Sep 15 16:20:32 host sshd[12111]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=dsl-emcali-200.29.120.146.emcali.net.co  user=root
Sep 15 16:20:33 host sshd[12111]: Failed password for root from 200.29.120.146 port 37130 ssh2
...

Sep 15 13:06:34 vmd17057 sshd[25369]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.29.120.146 
Sep 15 13:06:36 vmd17057 sshd[25369]: Failed password for invalid user web3 from 200.29.120.146 port 60054 ssh2
...

Invalid user fabienne from 200.29.120.146 port 38248

Aug 24 13:51:16 abendstille sshd\[3478\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.29.120.146  user=root
Aug 24 13:51:18 abendstille sshd\[3478\]: Failed password for root from 200.29.120.146 port 57558 ssh2
Aug 24 13:53:37 abendstille sshd\[5752\]: Invalid user mozilla from 200.29.120.146
Aug 24 13:53:37 abendstille sshd\[5752\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.29.120.146
Aug 24 13:53:39 abendstille sshd\[5752\]: Failed password for invalid user mozilla from 200.29.120.146 port 58428 ssh2
...

2020-08-24T12:02:57.540955mail.standpoint.com.ua sshd[18032]: Invalid user deploy from 200.29.120.146 port 54512
2020-08-24T12:02:57.544529mail.standpoint.com.ua sshd[18032]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=dsl-emcali-200.29.120.146.emcali.net.co
2020-08-24T12:02:57.540955mail.standpoint.com.ua sshd[18032]: Invalid user deploy from 200.29.120.146 port 54512
2020-08-24T12:02:59.243273mail.standpoint.com.ua sshd[18032]: Failed password for invalid user deploy from 200.29.120.146 port 54512 ssh2
2020-08-24T12:05:51.009625mail.standpoint.com.ua sshd[18565]: Invalid user shelly from 200.29.120.146 port 35156
...

Repeated brute force against a port

Aug 19 20:56:38 Invalid user teach from 200.29.120.146 port 50062

Bruteforce detected by fail2ban

200.29.120.94 (CO/Colombia/-), 6 distributed sshd attacks on account [root] in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_DISTATTACK; Logs: Oct  8 14:35:54 server sshd[27117]: Failed password for root from 200.29.120.94 port 34524 ssh2
Oct  8 14:17:44 server sshd[22719]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.199.123.211  user=root
Oct  8 14:17:47 server sshd[22719]: Failed password for root from 114.199.123.211 port 36574 ssh2
Oct  8 14:32:03 server sshd[26476]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=174.138.52.50  user=root
Oct  8 14:32:05 server sshd[26476]: Failed password for root from 174.138.52.50 port 38286 ssh2
Oct  8 14:39:46 server sshd[27769]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.170.13.225  user=root

IP Addresses Blocked:

sshd: Failed password for .... from 200.29.120.94 port 56106 ssh2 (8 attempts)

2020-06-09T17:26:05.463576ns386461 sshd\[24026\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=dsl-emcali-200.29.120.94.emcali.net.co  user=root
2020-06-09T17:26:07.978509ns386461 sshd\[24026\]: Failed password for root from 200.29.120.94 port 45996 ssh2
2020-06-09T17:36:49.186139ns386461 sshd\[1568\]: Invalid user betteti from 200.29.120.94 port 36092
2020-06-09T17:36:49.189801ns386461 sshd\[1568\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=dsl-emcali-200.29.120.94.emcali.net.co
2020-06-09T17:36:51.118223ns386461 sshd\[1568\]: Failed password for invalid user betteti from 200.29.120.94 port 36092 ssh2
...

Apr 10 00:38:38 NPSTNNYC01T sshd[24395]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.29.120.196
Apr 10 00:38:41 NPSTNNYC01T sshd[24395]: Failed password for invalid user postgres from 200.29.120.196 port 55168 ssh2
Apr 10 00:47:00 NPSTNNYC01T sshd[25333]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.29.120.196
...

Mar  1 16:27:41  sshd\[21107\]: Invalid user monitor from 200.29.120.196Mar  1 16:27:44  sshd\[21107\]: Failed password for invalid user monitor from 200.29.120.196 port 51218 ssh2
...

Failed password for invalid user flr from 200.29.120.196 port 55872 ssh2
Invalid user rdr from 200.29.120.196 port 54390
pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.29.120.196
Failed password for invalid user rdr from 200.29.120.196 port 54390 ssh2
Invalid user dzv from 200.29.120.196 port 52934

2020-02-04T00:30:20.071117host3.slimhost.com.ua sshd[1934538]: Invalid user guest from 200.29.120.196 port 59598
2020-02-04T00:30:20.077080host3.slimhost.com.ua sshd[1934538]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=dsl-emcali-200.29.120.196.emcali.net.co
2020-02-04T00:30:20.071117host3.slimhost.com.ua sshd[1934538]: Invalid user guest from 200.29.120.196 port 59598
2020-02-04T00:30:22.007527host3.slimhost.com.ua sshd[1934538]: Failed password for invalid user guest from 200.29.120.196 port 59598 ssh2
2020-02-04T00:53:34.426596host3.slimhost.com.ua sshd[1962906]: Invalid user test from 200.29.120.196 port 38630
2020-02-04T00:53:34.432326host3.slimhost.com.ua sshd[1962906]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=dsl-emcali-200.29.120.196.emcali.net.co
2020-02-04T00:53:34.426596host3.slimhost.com.ua sshd[1962906]: Invalid user test from 200.29.120.196 port 38630
2020-02-04T00:53:36.600288host
...

