detected by Fail2Ban

Nov  2 13:57:47 MK-Soft-VM6 sshd[6572]: Failed password for root from 212.47.251.164 port 39500 ssh2
Nov  2 14:01:46 MK-Soft-VM6 sshd[6589]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.47.251.164 
...

Oct 25 10:36:02 server sshd\[23540\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=164-251-47-212.rev.cloud.scaleway.com  user=root
Oct 25 10:36:04 server sshd\[23540\]: Failed password for root from 212.47.251.164 port 51032 ssh2
Oct 25 10:41:40 server sshd\[24723\]: Invalid user cc from 212.47.251.164
Oct 25 10:41:40 server sshd\[24723\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=164-251-47-212.rev.cloud.scaleway.com 
Oct 25 10:41:41 server sshd\[24723\]: Failed password for invalid user cc from 212.47.251.164 port 42174 ssh2
...

Oct 23 10:24:30 kapalua sshd\[12346\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=164-251-47-212.rev.cloud.scaleway.com  user=root
Oct 23 10:24:32 kapalua sshd\[12346\]: Failed password for root from 212.47.251.164 port 34206 ssh2
Oct 23 10:28:11 kapalua sshd\[12795\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=164-251-47-212.rev.cloud.scaleway.com  user=root
Oct 23 10:28:13 kapalua sshd\[12795\]: Failed password for root from 212.47.251.164 port 46610 ssh2
Oct 23 10:31:45 kapalua sshd\[13073\]: Invalid user admin from 212.47.251.164

2019-10-22T07:10:20.195437abusebot-4.cloudsearch.cf sshd\[25288\]: Invalid user anna from 212.47.251.164 port 46898

$f2bV_matches

Oct 19 07:00:44 OPSO sshd\[21957\]: Invalid user dragon from 212.47.251.164 port 56812
Oct 19 07:00:44 OPSO sshd\[21957\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.47.251.164
Oct 19 07:00:45 OPSO sshd\[21957\]: Failed password for invalid user dragon from 212.47.251.164 port 56812 ssh2
Oct 19 07:04:14 OPSO sshd\[22396\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.47.251.164  user=root
Oct 19 07:04:16 OPSO sshd\[22396\]: Failed password for root from 212.47.251.164 port 38602 ssh2

Oct 12 05:41:11 kapalua sshd\[16233\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=164-251-47-212.rev.cloud.scaleway.com  user=root
Oct 12 05:41:13 kapalua sshd\[16233\]: Failed password for root from 212.47.251.164 port 60006 ssh2
Oct 12 05:44:54 kapalua sshd\[16546\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=164-251-47-212.rev.cloud.scaleway.com  user=root
Oct 12 05:44:55 kapalua sshd\[16546\]: Failed password for root from 212.47.251.164 port 43040 ssh2
Oct 12 05:48:38 kapalua sshd\[16877\]: Invalid user 123 from 212.47.251.164

2019-10-12T07:59:19.8720561240 sshd\[15497\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.47.251.164  user=root
2019-10-12T07:59:22.0929951240 sshd\[15497\]: Failed password for root from 212.47.251.164 port 40806 ssh2
2019-10-12T08:02:54.2327131240 sshd\[15639\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.47.251.164  user=root
...

2019-10-08T20:05:58.773176abusebot.cloudsearch.cf sshd\[30871\]: Invalid user 123 from 212.47.251.164 port 50118

Oct  7 16:58:12 venus sshd\[23340\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.47.251.164  user=root
Oct  7 16:58:13 venus sshd\[23340\]: Failed password for root from 212.47.251.164 port 36428 ssh2
Oct  7 17:01:59 venus sshd\[23378\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.47.251.164  user=root
...

Oct  6 13:44:04 MK-Soft-Root2 sshd[28934]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.47.251.164 
Oct  6 13:44:07 MK-Soft-Root2 sshd[28934]: Failed password for invalid user !@#wsx123 from 212.47.251.164 port 46400 ssh2
...

SSH Brute Force, server-1 sshd[4359]: Failed password for invalid user P4SSw0rd from 212.47.251.164 port 50856 ssh2

Oct  3 12:47:34 ny01 sshd[20317]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.47.251.164
Oct  3 12:47:36 ny01 sshd[20317]: Failed password for invalid user nagios from 212.47.251.164 port 43252 ssh2
Oct  3 12:51:12 ny01 sshd[20878]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.47.251.164

2019-10-01T15:53:57.798257abusebot-7.cloudsearch.cf sshd\[30356\]: Invalid user dev from 212.47.251.164 port 52400

Oct  1 00:08:45 localhost sshd\[30708\]: Invalid user nx from 212.47.251.164 port 39732
Oct  1 00:08:45 localhost sshd\[30708\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.47.251.164
Oct  1 00:08:48 localhost sshd\[30708\]: Failed password for invalid user nx from 212.47.251.164 port 39732 ssh2

2019-09-29T05:54:33.369182abusebot-8.cloudsearch.cf sshd\[19403\]: Invalid user uno from 212.47.251.164 port 37256

$f2bV_matches_ltvn

Sep 25 06:38:51 apollo sshd\[31508\]: Invalid user ddddd from 212.47.251.164Sep 25 06:38:53 apollo sshd\[31508\]: Failed password for invalid user ddddd from 212.47.251.164 port 48640 ssh2Sep 25 06:47:16 apollo sshd\[31559\]: Invalid user vpnguardbot from 212.47.251.164
...

