Aug 14 01:09:21 rancher-0 sshd[1072498]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.4.242.37  user=root
Aug 14 01:09:22 rancher-0 sshd[1072498]: Failed password for root from 186.4.242.37 port 41078 ssh2
...

Cowrie Honeypot: 3 unauthorised SSH/Telnet login attempts between 2020-08-09T17:15:53Z and 2020-08-09T17:21:31Z

Unauthorized SSH login attempts

Jun 28 22:46:54 srv-ubuntu-dev3 sshd[78215]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.4.242.37  user=root
Jun 28 22:46:56 srv-ubuntu-dev3 sshd[78215]: Failed password for root from 186.4.242.37 port 52936 ssh2
Jun 28 22:48:47 srv-ubuntu-dev3 sshd[78464]: Invalid user user1 from 186.4.242.37
Jun 28 22:48:47 srv-ubuntu-dev3 sshd[78464]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.4.242.37
Jun 28 22:48:47 srv-ubuntu-dev3 sshd[78464]: Invalid user user1 from 186.4.242.37
Jun 28 22:48:50 srv-ubuntu-dev3 sshd[78464]: Failed password for invalid user user1 from 186.4.242.37 port 37268 ssh2
Jun 28 22:52:26 srv-ubuntu-dev3 sshd[79006]: Invalid user user01 from 186.4.242.37
...

DATE:2020-06-26 23:28:09, IP:186.4.242.37, PORT:ssh SSH brute force auth (docker-dc)

2020-06-20T17:47:29.680467shield sshd\[5039\]: Invalid user yly from 186.4.242.37 port 54598
2020-06-20T17:47:29.684459shield sshd\[5039\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=host-186-4-242-37.netlife.ec
2020-06-20T17:47:31.612274shield sshd\[5039\]: Failed password for invalid user yly from 186.4.242.37 port 54598 ssh2
2020-06-20T17:50:59.895664shield sshd\[5864\]: Invalid user admin from 186.4.242.37 port 53164
2020-06-20T17:50:59.899283shield sshd\[5864\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=host-186-4-242-37.netlife.ec

Jun 18 10:45:49 hosting sshd[13177]: Invalid user ts from 186.4.242.37 port 49610
...

May 21 14:15:05 onepixel sshd[696523]: Invalid user fnx from 186.4.242.37 port 51612
May 21 14:15:05 onepixel sshd[696523]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.4.242.37 
May 21 14:15:05 onepixel sshd[696523]: Invalid user fnx from 186.4.242.37 port 51612
May 21 14:15:07 onepixel sshd[696523]: Failed password for invalid user fnx from 186.4.242.37 port 51612 ssh2
May 21 14:17:19 onepixel sshd[696773]: Invalid user saikrushna from 186.4.242.37 port 53926

$f2bV_matches

$f2bV_matches

May  9 22:38:15 server1 sshd\[7725\]: Failed password for invalid user mpt from 186.4.242.37 port 43238 ssh2
May  9 22:42:27 server1 sshd\[9106\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.4.242.37  user=postgres
May  9 22:42:29 server1 sshd\[9106\]: Failed password for postgres from 186.4.242.37 port 51924 ssh2
May  9 22:46:44 server1 sshd\[10451\]: Invalid user zhongfu from 186.4.242.37
May  9 22:46:44 server1 sshd\[10451\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.4.242.37 
...

May  5 04:27:56 server1 sshd\[8043\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.4.242.37  user=root
May  5 04:27:58 server1 sshd\[8043\]: Failed password for root from 186.4.242.37 port 55262 ssh2
May  5 04:30:41 server1 sshd\[8871\]: Invalid user admin from 186.4.242.37
May  5 04:30:41 server1 sshd\[8871\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.4.242.37 
May  5 04:30:43 server1 sshd\[8871\]: Failed password for invalid user admin from 186.4.242.37 port 39122 ssh2
...

Apr 24 20:00:25 xeon sshd[60151]: Failed password for invalid user foxi from 186.4.242.37 port 44652 ssh2

detected by Fail2Ban

SSH Brute-Forcing (server1)

Apr 19 22:06:08 meumeu sshd[2110]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.4.242.37 
Apr 19 22:06:09 meumeu sshd[2110]: Failed password for invalid user be from 186.4.242.37 port 45448 ssh2
Apr 19 22:15:59 meumeu sshd[3523]: Failed password for root from 186.4.242.37 port 35662 ssh2
...

