(sshd) Failed SSH login from 192.34.61.49 (US/United States/zap-asia.com): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Feb 17 08:03:53 elude sshd[32175]: Invalid user PlcmSpIp from 192.34.61.49 port 57459
Feb 17 08:03:54 elude sshd[32175]: Failed password for invalid user PlcmSpIp from 192.34.61.49 port 57459 ssh2
Feb 17 08:18:44 elude sshd[711]: Invalid user Test from 192.34.61.49 port 43563
Feb 17 08:18:45 elude sshd[711]: Failed password for invalid user Test from 192.34.61.49 port 43563 ssh2
Feb 17 08:22:02 elude sshd[971]: Invalid user testtest from 192.34.61.49 port 58224

Feb 13 21:12:28 dedicated sshd[21279]: Invalid user q from 192.34.61.49 port 59296

Feb  9 07:10:51 legacy sshd[5395]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.34.61.49
Feb  9 07:10:52 legacy sshd[5395]: Failed password for invalid user mfk from 192.34.61.49 port 37682 ssh2
Feb  9 07:14:25 legacy sshd[5629]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.34.61.49
...

*Port Scan* detected from 192.34.61.49 (US/United States/zap-asia.com). 4 hits in the last 280 seconds

Unauthorized connection attempt detected from IP address 192.34.61.49 to port 2220 [J]

Dec 21 12:29:51 gw1 sshd[17723]: Failed password for sync from 192.34.61.49 port 33413 ssh2
...

Dec 18 11:04:12 localhost sshd[57727]: Failed password for invalid user breiter from 192.34.61.49 port 46822 ssh2
Dec 18 11:16:40 localhost sshd[58206]: Failed password for root from 192.34.61.49 port 59146 ssh2
Dec 18 11:24:51 localhost sshd[58543]: Failed password for invalid user mysql from 192.34.61.49 port 35292 ssh2

Invalid user admin from 192.34.61.49 port 54952

Dec 10 12:13:56 Ubuntu-1404-trusty-64-minimal sshd\[3288\]: Invalid user hartenstein from 192.34.61.49
Dec 10 12:13:56 Ubuntu-1404-trusty-64-minimal sshd\[3288\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.34.61.49
Dec 10 12:13:57 Ubuntu-1404-trusty-64-minimal sshd\[3288\]: Failed password for invalid user hartenstein from 192.34.61.49 port 56727 ssh2
Dec 10 12:23:38 Ubuntu-1404-trusty-64-minimal sshd\[13574\]: Invalid user miel from 192.34.61.49
Dec 10 12:23:38 Ubuntu-1404-trusty-64-minimal sshd\[13574\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.34.61.49

ssh intrusion attempt

Invalid user smoke from 192.34.61.49 port 43613

Nov 26 23:48:30 ns382633 sshd\[9638\]: Invalid user ts3ovh from 192.34.61.49 port 43653
Nov 26 23:48:30 ns382633 sshd\[9638\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.34.61.49
Nov 26 23:48:33 ns382633 sshd\[9638\]: Failed password for invalid user ts3ovh from 192.34.61.49 port 43653 ssh2
Nov 26 23:55:05 ns382633 sshd\[10973\]: Invalid user samdra from 192.34.61.49 port 34005
Nov 26 23:55:05 ns382633 sshd\[10973\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.34.61.49

Nov 24 22:46:20 hanapaa sshd\[26438\]: Invalid user arabele from 192.34.61.49
Nov 24 22:46:20 hanapaa sshd\[26438\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.34.61.49
Nov 24 22:46:21 hanapaa sshd\[26438\]: Failed password for invalid user arabele from 192.34.61.49 port 34185 ssh2
Nov 24 22:52:34 hanapaa sshd\[26945\]: Invalid user public321 from 192.34.61.49
Nov 24 22:52:34 hanapaa sshd\[26945\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.34.61.49

Nov 15 11:24:57 mout sshd[11276]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.34.61.49  user=root
Nov 15 11:24:59 mout sshd[11276]: Failed password for root from 192.34.61.49 port 47527 ssh2

Nov 14 00:35:07 eventyay sshd[32622]: Failed password for root from 192.34.61.49 port 34363 ssh2
Nov 14 00:40:19 eventyay sshd[329]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.34.61.49
Nov 14 00:40:21 eventyay sshd[329]: Failed password for invalid user stivender from 192.34.61.49 port 53447 ssh2
...

