Invalid user antonio from 34.66.28.207 port 56574

Feb 14 13:46:53 marvibiene sshd[2674]: Invalid user byu from 34.66.28.207 port 42204
Feb 14 13:46:53 marvibiene sshd[2674]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.66.28.207
Feb 14 13:46:53 marvibiene sshd[2674]: Invalid user byu from 34.66.28.207 port 42204
Feb 14 13:46:55 marvibiene sshd[2674]: Failed password for invalid user byu from 34.66.28.207 port 42204 ssh2
...

Feb 11 19:20:04 plusreed sshd[26253]: Invalid user krister1 from 34.66.28.207
...

Jan 25 18:14:31 debian64 sshd\[4159\]: Invalid user qwerty from 34.66.28.207 port 42334
Jan 25 18:14:31 debian64 sshd\[4159\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.66.28.207
Jan 25 18:14:32 debian64 sshd\[4159\]: Failed password for invalid user qwerty from 34.66.28.207 port 42334 ssh2
...

Jan 21 11:25:09 * sshd[19610]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.66.28.207
Jan 21 11:25:11 * sshd[19610]: Failed password for invalid user zls from 34.66.28.207 port 38088 ssh2

Dec 20 09:37:00 zeus sshd[20713]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.66.28.207 
Dec 20 09:37:02 zeus sshd[20713]: Failed password for invalid user 1929 from 34.66.28.207 port 51552 ssh2
Dec 20 09:42:01 zeus sshd[20870]: Failed password for root from 34.66.28.207 port 33008 ssh2

Dec 19 19:41:58 ip-172-31-62-245 sshd\[19672\]: Invalid user wochatz from 34.66.28.207\
Dec 19 19:42:00 ip-172-31-62-245 sshd\[19672\]: Failed password for invalid user wochatz from 34.66.28.207 port 49716 ssh2\
Dec 19 19:46:50 ip-172-31-62-245 sshd\[19733\]: Failed password for root from 34.66.28.207 port 53582 ssh2\
Dec 19 19:51:31 ip-172-31-62-245 sshd\[19770\]: Invalid user ajith from 34.66.28.207\
Dec 19 19:51:33 ip-172-31-62-245 sshd\[19770\]: Failed password for invalid user ajith from 34.66.28.207 port 58176 ssh2\

Invalid user test from 34.66.28.207 port 42942

Invalid user kawatake from 34.66.28.207 port 53836

Dec 13 19:46:40 server sshd\[31380\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=207.28.66.34.bc.googleusercontent.com  user=root
Dec 13 19:46:43 server sshd\[31380\]: Failed password for root from 34.66.28.207 port 52394 ssh2
Dec 13 19:56:39 server sshd\[1862\]: Invalid user pathy from 34.66.28.207
Dec 13 19:56:39 server sshd\[1862\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=207.28.66.34.bc.googleusercontent.com 
Dec 13 19:56:41 server sshd\[1862\]: Failed password for invalid user pathy from 34.66.28.207 port 55190 ssh2
...

Dec 13 14:10:50 sd-53420 sshd\[18328\]: User root from 34.66.28.207 not allowed because none of user's groups are listed in AllowGroups
Dec 13 14:10:50 sd-53420 sshd\[18328\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.66.28.207  user=root
Dec 13 14:10:53 sd-53420 sshd\[18328\]: Failed password for invalid user root from 34.66.28.207 port 54838 ssh2
Dec 13 14:16:11 sd-53420 sshd\[18839\]: Invalid user hung from 34.66.28.207
Dec 13 14:16:11 sd-53420 sshd\[18839\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.66.28.207
...

