(sshd) Failed SSH login from 138.197.216.135 (US/United States/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Oct  4 11:16:42 optimus sshd[23211]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.216.135  user=root
Oct  4 11:16:43 optimus sshd[23211]: Failed password for root from 138.197.216.135 port 45342 ssh2
Oct  4 11:20:31 optimus sshd[24282]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.216.135  user=root
Oct  4 11:20:33 optimus sshd[24282]: Failed password for root from 138.197.216.135 port 51740 ssh2
Oct  4 11:24:11 optimus sshd[25688]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.216.135  user=root

Oct  4 09:29:05 onepixel sshd[490332]: Failed password for root from 138.197.216.135 port 40108 ssh2
Oct  4 09:31:02 onepixel sshd[490629]: Invalid user saurabh from 138.197.216.135 port 46082
Oct  4 09:31:02 onepixel sshd[490629]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.216.135 
Oct  4 09:31:02 onepixel sshd[490629]: Invalid user saurabh from 138.197.216.135 port 46082
Oct  4 09:31:04 onepixel sshd[490629]: Failed password for invalid user saurabh from 138.197.216.135 port 46082 ssh2

(sshd) Failed SSH login from 138.197.216.135 (US/United States/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Sep 22 02:17:32 server2 sshd[5928]: Invalid user jd from 138.197.216.135
Sep 22 02:17:32 server2 sshd[5928]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.216.135 
Sep 22 02:17:33 server2 sshd[5928]: Failed password for invalid user jd from 138.197.216.135 port 53806 ssh2
Sep 22 02:29:28 server2 sshd[23893]: Invalid user edi from 138.197.216.135
Sep 22 02:29:28 server2 sshd[23893]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.216.135

Invalid user sage from 138.197.216.135 port 46366

Sep 11 12:52:52 eventyay sshd[31766]: Failed password for root from 138.197.216.135 port 33012 ssh2
Sep 11 12:57:00 eventyay sshd[31853]: Failed password for root from 138.197.216.135 port 46950 ssh2
...

Aug 25 18:54:59 [host] sshd[21526]: Invalid user t
Aug 25 18:54:59 [host] sshd[21526]: pam_unix(sshd:
Aug 25 18:55:01 [host] sshd[21526]: Failed passwor

Aug 21 08:33:27 rancher-0 sshd[1190291]: Invalid user student from 138.197.216.135 port 41526
...

Aug 18 16:49:37 ns382633 sshd\[26886\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.216.135  user=root
Aug 18 16:49:39 ns382633 sshd\[26886\]: Failed password for root from 138.197.216.135 port 36358 ssh2
Aug 18 17:04:15 ns382633 sshd\[29674\]: Invalid user noemi from 138.197.216.135 port 50108
Aug 18 17:04:15 ns382633 sshd\[29674\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.216.135
Aug 18 17:04:18 ns382633 sshd\[29674\]: Failed password for invalid user noemi from 138.197.216.135 port 50108 ssh2

2020-08-17T22:26:48+0200 Failed SSH Authentication/Brute Force Attack. (Server 9)

Unauthorised connection attempt detected at AUO MAIN. System is sshd. Protected by AUO Stack Web Application Firewall (WAF)

Oct 11 06:58:59 ajax sshd[29351]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.216.162 
Oct 11 06:59:02 ajax sshd[29351]: Failed password for invalid user vnc from 138.197.216.162 port 55872 ssh2

Invalid user zabbix from 138.197.216.162 port 33422

Sep 29 20:28:50 dhoomketu sshd[3455985]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.216.162 
Sep 29 20:28:50 dhoomketu sshd[3455985]: Invalid user informix from 138.197.216.162 port 50836
Sep 29 20:28:52 dhoomketu sshd[3455985]: Failed password for invalid user informix from 138.197.216.162 port 50836 ssh2
Sep 29 20:30:21 dhoomketu sshd[3456001]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.216.162  user=root
Sep 29 20:30:22 dhoomketu sshd[3456001]: Failed password for root from 138.197.216.162 port 37730 ssh2
...

