SSH bruteforce (Triggered fail2ban)

2019-10-17T22:52:55.544357abusebot-7.cloudsearch.cf sshd\[10062\]: Invalid user gitlab from 134.175.13.213 port 48374

Oct 13 07:03:43 www sshd\[167272\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.175.13.213  user=root
Oct 13 07:03:45 www sshd\[167272\]: Failed password for root from 134.175.13.213 port 57634 ssh2
Oct 13 07:08:56 www sshd\[167316\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.175.13.213  user=root
...

2019-08-20 09:31:33,572 fail2ban.actions        [878]: NOTICE  [sshd] Ban 134.175.13.213
2019-08-20 13:16:36,994 fail2ban.actions        [878]: NOTICE  [sshd] Ban 134.175.13.213
2019-08-20 16:24:57,712 fail2ban.actions        [878]: NOTICE  [sshd] Ban 134.175.13.213
...

Sep 29 11:33:09 kapalua sshd\[28936\]: Invalid user marcel from 134.175.13.213
Sep 29 11:33:09 kapalua sshd\[28936\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.175.13.213
Sep 29 11:33:11 kapalua sshd\[28936\]: Failed password for invalid user marcel from 134.175.13.213 port 51580 ssh2
Sep 29 11:37:31 kapalua sshd\[29310\]: Invalid user oracle from 134.175.13.213
Sep 29 11:37:31 kapalua sshd\[29310\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.175.13.213

Sep 27 12:15:56 php1 sshd\[1306\]: Invalid user sms from 134.175.13.213
Sep 27 12:15:56 php1 sshd\[1306\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.175.13.213
Sep 27 12:15:58 php1 sshd\[1306\]: Failed password for invalid user sms from 134.175.13.213 port 46578 ssh2
Sep 27 12:20:39 php1 sshd\[1741\]: Invalid user gmodserver from 134.175.13.213
Sep 27 12:20:39 php1 sshd\[1741\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.175.13.213

Sep 27 05:53:50 mail sshd\[25686\]: Invalid user operator from 134.175.13.213
Sep 27 05:53:50 mail sshd\[25686\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.175.13.213
Sep 27 05:53:52 mail sshd\[25686\]: Failed password for invalid user operator from 134.175.13.213 port 53752 ssh2
...

Sep 12 20:28:24 aiointranet sshd\[26087\]: Invalid user ansible from 134.175.13.213
Sep 12 20:28:24 aiointranet sshd\[26087\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.175.13.213
Sep 12 20:28:26 aiointranet sshd\[26087\]: Failed password for invalid user ansible from 134.175.13.213 port 59128 ssh2
Sep 12 20:34:05 aiointranet sshd\[26548\]: Invalid user sinusbot from 134.175.13.213
Sep 12 20:34:05 aiointranet sshd\[26548\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.175.13.213

Aug 21 19:00:33 vps200512 sshd\[30269\]: Invalid user apple from 134.175.13.213
Aug 21 19:00:33 vps200512 sshd\[30269\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.175.13.213
Aug 21 19:00:35 vps200512 sshd\[30269\]: Failed password for invalid user apple from 134.175.13.213 port 46088 ssh2
Aug 21 19:05:06 vps200512 sshd\[30410\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.175.13.213  user=root
Aug 21 19:05:08 vps200512 sshd\[30410\]: Failed password for root from 134.175.13.213 port 32778 ssh2

2019-08-20T11:20:48.576562abusebot-7.cloudsearch.cf sshd\[26331\]: Invalid user chocolateslim from 134.175.13.213 port 51684

Brute force SMTP login attempted.
...

Jul 18 04:29:27 srv-4 sshd\[22166\]: Invalid user zb from 134.175.13.213
Jul 18 04:29:27 srv-4 sshd\[22166\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.175.13.213
Jul 18 04:29:29 srv-4 sshd\[22166\]: Failed password for invalid user zb from 134.175.13.213 port 54392 ssh2
...

detected by Fail2Ban

Jul  1 06:57:23 XXX sshd[61895]: Invalid user shuan from 134.175.13.213 port 42468

Jun 25 19:26:13 localhost sshd[19597]: Invalid user rao from 134.175.13.213 port 49908
Jun 25 19:26:13 localhost sshd[19597]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.175.13.213
Jun 25 19:26:13 localhost sshd[19597]: Invalid user rao from 134.175.13.213 port 49908
Jun 25 19:26:16 localhost sshd[19597]: Failed password for invalid user rao from 134.175.13.213 port 49908 ssh2
...

