Oct 15 12:58:08 newdogma sshd[20027]: Invalid user admin from 134.209.106.201 port 53702
Oct 15 12:58:08 newdogma sshd[20027]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.106.201
Oct 15 12:58:10 newdogma sshd[20027]: Failed password for invalid user admin from 134.209.106.201 port 53702 ssh2
Oct 15 12:58:10 newdogma sshd[20027]: Received disconnect from 134.209.106.201 port 53702:11: Bye Bye [preauth]
Oct 15 12:58:10 newdogma sshd[20027]: Disconnected from 134.209.106.201 port 53702 [preauth]
Oct 15 13:19:35 newdogma sshd[20254]: Invalid user versuch from 134.209.106.201 port 42782
Oct 15 13:19:35 newdogma sshd[20254]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.106.201
Oct 15 13:19:37 newdogma sshd[20254]: Failed password for invalid user versuch from 134.209.106.201 port 42782 ssh2
Oct 15 13:19:37 newdogma sshd[20254]: Received disconnect from 134.209.106.201 port 4........
-------------------------------

Invalid user energy from 134.209.106.187 port 53556

134.209.106.187 (SG/Singapore/-), 6 distributed sshd attacks on account [root] in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_DISTATTACK; Logs: Sep 15 04:18:17 server5 sshd[30407]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.106.187  user=root
Sep 15 04:18:17 server5 sshd[30399]: Failed password for root from 117.103.168.204 port 39584 ssh2
Sep 15 04:17:30 server5 sshd[29877]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.43.5  user=root
Sep 15 04:17:31 server5 sshd[29877]: Failed password for root from 165.22.43.5 port 41030 ssh2
Sep 15 04:17:47 server5 sshd[30189]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.57.2  user=root
Sep 15 04:17:49 server5 sshd[30189]: Failed password for root from 139.59.57.2 port 45714 ssh2

IP Addresses Blocked:

Time:     Wed Sep  9 09:05:11 2020 +0000
IP:       134.209.106.187 (SG/Singapore/-)
Failures: 5 (sshd)
Interval: 3600 seconds
Blocked:  Permanent Block [LF_SSHD]

Log entries:

Sep  9 08:55:04 vps1 sshd[14832]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.106.187  user=root
Sep  9 08:55:06 vps1 sshd[14832]: Failed password for root from 134.209.106.187 port 34690 ssh2
Sep  9 09:00:44 vps1 sshd[15021]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.106.187  user=root
Sep  9 09:00:46 vps1 sshd[15021]: Failed password for root from 134.209.106.187 port 52842 ssh2
Sep  9 09:05:09 vps1 sshd[15184]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.106.187  user=root

...

Sep  8 20:02:44 powerpi2 sshd[6963]: Failed password for root from 134.209.106.187 port 45498 ssh2
Sep  8 20:06:24 powerpi2 sshd[7147]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.106.187  user=root
Sep  8 20:06:26 powerpi2 sshd[7147]: Failed password for root from 134.209.106.187 port 49532 ssh2
...

2020-09-07T21:50:01.809583afi-git.jinr.ru sshd[24986]: Failed password for root from 134.209.106.7 port 39022 ssh2
2020-09-07T21:52:04.962153afi-git.jinr.ru sshd[26021]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.106.7  user=root
2020-09-07T21:52:07.519835afi-git.jinr.ru sshd[26021]: Failed password for root from 134.209.106.7 port 41318 ssh2
2020-09-07T21:54:10.473138afi-git.jinr.ru sshd[26404]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.106.7  user=root
2020-09-07T21:54:12.996927afi-git.jinr.ru sshd[26404]: Failed password for root from 134.209.106.7 port 43610 ssh2
...

