Invalid user parana from 201.77.124.248 port 61831

Jul 17 07:38:26 DAAP sshd[17980]: Invalid user ipi from 201.77.124.248 port 38046
Jul 17 07:38:26 DAAP sshd[17980]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.77.124.248
Jul 17 07:38:26 DAAP sshd[17980]: Invalid user ipi from 201.77.124.248 port 38046
Jul 17 07:38:27 DAAP sshd[17980]: Failed password for invalid user ipi from 201.77.124.248 port 38046 ssh2
Jul 17 07:43:21 DAAP sshd[18079]: Invalid user chenshuyu from 201.77.124.248 port 61165
...

Invalid user dt from 201.77.124.248 port 36112

Jun 20 15:15:32 electroncash sshd[47461]: Failed password for invalid user emily from 201.77.124.248 port 18786 ssh2
Jun 20 15:19:28 electroncash sshd[48490]: Invalid user sammy from 201.77.124.248 port 1880
Jun 20 15:19:28 electroncash sshd[48490]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.77.124.248 
Jun 20 15:19:28 electroncash sshd[48490]: Invalid user sammy from 201.77.124.248 port 1880
Jun 20 15:19:29 electroncash sshd[48490]: Failed password for invalid user sammy from 201.77.124.248 port 1880 ssh2
...

SSH authentication failure x 6 reported by Fail2Ban
...

Jun 16 08:15:39 NPSTNNYC01T sshd[31315]: Failed password for root from 201.77.124.248 port 39670 ssh2
Jun 16 08:18:31 NPSTNNYC01T sshd[31518]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.77.124.248
Jun 16 08:18:32 NPSTNNYC01T sshd[31518]: Failed password for invalid user vp from 201.77.124.248 port 39092 ssh2
...

Jun  5 14:34:25 localhost sshd\[16335\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.77.124.248  user=root
Jun  5 14:34:28 localhost sshd\[16335\]: Failed password for root from 201.77.124.248 port 5704 ssh2
Jun  5 14:38:34 localhost sshd\[16603\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.77.124.248  user=root
Jun  5 14:38:35 localhost sshd\[16603\]: Failed password for root from 201.77.124.248 port 26032 ssh2
Jun  5 14:42:50 localhost sshd\[16948\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.77.124.248  user=root
...

2020-06-03T09:27:25.636489shield sshd\[14953\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=201-77-124-248.static.desktop.com.br  user=root
2020-06-03T09:27:27.879011shield sshd\[14953\]: Failed password for root from 201.77.124.248 port 63291 ssh2
2020-06-03T09:31:25.770207shield sshd\[15394\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=201-77-124-248.static.desktop.com.br  user=root
2020-06-03T09:31:27.626380shield sshd\[15394\]: Failed password for root from 201.77.124.248 port 19817 ssh2
2020-06-03T09:35:35.159989shield sshd\[15995\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=201-77-124-248.static.desktop.com.br  user=root

(sshd) Failed SSH login from 201.77.124.248 (BR/Brazil/201-77-124-248.static.desktop.com.br): 5 in the last 3600 secs

2020-05-10T08:53:06.7298481495-001 sshd[21921]: Failed password for invalid user admin from 201.77.124.248 port 7089 ssh2
2020-05-10T08:57:49.2436361495-001 sshd[22123]: Invalid user test from 201.77.124.248 port 54256
2020-05-10T08:57:49.2477411495-001 sshd[22123]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201-77-124-248.static.desktop.com.br
2020-05-10T08:57:49.2436361495-001 sshd[22123]: Invalid user test from 201.77.124.248 port 54256
2020-05-10T08:57:51.3760211495-001 sshd[22123]: Failed password for invalid user test from 201.77.124.248 port 54256 ssh2
2020-05-10T09:02:27.2588891495-001 sshd[22495]: Invalid user redmine from 201.77.124.248 port 25254
...

Apr 27 06:21:57 scw-6657dc sshd[1434]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.77.124.248
Apr 27 06:21:57 scw-6657dc sshd[1434]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.77.124.248
Apr 27 06:21:59 scw-6657dc sshd[1434]: Failed password for invalid user sx from 201.77.124.248 port 58196 ssh2
...

