Unauthorized connection attempt detected from IP address 200.85.4.121 to port 2220 [J]

Unauthorized connection attempt detected from IP address 200.85.4.121 to port 2220 [J]

Mar  3 23:10:27 jane sshd[14140]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.85.40.118 
Mar  3 23:10:29 jane sshd[14140]: Failed password for invalid user support from 200.85.40.118 port 45889 ssh2
...

Dec 28 15:12:19 zeus sshd[29051]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.85.48.30 
Dec 28 15:12:21 zeus sshd[29051]: Failed password for invalid user server from 200.85.48.30 port 34884 ssh2
Dec 28 15:14:43 zeus sshd[29132]: Failed password for root from 200.85.48.30 port 44035 ssh2

Dec 25 01:28:32 minden010 sshd[32272]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.85.48.30
Dec 25 01:28:34 minden010 sshd[32272]: Failed password for invalid user Leena from 200.85.48.30 port 57166 ssh2
Dec 25 01:30:41 minden010 sshd[569]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.85.48.30
...

Dec 24 02:08:04 mockhub sshd[27959]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.85.48.30
Dec 24 02:08:06 mockhub sshd[27959]: Failed password for invalid user test from 200.85.48.30 port 42778 ssh2
...

$f2bV_matches

Dec 18 18:55:22 hosting sshd[6511]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.85.48.30  user=root
Dec 18 18:55:24 hosting sshd[6511]: Failed password for root from 200.85.48.30 port 43430 ssh2
...

Dec 16 09:56:49 linuxvps sshd\[34567\]: Invalid user www from 200.85.48.30
Dec 16 09:56:49 linuxvps sshd\[34567\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.85.48.30
Dec 16 09:56:52 linuxvps sshd\[34567\]: Failed password for invalid user www from 200.85.48.30 port 56874 ssh2
Dec 16 10:05:59 linuxvps sshd\[40486\]: Invalid user f001 from 200.85.48.30
Dec 16 10:05:59 linuxvps sshd\[40486\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.85.48.30

Dec 13 23:51:41 vibhu-HP-Z238-Microtower-Workstation sshd\[17406\]: Invalid user george87 from 200.85.48.30
Dec 13 23:51:41 vibhu-HP-Z238-Microtower-Workstation sshd\[17406\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.85.48.30
Dec 13 23:51:43 vibhu-HP-Z238-Microtower-Workstation sshd\[17406\]: Failed password for invalid user george87 from 200.85.48.30 port 56910 ssh2
Dec 14 00:00:02 vibhu-HP-Z238-Microtower-Workstation sshd\[19202\]: Invalid user ytrewqhgfdsa from 200.85.48.30
Dec 14 00:00:02 vibhu-HP-Z238-Microtower-Workstation sshd\[19202\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.85.48.30
...

Dec 12 03:44:35 ws19vmsma01 sshd[127021]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.85.48.30
Dec 12 03:44:38 ws19vmsma01 sshd[127021]: Failed password for invalid user boicelli from 200.85.48.30 port 34765 ssh2
...

2019-12-10T01:20:31.740358ns547587 sshd\[12619\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.85.48.30  user=root
2019-12-10T01:20:33.612424ns547587 sshd\[12619\]: Failed password for root from 200.85.48.30 port 46751 ssh2
2019-12-10T01:28:46.518749ns547587 sshd\[25969\]: Invalid user cailleteau from 200.85.48.30 port 51104
2019-12-10T01:28:46.520700ns547587 sshd\[25969\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.85.48.30
...

