Connection to SSH Honeypot - Detected by HoneypotDB

2020-07-15T02:33:17.649179mail.csmailer.org sshd[4082]: Invalid user tibero1 from 175.6.35.140 port 35374
2020-07-15T02:33:17.652355mail.csmailer.org sshd[4082]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.6.35.140
2020-07-15T02:33:17.649179mail.csmailer.org sshd[4082]: Invalid user tibero1 from 175.6.35.140 port 35374
2020-07-15T02:33:19.395459mail.csmailer.org sshd[4082]: Failed password for invalid user tibero1 from 175.6.35.140 port 35374 ssh2
2020-07-15T02:35:01.638218mail.csmailer.org sshd[4242]: Invalid user simone from 175.6.35.140 port 57170
...

Unauthorized access to SSH at 13/Jul/2020:03:49:49 +0000.

$f2bV_matches

Jun 13 23:08:24 prox sshd[22381]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.6.35.140 
Jun 13 23:08:27 prox sshd[22381]: Failed password for invalid user tunnel from 175.6.35.140 port 59192 ssh2

Jun  7 05:54:58 [host] sshd[20452]: pam_unix(sshd:
Jun  7 05:55:00 [host] sshd[20452]: Failed passwor
Jun  7 05:58:21 [host] sshd[20658]: pam_unix(sshd:

2020-06-03T06:49:09.653613linuxbox-skyline sshd[109251]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.6.35.140  user=root
2020-06-03T06:49:11.892130linuxbox-skyline sshd[109251]: Failed password for root from 175.6.35.140 port 35964 ssh2
...

k+ssh-bruteforce

2020-05-27T16:26:25.263965afi-git.jinr.ru sshd[9541]: Failed password for invalid user Leo from 175.6.35.140 port 54362 ssh2
2020-05-27T16:30:59.447357afi-git.jinr.ru sshd[10597]: Invalid user cat from 175.6.35.140 port 47056
2020-05-27T16:30:59.450776afi-git.jinr.ru sshd[10597]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.6.35.140
2020-05-27T16:30:59.447357afi-git.jinr.ru sshd[10597]: Invalid user cat from 175.6.35.140 port 47056
2020-05-27T16:31:01.427049afi-git.jinr.ru sshd[10597]: Failed password for invalid user cat from 175.6.35.140 port 47056 ssh2
...

Apr 26 12:03:02 work-partkepr sshd\[480\]: Invalid user httpfs from 175.6.35.140 port 57722
Apr 26 12:03:02 work-partkepr sshd\[480\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.6.35.140
...

Fail2Ban Ban Triggered

Mar 27 09:45:19 cloud sshd[13210]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.6.35.140 
Mar 27 09:45:20 cloud sshd[13210]: Failed password for invalid user freebsd from 175.6.35.140 port 38182 ssh2

$f2bV_matches

Mar 12 03:00:23 php1 sshd\[4425\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.6.35.140  user=root
Mar 12 03:00:26 php1 sshd\[4425\]: Failed password for root from 175.6.35.140 port 45858 ssh2
Mar 12 03:02:06 php1 sshd\[4575\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.6.35.140  user=root
Mar 12 03:02:07 php1 sshd\[4575\]: Failed password for root from 175.6.35.140 port 39726 ssh2
Mar 12 03:03:55 php1 sshd\[4735\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.6.35.140  user=root

DATE:2020-03-03 11:31:04, IP:175.6.35.140, PORT:ssh SSH brute force auth (docker-dc)

Feb  9 23:26:29 gw1 sshd[6636]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.6.35.140
Feb  9 23:26:31 gw1 sshd[6636]: Failed password for invalid user ulp from 175.6.35.140 port 50690 ssh2
...

Oct 11 14:15:29 george sshd[21602]: Invalid user max from 175.6.35.46 port 37444
Oct 11 14:15:29 george sshd[21602]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.6.35.46 
Oct 11 14:15:31 george sshd[21602]: Failed password for invalid user max from 175.6.35.46 port 37444 ssh2
Oct 11 14:19:16 george sshd[21661]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.6.35.46  user=root
Oct 11 14:19:18 george sshd[21661]: Failed password for root from 175.6.35.46 port 33366 ssh2
...

