2020-10-13T08:05:05.291545mail.thespaminator.com sshd[31503]: Failed password for root from 138.68.81.162 port 41028 ssh2
2020-10-13T08:09:40.391450mail.thespaminator.com sshd[32109]: Invalid user qwerty from 138.68.81.162 port 37522
...

Oct 13 02:03:02 web-main sshd[3402804]: Failed password for invalid user victor from 138.68.81.162 port 48810 ssh2
Oct 13 02:17:56 web-main sshd[3404657]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.81.162  user=root
Oct 13 02:17:59 web-main sshd[3404657]: Failed password for root from 138.68.81.162 port 54682 ssh2

Oct 12 21:10:20 ws26vmsma01 sshd[193768]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.81.162
Oct 12 21:10:22 ws26vmsma01 sshd[193768]: Failed password for invalid user nishida from 138.68.81.162 port 49444 ssh2
...

Sep 28 15:48:49 lanister sshd[18241]: Failed password for invalid user tom from 138.68.81.162 port 49648 ssh2
Sep 28 15:53:58 lanister sshd[18288]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.81.162  user=root
Sep 28 15:53:59 lanister sshd[18288]: Failed password for root from 138.68.81.162 port 58818 ssh2
Sep 28 15:58:48 lanister sshd[18336]: Invalid user corinna from 138.68.81.162

Invalid user richard from 138.68.81.162 port 35616

Aug 30 14:12:26 haigwepa sshd[22111]: Failed password for root from 138.68.81.162 port 43888 ssh2
Aug 30 14:17:18 haigwepa sshd[22944]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.81.162 
...

 TCP (SYN) 138.68.81.162:52267 -> port 17084, len 44

$f2bV_matches

Aug  5 01:59:30 ny01 sshd[7219]: Failed password for root from 138.68.81.162 port 40172 ssh2
Aug  5 02:02:41 ny01 sshd[7628]: Failed password for root from 138.68.81.162 port 53300 ssh2

Aug  5 00:31:34 pve1 sshd[10820]: Failed password for root from 138.68.81.162 port 52610 ssh2
...

Jul 26 08:06:54 minden010 sshd[20318]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.81.162
Jul 26 08:06:57 minden010 sshd[20318]: Failed password for invalid user user2 from 138.68.81.162 port 46644 ssh2
Jul 26 08:12:10 minden010 sshd[21832]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.81.162
...

2020-07-23T14:31:24.741140abusebot-3.cloudsearch.cf sshd[24957]: Invalid user damian from 138.68.81.162 port 43352
2020-07-23T14:31:24.746957abusebot-3.cloudsearch.cf sshd[24957]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.81.162
2020-07-23T14:31:24.741140abusebot-3.cloudsearch.cf sshd[24957]: Invalid user damian from 138.68.81.162 port 43352
2020-07-23T14:31:26.304382abusebot-3.cloudsearch.cf sshd[24957]: Failed password for invalid user damian from 138.68.81.162 port 43352 ssh2
2020-07-23T14:37:24.105073abusebot-3.cloudsearch.cf sshd[25235]: Invalid user alex from 138.68.81.162 port 56376
2020-07-23T14:37:24.110882abusebot-3.cloudsearch.cf sshd[25235]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.81.162
2020-07-23T14:37:24.105073abusebot-3.cloudsearch.cf sshd[25235]: Invalid user alex from 138.68.81.162 port 56376
2020-07-23T14:37:26.426343abusebot-3.cloudsearch.cf sshd[25235]: Faile
...

