<6 unauthorized SSH connections

May  4 00:49:21 meumeu sshd[26299]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.44.243.160 
May  4 00:49:22 meumeu sshd[26299]: Failed password for invalid user marcio from 142.44.243.160 port 43208 ssh2
May  4 00:53:52 meumeu sshd[30460]: Failed password for root from 142.44.243.160 port 48750 ssh2
...

20 attempts against mh-ssh on cloud

Fail2Ban - SSH Bruteforce Attempt

Unauthorized connection attempt detected from IP address 142.44.243.160 to port 2220 [J]

Unauthorized connection attempt detected from IP address 142.44.243.160 to port 2220 [J]

2019-12-31T16:47:52.524173vps751288.ovh.net sshd\[7650\]: Invalid user kiltz from 142.44.243.160 port 45144
2019-12-31T16:47:52.532969vps751288.ovh.net sshd\[7650\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=160.ip-142-44-243.net
2019-12-31T16:47:54.834720vps751288.ovh.net sshd\[7650\]: Failed password for invalid user kiltz from 142.44.243.160 port 45144 ssh2
2019-12-31T16:50:55.103610vps751288.ovh.net sshd\[7654\]: Invalid user eskedal from 142.44.243.160 port 60289
2019-12-31T16:50:55.113652vps751288.ovh.net sshd\[7654\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=160.ip-142-44-243.net

Automatic report - SSH Brute-Force Attack

Dec 21 21:37:04 server sshd\[29414\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=160.ip-142-44-243.net  user=root
Dec 21 21:37:06 server sshd\[29414\]: Failed password for root from 142.44.243.160 port 53249 ssh2
Dec 21 21:41:59 server sshd\[30687\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=160.ip-142-44-243.net  user=root
Dec 21 21:42:00 server sshd\[30687\]: Failed password for root from 142.44.243.160 port 56239 ssh2
Dec 21 21:46:53 server sshd\[31966\]: Invalid user escape from 142.44.243.160
Dec 21 21:46:53 server sshd\[31966\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=160.ip-142-44-243.net 
...

Dec 18 13:33:21 wbs sshd\[3028\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=160.ip-142-44-243.net  user=root
Dec 18 13:33:22 wbs sshd\[3028\]: Failed password for root from 142.44.243.160 port 51799 ssh2
Dec 18 13:38:48 wbs sshd\[3527\]: Invalid user server from 142.44.243.160
Dec 18 13:38:48 wbs sshd\[3527\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=160.ip-142-44-243.net
Dec 18 13:38:50 wbs sshd\[3527\]: Failed password for invalid user server from 142.44.243.160 port 56154 ssh2

Dec 12 23:44:08 kapalua sshd\[637\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=160.ip-142-44-243.net  user=mysql
Dec 12 23:44:10 kapalua sshd\[637\]: Failed password for mysql from 142.44.243.160 port 40449 ssh2
Dec 12 23:49:37 kapalua sshd\[1254\]: Invalid user roo from 142.44.243.160
Dec 12 23:49:37 kapalua sshd\[1254\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=160.ip-142-44-243.net
Dec 12 23:49:39 kapalua sshd\[1254\]: Failed password for invalid user roo from 142.44.243.160 port 45037 ssh2

$f2bV_matches

$f2bV_matches

Automatic report - SSH Brute-Force Attack

Exploited Host.

2020-04-06T02:38:13.238478struts4.enskede.local sshd\[25312\]: Invalid user user3 from 142.44.243.190 port 37770
2020-04-06T02:38:13.246079struts4.enskede.local sshd\[25312\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.ip-142-44-243.net
2020-04-06T02:38:17.011930struts4.enskede.local sshd\[25312\]: Failed password for invalid user user3 from 142.44.243.190 port 37770 ssh2
2020-04-06T02:40:02.642733struts4.enskede.local sshd\[25367\]: Invalid user ubuntu from 142.44.243.190 port 57770
2020-04-06T02:40:02.650424struts4.enskede.local sshd\[25367\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.ip-142-44-243.net
...

Tried sshing with brute force.