Nov 13 07:13:00 ovpn sshd\[12522\]: Invalid user osni from 192.34.61.49
Nov 13 07:13:00 ovpn sshd\[12522\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.34.61.49
Nov 13 07:13:03 ovpn sshd\[12522\]: Failed password for invalid user osni from 192.34.61.49 port 33548 ssh2
Nov 13 07:28:28 ovpn sshd\[15825\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.34.61.49  user=proxy
Nov 13 07:28:30 ovpn sshd\[15825\]: Failed password for proxy from 192.34.61.49 port 52777 ssh2

(PERMBLOCK) 192.34.61.86 (US/United States/346681.cloudwaysapps.com) has had more than 4 temp blocks in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_PERMBLOCK_COUNT; Logs:

192.34.61.86 - - [12/Oct/2020:05:27:33 +0100] "POST /wp-login.php HTTP/1.1" 200 4425 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
192.34.61.86 - - [12/Oct/2020:05:27:39 +0100] "POST /wp-login.php HTTP/1.1" 200 4425 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
192.34.61.86 - - [12/Oct/2020:05:27:50 +0100] "POST /wp-login.php HTTP/1.1" 200 4425 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
...

2020-07-28T14:07:58.541824ks3355764 sshd[14121]: Invalid user wangxq from 192.34.61.161 port 47988
2020-07-28T14:08:00.733448ks3355764 sshd[14121]: Failed password for invalid user wangxq from 192.34.61.161 port 47988 ssh2
...

2020-07-27T20:09:03.367415shield sshd\[5113\]: Invalid user dondo from 192.34.61.161 port 60476
2020-07-27T20:09:03.378511shield sshd\[5113\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.34.61.161
2020-07-27T20:09:05.674486shield sshd\[5113\]: Failed password for invalid user dondo from 192.34.61.161 port 60476 ssh2
2020-07-27T20:13:50.767794shield sshd\[5721\]: Invalid user shishengjie from 192.34.61.161 port 45752
2020-07-27T20:13:50.778515shield sshd\[5721\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.34.61.161

Jul  1 04:53:43 ahost sshd[31600]: Invalid user mig from 192.34.61.161
Jul  1 04:53:43 ahost sshd[31600]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.34.61.161 
Jul  1 04:53:45 ahost sshd[31600]: Failed password for invalid user mig from 192.34.61.161 port 54576 ssh2
Jul  1 04:53:45 ahost sshd[31600]: Received disconnect from 192.34.61.161: 11: Bye Bye [preauth]
Jul  1 05:03:48 ahost sshd[2262]: Invalid user rocky from 192.34.61.161
Jul  1 05:03:48 ahost sshd[2262]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.34.61.161 
Jul  1 05:03:49 ahost sshd[2262]: Failed password for invalid user rocky from 192.34.61.161 port 46994 ssh2
Jul  1 05:03:50 ahost sshd[2262]: Received disconnect from 192.34.61.161: 11: Bye Bye [preauth]
Jul  1 05:06:56 ahost sshd[2328]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.34.61.161  user=postgres
Jul  1 0........
------------------------------

SSH login attempts with user root.

192.34.61.156 - - [18/Jul/2019:03:21:23 +0200] "GET /wp-login.php HTTP/1.1" 200 1301 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
192.34.61.156 - - [18/Jul/2019:03:21:29 +0200] "POST /wp-login.php HTTP/1.1" 200 1704 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
192.34.61.156 - - [18/Jul/2019:03:21:29 +0200] "GET /wp-login.php HTTP/1.1" 200 1301 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
192.34.61.156 - - [18/Jul/2019:03:21:30 +0200] "POST /wp-login.php HTTP/1.1" 200 1710 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
192.34.61.156 - - [18/Jul/2019:03:21:35 +0200] "GET /wp-login.php HTTP/1.1" 200 1301 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
192.34.61.156 - - [18/Jul/2019:03:21:41 +0200] "POST /wp-login.php HTTP/1.1" 200 1710 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
...

2020-06-12T09:16:03.824649afi-git.jinr.ru sshd[1492]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.178.64
2020-06-12T09:16:03.821410afi-git.jinr.ru sshd[1492]: Invalid user medias from 138.68.178.64 port 58910
2020-06-12T09:16:05.383799afi-git.jinr.ru sshd[1492]: Failed password for invalid user medias from 138.68.178.64 port 58910 ssh2
2020-06-12T09:19:30.927313afi-git.jinr.ru sshd[2356]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.178.64  user=root
2020-06-12T09:19:33.238935afi-git.jinr.ru sshd[2356]: Failed password for root from 138.68.178.64 port 60244 ssh2
...

