Sep 15 16:47:47 onepixel sshd[169232]: Failed password for root from 167.114.12.244 port 41072 ssh2
Sep 15 16:51:44 onepixel sshd[169982]: Invalid user apache from 167.114.12.244 port 52632
Sep 15 16:51:44 onepixel sshd[169982]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.114.12.244 
Sep 15 16:51:44 onepixel sshd[169982]: Invalid user apache from 167.114.12.244 port 52632
Sep 15 16:51:46 onepixel sshd[169982]: Failed password for invalid user apache from 167.114.12.244 port 52632 ssh2

Unauthorised connection attempt detected at AUO NODE 4. System is sshd. Protected by AUO Stack Web Application Firewall (WAF)

SSH invalid-user multiple login attempts

Aug 27 14:53:02 vm1 sshd[7634]: Failed password for root from 167.114.12.244 port 56568 ssh2
...

Aug 26 22:51:48 electroncash sshd[44709]: Invalid user admindb from 167.114.12.244 port 60742
Aug 26 22:51:48 electroncash sshd[44709]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.114.12.244 
Aug 26 22:51:48 electroncash sshd[44709]: Invalid user admindb from 167.114.12.244 port 60742
Aug 26 22:51:50 electroncash sshd[44709]: Failed password for invalid user admindb from 167.114.12.244 port 60742 ssh2
Aug 26 22:55:15 electroncash sshd[45601]: Invalid user postgres from 167.114.12.244 port 39592
...

Aug 19 16:00:06 electroncash sshd[24922]: Failed password for root from 167.114.12.244 port 44026 ssh2
Aug 19 16:03:57 electroncash sshd[27705]: Invalid user potente from 167.114.12.244 port 52598
Aug 19 16:03:57 electroncash sshd[27705]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.114.12.244 
Aug 19 16:03:57 electroncash sshd[27705]: Invalid user potente from 167.114.12.244 port 52598
Aug 19 16:03:59 electroncash sshd[27705]: Failed password for invalid user potente from 167.114.12.244 port 52598 ssh2
...

Aug 18 14:59:00 electroncash sshd[25119]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.114.12.244 
Aug 18 14:59:00 electroncash sshd[25119]: Invalid user webadm from 167.114.12.244 port 60420
Aug 18 14:59:02 electroncash sshd[25119]: Failed password for invalid user webadm from 167.114.12.244 port 60420 ssh2
Aug 18 15:02:52 electroncash sshd[27292]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.114.12.244  user=root
Aug 18 15:02:53 electroncash sshd[27292]: Failed password for root from 167.114.12.244 port 41426 ssh2
...

Invalid user TESTUSER from 167.114.12.244 port 39784

Jul 29 23:02:53 vmd36147 sshd[14934]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.114.12.244
Jul 29 23:02:56 vmd36147 sshd[14934]: Failed password for invalid user mshan from 167.114.12.244 port 47076 ssh2
Jul 29 23:11:39 vmd36147 sshd[1498]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.114.12.244
...

2020-07-27 23:22:47,085 fail2ban.actions: WARNING [ssh] Ban 167.114.12.244

Jun 10 20:30:52 pi sshd[29289]: Failed password for root from 167.114.12.244 port 45496 ssh2

2020-07-23T12:47:46.087651linuxbox-skyline sshd[160914]: Invalid user chiara from 167.114.12.244 port 43206
...

Jul 11 20:15:27 django-0 sshd[32696]: Invalid user marcia from 167.114.12.244
...

Jul  3 23:17:19 dhoomketu sshd[1253307]: Failed password for root from 167.114.12.244 port 50780 ssh2
Jul  3 23:20:25 dhoomketu sshd[1253336]: Invalid user zwt from 167.114.12.244 port 47862
Jul  3 23:20:25 dhoomketu sshd[1253336]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.114.12.244 
Jul  3 23:20:25 dhoomketu sshd[1253336]: Invalid user zwt from 167.114.12.244 port 47862
Jul  3 23:20:27 dhoomketu sshd[1253336]: Failed password for invalid user zwt from 167.114.12.244 port 47862 ssh2
...

Jun 29 21:46:30 piServer sshd[3930]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.114.12.244 
Jun 29 21:46:32 piServer sshd[3930]: Failed password for invalid user corentin from 167.114.12.244 port 39882 ssh2
Jun 29 21:49:39 piServer sshd[4325]: Failed password for root from 167.114.12.244 port 33612 ssh2
...

