Oct  9 01:11:02 elp-server sshd[85411]: Unable to negotiate with 185.132.53.14 port 48206: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
Oct  9 01:11:19 elp-server sshd[85417]: Unable to negotiate with 185.132.53.14 port 48212: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
Oct  9 01:11:36 elp-server sshd[85423]: Unable to negotiate with 185.132.53.14 port 48258: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
...

(sshd) Failed SSH login from 185.132.53.14 (DE/Germany/vps32.virtual4host.pt): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Oct  8 11:51:30 server sshd[22256]: Did not receive identification string from 185.132.53.14 port 55218
Oct  8 11:51:58 server sshd[22312]: Failed password for root from 185.132.53.14 port 33202 ssh2
Oct  8 11:52:15 server sshd[22379]: Invalid user oracle from 185.132.53.14 port 33402
Oct  8 11:52:16 server sshd[22379]: Failed password for invalid user oracle from 185.132.53.14 port 33402 ssh2
Oct  8 11:52:35 server sshd[22457]: Failed password for root from 185.132.53.14 port 33592 ssh2

Oct  8 09:38:37 sd-69548 sshd[84133]: Unable to negotiate with 185.132.53.14 port 35272: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
Oct  8 09:38:55 sd-69548 sshd[84153]: Unable to negotiate with 185.132.53.14 port 58052: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
...

[N3.H3.VM3] Port Scanner Detected Blocked by UFW

2020-10-04 10:40:34.849649-0500  localhost sshd[74206]: Failed password for root from 185.132.53.14 port 35032 ssh2

Oct  4 10:17:28 server2 sshd\[32424\]: User root from vps32.virtual4host.pt not allowed because not listed in AllowUsers
Oct  4 10:17:45 server2 sshd\[32427\]: User root from vps32.virtual4host.pt not allowed because not listed in AllowUsers
Oct  4 10:18:01 server2 sshd\[32431\]: User root from vps32.virtual4host.pt not allowed because not listed in AllowUsers
Oct  4 10:18:18 server2 sshd\[32462\]: User root from vps32.virtual4host.pt not allowed because not listed in AllowUsers
Oct  4 10:18:36 server2 sshd\[32464\]: Invalid user telnet from 185.132.53.14
Oct  4 10:18:53 server2 sshd\[32470\]: Invalid user ubnt from 185.132.53.14

The sucker tried to brute force my teeny tiny SSH server

Sep 29 16:55:37 XXX sshd[41741]: Invalid user oracle from 185.132.53.14 port 40844

Sep 28 20:06:02 OPSO sshd\[1962\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.132.53.14  user=root
Sep 28 20:06:04 OPSO sshd\[1962\]: Failed password for root from 185.132.53.14 port 48780 ssh2
Sep 28 20:06:18 OPSO sshd\[2032\]: Invalid user oracle from 185.132.53.14 port 43816
Sep 28 20:06:18 OPSO sshd\[2032\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.132.53.14
Sep 28 20:06:20 OPSO sshd\[2032\]: Failed password for invalid user oracle from 185.132.53.14 port 43816 ssh2

Time:     Mon Sep 28 12:03:01 2020 +0200
IP:       185.132.53.14 (DE/Germany/32.virtual4host.pt)
Failures: 5 (sshd)
Interval: 3600 seconds
Blocked:  Permanent Block [LF_SSHD]

Log entries:

Sep 28 12:01:36 3-1 sshd[5014]: Did not receive identification string from 185.132.53.14 port 47220
Sep 28 12:02:23 3-1 sshd[5054]: Failed password for root from 185.132.53.14 port 53030 ssh2
Sep 28 12:02:38 3-1 sshd[5072]: Invalid user oracle from 185.132.53.14 port 47438
Sep 28 12:02:39 3-1 sshd[5072]: Failed password for invalid user oracle from 185.132.53.14 port 47438 ssh2
Sep 28 12:02:57 3-1 sshd[5081]: Failed password for root from 185.132.53.14 port 41860 ssh2

