Unauthorized connection attempt from IP address 49.231.201.146 on Port 445(SMB)

Honeypot attack, port: 445, PTR: PTR record not found

20/2/12@23:48:23: FAIL: Alarm-Network address from=49.231.201.146
20/2/12@23:48:23: FAIL: Alarm-Network address from=49.231.201.146
...

2020-06-17T19:39:26.498339+02:00  sshd[8987]: Failed password for root from 49.231.201.242 port 51646 ssh2

Jun  9 00:57:02 lnxweb62 sshd[28443]: Failed password for root from 49.231.201.242 port 49392 ssh2
Jun  9 00:57:02 lnxweb62 sshd[28443]: Failed password for root from 49.231.201.242 port 49392 ssh2
Jun  9 01:00:56 lnxweb62 sshd[30753]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.231.201.242

Invalid user dominic from 49.231.201.242 port 57876

May 25 15:46:04 localhost sshd\[2902\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.231.201.242  user=root
May 25 15:46:06 localhost sshd\[2902\]: Failed password for root from 49.231.201.242 port 57778 ssh2
May 25 15:50:18 localhost sshd\[3309\]: Invalid user phion from 49.231.201.242
May 25 15:50:18 localhost sshd\[3309\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.231.201.242
May 25 15:50:20 localhost sshd\[3309\]: Failed password for invalid user phion from 49.231.201.242 port 49712 ssh2
...

odoo8
...

May 12 07:03:27 localhost sshd\[4234\]: Invalid user ms from 49.231.201.242
May 12 07:03:27 localhost sshd\[4234\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.231.201.242
May 12 07:03:29 localhost sshd\[4234\]: Failed password for invalid user ms from 49.231.201.242 port 54960 ssh2
May 12 07:07:54 localhost sshd\[4558\]: Invalid user postgres from 49.231.201.242
May 12 07:07:54 localhost sshd\[4558\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.231.201.242
...

May  9 19:33:53 hanapaa sshd\[25890\]: Invalid user user from 49.231.201.242
May  9 19:33:53 hanapaa sshd\[25890\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.231.201.242
May  9 19:33:55 hanapaa sshd\[25890\]: Failed password for invalid user user from 49.231.201.242 port 38486 ssh2
May  9 19:38:27 hanapaa sshd\[26223\]: Invalid user test from 49.231.201.242
May  9 19:38:27 hanapaa sshd\[26223\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.231.201.242

Apr 26 11:56:08 ip-172-31-62-245 sshd\[4801\]: Invalid user demohcq from 49.231.201.242\
Apr 26 11:56:10 ip-172-31-62-245 sshd\[4801\]: Failed password for invalid user demohcq from 49.231.201.242 port 36622 ssh2\
Apr 26 12:00:04 ip-172-31-62-245 sshd\[4847\]: Invalid user samp from 49.231.201.242\
Apr 26 12:00:06 ip-172-31-62-245 sshd\[4847\]: Failed password for invalid user samp from 49.231.201.242 port 52508 ssh2\
Apr 26 12:03:59 ip-172-31-62-245 sshd\[4875\]: Invalid user kato from 49.231.201.242\

Apr 25 06:46:27 PorscheCustomer sshd[22815]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.231.201.242
Apr 25 06:46:29 PorscheCustomer sshd[22815]: Failed password for invalid user itagaki from 49.231.201.242 port 42392 ssh2
Apr 25 06:51:10 PorscheCustomer sshd[23040]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.231.201.242
...

Apr 14 15:17:23 server sshd[13672]: Failed password for invalid user lisa from 49.231.201.242 port 50850 ssh2
Apr 14 15:21:27 server sshd[16931]: Failed password for root from 49.231.201.242 port 39374 ssh2
Apr 14 15:29:37 server sshd[24450]: Failed password for root from 49.231.201.242 port 44650 ssh2

Apr 11 06:57:13 host01 sshd[4299]: Failed password for root from 49.231.201.242 port 33508 ssh2
Apr 11 07:01:52 host01 sshd[5166]: Failed password for root from 49.231.201.242 port 57116 ssh2
...

