Nov 11 15:40:25 h2177944 kernel: \[6358779.915352\] \[UFW BLOCK\] IN=venet0 OUT= MAC= SRC=45.136.110.43 DST=85.214.117.9 LEN=40 TOS=0x00 PREC=0x00 TTL=248 ID=54504 PROTO=TCP SPT=52801 DPT=1439 WINDOW=1024 RES=0x00 SYN URGP=0 
Nov 11 15:44:40 h2177944 kernel: \[6359035.274057\] \[UFW BLOCK\] IN=venet0 OUT= MAC= SRC=45.136.110.43 DST=85.214.117.9 LEN=40 TOS=0x00 PREC=0x00 TTL=248 ID=24756 PROTO=TCP SPT=52801 DPT=1408 WINDOW=1024 RES=0x00 SYN URGP=0 
Nov 11 15:52:06 h2177944 kernel: \[6359481.409706\] \[UFW BLOCK\] IN=venet0 OUT= MAC= SRC=45.136.110.43 DST=85.214.117.9 LEN=40 TOS=0x00 PREC=0x00 TTL=248 ID=47723 PROTO=TCP SPT=52801 DPT=1201 WINDOW=1024 RES=0x00 SYN URGP=0 
Nov 11 15:55:07 h2177944 kernel: \[6359662.286145\] \[UFW BLOCK\] IN=venet0 OUT= MAC= SRC=45.136.110.43 DST=85.214.117.9 LEN=40 TOS=0x00 PREC=0x00 TTL=249 ID=53681 PROTO=TCP SPT=52801 DPT=1583 WINDOW=1024 RES=0x00 SYN URGP=0 
Nov 11 15:55:14 h2177944 kernel: \[6359668.957840\] \[UFW BLOCK\] IN=venet0 OUT= MAC= SRC=45.136.110.43 DST=85.214.117.9

Nov  5 20:14:15 h2177944 kernel: \[5856900.734467\] \[UFW BLOCK\] IN=venet0 OUT= MAC= SRC=45.136.110.43 DST=85.214.117.9 LEN=40 TOS=0x00 PREC=0x00 TTL=248 ID=47635 PROTO=TCP SPT=50341 DPT=428 WINDOW=1024 RES=0x00 SYN URGP=0 
Nov  5 20:17:27 h2177944 kernel: \[5857092.925218\] \[UFW BLOCK\] IN=venet0 OUT= MAC= SRC=45.136.110.43 DST=85.214.117.9 LEN=40 TOS=0x00 PREC=0x00 TTL=248 ID=22721 PROTO=TCP SPT=50341 DPT=1655 WINDOW=1024 RES=0x00 SYN URGP=0 
Nov  5 20:25:32 h2177944 kernel: \[5857577.910269\] \[UFW BLOCK\] IN=venet0 OUT= MAC= SRC=45.136.110.43 DST=85.214.117.9 LEN=40 TOS=0x00 PREC=0x00 TTL=248 ID=11337 PROTO=TCP SPT=50341 DPT=73 WINDOW=1024 RES=0x00 SYN URGP=0 
Nov  5 20:41:27 h2177944 kernel: \[5858532.605664\] \[UFW BLOCK\] IN=venet0 OUT= MAC= SRC=45.136.110.43 DST=85.214.117.9 LEN=40 TOS=0x00 PREC=0x00 TTL=249 ID=39272 PROTO=TCP SPT=50341 DPT=763 WINDOW=1024 RES=0x00 SYN URGP=0 
Nov  5 20:41:50 h2177944 kernel: \[5858555.159779\] \[UFW BLOCK\] IN=venet0 OUT= MAC= SRC=45.136.110.43 DST=85.214.117.9 LEN

firewall-block, port(s): 7/tcp, 77/tcp, 485/tcp, 524/tcp, 631/tcp, 670/tcp, 700/tcp, 876/tcp, 922/tcp, 1015/tcp, 1257/tcp, 1593/tcp

Attempted to connect 2 times to port 1016 TCP

Scanning random ports - tries to find possible vulnerable services

TCP scanned

Mar 13 18:33:09 debian-2gb-nbg1-2 kernel: \[6379921.888201\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=45.136.110.25 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=247 ID=31856 PROTO=TCP SPT=45838 DPT=2891 WINDOW=1024 RES=0x00 SYN URGP=0

