Aug 20 07:03:08 rancher-0 sshd[1172212]: Invalid user redmine from 138.68.94.173 port 54758
...

*Port Scan* detected from 138.68.94.173 (DE/Germany/Hesse/Frankfurt am Main/-). 4 hits in the last 161 seconds

$f2bV_matches

Connection to SSH Honeypot - Detected by HoneypotDB

Jul 12 13:00:04 localhost sshd[46230]: Invalid user fating from 138.68.94.173 port 43596
Jul 12 13:00:04 localhost sshd[46230]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.94.173
Jul 12 13:00:04 localhost sshd[46230]: Invalid user fating from 138.68.94.173 port 43596
Jul 12 13:00:06 localhost sshd[46230]: Failed password for invalid user fating from 138.68.94.173 port 43596 ssh2
Jul 12 13:06:23 localhost sshd[46873]: Invalid user gena from 138.68.94.173 port 34574
...

Jun 24 10:15:12 gw1 sshd[10611]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.94.173
Jun 24 10:15:14 gw1 sshd[10611]: Failed password for invalid user dmitry from 138.68.94.173 port 36224 ssh2
...

(sshd) Failed SSH login from 138.68.94.173 (DE/Germany/-): 12 in the last 3600 secs

May 29 22:50:17 vps639187 sshd\[10409\]: Invalid user 111111 from 138.68.94.173 port 54672
May 29 22:50:17 vps639187 sshd\[10409\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.94.173
May 29 22:50:19 vps639187 sshd\[10409\]: Failed password for invalid user 111111 from 138.68.94.173 port 54672 ssh2
...

2020-05-23T18:05:51.062450morrigan.ad5gb.com sshd[11987]: Invalid user kyn from 138.68.94.173 port 42690
2020-05-23T18:05:52.667755morrigan.ad5gb.com sshd[11987]: Failed password for invalid user kyn from 138.68.94.173 port 42690 ssh2
2020-05-23T18:05:53.571711morrigan.ad5gb.com sshd[11987]: Disconnected from invalid user kyn 138.68.94.173 port 42690 [preauth]

May 21 06:37:02 eventyay sshd[13562]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.94.173
May 21 06:37:04 eventyay sshd[13562]: Failed password for invalid user jiaxin from 138.68.94.173 port 58952 ssh2
May 21 06:44:52 eventyay sshd[13863]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.94.173
...

Invalid user eas from 138.68.94.173 port 50486

May 13 03:30:13 XXXXXX sshd[5595]: Invalid user user from 138.68.94.173 port 33904

$f2bV_matches

Brute-force attempt banned

May  7 10:37:57 plex sshd[30495]: Invalid user ragnarok from 138.68.94.173 port 46768

2020-05-04T20:42:24.619339abusebot-7.cloudsearch.cf sshd[28618]: Invalid user hadoopuser from 138.68.94.173 port 48510
2020-05-04T20:42:24.626006abusebot-7.cloudsearch.cf sshd[28618]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.94.173
2020-05-04T20:42:24.619339abusebot-7.cloudsearch.cf sshd[28618]: Invalid user hadoopuser from 138.68.94.173 port 48510
2020-05-04T20:42:27.213818abusebot-7.cloudsearch.cf sshd[28618]: Failed password for invalid user hadoopuser from 138.68.94.173 port 48510 ssh2
2020-05-04T20:50:24.529361abusebot-7.cloudsearch.cf sshd[29112]: Invalid user info from 138.68.94.173 port 58300
2020-05-04T20:50:24.537641abusebot-7.cloudsearch.cf sshd[29112]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.94.173
2020-05-04T20:50:24.529361abusebot-7.cloudsearch.cf sshd[29112]: Invalid user info from 138.68.94.173 port 58300
2020-05-04T20:50:27.020123abusebot-7.cloudsearch.cf sshd[2
...

2020-05-01T05:22:25.537538mail.thespaminator.com sshd[22499]: Invalid user test from 138.68.94.173 port 51982
2020-05-01T05:22:27.837364mail.thespaminator.com sshd[22499]: Failed password for invalid user test from 138.68.94.173 port 51982 ssh2
...

Apr 26 14:04:39 haigwepa sshd[32365]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.94.173 
Apr 26 14:04:41 haigwepa sshd[32365]: Failed password for invalid user test from 138.68.94.173 port 55416 ssh2
...

Apr 21 04:55:36 mockhub sshd[31698]: Failed password for root from 138.68.94.173 port 40550 ssh2
...

