Time:     Wed Aug 26 03:53:24 2020 +0000
IP:       196.206.254.240 (adsl196-240-254-206-196.adsl196-8.iam.net.ma)
Failures: 5 (sshd)
Interval: 3600 seconds
Blocked:  Permanent Block [LF_SSHD]

Log entries:

Aug 26 03:45:08 ca-16-ede1 sshd[44010]: Invalid user grid from 196.206.254.240 port 52018
Aug 26 03:45:10 ca-16-ede1 sshd[44010]: Failed password for invalid user grid from 196.206.254.240 port 52018 ssh2
Aug 26 03:49:32 ca-16-ede1 sshd[44484]: Invalid user plano from 196.206.254.240 port 38316
Aug 26 03:49:34 ca-16-ede1 sshd[44484]: Failed password for invalid user plano from 196.206.254.240 port 38316 ssh2
Aug 26 03:53:20 ca-16-ede1 sshd[44914]: Invalid user s from 196.206.254.240 port 45320

2020-08-16T12:15:15.587708abusebot-5.cloudsearch.cf sshd[20318]: Invalid user pgsql from 196.206.254.240 port 47036
2020-08-16T12:15:15.594070abusebot-5.cloudsearch.cf sshd[20318]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=adsl196-240-254-206-196.adsl196-8.iam.net.ma
2020-08-16T12:15:15.587708abusebot-5.cloudsearch.cf sshd[20318]: Invalid user pgsql from 196.206.254.240 port 47036
2020-08-16T12:15:17.860372abusebot-5.cloudsearch.cf sshd[20318]: Failed password for invalid user pgsql from 196.206.254.240 port 47036 ssh2
2020-08-16T12:20:38.724341abusebot-5.cloudsearch.cf sshd[20369]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=adsl196-240-254-206-196.adsl196-8.iam.net.ma  user=root
2020-08-16T12:20:40.331611abusebot-5.cloudsearch.cf sshd[20369]: Failed password for root from 196.206.254.240 port 40498 ssh2
2020-08-16T12:24:31.328846abusebot-5.cloudsearch.cf sshd[20422]: Invalid user vishal from 196
...

Aug  8 05:55:16 ip40 sshd[14203]: Failed password for root from 196.206.254.240 port 49302 ssh2
...

Aug  7 06:15:53 rocket sshd[6449]: Failed password for root from 196.206.254.240 port 46312 ssh2
Aug  7 06:20:07 rocket sshd[7367]: Failed password for root from 196.206.254.240 port 57068 ssh2
...

SSH brutforce

Jul 11 22:43:42 srv-ubuntu-dev3 sshd[834]: Invalid user claudiane from 196.206.254.240
Jul 11 22:43:42 srv-ubuntu-dev3 sshd[834]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=196.206.254.240
Jul 11 22:43:42 srv-ubuntu-dev3 sshd[834]: Invalid user claudiane from 196.206.254.240
Jul 11 22:43:44 srv-ubuntu-dev3 sshd[834]: Failed password for invalid user claudiane from 196.206.254.240 port 46090 ssh2
Jul 11 22:46:52 srv-ubuntu-dev3 sshd[1421]: Invalid user nagios from 196.206.254.240
Jul 11 22:46:52 srv-ubuntu-dev3 sshd[1421]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=196.206.254.240
Jul 11 22:46:52 srv-ubuntu-dev3 sshd[1421]: Invalid user nagios from 196.206.254.240
Jul 11 22:46:54 srv-ubuntu-dev3 sshd[1421]: Failed password for invalid user nagios from 196.206.254.240 port 42650 ssh2
Jul 11 22:50:01 srv-ubuntu-dev3 sshd[1907]: Invalid user orela from 196.206.254.240
...

Jul  7 23:54:59 nas sshd[26412]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=196.206.254.240 
Jul  7 23:55:01 nas sshd[26412]: Failed password for invalid user user from 196.206.254.240 port 60446 ssh2
Jul  8 00:02:13 nas sshd[26900]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=196.206.254.240 
...

