SSH Login Bruteforce

Sep  7 12:26:05 MainVPS sshd[10732]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.246.42  user=root
Sep  7 12:26:07 MainVPS sshd[10732]: Failed password for root from 142.93.246.42 port 47020 ssh2
Sep  7 12:30:04 MainVPS sshd[16861]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.246.42  user=root
Sep  7 12:30:06 MainVPS sshd[16861]: Failed password for root from 142.93.246.42 port 46532 ssh2
Sep  7 12:33:51 MainVPS sshd[24197]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.246.42  user=root
Sep  7 12:33:53 MainVPS sshd[24197]: Failed password for root from 142.93.246.42 port 46046 ssh2
...

(sshd) Failed SSH login from 142.93.246.42 (US/United States/-): 5 in the last 3600 secs

invalid user

'Fail2Ban'

2020-08-22T08:15:33.389407vps751288.ovh.net sshd\[26569\]: Invalid user jana from 142.93.246.42 port 43498
2020-08-22T08:15:33.398096vps751288.ovh.net sshd\[26569\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.246.42
2020-08-22T08:15:35.118809vps751288.ovh.net sshd\[26569\]: Failed password for invalid user jana from 142.93.246.42 port 43498 ssh2
2020-08-22T08:19:33.967472vps751288.ovh.net sshd\[26595\]: Invalid user alexandra from 142.93.246.42 port 52482
2020-08-22T08:19:33.973702vps751288.ovh.net sshd\[26595\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.246.42

Aug 20 14:50:22 sso sshd[15567]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.246.42
Aug 20 14:50:24 sso sshd[15567]: Failed password for invalid user lfd from 142.93.246.42 port 45452 ssh2
...

Cowrie Honeypot: 3 unauthorised SSH/Telnet login attempts between 2020-08-20T12:03:59Z and 2020-08-20T12:11:51Z

2020-08-19T04:07:01.641367shield sshd\[24416\]: Invalid user lqx from 142.93.246.42 port 59456
2020-08-19T04:07:01.650018shield sshd\[24416\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.246.42
2020-08-19T04:07:03.669370shield sshd\[24416\]: Failed password for invalid user lqx from 142.93.246.42 port 59456 ssh2
2020-08-19T04:10:41.269912shield sshd\[24696\]: Invalid user admin from 142.93.246.42 port 39044
2020-08-19T04:10:41.278362shield sshd\[24696\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.246.42

Automatic Fail2ban report - Trying login SSH

fail2ban/Aug 15 01:39:24 h1962932 sshd[10329]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.246.42  user=root
Aug 15 01:39:26 h1962932 sshd[10329]: Failed password for root from 142.93.246.42 port 56728 ssh2
Aug 15 01:43:47 h1962932 sshd[10531]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.246.42  user=root
Aug 15 01:43:49 h1962932 sshd[10531]: Failed password for root from 142.93.246.42 port 37618 ssh2
Aug 15 01:48:07 h1962932 sshd[13310]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.246.42  user=root
Aug 15 01:48:09 h1962932 sshd[13310]: Failed password for root from 142.93.246.42 port 46740 ssh2

Aug  7 13:53:13 ovpn sshd\[15541\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.246.42  user=root
Aug  7 13:53:16 ovpn sshd\[15541\]: Failed password for root from 142.93.246.42 port 50526 ssh2
Aug  7 13:58:57 ovpn sshd\[17913\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.246.42  user=root
Aug  7 13:58:59 ovpn sshd\[17913\]: Failed password for root from 142.93.246.42 port 36444 ssh2
Aug  7 14:00:40 ovpn sshd\[18709\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.246.42  user=root

2020-08-04T14:33:10+0200 Failed SSH Authentication/Brute Force Attack. (Server 9)

Jul 28 00:44:41 gospond sshd[26578]: Invalid user liuziyuan from 142.93.246.42 port 55216
Jul 28 00:44:43 gospond sshd[26578]: Failed password for invalid user liuziyuan from 142.93.246.42 port 55216 ssh2
Jul 28 00:45:56 gospond sshd[26595]: Invalid user sxltzxkt from 142.93.246.42 port 42322
...

$f2bV_matches

Jul 23 20:22:13 ns382633 sshd\[14117\]: Invalid user romulo from 142.93.246.42 port 37092
Jul 23 20:22:13 ns382633 sshd\[14117\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.246.42
Jul 23 20:22:14 ns382633 sshd\[14117\]: Failed password for invalid user romulo from 142.93.246.42 port 37092 ssh2
Jul 23 20:30:02 ns382633 sshd\[15175\]: Invalid user gitlab-runner from 142.93.246.42 port 40638
Jul 23 20:30:02 ns382633 sshd\[15175\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.246.42

$f2bV_matches

Jul 19 06:22:44 ny01 sshd[21270]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.246.42
Jul 19 06:22:46 ny01 sshd[21270]: Failed password for invalid user nor from 142.93.246.42 port 53458 ssh2
Jul 19 06:24:33 ny01 sshd[21449]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.246.42

2020-07-16T10:31:40+0200 Failed SSH Authentication/Brute Force Attack. (Server 10)

Jul  7 07:25:21 PorscheCustomer sshd[8035]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.246.42
Jul  7 07:25:23 PorscheCustomer sshd[8035]: Failed password for invalid user jessica from 142.93.246.42 port 40628 ssh2
Jul  7 07:28:44 PorscheCustomer sshd[8212]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.246.42
...