Dec  7 14:35:19 php1 sshd\[23369\]: Invalid user nebb from 200.85.48.30
Dec  7 14:35:19 php1 sshd\[23369\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.85.48.30
Dec  7 14:35:21 php1 sshd\[23369\]: Failed password for invalid user nebb from 200.85.48.30 port 44648 ssh2
Dec  7 14:43:39 php1 sshd\[24354\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.85.48.30  user=root
Dec  7 14:43:41 php1 sshd\[24354\]: Failed password for root from 200.85.48.30 port 50198 ssh2

Invalid user jpg from 200.85.48.30 port 57196

Nov 20 06:11:14 master sshd[25005]: Failed password for root from 200.85.48.30 port 56490 ssh2
Nov 20 06:28:36 master sshd[25154]: Failed password for invalid user jpg from 200.85.48.30 port 54183 ssh2
Nov 20 06:33:21 master sshd[25465]: Failed password for invalid user wcsuser from 200.85.48.30 port 46767 ssh2
Nov 20 06:39:26 master sshd[25473]: Failed password for invalid user valarie from 200.85.48.30 port 39743 ssh2
Nov 20 06:44:20 master sshd[25479]: Failed password for invalid user server from 200.85.48.30 port 60590 ssh2
Nov 20 06:49:20 master sshd[25494]: Failed password for sshd from 200.85.48.30 port 53580 ssh2
Nov 20 06:54:17 master sshd[25500]: Failed password for invalid user smmsp from 200.85.48.30 port 46194 ssh2
Nov 20 06:59:06 master sshd[25508]: Failed password for invalid user sinaya from 200.85.48.30 port 38775 ssh2
Nov 20 07:03:57 master sshd[25820]: Failed password for invalid user hh from 200.85.48.30 port 59642 ssh2
Nov 20 07:08:55 master sshd[25832]: Failed password for invalid user g

Nov 20 05:25:56 venus sshd\[22782\]: Invalid user User2 from 200.85.48.30 port 59743
Nov 20 05:25:56 venus sshd\[22782\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.85.48.30
Nov 20 05:25:57 venus sshd\[22782\]: Failed password for invalid user User2 from 200.85.48.30 port 59743 ssh2
...

Automatic report - Banned IP Access

508. On Jun 8 2020 experienced a Brute Force SSH login attempt -> 3 unique times by 212.239.177.39.

Jun  8 23:50:54 gestao sshd[5373]: Failed password for mail from 51.38.236.221 port 43852 ssh2
Jun  8 23:56:58 gestao sshd[5650]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.236.221 
Jun  8 23:57:00 gestao sshd[5650]: Failed password for invalid user tr from 51.38.236.221 port 47004 ssh2
...

20/6/8@16:24:12: FAIL: Alarm-Network address from=37.190.37.217
...

Jun  9 00:32:03 web01.agentur-b-2.de dovecot: pop3-login: Aborted login (auth failed, 1 attempts in 2 secs): user=, method=PLAIN, rip=89.248.168.2, lip=185.118.198.210, session=
Jun  9 00:32:17 web01.agentur-b-2.de dovecot: pop3-login: Aborted login (auth failed, 1 attempts in 6 secs): user=, method=PLAIN, rip=89.248.168.2, lip=185.118.198.210, session=
Jun  9 00:32:38 web01.agentur-b-2.de dovecot: pop3-login: Aborted login (auth failed, 1 attempts in 2 secs): user=, method=PLAIN, rip=89.248.168.2, lip=185.118.198.210, session=
Jun  9 00:33:05 web01.agentur-b-2.de dovecot: pop3-login: Aborted login (auth failed, 1 attempts in 2 secs): user=, method=PLAIN, rip=89.248.168.2, lip=185.118.198.210, session=
Jun  9 00:35:25 web01.agentur-b-2.de dovecot: pop3-login: Aborted login (auth failed, 1 attempts in 2 secs): user=, method=PLAIN, rip=

Hacking

Jun  8 23:41:24 lnxded63 sshd[26328]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.69.222.71

IP 183.63.237.78 attacked honeypot on port: 139 at 6/8/2020 9:23:52 PM

Jun  9 00:57:02 lnxweb62 sshd[28443]: Failed password for root from 49.231.201.242 port 49392 ssh2
Jun  9 00:57:02 lnxweb62 sshd[28443]: Failed password for root from 49.231.201.242 port 49392 ssh2
Jun  9 01:00:56 lnxweb62 sshd[30753]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.231.201.242

Jun  9 06:24:24 NG-HHDC-SVS-001 sshd[21006]: Invalid user oracle from 139.59.3.114
...

