Sep 28 00:55:58 localhost sshd\[21533\]: Invalid user ftp_test from 45.14.150.130
Sep 28 00:55:58 localhost sshd\[21533\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.14.150.130
Sep 28 00:56:00 localhost sshd\[21533\]: Failed password for invalid user ftp_test from 45.14.150.130 port 52920 ssh2
Sep 28 01:04:38 localhost sshd\[21805\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.14.150.130  user=root
Sep 28 01:04:40 localhost sshd\[21805\]: Failed password for root from 45.14.150.130 port 34036 ssh2
...

Sep 27 14:48:36 scw-6657dc sshd[10123]: Failed password for root from 45.14.150.130 port 37550 ssh2
Sep 27 14:48:36 scw-6657dc sshd[10123]: Failed password for root from 45.14.150.130 port 37550 ssh2
Sep 27 14:57:12 scw-6657dc sshd[10371]: Invalid user mc from 45.14.150.130 port 48166
...

k+ssh-bruteforce

ET CINS Active Threat Intelligence Poor Reputation IP group 23 - port: 30303 proto: tcp cat: Misc Attackbytes: 60

Aug 28 13:09:18 ajax sshd[26394]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.14.150.130 
Aug 28 13:09:21 ajax sshd[26394]: Failed password for invalid user brenda from 45.14.150.130 port 33854 ssh2

firewall-block, port(s): 2259/tcp

SSH Invalid Login

Aug 26 17:40:09 l02a sshd[12069]: Invalid user dalila from 45.14.150.130
Aug 26 17:40:09 l02a sshd[12069]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.14.150.130 
Aug 26 17:40:09 l02a sshd[12069]: Invalid user dalila from 45.14.150.130
Aug 26 17:40:11 l02a sshd[12069]: Failed password for invalid user dalila from 45.14.150.130 port 38692 ssh2

Invalid user justin from 45.14.150.130 port 41762

Aug 23 19:37:26 Invalid user nikhil from 45.14.150.130 port 45884

Aug 22 08:15:15 *** sshd[20309]: Invalid user igi from 45.14.150.130

Aug  3 18:52:07 vpn01 sshd[31777]: Failed password for root from 45.14.150.130 port 34416 ssh2
...

SSH Brute Force

Jul 18 17:21:44 vps333114 sshd[1802]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.14.150.130
Jul 18 17:21:46 vps333114 sshd[1802]: Failed password for invalid user postgres from 45.14.150.130 port 56054 ssh2
...

Scanned 3 times in the last 24 hours on port 22

 TCP (SYN) 45.14.150.130:47596 -> port 28079, len 44

srv02 Mass scanning activity detected Target: 1660  ..

SSH Brute Force

Multiport scan 28 ports : 1210 3968 8576 9714 12721 13762 14576 15822 16017 16160 16294 17807 17887 19629 20736 21857 22101 22276 24126 24782 25825 26550 27808 29293 29697 29862 31229 31769

Scanned 222 unique addresses for 5 unique ports in 24 hours (ports 12689,16160,21857,31577,31617)

ssh brute force

Bruteforce detected by fail2ban

firewall-block, port(s): 24126/tcp

fail2ban -- 45.14.150.130
...

$f2bV_matches

May  7 10:47:46 OPSO sshd\[16109\]: Invalid user matriz from 45.14.150.130 port 49466
May  7 10:47:46 OPSO sshd\[16109\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.14.150.130
May  7 10:47:48 OPSO sshd\[16109\]: Failed password for invalid user matriz from 45.14.150.130 port 49466 ssh2
May  7 10:56:09 OPSO sshd\[17483\]: Invalid user sonicwall from 45.14.150.130 port 59324
May  7 10:56:09 OPSO sshd\[17483\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.14.150.130

Apr  2 07:54:34 vpn01 sshd[12707]: Failed password for root from 45.14.150.130 port 53394 ssh2
...

