Oct 11 23:53:45 *hidden* sshd[33031]: Invalid user teodora from 180.76.236.65 port 51230 Oct 11 23:53:45 *hidden* sshd[33031]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.236.65 Oct 11 23:53:48 *hidden* sshd[33031]: Failed password for invalid user teodora from 180.76.236.65 port 51230 ssh2

Oct 11 19:33:49 cdc sshd[3716]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.236.5  user=root
Oct 11 19:33:51 cdc sshd[3716]: Failed password for invalid user root from 180.76.236.5 port 49452 ssh2

Oct 11 12:04:01 OPSO sshd\[20485\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.236.5  user=root
Oct 11 12:04:03 OPSO sshd\[20485\]: Failed password for root from 180.76.236.5 port 57236 ssh2
Oct 11 12:05:41 OPSO sshd\[21016\]: Invalid user upload from 180.76.236.5 port 48352
Oct 11 12:05:41 OPSO sshd\[21016\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.236.5
Oct 11 12:05:43 OPSO sshd\[21016\]: Failed password for invalid user upload from 180.76.236.5 port 48352 ssh2

Invalid user info from 180.76.236.5 port 53338

Invalid user info from 180.76.236.5 port 53338

SSH login attempts.

Aug 29 05:57:17 ns382633 sshd\[30474\]: Invalid user frog from 180.76.236.65 port 56198
Aug 29 05:57:17 ns382633 sshd\[30474\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.236.65
Aug 29 05:57:19 ns382633 sshd\[30474\]: Failed password for invalid user frog from 180.76.236.65 port 56198 ssh2
Aug 29 06:03:04 ns382633 sshd\[31424\]: Invalid user ksk from 180.76.236.65 port 58938
Aug 29 06:03:04 ns382633 sshd\[31424\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.236.65

Aug 17 13:19:46 santamaria sshd\[28410\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.236.65  user=root
Aug 17 13:19:49 santamaria sshd\[28410\]: Failed password for root from 180.76.236.65 port 42272 ssh2
Aug 17 13:22:18 santamaria sshd\[28449\]: Invalid user usuario1 from 180.76.236.65
Aug 17 13:22:18 santamaria sshd\[28449\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.236.65
Aug 17 13:22:19 santamaria sshd\[28449\]: Failed password for invalid user usuario1 from 180.76.236.65 port 41456 ssh2
Aug 17 13:24:46 santamaria sshd\[28479\]: Invalid user testwww from 180.76.236.65
Aug 17 13:27:23 santamaria sshd\[28495\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.236.65  user=root
Aug 17 13:27:25 santamaria sshd\[28495\]: Failed password for root from 180.76.236.65 port 39842 ssh2
...

2020-08-08T05:41:51.453860ns386461 sshd\[14978\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.236.5  user=root
2020-08-08T05:41:53.142357ns386461 sshd\[14978\]: Failed password for root from 180.76.236.5 port 55556 ssh2
2020-08-08T05:55:44.876290ns386461 sshd\[28266\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.236.5  user=root
2020-08-08T05:55:46.585885ns386461 sshd\[28266\]: Failed password for root from 180.76.236.5 port 41550 ssh2
2020-08-08T06:00:22.302974ns386461 sshd\[32412\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.236.5  user=root
...

Aug  2 09:31:26 ns sshd[974]: Connection from 180.76.236.5 port 33232 on 134.119.36.27 port 22
Aug  2 09:31:29 ns sshd[974]: User r.r from 180.76.236.5 not allowed because not listed in AllowUsers
Aug  2 09:31:29 ns sshd[974]: Failed password for invalid user r.r from 180.76.236.5 port 33232 ssh2
Aug  2 09:31:29 ns sshd[974]: Received disconnect from 180.76.236.5 port 33232:11: Bye Bye [preauth]
Aug  2 09:31:29 ns sshd[974]: Disconnected from 180.76.236.5 port 33232 [preauth]
Aug  2 09:49:46 ns sshd[24749]: Connection from 180.76.236.5 port 52926 on 134.119.36.27 port 22
Aug  2 09:49:48 ns sshd[24749]: User r.r from 180.76.236.5 not allowed because not listed in AllowUsers
Aug  2 09:49:48 ns sshd[24749]: Failed password for invalid user r.r from 180.76.236.5 port 52926 ssh2
Aug  2 09:49:49 ns sshd[24749]: Received disconnect from 180.76.236.5 port 52926:11: Bye Bye [preauth]
Aug  2 09:49:49 ns sshd[24749]: Disconnected from 180.76.236.5 port 52926 [preauth]
Aug  2 09:55........
-------------------------------

2020-07-24 07:19:57,842 fail2ban.actions: WARNING [ssh] Ban 180.76.236.65

2020-06-20T15:12:02.074695shield sshd\[7145\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.236.65  user=root
2020-06-20T15:12:04.894907shield sshd\[7145\]: Failed password for root from 180.76.236.65 port 57494 ssh2
2020-06-20T15:16:50.680930shield sshd\[7774\]: Invalid user yhy from 180.76.236.65 port 48680
2020-06-20T15:16:50.684954shield sshd\[7774\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.236.65
2020-06-20T15:16:52.707363shield sshd\[7774\]: Failed password for invalid user yhy from 180.76.236.65 port 48680 ssh2

Jun 19 07:57:00 h2427292 sshd\[20430\]: Invalid user admin from 180.76.236.65
Jun 19 07:57:00 h2427292 sshd\[20430\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.236.65 
Jun 19 07:57:02 h2427292 sshd\[20430\]: Failed password for invalid user admin from 180.76.236.65 port 40128 ssh2
...