2020-06-09T01:02:42.646797lavrinenko.info sshd[2778]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.35.76.241
2020-06-09T01:02:42.636922lavrinenko.info sshd[2778]: Invalid user admin from 211.35.76.241 port 42456
2020-06-09T01:02:44.527220lavrinenko.info sshd[2778]: Failed password for invalid user admin from 211.35.76.241 port 42456 ssh2
2020-06-09T01:05:45.717706lavrinenko.info sshd[2916]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.35.76.241  user=root
2020-06-09T01:05:47.718163lavrinenko.info sshd[2916]: Failed password for root from 211.35.76.241 port 35065 ssh2
...

Jun  8 23:39:37 meumeu sshd[22190]: Invalid user 4321ABCD from 216.45.23.6 port 42850
Jun  8 23:39:37 meumeu sshd[22190]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.45.23.6 
Jun  8 23:39:37 meumeu sshd[22190]: Invalid user 4321ABCD from 216.45.23.6 port 42850
Jun  8 23:39:39 meumeu sshd[22190]: Failed password for invalid user 4321ABCD from 216.45.23.6 port 42850 ssh2
Jun  8 23:43:50 meumeu sshd[22348]: Invalid user olive from 216.45.23.6 port 42674
Jun  8 23:43:50 meumeu sshd[22348]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.45.23.6 
Jun  8 23:43:50 meumeu sshd[22348]: Invalid user olive from 216.45.23.6 port 42674
Jun  8 23:43:52 meumeu sshd[22348]: Failed password for invalid user olive from 216.45.23.6 port 42674 ssh2
Jun  8 23:47:57 meumeu sshd[22456]: Invalid user 1234 from 216.45.23.6 port 42498
...

2020-06-08 dovecot_plain authenticator failed for \(localhost\) \[77.40.2.104\]: 535 Incorrect authentication data \(set_id=web@**REMOVED**.de\)
2020-06-08 dovecot_login authenticator failed for \(localhost\) \[77.40.2.104\]: 535 Incorrect authentication data \(set_id=web@**REMOVED**.de\)
2020-06-08 dovecot_plain authenticator failed for \(localhost\) \[77.40.2.104\]: 535 Incorrect authentication data \(set_id=spam@**REMOVED**.org\)

SSH brute-force: detected 10 distinct username(s) / 14 distinct password(s) within a 24-hour window.

Jun  9 00:04:31 statusweb1.srvfarm.net postfix/smtpd[4195]: warning: unknown[87.246.7.70]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jun  9 00:05:26 statusweb1.srvfarm.net postfix/smtpd[4195]: warning: unknown[87.246.7.70]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jun  9 00:06:21 statusweb1.srvfarm.net postfix/smtpd[4195]: warning: unknown[87.246.7.70]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jun  9 00:07:13 statusweb1.srvfarm.net postfix/smtpd[4195]: warning: unknown[87.246.7.70]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jun  9 00:08:07 statusweb1.srvfarm.net postfix/smtpd[4043]: warning: unknown[87.246.7.70]: SASL LOGIN authentication failed: UGFzc3dvcmQ6

2020-06-08T22:20:42.488829abusebot-5.cloudsearch.cf sshd[32604]: Invalid user pi from 24.230.34.148 port 38854
2020-06-08T22:20:42.807631abusebot-5.cloudsearch.cf sshd[32606]: Invalid user pi from 24.230.34.148 port 38862
2020-06-08T22:20:42.635375abusebot-5.cloudsearch.cf sshd[32604]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=24-230-34-148-dynamic.midco.net
2020-06-08T22:20:42.488829abusebot-5.cloudsearch.cf sshd[32604]: Invalid user pi from 24.230.34.148 port 38854
2020-06-08T22:20:45.116788abusebot-5.cloudsearch.cf sshd[32604]: Failed password for invalid user pi from 24.230.34.148 port 38854 ssh2
2020-06-08T22:20:42.957294abusebot-5.cloudsearch.cf sshd[32606]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=24-230-34-148-dynamic.midco.net
2020-06-08T22:20:42.807631abusebot-5.cloudsearch.cf sshd[32606]: Invalid user pi from 24.230.34.148 port 38862
2020-06-08T22:20:45.559217abusebot-5.cloudsearch.c
...