Sep 15 17:49:17 MK-Soft-VM6 sshd\[2253\]: Invalid user gustav from 138.197.166.233 port 59082
Sep 15 17:49:17 MK-Soft-VM6 sshd\[2253\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.166.233
Sep 15 17:49:19 MK-Soft-VM6 sshd\[2253\]: Failed password for invalid user gustav from 138.197.166.233 port 59082 ssh2
...

Sep 14 21:04:38 vps01 sshd[6902]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.166.233
Sep 14 21:04:40 vps01 sshd[6902]: Failed password for invalid user hax from 138.197.166.233 port 60908 ssh2

Sep  4 01:21:09 www1 sshd\[38572\]: Address 138.197.166.233 maps to g6fitness.live, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!Sep  4 01:21:09 www1 sshd\[38572\]: Invalid user admin from 138.197.166.233Sep  4 01:21:11 www1 sshd\[38572\]: Failed password for invalid user admin from 138.197.166.233 port 55756 ssh2Sep  4 01:24:59 www1 sshd\[38807\]: Address 138.197.166.233 maps to g6fitness.live, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!Sep  4 01:25:01 www1 sshd\[38807\]: Failed password for root from 138.197.166.233 port 43478 ssh2Sep  4 01:28:46 www1 sshd\[39248\]: Address 138.197.166.233 maps to g6fitness.live, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!Sep  4 01:28:46 www1 sshd\[39248\]: Invalid user david from 138.197.166.233
...

2019-09-03T11:20:53.021914abusebot-8.cloudsearch.cf sshd\[11864\]: Invalid user factoria from 138.197.166.233 port 52346
2019-09-03T11:20:53.026781abusebot-8.cloudsearch.cf sshd\[11864\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.166.233

Sep  1 00:03:14 XXX sshd[34026]: Invalid user orlando from 138.197.166.233 port 46068

Aug 27 20:48:15 hanapaa sshd\[18086\]: Invalid user ftpaccess from 138.197.166.233
Aug 27 20:48:15 hanapaa sshd\[18086\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.166.233
Aug 27 20:48:17 hanapaa sshd\[18086\]: Failed password for invalid user ftpaccess from 138.197.166.233 port 37588 ssh2
Aug 27 20:52:27 hanapaa sshd\[18487\]: Invalid user lulu from 138.197.166.233
Aug 27 20:52:27 hanapaa sshd\[18487\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.166.233

Aug 24 00:03:58 meumeu sshd[22375]: Failed password for invalid user ayesha from 138.197.166.233 port 50758 ssh2
Aug 24 00:07:55 meumeu sshd[22887]: Failed password for invalid user admin from 138.197.166.233 port 39264 ssh2
...

Aug 22 04:53:23 SilenceServices sshd[20968]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.166.233
Aug 22 04:53:26 SilenceServices sshd[20968]: Failed password for invalid user syp from 138.197.166.233 port 47098 ssh2
Aug 22 04:57:27 SilenceServices sshd[24766]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.166.233

Aug 16 22:57:45 hcbb sshd\[32525\]: Invalid user tosi from 138.197.166.233
Aug 16 22:57:45 hcbb sshd\[32525\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.166.233
Aug 16 22:57:47 hcbb sshd\[32525\]: Failed password for invalid user tosi from 138.197.166.233 port 33290 ssh2
Aug 16 23:01:58 hcbb sshd\[430\]: Invalid user eslab from 138.197.166.233
Aug 16 23:01:58 hcbb sshd\[430\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.166.233

Aug 15 03:06:31 debian sshd\[5292\]: Invalid user ajeet from 138.197.166.233 port 43504
Aug 15 03:06:31 debian sshd\[5292\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.166.233
...

Aug  8 04:17:34 localhost sshd\[71250\]: Invalid user molisoft from 138.197.166.233 port 47096
Aug  8 04:17:34 localhost sshd\[71250\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.166.233
Aug  8 04:17:36 localhost sshd\[71250\]: Failed password for invalid user molisoft from 138.197.166.233 port 47096 ssh2
Aug  8 04:21:39 localhost sshd\[71276\]: Invalid user elsje from 138.197.166.233 port 41258
Aug  8 04:21:39 localhost sshd\[71276\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.166.233
...