Apr 11 20:21:01 ks10 sshd[3855017]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.4.242.37 
Apr 11 20:21:03 ks10 sshd[3855017]: Failed password for invalid user jil from 186.4.242.37 port 40090 ssh2
...

(sshd) Failed SSH login from 186.4.242.37 (EC/Ecuador/host-186-4-242-37.netlife.ec): 5 in the last 3600 secs

SSH brute force attempt

Jan 20 09:14:10 vps691689 sshd[27039]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.4.242.37
Jan 20 09:14:12 vps691689 sshd[27039]: Failed password for invalid user suporte from 186.4.242.37 port 35046 ssh2
Jan 20 09:17:15 vps691689 sshd[27170]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.4.242.37
...

Jan  8 02:55:15 firewall sshd[28442]: Invalid user xbi from 186.4.242.37
Jan  8 02:55:18 firewall sshd[28442]: Failed password for invalid user xbi from 186.4.242.37 port 44614 ssh2
Jan  8 02:59:10 firewall sshd[28510]: Invalid user games1 from 186.4.242.37
...

$f2bV_matches

SSH Login Bruteforce

Dec 24 07:17:34 game-panel sshd[31812]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.4.242.37
Dec 24 07:17:36 game-panel sshd[31812]: Failed password for invalid user update from 186.4.242.37 port 45766 ssh2
Dec 24 07:20:51 game-panel sshd[31970]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.4.242.37

2020-03-24T18:24:01.353282abusebot.cloudsearch.cf sshd[13612]: Invalid user hduser from 186.4.242.56 port 53860
2020-03-24T18:24:01.363991abusebot.cloudsearch.cf sshd[13612]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=host-186-4-242-56.netlife.ec
2020-03-24T18:24:01.353282abusebot.cloudsearch.cf sshd[13612]: Invalid user hduser from 186.4.242.56 port 53860
2020-03-24T18:24:03.608929abusebot.cloudsearch.cf sshd[13612]: Failed password for invalid user hduser from 186.4.242.56 port 53860 ssh2
2020-03-24T18:28:52.013221abusebot.cloudsearch.cf sshd[13970]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=host-186-4-242-56.netlife.ec  user=games
2020-03-24T18:28:54.205589abusebot.cloudsearch.cf sshd[13970]: Failed password for games from 186.4.242.56 port 47896 ssh2
2020-03-24T18:32:17.064938abusebot.cloudsearch.cf sshd[14317]: Invalid user student from 186.4.242.56 port 50894
...

SSH Brute-Forcing (server1)

2020-03-19T09:22:34.232711scmdmz1 sshd[4214]: Invalid user nivinform from 186.4.242.56 port 37716
2020-03-19T09:22:36.294643scmdmz1 sshd[4214]: Failed password for invalid user nivinform from 186.4.242.56 port 37716 ssh2
2020-03-19T09:27:04.962652scmdmz1 sshd[4592]: Invalid user vps from 186.4.242.56 port 56576
...

Mar 19 02:54:46 lock-38 sshd[81018]: Failed password for invalid user zhup from 186.4.242.56 port 59286 ssh2
Mar 19 02:58:23 lock-38 sshd[81074]: Failed password for root from 186.4.242.56 port 58878 ssh2
Mar 19 03:00:33 lock-38 sshd[81103]: Invalid user confluence from 186.4.242.56 port 36814
Mar 19 03:00:33 lock-38 sshd[81103]: Invalid user confluence from 186.4.242.56 port 36814
Mar 19 03:00:33 lock-38 sshd[81103]: Failed password for invalid user confluence from 186.4.242.56 port 36814 ssh2
...

Mar  1 17:51:54 ns381471 sshd[19569]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.4.242.56
Mar  1 17:51:55 ns381471 sshd[19569]: Failed password for invalid user nitish from 186.4.242.56 port 33560 ssh2

Unauthorized connection attempt detected from IP address 186.4.242.111 to port 80 [J]

SSH login attempts with user root at 2020-01-02.

