Invalid user zhy from 159.138.65.35 port 34118

Invalid user huqm from 159.138.65.35 port 59816

Jul  7 05:34:44 nas sshd[1921]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.138.65.35 
Jul  7 05:34:47 nas sshd[1921]: Failed password for invalid user sdv from 159.138.65.35 port 49036 ssh2
Jul  7 05:47:30 nas sshd[2557]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.138.65.35  user=admin
...

leo_www

$f2bV_matches

SSH/22 MH Probe, BF, Hack -

Apr 21 20:02:00 vps sshd[245298]: Failed password for invalid user vo from 159.138.65.35 port 35408 ssh2
Apr 21 20:06:36 vps sshd[269502]: Invalid user admin from 159.138.65.35 port 51612
Apr 21 20:06:36 vps sshd[269502]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.138.65.35
Apr 21 20:06:38 vps sshd[269502]: Failed password for invalid user admin from 159.138.65.35 port 51612 ssh2
Apr 21 20:11:13 vps sshd[295147]: Invalid user microsoft from 159.138.65.35 port 39582
...

Apr 21 06:04:33 v22018086721571380 sshd[1424]: Failed password for invalid user mw from 159.138.65.35 port 39106 ssh2
Apr 21 07:07:21 v22018086721571380 sshd[23934]: Failed password for invalid user lt from 159.138.65.35 port 38504 ssh2

Invalid user uucp from 159.138.65.35 port 37788

Apr 17 10:51:13 web8 sshd\[8246\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.138.65.35  user=root
Apr 17 10:51:16 web8 sshd\[8246\]: Failed password for root from 159.138.65.35 port 42922 ssh2
Apr 17 10:55:05 web8 sshd\[10354\]: Invalid user admin from 159.138.65.35
Apr 17 10:55:05 web8 sshd\[10354\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.138.65.35
Apr 17 10:55:07 web8 sshd\[10354\]: Failed password for invalid user admin from 159.138.65.35 port 56502 ssh2

fail2ban

firewall-block, port(s): 19517/tcp

2020-06-22T21:31:29.486629mail.standpoint.com.ua sshd[23482]: Invalid user beatriz from 159.138.65.107 port 47182
2020-06-22T21:31:29.489542mail.standpoint.com.ua sshd[23482]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.138.65.107
2020-06-22T21:31:29.486629mail.standpoint.com.ua sshd[23482]: Invalid user beatriz from 159.138.65.107 port 47182
2020-06-22T21:31:31.267311mail.standpoint.com.ua sshd[23482]: Failed password for invalid user beatriz from 159.138.65.107 port 47182 ssh2
2020-06-22T21:36:36.073921mail.standpoint.com.ua sshd[24197]: Invalid user esteban from 159.138.65.107 port 38720
...

SSH invalid-user multiple login try

Jun 22 04:19:01 web1 sshd[22447]: Invalid user mapr from 159.138.65.107 port 54088
Jun 22 04:19:01 web1 sshd[22447]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.138.65.107
Jun 22 04:19:01 web1 sshd[22447]: Invalid user mapr from 159.138.65.107 port 54088
Jun 22 04:19:03 web1 sshd[22447]: Failed password for invalid user mapr from 159.138.65.107 port 54088 ssh2
Jun 22 04:23:19 web1 sshd[23822]: Invalid user bot from 159.138.65.107 port 46882
Jun 22 04:23:19 web1 sshd[23822]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.138.65.107
Jun 22 04:23:19 web1 sshd[23822]: Invalid user bot from 159.138.65.107 port 46882
Jun 22 04:23:22 web1 sshd[23822]: Failed password for invalid user bot from 159.138.65.107 port 46882 ssh2
Jun 22 04:24:40 web1 sshd[24121]: Invalid user user1 from 159.138.65.107 port 40850
...