Mar 13 05:18:39 debian-2gb-nbg1-2 kernel: \[6332254.684603\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=45.136.110.25 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=247 ID=29917 PROTO=TCP SPT=42567 DPT=5768 WINDOW=1024 RES=0x00 SYN URGP=0

Mar 12 18:54:02 debian-2gb-nbg1-2 kernel: \[6294779.364795\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=45.136.110.25 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=50546 PROTO=TCP SPT=40824 DPT=3009 WINDOW=1024 RES=0x00 SYN URGP=0

Mar 12 06:06:36 debian-2gb-nbg1-2 kernel: \[6248736.057240\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=45.136.110.25 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=36529 PROTO=TCP SPT=40824 DPT=3230 WINDOW=1024 RES=0x00 SYN URGP=0

Mar 11 20:18:44 debian-2gb-nbg1-2 kernel: \[6213465.545709\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=45.136.110.25 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=44819 PROTO=TCP SPT=52822 DPT=4035 WINDOW=1024 RES=0x00 SYN URGP=0

Mar 11 06:03:41 debian-2gb-nbg1-2 kernel: \[6162165.528514\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=45.136.110.25 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=247 ID=63434 PROTO=TCP SPT=51295 DPT=3710 WINDOW=1024 RES=0x00 SYN URGP=0

Scanning random ports - tries to find possible vulnerable services

Mar  9 00:46:54 debian-2gb-nbg1-2 kernel: \[5970368.159838\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=45.136.110.25 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=247 ID=43699 PROTO=TCP SPT=53340 DPT=5288 WINDOW=1024 RES=0x00 SYN URGP=0

Mar  8 17:38:09 debian-2gb-nbg1-2 kernel: \[5944645.387471\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=45.136.110.25 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=53755 PROTO=TCP SPT=53340 DPT=5263 WINDOW=1024 RES=0x00 SYN URGP=0

Mar  8 02:00:28 debian-2gb-nbg1-2 kernel: \[5888387.149380\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=45.136.110.25 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=57156 PROTO=TCP SPT=49617 DPT=4308 WINDOW=1024 RES=0x00 SYN URGP=0

Mar  7 14:08:54 debian-2gb-nbg1-2 kernel: \[5845695.146432\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=45.136.110.25 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=45338 PROTO=TCP SPT=49617 DPT=4364 WINDOW=1024 RES=0x00 SYN URGP=0

Mar  5 23:22:53 debian-2gb-nbg1-2 kernel: \[5706141.085150\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=45.136.110.25 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=46803 PROTO=TCP SPT=56630 DPT=12121 WINDOW=1024 RES=0x00 SYN URGP=0

Mar  5 01:11:04 debian-2gb-nbg1-2 kernel: \[5626236.499804\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=45.136.110.25 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=60913 PROTO=TCP SPT=59333 DPT=3934 WINDOW=1024 RES=0x00 SYN URGP=0

Attempt to attack host OS, exploiting network vulnerabilities, on 04-03-2020 13:35:09.

Aug 2 17:20:28 *hidden* sshd[9513]: Failed password for *hidden* from 180.76.163.33 port 56962 ssh2 Aug 2 17:24:37 *hidden* sshd[20052]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.163.33 user=root Aug 2 17:24:39 *hidden* sshd[20052]: Failed password for *hidden* from 180.76.163.33 port 40618 ssh2 Aug 2 17:28:34 *hidden* sshd[29709]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.163.33 user=root Aug 2 17:28:36 *hidden* sshd[29709]: Failed password for *hidden* from 180.76.163.33 port 52510 ssh2

1596369941 - 08/02/2020 14:05:41 Host: 180.242.183.200/180.242.183.200 Port: 445 TCP Blocked

2020-08-02T13:55:07.9568991495-001 sshd[35046]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.236.142.89  user=root
2020-08-02T13:55:10.3408841495-001 sshd[35046]: Failed password for root from 104.236.142.89 port 46630 ssh2
2020-08-02T13:58:51.3641461495-001 sshd[35209]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.236.142.89  user=root
2020-08-02T13:58:53.1657141495-001 sshd[35209]: Failed password for root from 104.236.142.89 port 58628 ssh2
2020-08-02T14:02:38.8119261495-001 sshd[35442]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.236.142.89  user=root
2020-08-02T14:02:41.1105641495-001 sshd[35442]: Failed password for root from 104.236.142.89 port 42386 ssh2
...