Mar 28 10:08:54 server sshd\[27528\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.ip-142-44-243.net  user=root
Mar 28 10:08:56 server sshd\[27528\]: Failed password for root from 142.44.243.190 port 34966 ssh2
Mar 28 10:10:39 server sshd\[28317\]: Invalid user test from 142.44.243.190
Mar 28 10:10:39 server sshd\[28317\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.ip-142-44-243.net 
Mar 28 10:10:41 server sshd\[28317\]: Failed password for invalid user test from 142.44.243.190 port 48964 ssh2
...

Mar 27 21:00:53 jane sshd[3937]: Failed password for root from 142.44.243.190 port 43702 ssh2
Mar 27 21:02:35 jane sshd[6190]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.44.243.190 
...

Mar 24 21:46:17  sshd\[17456\]: User root from 190.ip-142-44-243.net not allowed because not listed in AllowUsersMar 24 21:46:19  sshd\[17456\]: Failed password for invalid user root from 142.44.243.190 port 55782 ssh2
...

$f2bV_matches_ltvn

fail2ban

MultiHost/MultiPort Probe, Scan, Hack -

Nov  8 19:09:16 h2177944 kernel: \[6112155.288070\] \[UFW BLOCK\] IN=venet0 OUT= MAC= SRC=142.44.243.161 DST=85.214.117.9 LEN=40 TOS=0x00 PREC=0x00 TTL=240 ID=64571 PROTO=TCP SPT=23990 DPT=23 WINDOW=0 RES=0x00 SYN URGP=0 
Nov  8 19:09:34 h2177944 kernel: \[6112173.258398\] \[UFW BLOCK\] IN=venet0 OUT= MAC= SRC=142.44.243.161 DST=85.214.117.9 LEN=40 TOS=0x00 PREC=0x00 TTL=240 ID=60261 PROTO=TCP SPT=57166 DPT=23 WINDOW=0 RES=0x00 SYN URGP=0 
Nov  8 19:12:10 h2177944 kernel: \[6112329.221696\] \[UFW BLOCK\] IN=venet0 OUT= MAC= SRC=142.44.243.161 DST=85.214.117.9 LEN=40 TOS=0x00 PREC=0x00 TTL=240 ID=19014 PROTO=TCP SPT=40139 DPT=23 WINDOW=0 RES=0x00 SYN URGP=0 
Nov  8 19:13:54 h2177944 kernel: \[6112433.916701\] \[UFW BLOCK\] IN=venet0 OUT= MAC= SRC=142.44.243.161 DST=85.214.117.9 LEN=40 TOS=0x00 PREC=0x00 TTL=240 ID=55872 PROTO=TCP SPT=6946 DPT=23 WINDOW=0 RES=0x00 SYN URGP=0 
Nov  8 19:15:10 h2177944 kernel: \[6112509.834276\] \[UFW BLOCK\] IN=venet0 OUT= MAC= SRC=142.44.243.161 DST=85.214.117.9 LEN=40 TOS=0x00

Unauthorised access (Nov  8) SRC=142.44.243.161 LEN=40 TTL=237 ID=59526 TCP DPT=23 WINDOW=0 SYN 
Unauthorised access (Nov  6) SRC=142.44.243.161 LEN=40 TTL=239 ID=1248 TCP DPT=23 WINDOW=0 SYN 
Unauthorised access (Nov  5) SRC=142.44.243.161 LEN=40 TTL=237 ID=34274 TCP DPT=23 WINDOW=0 SYN 
Unauthorised access (Nov  5) SRC=142.44.243.161 LEN=40 TTL=237 ID=61835 TCP DPT=23 WINDOW=0 SYN 
Unauthorised access (Nov  4) SRC=142.44.243.161 LEN=40 TTL=237 ID=52567 TCP DPT=23 WINDOW=0 SYN 
Unauthorised access (Nov  4) SRC=142.44.243.161 LEN=40 TTL=237 ID=18317 TCP DPT=23 WINDOW=0 SYN 
Unauthorised access (Nov  3) SRC=142.44.243.161 LEN=40 TTL=237 ID=16544 TCP DPT=23 WINDOW=0 SYN

