2019-09-22T23:58:04.070858tmaserv sshd\[21982\]: Invalid user admin2 from 206.189.232.45 port 35820
2019-09-22T23:58:04.075439tmaserv sshd\[21982\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=mail.artifice.ec
2019-09-22T23:58:05.624505tmaserv sshd\[21982\]: Failed password for invalid user admin2 from 206.189.232.45 port 35820 ssh2
2019-09-23T00:01:55.925910tmaserv sshd\[24912\]: Invalid user bretto from 206.189.232.45 port 48528
2019-09-23T00:01:55.929853tmaserv sshd\[24912\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=mail.artifice.ec
2019-09-23T00:01:57.567847tmaserv sshd\[24912\]: Failed password for invalid user bretto from 206.189.232.45 port 48528 ssh2
...

Sep 11 19:39:38 sachi sshd\[13304\]: Invalid user minecraft from 206.189.232.45
Sep 11 19:39:38 sachi sshd\[13304\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=mail.artifice.ec
Sep 11 19:39:41 sachi sshd\[13304\]: Failed password for invalid user minecraft from 206.189.232.45 port 54120 ssh2
Sep 11 19:45:19 sachi sshd\[13772\]: Invalid user vmuser from 206.189.232.45
Sep 11 19:45:19 sachi sshd\[13772\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=mail.artifice.ec

Aug 31 21:33:16 lcdev sshd\[13369\]: Invalid user amdsa from 206.189.232.45
Aug 31 21:33:16 lcdev sshd\[13369\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=mail.artifice.ec
Aug 31 21:33:18 lcdev sshd\[13369\]: Failed password for invalid user amdsa from 206.189.232.45 port 36256 ssh2
Aug 31 21:37:00 lcdev sshd\[13690\]: Invalid user aaron from 206.189.232.45
Aug 31 21:37:00 lcdev sshd\[13690\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=mail.artifice.ec

Aug 27 03:50:13 aiointranet sshd\[21426\]: Invalid user lw from 206.189.232.45
Aug 27 03:50:13 aiointranet sshd\[21426\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=mail.artifice.ec
Aug 27 03:50:15 aiointranet sshd\[21426\]: Failed password for invalid user lw from 206.189.232.45 port 34876 ssh2
Aug 27 03:54:19 aiointranet sshd\[21769\]: Invalid user xbox from 206.189.232.45
Aug 27 03:54:19 aiointranet sshd\[21769\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=mail.artifice.ec

Aug 19 02:30:43 ny01 sshd[9810]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.232.45
Aug 19 02:30:44 ny01 sshd[9810]: Failed password for invalid user getmail from 206.189.232.45 port 33064 ssh2
Aug 19 02:34:46 ny01 sshd[10228]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.232.45

Aug 10 16:28:49 mail sshd\[9879\]: Failed password for invalid user wedding from 206.189.232.45 port 46726 ssh2
Aug 10 16:44:40 mail sshd\[10068\]: Invalid user dante from 206.189.232.45 port 47076
Aug 10 16:44:40 mail sshd\[10068\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.232.45
...

k+ssh-bruteforce

Aug  1 08:37:42 icinga sshd[17555]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.232.45
Aug  1 08:37:44 icinga sshd[17555]: Failed password for invalid user alexandru from 206.189.232.45 port 48492 ssh2
...

Jul 26 05:36:08 vps200512 sshd\[6932\]: Invalid user cmb from 206.189.232.45
Jul 26 05:36:08 vps200512 sshd\[6932\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.232.45
Jul 26 05:36:10 vps200512 sshd\[6932\]: Failed password for invalid user cmb from 206.189.232.45 port 51120 ssh2
Jul 26 05:40:25 vps200512 sshd\[7132\]: Invalid user hg from 206.189.232.45
Jul 26 05:40:25 vps200512 sshd\[7132\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.232.45