Apr 26 22:38:30 v22018086721571380 sshd[31170]: Failed password for invalid user hendry from 201.77.124.248 port 9028 ssh2

Apr  4 05:59:09 ns382633 sshd\[23255\]: Invalid user wd from 201.77.124.248 port 52251
Apr  4 05:59:09 ns382633 sshd\[23255\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.77.124.248
Apr  4 05:59:10 ns382633 sshd\[23255\]: Failed password for invalid user wd from 201.77.124.248 port 52251 ssh2
Apr  4 06:04:37 ns382633 sshd\[24218\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.77.124.248  user=root
Apr  4 06:04:39 ns382633 sshd\[24218\]: Failed password for root from 201.77.124.248 port 59463 ssh2

Mar 25 02:54:40 h2646465 sshd[9981]: Invalid user nk from 201.77.124.248
Mar 25 02:54:40 h2646465 sshd[9981]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.77.124.248
Mar 25 02:54:40 h2646465 sshd[9981]: Invalid user nk from 201.77.124.248
Mar 25 02:54:42 h2646465 sshd[9981]: Failed password for invalid user nk from 201.77.124.248 port 58218 ssh2
Mar 25 03:03:06 h2646465 sshd[12195]: Invalid user cg from 201.77.124.248
Mar 25 03:03:06 h2646465 sshd[12195]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.77.124.248
Mar 25 03:03:06 h2646465 sshd[12195]: Invalid user cg from 201.77.124.248
Mar 25 03:03:08 h2646465 sshd[12195]: Failed password for invalid user cg from 201.77.124.248 port 47124 ssh2
Mar 25 03:07:22 h2646465 sshd[12987]: Invalid user gwendolyn from 201.77.124.248
...

Mar 24 01:16:28 ks10 sshd[304574]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.77.124.248 
Mar 24 01:16:30 ks10 sshd[304574]: Failed password for invalid user admin from 201.77.124.248 port 39947 ssh2
...

2020-03-20T06:13:37.999951vps773228.ovh.net sshd[28815]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201-77-124-248.static.desktop.com.br  user=root
2020-03-20T06:13:40.569047vps773228.ovh.net sshd[28815]: Failed password for root from 201.77.124.248 port 17247 ssh2
2020-03-20T06:20:17.633464vps773228.ovh.net sshd[31310]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201-77-124-248.static.desktop.com.br  user=root
2020-03-20T06:20:19.781318vps773228.ovh.net sshd[31310]: Failed password for root from 201.77.124.248 port 20340 ssh2
2020-03-20T06:26:50.123689vps773228.ovh.net sshd[1288]: Invalid user rafli from 201.77.124.248 port 45120
...

Lines containing failures of 201.77.124.248 (max 1000)
Mar 19 18:43:26 Server sshd[19826]: User r.r from 201.77.124.248 not allowed because not listed in AllowUsers
Mar 19 18:43:26 Server sshd[19826]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.77.124.248  user=r.r
Mar 19 18:43:28 Server sshd[19826]: Failed password for invalid user r.r from 201.77.124.248 port 3467 ssh2
Mar 19 18:43:28 Server sshd[19826]: Received disconnect from 201.77.124.248 port 3467:11: Bye Bye [preauth]
Mar 19 18:43:28 Server sshd[19826]: Disconnected from invalid user r.r 201.77.124.248 port 3467 [preauth]


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=201.77.124.248

SSH brute-force: detected 79 distinct usernames within a 24-hour window.

2020-02-20T16:11:23.028908dmca.cloudsearch.cf sshd[20618]: Invalid user admin from 92.63.194.59 port 32773
2020-02-20T16:11:23.034478dmca.cloudsearch.cf sshd[20618]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.63.194.59
2020-02-20T16:11:23.028908dmca.cloudsearch.cf sshd[20618]: Invalid user admin from 92.63.194.59 port 32773
2020-02-20T16:11:25.344149dmca.cloudsearch.cf sshd[20618]: Failed password for invalid user admin from 92.63.194.59 port 32773 ssh2
2020-02-20T16:12:31.943913dmca.cloudsearch.cf sshd[20745]: Invalid user admin from 92.63.194.59 port 39391
2020-02-20T16:12:31.949074dmca.cloudsearch.cf sshd[20745]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.63.194.59
2020-02-20T16:12:31.943913dmca.cloudsearch.cf sshd[20745]: Invalid user admin from 92.63.194.59 port 39391
2020-02-20T16:12:34.594861dmca.cloudsearch.cf sshd[20745]: Failed password for invalid user admin from 92.63.194.59 port
...

port scan and connect, tcp 23 (telnet)

Feb 19 22:13:10 h2034429 sshd[22708]: Invalid user mapred from 95.37.205.250
Feb 19 22:13:10 h2034429 sshd[22708]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=95.37.205.250
Feb 19 22:13:12 h2034429 sshd[22708]: Failed password for invalid user mapred from 95.37.205.250 port 60204 ssh2
Feb 19 22:13:12 h2034429 sshd[22708]: Received disconnect from 95.37.205.250 port 60204:11: Bye Bye [preauth]
Feb 19 22:13:12 h2034429 sshd[22708]: Disconnected from 95.37.205.250 port 60204 [preauth]
Feb 19 22:17:50 h2034429 sshd[22779]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=95.37.205.250  user=r.r
Feb 19 22:17:52 h2034429 sshd[22779]: Failed password for r.r from 95.37.205.250 port 53236 ssh2
Feb 19 22:17:52 h2034429 sshd[22779]: Received disconnect from 95.37.205.250 port 53236:11: Bye Bye [preauth]
Feb 19 22:17:52 h2034429 sshd[22779]: Disconnected from 95.37.205.250 port 53236 [preauth]


