Oct  6 11:27:26 alfc-lms-prod01 sshd\[25821\]: Invalid user user from 185.132.53.124
Oct  6 11:27:33 alfc-lms-prod01 sshd\[25825\]: Invalid user git from 185.132.53.124
Oct  6 11:27:41 alfc-lms-prod01 sshd\[25827\]: Invalid user postgres from 185.132.53.124
...

Oct  6 11:27:26 alfc-lms-prod01 sshd\[25821\]: Invalid user user from 185.132.53.124
Oct  6 11:27:33 alfc-lms-prod01 sshd\[25825\]: Invalid user git from 185.132.53.124
Oct  6 11:27:41 alfc-lms-prod01 sshd\[25827\]: Invalid user postgres from 185.132.53.124
...

[N10.H2.VM2] Port Scanner Detected Blocked by UFW

fail2ban detected bruce force on ssh iptables

frenzy

 TCP (SYN) 185.132.53.124:58330 -> port 22, len 48

firewall-block, port(s): 53413/udp

Invalid user admin from 185.132.53.115 port 35110

Oct 13 10:06:29 ns1 sshd[78677]: Did not receive identification string from 185.132.53.115 port 44168
Oct 13 10:06:33 ns1 sshd[78678]: Unable to negotiate with 185.132.53.115 port 40660: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
Oct 13 10:06:49 ns1 sshd[78680]: Unable to negotiate with 185.132.53.115 port 41618: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
Oct 13 10:07:05 ns1 sshd[78682]: Unable to negotiate with 185.132.53.115 port 42644: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
Oct 13 10:07:20 ns1 sshd[78684]: Unable to negotiate with 185.132.53.115 port 43726: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-e
...

Oct 12 20:59:42 targaryen sshd[6336]: Invalid user admin from 185.132.53.115
Oct 12 20:59:56 targaryen sshd[6338]: Invalid user admin from 185.132.53.115
Oct 12 21:00:12 targaryen sshd[6343]: Invalid user admin from 185.132.53.115
Oct 12 21:00:27 targaryen sshd[6345]: Invalid user admin from 185.132.53.115
...

SSH Brute Force (V)

Unauthorized connection attempt detected from IP address 185.132.53.85 to port 22

Oct  9 01:11:02 elp-server sshd[85411]: Unable to negotiate with 185.132.53.14 port 48206: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
Oct  9 01:11:19 elp-server sshd[85417]: Unable to negotiate with 185.132.53.14 port 48212: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
Oct  9 01:11:36 elp-server sshd[85423]: Unable to negotiate with 185.132.53.14 port 48258: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
...

(sshd) Failed SSH login from 185.132.53.14 (DE/Germany/vps32.virtual4host.pt): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Oct  8 11:51:30 server sshd[22256]: Did not receive identification string from 185.132.53.14 port 55218
Oct  8 11:51:58 server sshd[22312]: Failed password for root from 185.132.53.14 port 33202 ssh2
Oct  8 11:52:15 server sshd[22379]: Invalid user oracle from 185.132.53.14 port 33402
Oct  8 11:52:16 server sshd[22379]: Failed password for invalid user oracle from 185.132.53.14 port 33402 ssh2
Oct  8 11:52:35 server sshd[22457]: Failed password for root from 185.132.53.14 port 33592 ssh2

Oct  8 09:38:37 sd-69548 sshd[84133]: Unable to negotiate with 185.132.53.14 port 35272: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
Oct  8 09:38:55 sd-69548 sshd[84153]: Unable to negotiate with 185.132.53.14 port 58052: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
...

Oct  6 22:25:15 nas sshd[30358]: Failed password for root from 185.132.53.115 port 42610 ssh2
Oct  6 22:25:31 nas sshd[30780]: Failed password for root from 185.132.53.115 port 40618 ssh2
...

