Invalid user HTTP from 154.8.167.48 port 42882

2020-03-17T12:48:36.651653dmca.cloudsearch.cf sshd[31212]: Invalid user daniel from 154.8.167.48 port 41838
2020-03-17T12:48:36.658109dmca.cloudsearch.cf sshd[31212]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=154.8.167.48
2020-03-17T12:48:36.651653dmca.cloudsearch.cf sshd[31212]: Invalid user daniel from 154.8.167.48 port 41838
2020-03-17T12:48:38.578628dmca.cloudsearch.cf sshd[31212]: Failed password for invalid user daniel from 154.8.167.48 port 41838 ssh2
2020-03-17T12:54:26.885001dmca.cloudsearch.cf sshd[31660]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=154.8.167.48  user=root
2020-03-17T12:54:28.188266dmca.cloudsearch.cf sshd[31660]: Failed password for root from 154.8.167.48 port 46956 ssh2
2020-03-17T12:57:11.197568dmca.cloudsearch.cf sshd[31914]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=154.8.167.48  user=root
2020-03-17T12:57:13.153035dmca.
...

Invalid user liaohaoran from 154.8.167.48 port 50834

Dec 10 07:13:08 woltan sshd[28290]: Failed password for invalid user web from 154.8.167.48 port 57154 ssh2

Feb 13 23:34:05 main sshd[12656]: Failed password for invalid user test1 from 154.8.167.48 port 40756 ssh2

Jan 27 13:48:10 ms-srv sshd[56895]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=154.8.167.48  user=root
Jan 27 13:48:12 ms-srv sshd[56895]: Failed password for invalid user root from 154.8.167.48 port 34794 ssh2

Dec 17 00:55:58 game-panel sshd[27636]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=154.8.167.48
Dec 17 00:56:00 game-panel sshd[27636]: Failed password for invalid user cimarron from 154.8.167.48 port 55350 ssh2
Dec 17 01:02:58 game-panel sshd[27977]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=154.8.167.48

fraudulent SSH attempt

2019-12-05T07:26:16.236357scmdmz1 sshd\[30284\]: Invalid user troy from 154.8.167.48 port 34438
2019-12-05T07:26:16.239173scmdmz1 sshd\[30284\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=154.8.167.48
2019-12-05T07:26:17.732487scmdmz1 sshd\[30284\]: Failed password for invalid user troy from 154.8.167.48 port 34438 ssh2
...

Dec  4 06:02:48 firewall sshd[23369]: Invalid user dawit from 154.8.167.48
Dec  4 06:02:50 firewall sshd[23369]: Failed password for invalid user dawit from 154.8.167.48 port 53038 ssh2
Dec  4 06:09:02 firewall sshd[23565]: Invalid user test from 154.8.167.48
...

Dec  3 23:46:23 markkoudstaal sshd[24054]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=154.8.167.48
Dec  3 23:46:25 markkoudstaal sshd[24054]: Failed password for invalid user brinks from 154.8.167.48 port 59826 ssh2
Dec  3 23:53:45 markkoudstaal sshd[24939]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=154.8.167.48

Nov  9 11:26:04 zulu412 sshd\[27517\]: Invalid user par0t from 154.8.167.48 port 58676
Nov  9 11:26:04 zulu412 sshd\[27517\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=154.8.167.48
Nov  9 11:26:05 zulu412 sshd\[27517\]: Failed password for invalid user par0t from 154.8.167.48 port 58676 ssh2
...

(sshd) Failed SSH login from 154.8.167.48 (CN/China/-): 3 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Oct 15 19:29:44 andromeda sshd[30634]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=154.8.167.48  user=root
Oct 15 19:29:46 andromeda sshd[30634]: Failed password for root from 154.8.167.48 port 39792 ssh2
Oct 15 19:51:20 andromeda sshd[575]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=154.8.167.48  user=root

Oct  4 06:53:10 www sshd\[227025\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=154.8.167.48  user=root
Oct  4 06:53:12 www sshd\[227025\]: Failed password for root from 154.8.167.48 port 54088 ssh2
Oct  4 06:58:05 www sshd\[227088\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=154.8.167.48  user=root
...

Sep 22 05:40:02 TORMINT sshd\[11372\]: Invalid user temptemp from 154.8.167.48
Sep 22 05:40:02 TORMINT sshd\[11372\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=154.8.167.48
Sep 22 05:40:05 TORMINT sshd\[11372\]: Failed password for invalid user temptemp from 154.8.167.48 port 39960 ssh2
...

2019-09-21T03:56:55.496376abusebot-3.cloudsearch.cf sshd\[30130\]: Invalid user centos from 154.8.167.48 port 60740

*Port Scan* detected from 154.8.167.48 (CN/China/-). 4 hits in the last 110 seconds

SSH invalid-user multiple login attempts

Aug 24 13:52:52 ip40 sshd[27886]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=154.8.167.100 
Aug 24 13:52:54 ip40 sshd[27886]: Failed password for invalid user test from 154.8.167.100 port 50206 ssh2
...