Jul  5 05:16:24 ws24vmsma01 sshd[55112]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=196.206.254.240
Jul  5 05:16:26 ws24vmsma01 sshd[55112]: Failed password for invalid user dk from 196.206.254.240 port 34422 ssh2
...

prod11
...

Jun 29 13:13:22 l03 sshd[18870]: Invalid user yq from 196.206.254.240 port 59854
...

Jun 28 20:19:55 gw1 sshd[24352]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=196.206.254.240
Jun 28 20:19:56 gw1 sshd[24352]: Failed password for invalid user kiwi from 196.206.254.240 port 43402 ssh2
...

Invalid user vet from 196.206.254.240 port 40840

invalid user

Jun 13 22:15:08 web1 sshd[3574]: Invalid user ht from 196.206.254.240 port 45048
Jun 13 22:15:08 web1 sshd[3574]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=196.206.254.240
Jun 13 22:15:08 web1 sshd[3574]: Invalid user ht from 196.206.254.240 port 45048
Jun 13 22:15:10 web1 sshd[3574]: Failed password for invalid user ht from 196.206.254.240 port 45048 ssh2
Jun 13 22:25:55 web1 sshd[6163]: Invalid user nfa from 196.206.254.240 port 33882
Jun 13 22:25:55 web1 sshd[6163]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=196.206.254.240
Jun 13 22:25:55 web1 sshd[6163]: Invalid user nfa from 196.206.254.240 port 33882
Jun 13 22:25:57 web1 sshd[6163]: Failed password for invalid user nfa from 196.206.254.240 port 33882 ssh2
Jun 13 22:29:19 web1 sshd[6933]: Invalid user luky from 196.206.254.240 port 34242
...

SSH brute-force: detected 8 distinct username(s) / 12 distinct password(s) within a 24-hour window.

Lines containing failures of 196.206.254.240 (max 1000)
Jun  9 09:31:14 localhost sshd[6295]: Invalid user admin from 196.206.254.240 port 36904
Jun  9 09:31:14 localhost sshd[6295]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=196.206.254.240 
Jun  9 09:31:16 localhost sshd[6295]: Failed password for invalid user admin from 196.206.254.240 port 36904 ssh2
Jun  9 09:31:17 localhost sshd[6295]: Received disconnect from 196.206.254.240 port 36904:11: Bye Bye [preauth]
Jun  9 09:31:17 localhost sshd[6295]: Disconnected from invalid user admin 196.206.254.240 port 36904 [preauth]
Jun  9 09:47:01 localhost sshd[10578]: Invalid user tear from 196.206.254.240 port 37808
Jun  9 09:47:01 localhost sshd[10578]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=196.206.254.240 
Jun  9 09:47:03 localhost sshd[10578]: Failed password for invalid user tear from 196.206.254.240 port 37808 ssh2
Jun  9 09:47........
------------------------------

Sep 22 14:16:00 piServer sshd[7668]: Failed password for root from 196.206.254.241 port 48282 ssh2
Sep 22 14:18:03 piServer sshd[7881]: Failed password for backup from 196.206.254.241 port 47304 ssh2
...

5x Failed Password

Sep 21 22:30:30 mout sshd[10008]: Invalid user visitante from 196.206.254.241 port 39456

SSH Brute-Forcing (server2)

Sep 17 05:23:06 ip106 sshd[13691]: Failed password for root from 196.206.254.241 port 44578 ssh2
...