Jan 31 09:44:53 pkdns2 sshd\[48153\]: Invalid user mahalakshmi from 200.29.120.196Jan 31 09:44:55 pkdns2 sshd\[48153\]: Failed password for invalid user mahalakshmi from 200.29.120.196 port 43432 ssh2Jan 31 09:48:21 pkdns2 sshd\[48414\]: Invalid user bhadrang from 200.29.120.196Jan 31 09:48:24 pkdns2 sshd\[48414\]: Failed password for invalid user bhadrang from 200.29.120.196 port 38876 ssh2Jan 31 09:51:54 pkdns2 sshd\[48598\]: Invalid user ilavalagi from 200.29.120.196Jan 31 09:51:56 pkdns2 sshd\[48598\]: Failed password for invalid user ilavalagi from 200.29.120.196 port 34326 ssh2
...

Jan 17 17:18:11 ny01 sshd[31475]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.29.120.196
Jan 17 17:18:13 ny01 sshd[31475]: Failed password for invalid user adsl from 200.29.120.196 port 48264 ssh2
Jan 17 17:22:47 ny01 sshd[31893]: Failed password for root from 200.29.120.196 port 51160 ssh2

Unauthorized connection attempt detected from IP address 200.29.120.94 to port 22

Invalid user rod from 200.29.120.196 port 58464

Jun 27 09:44:57 vserver sshd\[13474\]: Invalid user admin from 200.29.120.94Jun 27 09:44:59 vserver sshd\[13474\]: Failed password for invalid user admin from 200.29.120.94 port 46230 ssh2Jun 27 09:47:30 vserver sshd\[13495\]: Invalid user oracle from 200.29.120.94Jun 27 09:47:31 vserver sshd\[13495\]: Failed password for invalid user oracle from 200.29.120.94 port 34836 ssh2
...

May  5 00:08:02 ms-srv sshd[55785]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.49.138.69
May  5 00:08:04 ms-srv sshd[55785]: Failed password for invalid user adam from 181.49.138.69 port 36616 ssh2

2020-05-04 18:07:25.513653-0500  localhost sshd[91033]: Failed password for invalid user alex from 51.178.24.61 port 56994 ssh2

May  4 23:01:34 buvik sshd[13259]: Invalid user gala from 177.44.208.107
May  4 23:01:34 buvik sshd[13259]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.44.208.107
May  4 23:01:36 buvik sshd[13259]: Failed password for invalid user gala from 177.44.208.107 port 42400 ssh2
...

Server attack

May  5 02:24:53 legacy sshd[14994]: Failed password for root from 218.92.0.189 port 44656 ssh2
May  5 02:24:55 legacy sshd[14994]: Failed password for root from 218.92.0.189 port 44656 ssh2
May  5 02:24:57 legacy sshd[14994]: Failed password for root from 218.92.0.189 port 44656 ssh2
...

May  5 02:39:39 vps sshd[762840]: Failed password for root from 222.186.31.83 port 48980 ssh2
May  5 02:39:41 vps sshd[762840]: Failed password for root from 222.186.31.83 port 48980 ssh2
May  5 02:39:43 vps sshd[763447]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.31.83  user=root
May  5 02:39:45 vps sshd[763447]: Failed password for root from 222.186.31.83 port 25528 ssh2
May  5 02:39:47 vps sshd[763447]: Failed password for root from 222.186.31.83 port 25528 ssh2
...

May  4 19:50:24 vps46666688 sshd[15052]: Failed password for root from 13.81.24.185 port 2048 ssh2
...

firewall-block, port(s): 25281/tcp

May  5 01:45:05 ift sshd\[51279\]: Invalid user ubuntu from 122.51.69.116May  5 01:45:07 ift sshd\[51279\]: Failed password for invalid user ubuntu from 122.51.69.116 port 50456 ssh2May  5 01:47:42 ift sshd\[51757\]: Invalid user dome from 122.51.69.116May  5 01:47:45 ift sshd\[51757\]: Failed password for invalid user dome from 122.51.69.116 port 60772 ssh2May  5 01:50:11 ift sshd\[52096\]: Failed password for root from 122.51.69.116 port 42842 ssh2
...

May  4 21:00:17 localhost sshd[102612]: Invalid user ranjbar from 203.172.66.216 port 44706
May  4 21:00:17 localhost sshd[102612]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.172.66.216
May  4 21:00:17 localhost sshd[102612]: Invalid user ranjbar from 203.172.66.216 port 44706
May  4 21:00:19 localhost sshd[102612]: Failed password for invalid user ranjbar from 203.172.66.216 port 44706 ssh2
May  4 21:03:31 localhost sshd[102905]: Invalid user tester from 203.172.66.216 port 38168
...

3x Failed Password

May  4 16:38:31 pixelmemory sshd[313912]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.196.4.163 
May  4 16:38:31 pixelmemory sshd[313912]: Invalid user wy from 104.196.4.163 port 57882
May  4 16:38:33 pixelmemory sshd[313912]: Failed password for invalid user wy from 104.196.4.163 port 57882 ssh2
May  4 16:51:05 pixelmemory sshd[316142]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.196.4.163  user=root
May  4 16:51:07 pixelmemory sshd[316142]: Failed password for root from 104.196.4.163 port 40506 ssh2
...

May  4 22:18:40 home sshd[23237]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.136.105.190
May  4 22:18:42 home sshd[23237]: Failed password for invalid user one from 152.136.105.190 port 45128 ssh2
May  4 22:23:09 home sshd[24033]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.136.105.190
...

xmlrpc attack

Honeypot attack, port: 445, PTR: 200-206-26-173.plastunion.com.br.