Feb 25 20:23:52 wbs sshd\[19662\]: Invalid user user from 138.0.60.6
Feb 25 20:23:52 wbs sshd\[19662\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.0.60.6.wellnet.com.br
Feb 25 20:23:54 wbs sshd\[19662\]: Failed password for invalid user user from 138.0.60.6 port 35676 ssh2
Feb 25 20:29:04 wbs sshd\[20155\]: Invalid user hxx from 138.0.60.6
Feb 25 20:29:04 wbs sshd\[20155\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.0.60.6.wellnet.com.br

Feb 25 03:22:40 * sshd[14366]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.0.60.6
Feb 25 03:22:43 * sshd[14366]: Failed password for invalid user yuchen from 138.0.60.6 port 57466 ssh2

Feb 21 15:05:34 eddieflores sshd\[25016\]: Invalid user ncs from 138.0.60.6
Feb 21 15:05:34 eddieflores sshd\[25016\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.0.60.6.wellnet.com.br
Feb 21 15:05:37 eddieflores sshd\[25016\]: Failed password for invalid user ncs from 138.0.60.6 port 53432 ssh2
Feb 21 15:08:47 eddieflores sshd\[25345\]: Invalid user jira from 138.0.60.6
Feb 21 15:08:47 eddieflores sshd\[25345\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.0.60.6.wellnet.com.br

Feb 20 14:19:48 prox sshd[19439]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.0.60.6 
Feb 20 14:19:50 prox sshd[19439]: Failed password for invalid user guest from 138.0.60.6 port 37424 ssh2

Feb 16 23:27:21 vpn01 sshd[27417]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.0.60.6
Feb 16 23:27:23 vpn01 sshd[27417]: Failed password for invalid user admin from 138.0.60.6 port 33264 ssh2
...

Invalid user taiga from 138.0.60.6 port 53134

Feb  5 01:19:26 plusreed sshd[23242]: Invalid user !QAZXCDE#@WS from 138.0.60.6
...

Feb  3 08:59:00 server sshd\[23526\]: Invalid user userpe from 138.0.60.6
Feb  3 08:59:00 server sshd\[23526\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.0.60.6.wellnet.com.br 
Feb  3 08:59:02 server sshd\[23526\]: Failed password for invalid user userpe from 138.0.60.6 port 58128 ssh2
Feb  3 09:04:08 server sshd\[24757\]: Invalid user tapas from 138.0.60.6
Feb  3 09:04:08 server sshd\[24757\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.0.60.6.wellnet.com.br 
...

Unauthorized connection attempt detected from IP address 138.0.60.6 to port 2220 [J]

Jan  3 20:38:43 srv206 sshd[32493]: Invalid user tan from 138.0.60.6
...

Dec 26 23:20:09 server sshd\[8711\]: Invalid user coykendall from 138.0.60.6
Dec 26 23:20:09 server sshd\[8711\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.0.60.6.wellnet.com.br 
Dec 26 23:20:11 server sshd\[8711\]: Failed password for invalid user coykendall from 138.0.60.6 port 45992 ssh2
Dec 27 14:11:40 server sshd\[3016\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.0.60.6.wellnet.com.br  user=root
Dec 27 14:11:41 server sshd\[3016\]: Failed password for root from 138.0.60.6 port 44592 ssh2
...

Invalid user nelsen from 138.0.60.6 port 48414

Invalid user nelsen from 138.0.60.6 port 48414

Dec  9 12:51:58 server sshd\[4339\]: Invalid user claudio from 138.0.60.6
Dec  9 12:51:58 server sshd\[4339\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.0.60.6.wellnet.com.br 
Dec  9 12:52:00 server sshd\[4339\]: Failed password for invalid user claudio from 138.0.60.6 port 35808 ssh2
Dec  9 13:00:36 server sshd\[6902\]: Invalid user gillmann from 138.0.60.6
Dec  9 13:00:36 server sshd\[6902\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.0.60.6.wellnet.com.br 
...