Sep 21 14:55:55 MK-Soft-VM3 sshd[7864]: Failed password for root from 212.47.251.164 port 60486 ssh2
...

212.47.251.127 - - [13/Oct/2020:14:22:56 +0100] "POST /wp-login.php HTTP/1.1" 200 2284 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
212.47.251.127 - - [13/Oct/2020:14:23:01 +0100] "POST /xmlrpc.php HTTP/1.1" 403 219 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
212.47.251.127 - - [13/Oct/2020:14:30:12 +0100] "POST /wp-login.php HTTP/1.1" 200 2340 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
...

212.47.251.127 - - [13/Oct/2020:05:43:18 +0200] "GET /wp-login.php HTTP/1.1" 200 9061 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
212.47.251.127 - - [13/Oct/2020:05:43:19 +0200] "POST /wp-login.php HTTP/1.1" 200 9312 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
212.47.251.127 - - [13/Oct/2020:05:43:20 +0200] "POST /xmlrpc.php HTTP/1.1" 200 427 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"

php WP PHPmyadamin ABUSE blocked for 12h

212.47.251.127 - - [27/Sep/2020:11:35:33 +0100] "POST /wp-login.php HTTP/1.1" 200 2217 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
212.47.251.127 - - [27/Sep/2020:11:35:39 +0100] "POST /wp-login.php HTTP/1.1" 200 2242 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
212.47.251.127 - - [27/Sep/2020:11:35:39 +0100] "POST /xmlrpc.php HTTP/1.1" 403 219 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
...

212.47.251.127 - - [21/Sep/2020:08:41:25 +0100] "POST /wp-login.php HTTP/1.1" 200 2371 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
212.47.251.127 - - [21/Sep/2020:08:41:36 +0100] "POST /wp-login.php HTTP/1.1" 200 2387 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
212.47.251.127 - - [21/Sep/2020:08:41:41 +0100] "POST /xmlrpc.php HTTP/1.1" 403 219 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
...

Dec  5 07:26:18 fr01 sshd[7356]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.47.251.194  user=root
Dec  5 07:26:19 fr01 sshd[7356]: Failed password for root from 212.47.251.194 port 49094 ssh2
Dec  5 07:26:18 fr01 sshd[7362]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.47.251.194  user=root
Dec  5 07:26:19 fr01 sshd[7362]: Failed password for root from 212.47.251.194 port 49486 ssh2
Dec  5 07:26:18 fr01 sshd[7364]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.47.251.194  user=root
Dec  5 07:26:19 fr01 sshd[7364]: Failed password for root from 212.47.251.194 port 49494 ssh2
Dec  5 07:26:18 fr01 sshd[7363]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.47.251.194  user=root
Dec  5 07:26:19 fr01 sshd[7363]: Failed password for root from 212.47.251.194 port 49490 ssh2
Dec  5 07:26:18 fr01 sshd[7360]: pam_unix(sshd:auth): authen

SSH bruteforce

" "

20 attempts against mh_ha-misbehave-ban on lb

MultiHost/MultiPort Probe, Scan, Hack -

Mar 16 05:43:36 ns382633 sshd\[32006\]: Invalid user office from 154.8.148.102 port 43100
Mar 16 05:43:36 ns382633 sshd\[32006\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=154.8.148.102
Mar 16 05:43:39 ns382633 sshd\[32006\]: Failed password for invalid user office from 154.8.148.102 port 43100 ssh2
Mar 16 06:12:17 ns382633 sshd\[5014\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=154.8.148.102  user=root
Mar 16 06:12:18 ns382633 sshd\[5014\]: Failed password for root from 154.8.148.102 port 40142 ssh2

2020-03-16T09:34:27.146411homeassistant sshd[17952]: Failed none for root from 222.186.169.194 port 8420 ssh2
2020-03-16T09:34:27.360436homeassistant sshd[17952]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.169.194  user=root
...

88.99.222.59 - - \[16/Mar/2020:06:11:58 +0100\] "POST /wp-login.php HTTP/1.0" 200 6997 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"
88.99.222.59 - - \[16/Mar/2020:06:12:08 +0100\] "POST /wp-login.php HTTP/1.0" 200 6864 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"
88.99.222.59 - - \[16/Mar/2020:06:12:19 +0100\] "POST /wp-login.php HTTP/1.0" 200 6860 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"

Telnetd brute force attack detected by fail2ban

port scan and connect, tcp 23 (telnet)

xmlrpc attack

from [212.88.109.66] (port=56764 helo=mail-20.srv.mtn.co.ug)
	by sg3plcpnl0224.prod.sin3.secureserver.net with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)
	(Exim 4.92)
	(envelope-from )
	id 1jDfqc-00BjZk-BO; Sun, 15 Mar 2020 19:51:27 -0700

Mar 15 15:08:12 server sshd\[8778\]: Failed password for root from 196.203.31.154 port 58785 ssh2
Mar 16 06:29:23 server sshd\[30915\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=196.203.31.154  user=root
Mar 16 06:29:26 server sshd\[30915\]: Failed password for root from 196.203.31.154 port 43914 ssh2
Mar 16 08:12:29 server sshd\[22623\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=196.203.31.154  user=root
Mar 16 08:12:32 server sshd\[22623\]: Failed password for root from 196.203.31.154 port 50457 ssh2
...

Invalid user vncuser from 117.50.95.121 port 36168

MultiHost/MultiPort Probe, Scan, Hack -

20 attempts against mh-misbehave-ban on pluto