[ssh] SSH attack

Unauthorised connection attempt detected at AUO NODE 4. System is sshd. Protected by AUO Stack Web Application Firewall (WAF)

$f2bV_matches

2020-08-23T17:27:49.7160451495-001 sshd[13088]: Invalid user Lobby from 210.100.200.167 port 49826
2020-08-23T17:27:49.7193351495-001 sshd[13088]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.100.200.167
2020-08-23T17:27:49.7160451495-001 sshd[13088]: Invalid user Lobby from 210.100.200.167 port 49826
2020-08-23T17:27:51.9545691495-001 sshd[13088]: Failed password for invalid user Lobby from 210.100.200.167 port 49826 ssh2
2020-08-23T17:31:53.8404691495-001 sshd[13274]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.100.200.167  user=root
2020-08-23T17:31:55.9052781495-001 sshd[13274]: Failed password for root from 210.100.200.167 port 57516 ssh2
...

2020-08-07T05:50:47.337542amanda2.illicoweb.com sshd\[2455\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.100.200.167  user=root
2020-08-07T05:50:49.061974amanda2.illicoweb.com sshd\[2455\]: Failed password for root from 210.100.200.167 port 36716 ssh2
2020-08-07T05:56:23.104516amanda2.illicoweb.com sshd\[3709\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.100.200.167  user=root
2020-08-07T05:56:24.287403amanda2.illicoweb.com sshd\[3709\]: Failed password for root from 210.100.200.167 port 34614 ssh2
2020-08-07T05:58:14.161762amanda2.illicoweb.com sshd\[4033\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.100.200.167  user=root
...

(sshd) Failed SSH login from 210.100.200.167 (KR/South Korea/-): 5 in the last 3600 secs

2020-07-30T14:22:55.295842linuxbox-skyline sshd[109674]: Invalid user maurice from 210.100.200.167 port 54422
...

Jul 30 13:48:55 NG-HHDC-SVS-001 sshd[16094]: Invalid user zhicong from 210.100.200.167
...

Invalid user emil from 210.100.200.167 port 42568

2020-07-19 12:06:25,102 fail2ban.actions        [1840]: NOTICE  [sshd] Ban 210.100.200.167

Failed password for invalid user tateuchi from 210.100.200.167 port 58408 ssh2

Jul 11 00:10:21 srv-ubuntu-dev3 sshd[35815]: Invalid user zhimengguo from 210.100.200.167
Jul 11 00:10:21 srv-ubuntu-dev3 sshd[35815]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.100.200.167
Jul 11 00:10:21 srv-ubuntu-dev3 sshd[35815]: Invalid user zhimengguo from 210.100.200.167
Jul 11 00:10:24 srv-ubuntu-dev3 sshd[35815]: Failed password for invalid user zhimengguo from 210.100.200.167 port 37002 ssh2
Jul 11 00:12:31 srv-ubuntu-dev3 sshd[36130]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.100.200.167  user=www-data
Jul 11 00:12:32 srv-ubuntu-dev3 sshd[36130]: Failed password for www-data from 210.100.200.167 port 44126 ssh2
Jul 11 00:14:49 srv-ubuntu-dev3 sshd[36487]: Invalid user Jiang from 210.100.200.167
Jul 11 00:14:49 srv-ubuntu-dev3 sshd[36487]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.100.200.167
Jul 11 00:14:49 srv-ubuntu-dev3 sshd
...

2020-07-09T13:36:21.650351abusebot.cloudsearch.cf sshd[12196]: Invalid user tangjiaheng from 210.100.200.167 port 49018
2020-07-09T13:36:21.656677abusebot.cloudsearch.cf sshd[12196]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.100.200.167
2020-07-09T13:36:21.650351abusebot.cloudsearch.cf sshd[12196]: Invalid user tangjiaheng from 210.100.200.167 port 49018
2020-07-09T13:36:23.423625abusebot.cloudsearch.cf sshd[12196]: Failed password for invalid user tangjiaheng from 210.100.200.167 port 49018 ssh2
2020-07-09T13:40:47.151406abusebot.cloudsearch.cf sshd[12429]: Invalid user ncx27 from 210.100.200.167 port 56194
2020-07-09T13:40:47.156519abusebot.cloudsearch.cf sshd[12429]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.100.200.167
2020-07-09T13:40:47.151406abusebot.cloudsearch.cf sshd[12429]: Invalid user ncx27 from 210.100.200.167 port 56194
2020-07-09T13:40:49.108909abusebot.cloudsearch.cf ssh
...

Jul  3 20:45:05 OPSO sshd\[7906\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.100.200.167  user=root
Jul  3 20:45:07 OPSO sshd\[7906\]: Failed password for root from 210.100.200.167 port 54074 ssh2
Jul  3 20:48:40 OPSO sshd\[8774\]: Invalid user test from 210.100.200.167 port 52938
Jul  3 20:48:40 OPSO sshd\[8774\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.100.200.167
Jul  3 20:48:42 OPSO sshd\[8774\]: Failed password for invalid user test from 210.100.200.167 port 52938 ssh2

Jun 26 00:56:35 vps687878 sshd\[21211\]: Failed password for root from 210.100.200.167 port 52384 ssh2
Jun 26 00:58:28 vps687878 sshd\[21317\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.100.200.167  user=root
Jun 26 00:58:30 vps687878 sshd\[21317\]: Failed password for root from 210.100.200.167 port 52646 ssh2
Jun 26 01:00:26 vps687878 sshd\[21403\]: Invalid user zhanghao from 210.100.200.167 port 52912
Jun 26 01:00:26 vps687878 sshd\[21403\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.100.200.167
...

