2019-09-02T04:27:12.027736enmeeting.mahidol.ac.th sshd\[21876\]: Invalid user sergey from 149.202.204.141 port 51816
2019-09-02T04:27:12.047267enmeeting.mahidol.ac.th sshd\[21876\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=core00.0k.io
2019-09-02T04:27:14.244148enmeeting.mahidol.ac.th sshd\[21876\]: Failed password for invalid user sergey from 149.202.204.141 port 51816 ssh2
...

Aug 31 13:51:29 hiderm sshd\[4078\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=core00.0k.io  user=root
Aug 31 13:51:31 hiderm sshd\[4078\]: Failed password for root from 149.202.204.141 port 45364 ssh2
Aug 31 13:55:26 hiderm sshd\[4436\]: Invalid user sun from 149.202.204.141
Aug 31 13:55:26 hiderm sshd\[4436\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=core00.0k.io
Aug 31 13:55:29 hiderm sshd\[4436\]: Failed password for invalid user sun from 149.202.204.141 port 34142 ssh2

Aug 29 03:07:26 SilenceServices sshd[8460]: Failed password for root from 149.202.204.141 port 58398 ssh2
Aug 29 03:11:23 SilenceServices sshd[11579]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=149.202.204.141
Aug 29 03:11:25 SilenceServices sshd[11579]: Failed password for invalid user l from 149.202.204.141 port 48284 ssh2

Aug 28 08:43:01 lcprod sshd\[6862\]: Invalid user penis from 149.202.204.141
Aug 28 08:43:01 lcprod sshd\[6862\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=core00.0k.io
Aug 28 08:43:03 lcprod sshd\[6862\]: Failed password for invalid user penis from 149.202.204.141 port 37984 ssh2
Aug 28 08:46:57 lcprod sshd\[7204\]: Invalid user hp from 149.202.204.141
Aug 28 08:46:57 lcprod sshd\[7204\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=core00.0k.io

Aug 26 14:34:08 tdfoods sshd\[26438\]: Invalid user scanner from 149.202.204.141
Aug 26 14:34:08 tdfoods sshd\[26438\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=core00.0k.io
Aug 26 14:34:10 tdfoods sshd\[26438\]: Failed password for invalid user scanner from 149.202.204.141 port 50564 ssh2
Aug 26 14:38:17 tdfoods sshd\[26784\]: Invalid user vincintz from 149.202.204.141
Aug 26 14:38:17 tdfoods sshd\[26784\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=core00.0k.io

Aug 26 08:20:32 tdfoods sshd\[25031\]: Invalid user cgi from 149.202.204.141
Aug 26 08:20:32 tdfoods sshd\[25031\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=core00.0k.io
Aug 26 08:20:35 tdfoods sshd\[25031\]: Failed password for invalid user cgi from 149.202.204.141 port 49502 ssh2
Aug 26 08:25:56 tdfoods sshd\[25459\]: Invalid user exploit from 149.202.204.141
Aug 26 08:25:56 tdfoods sshd\[25459\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=core00.0k.io

Aug 17 22:54:37 vps65 sshd\[1466\]: Invalid user sandeep from 149.202.204.141 port 44140
Aug 17 22:54:37 vps65 sshd\[1466\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=149.202.204.141
...

Aug 16 07:01:18 php1 sshd\[16405\]: Invalid user netdump from 149.202.204.141
Aug 16 07:01:18 php1 sshd\[16405\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=149.202.204.141
Aug 16 07:01:20 php1 sshd\[16405\]: Failed password for invalid user netdump from 149.202.204.141 port 36112 ssh2
Aug 16 07:05:31 php1 sshd\[16750\]: Invalid user didba from 149.202.204.141
Aug 16 07:05:31 php1 sshd\[16750\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=149.202.204.141

[Aegis] @ 2019-08-11 08:43:10  0100 -> Attempted Administrator Privilege Gain: ET SCAN LibSSH Based Frequent SSH Connections Likely BruteForce Attack

Automatic report - Banned IP Access

Aug  6 03:12:44 localhost sshd\[125908\]: Invalid user ts3server from 149.202.204.141 port 50922
Aug  6 03:12:44 localhost sshd\[125908\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=149.202.204.141
Aug  6 03:12:46 localhost sshd\[125908\]: Failed password for invalid user ts3server from 149.202.204.141 port 50922 ssh2
Aug  6 03:16:50 localhost sshd\[126007\]: Invalid user sparc from 149.202.204.141 port 46430
Aug  6 03:16:50 localhost sshd\[126007\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=149.202.204.141
...

