05/01/2020-10:12:23.039316 162.243.136.230 Protocol: 6 ET COMPROMISED Known Compromised or Hostile Host Traffic group 12

trying to access non-authorized port

Jul  5 15:56:07 server sshd\[199796\]: Invalid user wendel from 162.243.136.230
Jul  5 15:56:07 server sshd\[199796\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.243.136.230
Jul  5 15:56:09 server sshd\[199796\]: Failed password for invalid user wendel from 162.243.136.230 port 56066 ssh2
...

Sep 27 18:12:54 apollo sshd\[9603\]: Invalid user ods from 162.243.136.230Sep 27 18:12:57 apollo sshd\[9603\]: Failed password for invalid user ods from 162.243.136.230 port 43994 ssh2Sep 27 18:22:34 apollo sshd\[9642\]: Invalid user nicole from 162.243.136.230
...

Sep 25 08:38:17 vps691689 sshd[19396]: Failed password for root from 162.243.136.230 port 55744 ssh2
Sep 25 08:43:40 vps691689 sshd[19451]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.243.136.230
...

Sep 22 23:26:47 vps647732 sshd[18364]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.243.136.230
Sep 22 23:26:49 vps647732 sshd[18364]: Failed password for invalid user temp from 162.243.136.230 port 45446 ssh2
...

2019-08-31T07:03:46.621756wiz-ks3 sshd[30264]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.243.136.230  user=root
2019-08-31T07:03:48.906485wiz-ks3 sshd[30264]: Failed password for root from 162.243.136.230 port 56988 ssh2
2019-08-31T07:08:54.353002wiz-ks3 sshd[30275]: Invalid user admin from 162.243.136.230 port 44068
2019-08-31T07:08:54.355076wiz-ks3 sshd[30275]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.243.136.230
2019-08-31T07:08:54.353002wiz-ks3 sshd[30275]: Invalid user admin from 162.243.136.230 port 44068
2019-08-31T07:08:55.922254wiz-ks3 sshd[30275]: Failed password for invalid user admin from 162.243.136.230 port 44068 ssh2
2019-08-31T07:14:37.996942wiz-ks3 sshd[30291]: Invalid user help from 162.243.136.230 port 59362
2019-08-31T07:14:37.999018wiz-ks3 sshd[30291]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.243.136.230
2019-08-31T07:14:37.996942wiz-ks3 s

Sep  8 01:49:53 vps691689 sshd[20037]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.243.136.230
Sep  8 01:49:55 vps691689 sshd[20037]: Failed password for invalid user 1234 from 162.243.136.230 port 41746 ssh2
...

Sep  4 09:26:16 tdfoods sshd\[23486\]: Invalid user rostami from 162.243.136.230
Sep  4 09:26:16 tdfoods sshd\[23486\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.243.136.230
Sep  4 09:26:18 tdfoods sshd\[23486\]: Failed password for invalid user rostami from 162.243.136.230 port 37394 ssh2
Sep  4 09:32:01 tdfoods sshd\[23914\]: Invalid user admin from 162.243.136.230
Sep  4 09:32:01 tdfoods sshd\[23914\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.243.136.230

Aug 31 04:33:40 www sshd\[13490\]: Failed password for root from 162.243.136.230 port 35206 ssh2Aug 31 04:39:19 www sshd\[13560\]: Invalid user admin from 162.243.136.230Aug 31 04:39:21 www sshd\[13560\]: Failed password for invalid user admin from 162.243.136.230 port 50506 ssh2
...

T: f2b ssh aggressive 3x

2019-08-29T05:10:50.532223abusebot.cloudsearch.cf sshd\[28546\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.243.136.230  user=root

SSH 15 Failed Logins

leo_www

2019-08-14T04:18:26.672167stark.klein-stark.info sshd\[6209\]: Invalid user applmgr from 162.243.136.230 port 45544
2019-08-14T04:18:26.676177stark.klein-stark.info sshd\[6209\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.243.136.230
2019-08-14T04:18:28.794717stark.klein-stark.info sshd\[6209\]: Failed password for invalid user applmgr from 162.243.136.230 port 45544 ssh2
...

Aug 11 07:46:50 MK-Soft-VM5 sshd\[23285\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.243.136.230  user=root
Aug 11 07:46:53 MK-Soft-VM5 sshd\[23285\]: Failed password for root from 162.243.136.230 port 59302 ssh2
Aug 11 07:52:28 MK-Soft-VM5 sshd\[23308\]: Invalid user cible from 162.243.136.230 port 43306
...