Nov  2 22:54:24 h2177944 kernel: \[5607354.351930\] \[UFW BLOCK\] IN=venet0 OUT= MAC= SRC=142.44.243.161 DST=85.214.117.9 LEN=40 TOS=0x00 PREC=0x00 TTL=241 ID=47309 PROTO=TCP SPT=50898 DPT=23 WINDOW=0 RES=0x00 SYN URGP=0 
Nov  2 22:54:36 h2177944 kernel: \[5607366.493998\] \[UFW BLOCK\] IN=venet0 OUT= MAC= SRC=142.44.243.161 DST=85.214.117.9 LEN=40 TOS=0x00 PREC=0x00 TTL=241 ID=62777 PROTO=TCP SPT=35399 DPT=23 WINDOW=0 RES=0x00 SYN URGP=0 
Nov  2 22:55:10 h2177944 kernel: \[5607400.863459\] \[UFW BLOCK\] IN=venet0 OUT= MAC= SRC=142.44.243.161 DST=85.214.117.9 LEN=40 TOS=0x00 PREC=0x00 TTL=240 ID=35029 PROTO=TCP SPT=11008 DPT=23 WINDOW=0 RES=0x00 SYN URGP=0 
Nov  2 22:55:19 h2177944 kernel: \[5607410.179296\] \[UFW BLOCK\] IN=venet0 OUT= MAC= SRC=142.44.243.161 DST=85.214.117.9 LEN=40 TOS=0x00 PREC=0x00 TTL=241 ID=46821 PROTO=TCP SPT=56382 DPT=23 WINDOW=0 RES=0x00 SYN URGP=0 
Nov  2 22:56:12 h2177944 kernel: \[5607462.536175\] \[UFW BLOCK\] IN=venet0 OUT= MAC= SRC=142.44.243.161 DST=85.214.117.9 LEN=40 TOS=0x0

Excessive Port-Scanning

23/tcp 23/tcp
[2019-09-29]2pkt

Invalid user dev from 142.44.243.126 port 40462

Dec 14 20:50:34 thevastnessof sshd[4457]: Failed password for root from 222.186.180.147 port 55214 ssh2
...

Dec 14 18:18:44 herz-der-gamer sshd[19381]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.86.62  user=mysql
Dec 14 18:18:46 herz-der-gamer sshd[19381]: Failed password for mysql from 91.121.86.62 port 42242 ssh2
Dec 14 18:27:41 herz-der-gamer sshd[19489]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.86.62  user=root
Dec 14 18:27:44 herz-der-gamer sshd[19489]: Failed password for root from 91.121.86.62 port 40872 ssh2
...

(imapd) Failed IMAP login from 103.89.56.42 (IN/India/host103-89-56-42.adriinfocom.in): 1 in the last 3600 secs

Automatic report - Banned IP Access

ET SCAN Sipvicious User-Agent Detected (friendly-scanner) - port: 5060 proto: UDP cat: Attempted Information Leak

Dec 14 20:56:22 MK-Soft-VM5 sshd[20045]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=209.97.179.209 
Dec 14 20:56:24 MK-Soft-VM5 sshd[20045]: Failed password for invalid user jayendra from 209.97.179.209 port 56342 ssh2
...

Unauthorized connection attempt detected from IP address 193.188.22.187 to port 3389

(From eric@talkwithcustomer.com) Hello rolleyfamilychiropractic.com,

People ask, “why does TalkWithCustomer work so well?”

It’s simple.

TalkWithCustomer enables you to connect with a prospective customer at EXACTLY the Perfect Time.

- NOT one week, two weeks, three weeks after they’ve checked out your website rolleyfamilychiropractic.com.
- NOT with a form letter style email that looks like it was written by a bot.
- NOT with a robocall that could come at any time out of the blue.

TalkWithCustomer connects you to that person within seconds of THEM asking to hear from YOU.

They kick off the conversation.

They take that first step.

They ask to hear from you regarding what you have to offer and how it can make their life better. 

And it happens almost immediately. In real time. While they’re still looking over your website rolleyfamilychiropractic.com, trying to make up their mind whether you are right for them.

When you connect with them at that very moment it’s the ultimate in P

IP blocked

Invalid user canja from 184.64.13.67 port 46038

Unauthorized connection attempt detected from IP address 46.217.248.7 to port 23

fail2ban honeypot

Dec 14 16:49:28 dedicated sshd[21695]: Invalid user kiandra from 183.63.87.236 port 33312

Dec 15 03:45:32 webhost01 sshd[13492]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.37.209
Dec 15 03:45:34 webhost01 sshd[13492]: Failed password for invalid user guest from 139.59.37.209 port 60454 ssh2
...