Aug 31 14:26:33 ns382633 sshd\[9048\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.35.37.149  user=root
Aug 31 14:26:34 ns382633 sshd\[9048\]: Failed password for root from 161.35.37.149 port 41246 ssh2
Aug 31 14:31:38 ns382633 sshd\[9834\]: Invalid user nina from 161.35.37.149 port 41624
Aug 31 14:31:38 ns382633 sshd\[9834\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.35.37.149
Aug 31 14:31:39 ns382633 sshd\[9834\]: Failed password for invalid user nina from 161.35.37.149 port 41624 ssh2

*Port Scan* detected from 161.35.37.149 (GB/United Kingdom/England/London/-). 4 hits in the last 115 seconds

Aug 28 14:09:53 santamaria sshd\[12919\]: Invalid user emerson from 161.35.37.149
Aug 28 14:09:53 santamaria sshd\[12919\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.35.37.149
Aug 28 14:09:55 santamaria sshd\[12919\]: Failed password for invalid user emerson from 161.35.37.149 port 38466 ssh2
...

[N10.H2.VM2] Port Scanner Detected Blocked by UFW

Aug 26 08:46:43 pve1 sshd[2605]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.35.37.149 
Aug 26 08:46:45 pve1 sshd[2605]: Failed password for invalid user dzh from 161.35.37.149 port 47496 ssh2
...

Aug 16 01:27:20 NPSTNNYC01T sshd[25534]: Failed password for root from 161.35.37.149 port 50398 ssh2
Aug 16 01:30:39 NPSTNNYC01T sshd[25694]: Failed password for root from 161.35.37.149 port 40242 ssh2
...

srv02 Mass scanning activity detected Target: 26985  ..

Aug  7 08:40:00 santamaria sshd\[14589\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.35.37.149  user=root
Aug  7 08:40:01 santamaria sshd\[14589\]: Failed password for root from 161.35.37.149 port 53544 ssh2
Aug  7 08:44:37 santamaria sshd\[14631\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.35.37.149  user=root
...

firewall-block, port(s): 31420/tcp

Invalid user demouser from 161.35.37.149 port 50250

SSH bruteforce

2020-07-06T16:37:46.413848na-vps210223 sshd[19595]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.35.37.149  user=root
2020-07-06T16:37:48.394919na-vps210223 sshd[19595]: Failed password for root from 161.35.37.149 port 44672 ssh2
2020-07-06T16:41:05.920898na-vps210223 sshd[28707]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.35.37.149  user=root
2020-07-06T16:41:08.553546na-vps210223 sshd[28707]: Failed password for root from 161.35.37.149 port 41678 ssh2
2020-07-06T16:44:17.726621na-vps210223 sshd[5050]: Invalid user admin from 161.35.37.149 port 38682
...

Jun 30 21:02:58 PorscheCustomer sshd[19372]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.35.37.149
Jun 30 21:03:00 PorscheCustomer sshd[19372]: Failed password for invalid user rafal from 161.35.37.149 port 59332 ssh2
Jun 30 21:06:32 PorscheCustomer sshd[19539]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.35.37.149
...

Unauthorized connection attempt detected from IP address 161.35.37.149 to port 8364

Jun 16 20:47:33 pbkit sshd[59140]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.35.37.149 
Jun 16 20:47:33 pbkit sshd[59140]: Invalid user teamspeak from 161.35.37.149 port 48468
Jun 16 20:47:35 pbkit sshd[59140]: Failed password for invalid user teamspeak from 161.35.37.149 port 48468 ssh2
...

Jun 16 04:54:43 ip-172-31-61-156 sshd[17267]: Invalid user admin from 161.35.37.149
Jun 16 04:54:45 ip-172-31-61-156 sshd[17267]: Failed password for invalid user admin from 161.35.37.149 port 48314 ssh2
Jun 16 04:54:43 ip-172-31-61-156 sshd[17267]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.35.37.149
Jun 16 04:54:43 ip-172-31-61-156 sshd[17267]: Invalid user admin from 161.35.37.149
Jun 16 04:54:45 ip-172-31-61-156 sshd[17267]: Failed password for invalid user admin from 161.35.37.149 port 48314 ssh2
...