Icarus honeypot on github

Oct  6 06:18:41 ns382633 sshd\[16857\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.132.53.115  user=root
Oct  6 06:18:43 ns382633 sshd\[16857\]: Failed password for root from 185.132.53.115 port 39806 ssh2
Oct  6 06:18:55 ns382633 sshd\[16861\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.132.53.115  user=root
Oct  6 06:18:58 ns382633 sshd\[16861\]: Failed password for root from 185.132.53.115 port 33824 ssh2
Oct  6 06:19:11 ns382633 sshd\[17121\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.132.53.115  user=root

[N3.H3.VM3] Port Scanner Detected Blocked by UFW

Oct  4 23:48:13 vps647732 sshd[7976]: Failed password for root from 185.132.53.85 port 51540 ssh2
...

2020-10-04T00:19:55.319686snf-827550 sshd[7118]: Invalid user oracle from 185.132.53.145 port 41440
2020-10-04T00:19:56.654396snf-827550 sshd[7118]: Failed password for invalid user oracle from 185.132.53.145 port 41440 ssh2
2020-10-04T00:19:58.686112snf-827550 sshd[7120]: Invalid user nagios from 185.132.53.145 port 48806
...

Sep 28 02:35:15 roki-contabo sshd\[5365\]: Invalid user superuser from 185.132.53.5
Sep 28 02:35:15 roki-contabo sshd\[5365\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.132.53.5
Sep 28 02:35:17 roki-contabo sshd\[5365\]: Failed password for invalid user superuser from 185.132.53.5 port 59012 ssh2
Sep 28 02:42:40 roki-contabo sshd\[5433\]: Invalid user grid from 185.132.53.5
Sep 28 02:42:40 roki-contabo sshd\[5433\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.132.53.5
...

May 16 14:06:02 buvik sshd[23821]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.147.181
May 16 14:06:03 buvik sshd[23821]: Failed password for invalid user user from 122.51.147.181 port 44958 ssh2
May 16 14:10:01 buvik sshd[24416]: Invalid user admin from 122.51.147.181
...

May 16 16:43:16 ip-172-31-62-245 sshd\[8877\]: Invalid user hadoop from 37.187.12.126\
May 16 16:43:18 ip-172-31-62-245 sshd\[8877\]: Failed password for invalid user hadoop from 37.187.12.126 port 48086 ssh2\
May 16 16:45:45 ip-172-31-62-245 sshd\[8944\]: Invalid user user5 from 37.187.12.126\
May 16 16:45:47 ip-172-31-62-245 sshd\[8944\]: Failed password for invalid user user5 from 37.187.12.126 port 35124 ssh2\
May 16 16:48:18 ip-172-31-62-245 sshd\[8983\]: Invalid user beny from 37.187.12.126\

C1,DEF GET /wp-config.php_orig

Triggered by Fail2Ban at Ares web server

May 16 18:56:07 ns392434 sshd[19612]: Invalid user uftp from 188.168.82.246 port 60624
May 16 18:56:07 ns392434 sshd[19612]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.168.82.246
May 16 18:56:07 ns392434 sshd[19612]: Invalid user uftp from 188.168.82.246 port 60624
May 16 18:56:09 ns392434 sshd[19612]: Failed password for invalid user uftp from 188.168.82.246 port 60624 ssh2
May 16 19:12:19 ns392434 sshd[19854]: Invalid user admin from 188.168.82.246 port 56114
May 16 19:12:19 ns392434 sshd[19854]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.168.82.246
May 16 19:12:19 ns392434 sshd[19854]: Invalid user admin from 188.168.82.246 port 56114
May 16 19:12:21 ns392434 sshd[19854]: Failed password for invalid user admin from 188.168.82.246 port 56114 ssh2
May 16 19:16:24 ns392434 sshd[19912]: Invalid user white from 188.168.82.246 port 34566

May 16 14:09:04 abendstille sshd\[27273\]: Invalid user support from 61.5.7.249
May 16 14:09:04 abendstille sshd\[27252\]: Invalid user support from 61.5.7.249
May 16 14:09:04 abendstille sshd\[27273\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.5.7.249
May 16 14:09:06 abendstille sshd\[27273\]: Failed password for invalid user support from 61.5.7.249 port 52874 ssh2
May 16 14:09:06 abendstille sshd\[27252\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.5.7.249
...

