2020-10-13T14:07:28.323293server.espacesoutien.com sshd[23783]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.64.5.28
2020-10-13T14:07:28.309269server.espacesoutien.com sshd[23783]: Invalid user marco from 212.64.5.28 port 37284
2020-10-13T14:07:30.057257server.espacesoutien.com sshd[23783]: Failed password for invalid user marco from 212.64.5.28 port 37284 ssh2
2020-10-13T14:10:13.781434server.espacesoutien.com sshd[24390]: Invalid user vn from 212.64.5.28 port 60462
...

2020-10-13T06:42:52.477795mail.standpoint.com.ua sshd[15474]: Invalid user gerhard from 212.64.5.28 port 40890
2020-10-13T06:42:52.480771mail.standpoint.com.ua sshd[15474]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.64.5.28
2020-10-13T06:42:52.477795mail.standpoint.com.ua sshd[15474]: Invalid user gerhard from 212.64.5.28 port 40890
2020-10-13T06:42:53.746708mail.standpoint.com.ua sshd[15474]: Failed password for invalid user gerhard from 212.64.5.28 port 40890 ssh2
2020-10-13T06:47:40.051144mail.standpoint.com.ua sshd[16155]: Invalid user oscar from 212.64.5.28 port 36990
...

2020-10-12T21:57:12.102478shield sshd\[8643\]: Invalid user harris from 212.64.5.28 port 39022
2020-10-12T21:57:12.109804shield sshd\[8643\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.64.5.28
2020-10-12T21:57:14.467871shield sshd\[8643\]: Failed password for invalid user harris from 212.64.5.28 port 39022 ssh2
2020-10-12T22:01:50.229312shield sshd\[9528\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.64.5.28  user=root
2020-10-12T22:01:52.085848shield sshd\[9528\]: Failed password for root from 212.64.5.28 port 35652 ssh2

$f2bV_matches

Oct 10 06:38:40 vps sshd[2837]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.64.5.28 
Oct 10 06:38:41 vps sshd[2837]: Failed password for invalid user sync1 from 212.64.5.28 port 46030 ssh2
Oct 10 07:03:54 vps sshd[4118]: Failed password for root from 212.64.5.28 port 39646 ssh2
...

Time:     Wed Sep 23 01:00:47 2020 +0000
IP:       212.64.5.28 (CN/China/-)
Failures: 5 (sshd)
Interval: 3600 seconds
Blocked:  Permanent Block [LF_SSHD]

Log entries:

Sep 23 00:31:27 3 sshd[23535]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.64.5.28  user=mysql
Sep 23 00:31:29 3 sshd[23535]: Failed password for mysql from 212.64.5.28 port 39848 ssh2
Sep 23 00:56:27 3 sshd[8362]: Invalid user jason from 212.64.5.28 port 46046
Sep 23 00:56:29 3 sshd[8362]: Failed password for invalid user jason from 212.64.5.28 port 46046 ssh2
Sep 23 01:00:43 3 sshd[13056]: Invalid user apagar from 212.64.5.28 port 45230

Time:     Wed Sep 23 01:00:47 2020 +0000
IP:       212.64.5.28 (CN/China/-)
Failures: 5 (sshd)
Interval: 3600 seconds
Blocked:  Permanent Block [LF_SSHD]

Log entries:

Sep 23 00:31:27 3 sshd[23535]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.64.5.28  user=mysql
Sep 23 00:31:29 3 sshd[23535]: Failed password for mysql from 212.64.5.28 port 39848 ssh2
Sep 23 00:56:27 3 sshd[8362]: Invalid user jason from 212.64.5.28 port 46046
Sep 23 00:56:29 3 sshd[8362]: Failed password for invalid user jason from 212.64.5.28 port 46046 ssh2
Sep 23 01:00:43 3 sshd[13056]: Invalid user apagar from 212.64.5.28 port 45230

Sep 22 20:26:24 ns382633 sshd\[24220\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.64.5.28  user=root
Sep 22 20:26:26 ns382633 sshd\[24220\]: Failed password for root from 212.64.5.28 port 51378 ssh2
Sep 22 20:39:57 ns382633 sshd\[26704\]: Invalid user ubuntu from 212.64.5.28 port 40308
Sep 22 20:39:58 ns382633 sshd\[26704\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.64.5.28
Sep 22 20:39:59 ns382633 sshd\[26704\]: Failed password for invalid user ubuntu from 212.64.5.28 port 40308 ssh2

Sep 21 09:02:21 OPSO sshd\[15328\]: Invalid user hadoop from 212.64.54.49 port 51074
Sep 21 09:02:21 OPSO sshd\[15328\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.64.54.49
Sep 21 09:02:23 OPSO sshd\[15328\]: Failed password for invalid user hadoop from 212.64.54.49 port 51074 ssh2
Sep 21 09:05:08 OPSO sshd\[16720\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.64.54.49  user=root
Sep 21 09:05:10 OPSO sshd\[16720\]: Failed password for root from 212.64.54.49 port 54488 ssh2

Sep 21 08:06:56 OPSO sshd\[24801\]: Invalid user test from 212.64.54.49 port 35770
Sep 21 08:06:56 OPSO sshd\[24801\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.64.54.49
Sep 21 08:06:58 OPSO sshd\[24801\]: Failed password for invalid user test from 212.64.54.49 port 35770 ssh2
Sep 21 08:12:16 OPSO sshd\[26572\]: Invalid user www from 212.64.54.49 port 42606
Sep 21 08:12:16 OPSO sshd\[26572\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.64.54.49

Sep 20 18:38:22 Ubuntu-1404-trusty-64-minimal sshd\[842\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.64.54.49  user=root
Sep 20 18:38:24 Ubuntu-1404-trusty-64-minimal sshd\[842\]: Failed password for root from 212.64.54.49 port 53340 ssh2
Sep 20 18:57:01 Ubuntu-1404-trusty-64-minimal sshd\[8514\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.64.54.49  user=root
Sep 20 18:57:03 Ubuntu-1404-trusty-64-minimal sshd\[8514\]: Failed password for root from 212.64.54.49 port 33578 ssh2
Sep 20 19:01:56 Ubuntu-1404-trusty-64-minimal sshd\[14687\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.64.54.49  user=root

SSH auth scanning - multiple failed logins

Invalid user noc from 212.64.5.28 port 52946

Sep  9 09:59:01 root sshd[531]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.64.5.28 
...