Time:     Mon Sep  7 09:13:43 2020 +0000
IP:       134.209.106.7 (SG/Singapore/-)
Failures: 5 (sshd)
Interval: 3600 seconds
Blocked:  Permanent Block [LF_SSHD]

Log entries:

Sep  7 08:55:11 ca-29-ams1 sshd[20527]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.106.7  user=root
Sep  7 08:55:13 ca-29-ams1 sshd[20527]: Failed password for root from 134.209.106.7 port 50940 ssh2
Sep  7 09:09:54 ca-29-ams1 sshd[22801]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.106.7  user=root
Sep  7 09:09:55 ca-29-ams1 sshd[22801]: Failed password for root from 134.209.106.7 port 45298 ssh2
Sep  7 09:13:40 ca-29-ams1 sshd[23400]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.106.7  user=root

2020-08-30T17:19:08.986305afi-git.jinr.ru sshd[28402]: Invalid user mam from 134.209.106.7 port 37030
2020-08-30T17:19:08.989593afi-git.jinr.ru sshd[28402]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.106.7
2020-08-30T17:19:08.986305afi-git.jinr.ru sshd[28402]: Invalid user mam from 134.209.106.7 port 37030
2020-08-30T17:19:11.018480afi-git.jinr.ru sshd[28402]: Failed password for invalid user mam from 134.209.106.7 port 37030 ssh2
2020-08-30T17:20:17.679250afi-git.jinr.ru sshd[28615]: Invalid user dovecot from 134.209.106.7 port 50174
...

21 attempts against mh-ssh on cloud

Aug 28 10:16:20 vpn01 sshd[16865]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.106.187
Aug 28 10:16:21 vpn01 sshd[16865]: Failed password for invalid user test from 134.209.106.187 port 50134 ssh2
...

2020-01-01T11:23:05.569596shield sshd\[11618\]: Invalid user guest from 134.209.106.112 port 44316
2020-01-01T11:23:05.573150shield sshd\[11618\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.106.112
2020-01-01T11:23:07.074586shield sshd\[11618\]: Failed password for invalid user guest from 134.209.106.112 port 44316 ssh2
2020-01-01T11:26:21.633893shield sshd\[12638\]: Invalid user server from 134.209.106.112 port 44498
2020-01-01T11:26:21.638366shield sshd\[12638\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.106.112

Dec 22 13:51:26 sd-53420 sshd\[12441\]: Invalid user shana from 134.209.106.112
Dec 22 13:51:26 sd-53420 sshd\[12441\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.106.112
Dec 22 13:51:28 sd-53420 sshd\[12441\]: Failed password for invalid user shana from 134.209.106.112 port 58226 ssh2
Dec 22 13:57:09 sd-53420 sshd\[14429\]: Invalid user willever from 134.209.106.112
Dec 22 13:57:09 sd-53420 sshd\[14429\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.106.112
...

Dec 19 08:53:24 eddieflores sshd\[19549\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.106.112  user=mysql
Dec 19 08:53:26 eddieflores sshd\[19549\]: Failed password for mysql from 134.209.106.112 port 39412 ssh2
Dec 19 08:59:22 eddieflores sshd\[20029\]: Invalid user ubnt from 134.209.106.112
Dec 19 08:59:22 eddieflores sshd\[20029\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.106.112
Dec 19 08:59:24 eddieflores sshd\[20029\]: Failed password for invalid user ubnt from 134.209.106.112 port 45786 ssh2

Dec 12 23:41:55 OPSO sshd\[3390\]: Invalid user airforce from 134.209.106.112 port 58780
Dec 12 23:41:55 OPSO sshd\[3390\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.106.112
Dec 12 23:41:57 OPSO sshd\[3390\]: Failed password for invalid user airforce from 134.209.106.112 port 58780 ssh2
Dec 12 23:48:07 OPSO sshd\[4964\]: Invalid user sachie from 134.209.106.112 port 39464
Dec 12 23:48:07 OPSO sshd\[4964\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.106.112

fail2ban

(sshd) Failed SSH login from 152.136.17.25 (CN/China/-): 5 in the last 3600 secs

May  4 13:59:58 mail.srvfarm.net postfix/smtpd[3200928]: NOQUEUE: reject: RCPT from unknown[217.112.128.242]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
May  4 14:02:28 mail.srvfarm.net postfix/smtpd[3194833]: NOQUEUE: reject: RCPT from unknown[217.112.128.242]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
May  4 14:02:28 mail.srvfarm.net postfix/smtpd[3199545]: NOQUEUE: reject: RCPT from unknown[217.112.128.242]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
May  4 14:04:26 mail.srvfarm.net postfix/smtpd[3199545]: NOQUEUE: reject: RCPT fr

May  4 15:06:07 lukav-desktop sshd\[13300\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.220.235.64  user=root
May  4 15:06:09 lukav-desktop sshd\[13300\]: Failed password for root from 47.220.235.64 port 59758 ssh2
May  4 15:11:38 lukav-desktop sshd\[18468\]: Invalid user web from 47.220.235.64
May  4 15:11:38 lukav-desktop sshd\[18468\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.220.235.64
May  4 15:11:39 lukav-desktop sshd\[18468\]: Failed password for invalid user web from 47.220.235.64 port 51764 ssh2

May  4 16:29:19 meumeu sshd[13169]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.99.238.48 
May  4 16:29:21 meumeu sshd[13169]: Failed password for invalid user jiaxing from 139.99.238.48 port 32850 ssh2
May  4 16:34:09 meumeu sshd[13864]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.99.238.48 
...