Unauthorized access or intrusion attempt detected from Thor banned IP

$f2bV_matches

[Mon May 25 03:31:30.667468 2020] [:error] [pid 4726:tid 139717567837952] [client 207.46.13.127:7388] [client 207.46.13.127] ModSecurity: Access denied with code 403 (phase 2). Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/modsecurity/owasp-modsecurity-crs-3.2.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "696"] [id "920350"] [msg "Host header is a numeric IP address"] [data "103.27.207.197"] [severity "WARNING"] [ver "OWASP_CRS/3.2.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/IP_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "karangploso.jatim.bmkg.go.id"] [uri "/index.php/prakiraan-musim/296-prakiraan-musim-kemarau/prakiraan-sifat-hujan-musim-kemarau/prakiraan-sifat-hujan-musim-kemarau-di-malang"] [unique_id "XsrZooebSB3qjOjjfHG24QAAAZc"]
...

May 24 20:54:04 game-panel sshd[14386]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=141.98.81.99
May 24 20:54:07 game-panel sshd[14386]: Failed password for invalid user Administrator from 141.98.81.99 port 42039 ssh2
May 24 20:54:43 game-panel sshd[14442]: Failed password for root from 141.98.81.99 port 38161 ssh2

May 24 16:22:47 r.ca sshd[1562]: Failed password for invalid user pan from 177.42.37.126 port 7688 ssh2

May 24 23:08:58 debian-2gb-nbg1-2 kernel: \[12613344.875307\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=195.54.160.225 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=245 ID=65454 PROTO=TCP SPT=49689 DPT=3877 WINDOW=1024 RES=0x00 SYN URGP=0

May 24 22:31:00 minden010 sshd[6526]: Failed password for root from 159.203.219.38 port 41722 ssh2
May 24 22:33:26 minden010 sshd[7322]: Failed password for mysql from 159.203.219.38 port 36893 ssh2
...

May 24 22:41:29 abendstille sshd\[20844\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.159.29  user=root
May 24 22:41:31 abendstille sshd\[20844\]: Failed password for root from 142.93.159.29 port 54398 ssh2
May 24 22:44:53 abendstille sshd\[24372\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.159.29  user=root
May 24 22:44:55 abendstille sshd\[24372\]: Failed password for root from 142.93.159.29 port 59908 ssh2
May 24 22:48:21 abendstille sshd\[27791\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.159.29  user=root
...

Auto Fail2Ban report, multiple SSH login attempts.

$f2bV_matches

May 24 22:31:37 pve1 sshd[2459]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.236.195.150 
May 24 22:31:38 pve1 sshd[2459]: Failed password for invalid user p from 49.236.195.150 port 34046 ssh2
...

May 24 22:28:24 PorscheCustomer sshd[23514]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.205.128.170
May 24 22:28:25 PorscheCustomer sshd[23514]: Failed password for invalid user java from 91.205.128.170 port 39702 ssh2
May 24 22:31:49 PorscheCustomer sshd[23623]: Failed password for root from 91.205.128.170 port 39762 ssh2
...

May 24 22:31:24 wordpress wordpress(www.ruhnke.cloud)[1015]: Blocked authentication attempt for admin from ::ffff:162.243.22.112

2020-05-24T20:23:31.102438abusebot-5.cloudsearch.cf sshd[13765]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.188.139.17  user=root
2020-05-24T20:23:33.117694abusebot-5.cloudsearch.cf sshd[13765]: Failed password for root from 190.188.139.17 port 52095 ssh2
2020-05-24T20:27:31.089223abusebot-5.cloudsearch.cf sshd[13768]: Invalid user gasiago from 190.188.139.17 port 50982
2020-05-24T20:27:31.096754abusebot-5.cloudsearch.cf sshd[13768]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.188.139.17
2020-05-24T20:27:31.089223abusebot-5.cloudsearch.cf sshd[13768]: Invalid user gasiago from 190.188.139.17 port 50982
2020-05-24T20:27:33.397342abusebot-5.cloudsearch.cf sshd[13768]: Failed password for invalid user gasiago from 190.188.139.17 port 50982 ssh2
2020-05-24T20:31:31.678759abusebot-5.cloudsearch.cf sshd[13774]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhos
...

May 24 23:27:33 vps sshd[888985]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.59.139.12
May 24 23:27:36 vps sshd[888985]: Failed password for invalid user redbul from 218.59.139.12 port 51683 ssh2
May 24 23:30:41 vps sshd[904753]: Invalid user kendis from 218.59.139.12 port 46402
May 24 23:30:41 vps sshd[904753]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.59.139.12
May 24 23:30:44 vps sshd[904753]: Failed password for invalid user kendis from 218.59.139.12 port 46402 ssh2
...

206.189.26.231 - - \[24/May/2020:22:53:32 +0200\] "POST /wp-login.php HTTP/1.0" 200 6052 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"
206.189.26.231 - - \[24/May/2020:22:53:35 +0200\] "POST /wp-login.php HTTP/1.0" 200 5872 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"
206.189.26.231 - - \[24/May/2020:22:53:41 +0200\] "POST /wp-login.php HTTP/1.0" 200 5865 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"

[MK-VM1] Blocked by UFW