Jul 28 00:20:26 rpi sshd[28512]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.243.136.230 
Jul 28 00:20:28 rpi sshd[28512]: Failed password for invalid user mysql from 162.243.136.230 port 43752 ssh2

Invalid user www from 162.243.136.230 port 50920

Invalid user www from 162.243.136.230 port 50920

Jul 16 14:33:02 XXX sshd[37137]: Invalid user shania from 162.243.136.230 port 48532

Invalid user thomas from 162.243.136.230 port 48258
pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.243.136.230
Failed password for invalid user thomas from 162.243.136.230 port 48258 ssh2
Invalid user testbed from 162.243.136.230 port 33910
pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.243.136.230

Invalid user long from 162.243.136.230 port 60804
pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.243.136.230
Failed password for invalid user long from 162.243.136.230 port 60804 ssh2
Invalid user secure from 162.243.136.230 port 45088
pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.243.136.230

Invalid user sylvia from 162.243.136.230 port 48490

Invalid user rodriguez from 162.243.136.230 port 34232

Invalid user ts from 162.243.136.230 port 51442

Jul  5 20:11:10 mail sshd\[32639\]: Invalid user ftpadmin from 162.243.136.230
Jul  5 20:11:10 mail sshd\[32639\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.243.136.230
Jul  5 20:11:12 mail sshd\[32639\]: Failed password for invalid user ftpadmin from 162.243.136.230 port 55460 ssh2
...

Jul  4 13:15:18 MK-Soft-VM7 sshd\[26512\]: Invalid user alin from 162.243.136.230 port 47846
Jul  4 13:15:18 MK-Soft-VM7 sshd\[26512\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.243.136.230
Jul  4 13:15:20 MK-Soft-VM7 sshd\[26512\]: Failed password for invalid user alin from 162.243.136.230 port 47846 ssh2
...

Jul  1 20:18:55 ArkNodeAT sshd\[14118\]: Invalid user pospoint from 162.243.136.230
Jul  1 20:18:55 ArkNodeAT sshd\[14118\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.243.136.230
Jul  1 20:18:57 ArkNodeAT sshd\[14118\]: Failed password for invalid user pospoint from 162.243.136.230 port 58720 ssh2

2019-06-30T12:35:14.315635abusebot-5.cloudsearch.cf sshd\[19864\]: Invalid user www from 162.243.136.230 port 42960

[Wed Jun 10 05:55:45 2020] - DDoS Attack From IP: 162.243.136.186 Port: 40597

[Sun May 31 02:48:40 2020] - DDoS Attack From IP: 162.243.136.60 Port: 49864

scans 2 times in preceeding hours on the ports (in chronological order) 4545 60001 resulting in total of 51 scans from 162.243.0.0/16 block.

3011/tcp 7547/tcp 502/tcp...
[2020-05-05/06-21]31pkt,27pt.(tcp),1pt.(udp)

scans once in preceeding hours on the ports (in chronological order) 1931 resulting in total of 51 scans from 162.243.0.0/16 block.

scans once in preceeding hours on the ports (in chronological order) 3011 resulting in total of 51 scans from 162.243.0.0/16 block.

1720/tcp 8005/tcp 7777/tcp...
[2020-04-29/06-21]42pkt,34pt.(tcp),2pt.(udp)

2000/tcp 646/tcp 10880/tcp...
[2020-04-30/06-21]57pkt,46pt.(tcp),4pt.(udp)

scans once in preceeding hours on the ports (in chronological order) 33930 resulting in total of 51 scans from 162.243.0.0/16 block.

firewall-block, port(s): 50070/tcp

RDP brute force attack detected by fail2ban

9001/tcp 47808/tcp 5984/tcp...
[2020-05-03/06-19]31pkt,24pt.(tcp),2pt.(udp)

Port scan denied

404 NOT FOUND

162.243.136.216 - - - [17/Jun/2020:05:56:02 +0200] "GET /owa/auth/logon.aspx?url=https%3a%2f%2f1%2fecp%2f HTTP/1.1" 404 162 "-" "Mozilla/5.0 zgrab/0.x" "-" "-"

A person using this address is trying to steal my information.