Aug  1 10:34:29 v22018076622670303 sshd\[26029\]: Invalid user max from 138.197.166.233 port 51900
Aug  1 10:34:29 v22018076622670303 sshd\[26029\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.166.233
Aug  1 10:34:30 v22018076622670303 sshd\[26029\]: Failed password for invalid user max from 138.197.166.233 port 51900 ssh2
...

Jul 26 23:07:59 localhost sshd\[36353\]: Invalid user dalian from 138.197.166.233 port 53294
Jul 26 23:07:59 localhost sshd\[36353\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.166.233
Jul 26 23:08:02 localhost sshd\[36353\]: Failed password for invalid user dalian from 138.197.166.233 port 53294 ssh2
Jul 26 23:12:10 localhost sshd\[36587\]: Invalid user linux@123456 from 138.197.166.233 port 46062
Jul 26 23:12:10 localhost sshd\[36587\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.166.233
...

2019-07-23T17:26:23.080141hub.schaetter.us sshd\[8647\]: Invalid user ftpuser from 138.197.166.233
2019-07-23T17:26:23.132266hub.schaetter.us sshd\[8647\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.166.233
2019-07-23T17:26:25.593661hub.schaetter.us sshd\[8647\]: Failed password for invalid user ftpuser from 138.197.166.233 port 35448 ssh2
2019-07-23T17:30:59.524694hub.schaetter.us sshd\[8655\]: Invalid user marcus from 138.197.166.233
2019-07-23T17:30:59.581191hub.schaetter.us sshd\[8655\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.166.233
...

Tried sshing with brute force.

2020-08-20T04:55:15.2903771495-001 sshd[28115]: Invalid user oracle from 138.197.166.66 port 46826
2020-08-20T04:55:15.2934631495-001 sshd[28115]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.166.66
2020-08-20T04:55:15.2903771495-001 sshd[28115]: Invalid user oracle from 138.197.166.66 port 46826
2020-08-20T04:55:17.6915131495-001 sshd[28115]: Failed password for invalid user oracle from 138.197.166.66 port 46826 ssh2
2020-08-20T05:00:09.9152261495-001 sshd[28345]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.166.66  user=root
2020-08-20T05:00:12.3431121495-001 sshd[28345]: Failed password for root from 138.197.166.66 port 54802 ssh2
...

Aug  9 09:50:02 * sshd[22797]: Failed password for root from 138.197.166.66 port 49612 ssh2

Aug  3 22:28:05 server sshd[47805]: Failed password for root from 138.197.166.66 port 56432 ssh2
Aug  3 22:41:39 server sshd[52625]: Failed password for root from 138.197.166.66 port 43696 ssh2
Aug  3 22:47:32 server sshd[54555]: Failed password for root from 138.197.166.66 port 56520 ssh2

Aug  2 18:41:51 h2646465 sshd[9833]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.166.66  user=root
Aug  2 18:41:52 h2646465 sshd[9833]: Failed password for root from 138.197.166.66 port 42202 ssh2
Aug  2 18:49:01 h2646465 sshd[10516]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.166.66  user=root
Aug  2 18:49:02 h2646465 sshd[10516]: Failed password for root from 138.197.166.66 port 38734 ssh2
Aug  2 18:52:59 h2646465 sshd[11119]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.166.66  user=root
Aug  2 18:53:01 h2646465 sshd[11119]: Failed password for root from 138.197.166.66 port 58512 ssh2
Aug  2 18:56:53 h2646465 sshd[11732]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.166.66  user=root
Aug  2 18:56:55 h2646465 sshd[11732]: Failed password for root from 138.197.166.66 port 50058 ssh2
Aug  2 19:00:42 h26464

Invalid user nikolas from 138.197.166.66 port 49724

Exploited Host.

Fail2Ban Ban Triggered

Jul  6 01:36:37 webhost01 sshd[26320]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.166.66
Jul  6 01:36:39 webhost01 sshd[26320]: Failed password for invalid user xixi from 138.197.166.66 port 33190 ssh2
...

$f2bV_matches

$f2bV_matches

This client attempted to login to an administrator account on a Website, or abused from another resource.

Jun  7 12:37:03 vpn01 sshd[13749]: Failed password for root from 138.197.166.66 port 39898 ssh2
...