Apr 19 19:17:02 lukav-desktop sshd\[19372\]: Invalid user dm from 138.68.94.173
Apr 19 19:17:02 lukav-desktop sshd\[19372\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.94.173
Apr 19 19:17:03 lukav-desktop sshd\[19372\]: Failed password for invalid user dm from 138.68.94.173 port 38322 ssh2
Apr 19 19:26:37 lukav-desktop sshd\[19719\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.94.173  user=root
Apr 19 19:26:38 lukav-desktop sshd\[19719\]: Failed password for root from 138.68.94.173 port 59662 ssh2

2020-04-09T03:54:47.859663abusebot-4.cloudsearch.cf sshd[5086]: Invalid user jboss from 138.68.94.173 port 55898
2020-04-09T03:54:47.867644abusebot-4.cloudsearch.cf sshd[5086]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.94.173
2020-04-09T03:54:47.859663abusebot-4.cloudsearch.cf sshd[5086]: Invalid user jboss from 138.68.94.173 port 55898
2020-04-09T03:54:50.048845abusebot-4.cloudsearch.cf sshd[5086]: Failed password for invalid user jboss from 138.68.94.173 port 55898 ssh2
2020-04-09T04:03:39.719508abusebot-4.cloudsearch.cf sshd[5718]: Invalid user prometheus from 138.68.94.173 port 38036
2020-04-09T04:03:39.738147abusebot-4.cloudsearch.cf sshd[5718]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.94.173
2020-04-09T04:03:39.719508abusebot-4.cloudsearch.cf sshd[5718]: Invalid user prometheus from 138.68.94.173 port 38036
2020-04-09T04:03:40.952001abusebot-4.cloudsearch.cf sshd[5718]: Fail
...

SSH Brute-Force reported by Fail2Ban

Apr  4 08:14:12 prox sshd[32501]: Failed password for root from 138.68.94.173 port 44148 ssh2

Mar 25 09:32:28 ny01 sshd[27651]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.94.173
Mar 25 09:32:30 ny01 sshd[27651]: Failed password for invalid user nexus from 138.68.94.173 port 59166 ssh2
Mar 25 09:40:55 ny01 sshd[31174]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.94.173

Mar  4 19:08:16 server sshd[620149]: Failed password for invalid user cpanelphpmyadmin from 138.68.94.173 port 56204 ssh2
Mar  4 19:29:44 server sshd[654967]: Failed password for invalid user server from 138.68.94.173 port 38528 ssh2
Mar  4 19:50:56 server sshd[689501]: Failed password for invalid user svnuser from 138.68.94.173 port 49088 ssh2

Mar  1 20:36:38 vps647732 sshd[13667]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.94.173
Mar  1 20:36:40 vps647732 sshd[13667]: Failed password for invalid user jayheo from 138.68.94.173 port 51050 ssh2
...

$f2bV_matches_ltvn

Invalid user autodoor from 138.68.94.173 port 52722

2019-12-31T15:42:10.838811shield sshd\[4100\]: Invalid user pass1235 from 138.68.94.173 port 51884
2019-12-31T15:42:10.843508shield sshd\[4100\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.94.173
2019-12-31T15:42:12.855318shield sshd\[4100\]: Failed password for invalid user pass1235 from 138.68.94.173 port 51884 ssh2
2019-12-31T15:44:33.603106shield sshd\[4612\]: Invalid user music from 138.68.94.173 port 40518
2019-12-31T15:44:33.606559shield sshd\[4612\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.94.173

Fail2Ban Ban Triggered

Sep 15 14:51:57 router sshd[6506]: Failed password for root from 138.68.94.142 port 51963 ssh2
Sep 15 15:02:08 router sshd[6558]: Failed password for root from 138.68.94.142 port 58331 ssh2
...

Port scan denied

Port scan: Attack repeated for 24 hours

Automatic report - Banned IP Access

TCP port : 2280

Port scan: Attack repeated for 24 hours

 TCP (SYN) 138.68.94.142:55075 -> port 2280, len 44

firewall-block, port(s): 28171/tcp

TCP port : 15460

Port scan: Attack repeated for 24 hours

 TCP (SYN) 138.68.94.142:48510 -> port 13357, len 44

scans 2 times in preceeding hours on the ports (in chronological order) 22933 26188

Jul 23 22:23:53 vps639187 sshd\[8838\]: Invalid user lazare from 138.68.94.142 port 47458
Jul 23 22:23:53 vps639187 sshd\[8838\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.94.142
Jul 23 22:23:55 vps639187 sshd\[8838\]: Failed password for invalid user lazare from 138.68.94.142 port 47458 ssh2
...

Jul 22 21:36:02 ns382633 sshd\[20639\]: Invalid user hg from 138.68.94.142 port 40958
Jul 22 21:36:02 ns382633 sshd\[20639\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.94.142
Jul 22 21:36:04 ns382633 sshd\[20639\]: Failed password for invalid user hg from 138.68.94.142 port 40958 ssh2
Jul 22 21:54:07 ns382633 sshd\[23882\]: Invalid user coi from 138.68.94.142 port 49014
Jul 22 21:54:07 ns382633 sshd\[23882\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.94.142

Multiport scan 32 ports : 2720 3282 4445 4836 4969 8299 8769 9207 10227 11609 14585 15385 16082 16142 16936 17633 17930 18243 18554 20440 22852 23740 24495 26075 26210 27033 29231 29900 30040 31131 31176 31864

Apr 27 22:28:48 vmd17057 sshd[15321]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.227.255.4 
Apr 27 22:28:49 vmd17057 sshd[15321]: Failed password for invalid user admin from 45.227.255.4 port 9114 ssh2
...