Jul 11 01:21:04 lukav-desktop sshd\[3272\]: Invalid user admin from 138.68.81.162
Jul 11 01:21:04 lukav-desktop sshd\[3272\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.81.162
Jul 11 01:21:06 lukav-desktop sshd\[3272\]: Failed password for invalid user admin from 138.68.81.162 port 36656 ssh2
Jul 11 01:24:56 lukav-desktop sshd\[3335\]: Invalid user yyk from 138.68.81.162
Jul 11 01:24:56 lukav-desktop sshd\[3335\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.81.162

" "

 TCP (SYN) 138.68.81.162:52545 -> port 14663, len 44

Jun 23 07:10:56 scw-focused-cartwright sshd[8266]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.81.162
Jun 23 07:10:58 scw-focused-cartwright sshd[8266]: Failed password for invalid user maquina from 138.68.81.162 port 44036 ssh2

SSH brute-force: detected 11 distinct username(s) / 10 distinct password(s) within a 24-hour window.

Jun 14 20:23:21 webhost01 sshd[16905]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.81.162
Jun 14 20:23:23 webhost01 sshd[16905]: Failed password for invalid user chy from 138.68.81.162 port 33006 ssh2
...

Jun 10 20:39:54 vpn01 sshd[20270]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.81.162
Jun 10 20:39:57 vpn01 sshd[20270]: Failed password for invalid user zdq from 138.68.81.162 port 39996 ssh2
...

5x Failed Password

Jun  5 11:52:46 gw1 sshd[7854]: Failed password for root from 138.68.81.162 port 41596 ssh2
...

Jun  2 16:21:28 legacy sshd[32054]: Failed password for root from 138.68.81.162 port 60502 ssh2
Jun  2 16:25:41 legacy sshd[32172]: Failed password for root from 138.68.81.162 port 36100 ssh2
...

May 30 01:06:17 propaganda sshd[19703]: Connection from 138.68.81.162 port 42938 on 10.0.0.160 port 22 rdomain ""
May 30 01:06:17 propaganda sshd[19703]: Connection closed by 138.68.81.162 port 42938 [preauth]

May 29 11:09:37 game-panel sshd[9986]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.81.162
May 29 11:09:39 game-panel sshd[9986]: Failed password for invalid user logout from 138.68.81.162 port 35232 ssh2
May 29 11:13:35 game-panel sshd[10096]: Failed password for root from 138.68.81.162 port 58716 ssh2

SSH Invalid Login

May  5 09:20:59 scw-6657dc sshd[30482]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.81.162  user=root
May  5 09:20:59 scw-6657dc sshd[30482]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.81.162  user=root
May  5 09:21:01 scw-6657dc sshd[30482]: Failed password for root from 138.68.81.162 port 38124 ssh2
...

Unauthorised connection attempt detected at AUO MAIN. System is sshd. Protected by AUO Stack Web Application Firewall (WAF)

2020-04-26T23:51:39.111300sd-86998 sshd[14443]: Invalid user kristof from 138.68.81.162 port 55994
2020-04-26T23:51:39.114482sd-86998 sshd[14443]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.81.162
2020-04-26T23:51:39.111300sd-86998 sshd[14443]: Invalid user kristof from 138.68.81.162 port 55994
2020-04-26T23:51:41.389967sd-86998 sshd[14443]: Failed password for invalid user kristof from 138.68.81.162 port 55994 ssh2
2020-04-26T23:57:06.057635sd-86998 sshd[14971]: Invalid user pma from 138.68.81.162 port 36950
...

SSH Invalid Login

Apr 12 07:56:46 meumeu sshd[19706]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.81.162 
Apr 12 07:56:48 meumeu sshd[19706]: Failed password for invalid user midnight from 138.68.81.162 port 44952 ssh2
Apr 12 08:01:18 meumeu sshd[20785]: Failed password for root from 138.68.81.162 port 55064 ssh2
...