Oct 11 07:14:48 mail sshd[3089]: Failed password for root from 175.6.35.46 port 51112 ssh2

fail2ban detected bruce force on ssh iptables

2020-10-06 UTC: (34x) - root(34x)

Oct  7 13:00:08 rocket sshd[30368]: Failed password for root from 175.6.35.46 port 45980 ssh2
Oct  7 13:02:54 rocket sshd[30713]: Failed password for root from 175.6.35.46 port 49238 ssh2
...

2020-10-06T23:50:32.423594lavrinenko.info sshd[7226]: Failed password for root from 175.6.35.207 port 49348 ssh2
2020-10-06T23:52:56.785722lavrinenko.info sshd[7295]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.6.35.207  user=root
2020-10-06T23:52:58.826115lavrinenko.info sshd[7295]: Failed password for root from 175.6.35.207 port 59098 ssh2
2020-10-06T23:55:23.173147lavrinenko.info sshd[7374]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.6.35.207  user=root
2020-10-06T23:55:25.394130lavrinenko.info sshd[7374]: Failed password for root from 175.6.35.207 port 40616 ssh2
...

Oct  7 04:27:15 ns381471 sshd[9050]: Failed password for root from 175.6.35.46 port 33572 ssh2

Sep 17 12:39:02 rocket sshd[512]: Failed password for root from 175.6.35.46 port 55584 ssh2
Sep 17 12:43:02 rocket sshd[1355]: Failed password for root from 175.6.35.46 port 46936 ssh2
...

Sep 17 03:56:43 vlre-nyc-1 sshd\[30046\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.6.35.46  user=root
Sep 17 03:56:46 vlre-nyc-1 sshd\[30046\]: Failed password for root from 175.6.35.46 port 34342 ssh2
Sep 17 04:03:59 vlre-nyc-1 sshd\[30238\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.6.35.46  user=root
Sep 17 04:04:01 vlre-nyc-1 sshd\[30238\]: Failed password for root from 175.6.35.46 port 46254 ssh2
Sep 17 04:06:01 vlre-nyc-1 sshd\[30318\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.6.35.46  user=root
...

Sep 17 05:58:17 web1 sshd[11713]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.6.35.46  user=root
Sep 17 05:58:18 web1 sshd[11713]: Failed password for root from 175.6.35.46 port 53534 ssh2
Sep 17 06:02:52 web1 sshd[13947]: Invalid user oracle from 175.6.35.46 port 41730
Sep 17 06:02:52 web1 sshd[13947]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.6.35.46
Sep 17 06:02:52 web1 sshd[13947]: Invalid user oracle from 175.6.35.46 port 41730
Sep 17 06:02:55 web1 sshd[13947]: Failed password for invalid user oracle from 175.6.35.46 port 41730 ssh2
Sep 17 06:04:24 web1 sshd[14645]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.6.35.46  user=root
Sep 17 06:04:26 web1 sshd[14645]: Failed password for root from 175.6.35.46 port 34512 ssh2
Sep 17 06:05:54 web1 sshd[15453]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost
...

(sshd) Failed SSH login from 175.6.35.202 (CN/China/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Sep 14 04:48:20 optimus sshd[16537]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.6.35.202  user=root
Sep 14 04:48:23 optimus sshd[16537]: Failed password for root from 175.6.35.202 port 34656 ssh2
Sep 14 04:56:55 optimus sshd[19013]: Invalid user cron from 175.6.35.202
Sep 14 04:56:55 optimus sshd[19013]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.6.35.202 
Sep 14 04:56:58 optimus sshd[19013]: Failed password for invalid user cron from 175.6.35.202 port 56804 ssh2

Aug 28 16:30:37 mout sshd[27637]: Invalid user username from 175.6.35.202 port 41834

Invalid user csgoserver from 175.6.35.52 port 55522

Invalid user ocr from 175.6.35.197 port 52648

Aug 24 23:19:12 server sshd[37717]: Failed password for invalid user mike from 175.6.35.52 port 60890 ssh2
Aug 24 23:21:25 server sshd[38831]: Failed password for root from 175.6.35.52 port 38942 ssh2
Aug 24 23:23:42 server sshd[39959]: Failed password for invalid user odoo from 175.6.35.52 port 45220 ssh2

firewall-block, port(s): 80/tcp

Invalid user cmte from 27.111.36.136 port 48864

port scan and connect, tcp 22 (ssh)