Invalid user git from 161.35.37.149 port 42002

May 27 12:59:18 server sshd[13065]: Failed password for root from 161.35.37.149 port 53286 ssh2
May 27 13:03:05 server sshd[16857]: Failed password for root from 161.35.37.149 port 60522 ssh2
May 27 13:06:57 server sshd[20927]: Failed password for root from 161.35.37.149 port 39526 ssh2

Sep 26 21:39:22 ip-172-31-16-56 sshd\[13158\]: Invalid user user1 from 161.35.37.241\
Sep 26 21:39:24 ip-172-31-16-56 sshd\[13158\]: Failed password for invalid user user1 from 161.35.37.241 port 49546 ssh2\
Sep 26 21:43:20 ip-172-31-16-56 sshd\[13196\]: Invalid user oscar from 161.35.37.241\
Sep 26 21:43:22 ip-172-31-16-56 sshd\[13196\]: Failed password for invalid user oscar from 161.35.37.241 port 35110 ssh2\
Sep 26 21:47:15 ip-172-31-16-56 sshd\[13265\]: Invalid user cristina from 161.35.37.241\

Sep 26 21:39:22 ip-172-31-16-56 sshd\[13158\]: Invalid user user1 from 161.35.37.241\
Sep 26 21:39:24 ip-172-31-16-56 sshd\[13158\]: Failed password for invalid user user1 from 161.35.37.241 port 49546 ssh2\
Sep 26 21:43:20 ip-172-31-16-56 sshd\[13196\]: Invalid user oscar from 161.35.37.241\
Sep 26 21:43:22 ip-172-31-16-56 sshd\[13196\]: Failed password for invalid user oscar from 161.35.37.241 port 35110 ssh2\
Sep 26 21:47:15 ip-172-31-16-56 sshd\[13265\]: Invalid user cristina from 161.35.37.241\

Sep 26 21:39:22 ip-172-31-16-56 sshd\[13158\]: Invalid user user1 from 161.35.37.241\
Sep 26 21:39:24 ip-172-31-16-56 sshd\[13158\]: Failed password for invalid user user1 from 161.35.37.241 port 49546 ssh2\
Sep 26 21:43:20 ip-172-31-16-56 sshd\[13196\]: Invalid user oscar from 161.35.37.241\
Sep 26 21:43:22 ip-172-31-16-56 sshd\[13196\]: Failed password for invalid user oscar from 161.35.37.241 port 35110 ssh2\
Sep 26 21:47:15 ip-172-31-16-56 sshd\[13265\]: Invalid user cristina from 161.35.37.241\

2020-09-24 UTC: (30x) - admin,bash,beatriz,bso,dcadmin,external,git,huawei,mohammad,myftp,rafael,root(6x),sdtdserver,sergio,slurm,stream,student9,sysadmin,tele,test,testuser,ts3,uno8,vyatta,xu

2020-09-24 UTC: (30x) - admin,bash,beatriz,bso,dcadmin,external,git,huawei,mohammad,myftp,rafael,root(6x),sdtdserver,sergio,slurm,stream,student9,sysadmin,tele,test,testuser,ts3,uno8,vyatta,xu

Sep 24 11:37:22 php1 sshd\[19263\]: Invalid user alex from 161.35.37.64
Sep 24 11:37:22 php1 sshd\[19263\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.35.37.64
Sep 24 11:37:24 php1 sshd\[19263\]: Failed password for invalid user alex from 161.35.37.64 port 45348 ssh2
Sep 24 11:41:21 php1 sshd\[19927\]: Invalid user ftproot from 161.35.37.64
Sep 24 11:41:21 php1 sshd\[19927\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.35.37.64

Invalid user parsa from 161.35.37.0 port 23529

04/16/2020-00:37:50.901429 113.170.118.93 Protocol: 6 ET SCAN Suspicious inbound to MSSQL port 1433

...