Dec 11 21:02:16 web9 sshd\[22414\]: Invalid user krom from 34.66.28.207
Dec 11 21:02:16 web9 sshd\[22414\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.66.28.207
Dec 11 21:02:18 web9 sshd\[22414\]: Failed password for invalid user krom from 34.66.28.207 port 38726 ssh2
Dec 11 21:07:43 web9 sshd\[23273\]: Invalid user q1w2e3r4t5y6 from 34.66.28.207
Dec 11 21:07:43 web9 sshd\[23273\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.66.28.207

Fail2Ban - SSH Bruteforce Attempt

Dec 10 06:04:53 php1 sshd\[22271\]: Invalid user prue from 34.66.28.207
Dec 10 06:04:53 php1 sshd\[22271\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.66.28.207
Dec 10 06:04:55 php1 sshd\[22271\]: Failed password for invalid user prue from 34.66.28.207 port 52542 ssh2
Dec 10 06:10:09 php1 sshd\[22990\]: Invalid user drivebys from 34.66.28.207
Dec 10 06:10:09 php1 sshd\[22990\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.66.28.207

Dec  7 06:36:19 hpm sshd\[29329\]: Invalid user user from 34.66.28.207
Dec  7 06:36:19 hpm sshd\[29329\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=207.28.66.34.bc.googleusercontent.com
Dec  7 06:36:21 hpm sshd\[29329\]: Failed password for invalid user user from 34.66.28.207 port 47130 ssh2
Dec  7 06:41:41 hpm sshd\[29959\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=207.28.66.34.bc.googleusercontent.com  user=root
Dec  7 06:41:42 hpm sshd\[29959\]: Failed password for root from 34.66.28.207 port 36854 ssh2

Dec  6 08:15:41 mail sshd[14806]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.66.28.207 
Dec  6 08:15:43 mail sshd[14806]: Failed password for invalid user letmain from 34.66.28.207 port 42300 ssh2
Dec  6 08:21:10 mail sshd[16550]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.66.28.207

Dec  6 06:00:50 mail sshd[22368]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.66.28.207 
Dec  6 06:00:51 mail sshd[22368]: Failed password for invalid user alaily from 34.66.28.207 port 51592 ssh2
Dec  6 06:06:11 mail sshd[24293]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.66.28.207

Dec  5 08:14:39 srv206 sshd[30330]: Invalid user zz from 34.66.28.207
Dec  5 08:14:39 srv206 sshd[30330]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.66.28.207
Dec  5 08:14:39 srv206 sshd[30330]: Invalid user zz from 34.66.28.207
Dec  5 08:14:41 srv206 sshd[30330]: Failed password for invalid user zz from 34.66.28.207 port 56976 ssh2
...

Dec  1 02:52:02 plusreed sshd[29899]: Invalid user meel from 34.66.28.207
...

Nov 29 00:41:32 pkdns2 sshd\[62640\]: Invalid user blondy from 34.66.28.207Nov 29 00:41:34 pkdns2 sshd\[62640\]: Failed password for invalid user blondy from 34.66.28.207 port 46690 ssh2Nov 29 00:44:28 pkdns2 sshd\[62747\]: Invalid user fa from 34.66.28.207Nov 29 00:44:30 pkdns2 sshd\[62747\]: Failed password for invalid user fa from 34.66.28.207 port 54454 ssh2Nov 29 00:47:28 pkdns2 sshd\[62889\]: Invalid user yoyo from 34.66.28.207Nov 29 00:47:30 pkdns2 sshd\[62889\]: Failed password for invalid user yoyo from 34.66.28.207 port 34006 ssh2
...

Nov 27 23:10:52 web8 sshd\[5699\]: Invalid user Adventure123 from 34.66.28.207
Nov 27 23:10:52 web8 sshd\[5699\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.66.28.207
Nov 27 23:10:54 web8 sshd\[5699\]: Failed password for invalid user Adventure123 from 34.66.28.207 port 43996 ssh2
Nov 27 23:16:47 web8 sshd\[8722\]: Invalid user playboy from 34.66.28.207
Nov 27 23:16:47 web8 sshd\[8722\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.66.28.207

2019-11-26T07:16:02.857618shield sshd\[10358\]: Invalid user itinfra from 34.66.28.207 port 48266
2019-11-26T07:16:02.862159shield sshd\[10358\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=207.28.66.34.bc.googleusercontent.com
2019-11-26T07:16:04.691722shield sshd\[10358\]: Failed password for invalid user itinfra from 34.66.28.207 port 48266 ssh2
2019-11-26T07:22:20.670618shield sshd\[12658\]: Invalid user db2fenc from 34.66.28.207 port 56326
2019-11-26T07:22:20.674885shield sshd\[12658\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=207.28.66.34.bc.googleusercontent.com

Oracle WebLogic WLS Security Component Remote Code Execution Vulnerability 2017-10271, PTR: 207.28.66.34.bc.googleusercontent.com.