SSH Brute-Force attacks

Mar 21 14:16:40 v22018086721571380 sshd[4469]: Failed password for invalid user couch from 45.14.150.130 port 50294 ssh2
Mar 21 15:18:05 v22018086721571380 sshd[15758]: Failed password for invalid user honeyridge from 45.14.150.130 port 35050 ssh2

Total attacks: 2

Banned for a week because repeated abuses, for example SSH, but not only

(sshd) Failed SSH login from 45.14.150.51 (RO/Romania/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Oct 10 08:12:10 server4 sshd[27424]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.14.150.51  user=nobody
Oct 10 08:12:12 server4 sshd[27424]: Failed password for nobody from 45.14.150.51 port 59558 ssh2
Oct 10 08:29:52 server4 sshd[10555]: Invalid user majordomo5 from 45.14.150.51
Oct 10 08:29:52 server4 sshd[10555]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.14.150.51 
Oct 10 08:29:54 server4 sshd[10555]: Failed password for invalid user majordomo5 from 45.14.150.51 port 56344 ssh2

sshd jail - ssh hack attempt

sshd jail - ssh hack attempt

Sep 22 12:51:43 ip106 sshd[9293]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.14.150.51 
Sep 22 12:51:46 ip106 sshd[9293]: Failed password for invalid user gb from 45.14.150.51 port 39746 ssh2
...

$f2bV_matches

2020-09-20T15:00:46.079720abusebot-3.cloudsearch.cf sshd[10613]: Invalid user frappe from 45.14.150.140 port 39690
2020-09-20T15:00:46.085728abusebot-3.cloudsearch.cf sshd[10613]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.14.150.140
2020-09-20T15:00:46.079720abusebot-3.cloudsearch.cf sshd[10613]: Invalid user frappe from 45.14.150.140 port 39690
2020-09-20T15:00:48.233131abusebot-3.cloudsearch.cf sshd[10613]: Failed password for invalid user frappe from 45.14.150.140 port 39690 ssh2
2020-09-20T15:09:48.367897abusebot-3.cloudsearch.cf sshd[10690]: Invalid user git from 45.14.150.140 port 50204
2020-09-20T15:09:48.373615abusebot-3.cloudsearch.cf sshd[10690]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.14.150.140
2020-09-20T15:09:48.367897abusebot-3.cloudsearch.cf sshd[10690]: Invalid user git from 45.14.150.140 port 50204
2020-09-20T15:09:50.595996abusebot-3.cloudsearch.cf sshd[10690]: Failed 
...

45.14.150.140 (RO/Romania/-), 5 distributed sshd attacks on account [root] in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_DISTATTACK; Logs: Sep 20 01:43:25 server2 sshd[12632]: Failed password for root from 51.79.84.101 port 47466 ssh2
Sep 20 01:43:10 server2 sshd[12434]: Failed password for root from 149.56.132.202 port 43078 ssh2
Sep 20 01:43:15 server2 sshd[12610]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.155.127.59  user=root
Sep 20 01:43:17 server2 sshd[12610]: Failed password for root from 139.155.127.59 port 53912 ssh2
Sep 20 01:43:34 server2 sshd[12715]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.14.150.140  user=root

IP Addresses Blocked:

51.79.84.101 (CA/Canada/-)
149.56.132.202 (CA/Canada/-)
139.155.127.59 (CN/China/-)

Invalid user server from 45.14.150.140 port 57638

Invalid user server from 45.14.150.140 port 43064

" "

Brute%20Force%20SSH

(sshd) Failed SSH login from 45.14.150.52 (RO/Romania/-): 3 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Sep 10 18:58:35 centos8 sshd[164313]: Invalid user test1 from 45.14.150.52 port 37620
Sep 10 18:58:37 centos8 sshd[164313]: Failed password for invalid user test1 from 45.14.150.52 port 37620 ssh2
Sep 10 19:08:22 centos8 sshd[164606]: Invalid user range from 45.14.150.52 port 53926

ET CINS Active Threat Intelligence Poor Reputation IP group 24 - port: 1722 proto: tcp cat: Misc Attackbytes: 60

[N10.H2.VM2] Port Scanner Detected Blocked by UFW

failed root login

Host Scan

Unauthorised access (Dec 25) SRC=31.171.86.215 LEN=44 TTL=245 ID=9863 TCP DPT=1433 WINDOW=1024 SYN

Dec 25 01:43:24 plusreed sshd[8621]: Invalid user idcsea from 14.98.215.178
...