SSH Invalid Login

2020-09-28T15:04:55.063627abusebot-5.cloudsearch.cf sshd[24397]: Invalid user anthony from 134.175.130.52 port 49950
2020-09-28T15:04:55.072240abusebot-5.cloudsearch.cf sshd[24397]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.175.130.52
2020-09-28T15:04:55.063627abusebot-5.cloudsearch.cf sshd[24397]: Invalid user anthony from 134.175.130.52 port 49950
2020-09-28T15:04:57.792292abusebot-5.cloudsearch.cf sshd[24397]: Failed password for invalid user anthony from 134.175.130.52 port 49950 ssh2
2020-09-28T15:12:48.751720abusebot-5.cloudsearch.cf sshd[24449]: Invalid user liuhao from 134.175.130.52 port 45894
2020-09-28T15:12:48.761500abusebot-5.cloudsearch.cf sshd[24449]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.175.130.52
2020-09-28T15:12:48.751720abusebot-5.cloudsearch.cf sshd[24449]: Invalid user liuhao from 134.175.130.52 port 45894
2020-09-28T15:12:50.748970abusebot-5.cloudsearch.cf sshd
...

Sep 15 05:05:04 dignus sshd[8274]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.175.132.12  user=root
Sep 15 05:05:06 dignus sshd[8274]: Failed password for root from 134.175.132.12 port 56048 ssh2
Sep 15 05:08:26 dignus sshd[8573]: Invalid user mother from 134.175.132.12 port 43100
Sep 15 05:08:26 dignus sshd[8573]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.175.132.12
Sep 15 05:08:28 dignus sshd[8573]: Failed password for invalid user mother from 134.175.132.12 port 43100 ssh2
...

Sep 15 06:09:52 itv-usvr-02 sshd[27552]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.175.132.12  user=root
Sep 15 06:13:29 itv-usvr-02 sshd[27672]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.175.132.12  user=root
Sep 15 06:17:06 itv-usvr-02 sshd[27848]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.175.132.12  user=root

Sep 14 22:36:17 vps639187 sshd\[7032\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.175.132.12  user=root
Sep 14 22:36:19 vps639187 sshd\[7032\]: Failed password for root from 134.175.132.12 port 54918 ssh2
Sep 14 22:40:19 vps639187 sshd\[7101\]: Invalid user reder from 134.175.132.12 port 34688
Sep 14 22:40:19 vps639187 sshd\[7101\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.175.132.12
...

$lgm

Cowrie Honeypot: 10 unauthorised SSH/Telnet login attempts between 2020-08-18T23:05:42Z and 2020-08-18T23:26:16Z

Aug 17 11:59:37 rush sshd[31454]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.175.130.52
Aug 17 11:59:40 rush sshd[31454]: Failed password for invalid user var from 134.175.130.52 port 40138 ssh2
Aug 17 12:04:58 rush sshd[31589]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.175.130.52
...

Aug 16 14:35:37 haigwepa sshd[5429]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.175.130.52 
Aug 16 14:35:39 haigwepa sshd[5429]: Failed password for invalid user user from 134.175.130.52 port 42058 ssh2
...

Aug 11 04:52:41 onepixel sshd[2312380]: Failed password for root from 134.175.132.12 port 49624 ssh2
Aug 11 04:54:59 onepixel sshd[2313726]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.175.132.12  user=root
Aug 11 04:55:01 onepixel sshd[2313726]: Failed password for root from 134.175.132.12 port 49428 ssh2
Aug 11 04:57:30 onepixel sshd[2315144]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.175.132.12  user=root
Aug 11 04:57:33 onepixel sshd[2315144]: Failed password for root from 134.175.132.12 port 49222 ssh2

Aug  8 22:08:59 rush sshd[3268]: Failed password for root from 134.175.132.12 port 42512 ssh2
Aug  8 22:13:45 rush sshd[3514]: Failed password for root from 134.175.132.12 port 54632 ssh2
...

Aug  8 14:48:00 vps639187 sshd\[8123\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.175.130.52  user=root
Aug  8 14:48:02 vps639187 sshd\[8123\]: Failed password for root from 134.175.130.52 port 38750 ssh2
Aug  8 14:53:40 vps639187 sshd\[8220\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.175.130.52  user=root
...

Exploited Host.

Jul 25 05:32:33 webhost01 sshd[13317]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.175.130.52
Jul 25 05:32:35 webhost01 sshd[13317]: Failed password for invalid user satou from 134.175.130.52 port 38978 ssh2
...