Invalid user admin from 185.132.53.115 port 35110

Oct 13 10:06:29 ns1 sshd[78677]: Did not receive identification string from 185.132.53.115 port 44168
Oct 13 10:06:33 ns1 sshd[78678]: Unable to negotiate with 185.132.53.115 port 40660: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
Oct 13 10:06:49 ns1 sshd[78680]: Unable to negotiate with 185.132.53.115 port 41618: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
Oct 13 10:07:05 ns1 sshd[78682]: Unable to negotiate with 185.132.53.115 port 42644: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
Oct 13 10:07:20 ns1 sshd[78684]: Unable to negotiate with 185.132.53.115 port 43726: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-e
...

Oct 12 20:59:42 targaryen sshd[6336]: Invalid user admin from 185.132.53.115
Oct 12 20:59:56 targaryen sshd[6338]: Invalid user admin from 185.132.53.115
Oct 12 21:00:12 targaryen sshd[6343]: Invalid user admin from 185.132.53.115
Oct 12 21:00:27 targaryen sshd[6345]: Invalid user admin from 185.132.53.115
...

SSH Brute Force (V)

Unauthorized connection attempt detected from IP address 185.132.53.85 to port 22

Oct  6 22:25:15 nas sshd[30358]: Failed password for root from 185.132.53.115 port 42610 ssh2
Oct  6 22:25:31 nas sshd[30780]: Failed password for root from 185.132.53.115 port 40618 ssh2
...

Oct  6 11:27:26 alfc-lms-prod01 sshd\[25821\]: Invalid user user from 185.132.53.124
Oct  6 11:27:33 alfc-lms-prod01 sshd\[25825\]: Invalid user git from 185.132.53.124
Oct  6 11:27:41 alfc-lms-prod01 sshd\[25827\]: Invalid user postgres from 185.132.53.124
...

Icarus honeypot on github

Oct  6 11:27:26 alfc-lms-prod01 sshd\[25821\]: Invalid user user from 185.132.53.124
Oct  6 11:27:33 alfc-lms-prod01 sshd\[25825\]: Invalid user git from 185.132.53.124
Oct  6 11:27:41 alfc-lms-prod01 sshd\[25827\]: Invalid user postgres from 185.132.53.124
...

Oct  6 06:18:41 ns382633 sshd\[16857\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.132.53.115  user=root
Oct  6 06:18:43 ns382633 sshd\[16857\]: Failed password for root from 185.132.53.115 port 39806 ssh2
Oct  6 06:18:55 ns382633 sshd\[16861\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.132.53.115  user=root
Oct  6 06:18:58 ns382633 sshd\[16861\]: Failed password for root from 185.132.53.115 port 33824 ssh2
Oct  6 06:19:11 ns382633 sshd\[17121\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.132.53.115  user=root

[N10.H2.VM2] Port Scanner Detected Blocked by UFW

fail2ban detected bruce force on ssh iptables

frenzy

 TCP (SYN) 185.132.53.124:58330 -> port 22, len 48

Oct  4 23:48:13 vps647732 sshd[7976]: Failed password for root from 185.132.53.85 port 51540 ssh2
...

xmlrpc attack

Nov  6 11:18:01 vps58358 sshd\[14075\]: Invalid user fw from 45.249.111.40Nov  6 11:18:03 vps58358 sshd\[14075\]: Failed password for invalid user fw from 45.249.111.40 port 43928 ssh2Nov  6 11:22:30 vps58358 sshd\[14152\]: Invalid user shuo from 45.249.111.40Nov  6 11:22:32 vps58358 sshd\[14152\]: Failed password for invalid user shuo from 45.249.111.40 port 53898 ssh2Nov  6 11:27:00 vps58358 sshd\[14185\]: Invalid user kran from 45.249.111.40Nov  6 11:27:02 vps58358 sshd\[14185\]: Failed password for invalid user kran from 45.249.111.40 port 35638 ssh2
...