Apr  4 18:29:35 [host] sshd[5187]: pam_unix(sshd:a
Apr  4 18:29:38 [host] sshd[5187]: Failed password
Apr  4 18:34:08 [host] sshd[5343]: pam_unix(sshd:a

Apr  4 18:58:59 silence02 sshd[15421]: Failed password for root from 183.82.34.162 port 44318 ssh2
Apr  4 19:04:02 silence02 sshd[15677]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.82.34.162
Apr  4 19:04:04 silence02 sshd[15677]: Failed password for invalid user Tlhua from 183.82.34.162 port 60020 ssh2

Fail2Ban Ban Triggered (2)

Apr  4 14:08:15 master sshd[3741]: Failed password for invalid user admin from 180.245.91.151 port 49188 ssh2

Apr  4 18:32:04 plex sshd[12980]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.31.83  user=root
Apr  4 18:32:06 plex sshd[12980]: Failed password for root from 222.186.31.83 port 12884 ssh2

Honeypot attack, port: 445, PTR: PTR record not found

Apr  4 16:23:53 MainVPS sshd[13174]: Invalid user pi from 197.231.70.61 port 34164
Apr  4 16:23:53 MainVPS sshd[13176]: Invalid user pi from 197.231.70.61 port 34178
Apr  4 16:23:53 MainVPS sshd[13174]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=197.231.70.61
Apr  4 16:23:53 MainVPS sshd[13174]: Invalid user pi from 197.231.70.61 port 34164
Apr  4 16:23:55 MainVPS sshd[13174]: Failed password for invalid user pi from 197.231.70.61 port 34164 ssh2
...

SSH authentication failure x 6 reported by Fail2Ban
...

2020-04-04T17:40:21.553828centos sshd[20173]: Failed password for root from 14.29.205.220 port 33178 ssh2
2020-04-04T17:42:19.252588centos sshd[20299]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.29.205.220  user=root
2020-04-04T17:42:21.276541centos sshd[20299]: Failed password for root from 14.29.205.220 port 41362 ssh2
...

[2020-04-04 12:37:23] NOTICE[12114] chan_sip.c: Registration from '' failed for '185.147.212.8:59764' - Wrong password
[2020-04-04 12:37:23] SECURITY[12128] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-04-04T12:37:23.826-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="3051",SessionID="0x7f020c04b958",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/185.147.212.8/59764",Challenge="6bdce02c",ReceivedChallenge="6bdce02c",ReceivedHash="48847aed2eacf7dc92805d37a44b8f8b"
[2020-04-04 12:37:47] NOTICE[12114] chan_sip.c: Registration from '' failed for '185.147.212.8:51668' - Wrong password
[2020-04-04 12:37:47] SECURITY[12128] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-04-04T12:37:47.081-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="2639",SessionID="0x7f020c088288",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/185.147.2
...

Unauthorized connection attempt detected from IP address 49.51.8.104 to port 616

Apr  4 16:50:47 localhost sshd[125818]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.190.2  user=root
Apr  4 16:50:48 localhost sshd[125818]: Failed password for root from 222.186.190.2 port 43068 ssh2
Apr  4 16:50:51 localhost sshd[125818]: Failed password for root from 222.186.190.2 port 43068 ssh2
Apr  4 16:50:47 localhost sshd[125818]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.190.2  user=root
Apr  4 16:50:48 localhost sshd[125818]: Failed password for root from 222.186.190.2 port 43068 ssh2
Apr  4 16:50:51 localhost sshd[125818]: Failed password for root from 222.186.190.2 port 43068 ssh2
Apr  4 16:50:47 localhost sshd[125818]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.190.2  user=root
Apr  4 16:50:48 localhost sshd[125818]: Failed password for root from 222.186.190.2 port 43068 ssh2
Apr  4 16:50:51 localhost sshd[125818]: F
...

Apr  4 08:57:37 Ubuntu-1404-trusty-64-minimal sshd\[29325\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.178  user=root
Apr  4 08:57:39 Ubuntu-1404-trusty-64-minimal sshd\[29325\]: Failed password for root from 218.92.0.178 port 50824 ssh2
Apr  4 08:57:52 Ubuntu-1404-trusty-64-minimal sshd\[29325\]: Failed password for root from 218.92.0.178 port 50824 ssh2
Apr  4 18:30:25 Ubuntu-1404-trusty-64-minimal sshd\[23028\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.178  user=root
Apr  4 18:30:26 Ubuntu-1404-trusty-64-minimal sshd\[23028\]: Failed password for root from 218.92.0.178 port 44272 ssh2

$f2bV_matches