2020-06-12T11:26:09.323717wiz-ks3 sshd[11603]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.175.167  user=root
2020-06-12T11:26:11.062067wiz-ks3 sshd[11603]: Failed password for root from 222.186.175.167 port 25160 ssh2
2020-06-12T11:26:13.737318wiz-ks3 sshd[11603]: Failed password for root from 222.186.175.167 port 25160 ssh2
2020-06-12T11:26:09.323717wiz-ks3 sshd[11603]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.175.167  user=root
2020-06-12T11:26:11.062067wiz-ks3 sshd[11603]: Failed password for root from 222.186.175.167 port 25160 ssh2
2020-06-12T11:26:13.737318wiz-ks3 sshd[11603]: Failed password for root from 222.186.175.167 port 25160 ssh2
2020-06-12T11:26:09.323717wiz-ks3 sshd[11603]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.175.167  user=root
2020-06-12T11:26:11.062067wiz-ks3 sshd[11603]: Failed password for root from 222.186.175.167 port 2516

3 attempts against mh-modsecurity-ban on milky

Jun 12 10:54:06 electroncash sshd[18252]: Failed password for root from 178.128.218.56 port 39372 ssh2
Jun 12 10:58:55 electroncash sshd[19483]: Invalid user znyjjszx from 178.128.218.56 port 41572
Jun 12 10:58:55 electroncash sshd[19483]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.218.56 
Jun 12 10:58:55 electroncash sshd[19483]: Invalid user znyjjszx from 178.128.218.56 port 41572
Jun 12 10:58:57 electroncash sshd[19483]: Failed password for invalid user znyjjszx from 178.128.218.56 port 41572 ssh2
...

Unauthorised connection attempt detected at AUO FR1 NODE2. System is sshd. Protected by AUO Stack Web Application Firewall (WAF)

Invalid user cynthia from 94.247.179.224 port 37314

[2020-06-12 04:57:38] NOTICE[1273] chan_sip.c: Registration from '' failed for '62.171.144.195:56969' - Wrong password
[2020-06-12 04:57:38] SECURITY[1288] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-06-12T04:57:38.348-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="secret200",SessionID="0x7f31c0037328",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/62.171.144.195/56969",Challenge="2e1f8e80",ReceivedChallenge="2e1f8e80",ReceivedHash="b42bb4f496cda9850dacc5f4ad3410d8"
[2020-06-12 05:01:36] NOTICE[1273] chan_sip.c: Registration from '' failed for '62.171.144.195:37820' - Wrong password
[2020-06-12 05:01:36] SECURITY[1288] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-06-12T05:01:36.222-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="qaz201",SessionID="0x7f31c02f7128",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/
...

Jun 12 08:45:30 localhost sshd\[5123\]: Invalid user chrony from 51.91.78.238 port 55358
Jun 12 08:45:30 localhost sshd\[5123\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.91.78.238
Jun 12 08:45:32 localhost sshd\[5123\]: Failed password for invalid user chrony from 51.91.78.238 port 55358 ssh2
...

Jun 12 06:18:04 ws24vmsma01 sshd[15751]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.235.0.207
Jun 12 06:18:07 ws24vmsma01 sshd[15751]: Failed password for invalid user skynet from 188.235.0.207 port 50952 ssh2
...

2020-06-12T11:01:36.531947mail.broermann.family sshd[16193]: Failed password for root from 104.248.182.179 port 57258 ssh2
2020-06-12T11:03:52.076180mail.broermann.family sshd[16400]: Invalid user renato from 104.248.182.179 port 55714
2020-06-12T11:03:52.080607mail.broermann.family sshd[16400]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.182.179
2020-06-12T11:03:52.076180mail.broermann.family sshd[16400]: Invalid user renato from 104.248.182.179 port 55714
2020-06-12T11:03:53.939541mail.broermann.family sshd[16400]: Failed password for invalid user renato from 104.248.182.179 port 55714 ssh2
...

Jun 12 07:08:18 meumeu sshd[299248]: Invalid user xdzhang from 201.235.19.122 port 34631
Jun 12 07:08:18 meumeu sshd[299248]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.235.19.122 
Jun 12 07:08:18 meumeu sshd[299248]: Invalid user xdzhang from 201.235.19.122 port 34631
Jun 12 07:08:20 meumeu sshd[299248]: Failed password for invalid user xdzhang from 201.235.19.122 port 34631 ssh2
Jun 12 07:12:51 meumeu sshd[299576]: Invalid user frxu from 201.235.19.122 port 36270
Jun 12 07:12:51 meumeu sshd[299576]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.235.19.122 
Jun 12 07:12:51 meumeu sshd[299576]: Invalid user frxu from 201.235.19.122 port 36270
Jun 12 07:12:53 meumeu sshd[299576]: Failed password for invalid user frxu from 201.235.19.122 port 36270 ssh2
Jun 12 07:17:31 meumeu sshd[299807]: Invalid user oracle from 201.235.19.122 port 37910
...

2020-06-12T02:46:28.600266devel sshd[26102]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.123.253.220  user=root
2020-06-12T02:46:30.371710devel sshd[26102]: Failed password for root from 175.123.253.220 port 40076 ssh2
2020-06-12T02:48:34.437675devel sshd[26228]: Invalid user admin from 175.123.253.220 port 44484

$f2bV_matches

sshd: Failed password for .... from 78.42.135.89 port 41422 ssh2 (5 attempts)

Automatic report - XMLRPC Attack