Brute forcing email accounts

Port probing on unauthorized port 23

03/07/2020-17:16:19.844261 92.118.37.95 Protocol: 6 ET SCAN NMAP -sS window 1024

$f2bV_matches

400 BAD REQUEST

80.82.78.100 was recorded 20 times by 11 hosts attempting to connect to the following ports: 41022,41092,40831. Incident counter (4h, 24h, all-time): 20, 122, 21050

Mar  7 23:29:45 lnxweb62 sshd[1075]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.230.48.59

firewall-block, port(s): 1900/tcp

[2020-03-07 17:56:26] NOTICE[1148] chan_sip.c: Registration from '"1601" ' failed for '45.143.220.164:5126' - Wrong password
[2020-03-07 17:56:26] SECURITY[1163] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-03-07T17:56:26.267-0500",Severity="Error",Service="SIP",EventVersion="2",AccountID="1601",SessionID="0x7fd82c40d3d8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/45.143.220.164/5126",Challenge="10db4086",ReceivedChallenge="10db4086",ReceivedHash="5b7c70e7f26436e200aca76caf55c1db"
[2020-03-07 17:56:26] NOTICE[1148] chan_sip.c: Registration from '"1601" ' failed for '45.143.220.164:5126' - Wrong password
[2020-03-07 17:56:26] SECURITY[1163] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-03-07T17:56:26.418-0500",Severity="Error",Service="SIP",EventVersion="2",AccountID="1601",SessionID="0x7fd82ca9d388",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP
...

Mar  7 23:13:56 vpn01 sshd[32536]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.134.146.117
Mar  7 23:13:58 vpn01 sshd[32536]: Failed password for invalid user cpanellogin from 45.134.146.117 port 42706 ssh2
...

Honeypot attack, port: 5555, PTR: unallocated.sta.lan.ua.

Mar  7 17:51:43 plusreed sshd[26249]: Invalid user chencaiping from 121.15.2.178
...

Mar  7 12:53:52 web1 sshd\[11033\]: Invalid user caikj from 45.129.3.91
Mar  7 12:53:52 web1 sshd\[11033\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.129.3.91
Mar  7 12:53:53 web1 sshd\[11033\]: Failed password for invalid user caikj from 45.129.3.91 port 42010 ssh2
Mar  7 12:58:56 web1 sshd\[11454\]: Invalid user wusifan from 45.129.3.91
Mar  7 12:58:56 web1 sshd\[11454\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.129.3.91

Automatic report - Port Scan Attack

firewall-block, port(s): 33604/tcp, 33611/tcp, 33612/tcp, 33619/tcp, 33620/tcp, 33629/tcp, 33646/tcp, 33647/tcp, 33654/tcp, 33662/tcp, 33669/tcp, 33678/tcp, 33688/tcp, 33693/tcp, 33695/tcp, 33696/tcp, 33705/tcp, 33706/tcp, 33710/tcp, 33712/tcp, 33713/tcp, 33721/tcp, 33722/tcp, 33728/tcp, 33747/tcp, 33750/tcp, 33753/tcp, 33754/tcp, 33761/tcp, 33762/tcp, 33766/tcp, 33768/tcp, 33769/tcp, 33773/tcp, 33779/tcp, 33780/tcp, 33785/tcp, 33786/tcp, 33787/tcp, 33801/tcp, 33806/tcp, 33810/tcp, 33812/tcp, 33813/tcp, 33816/tcp, 33818/tcp, 33821/tcp, 33826/tcp, 33827/tcp, 33828/tcp, 33831/tcp, 33835/tcp, 33842/tcp, 33848/tcp, 33853/tcp, 33875/tcp, 33876/tcp, 33888/tcp, 33896/tcp