Unauthorised access (May 16) SRC=180.119.55.168 LEN=40 TTL=52 ID=62915 TCP DPT=8080 WINDOW=45051 SYN 
Unauthorised access (May 15) SRC=180.119.55.168 LEN=40 TTL=52 ID=46095 TCP DPT=8080 WINDOW=45051 SYN 
Unauthorised access (May 15) SRC=180.119.55.168 LEN=40 TTL=52 ID=19415 TCP DPT=8080 WINDOW=45051 SYN

May 16 12:09:06 ip-172-31-61-156 sshd[1006]: Invalid user test from 106.225.130.128
May 16 12:09:08 ip-172-31-61-156 sshd[1006]: Failed password for invalid user test from 106.225.130.128 port 34378 ssh2
May 16 12:09:06 ip-172-31-61-156 sshd[1006]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.225.130.128
May 16 12:09:06 ip-172-31-61-156 sshd[1006]: Invalid user test from 106.225.130.128
May 16 12:09:08 ip-172-31-61-156 sshd[1006]: Failed password for invalid user test from 106.225.130.128 port 34378 ssh2
...

2020-05-16T18:39:38.579561abusebot-8.cloudsearch.cf sshd[23935]: Invalid user 1234 from 141.98.81.81 port 44438
2020-05-16T18:39:38.587035abusebot-8.cloudsearch.cf sshd[23935]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=141.98.81.81
2020-05-16T18:39:38.579561abusebot-8.cloudsearch.cf sshd[23935]: Invalid user 1234 from 141.98.81.81 port 44438
2020-05-16T18:39:40.532067abusebot-8.cloudsearch.cf sshd[23935]: Failed password for invalid user 1234 from 141.98.81.81 port 44438 ssh2
2020-05-16T18:40:13.678151abusebot-8.cloudsearch.cf sshd[24022]: Invalid user user from 141.98.81.81 port 60234
2020-05-16T18:40:13.687142abusebot-8.cloudsearch.cf sshd[24022]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=141.98.81.81
2020-05-16T18:40:13.678151abusebot-8.cloudsearch.cf sshd[24022]: Invalid user user from 141.98.81.81 port 60234
2020-05-16T18:40:15.436533abusebot-8.cloudsearch.cf sshd[24022]: Failed password fo
...

RU from mail.ufacity.info [81.30.200.35]:38181

May 16 18:38:59 raspberrypi sshd\[12313\]: Invalid user nagios from 106.12.210.115May 16 18:39:01 raspberrypi sshd\[12313\]: Failed password for invalid user nagios from 106.12.210.115 port 59864 ssh2May 16 18:57:44 raspberrypi sshd\[21507\]: Failed password for root from 106.12.210.115 port 53316 ssh2
...

firewall-block, port(s): 5222/tcp

Port probing on unauthorized port 8888

Unauthorized IMAP connection attempt

May 17 03:52:24 web1 sshd[4817]: Invalid user bret from 181.48.139.118 port 41144
May 17 03:52:24 web1 sshd[4817]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.48.139.118
May 17 03:52:24 web1 sshd[4817]: Invalid user bret from 181.48.139.118 port 41144
May 17 03:52:26 web1 sshd[4817]: Failed password for invalid user bret from 181.48.139.118 port 41144 ssh2
May 17 03:54:40 web1 sshd[5350]: Invalid user test from 181.48.139.118 port 40464
May 17 03:54:40 web1 sshd[5350]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.48.139.118
May 17 03:54:40 web1 sshd[5350]: Invalid user test from 181.48.139.118 port 40464
May 17 03:54:42 web1 sshd[5350]: Failed password for invalid user test from 181.48.139.118 port 40464 ssh2
May 17 03:55:27 web1 sshd[5605]: Invalid user postgres from 181.48.139.118 port 51718
...