MultiHost/MultiPort Probe, Scan, Hack -

Fail2Ban Ban Triggered (2)

Apr  2 13:05:42 ntop sshd[2657]: User r.r from 111.231.78.60 not allowed because not listed in AllowUsers
Apr  2 13:05:42 ntop sshd[2657]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.78.60  user=r.r
Apr  2 13:05:44 ntop sshd[2657]: Failed password for invalid user r.r from 111.231.78.60 port 48406 ssh2
Apr  2 13:05:45 ntop sshd[2657]: Received disconnect from 111.231.78.60 port 48406:11: Bye Bye [preauth]
Apr  2 13:05:45 ntop sshd[2657]: Disconnected from invalid user r.r 111.231.78.60 port 48406 [preauth]
Apr  2 13:23:21 ntop sshd[6812]: User r.r from 111.231.78.60 not allowed because not listed in AllowUsers
Apr  2 13:23:21 ntop sshd[6812]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.78.60  user=r.r
Apr  2 13:23:23 ntop sshd[6812]: Failed password for invalid user r.r from 111.231.78.60 port 59138 ssh2
Apr  2 13:23:24 ntop sshd[6812]: Received disconnect from 111.23........
-------------------------------

Automatic report - Port Scan Attack

SSH/22 MH Probe, BF, Hack -

04/02/2020-08:42:46.055418 198.108.67.58 Protocol: 6 ET DROP Dshield Block Listed Source group 1

(sshd) Failed SSH login from 117.50.107.175 (CN/China/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Apr  2 20:01:08 amsweb01 sshd[5541]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.50.107.175  user=root
Apr  2 20:01:10 amsweb01 sshd[5541]: Failed password for root from 117.50.107.175 port 34982 ssh2
Apr  2 20:31:53 amsweb01 sshd[9396]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.50.107.175  user=root
Apr  2 20:31:55 amsweb01 sshd[9396]: Failed password for root from 117.50.107.175 port 60290 ssh2
Apr  2 20:36:34 amsweb01 sshd[10033]: Invalid user testtest from 117.50.107.175 port 49692

SSH authentication failure x 6 reported by Fail2Ban
...

Apr  2 20:59:09 v22019038103785759 sshd\[1366\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.175.140  user=root
Apr  2 20:59:10 v22019038103785759 sshd\[1366\]: Failed password for root from 222.186.175.140 port 43072 ssh2
Apr  2 20:59:14 v22019038103785759 sshd\[1366\]: Failed password for root from 222.186.175.140 port 43072 ssh2
Apr  2 20:59:17 v22019038103785759 sshd\[1366\]: Failed password for root from 222.186.175.140 port 43072 ssh2
Apr  2 20:59:21 v22019038103785759 sshd\[1366\]: Failed password for root from 222.186.175.140 port 43072 ssh2
...

(imapd) Failed IMAP login from 194.135.15.6 (RU/Russia/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Apr  2 17:11:45 ir1 dovecot[566034]: imap-login: Disconnected (auth failed, 1 attempts in 2 secs): user=, method=PLAIN, rip=194.135.15.6, lip=5.63.12.44, TLS: Connection closed, session=

2020-04-02T18:34:25.372907ns386461 sshd\[18635\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=078088008252.bialystok.vectranet.pl  user=root
2020-04-02T18:34:27.113115ns386461 sshd\[18635\]: Failed password for root from 78.88.8.252 port 55138 ssh2
2020-04-02T18:44:06.099895ns386461 sshd\[27875\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=078088008252.bialystok.vectranet.pl  user=root
2020-04-02T18:44:07.934510ns386461 sshd\[27875\]: Failed password for root from 78.88.8.252 port 48944 ssh2
2020-04-02T18:53:27.817008ns386461 sshd\[3952\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=078088008252.bialystok.vectranet.pl  user=root
...

Apr  2 18:23:53 localhost sshd[65394]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=modemcable113.131-56-74.mc.videotron.ca  user=root
Apr  2 18:23:55 localhost sshd[65394]: Failed password for root from 74.56.131.113 port 36830 ssh2
Apr  2 18:27:47 localhost sshd[65764]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=modemcable113.131-56-74.mc.videotron.ca  user=root
Apr  2 18:27:49 localhost sshd[65764]: Failed password for root from 74.56.131.113 port 50036 ssh2
Apr  2 18:31:33 localhost sshd[66165]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=modemcable113.131-56-74.mc.videotron.ca  user=root
Apr  2 18:31:36 localhost sshd[66165]: Failed password for root from 74.56.131.113 port 34704 ssh2
...

MultiHost/MultiPort Probe, Scan, Hack -

Lines containing failures of 67.210.111.94
Apr  1 19:48:03 shared03 sshd[32553]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=67.210.111.94  user=r.r
Apr  1 19:48:05 shared03 sshd[32553]: Failed password for r.r from 67.210.111.94 port 55662 ssh2
Apr  1 19:48:05 shared03 sshd[32553]: Received disconnect from 67.210.111.94 port 55662:11: Bye Bye [preauth]
Apr  1 19:48:05 shared03 sshd[32553]: Disconnected from authenticating user r.r 67.210.111.94 port 55662 [preauth]
Apr  1 19:57:40 shared03 sshd[3402]: Invalid user ftpsecure from 67.210.111.94 port 40462
Apr  1 19:57:40 shared03 sshd[3402]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=67.210.111.94
Apr  1 19:57:41 shared03 sshd[3402]: Failed password for invalid user ftpsecure from 67.210.111.94 port 40462 ssh2
Apr  1 19:57:42 shared03 sshd[3402]: Received disconnect from 67.210.111.94 port 40462:11: Bye Bye [preauth]
Apr  1 19:57:42 s........
------------------------------

Trolling for resource vulnerabilities