Brute force attempt

Apr 27 22:36:22 legacy sshd[28581]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=140.238.153.125
Apr 27 22:36:24 legacy sshd[28581]: Failed password for invalid user pepe from 140.238.153.125 port 27426 ssh2
Apr 27 22:38:14 legacy sshd[28613]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=140.238.153.125
...

Apr 27 21:42:50 combo sshd[22814]: Failed password for root from 222.186.173.238 port 30512 ssh2
Apr 27 21:42:53 combo sshd[22814]: Failed password for root from 222.186.173.238 port 30512 ssh2
Apr 27 21:42:56 combo sshd[22814]: Failed password for root from 222.186.173.238 port 30512 ssh2
...

Port probing on unauthorized port 1433

Apr 27 21:59:14 ns382633 sshd\[8942\]: Invalid user telekom from 183.61.254.56 port 60182
Apr 27 21:59:14 ns382633 sshd\[8942\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.61.254.56
Apr 27 21:59:16 ns382633 sshd\[8942\]: Failed password for invalid user telekom from 183.61.254.56 port 60182 ssh2
Apr 27 22:12:42 ns382633 sshd\[11785\]: Invalid user screeps from 183.61.254.56 port 49147
Apr 27 22:12:42 ns382633 sshd\[11785\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.61.254.56

Apr 27 22:06:27 mail.srvfarm.net postfix/smtpd[579250]: NOQUEUE: reject: RCPT from palliate.kranbery.com[217.112.128.159]: 554 5.7.1 Service unavailable; Client host [217.112.128.159] blocked using zen.spamhaus.org; https://www.spamhaus.org/sbl/query/SBL461503 / https://www.spamhaus.org/sbl/query/SBLCSS; from= to= proto=ESMTP helo=
Apr 27 22:06:32 mail.srvfarm.net postfix/smtpd[578441]: NOQUEUE: reject: RCPT from palliate.kranbery.com[217.112.128.159]: 554 5.7.1 Service unavailable; Client host [217.112.128.159] blocked using zen.spamhaus.org; https://www.spamhaus.org/sbl/query/SBL461503 / https://www.spamhaus.org/sbl/query/SBLCSS; from= to= proto=ESMTP helo=
Apr 27 22:07:00 mail.srvfarm.net postfix/smtpd[583779]: NOQUEUE: reject: RCPT from palliate.kranbery.com[217.112.128.159]: 554 5.7.1 Service unavailable; Client host [217.112.128.

(sshd) Failed SSH login from 162.248.52.82 (US/United States/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Apr 27 23:04:34 srv sshd[12022]: Invalid user ops from 162.248.52.82 port 42768
Apr 27 23:04:35 srv sshd[12022]: Failed password for invalid user ops from 162.248.52.82 port 42768 ssh2
Apr 27 23:12:19 srv sshd[12311]: Invalid user sysadmin from 162.248.52.82 port 48822
Apr 27 23:12:21 srv sshd[12311]: Failed password for invalid user sysadmin from 162.248.52.82 port 48822 ssh2
Apr 27 23:14:58 srv sshd[12412]: Invalid user zn from 162.248.52.82 port 41964

ICMP flood

Apr 27 22:24:42 server sshd[19122]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.69.24.243
Apr 27 22:24:44 server sshd[19122]: Failed password for invalid user net from 185.69.24.243 port 36674 ssh2
Apr 27 22:28:44 server sshd[19515]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.69.24.243
...

2020-04-27T22:12:22.785833  sshd[4712]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.88.112.115  user=root
2020-04-27T22:12:24.484685  sshd[4712]: Failed password for root from 49.88.112.115 port 31504 ssh2
2020-04-27T22:12:27.974388  sshd[4712]: Failed password for root from 49.88.112.115 port 31504 ssh2
2020-04-27T22:12:22.785833  sshd[4712]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.88.112.115  user=root
2020-04-27T22:12:24.484685  sshd[4712]: Failed password for root from 49.88.112.115 port 31504 ssh2
2020-04-27T22:12:27.974388  sshd[4712]: Failed password for root from 49.88.112.115 port 31504 ssh2
...

Apr 27 17:01:34 ny01 sshd[12607]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=223.83.138.104
Apr 27 17:01:35 ny01 sshd[12607]: Failed password for invalid user aiken from 223.83.138.104 port 57610 ssh2
Apr 27 17:03:29 ny01 sshd[12794]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=223.83.138.104

Apr 27 21:49:23 server sshd[17440]: Failed password for invalid user karunya from 103.4.217.138 port 58940 ssh2
Apr 27 22:06:22 server sshd[22883]: Failed password for invalid user manager from 103.4.217.138 port 43600 ssh2
Apr 27 22:12:15 server sshd[24882]: Failed password for invalid user sac from 103.4.217.138 port 49418 ssh2

Unauthorised connection attempt detected at AUO MAIN. System is sshd. Protected by AUO Stack Web Application Firewall (WAF)

Brute-force general attack.