2019-12-07T22:01:16.048768abusebot-2.cloudsearch.cf sshd\[19581\]: Invalid user frandon from 138.0.60.6 port 55778

SSH Brute-Force reported by Fail2Ban

Invalid user test from 138.0.60.14 port 50748

Mar  1 14:23:04 163-172-32-151 sshd[7449]: Invalid user big from 138.0.60.5 port 58654
...

Feb 28 05:50:27 silence02 sshd[8795]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.0.60.5
Feb 28 05:50:28 silence02 sshd[8795]: Failed password for invalid user tengwen from 138.0.60.5 port 40102 ssh2
Feb 28 05:57:17 silence02 sshd[11918]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.0.60.5

$f2bV_matches

Feb  7 16:22:51 silence02 sshd[10266]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.0.60.5
Feb  7 16:22:53 silence02 sshd[10266]: Failed password for invalid user oxr from 138.0.60.5 port 58030 ssh2
Feb  7 16:26:48 silence02 sshd[10577]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.0.60.5

Feb  2 15:36:01 hpm sshd\[7649\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.0.60.5.wellnet.com.br  user=root
Feb  2 15:36:03 hpm sshd\[7649\]: Failed password for root from 138.0.60.5 port 35040 ssh2
Feb  2 15:41:23 hpm sshd\[8018\]: Invalid user archie from 138.0.60.5
Feb  2 15:41:23 hpm sshd\[8018\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.0.60.5.wellnet.com.br
Feb  2 15:41:25 hpm sshd\[8018\]: Failed password for invalid user archie from 138.0.60.5 port 36646 ssh2

Unauthorized connection attempt detected from IP address 138.0.60.5 to port 2220 [J]

$f2bV_matches

Unauthorized connection attempt detected from IP address 138.0.60.5 to port 2220 [J]

2019-12-30T12:47:17.698228abusebot-3.cloudsearch.cf sshd[13437]: Invalid user mirko from 138.0.60.5 port 39626
2019-12-30T12:47:17.709656abusebot-3.cloudsearch.cf sshd[13437]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.0.60.5.wellnet.com.br
2019-12-30T12:47:17.698228abusebot-3.cloudsearch.cf sshd[13437]: Invalid user mirko from 138.0.60.5 port 39626
2019-12-30T12:47:20.002484abusebot-3.cloudsearch.cf sshd[13437]: Failed password for invalid user mirko from 138.0.60.5 port 39626 ssh2
2019-12-30T12:49:55.339998abusebot-3.cloudsearch.cf sshd[13566]: Invalid user teste from 138.0.60.5 port 34890
2019-12-30T12:49:55.349706abusebot-3.cloudsearch.cf sshd[13566]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.0.60.5.wellnet.com.br
2019-12-30T12:49:55.339998abusebot-3.cloudsearch.cf sshd[13566]: Invalid user teste from 138.0.60.5 port 34890
2019-12-30T12:49:57.667681abusebot-3.cloudsearch.cf sshd[13566
...

Telnet Server BruteForce Attack

Repeated brute force against a port

Jun 27 13:20:24 localhost sshd\[43600\]: Invalid user sa from 24.2.16.207 port 59584
Jun 27 13:20:24 localhost sshd\[43600\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=24.2.16.207
...