2019-11-06T08:51:15.234660shield sshd\[28160\]: Invalid user Lotta from 14.63.221.108 port 36515
2019-11-06T08:51:15.239446shield sshd\[28160\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.63.221.108
2019-11-06T08:51:17.044198shield sshd\[28160\]: Failed password for invalid user Lotta from 14.63.221.108 port 36515 ssh2
2019-11-06T08:55:51.009802shield sshd\[28813\]: Invalid user gb from 14.63.221.108 port 55686
2019-11-06T08:55:51.014390shield sshd\[28813\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.63.221.108

*Port Scan* detected from 167.71.115.227 (US/United States/-). 4 hits in the last 55 seconds

CloudCIX Reconnaissance Scan Detected, PTR: ns3047422.ip-51-255-74.eu.

WordPress login Brute force / Web App Attack on client site.

" "

Nov  4 00:04:12 rb06 sshd[6505]: reveeclipse mapping checking getaddrinfo for pool-70-18-218-223.ny325.east.verizon.net [70.18.218.223] failed - POSSIBLE BREAK-IN ATTEMPT!
Nov  4 00:04:14 rb06 sshd[6505]: Failed password for invalid user take from 70.18.218.223 port 53150 ssh2
Nov  4 00:04:14 rb06 sshd[6505]: Received disconnect from 70.18.218.223: 11: Bye Bye [preauth]
Nov  4 00:19:15 rb06 sshd[25780]: reveeclipse mapping checking getaddrinfo for pool-70-18-218-223.ny325.east.verizon.net [70.18.218.223] failed - POSSIBLE BREAK-IN ATTEMPT!
Nov  4 00:19:15 rb06 sshd[25780]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=70.18.218.223  user=r.r
Nov  4 00:19:16 rb06 sshd[25780]: Failed password for r.r from 70.18.218.223 port 38600 ssh2
Nov  4 00:19:16 rb06 sshd[25780]: Received disconnect from 70.18.218.223: 11: Bye Bye [preauth]
Nov  4 00:22:50 rb06 sshd[25754]: reveeclipse mapping checking getaddrinfo for pool-70-18-218-223.ny325........
-------------------------------

MultiHost/MultiPort Probe, Scan, Hack -

Automatic report - Port Scan Attack

Fail2Ban Ban Triggered

Connection by 196.52.43.129 on port: 2160 got caught by honeypot at 11/6/2019 5:25:28 AM

2019-11-06T09:22:22.197252abusebot-5.cloudsearch.cf sshd\[5709\]: Invalid user default from 159.203.189.152 port 54068

2019-11-06T09:17:35.341570matrix.arvenenaske.de sshd[214196]: Invalid user tibold from 189.112.94.27 port 25419
2019-11-06T09:17:35.344719matrix.arvenenaske.de sshd[214196]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.112.94.27 user=tibold
2019-11-06T09:17:35.345311matrix.arvenenaske.de sshd[214196]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.112.94.27
2019-11-06T09:17:35.341570matrix.arvenenaske.de sshd[214196]: Invalid user tibold from 189.112.94.27 port 25419
2019-11-06T09:17:37.174808matrix.arvenenaske.de sshd[214196]: Failed password for invalid user tibold from 189.112.94.27 port 25419 ssh2
2019-11-06T09:22:10.471502matrix.arvenenaske.de sshd[214214]: Invalid user jake from 189.112.94.27 port 7905
2019-11-06T09:22:10.474459matrix.arvenenaske.de sshd[214214]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.112.94.27 user=jake
201........
------------------------------

DATE:2019-11-06 07:12:13, IP:101.249.83.94, PORT:1433 MSSQL brute force auth on honeypot server (honey-neo-dc-bis)