(sshd) Failed SSH login from 14.161.45.187 (VN/Vietnam/static.vnpt.vn): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Oct 11 15:23:10 optimus sshd[3270]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.161.45.187  user=root
Oct 11 15:23:11 optimus sshd[3270]: Failed password for root from 14.161.45.187 port 51020 ssh2
Oct 11 15:55:09 optimus sshd[31504]: Invalid user test123 from 14.161.45.187
Oct 11 15:55:09 optimus sshd[31504]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.161.45.187 
Oct 11 15:55:10 optimus sshd[31504]: Failed password for invalid user test123 from 14.161.45.187 port 35170 ssh2

Oct 11 16:13:39 mx sshd[1351830]: Failed password for root from 14.161.45.187 port 47020 ssh2
Oct 11 16:14:33 mx sshd[1351838]: Invalid user uu from 14.161.45.187 port 52915
Oct 11 16:14:33 mx sshd[1351838]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.161.45.187 
Oct 11 16:14:33 mx sshd[1351838]: Invalid user uu from 14.161.45.187 port 52915
Oct 11 16:14:35 mx sshd[1351838]: Failed password for invalid user uu from 14.161.45.187 port 52915 ssh2
...

$f2bV_matches

2020-10-10 16:10:30.176107-0500  localhost sshd[48225]: Failed password for root from 14.161.45.187 port 36078 ssh2

Invalid user tester from 14.161.45.187 port 35104

Invalid user tester from 14.161.45.187 port 35104

Aug 17 07:12:39 PorscheCustomer sshd[28388]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.161.45.187
Aug 17 07:12:41 PorscheCustomer sshd[28388]: Failed password for invalid user lisa from 14.161.45.187 port 36779 ssh2
Aug 17 07:14:24 PorscheCustomer sshd[28481]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.161.45.187
...

Connection to SSH Honeypot - Detected by HoneypotDB

Jul 23 16:54:26 Invalid user yxy from 14.161.45.187 port 40629

Jul 21 23:45:10 abendstille sshd\[7566\]: Invalid user mm from 14.161.45.187
Jul 21 23:45:10 abendstille sshd\[7566\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.161.45.187
Jul 21 23:45:12 abendstille sshd\[7566\]: Failed password for invalid user mm from 14.161.45.187 port 41466 ssh2
Jul 21 23:49:06 abendstille sshd\[11714\]: Invalid user sda from 14.161.45.187
Jul 21 23:49:06 abendstille sshd\[11714\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.161.45.187
...

2020-07-21T09:08:01.919873afi-git.jinr.ru sshd[15602]: Invalid user gitolite from 14.161.45.187 port 57538
2020-07-21T09:08:01.923118afi-git.jinr.ru sshd[15602]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.161.45.187
2020-07-21T09:08:01.919873afi-git.jinr.ru sshd[15602]: Invalid user gitolite from 14.161.45.187 port 57538
2020-07-21T09:08:03.706524afi-git.jinr.ru sshd[15602]: Failed password for invalid user gitolite from 14.161.45.187 port 57538 ssh2
2020-07-21T09:10:56.435301afi-git.jinr.ru sshd[16384]: Invalid user guest from 14.161.45.187 port 49604
...

SSH Brute-Forcing (server1)

Jun 19 12:41:20 vps639187 sshd\[26885\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.161.45.187  user=root
Jun 19 12:41:21 vps639187 sshd\[26885\]: Failed password for root from 14.161.45.187 port 60281 ssh2
Jun 19 12:44:41 vps639187 sshd\[26937\]: Invalid user ustin from 14.161.45.187 port 60197
Jun 19 12:44:41 vps639187 sshd\[26937\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.161.45.187
...

145. On Jun 7 2020 experienced a Brute Force SSH login attempt -> 80 unique times by 14.161.45.187.

(sshd) Failed SSH login from 14.161.45.187 (VN/Vietnam/static.vnpt.vn): 5 in the last 3600 secs

May 10 15:18:13 sip sshd[199212]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.161.45.187 
May 10 15:18:13 sip sshd[199212]: Invalid user restart from 14.161.45.187 port 47964
May 10 15:18:15 sip sshd[199212]: Failed password for invalid user restart from 14.161.45.187 port 47964 ssh2
...