Scanning random ports - tries to find possible vulnerable services

445/tcp 445/tcp 445/tcp...
[2019-05-17/07-15]11pkt,1pt.(tcp)

WordPress brute force

@LucianNitescu Personal Honeypot Network <<<>>> Donate at paypal.me/LNitescu <<<>>> 2019-07-15 15:27:04,796 INFO [amun_request_handler] PortScan Detected on Port: 445 (180.183.45.8)

Jul 15 11:02:27 shadeyouvpn sshd[23979]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=223.100.164.221  user=r.r
Jul 15 11:02:29 shadeyouvpn sshd[23979]: Failed password for r.r from 223.100.164.221 port 45639 ssh2
Jul 15 11:02:29 shadeyouvpn sshd[23979]: Received disconnect from 223.100.164.221: 11: Bye Bye [preauth]
Jul 15 11:06:59 shadeyouvpn sshd[28166]: Invalid user laura from 223.100.164.221
Jul 15 11:06:59 shadeyouvpn sshd[28166]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=223.100.164.221 
Jul 15 11:07:01 shadeyouvpn sshd[28166]: Failed password for invalid user laura from 223.100.164.221 port 47523 ssh2
Jul 15 11:07:01 shadeyouvpn sshd[28166]: Received disconnect from 223.100.164.221: 11: Bye Bye [preauth]
Jul 15 11:10:13 shadeyouvpn sshd[31522]: Invalid user quercia from 223.100.164.221
Jul 15 11:10:13 shadeyouvpn sshd[31522]: pam_unix(sshd:auth): authentication failure; logn........
-------------------------------

23/tcp 23/tcp 23/tcp...
[2019-05-24/07-15]12pkt,1pt.(tcp)

23/tcp 23/tcp 23/tcp
[2019-06-30/07-15]3pkt

Jul 16 00:19:27 SilenceServices sshd[10327]: Failed password for nobody from 51.68.70.175 port 42154 ssh2
Jul 16 00:23:43 SilenceServices sshd[12997]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.68.70.175
Jul 16 00:23:45 SilenceServices sshd[12997]: Failed password for invalid user deploy from 51.68.70.175 port 39022 ssh2

Automatic report - Port Scan Attack

(From Asher@thechatsinc.org) Hi,

This is Asher Collins from The Chats Inc. I have visited your website and noticed good traffic. We can convert that traffic into you client lead by equipping your website with 24-7 live chat service with live attendant availability which will increase your website conversion up to 35% and generate 3 times more leads from your visitor traffic, ensuring you don’t lose a single client visiting your website.

Per Lead billing – No setup charges- Free non-qualified chats.

You can test the potential with $300 worth of free lead credit and continue if you see the results.


If you would like to explore this further - please let me know and we can take it from there!

For more info or to try the service, please reply or you can call me directly.

Best,
Asher Collins
Client Relations
Asher@thechatsinc.org
www.thechatsinc.net

(From webmasterdesigners4u@gmail.com) Hello,

I have run some diagnostic tools on your website and saw immediately that there is plenty of room for improvement. With a few upgrades on your existing platform, your website can start generating more sales, leads, and more business. Your website is your most important digital asset out on the Web, and it's time that it got the upgrade that it sorely needs. 

Search engines like Google have a way of accessing websites to look for certain keywords and elements that will highlight what your site is all about. I specialize in making sure that search algorithms find what they need on your website to put it on top of the search results.

I'll be glad to give you more detailed information about how you can make your website more profitable and what the results will be during a free consultation. Kindly reply to let me know when's the best time to give in touch with you if you're interested. I look forward to hearing back from you.

- Mario Ferguson

Jul 16 00:23:02 microserver sshd[64709]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.227.12.38  user=root
Jul 16 00:23:05 microserver sshd[64709]: Failed password for root from 80.227.12.38 port 48612 ssh2
Jul 16 00:28:37 microserver sshd[1792]: Invalid user sims from 80.227.12.38 port 48798
Jul 16 00:28:37 microserver sshd[1792]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.227.12.38
Jul 16 00:28:40 microserver sshd[1792]: Failed password for invalid user sims from 80.227.12.38 port 48798 ssh2
Jul 16 00:39:40 microserver sshd[6166]: Invalid user po from 80.227.12.38 port 48442
Jul 16 00:39:40 microserver sshd[6166]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.227.12.38
Jul 16 00:39:42 microserver sshd[6166]: Failed password for invalid user po from 80.227.12.38 port 48442 ssh2
Jul 16 00:45:14 microserver sshd[8763]: Invalid user teamspeak3 from 80.227.12.38 port 48632
Ju

Jul 16 00:31:48 vps647732 sshd[24342]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=151.236.32.126
Jul 16 00:31:50 vps647732 sshd[24342]: Failed password for invalid user sterling from 151.236.32.126 port 52154 ssh2
...

Jul 16 00:23:21 vps691689 sshd[13745]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=170.247.0.30
Jul 16 00:23:23 vps691689 sshd[13745]: Failed password for invalid user silver from 170.247.0.30 port 32788 ssh2
Jul 16 00:28:12 vps691689 sshd[13908]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=170.247.0.30
...

Spam