Apr  3 15:39:31 server sshd[19494]: Failed password for r.r from 196.1.97.216 port 34854 ssh2
Apr  3 15:39:31 server sshd[19486]: Failed password for r.r from 178.165.72.177 port 33278 ssh2
Apr 16 03:09:19 server sshd[29747]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=em3-3-15-39-31.us-east-2.compute.amazonaws.com
Apr 16 03:09:21 server sshd[29747]: Failed password for invalid user backuper from 3.15.39.31 port 56582 ssh2
Apr 16 03:09:21 server sshd[29747]: Received disconnect from 3.15.39.31: 11: Bye Bye [preauth]
Apr 16 03:23:06 server sshd[29985]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=em3-3-15-39-31.us-east-2.compute.amazonaws.com
Apr 16 03:23:08 server sshd[29985]: Failed password for invalid user dev from 3.15.39.31 port 49344 ssh2
Apr 16 03:23:08 server sshd[29985]: Received disconnect from 3.15.39.31: 11: Bye Bye [preauth]
Apr 16 03:27:36 server sshd[30062]: pam_unix(ss........
-------------------------------

" "

(ftpd) Failed FTP login from 111.226.232.233 (CN/China/-): 10 in the last 3600 secs

Telnet/23 MH Probe, Scan, BF, Hack -

port scan and connect, tcp 22 (ssh)

Apr 16 07:34:18 vps46666688 sshd[13026]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.67.101.203
Apr 16 07:34:20 vps46666688 sshd[13026]: Failed password for invalid user hadoopuser from 114.67.101.203 port 35334 ssh2
...

Attempted connection to port 50060.

23/tcp
[2020-04-16]1pkt

DATE:2020-04-16 05:47:59, IP:218.201.222.25, PORT:1433 MSSQL brute force auth on honeypot server (honey-neo-dc)

Apr 16 12:31:43 vmanager6029 sshd\[30818\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.198  user=root
Apr 16 12:31:45 vmanager6029 sshd\[30816\]: error: PAM: Authentication failure for root from 218.92.0.198
Apr 16 12:31:46 vmanager6029 sshd\[30831\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.198  user=root

Apr 16 12:17:33 minden010 postfix/smtpd[22186]: NOQUEUE: reject: RCPT from p548DF6A6.dip0.t-ipconnect.de[84.141.246.166]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Apr 16 12:17:33 minden010 postfix/smtpd[26673]: NOQUEUE: reject: RCPT from p548DF6A6.dip0.t-ipconnect.de[84.141.246.166]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Apr 16 12:17:34 minden010 postfix/smtpd[26671]: NOQUEUE: reject: RCPT from p548DF6A6.dip0.t-ipconnect.de[84.141.246.166]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Apr 16 12:17:34 minden010 postfix/smtpd[26671]: NOQUEUE: reject: RCPT from p548DF6A6.dip0.t-ipconnect.de[84.141.246.166]: 450 4.7.1 : He
...

Apr 16 12:41:34 ns382633 sshd\[5402\]: Invalid user nu from 159.65.154.48 port 57364
Apr 16 12:41:34 ns382633 sshd\[5402\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.65.154.48
Apr 16 12:41:36 ns382633 sshd\[5402\]: Failed password for invalid user nu from 159.65.154.48 port 57364 ssh2
Apr 16 12:56:42 ns382633 sshd\[9591\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.65.154.48  user=root
Apr 16 12:56:44 ns382633 sshd\[9591\]: Failed password for root from 159.65.154.48 port 34326 ssh2

2020-04-16T10:51:50.521435abusebot-3.cloudsearch.cf sshd[9030]: Invalid user ib from 212.100.155.154 port 52982
2020-04-16T10:51:50.527796abusebot-3.cloudsearch.cf sshd[9030]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.100.155.154
2020-04-16T10:51:50.521435abusebot-3.cloudsearch.cf sshd[9030]: Invalid user ib from 212.100.155.154 port 52982
2020-04-16T10:51:52.437418abusebot-3.cloudsearch.cf sshd[9030]: Failed password for invalid user ib from 212.100.155.154 port 52982 ssh2
2020-04-16T10:55:36.795726abusebot-3.cloudsearch.cf sshd[9585]: Invalid user wx from 212.100.155.154 port 32780
2020-04-16T10:55:36.801262abusebot-3.cloudsearch.cf sshd[9585]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.100.155.154
2020-04-16T10:55:36.795726abusebot-3.cloudsearch.cf sshd[9585]: Invalid user wx from 212.100.155.154 port 32780
2020-04-16T10:55:38.404596abusebot-3.cloudsearch.cf sshd[9585]: Failed password
...