SSH Brute-Force reported by Fail2Ban

(sshd) Failed SSH login from 49.231.201.242 (TH/Thailand/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Mar 23 16:35:05 amsweb01 sshd[6290]: Invalid user o2 from 49.231.201.242 port 43784
Mar 23 16:35:07 amsweb01 sshd[6290]: Failed password for invalid user o2 from 49.231.201.242 port 43784 ssh2
Mar 23 16:45:30 amsweb01 sshd[7512]: Invalid user yangdeyue from 49.231.201.242 port 47746
Mar 23 16:45:33 amsweb01 sshd[7512]: Failed password for invalid user yangdeyue from 49.231.201.242 port 47746 ssh2
Mar 23 16:53:15 amsweb01 sshd[8288]: Invalid user mongo from 49.231.201.242 port 39570

Mar 23 09:27:35 server sshd\[25810\]: Invalid user infowarelab from 49.231.201.242
Mar 23 09:27:35 server sshd\[25810\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.231.201.242 
Mar 23 09:27:36 server sshd\[25810\]: Failed password for invalid user infowarelab from 49.231.201.242 port 45454 ssh2
Mar 23 09:36:38 server sshd\[27803\]: Invalid user chenyang from 49.231.201.242
Mar 23 09:36:38 server sshd\[27803\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.231.201.242 
...

Mar  9 02:11:31 server sshd[3601559]: Failed password for invalid user ubuntu from 49.231.201.242 port 57330 ssh2
Mar  9 02:16:04 server sshd[3612049]: Failed password for invalid user carlos from 49.231.201.242 port 53466 ssh2
Mar  9 02:20:43 server sshd[3619709]: Failed password for invalid user tanghao from 49.231.201.242 port 49600 ssh2

Oct  3 18:27:57 php1 sshd\[1704\]: Invalid user Columbus123 from 162.243.158.198
Oct  3 18:27:57 php1 sshd\[1704\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.243.158.198
Oct  3 18:27:59 php1 sshd\[1704\]: Failed password for invalid user Columbus123 from 162.243.158.198 port 40404 ssh2
Oct  3 18:32:06 php1 sshd\[2063\]: Invalid user QWE!@\# from 162.243.158.198
Oct  3 18:32:06 php1 sshd\[2063\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.243.158.198

Oct  3 18:11:46 tdfoods sshd\[7412\]: Invalid user 6tfc7ygv from 51.91.249.178
Oct  3 18:11:46 tdfoods sshd\[7412\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.ip-51-91-249.eu
Oct  3 18:11:48 tdfoods sshd\[7412\]: Failed password for invalid user 6tfc7ygv from 51.91.249.178 port 52060 ssh2
Oct  3 18:16:03 tdfoods sshd\[7754\]: Invalid user Root@1234 from 51.91.249.178
Oct  3 18:16:03 tdfoods sshd\[7754\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.ip-51-91-249.eu

2019-10-04T03:50:32.237054shield sshd\[13992\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.142.0  user=root
2019-10-04T03:50:33.951686shield sshd\[13992\]: Failed password for root from 128.199.142.0 port 59152 ssh2
2019-10-04T03:55:03.491313shield sshd\[14497\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.142.0  user=root
2019-10-04T03:55:06.078769shield sshd\[14497\]: Failed password for root from 128.199.142.0 port 43248 ssh2
2019-10-04T03:59:35.885980shield sshd\[15175\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.142.0  user=root

Oct  4 06:20:15 vps01 sshd[29064]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.120.63.89
Oct  4 06:20:17 vps01 sshd[29064]: Failed password for invalid user Salon123 from 210.120.63.89 port 43403 ssh2

ECShop Remote Code Execution Vulnerability, PTR: PTR record not found

Oct  3 18:30:17 php1 sshd\[5631\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=s010600f28b41237d.gv.shawcable.net  user=root
Oct  3 18:30:19 php1 sshd\[5631\]: Failed password for root from 184.66.248.150 port 35032 ssh2
Oct  3 18:34:13 php1 sshd\[6010\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=s010600f28b41237d.gv.shawcable.net  user=root
Oct  3 18:34:15 php1 sshd\[6010\]: Failed password for root from 184.66.248.150 port 47970 ssh2
Oct  3 18:38:08 php1 sshd\[6523\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=s010600f28b41237d.gv.shawcable.net  user=root

Oct  4 06:31:47 legacy sshd[2487]: Failed password for root from 222.186.173.142 port 58540 ssh2
Oct  4 06:31:51 legacy sshd[2487]: Failed password for root from 222.186.173.142 port 58540 ssh2
Oct  4 06:31:56 legacy sshd[2487]: Failed password for root from 222.186.173.142 port 58540 ssh2
Oct  4 06:32:00 legacy sshd[2487]: Failed password for root from 222.186.173.142 port 58540 ssh2
...