Aug  2 19:28:27 mail sshd[12472]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=13.72.107.84  user=root
Aug  2 19:28:29 mail sshd[12472]: Failed password for root from 13.72.107.84 port 52476 ssh2
...

 TCP (SYN) 192.241.130.161:52857 -> port 22, len 44

Aug  2 17:12:46 fhem-rasp sshd[8124]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.131.189.116  user=root
Aug  2 17:12:49 fhem-rasp sshd[8124]: Failed password for root from 104.131.189.116 port 38730 ssh2
...

Aug  2 16:42:16 *** sshd[6409]: User root from 58.250.0.73 not allowed because not listed in AllowUsers

Aug  2 19:25:56 root sshd[15611]: Failed password for root from 125.99.46.50 port 57044 ssh2
Aug  2 19:31:54 root sshd[16340]: Failed password for root from 125.99.46.50 port 39940 ssh2
...

20 attempts against mh-misbehave-ban on wood

Aug  2 12:34:32 django-0 sshd[23602]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.145.192.106  user=root
Aug  2 12:34:34 django-0 sshd[23602]: Failed password for root from 190.145.192.106 port 36112 ssh2
...

Aug  2 17:44:15 localhost sshd[74419]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.209.0.103  user=root
Aug  2 17:44:16 localhost sshd[74419]: Failed password for root from 85.209.0.103 port 4184 ssh2
Aug  2 17:44:14 localhost sshd[74413]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.209.0.103  user=root
Aug  2 17:44:17 localhost sshd[74413]: Failed password for root from 85.209.0.103 port 4212 ssh2
Aug  2 17:44:14 localhost sshd[74415]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.209.0.103  user=root
Aug  2 17:44:17 localhost sshd[74415]: Failed password for root from 85.209.0.103 port 4194 ssh2
...

Aug  2 20:34:54 OPSO sshd\[21691\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.225.60.57  user=root
Aug  2 20:34:56 OPSO sshd\[21691\]: Failed password for root from 121.225.60.57 port 39602 ssh2
Aug  2 20:38:15 OPSO sshd\[22418\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.225.60.57  user=root
Aug  2 20:38:17 OPSO sshd\[22418\]: Failed password for root from 121.225.60.57 port 58132 ssh2
Aug  2 20:41:49 OPSO sshd\[23210\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.225.60.57  user=root

Aug  2 15:49:12 plg sshd[16582]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=171.243.115.194  user=root
Aug  2 15:49:14 plg sshd[16582]: Failed password for invalid user root from 171.243.115.194 port 57708 ssh2
Aug  2 15:51:09 plg sshd[16599]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=171.243.115.194  user=root
Aug  2 15:51:11 plg sshd[16599]: Failed password for invalid user root from 171.243.115.194 port 46612 ssh2
Aug  2 15:52:56 plg sshd[16617]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=171.243.115.194  user=root
Aug  2 15:52:59 plg sshd[16617]: Failed password for invalid user root from 171.243.115.194 port 35506 ssh2
Aug  2 15:54:43 plg sshd[16623]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=171.243.115.194  user=root
...

Lines containing failures of 177.134.165.24
Aug  1 09:38:17 newdogma sshd[23970]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.134.165.24  user=r.r
Aug  1 09:38:19 newdogma sshd[23970]: Failed password for r.r from 177.134.165.24 port 54493 ssh2
Aug  1 09:38:20 newdogma sshd[23970]: Received disconnect from 177.134.165.24 port 54493:11: Bye Bye [preauth]
Aug  1 09:38:20 newdogma sshd[23970]: Disconnected from authenticating user r.r 177.134.165.24 port 54493 [preauth]
Aug  1 09:46:32 newdogma sshd[24304]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.134.165.24  user=r.r
Aug  1 09:46:35 newdogma sshd[24304]: Failed password for r.r from 177.134.165.24 port 41909 ssh2
Aug  1 09:46:36 newdogma sshd[24304]: Received disconnect from 177.134.165.24 port 41909:11: Bye Bye [preauth]
Aug  1 09:46:36 newdogma sshd[24304]: Disconnected from authenticating user r.r 177.134.165.24 port 41909........
------------------------------

Brute-force attempt banned