Jun 24 11:21:10 h1745522 sshd[16028]: Invalid user juan from 167.114.12.244 port 41362
Jun 24 11:21:10 h1745522 sshd[16028]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.114.12.244
Jun 24 11:21:10 h1745522 sshd[16028]: Invalid user juan from 167.114.12.244 port 41362
Jun 24 11:21:12 h1745522 sshd[16028]: Failed password for invalid user juan from 167.114.12.244 port 41362 ssh2
Jun 24 11:24:28 h1745522 sshd[16155]: Invalid user user1 from 167.114.12.244 port 40808
Jun 24 11:24:28 h1745522 sshd[16155]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.114.12.244
Jun 24 11:24:28 h1745522 sshd[16155]: Invalid user user1 from 167.114.12.244 port 40808
Jun 24 11:24:29 h1745522 sshd[16155]: Failed password for invalid user user1 from 167.114.12.244 port 40808 ssh2
Jun 24 11:27:45 h1745522 sshd[16317]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.114.12.244  u
...

Jun 22 06:34:02 rocket sshd[21819]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.114.12.244
Jun 22 06:34:04 rocket sshd[21819]: Failed password for invalid user log from 167.114.12.244 port 57294 ssh2
Jun 22 06:36:55 rocket sshd[22116]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.114.12.244
...

Invalid user valerie from 167.114.12.244 port 44510

Jun 15 08:47:55 [host] sshd[15142]: Invalid user s
Jun 15 08:47:55 [host] sshd[15142]: pam_unix(sshd:
Jun 15 08:47:57 [host] sshd[15142]: Failed passwor

Jun  8 22:20:50 sip sshd[562]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.114.12.244
Jun  8 22:20:52 sip sshd[562]: Failed password for invalid user tpu from 167.114.12.244 port 52396 ssh2
Jun  8 22:27:52 sip sshd[3224]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.114.12.244

$f2bV_matches

$f2bV_matches | Triggered by Fail2Ban at Vostok web server

May 20 17:57:15 vps sshd[187649]: Failed password for invalid user fb from 167.114.12.244 port 44594 ssh2
May 20 18:01:36 vps sshd[209326]: Invalid user gvl from 167.114.12.244 port 52988
May 20 18:01:36 vps sshd[209326]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.114.12.244
May 20 18:01:38 vps sshd[209326]: Failed password for invalid user gvl from 167.114.12.244 port 52988 ssh2
May 20 18:05:49 vps sshd[229919]: Invalid user xzn from 167.114.12.244 port 33148
...

May  5 21:52:36 vpn01 sshd[7103]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.114.12.244
May  5 21:52:38 vpn01 sshd[7103]: Failed password for invalid user admin from 167.114.12.244 port 34662 ssh2
...

Wordpress malicious attack:[sshd]

1 Attack(s) Detected
[DoS Attack: SYN/ACK Scan] from source: 167.114.129.144, port 22, Saturday, September 05, 2020 05:49:34

1 Attack(s) Detected
[DoS Attack: SYN/ACK Scan] from source: 167.114.129.144, port 22, Saturday, September 05, 2020 05:49:34

1 Attack(s) Detected
[DoS Attack: SYN/ACK Scan] from source: 167.114.129.144, port 22, Saturday, September 05, 2020 05:49:34

failed_logins

fell into ViewStateTrap:wien2018

[portscan] tcp/21 [FTP]
[scan/connect: 5 time(s)]
in blocklist.de:'listed [ftp]'
*(RWIN=29200)(10151156)

php WP PHPmyadamin ABUSE blocked for 12h

scan z

Blocked range because of multiple attacks in the past. @ 2019-07-31T07:56:23+02:00.

May  5 17:57:39 vpn sshd[20881]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.114.128.189  user=root
May  5 17:57:42 vpn sshd[20881]: Failed password for root from 167.114.128.189 port 57142 ssh2
May  5 17:59:27 vpn sshd[20883]: Invalid user delta from 167.114.128.189
May  5 17:59:27 vpn sshd[20883]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.114.128.189
May  5 17:59:30 vpn sshd[20883]: Failed password for invalid user delta from 167.114.128.189 port 36654 ssh2

Nov 30 04:46:27 vpn sshd[32678]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.114.128.197
Nov 30 04:46:29 vpn sshd[32678]: Failed password for invalid user log from 167.114.128.197 port 48514 ssh2
Nov 30 04:52:43 vpn sshd[32719]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.114.128.197