Jun 27 06:50:41 www sshd[20112]: Invalid user service from 221.212.224.5
Jun 27 06:50:41 www sshd[20112]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.212.224.5 
Jun 27 06:50:43 www sshd[20112]: Failed password for invalid user service from 221.212.224.5 port 43774 ssh2
Jun 27 06:50:46 www sshd[20112]: Failed password for invalid user service from 221.212.224.5 port 43774 ssh2
Jun 27 06:50:48 www sshd[20112]: Failed password for invalid user service from 221.212.224.5 port 43774 ssh2
Jun 27 06:50:51 www sshd[20112]: Failed password for invalid user service from 221.212.224.5 port 43774 ssh2


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=221.212.224.5

2019-06-27T14:16:02.040668test01.cajus.name sshd\[20754\]: Invalid user applmgr from 5.11.37.63 port 45096
2019-06-27T14:16:02.068812test01.cajus.name sshd\[20754\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.11.37.63
2019-06-27T14:16:04.264108test01.cajus.name sshd\[20754\]: Failed password for invalid user applmgr from 5.11.37.63 port 45096 ssh2

Jun 27 13:49:10 mail postfix/smtpd\[2995\]: warning: unknown\[185.234.218.128\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jun 27 13:57:56 mail postfix/smtpd\[4161\]: warning: unknown\[185.234.218.128\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jun 27 14:07:03 mail postfix/smtpd\[5616\]: warning: unknown\[185.234.218.128\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6

2019-06-27 12:29:54,395 [snip] proftpd[11405] [snip] (193.201.224.214[193.201.224.214]): USER 0: no such user found from 193.201.224.214 [193.201.224.214] to ::ffff:[snip]:22
2019-06-27 12:30:13,514 [snip] proftpd[11463] [snip] (193.201.224.214[193.201.224.214]): USER 22: no such user found from 193.201.224.214 [193.201.224.214] to ::ffff:[snip]:22
2019-06-27 12:30:13,554 [snip] proftpd[11463] [snip] (193.201.224.214[193.201.224.214]): USER 22: no such user found from 193.201.224.214 [193.201.224.214] to ::ffff:[snip]:22[...]

Invalid user staffc from 79.120.221.66 port 52532

Jun 27 08:31:01 vps200512 sshd\[27230\]: Invalid user xun from 185.231.245.17
Jun 27 08:31:01 vps200512 sshd\[27230\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.231.245.17
Jun 27 08:31:03 vps200512 sshd\[27230\]: Failed password for invalid user xun from 185.231.245.17 port 59102 ssh2
Jun 27 08:33:47 vps200512 sshd\[27252\]: Invalid user transition from 185.231.245.17
Jun 27 08:33:47 vps200512 sshd\[27252\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.231.245.17

Jun 27 05:38:00 bouncer sshd\[21340\]: Invalid user pkjain from 118.45.130.170 port 34830
Jun 27 05:38:00 bouncer sshd\[21340\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.45.130.170 
Jun 27 05:38:02 bouncer sshd\[21340\]: Failed password for invalid user pkjain from 118.45.130.170 port 34830 ssh2
...

Jun 27 09:29:03 lnxweb62 sshd[18194]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.231.37.205
Jun 27 09:29:03 lnxweb62 sshd[18194]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.231.37.205

@LucianNitescu Personal Honeypot Network <<<>>> Donate at paypal.me/LNitescu <<<>>> 2019-06-26 03:58:49,791 INFO [shellcode_manager] (195.175.63.126) no match, writing hexdump (aec0906ca589d7b70ade454de23430b0 :2129281) - MS17010 (EternalBlue)

failed_logins

Jun 27 14:03:57 [host] sshd[4600]: Invalid user nagios from 187.52.54.42
Jun 27 14:03:57 [host] sshd[4600]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.52.54.42
Jun 27 14:03:59 [host] sshd[4600]: Failed password for invalid user nagios from 187.52.54.42 port 39888 ssh2

Jun 27 01:49:39 bilbo sshd\[14843\]: Invalid user ftpuser from 106.12.86.205\
Jun 27 01:49:42 bilbo sshd\[14843\]: Failed password for invalid user ftpuser from 106.12.86.205 port 43448 ssh2\
Jun 27 01:54:13 bilbo sshd\[17385\]: Invalid user konstantin from 106.12.86.205\
Jun 27 01:54:15 bilbo sshd\[17385\]: Failed password for invalid user konstantin from 106.12.86.205 port 45810 ssh2\