2019-10-03T02:37:09.576044  sshd[4251]: Invalid user ky from 145.239.227.21 port 51278
2019-10-03T02:37:09.589610  sshd[4251]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=145.239.227.21
2019-10-03T02:37:09.576044  sshd[4251]: Invalid user ky from 145.239.227.21 port 51278
2019-10-03T02:37:11.532005  sshd[4251]: Failed password for invalid user ky from 145.239.227.21 port 51278 ssh2
2019-10-03T02:40:56.169656  sshd[4298]: Invalid user osvaldo from 145.239.227.21 port 34400
...

Sep 22 00:33:33 SilenceServices sshd[589]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=145.239.227.21
Sep 22 00:33:36 SilenceServices sshd[589]: Failed password for invalid user teste from 145.239.227.21 port 42708 ssh2
Sep 22 00:37:14 SilenceServices sshd[1586]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=145.239.227.21

Sep 17 05:11:18 hanapaa sshd\[13091\]: Invalid user recovery from 145.239.227.21
Sep 17 05:11:18 hanapaa sshd\[13091\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ip21.ip-145-239-227.eu
Sep 17 05:11:20 hanapaa sshd\[13091\]: Failed password for invalid user recovery from 145.239.227.21 port 48258 ssh2
Sep 17 05:15:36 hanapaa sshd\[13423\]: Invalid user ubnt from 145.239.227.21
Sep 17 05:15:36 hanapaa sshd\[13423\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ip21.ip-145-239-227.eu

Sep 17 01:34:01 aat-srv002 sshd[2316]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=145.239.227.21
Sep 17 01:34:02 aat-srv002 sshd[2316]: Failed password for invalid user password from 145.239.227.21 port 36462 ssh2
Sep 17 01:38:05 aat-srv002 sshd[2419]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=145.239.227.21
Sep 17 01:38:07 aat-srv002 sshd[2419]: Failed password for invalid user ionyszaa from 145.239.227.21 port 49454 ssh2
...

Sep 14 23:21:13 vtv3 sshd\[28935\]: Invalid user maxwell from 145.239.227.21 port 34480
Sep 14 23:21:13 vtv3 sshd\[28935\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=145.239.227.21
Sep 14 23:21:14 vtv3 sshd\[28935\]: Failed password for invalid user maxwell from 145.239.227.21 port 34480 ssh2
Sep 14 23:24:45 vtv3 sshd\[30537\]: Invalid user scaner from 145.239.227.21 port 48498
Sep 14 23:24:45 vtv3 sshd\[30537\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=145.239.227.21
Sep 14 23:36:04 vtv3 sshd\[4036\]: Invalid user tx from 145.239.227.21 port 34078
Sep 14 23:36:04 vtv3 sshd\[4036\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=145.239.227.21
Sep 14 23:36:06 vtv3 sshd\[4036\]: Failed password for invalid user tx from 145.239.227.21 port 34078 ssh2
Sep 14 23:39:57 vtv3 sshd\[5638\]: Invalid user bill from 145.239.227.21 port 48092
Sep 14 23:39:57 vtv3 sshd\[5638\]: pam

pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=145.239.227.21
Failed password for invalid user tomas from 145.239.227.21 port 41688 ssh2
Invalid user user123 from 145.239.227.21 port 56908
pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=145.239.227.21
Failed password for invalid user user123 from 145.239.227.21 port 56908 ssh2

Sep 12 19:43:37 nextcloud sshd\[23244\]: Invalid user temp from 145.239.227.21
Sep 12 19:43:37 nextcloud sshd\[23244\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=145.239.227.21
Sep 12 19:43:39 nextcloud sshd\[23244\]: Failed password for invalid user temp from 145.239.227.21 port 54314 ssh2
...