Jul 26 02:43:56 vps200512 sshd\[1097\]: Invalid user crawler from 206.189.232.45
Jul 26 02:43:56 vps200512 sshd\[1097\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.232.45
Jul 26 02:43:58 vps200512 sshd\[1097\]: Failed password for invalid user crawler from 206.189.232.45 port 40038 ssh2
Jul 26 02:48:13 vps200512 sshd\[1211\]: Invalid user dean from 206.189.232.45
Jul 26 02:48:13 vps200512 sshd\[1211\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.232.45

Jul 20 10:21:51 [host] sshd[13247]: Invalid user web from 206.189.232.45
Jul 20 10:21:51 [host] sshd[13247]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.232.45
Jul 20 10:21:53 [host] sshd[13247]: Failed password for invalid user web from 206.189.232.45 port 49496 ssh2

Jul 20 00:14:38 ip-172-31-1-72 sshd\[28244\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.232.45  user=ftp
Jul 20 00:14:40 ip-172-31-1-72 sshd\[28244\]: Failed password for ftp from 206.189.232.45 port 59628 ssh2
Jul 20 00:18:51 ip-172-31-1-72 sshd\[28319\]: Invalid user qbiomedical from 206.189.232.45
Jul 20 00:18:51 ip-172-31-1-72 sshd\[28319\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.232.45
Jul 20 00:18:53 ip-172-31-1-72 sshd\[28319\]: Failed password for invalid user qbiomedical from 206.189.232.45 port 53796 ssh2

Jul  9 20:58:25 vps65 sshd\[26717\]: Invalid user amazon from 206.189.232.45 port 54454
Jul  9 20:58:25 vps65 sshd\[26717\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.232.45
...

2019-06-23T12:22:11.253083test01.cajus.name sshd\[25197\]: Invalid user mercure from 206.189.232.45 port 51596
2019-06-23T12:22:11.267868test01.cajus.name sshd\[25197\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=mail.artifice.ec
2019-06-23T12:22:13.161295test01.cajus.name sshd\[25197\]: Failed password for invalid user mercure from 206.189.232.45 port 51596 ssh2

*Port Scan* detected from 206.189.232.96 (US/United States/New Jersey/North Bergen/-). 4 hits in the last 65 seconds

kernel: [1349891.741063] portscan:IN=eth0 OUT= MAC=9e:11:7f:4a:a0:76:30:7c:5e:91:9c:30:08:00 SRC=206.189.232.174

PORT      STATE SERVICE       VERSION
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
3389/tcp  open  ms-wbt-server Microsoft Terminal Service
4899/tcp  open  radmin        Famatech Radmin 3.X (Radmin Authentication)
5357/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
49152/tcp open  msrpc         Microsoft Windows RPC
49153/tcp open  msrpc         Microsoft Windows RPC
49154/tcp open  msrpc         Microsoft Windows RPC
49158/tcp open  msrpc         Microsoft Windows RPC
49159/tcp open  msrpc         Microsoft Windows RPC
49160/tcp open  msrpc         Microsoft Windows RPC
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

SSH Bruteforce attempt

Sep 11 18:12:57 hpm sshd\[2060\]: Invalid user testuser from 206.189.232.29
Sep 11 18:12:57 hpm sshd\[2060\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.232.29
Sep 11 18:12:59 hpm sshd\[2060\]: Failed password for invalid user testuser from 206.189.232.29 port 57874 ssh2
Sep 11 18:19:57 hpm sshd\[2760\]: Invalid user guest1 from 206.189.232.29
Sep 11 18:19:57 hpm sshd\[2760\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.232.29

Sep  7 00:45:37 lcdev sshd\[6171\]: Invalid user dev from 206.189.232.29
Sep  7 00:45:37 lcdev sshd\[6171\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.232.29
Sep  7 00:45:39 lcdev sshd\[6171\]: Failed password for invalid user dev from 206.189.232.29 port 45224 ssh2
Sep  7 00:52:37 lcdev sshd\[6783\]: Invalid user ftpadmin from 206.189.232.29
Sep  7 00:52:37 lcdev sshd\[6783\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.232.29