Oct  4 06:55:10 www5 sshd\[35292\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=151.80.155.98  user=root
Oct  4 06:55:13 www5 sshd\[35292\]: Failed password for root from 151.80.155.98 port 37084 ssh2
Oct  4 06:59:25 www5 sshd\[36033\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=151.80.155.98  user=root
...

Oct  4 06:46:55 mail sshd\[7179\]: Failed password for root from 218.92.0.173 port 16032 ssh2
Oct  4 06:46:58 mail sshd\[7179\]: Failed password for root from 218.92.0.173 port 16032 ssh2
Oct  4 06:46:58 mail sshd\[7179\]: error: maximum authentication attempts exceeded for root from 218.92.0.173 port 16032 ssh2 \[preauth\]
Oct  4 06:47:01 mail sshd\[7214\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.173  user=root
Oct  4 06:47:03 mail sshd\[7214\]: Failed password for root from 218.92.0.173 port 38892 ssh2

DATE:2019-10-04 05:48:54, IP:177.158.177.184, PORT:telnet Telnet brute force auth on honeypot server (honey-neo-dc-bis)

" "

Oct  4 06:56:49 site3 sshd\[10348\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.173.80.134  user=root
Oct  4 06:56:51 site3 sshd\[10348\]: Failed password for root from 188.173.80.134 port 45078 ssh2
Oct  4 07:00:55 site3 sshd\[10456\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.173.80.134  user=root
Oct  4 07:00:57 site3 sshd\[10456\]: Failed password for root from 188.173.80.134 port 36941 ssh2
Oct  4 07:05:16 site3 sshd\[10578\]: Invalid user 123 from 188.173.80.134
Oct  4 07:05:16 site3 sshd\[10578\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.173.80.134
...

Oct  4 06:53:46 server sshd\[4885\]: User root from 106.13.119.163 not allowed because listed in DenyUsers
Oct  4 06:53:46 server sshd\[4885\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.119.163  user=root
Oct  4 06:53:49 server sshd\[4885\]: Failed password for invalid user root from 106.13.119.163 port 52516 ssh2
Oct  4 06:59:33 server sshd\[1196\]: User root from 106.13.119.163 not allowed because listed in DenyUsers
Oct  4 06:59:33 server sshd\[1196\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.119.163  user=root

Oct  3 20:57:12 localhost kernel: [3888451.672518] iptables_INPUT_denied: IN=eth0 OUT= MAC=f2:3c:91:84:83:95:84:78:ac:57:aa:c1:08:00 SRC=190.14.37.30 DST=[mungedIP2] LEN=40 TOS=0x00 PREC=0x00 TTL=78 ID=33320 DF PROTO=TCP SPT=55980 DPT=22 WINDOW=29200 RES=0x00 SYN URGP=0 
Oct  3 20:57:12 localhost kernel: [3888451.672526] iptables_INPUT_denied: IN=eth0 OUT= MAC=f2:3c:91:84:83:95:84:78:ac:57:aa:c1:08:00 SRC=190.14.37.30 DST=[mungedIP2] LEN=40 TOS=0x00 PREC=0x00 TTL=78 ID=33320 DF PROTO=TCP SPT=55980 DPT=22 SEQ=4139077373 ACK=0 WINDOW=29200 RES=0x00 SYN URGP=0 
Oct  3 23:59:22 localhost kernel: [3899381.476104] iptables_INPUT_denied: IN=eth0 OUT= MAC=f2:3c:91:84:83:95:84:78:ac:57:aa:c1:08:00 SRC=190.14.37.30 DST=[mungedIP2] LEN=40 TOS=0x00 PREC=0x00 TTL=54 ID=63550 DF PROTO=TCP SPT=59450 DPT=22 WINDOW=29200 RES=0x00 SYN URGP=0 
Oct  3 23:59:22 localhost kernel: [3899381.476130] iptables_INPUT_denied: IN=eth0 OUT= MAC=f2:3c:91:84:83:95:84:78:ac:57:aa:c1:08:00 SRC=190.14.37.30 DST=[mungedIP2] LEN=40 TOS=0x00 PREC=

Oct  4 06:54:09 www sshd\[49601\]: Invalid user Bienvenue2017 from 118.92.93.233Oct  4 06:54:12 www sshd\[49601\]: Failed password for invalid user Bienvenue2017 from 118.92.93.233 port 33746 ssh2Oct  4 06:58:59 www sshd\[49838\]: Invalid user Bienvenue2017 from 118.92.93.233
...