May  9 02:33:13 melroy-server sshd[31193]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.161.45.187 
May  9 02:33:15 melroy-server sshd[31193]: Failed password for invalid user www from 14.161.45.187 port 55785 ssh2
...

$f2bV_matches

invalid user

Apr  2 20:33:26 mout sshd[15383]: Failed password for root from 14.161.45.187 port 40555 ssh2
Apr  2 20:36:38 mout sshd[15640]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.161.45.187  user=root
Apr  2 20:36:40 mout sshd[15640]: Failed password for root from 14.161.45.187 port 39570 ssh2

Mar 27 07:32:30 ns3042688 sshd\[30230\]: Invalid user mmo from 14.161.45.187
Mar 27 07:32:30 ns3042688 sshd\[30230\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.161.45.187 
Mar 27 07:32:32 ns3042688 sshd\[30230\]: Failed password for invalid user mmo from 14.161.45.187 port 38291 ssh2
Mar 27 07:35:53 ns3042688 sshd\[32178\]: Invalid user zbi from 14.161.45.187
Mar 27 07:35:53 ns3042688 sshd\[32178\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.161.45.187 
...

SSH brute-force attempt

leo_www

Mar 16 15:46:18 host sshd[20163]: Invalid user list from 14.161.45.187 port 58949
...

sshd jail - ssh hack attempt

Mar  6 23:29:39 srv01 sshd[25227]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.161.45.187  user=root
Mar  6 23:29:41 srv01 sshd[25227]: Failed password for root from 14.161.45.187 port 47193 ssh2
Mar  6 23:32:08 srv01 sshd[25468]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.161.45.187  user=root
Mar  6 23:32:10 srv01 sshd[25468]: Failed password for root from 14.161.45.187 port 38584 ssh2
Mar  6 23:34:36 srv01 sshd[25606]: Invalid user amit from 14.161.45.187 port 58210
...

Feb 29 08:22:00 silence02 sshd[25976]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.161.45.187
Feb 29 08:22:02 silence02 sshd[25976]: Failed password for invalid user guoyifan from 14.161.45.187 port 36942 ssh2
Feb 29 08:27:31 silence02 sshd[26219]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.161.45.187

Jul  5 17:26:58 Host-KLAX-C dovecot: imap-login: Disconnected (auth failed, 1 attempts in 9 secs): user=, method=PLAIN, rip=14.161.45.253, lip=185.198.26.142, TLS, session=
...

Dovecot Invalid User Login Attempt.

Dovecot Invalid User Login Attempt.

This IP Address sent many spam to @bit.co.id
mhamdanrifai@gmail.com is administrator

"Fail2Ban detected SSH brute force attempt"

Oct  7 13:42:52 dev sshd\[10939\]: Invalid user admin from 14.161.45.253 port 44058
Oct  7 13:42:52 dev sshd\[10939\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.161.45.253
Oct  7 13:42:54 dev sshd\[10939\]: Failed password for invalid user admin from 14.161.45.253 port 44058 ssh2

Sep 14 18:08:22 ny01 sshd[23085]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.89.153.54
Sep 14 18:08:23 ny01 sshd[23085]: Failed password for invalid user adm from 159.89.153.54 port 44090 ssh2
Sep 14 18:12:40 ny01 sshd[23751]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.89.153.54

Sep 14 21:15:18 TORMINT sshd\[25193\]: Invalid user ubuntu from 198.27.90.106
Sep 14 21:15:18 TORMINT sshd\[25193\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=198.27.90.106
Sep 14 21:15:20 TORMINT sshd\[25193\]: Failed password for invalid user ubuntu from 198.27.90.106 port 43053 ssh2
...

Sep 14 23:27:01 mail sshd\[23765\]: Invalid user penis from 196.40.156.49
Sep 14 23:27:01 mail sshd\[23765\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=196.40.156.49
Sep 14 23:27:04 mail sshd\[23765\]: Failed password for invalid user penis from 196.40.156.49 port 53312 ssh2
...