Jul 19 18:23:18 abendstille sshd\[26434\]: Invalid user miket from 134.175.130.52
Jul 19 18:23:18 abendstille sshd\[26434\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.175.130.52
Jul 19 18:23:20 abendstille sshd\[26434\]: Failed password for invalid user miket from 134.175.130.52 port 48634 ssh2
Jul 19 18:28:01 abendstille sshd\[31179\]: Invalid user peter from 134.175.130.52
Jul 19 18:28:01 abendstille sshd\[31179\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.175.130.52
...

Jul  2 23:15:35 toyboy sshd[4446]: Invalid user deploy from 177.8.244.38
Jul  2 23:15:35 toyboy sshd[4446]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.8.244.38
Jul  2 23:15:38 toyboy sshd[4446]: Failed password for invalid user deploy from 177.8.244.38 port 39072 ssh2
Jul  2 23:15:38 toyboy sshd[4446]: Received disconnect from 177.8.244.38: 11: Bye Bye [preauth]
Jul  2 23:19:24 toyboy sshd[4811]: Invalid user tunnel from 177.8.244.38
Jul  2 23:19:24 toyboy sshd[4811]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.8.244.38
Jul  2 23:19:25 toyboy sshd[4811]: Failed password for invalid user tunnel from 177.8.244.38 port 55791 ssh2
Jul  2 23:19:26 toyboy sshd[4811]: Received disconnect from 177.8.244.38: 11: Bye Bye [preauth]
Jul  2 23:22:10 toyboy sshd[5100]: Invalid user zhouh from 177.8.244.38
Jul  2 23:22:10 toyboy sshd[5100]: pam_unix(sshd:auth): authentication failure; logn........
-------------------------------

2019-06-30T02:23:30.245668wiz-ks3 sshd[18182]: Failed password for root from 112.85.42.181 port 64200 ssh2
2019-06-30T02:23:32.374760wiz-ks3 sshd[18182]: Failed password for root from 112.85.42.181 port 64200 ssh2
2019-06-30T02:23:35.449872wiz-ks3 sshd[18182]: Failed password for root from 112.85.42.181 port 64200 ssh2
2019-06-30T02:23:38.281820wiz-ks3 sshd[18182]: Failed password for root from 112.85.42.181 port 64200 ssh2
2019-06-30T02:23:40.814749wiz-ks3 sshd[18182]: Failed password for root from 112.85.42.181 port 64200 ssh2
2019-06-30T02:23:43.607642wiz-ks3 sshd[18182]: Failed password for root from 112.85.42.181 port 64200 ssh2
2019-06-30T02:23:43.607766wiz-ks3 sshd[18182]: error: maximum authentication attempts exceeded for root from 112.85.42.181 port 64200 ssh2 [preauth]
2019-06-30T02:23:48.042590wiz-ks3 sshd[18184]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.85.42.181  user=root
2019-06-30T02:23:49.911965wiz-ks3 sshd[18184]: Failed password for root f

Jul  3 01:44:32 mail sshd\[18485\]: Failed password for invalid user debian from 134.209.20.68 port 41064 ssh2
Jul  3 02:00:45 mail sshd\[18820\]: Invalid user jiu from 134.209.20.68 port 44554
...

2019-07-03T08:53:34.451163enmeeting.mahidol.ac.th sshd\[17466\]: User root from 153.36.236.242 not allowed because not listed in AllowUsers
2019-07-03T08:53:34.693923enmeeting.mahidol.ac.th sshd\[17466\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=153.36.236.242  user=root
2019-07-03T08:53:36.616807enmeeting.mahidol.ac.th sshd\[17466\]: Failed password for invalid user root from 153.36.236.242 port 39153 ssh2
...

proto=tcp  .  spt=46614  .  dpt=25  .     (listed on Blocklist de  Jul 02)     (16)

TCP port 23 (Telnet) attempt blocked by firewall. [2019-07-03 01:11:57]