Sep 12 10:59:26 SilenceServices sshd[20424]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=145.239.227.21
Sep 12 10:59:28 SilenceServices sshd[20424]: Failed password for invalid user postgres from 145.239.227.21 port 57638 ssh2
Sep 12 11:05:12 SilenceServices sshd[22526]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=145.239.227.21

Sep 11 15:46:17 web9 sshd\[28610\]: Invalid user p@ssw0rd from 145.239.227.21
Sep 11 15:46:17 web9 sshd\[28610\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=145.239.227.21
Sep 11 15:46:19 web9 sshd\[28610\]: Failed password for invalid user p@ssw0rd from 145.239.227.21 port 60578 ssh2
Sep 11 15:52:06 web9 sshd\[29715\]: Invalid user 1q2w3e4r from 145.239.227.21
Sep 11 15:52:06 web9 sshd\[29715\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=145.239.227.21

SSH Brute Force, server-1 sshd[8339]: Failed password for invalid user webuser from 145.239.227.21 port 47614 ssh2

Sep  4 07:10:36 legacy sshd[9391]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=145.239.227.21
Sep  4 07:10:38 legacy sshd[9391]: Failed password for invalid user odoo from 145.239.227.21 port 48572 ssh2
Sep  4 07:15:08 legacy sshd[9470]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=145.239.227.21
...

Aug 15 20:39:46 XXX sshd[44620]: Invalid user rx from 145.239.227.21 port 40714

Automatic report - Banned IP Access

Jul 13 19:45:01 server sshd\[13099\]: Invalid user privoxy from 145.239.227.21
Jul 13 19:45:01 server sshd\[13099\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=145.239.227.21
Jul 13 19:45:03 server sshd\[13099\]: Failed password for invalid user privoxy from 145.239.227.21 port 42966 ssh2
...

Jul 26 14:08:50 OPSO sshd\[601\]: Invalid user axel from 145.239.227.21 port 43534
Jul 26 14:08:50 OPSO sshd\[601\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=145.239.227.21
Jul 26 14:08:51 OPSO sshd\[601\]: Failed password for invalid user axel from 145.239.227.21 port 43534 ssh2
Jul 26 14:14:25 OPSO sshd\[1879\]: Invalid user confluence from 145.239.227.21 port 39232
Jul 26 14:14:25 OPSO sshd\[1879\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=145.239.227.21

ssh default account attempted login

Lines containing failures of 24.212.13.95
Sep 10 19:23:22 mellenthin sshd[12496]: User r.r from 24.212.13.95 not allowed because not listed in AllowUsers
Sep 10 19:23:23 mellenthin sshd[12496]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=24.212.13.95  user=r.r
Sep 10 19:23:25 mellenthin sshd[12496]: Failed password for invalid user r.r from 24.212.13.95 port 59812 ssh2
Sep 10 19:23:25 mellenthin sshd[12496]: Connection closed by invalid user r.r 24.212.13.95 port 59812 [preauth]


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=24.212.13.95

Failed password for invalid user ubuntu from 222.175.223.74 port 33682 ssh2

(sshd) Failed SSH login from 82.64.32.76 (FR/France/82-64-32-76.subs.proxad.net): 5 in the last 3600 secs

Lines containing failures of 37.57.82.137 (max 1000)
Sep 10 15:54:16 UTC__SANYALnet-Labs__cac1 sshd[27968]: Connection from 37.57.82.137 port 44422 on 64.137.179.160 port 22
Sep 10 15:54:16 UTC__SANYALnet-Labs__cac1 sshd[27970]: Connection from 37.57.82.137 port 44616 on 64.137.179.160 port 22
Sep 10 15:54:19 UTC__SANYALnet-Labs__cac1 sshd[27970]: Address 37.57.82.137 maps to 137.82.57.37.triolan.net, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!
Sep 10 15:54:19 UTC__SANYALnet-Labs__cac1 sshd[27970]: User r.r from 37.57.82.137 not allowed because not listed in AllowUsers
Sep 10 15:54:19 UTC__SANYALnet-Labs__cac1 sshd[27970]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.57.82.137  user=r.r
Sep 10 15:54:21 UTC__SANYALnet-Labs__cac1 sshd[27970]: Failed password for invalid user r.r from 37.57.82.137 port 44616 ssh2
Sep 10 15:54:21 UTC__SANYALnet-Labs__cac1 sshd[27970]: Connection closed by 37.57.82.137 p........
------------------------------