SSH Bruteforce attack

2020-06-29T22:55:06.615667abusebot.cloudsearch.cf sshd[25556]: Invalid user gt from 142.93.246.42 port 50744
2020-06-29T22:55:06.620753abusebot.cloudsearch.cf sshd[25556]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.246.42
2020-06-29T22:55:06.615667abusebot.cloudsearch.cf sshd[25556]: Invalid user gt from 142.93.246.42 port 50744
2020-06-29T22:55:07.967600abusebot.cloudsearch.cf sshd[25556]: Failed password for invalid user gt from 142.93.246.42 port 50744 ssh2
2020-06-29T22:58:40.004605abusebot.cloudsearch.cf sshd[25734]: Invalid user ftw from 142.93.246.42 port 50858
2020-06-29T22:58:40.009666abusebot.cloudsearch.cf sshd[25734]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.246.42
2020-06-29T22:58:40.004605abusebot.cloudsearch.cf sshd[25734]: Invalid user ftw from 142.93.246.42 port 50858
2020-06-29T22:58:42.069002abusebot.cloudsearch.cf sshd[25734]: Failed password for invalid user ft
...

Jun 24 15:04:40 h1745522 sshd[28789]: Invalid user phil from 142.93.246.42 port 58670
Jun 24 15:04:40 h1745522 sshd[28789]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.246.42
Jun 24 15:04:40 h1745522 sshd[28789]: Invalid user phil from 142.93.246.42 port 58670
Jun 24 15:04:42 h1745522 sshd[28789]: Failed password for invalid user phil from 142.93.246.42 port 58670 ssh2
Jun 24 15:07:53 h1745522 sshd[28905]: Invalid user dai from 142.93.246.42 port 59036
Jun 24 15:07:53 h1745522 sshd[28905]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.246.42
Jun 24 15:07:53 h1745522 sshd[28905]: Invalid user dai from 142.93.246.42 port 59036
Jun 24 15:07:55 h1745522 sshd[28905]: Failed password for invalid user dai from 142.93.246.42 port 59036 ssh2
Jun 24 15:11:05 h1745522 sshd[29179]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.246.42  user=root
Jun 24
...

Jun 24 09:57:29 jumpserver sshd[198740]: Failed password for root from 142.93.246.42 port 44052 ssh2
Jun 24 10:00:46 jumpserver sshd[198783]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.246.42  user=root
Jun 24 10:00:48 jumpserver sshd[198783]: Failed password for root from 142.93.246.42 port 45026 ssh2
...

ssh brute force

Jan 21 15:00:36 * sshd[13119]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.70.187.225
Jan 21 15:00:38 * sshd[13119]: Failed password for invalid user 1p2o3i from 118.70.187.225 port 41331 ssh2

Jan 21 18:15:02 firewall sshd[30821]: Failed password for root from 222.186.190.92 port 32314 ssh2
Jan 21 18:15:15 firewall sshd[30821]: error: maximum authentication attempts exceeded for root from 222.186.190.92 port 32314 ssh2 [preauth]
Jan 21 18:15:15 firewall sshd[30821]: Disconnecting: Too many authentication failures [preauth]
...

Honeypot attack, port: 445, PTR: 202-141-252-138.multi.net.pk.

Unauthorized connection attempt detected from IP address 61.68.232.186 to port 5555 [J]

Jan 21 13:55:41 grey postfix/smtpd\[23443\]: NOQUEUE: reject: RCPT from unknown\[66.55.76.184\]: 554 5.7.1 Service unavailable\; Client host \[66.55.76.184\] blocked using truncate.gbudb.net\; http://www.gbudb.com/truncate/ \[66.55.76.184\]\; from=\<5465-491-383329-923-principal=learning-steps.com@mail.unlock1.rest\> to=\ proto=ESMTP helo=\
...

Honeypot attack, port: 5555, PTR: n219077212068.netvigator.com.

Invalid user gc from 46.101.139.105 port 42694

(From loyd.burn@gmail.com) Would you like to post your business on thousands of advertising sites every month? Pay one low monthly fee and get virtually unlimited traffic to your site forever! Get more info by visiting: http://www.adsonautopilot.xyz

Jan 21 10:49:25 eddieflores sshd\[13290\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=168.197.31.12  user=root
Jan 21 10:49:27 eddieflores sshd\[13290\]: Failed password for root from 168.197.31.12 port 37200 ssh2
Jan 21 10:53:36 eddieflores sshd\[13911\]: Invalid user charles from 168.197.31.12
Jan 21 10:53:36 eddieflores sshd\[13911\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=168.197.31.12
Jan 21 10:53:38 eddieflores sshd\[13911\]: Failed password for invalid user charles from 168.197.31.12 port 52822 ssh2

2020-01-21 16:03:29,203 fail2ban.actions        [1799]: NOTICE  [sshd] Ban 66.228.16.122

Honeypot attack, port: 445, PTR: 30.7.67.222.broad.xw.sh.dynamic.163data.com.cn.

2020-01-21T21:42:26.212269struts4.enskede.local sshd\[16284\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.180.9  user=root
2020-01-21T21:42:29.434828struts4.enskede.local sshd\[16284\]: Failed password for root from 222.186.180.9 port 31394 ssh2
2020-01-21T21:42:34.230212struts4.enskede.local sshd\[16284\]: Failed password for root from 222.186.180.9 port 31394 ssh2
2020-01-21T21:42:39.053900struts4.enskede.local sshd\[16284\]: Failed password for root from 222.186.180.9 port 31394 ssh2
2020-01-21T21:42:43.402900struts4.enskede.local sshd\[16284\]: Failed password for root from 222.186.180.9 port 31394 ssh2
...

Wordpress attack

Unauthorized connection attempt detected from IP address 180.76.102.226 to port 2220 [J]

Honeypot attack, port: 445, PTR: PTR record not found