Aug  5 05:39:09 Ubuntu-1404-trusty-64-minimal sshd\[25630\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.199.78.228  user=root
Aug  5 05:39:12 Ubuntu-1404-trusty-64-minimal sshd\[25630\]: Failed password for root from 139.199.78.228 port 32812 ssh2
Aug  5 05:48:48 Ubuntu-1404-trusty-64-minimal sshd\[30288\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.199.78.228  user=root
Aug  5 05:48:50 Ubuntu-1404-trusty-64-minimal sshd\[30288\]: Failed password for root from 139.199.78.228 port 60586 ssh2
Aug  5 05:52:12 Ubuntu-1404-trusty-64-minimal sshd\[32128\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.199.78.228  user=root

[2020-08-05 04:40:36] NOTICE[1248] chan_sip.c: Registration from '' failed for '147.135.253.94:56112' - Wrong password
[2020-08-05 04:40:36] SECURITY[1275] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-08-05T04:40:36.155-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="1090",SessionID="0x7f27200a09d8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/147.135.253.94/56112",Challenge="7266feaa",ReceivedChallenge="7266feaa",ReceivedHash="1aa46b1f2704a1e9560f876eb64dc473"
[2020-08-05 04:41:00] NOTICE[1248] chan_sip.c: Registration from '' failed for '147.135.253.94:60573' - Wrong password
[2020-08-05 04:41:00] SECURITY[1275] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-08-05T04:41:00.685-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="16",SessionID="0x7f27205a5c28",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/147.135.253.94
...

$f2bV_matches

Lines containing failures of 140.143.233.218
Aug  4 06:01:43 neweola sshd[29391]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=140.143.233.218  user=r.r
Aug  4 06:01:46 neweola sshd[29391]: Failed password for r.r from 140.143.233.218 port 59190 ssh2
Aug  4 06:01:48 neweola sshd[29391]: Received disconnect from 140.143.233.218 port 59190:11: Bye Bye [preauth]
Aug  4 06:01:48 neweola sshd[29391]: Disconnected from authenticating user r.r 140.143.233.218 port 59190 [preauth]
Aug  4 06:20:47 neweola sshd[30145]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=140.143.233.218  user=r.r
Aug  4 06:20:49 neweola sshd[30145]: Failed password for r.r from 140.143.233.218 port 35946 ssh2
Aug  4 06:20:50 neweola sshd[30145]: Received disconnect from 140.143.233.218 port 35946:11: Bye Bye [preauth]
Aug  4 06:20:50 neweola sshd[30145]: Disconnected from authenticating user r.r 140.143.233.218 port 3594........
------------------------------

firewall-block, port(s): 3775/tcp

$f2bV_matches

Unauthorized connection attempt detected from IP address 222.186.42.137 to port 22

Aug  5 08:03:54 rush sshd[17674]: Failed password for root from 59.9.199.98 port 44710 ssh2
Aug  5 08:08:35 rush sshd[17810]: Failed password for root from 59.9.199.98 port 22496 ssh2
...

Aug  5 10:31:51 piServer sshd[19444]: Failed password for root from 202.38.153.233 port 47763 ssh2
Aug  5 10:36:12 piServer sshd[19958]: Failed password for root from 202.38.153.233 port 12876 ssh2
...

Aug  5 10:12:44 amit sshd\[10366\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.254.209.201  user=root
Aug  5 10:12:46 amit sshd\[10366\]: Failed password for root from 103.254.209.201 port 58703 ssh2
Aug  5 10:21:45 amit sshd\[7677\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.254.209.201  user=root
...

Multiple SSH authentication failures from 51.38.51.200

Aug  5 08:49:24 ajax sshd[22575]: Failed password for root from 36.153.231.18 port 39892 ssh2

trying to access non-authorized port

<6 unauthorized SSH connections

2020-08-05T03:48:30.287454abusebot-8.cloudsearch.cf sshd[9275]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.208  user=root
2020-08-05T03:48:32.440168abusebot-8.cloudsearch.cf sshd[9275]: Failed password for root from 218.92.0.208 port 19665 ssh2
2020-08-05T03:48:35.064340abusebot-8.cloudsearch.cf sshd[9275]: Failed password for root from 218.92.0.208 port 19665 ssh2
2020-08-05T03:48:30.287454abusebot-8.cloudsearch.cf sshd[9275]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.208  user=root
2020-08-05T03:48:32.440168abusebot-8.cloudsearch.cf sshd[9275]: Failed password for root from 218.92.0.208 port 19665 ssh2
2020-08-05T03:48:35.064340abusebot-8.cloudsearch.cf sshd[9275]: Failed password for root from 218.92.0.208 port 19665 ssh2
2020-08-05T03:48:30.287454abusebot-8.cloudsearch.cf sshd[9275]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.
...