Time:     Tue Sep  8 12:48:21 2020 +0000
IP:       182.156.209.222 (IN/India/static-222.209.156.182-tataidc.co.in)
Failures: 5 (sshd)
Interval: 3600 seconds
Blocked:  Permanent Block [LF_SSHD]

Log entries:

Sep  8 12:33:48 ca-1-ams1 sshd[4249]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.156.209.222  user=root
Sep  8 12:33:50 ca-1-ams1 sshd[4249]: Failed password for root from 182.156.209.222 port 4302 ssh2
Sep  8 12:44:11 ca-1-ams1 sshd[4534]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.156.209.222  user=root
Sep  8 12:44:13 ca-1-ams1 sshd[4534]: Failed password for root from 182.156.209.222 port 51902 ssh2
Sep  8 12:48:17 ca-1-ams1 sshd[4721]: Invalid user climate from 182.156.209.222 port 17543

2020-09-07 02:41:53 plain_virtual_exim authenticator failed for ([5.190.81.105]) [5.190.81.105]: 535 Incorrect authentication data


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=5.190.81.105

2020-09-07 UTC: (2x) - ubnt,user

Unauthorised access (Sep  7) SRC=46.31.79.45 LEN=52 TOS=0x08 PREC=0x20 TTL=113 ID=31805 DF TCP DPT=445 WINDOW=8192 SYN

Cowrie Honeypot: 10 unauthorised SSH/Telnet login attempts between 2020-09-08T14:39:49Z and 2020-09-08T14:43:25Z

" "

Sep  7 18:51:16 ks10 sshd[895038]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.62.246.21 
Sep  7 18:51:19 ks10 sshd[895038]: Failed password for invalid user netman from 92.62.246.21 port 46402 ssh2
...

Honeypot attack, port: 445, PTR: PTR record not found

(sshd) Failed SSH login from 178.16.174.0 (FR/France/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Sep  8 10:26:06 server sshd[2709]: Invalid user admin from 178.16.174.0 port 19547
Sep  8 10:26:09 server sshd[2709]: Failed password for invalid user admin from 178.16.174.0 port 19547 ssh2
Sep  8 10:35:51 server sshd[5176]: Invalid user browser from 178.16.174.0 port 18648
Sep  8 10:35:54 server sshd[5176]: Failed password for invalid user browser from 178.16.174.0 port 18648 ssh2
Sep  8 10:37:58 server sshd[5723]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.16.174.0  user=root

SSH brute-force attempt

165.22.223.82 - - [08/Sep/2020:16:03:23 +0100] "POST /wp-login.php HTTP/1.1" 200 1874 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
165.22.223.82 - - [08/Sep/2020:16:03:25 +0100] "POST /wp-login.php HTTP/1.1" 200 1858 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
165.22.223.82 - - [08/Sep/2020:16:03:26 +0100] "POST /xmlrpc.php HTTP/1.1" 403 219 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
...

Port probing on unauthorized port 445

Sep  7 06:16:47 serwer sshd\[3493\]: Invalid user truninger from 112.30.136.31 port 56836
Sep  7 06:16:47 serwer sshd\[3493\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.30.136.31
Sep  7 06:16:49 serwer sshd\[3493\]: Failed password for invalid user truninger from 112.30.136.31 port 56836 ssh2
Sep  7 06:42:19 serwer sshd\[7278\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.30.136.31  user=root
Sep  7 06:42:20 serwer sshd\[7278\]: Failed password for root from 112.30.136.31 port 55754 ssh2
Sep  7 06:46:53 serwer sshd\[7770\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.30.136.31  user=root
Sep  7 06:46:55 serwer sshd\[7770\]: Failed password for root from 112.30.136.31 port 48280 ssh2
Sep  7 06:51:21 serwer sshd\[8253\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.30.136.31  user=root

...

 TCP (SYN) 112.11.231.240:52830 -> port 23, len 44

Sep  7 13:46:28 firewall sshd[20992]: Failed password for invalid user wiki from 182.92.226.228 port 32152 ssh2
Sep  7 13:51:20 firewall sshd[21162]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.92.226.228  user=root
Sep  7 13:51:22 firewall sshd[21162]: Failed password for root from 182.92.226.228 port 13325 ssh2
...