May 30 00:40:17 NPSTNNYC01T sshd[11834]: Failed password for root from 138.197.166.66 port 53064 ssh2
May 30 00:41:19 NPSTNNYC01T sshd[11962]: Failed password for root from 138.197.166.66 port 37206 ssh2
...

May 15 23:27:23 vps46666688 sshd[20334]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.166.66
May 15 23:27:25 vps46666688 sshd[20334]: Failed password for invalid user haisou from 138.197.166.66 port 47818 ssh2
...

May 15 15:47:55 pkdns2 sshd\[34959\]: Invalid user zimbra from 138.197.166.66May 15 15:47:57 pkdns2 sshd\[34959\]: Failed password for invalid user zimbra from 138.197.166.66 port 46124 ssh2May 15 15:52:43 pkdns2 sshd\[35264\]: Invalid user user from 138.197.166.66May 15 15:52:45 pkdns2 sshd\[35264\]: Failed password for invalid user user from 138.197.166.66 port 54124 ssh2May 15 15:57:31 pkdns2 sshd\[35528\]: Invalid user guest from 138.197.166.66May 15 15:57:33 pkdns2 sshd\[35528\]: Failed password for invalid user guest from 138.197.166.66 port 33888 ssh2
...

Jul 14 08:44:52 webhost01 sshd[31738]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.230.46.229
Jul 14 08:44:55 webhost01 sshd[31738]: Failed password for invalid user admin01 from 111.230.46.229 port 41000 ssh2
...

MultiHost/MultiPort Probe, Scan, Hack -

MultiHost/MultiPort Probe, Scan, Hack -

Jul 14 01:51:41 work-partkepr sshd\[15287\]: Invalid user clamav from 46.101.88.10 port 48736
Jul 14 01:51:41 work-partkepr sshd\[15287\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.101.88.10
...

2019-07-14T02:00:00.246259hub.schaetter.us sshd\[30608\]: Invalid user ftpuser from 187.28.50.230
2019-07-14T02:00:00.302313hub.schaetter.us sshd\[30608\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.28.50.230
2019-07-14T02:00:02.249054hub.schaetter.us sshd\[30608\]: Failed password for invalid user ftpuser from 187.28.50.230 port 44892 ssh2
2019-07-14T02:06:15.851047hub.schaetter.us sshd\[30639\]: Invalid user burn from 187.28.50.230
2019-07-14T02:06:15.885198hub.schaetter.us sshd\[30639\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.28.50.230
...

SSH bruteforce

Jul 14 04:01:42 core01 sshd\[17050\]: Invalid user priscila from 116.202.25.182 port 53636
Jul 14 04:01:42 core01 sshd\[17050\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.202.25.182
...

scan r

Jul 14 03:30:05 mail sshd\[7438\]: Invalid user postgres from 51.255.83.178 port 48008
Jul 14 03:30:05 mail sshd\[7438\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.255.83.178
...

Mar  1 11:25:03 vtv3 sshd\[5541\]: Invalid user kk from 132.232.54.102 port 46588
Mar  1 11:25:03 vtv3 sshd\[5541\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=132.232.54.102
Mar  1 11:25:06 vtv3 sshd\[5541\]: Failed password for invalid user kk from 132.232.54.102 port 46588 ssh2
Mar  1 11:28:19 vtv3 sshd\[7364\]: Invalid user sammy from 132.232.54.102 port 52284
Mar  1 11:28:19 vtv3 sshd\[7364\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=132.232.54.102
Mar  2 22:29:02 vtv3 sshd\[14657\]: Invalid user kp from 132.232.54.102 port 54460
Mar  2 22:29:02 vtv3 sshd\[14657\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=132.232.54.102
Mar  2 22:29:03 vtv3 sshd\[14657\]: Failed password for invalid user kp from 132.232.54.102 port 54460 ssh2
Mar  2 22:31:58 vtv3 sshd\[15931\]: Invalid user dw from 132.232.54.102 port 59796
Mar  2 22:31:58 vtv3 sshd\[15931\]: pam_unix\(sshd:a

Automatic report - Port Scan Attack

firewall-block, port(s): 3389/tcp

2019-07-13 UTC: 1x - root

14.07.2019 01:50:14 SSH access blocked by firewall

23/tcp
[2019-07-13]1pkt