Invalid user web from 196.206.254.241 port 57450

Triggered by Fail2Ban at Ares web server

Sep  7 04:32:53 scw-focused-cartwright sshd[17333]: Failed password for root from 196.206.254.241 port 56236 ssh2
Sep  7 04:47:14 scw-focused-cartwright sshd[17538]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=196.206.254.241

(sshd) Failed SSH login from 196.206.254.241 (MA/Morocco/adsl196-241-254-206-196.adsl196-8.iam.net.ma): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Sep  6 18:15:31 server sshd[15378]: Failed password for root from 196.206.254.241 port 59118 ssh2
Sep  6 18:19:57 server sshd[16597]: Invalid user guest from 196.206.254.241 port 33292
Sep  6 18:20:00 server sshd[16597]: Failed password for invalid user guest from 196.206.254.241 port 33292 ssh2
Sep  6 18:22:58 server sshd[17489]: Failed password for root from 196.206.254.241 port 51762 ssh2
Sep  6 18:26:11 server sshd[18528]: Invalid user tracker from 196.206.254.241 port 42008

(sshd) Failed SSH login from 196.206.254.241 (MA/Morocco/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Aug 31 04:15:41 server2 sshd[10393]: Invalid user user01 from 196.206.254.241
Aug 31 04:15:43 server2 sshd[10393]: Failed password for invalid user user01 from 196.206.254.241 port 50988 ssh2
Aug 31 04:20:43 server2 sshd[14725]: Invalid user sinusbot from 196.206.254.241
Aug 31 04:20:47 server2 sshd[14725]: Failed password for invalid user sinusbot from 196.206.254.241 port 58408 ssh2
Aug 31 04:25:38 server2 sshd[20180]: Invalid user elastic from 196.206.254.241

Invalid user by from 196.206.254.241 port 51502

Invalid user ts3 from 196.206.254.241 port 48422

Aug 25 11:30:33 dignus sshd[10537]: Invalid user del from 196.206.254.241 port 49850
Aug 25 11:30:33 dignus sshd[10537]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=196.206.254.241
Aug 25 11:30:36 dignus sshd[10537]: Failed password for invalid user del from 196.206.254.241 port 49850 ssh2
Aug 25 11:32:54 dignus sshd[10873]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=196.206.254.241  user=root
Aug 25 11:32:56 dignus sshd[10873]: Failed password for root from 196.206.254.241 port 60482 ssh2
...

Invalid user pdv from 196.206.254.241 port 53082

Aug 19 06:48:17 cosmoit sshd[17258]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=196.206.254.241

Unauthorized connection attempt detected from IP address 195.22.253.134 to port 23 [J]

Unauthorized connection attempt detected from IP address 176.105.105.54 to port 23 [J]

Unauthorized connection attempt detected from IP address 222.43.87.234 to port 23 [J]

unauthorized connection attempt

Unauthorized connection attempt detected from IP address 82.85.180.68 to port 83 [J]

Unauthorized connection attempt detected from IP address 116.103.37.21 to port 23 [J]

Unauthorized connection attempt detected from IP address 120.224.183.11 to port 23 [J]

Unauthorized connection attempt detected from IP address 79.36.127.31 to port 80 [J]

Unauthorized connection attempt detected from IP address 31.47.103.33 to port 8080 [J]

2020-01-19T11:55:26.029584scmdmz1 sshd[31126]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.30.57  user=root
2020-01-19T11:55:27.319833scmdmz1 sshd[31126]: Failed password for root from 222.186.30.57 port 35205 ssh2
2020-01-19T11:55:26.841405scmdmz1 sshd[31128]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.30.57  user=root
2020-01-19T11:55:28.132234scmdmz1 sshd[31128]: Failed password for root from 222.186.30.57 port 23496 ssh2
2020-01-19T11:55:26.029584scmdmz1 sshd[31126]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.30.57  user=root
2020-01-19T11:55:27.319833scmdmz1 sshd[31126]: Failed password for root from 222.186.30.57 port 35205 ssh2
2020-01-19T11:55:29.287848scmdmz1 sshd[31126]: Failed password for root from 222.186.30.57 port 35205 ssh2
...

Unauthorized connection attempt detected from IP address 85.110.132.75 to port 23 [J]

Unauthorized connection attempt detected from IP address 31.173.201.44 to port 8080 [J]

Unauthorized connection attempt detected from IP address 112.48.23.98 to port 1433 [J]

Unauthorized connection attempt detected from IP address 189.186.159.45 to port 4567 [J]

Unauthorized connection attempt detected from IP address 59.23.126.56 to port 23 [J]