Aug  4 13:23:26 dedicated sshd[15722]: Invalid user os from 149.202.204.141 port 47050

Aug  2 19:14:45 raspberrypi sshd\[14590\]: Invalid user ana from 149.202.204.141Aug  2 19:14:47 raspberrypi sshd\[14590\]: Failed password for invalid user ana from 149.202.204.141 port 45726 ssh2Aug  2 19:21:34 raspberrypi sshd\[14752\]: Invalid user ad from 149.202.204.141
...

Jul 31 20:47:09 meumeu sshd[718]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=149.202.204.141 
Jul 31 20:47:11 meumeu sshd[718]: Failed password for invalid user ftpuser2 from 149.202.204.141 port 41870 ssh2
Jul 31 20:51:18 meumeu sshd[1250]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=149.202.204.141 
...

Jul 26 03:56:25 SilenceServices sshd[22055]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=149.202.204.141
Jul 26 03:56:26 SilenceServices sshd[22055]: Failed password for invalid user test1 from 149.202.204.141 port 56788 ssh2
Jul 26 04:00:42 SilenceServices sshd[27012]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=149.202.204.141

Invalid user user from 149.202.204.141 port 39464

Jun 29 15:10:24 amit sshd\[16334\]: Invalid user QCC from 149.202.204.141
Jun 29 15:10:24 amit sshd\[16334\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=149.202.204.141
Jun 29 15:10:26 amit sshd\[16334\]: Failed password for invalid user QCC from 149.202.204.141 port 57954 ssh2
...

Nov 23 17:47:01 lnxmysql61 sshd[20740]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=149.202.204.88

2019-11-20T22:44:43.675637hub.schaetter.us sshd\[30433\]: Invalid user pcap from 149.202.204.88 port 37518
2019-11-20T22:44:43.682775hub.schaetter.us sshd\[30433\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ns3029165.ip-149-202-204.eu
2019-11-20T22:44:46.099702hub.schaetter.us sshd\[30433\]: Failed password for invalid user pcap from 149.202.204.88 port 37518 ssh2
2019-11-20T22:47:55.624385hub.schaetter.us sshd\[30449\]: Invalid user shon from 149.202.204.88 port 45210
2019-11-20T22:47:55.632887hub.schaetter.us sshd\[30449\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ns3029165.ip-149-202-204.eu
...

ssh failed login

5x Failed Password

Invalid user erfurt from 149.202.204.88 port 42424

Invalid user com from 149.202.204.88 port 46430

Oct 12 21:13:52 icinga sshd[11305]: Failed password for root from 149.202.204.88 port 49866 ssh2
...

149.202.204.104 - - [12/Oct/2019:16:15:51 +0200] "GET /wp-login.php HTTP/1.1" 200 1122 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
149.202.204.104 - - [12/Oct/2019:16:15:51 +0200] "POST /wp-login.php HTTP/1.1" 200 1503 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
149.202.204.104 - - [12/Oct/2019:16:15:52 +0200] "GET /wp-login.php HTTP/1.1" 200 1122 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
149.202.204.104 - - [12/Oct/2019:16:15:52 +0200] "POST /wp-login.php HTTP/1.1" 200 1489 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
149.202.204.104 - - [12/Oct/2019:16:15:52 +0200] "GET /wp-login.php HTTP/1.1" 200 1122 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
149.202.204.104 - - [12/Oct/2019:16:15:53 +0200] "POST /wp-login.php HTTP/1.1" 200 1491 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
.

Automatic report generated by Wazuh

Sep 19 17:20:03 debian sshd\[30679\]: Invalid user b from 149.202.204.88 port 58450
Sep 19 17:20:03 debian sshd\[30679\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=149.202.204.88
Sep 19 17:20:06 debian sshd\[30679\]: Failed password for invalid user b from 149.202.204.88 port 58450 ssh2
...

Sep 17 07:25:05 game-panel sshd[26095]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=149.202.204.88
Sep 17 07:25:07 game-panel sshd[26095]: Failed password for invalid user james from 149.202.204.88 port 33242 ssh2
Sep 17 07:31:31 game-panel sshd[26272]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=149.202.204.88

Sep 15 04:53:43 fr01 sshd[24770]: Invalid user ftpproc from 149.202.204.88
Sep 15 04:53:43 fr01 sshd[24770]: Invalid user ftpproc from 149.202.204.88
Sep 15 04:53:43 fr01 sshd[24770]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=149.202.204.88
Sep 15 04:53:43 fr01 sshd[24770]: Invalid user ftpproc from 149.202.204.88
Sep 15 04:53:46 fr01 sshd[24770]: Failed password for invalid user ftpproc from 149.202.204.88 port 55544 ssh2
...