Sep 29 03:46:30 hell sshd[5598]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.216.162
Sep 29 03:46:32 hell sshd[5598]: Failed password for invalid user solaris from 138.197.216.162 port 34338 ssh2
...

Jul  9 15:27:04 debian-2gb-nbg1-2 kernel: \[16559817.866708\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=138.197.216.120 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=240 ID=44696 PROTO=TCP SPT=47588 DPT=8443 WINDOW=1024 RES=0x00 SYN URGP=0

Masscan Port Scanning Tool Detection

[Tue Apr 14 00:12:31.870741 2020] [:error] [pid 1037:tid 140156611426048] [client 138.197.216.120:61000] [client 138.197.216.120] ModSecurity: Access denied with code 403 (phase 1). Match of "within %{tx.allowed_http_versions}" against "REQUEST_PROTOCOL" required. [file "/etc/modsecurity/owasp-modsecurity-crs-3.2.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "972"] [id "920430"] [msg "HTTP protocol version is not allowed by policy"] [data "HTTP/1.0"] [severity "CRITICAL"] [ver "OWASP_CRS/3.2.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "OWASP_CRS/POLICY/PROTOCOL_NOT_ALLOWED"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A6"] [tag "PCI/6.5.10"] [hostname "karangploso.jatim.bmkg.go.id"] [uri "/"] [unique_id "XpSdf8-6y5MyHEKsIkHv7QAAAOE"]
...

firewall-block, port(s): 80/tcp

Detected by Maltrail

Scanning unused Default website or suspicious access to valid sites from IP marked as abusive

Unauthorized connection attempt detected from IP address 138.197.216.120 to port 80 [J]

IP blocked

Nov 28 18:04:36 mc1 kernel: \[6246900.726536\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:11:a9:7b:d2:74:7f:6e:37:e3:08:00 SRC=138.197.216.120 DST=159.69.205.51 LEN=40 TOS=0x00 PREC=0x00 TTL=241 ID=57695 PROTO=TCP SPT=61000 DPT=80 WINDOW=1024 RES=0x00 SYN URGP=0 
Nov 28 18:04:40 mc1 kernel: \[6246903.886580\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:11:a9:7b:d2:74:7f:6e:37:e3:08:00 SRC=138.197.216.120 DST=159.69.205.51 LEN=40 TOS=0x00 PREC=0x00 TTL=241 ID=57695 PROTO=TCP SPT=61000 DPT=80 WINDOW=1024 RES=0x00 SYN URGP=0 
Nov 28 18:04:43 mc1 kernel: \[6246907.096799\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:11:a9:7b:d2:74:7f:6e:37:e3:08:00 SRC=138.197.216.120 DST=159.69.205.51 LEN=40 TOS=0x00 PREC=0x00 TTL=241 ID=57695 PROTO=TCP SPT=61000 DPT=80 WINDOW=1024 RES=0x00 SYN URGP=0 
...

Detected by Maltrail

Sep 22 07:18:32 hpm sshd\[15909\]: Invalid user zhouh from 112.64.170.166
Sep 22 07:18:32 hpm sshd\[15909\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.64.170.166
Sep 22 07:18:34 hpm sshd\[15909\]: Failed password for invalid user zhouh from 112.64.170.166 port 47284 ssh2
Sep 22 07:22:56 hpm sshd\[16258\]: Invalid user lloyd from 112.64.170.166
Sep 22 07:22:56 hpm sshd\[16258\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.64.170.166

Sep 22 19:17:19 cvbnet sshd[874]: Failed password for root from 222.186.42.15 port 61940 ssh2
Sep 22 19:17:22 cvbnet sshd[874]: Failed password for root from 222.186.42.15 port 61940 ssh2

2019-09-22T17:48:13.017399abusebot-4.cloudsearch.cf sshd\[23302\]: Invalid user anicom from 194.37.92.48 port 53564

Lines containing failures of 208.116.59.132
Sep 22 14:28:24 shared10 sshd[5901]: Invalid user odroid from 208.116.59.132 port 46683
Sep 22 14:28:24 shared10 sshd[5901]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=208.116.59.132
Sep 22 14:28:26 shared10 sshd[5901]: Failed password for invalid user odroid from 208.116.59.132 port 46683 ssh2
Sep 22 14:28:26 shared10 sshd[5901]: Received disconnect from 208.116.59.132 port 46683:11: Bye Bye [preauth]
Sep 22 14:28:26 shared10 sshd[5901]: Disconnected from invalid user odroid 208.116.59.132 port 46683 [preauth]


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=208.116.59.132

Sep 22 17:44:03 DAAP sshd[24747]: Invalid user aaring from 218.104.199.131 port 53990
...