Sep 15 03:33:52 OPSO sshd\[6935\]: Invalid user vbox from 178.128.241.99 port 44554
Sep 15 03:33:52 OPSO sshd\[6935\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.241.99
Sep 15 03:33:54 OPSO sshd\[6935\]: Failed password for invalid user vbox from 178.128.241.99 port 44554 ssh2
Sep 15 03:38:01 OPSO sshd\[7657\]: Invalid user ainslie from 178.128.241.99 port 35688
Sep 15 03:38:01 OPSO sshd\[7657\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.241.99

Sep 14 19:18:55 xb3 sshd[8700]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=em3-52-51-236-249.eu-west-1.compute.amazonaws.com
Sep 14 19:18:57 xb3 sshd[8700]: Failed password for invalid user mv from 52.51.236.249 port 57908 ssh2
Sep 14 19:18:57 xb3 sshd[8700]: Received disconnect from 52.51.236.249: 11: Bye Bye [preauth]
Sep 14 19:30:13 xb3 sshd[25885]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=em3-52-51-236-249.eu-west-1.compute.amazonaws.com
Sep 14 19:30:15 xb3 sshd[25885]: Failed password for invalid user swadmin from 52.51.236.249 port 51096 ssh2
Sep 14 19:30:15 xb3 sshd[25885]: Received disconnect from 52.51.236.249: 11: Bye Bye [preauth]
Sep 14 19:33:48 xb3 sshd[8991]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=em3-52-51-236-249.eu-west-1.compute.amazonaws.com
Sep 14 19:33:51 xb3 sshd[8991]: Failed password for invalid user vx from........
-------------------------------

Sep 15 02:41:42 vps691689 sshd[22883]: Failed password for root from 159.65.157.194 port 40662 ssh2
Sep 15 02:46:29 vps691689 sshd[22960]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.65.157.194
...

HTTP wp-login.php - dsl.49.151.246.125.pldt.net

Sep 15 03:30:35 vps01 sshd[10926]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.182.65.169
Sep 15 03:30:37 vps01 sshd[10926]: Failed password for invalid user a from 194.182.65.169 port 48366 ssh2

Invalid user admin from 171.235.60.248 port 5810

Sep 14 22:19:05 MK-Soft-VM5 sshd\[1280\]: Invalid user ftp from 144.217.93.130 port 35588
Sep 14 22:19:05 MK-Soft-VM5 sshd\[1280\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=144.217.93.130
Sep 14 22:19:07 MK-Soft-VM5 sshd\[1280\]: Failed password for invalid user ftp from 144.217.93.130 port 35588 ssh2
...

F2B jail: sshd. Time: 2019-09-15 03:14:57, Reported by: VKReport

Sep 15 00:13:43 areeb-Workstation sshd[10341]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=108.75.217.101
Sep 15 00:13:45 areeb-Workstation sshd[10341]: Failed password for invalid user alex from 108.75.217.101 port 60284 ssh2
...

Sep 14 16:52:18 ws12vmsma01 sshd[21830]: Invalid user username from 200.196.253.251
Sep 14 16:52:20 ws12vmsma01 sshd[21830]: Failed password for invalid user username from 200.196.253.251 port 34056 ssh2
Sep 14 17:01:07 ws12vmsma01 sshd[23089]: Invalid user training from 200.196.253.251
...

Sep 15 02:35:11 tuotantolaitos sshd[23174]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=132.232.120.158
Sep 15 02:35:13 tuotantolaitos sshd[23174]: Failed password for invalid user carol from 132.232.120.158 port 28890 ssh2
...

Sep 15 02:56:24 MK-Soft-Root2 sshd\[26050\]: Invalid user ts from 54.38.242.233 port 58090
Sep 15 02:56:24 MK-Soft-Root2 sshd\[26050\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.38.242.233
Sep 15 02:56:26 MK-Soft-Root2 sshd\[26050\]: Failed password for invalid user ts from 54.38.242.233 port 58090 ssh2
...