Apr 17 07:08:27 ns382633 sshd\[19411\]: Invalid user qu from 111.231.103.192 port 33618
Apr 17 07:08:27 ns382633 sshd\[19411\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.103.192
Apr 17 07:08:29 ns382633 sshd\[19411\]: Failed password for invalid user qu from 111.231.103.192 port 33618 ssh2
Apr 17 07:24:06 ns382633 sshd\[23065\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.103.192  user=root
Apr 17 07:24:08 ns382633 sshd\[23065\]: Failed password for root from 111.231.103.192 port 50582 ssh2

SSH authentication failure x 6 reported by Fail2Ban
...

Dovecot Invalid User Login Attempt.

Automatic report - Port Scan Attack

distributed sshd attacks

Apr 17 10:18:43 nginx sshd[45341]: Invalid user admin from 181.39.164.141
Apr 17 10:18:43 nginx sshd[45341]: Connection closed by 181.39.164.141 port 21000 [preauth]

Invalid user nagios from 51.91.76.175 port 43904

prod8
...

Apr 17 10:56:04 legacy sshd[18774]: Failed password for root from 112.85.42.176 port 17457 ssh2
Apr 17 10:56:07 legacy sshd[18774]: Failed password for root from 112.85.42.176 port 17457 ssh2
Apr 17 10:56:11 legacy sshd[18774]: Failed password for root from 112.85.42.176 port 17457 ssh2
Apr 17 10:56:17 legacy sshd[18774]: error: maximum authentication attempts exceeded for root from 112.85.42.176 port 17457 ssh2 [preauth]
...

(ftpd) Failed FTP login from 118.114.171.172 (CN/China/-): 10 in the last 3600 secs

port scan and connect, tcp 22 (ssh)

Apr 16 20:47:46 server6 sshd[28556]: reveeclipse mapping checking getaddrinfo for 45.32.51.54.vultr.com [45.32.51.54] failed - POSSIBLE BREAK-IN ATTEMPT!
Apr 16 20:47:48 server6 sshd[28556]: Failed password for invalid user ghostname_user from 45.32.51.54 port 35432 ssh2
Apr 16 20:47:48 server6 sshd[28556]: Received disconnect from 45.32.51.54: 11: Bye Bye [preauth]
Apr 16 21:01:16 server6 sshd[12428]: reveeclipse mapping checking getaddrinfo for 45.32.51.54.vultr.com [45.32.51.54] failed - POSSIBLE BREAK-IN ATTEMPT!
Apr 16 21:01:18 server6 sshd[12428]: Failed password for invalid user xm from 45.32.51.54 port 48320 ssh2
Apr 16 21:01:18 server6 sshd[12428]: Received disconnect from 45.32.51.54: 11: Bye Bye [preauth]
Apr 16 21:05:15 server6 sshd[17286]: reveeclipse mapping checking getaddrinfo for 45.32.51.54.vultr.com [45.32.51.54] failed - POSSIBLE BREAK-IN ATTEMPT!
Apr 16 21:05:17 server6 sshd[17286]: Failed password for invalid user pn from 45.32.51.54 port 60098 ssh........
-------------------------------

Apr 17 04:48:16 lanister sshd[32296]: Invalid user test from 106.12.45.32
Apr 17 04:48:16 lanister sshd[32296]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.45.32
Apr 17 04:48:16 lanister sshd[32296]: Invalid user test from 106.12.45.32
Apr 17 04:48:18 lanister sshd[32296]: Failed password for invalid user test from 106.12.45.32 port 58846 ssh2

Apr 17 10:55:36 [host] kernel: [3742892.671554] [U
Apr 17 10:56:13 [host] kernel: [3742929.818991] [U
Apr 17 10:59:21 [host] kernel: [3743117.220601] [U
Apr 17 11:04:02 [host] kernel: [3743398.022797] [U
Apr 17 11:05:26 [host] kernel: [3743481.932286] [U
Apr 17 11:05:27 [host] kernel: [3743483.061710] [U

2020-04-17 10:30:51,607 fail2ban.actions: WARNING [ssh] Ban 81.183.220.80