Jul 29 20:14:35 [host] sshd[16457]: Invalid user sex from 159.65.225.184
Jul 29 20:14:35 [host] sshd[16457]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.65.225.184
Jul 29 20:14:37 [host] sshd[16457]: Failed password for invalid user sex from 159.65.225.184 port 40972 ssh2

Jul 29 20:11:17 lnxweb62 sshd[8436]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.227.96.190

20 attempts against mh-ssh on milky.magehost.pro

Jul 29 19:52:22 vmd17057 sshd\[22808\]: Invalid user test from 45.55.12.248 port 36448
Jul 29 19:52:22 vmd17057 sshd\[22808\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.55.12.248
Jul 29 19:52:24 vmd17057 sshd\[22808\]: Failed password for invalid user test from 45.55.12.248 port 36448 ssh2
...

Jul 29 20:30:51 OPSO sshd\[31292\]: Invalid user passsword from 154.221.31.241 port 43255
Jul 29 20:30:51 OPSO sshd\[31292\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=154.221.31.241
Jul 29 20:30:52 OPSO sshd\[31292\]: Failed password for invalid user passsword from 154.221.31.241 port 43255 ssh2
Jul 29 20:36:06 OPSO sshd\[32196\]: Invalid user dolores from 154.221.31.241 port 41615
Jul 29 20:36:06 OPSO sshd\[32196\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=154.221.31.241

(From frezed803@gmail.com) Hi there!

A visually pleasing website interface can really make a difference in attracting (and keeping) clients. Would you like to see your website reach the top of its game with powerful new upgrades and changes? 

I'm an expert in the WordPress website platform, as well as many other platforms and shopping carts software. If you're not familiar with those, then I'd like to show you how easy it is to build your site on platforms that give you an incredible number of features to make your products and services easier to market to people. I would also like to show you the portfolio of my work from my previous clients and how their businesses profited tremendously after the improvements that I've done for them. 

If you're interested, I'll give you more details and present to you a portfolio of what I've done for other clients' websites. I do all the work myself, to help you cut costs. If you want, we can also talk more about this in the next couple of days if that would work

Portscan or hack attempt detected by psad/fwsnort

Honeypot attack, port: 5555, PTR: PTR record not found

Jul 29 14:24:52 vps200512 sshd\[8866\]: Invalid user dulap from 59.9.31.195
Jul 29 14:24:52 vps200512 sshd\[8866\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=59.9.31.195
Jul 29 14:24:55 vps200512 sshd\[8866\]: Failed password for invalid user dulap from 59.9.31.195 port 56216 ssh2
Jul 29 14:30:02 vps200512 sshd\[8954\]: Invalid user Password%100 from 59.9.31.195
Jul 29 14:30:02 vps200512 sshd\[8954\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=59.9.31.195

20 attempts against mh-ssh on heat.magehost.pro

Jul 29 19:24:20 admin sendmail[29054]: x6THOIrl029054: 52.64.154.61.broad.zz.fj.dynamic.163data.com.cn [61.154.64.52] (may be forged) did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA
Jul 29 19:24:21 admin sendmail[29055]: x6THOK2o029055: 52.64.154.61.broad.zz.fj.dynamic.163data.com.cn [61.154.64.52] (may be forged) did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA
Jul 29 19:24:22 admin sendmail[29057]: x6THOLdj029057: 52.64.154.61.broad.zz.fj.dynamic.163data.com.cn [61.154.64.52] (may be forged) did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA
Jul 29 19:24:23 admin sendmail[29058]: x6THOMYb029058: 52.64.154.61.broad.zz.fj.dynamic.163data.com.cn [61.154.64.52] (may be forged) did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=61.154.64.52

Honeypot attack, port: 23, PTR: PTR record not found

SMB Server BruteForce Attack

Automatic report - Banned IP Access

Lines containing failures of 46.123.255.234
Jul 29 19:27:20 server01 postfix/smtpd[21228]: connect from APN-123-255-234-gprs.simobil.net[46.123.255.234]
Jul x@x
Jul x@x
Jul 29 19:27:22 server01 postfix/policy-spf[21236]: : Policy action=PREPEND Received-SPF: none (wardroplaw.com: No applicable sender policy available) receiver=x@x
Jul x@x


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=46.123.255.234