Jun 30 07:37:00 own sshd[23252]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=124.158.7.146  user=r.r
Jun 30 07:37:01 own sshd[23252]: Failed password for r.r from 124.158.7.146 port 57938 ssh2
Jun 30 07:37:04 own sshd[23252]: Failed password for r.r from 124.158.7.146 port 57938 ssh2
Jun 30 07:37:06 own sshd[23252]: Failed password for r.r from 124.158.7.146 port 57938 ssh2
Jun 30 07:37:11 own sshd[23252]: message repeated 2 times: [ Failed password for r.r from 124.158.7.146 port 57938 ssh2]
Jun 30 07:37:11 own sshd[23252]: Connection reset by 124.158.7.146 port 57938 [preauth]
Jun 30 07:37:11 own sshd[23252]: PAM 4 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=124.158.7.146  user=r.r
Jul  2 12:35:58 own sshd[18912]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=124.158.7.146  user=r.r
Jul  2 12:36:00 own sshd[18912]: Failed password for r.r from 124.158.7.1........
-------------------------------

\[2019-07-02 22:06:20\] SECURITY\[13451\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-07-02T22:06:20.051-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="011972595225502",SessionID="0x7f02f8352a28",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/185.53.88.125/51688",ACLName="no_extension_match"
\[2019-07-02 22:07:49\] SECURITY\[13451\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-07-02T22:07:49.181-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="00972592195700",SessionID="0x7f02f8352a28",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/185.53.88.125/53078",ACLName="no_extension_match"
\[2019-07-02 22:11:12\] SECURITY\[13451\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-07-02T22:11:12.487-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="9011972598412910",SessionID="0x7f02f8740ce8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/185.53.88.125/61282",ACLName="no_

\[2019-07-02 22:27:29\] NOTICE\[13443\] chan_sip.c: Registration from '"122" \' failed for '77.247.110.216:6139' - Wrong password
\[2019-07-02 22:27:29\] SECURITY\[13451\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-07-02T22:27:29.550-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="122",SessionID="0x7f02f8740ce8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/77.247.110.216/6139",Challenge="6abad970",ReceivedChallenge="6abad970",ReceivedHash="aed0bf5a67fb0ed6a2102f629711453c"
\[2019-07-02 22:27:29\] NOTICE\[13443\] chan_sip.c: Registration from '"122" \' failed for '77.247.110.216:6139' - Wrong password
\[2019-07-02 22:27:29\] SECURITY\[13451\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-07-02T22:27:29.656-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="122",SessionID="0x7f02f82f13e8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/U

Jul  2 11:53:04 scivo sshd[32581]: Invalid user yuan from 106.12.78.161
Jul  2 11:53:04 scivo sshd[32581]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.78.161 
Jul  2 11:53:06 scivo sshd[32581]: Failed password for invalid user yuan from 106.12.78.161 port 52922 ssh2
Jul  2 11:53:06 scivo sshd[32581]: Received disconnect from 106.12.78.161: 11: Bye Bye [preauth]
Jul  2 12:06:03 scivo sshd[878]: Invalid user smile from 106.12.78.161
Jul  2 12:06:03 scivo sshd[878]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.78.161 
Jul  2 12:06:05 scivo sshd[878]: Failed password for invalid user smile from 106.12.78.161 port 59504 ssh2
Jul  2 12:06:05 scivo sshd[878]: Received disconnect from 106.12.78.161: 11: Bye Bye [preauth]
Jul  2 12:07:10 scivo sshd[924]: Invalid user apt-mirror from 106.12.78.161
Jul  2 12:07:10 scivo sshd[924]: pam_unix(sshd:auth): authentication failure; lognam........
-------------------------------

proto=tcp  .  spt=34145  .  dpt=25  .     (listed on Blocklist de  Jul 02)     (11)

proto=tcp  .  spt=33455  .  dpt=25  .     (listed on Blocklist de  Jul 02)     (27)

2019-07-03T02:37:44.750723abusebot-7.cloudsearch.cf sshd\[3657\]: Invalid user pi from 46.214.254.180 port 52822

proto=tcp  .  spt=57943  .  dpt=25  .     (listed on Blocklist de  Jul 02)     (33)

(From animatedvideos33@gmail.com) Hi, I just came across your website and wanted to get in touch. 
 
I run an animation studio that makes animated explainer videos helping companies to explain what they do, why it matters and how they're unique in less than 2 minutes. 
 
You can take a look at some of our work here: 
http://bit.ly/306e3Yp  - do you like it? 
 
I would be very interested in creating a great animated video for your company. 
 
We have a smooth production process and handle everything needed for a high-quality video that typically takes us 6 weeks to produce from start to finish. 
 
First, we nail the script, design storyboards you can’t wait to see animated. Voice actors in your native language that capture your brand and animation that screams premium with sound design that brings it all together. 
 
Our videos are made from scratch and designed to make you stand out and get results. No templates, no cookie cutter animation that tarnishes your brand. 
 
If you’re interested in l