Jun 14 10:55:53 xeon sshd[11352]: Failed password for invalid user Sointu from 159.138.65.33 port 51200 ssh2

Jun 13 15:39:36 lnxmysql61 sshd[1227]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.138.65.33

$f2bV_matches

Jun  8 02:38:14 mailserver sshd[8739]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.138.65.107  user=r.r
Jun  8 02:38:17 mailserver sshd[8739]: Failed password for r.r from 159.138.65.107 port 51062 ssh2
Jun  8 02:38:17 mailserver sshd[8739]: Received disconnect from 159.138.65.107 port 51062:11: Bye Bye [preauth]
Jun  8 02:38:17 mailserver sshd[8739]: Disconnected from 159.138.65.107 port 51062 [preauth]
Jun  8 02:42:21 mailserver sshd[9235]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.138.65.107  user=r.r
Jun  8 02:42:24 mailserver sshd[9235]: Failed password for r.r from 159.138.65.107 port 57232 ssh2
Jun  8 02:42:24 mailserver sshd[9235]: Received disconnect from 159.138.65.107 port 57232:11: Bye Bye [preauth]
Jun  8 02:42:24 mailserver sshd[9235]: Disconnected from 159.138.65.107 port 57232 [preauth]


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=159.138.65.1

Jun  2 02:20:20 web9 sshd\[24582\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.138.65.33  user=root
Jun  2 02:20:23 web9 sshd\[24582\]: Failed password for root from 159.138.65.33 port 44506 ssh2
Jun  2 02:23:19 web9 sshd\[24911\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.138.65.33  user=root
Jun  2 02:23:21 web9 sshd\[24911\]: Failed password for root from 159.138.65.33 port 39862 ssh2
Jun  2 02:26:18 web9 sshd\[25259\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.138.65.33  user=root

Jun  1 15:00:50 scw-6657dc sshd[542]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.138.65.33  user=root
Jun  1 15:00:50 scw-6657dc sshd[542]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.138.65.33  user=root
Jun  1 15:00:52 scw-6657dc sshd[542]: Failed password for root from 159.138.65.33 port 36488 ssh2
...

May 15 18:24:32 nextcloud sshd\[24394\]: Invalid user xnc from 159.138.65.33
May 15 18:24:32 nextcloud sshd\[24394\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.138.65.33
May 15 18:24:34 nextcloud sshd\[24394\]: Failed password for invalid user xnc from 159.138.65.33 port 53624 ssh2

May 15 07:31:30 ny01 sshd[20425]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.138.65.33
May 15 07:31:32 ny01 sshd[20425]: Failed password for invalid user oracle from 159.138.65.33 port 38492 ssh2
May 15 07:34:39 ny01 sshd[20826]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.138.65.33

May 10 18:52:49 ws22vmsma01 sshd[40280]: Failed password for root from 159.138.65.33 port 34600 ssh2
...

May 10 00:29:57 [host] sshd[6971]: Invalid user lu
May 10 00:29:57 [host] sshd[6971]: pam_unix(sshd:a
May 10 00:29:59 [host] sshd[6971]: Failed password

May  8 06:35:11 OPSO sshd\[1715\]: Invalid user gs from 159.138.65.33 port 50356
May  8 06:35:11 OPSO sshd\[1715\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.138.65.33
May  8 06:35:14 OPSO sshd\[1715\]: Failed password for invalid user gs from 159.138.65.33 port 50356 ssh2
May  8 06:37:51 OPSO sshd\[2153\]: Invalid user carmel from 159.138.65.33 port 36016
May  8 06:37:51 OPSO sshd\[2153\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.138.65.33

SSH Brute-Force reported by Fail2Ban

mail.log:Jul 31 08:10:17 mail postfix/smtpd[27098]: warning: unknown[159.192.204.242]: SASL PLAIN authentication failed: authentication failure

Unauthorized connection attempt from IP address 91.76.24.169 on Port 445(SMB)

Unauthorized connection attempt from IP address 12.38.141.131 on Port 445(SMB)

Brute force attempt

Jul 31 12:08:11 piServer sshd\[25047\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.85.42.237  user=root
Jul 31 12:08:13 piServer sshd\[25047\]: Failed password for root from 112.85.42.237 port 49630 ssh2
Jul 31 12:08:15 piServer sshd\[25047\]: Failed password for root from 112.85.42.237 port 49630 ssh2
Jul 31 12:08:17 piServer sshd\[25047\]: Failed password for root from 112.85.42.237 port 49630 ssh2
Jul 31 12:10:54 piServer sshd\[25281\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.85.42.237  user=root
...