Sep  9 09:59:01 root sshd[531]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.64.5.28 
...

Feb  6 06:06:13 MK-Soft-VM7 sshd[11056]: Failed password for root from 222.186.30.31 port 35815 ssh2
Feb  6 06:06:16 MK-Soft-VM7 sshd[11056]: Failed password for root from 222.186.30.31 port 35815 ssh2
...

Feb  6 05:57:12 debian-2gb-nbg1-2 kernel: \[3224277.895304\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=89.248.162.136 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=247 ID=662 PROTO=TCP SPT=42955 DPT=2820 WINDOW=1024 RES=0x00 SYN URGP=0

2020-02-06T05:45:17.888263  sshd[25499]: Invalid user cyz from 124.29.236.163 port 58820
2020-02-06T05:45:17.902661  sshd[25499]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=124.29.236.163
2020-02-06T05:45:17.888263  sshd[25499]: Invalid user cyz from 124.29.236.163 port 58820
2020-02-06T05:45:19.156554  sshd[25499]: Failed password for invalid user cyz from 124.29.236.163 port 58820 ssh2
2020-02-06T05:57:17.555615  sshd[25772]: Invalid user rjl from 124.29.236.163 port 32902
...

(From SimonNash966@hotmail.com) Hello,

Have you ever considered to make upgrades with the user-interface of your website? Would you like to have helpful features integrated on it to help you run the business with ease for both you and your clients? Or have you ever thought about having a brand-new and better looking site that has all the modern features?

For the last six years of my experience in being a freelance web developer, I've helped many companies substantially increase their sales by helping them bring out the most out of their website for a cheap cost. I pay attention to what my clients needs are, so they can reach their business goals. 

I'd be delighted to show you my portfolio if you're interested. You'll be amazed how my designs helped my clients profit more out of their site. I'm also offering you a free consultation. Just tell me when you're free to be contacted. I look forward to speaking with you soon.

Simon Nash

Brute-force attempt banned

Brute force attempt

Feb  6 02:14:24 debian64 sshd\[8442\]: Invalid user ubnt from 115.75.217.124 port 51467
Feb  6 02:14:24 debian64 sshd\[8442\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.75.217.124
Feb  6 02:14:26 debian64 sshd\[8442\]: Failed password for invalid user ubnt from 115.75.217.124 port 51467 ssh2
...

Feb  6 03:33:30 eventyay sshd[30782]: Failed password for root from 218.92.0.211 port 58614 ssh2
Feb  6 03:39:40 eventyay sshd[30816]: Failed password for root from 218.92.0.211 port 20505 ssh2
...

Feb  6 08:01:21 areeb-Workstation sshd[15677]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=184.147.124.75 
Feb  6 08:01:23 areeb-Workstation sshd[15677]: Failed password for invalid user zeq from 184.147.124.75 port 43494 ssh2
...

Feb  6 02:12:17 srv01 sshd[4345]: Invalid user rmr from 106.13.233.178 port 49494
Feb  6 02:12:17 srv01 sshd[4345]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.233.178
Feb  6 02:12:17 srv01 sshd[4345]: Invalid user rmr from 106.13.233.178 port 49494
Feb  6 02:12:19 srv01 sshd[4345]: Failed password for invalid user rmr from 106.13.233.178 port 49494 ssh2
Feb  6 02:14:07 srv01 sshd[4455]: Invalid user bbi from 106.13.233.178 port 35564
...

Automatic report - Port Scan Attack

Feb  6 04:55:26 web8 sshd\[15759\]: Invalid user mtp from 188.6.161.77
Feb  6 04:55:26 web8 sshd\[15759\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.6.161.77
Feb  6 04:55:27 web8 sshd\[15759\]: Failed password for invalid user mtp from 188.6.161.77 port 51055 ssh2
Feb  6 04:57:09 web8 sshd\[16713\]: Invalid user jun from 188.6.161.77
Feb  6 04:57:09 web8 sshd\[16713\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.6.161.77

[2020-02-05 21:27:09] NOTICE[1148][C-0000696a] chan_sip.c: Call from '' (185.53.88.29:5071) to extension '011972595778361' rejected because extension not found in context 'public'.
[2020-02-05 21:27:09] SECURITY[1163] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-02-05T21:27:09.207-0500",Severity="Error",Service="SIP",EventVersion="1",AccountID="011972595778361",SessionID="0x7fd82c31abc8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/185.53.88.29/5071",ACLName="no_extension_match"
[2020-02-05 21:32:41] NOTICE[1148][C-00006971] chan_sip.c: Call from '' (185.53.88.29:5070) to extension '9011972595778361' rejected because extension not found in context 'public'.
[2020-02-05 21:32:41] SECURITY[1163] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-02-05T21:32:41.666-0500",Severity="Error",Service="SIP",EventVersion="1",AccountID="9011972595778361",SessionID="0x7fd82c3c1c38",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/185.
...

Feb  6 05:57:17 mout sshd[12436]: Invalid user tlc from 83.102.58.122 port 38068

Fail2Ban Ban Triggered