2020-05-04T14:49:45.352087shield sshd\[4330\]: Invalid user vilchis from 187.86.200.13 port 35844
2020-05-04T14:49:45.356439shield sshd\[4330\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.86.200.13
2020-05-04T14:49:47.848836shield sshd\[4330\]: Failed password for invalid user vilchis from 187.86.200.13 port 35844 ssh2
2020-05-04T14:52:57.075492shield sshd\[5052\]: Invalid user martina from 187.86.200.13 port 59435
2020-05-04T14:52:57.079831shield sshd\[5052\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.86.200.13

2020-05-04T15:49:25.444405shield sshd\[16423\]: Invalid user dev from 187.109.10.100 port 46860
2020-05-04T15:49:25.448333shield sshd\[16423\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=187-109-10-100.rev.sfox.com.br
2020-05-04T15:49:27.418423shield sshd\[16423\]: Failed password for invalid user dev from 187.109.10.100 port 46860 ssh2
2020-05-04T15:54:18.325424shield sshd\[17805\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=187-109-10-100.rev.sfox.com.br  user=root
2020-05-04T15:54:19.517853shield sshd\[17805\]: Failed password for root from 187.109.10.100 port 33484 ssh2

May  4 14:12:17 vps sshd[21460]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.248.85 
May  4 14:12:19 vps sshd[21460]: Failed password for invalid user dba from 180.76.248.85 port 43746 ssh2
May  4 14:28:57 vps sshd[22261]: Failed password for root from 180.76.248.85 port 43240 ssh2
...

(sshd) Failed SSH login from 181.143.10.148 (CO/Colombia/static-181-143-10-148.une.net.co): 5 in the last 3600 secs

May  4 05:45:05 mockhub sshd[6323]: Failed password for root from 104.224.153.177 port 49496 ssh2
...

Automatic report - Port Scan Attack

May 04 09:58:31 askasleikir sshd[40255]: Failed password for invalid user admin from 213.244.123.182 port 41149 ssh2
May 04 10:09:55 askasleikir sshd[40284]: Failed password for invalid user winer from 213.244.123.182 port 46339 ssh2
May 04 10:12:27 askasleikir sshd[40291]: Failed password for invalid user darwin from 213.244.123.182 port 34085 ssh2

May  4 16:39:02 server sshd[31626]: Failed password for root from 181.129.165.139 port 34756 ssh2
May  4 16:43:35 server sshd[32194]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.129.165.139
May  4 16:43:37 server sshd[32194]: Failed password for invalid user wsw from 181.129.165.139 port 44638 ssh2
...

www.goldgier.de 2001:19f0:6401:fc0:5400:2ff:feb1:6cf7 [04/May/2020:15:06:04 +0200] "POST /wp-login.php HTTP/1.1" 200 6541 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
www.goldgier.de 2001:19f0:6401:fc0:5400:2ff:feb1:6cf7 [04/May/2020:15:06:05 +0200] "POST /xmlrpc.php HTTP/1.1" 200 4334 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"

DATE:2020-05-04 18:24:02, IP:46.188.72.27, PORT:ssh SSH brute force auth (docker-dc)

May  4 14:03:21 ns382633 sshd\[9581\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.67.122.89  user=root
May  4 14:03:24 ns382633 sshd\[9581\]: Failed password for root from 114.67.122.89 port 58852 ssh2
May  4 14:11:36 ns382633 sshd\[11417\]: Invalid user user from 114.67.122.89 port 55116
May  4 14:11:36 ns382633 sshd\[11417\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.67.122.89
May  4 14:11:38 ns382633 sshd\[11417\]: Failed password for invalid user user from 114.67.122.89 port 55116 ssh2