Sep  6 18:02:13 lcdev sshd\[3141\]: Invalid user oracle from 206.189.232.29
Sep  6 18:02:13 lcdev sshd\[3141\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.232.29
Sep  6 18:02:14 lcdev sshd\[3141\]: Failed password for invalid user oracle from 206.189.232.29 port 45750 ssh2
Sep  6 18:09:54 lcdev sshd\[3867\]: Invalid user odoo from 206.189.232.29
Sep  6 18:09:54 lcdev sshd\[3867\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.232.29

2019-09-05T15:31:38.233780enmeeting.mahidol.ac.th sshd\[19332\]: Invalid user www-data from 206.189.232.29 port 56858
2019-09-05T15:31:38.248315enmeeting.mahidol.ac.th sshd\[19332\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.232.29
2019-09-05T15:31:39.465349enmeeting.mahidol.ac.th sshd\[19332\]: Failed password for invalid user www-data from 206.189.232.29 port 56858 ssh2
...

Sep  3 01:49:29 ks10 sshd[26237]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.232.29 
Sep  3 01:49:31 ks10 sshd[26237]: Failed password for invalid user mouse from 206.189.232.29 port 60364 ssh2
...

Sep  1 13:34:28 dedicated sshd[21087]: Invalid user webadmin from 206.189.232.29 port 49872

Invalid user svn from 206.189.232.29 port 52878

Aug 12 04:43:26 cvbmail sshd\[21986\]: Invalid user gpadmin from 206.189.232.29
Aug 12 04:43:26 cvbmail sshd\[21986\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.232.29
Aug 12 04:43:29 cvbmail sshd\[21986\]: Failed password for invalid user gpadmin from 206.189.232.29 port 47796 ssh2

fail2ban honeypot

Jun 29 20:14:26 ip-172-31-1-72 sshd\[4543\]: Invalid user ckobia from 206.189.232.29
Jun 29 20:14:26 ip-172-31-1-72 sshd\[4543\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.232.29
Jun 29 20:14:27 ip-172-31-1-72 sshd\[4543\]: Failed password for invalid user ckobia from 206.189.232.29 port 34522 ssh2
Jun 29 20:16:11 ip-172-31-1-72 sshd\[4612\]: Invalid user laury from 206.189.232.29
Jun 29 20:16:11 ip-172-31-1-72 sshd\[4612\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.232.29

Jun 25 08:57:01 ovpn sshd\[3580\]: Invalid user duan from 206.189.232.29
Jun 25 08:57:01 ovpn sshd\[3580\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.232.29
Jun 25 08:57:03 ovpn sshd\[3580\]: Failed password for invalid user duan from 206.189.232.29 port 37658 ssh2
Jun 25 09:01:39 ovpn sshd\[3689\]: Invalid user temp1 from 206.189.232.29
Jun 25 09:01:39 ovpn sshd\[3689\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.232.29

Unauthorized connection attempt detected from IP address 115.72.27.112 to port 88

Unauthorized connection attempt detected from IP address 107.145.158.252 to port 5555

Unauthorized connection attempt detected from IP address 211.193.17.165 to port 23 [T]

Unauthorized connection attempt detected from IP address 74.142.225.245 to port 2323

Unauthorized connection attempt detected from IP address 89.216.56.67 to port 1433

Unauthorized connection attempt detected from IP address 150.109.231.12 to port 39

Unauthorized connection attempt detected from IP address 170.106.38.214 to port 322

Unauthorized connection attempt detected from IP address 171.243.0.2 to port 23

Unauthorized connection attempt detected from IP address 78.179.213.146 to port 8080

Unauthorized connection attempt detected from IP address 45.83.65.127 to port 22

Unauthorized connection attempt detected from IP address 106.110.169.66 to port 2323

Unauthorized connection attempt detected from IP address 171.250.115.114 to port 23

Unauthorized connection attempt detected from IP address 118.249.205.125 to port 23

Unauthorized connection attempt detected from IP address 95.2.45.183 to port 445

Unauthorized connection attempt detected from IP address 187.84.81.89 to port 23