Dec 25 09:26:00 zeus sshd[6659]: Failed password for root from 51.15.41.227 port 46522 ssh2
Dec 25 09:28:37 zeus sshd[6779]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.15.41.227 
Dec 25 09:28:38 zeus sshd[6779]: Failed password for invalid user server from 51.15.41.227 port 45874 ssh2

2019-12-25T10:49:36.517842scmdmz1 sshd[20649]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.85.42.89  user=root
2019-12-25T10:49:38.495480scmdmz1 sshd[20649]: Failed password for root from 112.85.42.89 port 42474 ssh2
2019-12-25T10:49:41.273420scmdmz1 sshd[20649]: Failed password for root from 112.85.42.89 port 42474 ssh2
2019-12-25T10:49:36.517842scmdmz1 sshd[20649]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.85.42.89  user=root
2019-12-25T10:49:38.495480scmdmz1 sshd[20649]: Failed password for root from 112.85.42.89 port 42474 ssh2
2019-12-25T10:49:41.273420scmdmz1 sshd[20649]: Failed password for root from 112.85.42.89 port 42474 ssh2
2019-12-25T10:49:36.517842scmdmz1 sshd[20649]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.85.42.89  user=root
2019-12-25T10:49:38.495480scmdmz1 sshd[20649]: Failed password for root from 112.85.42.89 port 42474 ssh2
2019-12-25T10:49:

1577255170 - 12/25/2019 07:26:10 Host: 125.214.51.215/125.214.51.215 Port: 445 TCP Blocked

Dec 25 10:23:16 MK-Soft-VM6 sshd[26224]: Failed password for root from 222.186.173.226 port 46390 ssh2
Dec 25 10:23:20 MK-Soft-VM6 sshd[26224]: Failed password for root from 222.186.173.226 port 46390 ssh2
...

(sshd) Failed SSH login from 50.127.71.5 (-): 5 in the last 3600 secs

1577255171 - 12/25/2019 07:26:11 Host: 167.98.9.36/167.98.9.36 Port: 445 TCP Blocked

Dec 25 03:55:24 plusreed sshd[9627]: Invalid user rinaldo from 122.51.167.47
...

Dec 25 09:25:56 server sshd\[14736\]: Invalid user pi from 202.107.222.142
Dec 25 09:25:56 server sshd\[14736\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.107.222.142 
Dec 25 09:25:58 server sshd\[14738\]: Invalid user pi from 202.107.222.142
Dec 25 09:25:58 server sshd\[14738\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.107.222.142 
Dec 25 09:25:59 server sshd\[14736\]: Failed password for invalid user pi from 202.107.222.142 port 36396 ssh2
...

Portscan or hack attempt detected by psad/fwsnort

Dec 24 11:29:46 vpxxxxxxx22308 sshd[17418]: Invalid user www from 221.215.203.218
Dec 24 11:29:46 vpxxxxxxx22308 sshd[17418]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.215.203.218
Dec 24 11:29:48 vpxxxxxxx22308 sshd[17418]: Failed password for invalid user www from 221.215.203.218 port 21024 ssh2
Dec 24 11:32:34 vpxxxxxxx22308 sshd[17850]: Invalid user takadasa from 221.215.203.218
Dec 24 11:32:34 vpxxxxxxx22308 sshd[17850]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.215.203.218
Dec 24 11:32:37 vpxxxxxxx22308 sshd[17850]: Failed password for invalid user takadasa from 221.215.203.218 port 43042 ssh2

........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=221.215.203.218

Dec 25 08:26:57 grey postfix/smtpd\[17709\]: NOQUEUE: reject: RCPT from squirrel.vidyad.com\[63.81.87.121\]: 554 5.7.1 Service unavailable\; Client host \[63.81.87.121\] blocked using truncate.gbudb.net\; http://www.gbudb.com/truncate/ \[63.81.87.121\]\; from=\ to=\ proto=ESMTP helo=\
...