Sep 22 19:00:20 vps01 sshd[9977]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.29.61
Sep 22 19:00:23 vps01 sshd[9977]: Failed password for invalid user master from 51.75.29.61 port 56062 ssh2

Sep 22 06:58:39 lcprod sshd\[22800\]: Invalid user uts from 31.14.135.117
Sep 22 06:58:39 lcprod sshd\[22800\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.14.135.117
Sep 22 06:58:41 lcprod sshd\[22800\]: Failed password for invalid user uts from 31.14.135.117 port 53562 ssh2
Sep 22 07:03:09 lcprod sshd\[23225\]: Invalid user helpdesk from 31.14.135.117
Sep 22 07:03:09 lcprod sshd\[23225\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.14.135.117

2019-09-18 18:54:32,386 fail2ban.actions        \[946\]: NOTICE  \[sshd\] Ban 58.221.204.114
2019-09-18 19:28:02,222 fail2ban.actions        \[946\]: NOTICE  \[sshd\] Ban 58.221.204.114
2019-09-18 20:00:31,102 fail2ban.actions        \[946\]: NOTICE  \[sshd\] Ban 58.221.204.114
2019-09-18 20:33:56,198 fail2ban.actions        \[946\]: NOTICE  \[sshd\] Ban 58.221.204.114
2019-09-18 21:06:15,498 fail2ban.actions        \[946\]: NOTICE  \[sshd\] Ban 58.221.204.114
...

Automatic report - Banned IP Access

2019-08-21 18:20:49,369 fail2ban.actions        [878]: NOTICE  [sshd] Ban 54.38.184.235
2019-08-21 21:27:55,038 fail2ban.actions        [878]: NOTICE  [sshd] Ban 54.38.184.235
2019-08-22 00:34:04,862 fail2ban.actions        [878]: NOTICE  [sshd] Ban 54.38.184.235
...

Sep 22 02:55:17 hiderm sshd\[1436\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=234.ip-92-222-66.eu  user=messagebus
Sep 22 02:55:19 hiderm sshd\[1436\]: Failed password for messagebus from 92.222.66.234 port 57034 ssh2
Sep 22 02:59:30 hiderm sshd\[1907\]: Invalid user dobus from 92.222.66.234
Sep 22 02:59:30 hiderm sshd\[1907\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=234.ip-92-222-66.eu
Sep 22 02:59:32 hiderm sshd\[1907\]: Failed password for invalid user dobus from 92.222.66.234 port 42500 ssh2

Sep 22 07:42:21 auw2 sshd\[15350\]: Invalid user odroid from 106.75.141.91
Sep 22 07:42:21 auw2 sshd\[15350\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.75.141.91
Sep 22 07:42:22 auw2 sshd\[15350\]: Failed password for invalid user odroid from 106.75.141.91 port 42286 ssh2
Sep 22 07:48:08 auw2 sshd\[15941\]: Invalid user NetLinx from 106.75.141.91
Sep 22 07:48:08 auw2 sshd\[15941\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.75.141.91

Automatic report - Banned IP Access

RDP Bruteforce

Sep 22 19:31:23 webserver postfix/smtpd\[9607\]: warning: unknown\[46.38.144.57\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Sep 22 19:32:39 webserver postfix/smtpd\[8472\]: warning: unknown\[46.38.144.57\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Sep 22 19:33:58 webserver postfix/smtpd\[8472\]: warning: unknown\[46.38.144.57\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Sep 22 19:35:17 webserver postfix/smtpd\[9607\]: warning: unknown\[46.38.144.57\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Sep 22 19:36:34 webserver postfix/smtpd\[10566\]: warning: unknown\[46.38.144.57\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
...