Aug 28 07:43:21 ny01 sshd[11200]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.193.6.31
Aug 28 07:43:23 ny01 sshd[11200]: Failed password for invalid user vss from 62.193.6.31 port 35542 ssh2
Aug 28 07:47:26 ny01 sshd[11831]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.193.6.31

Aug 28 11:10:27 SilenceServices sshd[18203]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.230.113.218
Aug 28 11:10:29 SilenceServices sshd[18203]: Failed password for invalid user cvsroot from 157.230.113.218 port 40388 ssh2
Aug 28 11:14:10 SilenceServices sshd[19560]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.230.113.218

\[2019-08-28 07:29:51\] NOTICE\[1829\] chan_sip.c: Registration from '\' failed for '23.249.162.136:63672' - Wrong password
\[2019-08-28 07:29:51\] SECURITY\[1837\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-08-28T07:29:51.725-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="544",SessionID="0x7f7b30fa67f8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/23.249.162.136/63672",Challenge="7d784fd4",ReceivedChallenge="7d784fd4",ReceivedHash="2693a6269f45dffeb159b3a6b6ac85f2"
\[2019-08-28 07:32:10\] NOTICE\[1829\] chan_sip.c: Registration from '\' failed for '23.249.162.136:62906' - Wrong password
\[2019-08-28 07:32:10\] SECURITY\[1837\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-08-28T07:32:10.770-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="566",SessionID="0x7f7b301b3438",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/23.249.162

Aug 28 11:06:04 sshgateway sshd\[29367\]: Invalid user popa from 54.38.192.96
Aug 28 11:06:04 sshgateway sshd\[29367\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.38.192.96
Aug 28 11:06:06 sshgateway sshd\[29367\]: Failed password for invalid user popa from 54.38.192.96 port 46486 ssh2

firewall-block, port(s): 23/tcp

08/28/2019-04:43:38.075474 71.6.199.23 Protocol: 6 ET CINS Active Threat Intelligence Poor Reputation IP group 71

email spam

Aug 23 20:10:36 itv-usvr-01 sshd[3339]: Invalid user jw from 122.53.62.83
Aug 23 20:10:36 itv-usvr-01 sshd[3339]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.53.62.83
Aug 23 20:10:36 itv-usvr-01 sshd[3339]: Invalid user jw from 122.53.62.83
Aug 23 20:10:38 itv-usvr-01 sshd[3339]: Failed password for invalid user jw from 122.53.62.83 port 41012 ssh2
Aug 23 20:17:03 itv-usvr-01 sshd[3597]: Invalid user docker from 122.53.62.83

2019-08-28T09:41:52.246698abusebot-2.cloudsearch.cf sshd\[26348\]: Invalid user sontra from 60.28.253.182 port 34126

Aug 27 21:40:35 hiderm sshd\[13052\]: Invalid user hl from 182.61.34.79
Aug 27 21:40:35 hiderm sshd\[13052\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.34.79
Aug 27 21:40:37 hiderm sshd\[13052\]: Failed password for invalid user hl from 182.61.34.79 port 24849 ssh2
Aug 27 21:46:07 hiderm sshd\[13523\]: Invalid user canna from 182.61.34.79
Aug 27 21:46:07 hiderm sshd\[13523\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.34.79

Aug 28 09:43:46 yabzik sshd[319]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.28.150.73
Aug 28 09:43:48 yabzik sshd[319]: Failed password for invalid user paintball1 from 113.28.150.73 port 46529 ssh2
Aug 28 09:53:09 yabzik sshd[4064]: Failed password for root from 113.28.150.73 port 24481 ssh2

Aug 28 12:11:24 SilenceServices sshd[9180]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.70.36.161
Aug 28 12:11:26 SilenceServices sshd[9180]: Failed password for invalid user megan from 193.70.36.161 port 45827 ssh2
Aug 28 12:16:15 SilenceServices sshd[10957]: Failed password for root from 193.70.36.161 port 39553 ssh2