03:41 zeus sshd[31620]: Failed password for root from 222.186.42.4 port 16310 ssh2
Dec  1 01:03:44 zeus sshd[31620]: Failed password for root from 222.186.42.4 port 16310 ssh2
Dec  1 01:03:49 zeus sshd[31620]: Failed password for root from 222.186.42.4 port 16310 ssh2
Dec  1 01:03:53 zeus sshd[31620]: Failed password for root from 222.186.42.4 port 16310 ssh2
Dec  1 01:03:56 zeus sshd[31620]: Failed password for root from 222.186.42.4 port 16310 ssh2

Nov 28 03:55:24 sip sshd[4942]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=223.220.159.78
Nov 28 03:55:25 sip sshd[4942]: Failed password for invalid user drifa from 223.220.159.78 port 13984 ssh2
Nov 28 04:15:23 sip sshd[8537]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=223.220.159.78

Fail2Ban Ban Triggered
HTTP Attempted Bot Registration

Dec  1 02:06:39 eventyay sshd[17746]: Failed password for root from 222.186.175.220 port 57500 ssh2
Dec  1 02:06:52 eventyay sshd[17746]: error: maximum authentication attempts exceeded for root from 222.186.175.220 port 57500 ssh2 [preauth]
Dec  1 02:06:58 eventyay sshd[17749]: Failed password for root from 222.186.175.220 port 22388 ssh2
...

Nov 30 14:08:09 wbs sshd\[18458\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=244.ip-54-36-182.eu  user=root
Nov 30 14:08:12 wbs sshd\[18458\]: Failed password for root from 54.36.182.244 port 59981 ssh2
Nov 30 14:10:52 wbs sshd\[18750\]: Invalid user randell from 54.36.182.244
Nov 30 14:10:52 wbs sshd\[18750\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=244.ip-54-36-182.eu
Nov 30 14:10:54 wbs sshd\[18750\]: Failed password for invalid user randell from 54.36.182.244 port 35493 ssh2

Nov 30 14:31:18 eddieflores sshd\[2475\]: Invalid user rpm from 51.83.73.160
Nov 30 14:31:18 eddieflores sshd\[2475\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=160.ip-51-83-73.eu
Nov 30 14:31:20 eddieflores sshd\[2475\]: Failed password for invalid user rpm from 51.83.73.160 port 36660 ssh2
Nov 30 14:34:31 eddieflores sshd\[2701\]: Invalid user beulah from 51.83.73.160
Nov 30 14:34:31 eddieflores sshd\[2701\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=160.ip-51-83-73.eu

Nov 29 16:32:00 sip sshd[18380]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.68.198.113
Nov 29 16:32:02 sip sshd[18380]: Failed password for invalid user eli from 51.68.198.113 port 47350 ssh2
Nov 29 16:35:01 sip sshd[18917]: Failed password for root from 51.68.198.113 port 56004 ssh2

Nov 28 17:59:55 sip sshd[29168]: Failed password for root from 41.207.184.179 port 52554 ssh2
Nov 28 18:13:26 sip sshd[31836]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=41.207.184.179
Nov 28 18:13:28 sip sshd[31836]: Failed password for invalid user rowlandson from 41.207.184.179 port 37056 ssh2

$f2bV_matches

Dec  1 00:02:41 dedicated sshd[32130]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.154.33.66  user=backup
Dec  1 00:02:44 dedicated sshd[32130]: Failed password for backup from 195.154.33.66 port 51549 ssh2