31.07.2019 08:48:23 HTTP access blocked by firewall

Jul 31 11:53:36 OPSO sshd\[22198\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.219.3.139  user=root
Jul 31 11:53:39 OPSO sshd\[22198\]: Failed password for root from 46.219.3.139 port 60382 ssh2
Jul 31 11:58:31 OPSO sshd\[22649\]: Invalid user ftptest from 46.219.3.139 port 54460
Jul 31 11:58:31 OPSO sshd\[22649\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.219.3.139
Jul 31 11:58:32 OPSO sshd\[22649\]: Failed password for invalid user ftptest from 46.219.3.139 port 54460 ssh2

2019-07-31 03:08:09 H=(185.101.238.13.tarinnet.info) [185.101.238.13]:44021 I=[192.147.25.65]:25 F= rejected RCPT : RBL: found in thrukfz5b56tq6xao6odgdyjrq.zen.dq.spamhaus.net (127.0.0.4, 127.0.0.11, 127.0.0.3) (https://www.spamhaus.org/query/ip/185.101.238.13)
2019-07-31 03:08:10 H=(185.101.238.13.tarinnet.info) [185.101.238.13]:44021 I=[192.147.25.65]:25 F= rejected RCPT : RBL: found in thrukfz5b56tq6xao6odgdyjrq.zen.dq.spamhaus.net (127.0.0.3, 127.0.0.4, 127.0.0.11) (https://www.spamhaus.org/query/ip/185.101.238.13)
2019-07-31 03:08:11 H=(185.101.238.13.tarinnet.info) [185.101.238.13]:44021 I=[192.147.25.65]:25 F= rejected RCPT : RBL: found in thrukfz5b56tq6xao6odgdyjrq.zen.dq.spamhaus.net (127.0.0.4, 127.0.0.11, 127.0.0.3) (https://www.spamhaus.org/sbl/query/SBLCSS)
...

2019-07-31 03:08:52 H=onlineppk01.serviceinfosrj.net [5.53.124.199]:40414 I=[192.147.25.65]:25 sender verify fail for : all relevant MX records point to non-existent hosts
2019-07-31 03:08:52 H=onlineppk01.serviceinfosrj.net [5.53.124.199]:40414 I=[192.147.25.65]:25 F= rejected RCPT : Sender verify failed
2019-07-31 03:08:53 H=onlineppk01.serviceinfosrj.net [5.53.124.199]:40888 I=[192.147.25.65]:25 sender verify fail for : all relevant MX records point to non-existent hosts
2019-07-31 03:08:53 H=onlineppk01.serviceinfosrj.net [5.53.124.199]:40888 I=[192.147.25.65]:25 F= rejected RCPT : Sender verify failed
...

Jul 31 12:03:00 localhost sshd\[49920\]: Invalid user maryl from 54.39.107.119 port 58538
Jul 31 12:03:00 localhost sshd\[49920\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.39.107.119
...

Jul 31 12:31:32 SilenceServices sshd[23671]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.187.6.235
Jul 31 12:31:34 SilenceServices sshd[23671]: Failed password for invalid user tsbot from 37.187.6.235 port 53536 ssh2
Jul 31 12:36:26 SilenceServices sshd[27631]: Failed password for root from 37.187.6.235 port 49056 ssh2

20 attempts against mh-ssh on pluto.magehost.pro

" "

Unauthorized connection attempt from IP address 117.34.87.54 on Port 445(SMB)