Sep 11 14:31:50 vps647732 sshd[21835]: Failed password for root from 162.247.74.200 port 45136 ssh2
Sep 11 14:32:01 vps647732 sshd[21835]: error: maximum authentication attempts exceeded for root from 162.247.74.200 port 45136 ssh2 [preauth]
...

Sep 11 14:19:43  sshd\[20057\]: User root from 130.105.68.165 not allowed because not listed in AllowUsersSep 11 14:19:45  sshd\[20057\]: Failed password for invalid user root from 130.105.68.165 port 54456 ssh2
...

Invalid user ubuntu from 167.71.187.10 port 34328

Connection to SSH Honeypot - Detected by HoneypotDB

DATE:2020-09-10 18:55:23, IP:59.180.179.97, PORT:telnet Telnet brute force auth on honeypot server (honey-neo-dc)

Sep 11 22:47:49 web1 sshd[28980]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.180.29  user=root
Sep 11 22:47:51 web1 sshd[28980]: Failed password for root from 138.197.180.29 port 44968 ssh2
Sep 11 22:58:12 web1 sshd[770]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.180.29  user=root
Sep 11 22:58:14 web1 sshd[770]: Failed password for root from 138.197.180.29 port 46198 ssh2
Sep 11 23:02:58 web1 sshd[2781]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.180.29  user=root
Sep 11 23:03:00 web1 sshd[2781]: Failed password for root from 138.197.180.29 port 53050 ssh2
Sep 11 23:07:28 web1 sshd[4576]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.180.29  user=root
Sep 11 23:07:30 web1 sshd[4576]: Failed password for root from 138.197.180.29 port 59878 ssh2
Sep 11 23:11:43 web1 sshd[6482]: pam
...

Unauthorized connection attempt from IP address 178.159.127.5 on Port 445(SMB)

Sep 10 18:55:46 andromeda sshd\[5746\]: Invalid user nagios from 121.181.222.12 port 58770
Sep 10 18:55:47 andromeda sshd\[5746\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.181.222.12
Sep 10 18:55:48 andromeda sshd\[5746\]: Failed password for invalid user nagios from 121.181.222.12 port 58770 ssh2

Sep 11 16:55:11 web01.agentur-b-2.de dovecot: pop3-login: Aborted login (auth failed, 1 attempts in 2 secs): user=, method=PLAIN, rip=80.82.70.214, lip=185.118.198.210, session=
Sep 11 16:55:26 web01.agentur-b-2.de dovecot: pop3-login: Aborted login (auth failed, 1 attempts in 2 secs): user=, method=PLAIN, rip=80.82.70.214, lip=185.118.198.210, session=<9H/g3wqvOnRQUkbW>
Sep 11 16:56:22 web01.agentur-b-2.de dovecot: pop3-login: Aborted login (auth failed, 1 attempts in 2 secs): user=, method=PLAIN, rip=80.82.70.214, lip=185.118.198.210, session=
Sep 11 16:57:55 web01.agentur-b-2.de dovecot: pop3-login: Aborted login (auth failed, 1 attempts in 2 secs): user=, method=PLAIN, rip=80.82.70.214, lip=185.118.198.210, session=
Sep 11 16:58:25 web01.agentur-b-2.de dovecot: pop3-login: Aborted login (auth failed, 1 attempts in 2 secs): user=, m

srv02 DDoS Malware Target(80:http) ..

Cowrie Honeypot: Unauthorised SSH/Telnet login attempt with user "root" at 2020-09-11T13:56:01Z