........
----------------------------------

(sshd) Failed SSH login from 106.12.83.146 (CN/China/-): 2 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Feb 20 17:04:24 ubnt-55d23 sshd[17428]: Invalid user user from 106.12.83.146 port 49778
Feb 20 17:04:26 ubnt-55d23 sshd[17428]: Failed password for invalid user user from 106.12.83.146 port 49778 ssh2

Feb 20 20:27:56 webhost01 sshd[1532]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.72.7
Feb 20 20:27:58 webhost01 sshd[1532]: Failed password for invalid user libuuid from 138.68.72.7 port 43966 ssh2
...

Feb 20 05:57:18 wbs sshd\[28191\]: Invalid user tmpu01 from 159.65.148.91
Feb 20 05:57:18 wbs sshd\[28191\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.65.148.91
Feb 20 05:57:20 wbs sshd\[28191\]: Failed password for invalid user tmpu01 from 159.65.148.91 port 44116 ssh2
Feb 20 05:59:27 wbs sshd\[28362\]: Invalid user couchdb from 159.65.148.91
Feb 20 05:59:27 wbs sshd\[28362\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.65.148.91

2020-02-20T16:28:29.085781  sshd[22800]: Invalid user azureuser from 157.230.128.195 port 47678
2020-02-20T16:28:29.100446  sshd[22800]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.230.128.195
2020-02-20T16:28:29.085781  sshd[22800]: Invalid user azureuser from 157.230.128.195 port 47678
2020-02-20T16:28:30.712330  sshd[22800]: Failed password for invalid user azureuser from 157.230.128.195 port 47678 ssh2
...

Feb 20 17:05:06 grey postfix/smtpd\[30941\]: NOQUEUE: reject: RCPT from unknown\[185.143.223.161\]: 554 5.7.1 Service unavailable\; Client host \[185.143.223.161\] blocked using truncate.gbudb.net\; http://www.gbudb.com/truncate/ \[185.143.223.161\]\; from=\ to=\ proto=ESMTP helo=\<\[185.143.223.163\]\>Feb 20 17:05:06 grey postfix/smtpd\[30941\]: NOQUEUE: reject: RCPT from unknown\[185.143.223.161\]: 554 5.7.1 Service unavailable\; Client host \[185.143.223.161\] blocked using truncate.gbudb.net\; http://www.gbudb.com/truncate/ \[185.143.223.161\]\; from=\ to=\ proto=ESMTP helo=\<\[185.143.223.163\]\>Feb 20 17:05:06 grey postfix/smtpd\[30941\]: NOQUEUE: reject: RCPT from unknown\[185.143.223.161\]: 554 5.7.1 Service unavailable\; Client host \[185.143.223.161\] blocked using truncate.gbudb.net\; http://www.gbudb.com/truncate/ \[185.143.223.161\]\; from=\

php WP PHPmyadamin ABUSE blocked for 12h

Feb 20 16:23:34 server sshd\[11300\]: Invalid user xutao from 192.241.135.34
Feb 20 16:23:34 server sshd\[11300\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ekf.com.br 
Feb 20 16:23:36 server sshd\[11300\]: Failed password for invalid user xutao from 192.241.135.34 port 35893 ssh2
Feb 20 16:27:43 server sshd\[12048\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ekf.com.br  user=nagios
Feb 20 16:27:46 server sshd\[12048\]: Failed password for nagios from 192.241.135.34 port 49261 ssh2
...

Unauthorised access (Feb 20) SRC=186.90.150.42 LEN=52 TTL=116 ID=30394 DF TCP DPT=445 WINDOW=8192 SYN

$f2bV_matches

suspicious action Thu, 20 Feb 2020 10:28:19 -0300

2020-02-20T14:27:31.339953 X postfix/smtpd[44822]: lost connection after AUTH from unknown[112.117.112.114]
2020-02-20T14:27:33.660626 X postfix/smtpd[44822]: lost connection after AUTH from unknown[112.117.112.114]
2020-02-20T14:27:35.444520 X postfix/smtpd[44822]: lost connection after AUTH from unknown[112.117.112.114]

suspicious action Thu, 20 Feb 2020 10:28:23 -0300