Lines containing failures of 154.8.167.100
Aug  9 18:55:23 penfold sshd[28228]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=154.8.167.100  user=r.r
Aug  9 18:55:25 penfold sshd[28228]: Failed password for r.r from 154.8.167.100 port 55082 ssh2
Aug  9 18:55:26 penfold sshd[28228]: Received disconnect from 154.8.167.100 port 55082:11: Bye Bye [preauth]
Aug  9 18:55:26 penfold sshd[28228]: Disconnected from authenticating user r.r 154.8.167.100 port 55082 [preauth]
Aug  9 19:14:09 penfold sshd[29720]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=154.8.167.100  user=r.r
Aug  9 19:14:11 penfold sshd[29720]: Failed password for r.r from 154.8.167.100 port 53284 ssh2
Aug  9 19:14:11 penfold sshd[29720]: Received disconnect from 154.8.167.100 port 53284:11: Bye Bye [preauth]
Aug  9 19:14:11 penfold sshd[29720]: Disconnected from authenticating user r.r 154.8.167.100 port 53284 [preauth]
Aug  9........
------------------------------

Jan 29 02:35:14 pi sshd[335]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=154.8.167.35 
Jan 29 02:35:16 pi sshd[335]: Failed password for invalid user praveena from 154.8.167.35 port 56646 ssh2

Feb 25 17:34:48 MK-Soft-VM8 sshd[14150]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=154.8.167.35 
Feb 25 17:34:49 MK-Soft-VM8 sshd[14150]: Failed password for invalid user impala from 154.8.167.35 port 58050 ssh2
...

Feb 25 13:22:02 jane sshd[15229]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=154.8.167.35 
Feb 25 13:22:04 jane sshd[15229]: Failed password for invalid user wildfly123 from 154.8.167.35 port 37838 ssh2
...

Jan 26 06:02:51 ms-srv sshd[13588]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=154.8.167.35
Jan 26 06:02:53 ms-srv sshd[13588]: Failed password for invalid user pi from 154.8.167.35 port 46410 ssh2

Jan 10 08:54:00 wbs sshd\[1171\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=154.8.167.35  user=root
Jan 10 08:54:01 wbs sshd\[1171\]: Failed password for root from 154.8.167.35 port 45678 ssh2
Jan 10 08:55:13 wbs sshd\[1319\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=154.8.167.35  user=root
Jan 10 08:55:14 wbs sshd\[1319\]: Failed password for root from 154.8.167.35 port 54462 ssh2
Jan 10 08:56:13 wbs sshd\[1408\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=154.8.167.35  user=root

[Aegis] @ 2019-12-30 09:23:59  0000 -> Attempted Administrator Privilege Gain: ET SCAN LibSSH Based Frequent SSH Connections Likely BruteForce Attack

2020-05-2922:47:041jeluB-0007Sk-IB\<=info@whatsup2013.chH=\(localhost\)[123.21.24.248]:53372P=esmtpsaX=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256CV=noA=dovecot_login:info@whatsup2013.chS=3025id=8c4d8b4e456ebb486b9563303befd67a59b34beaf0@whatsup2013.chT="tohamnerdahammer"forhamnerdahammer@gmail.comabayateye37@gmail.commcontey123@gmail.com2020-05-2922:46:401jeltm-0007Qy-As\<=info@whatsup2013.chH=\(localhost\)[14.162.2.215]:51991P=esmtpsaX=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256CV=noA=dovecot_login:info@whatsup2013.chS=2989id=805debb8b398b2ba26239539deaa809c1ff6c4@whatsup2013.chT="todlwolf48"fordlwolf48@gmail.comgosseyec@hotmail.frpeterbarron@yahoo.com2020-05-2922:46:171jeltR-0007OH-0b\<=info@whatsup2013.chH=\(localhost\)[111.224.52.145]:53261P=esmtpsaX=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256CV=noA=dovecot_login:info@whatsup2013.chS=3029id=2ea60ab8b3984dbe9d6395c6cd19208caf45674e0e@whatsup2013.chT="tokanebradley69"forkanebradley69@icloud.comsmonsta312@gmail.comjmanning3412@gmail.com2020-05-2922:49:251jelwT-0007a

(mod_security) mod_security (id:210730) triggered by 122.51.235.220 (CN/China/-): 5 in the last 3600 secs

Invalid user nagios from 194.204.194.11 port 40892

v+ssh-bruteforce

1103. On May 29 2020 experienced a Brute Force SSH login attempt -> 1 unique times by 51.91.8.222.

Invalid user bricriu from 107.132.88.42 port 56278

Lütfən yardım edin

May 29 18:04:53 ny01 sshd[9559]: Failed password for root from 119.31.126.100 port 47136 ssh2
May 29 18:08:47 ny01 sshd[10079]: Failed password for root from 119.31.126.100 port 51200 ssh2

SASL PLAIN auth failed: ruser=...

Port probing on unauthorized port 1433

Invalid user witherspoon from 146.66.244.246 port 44986

May 29 15:49:02 mailman postfix/smtpd[1859]: warning: unknown[106.7.251.145]: SASL PLAIN authentication failed: authentication failure

139.59.146.28 - - \[29/May/2020:22:49:25 +0200\] "POST /wp-login.php HTTP/1.0" 200 5674 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"
139.59.146.28 - - \[29/May/2020:22:49:26 +0200\] "POST /wp-login.php HTTP/1.0" 200 5644 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"
139.59.146.28 - - \[29/May/2020:22:49:27 +0200\] "POST /wp-login.php HTTP/1.0" 200 5676 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"

2020-05-29T22:45:50.593127struts4.enskede.local sshd\[15037\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.229.4.66  user=root
2020-05-29T22:45:54.461949struts4.enskede.local sshd\[15037\]: Failed password for root from 111.229.4.66 port 33866 ssh2
2020-05-29T22:49:30.640236struts4.enskede.local sshd\[15040\]: Invalid user MAIL from 111.229.4.66 port 43634
2020-05-29T22:49:30.648439struts4.enskede.local sshd\[15040\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.229.4.66
2020-05-29T22:49:33.320362struts4.enskede.local sshd\[15040\]: Failed password for invalid user MAIL from 111.229.4.66 port 43634 ssh2
...

Port scan: Attack repeated for 24 hours