Invalid user mika from 49.234.46.134 port 51884
pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.234.46.134
Failed password for invalid user mika from 49.234.46.134 port 51884 ssh2
pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.234.46.134  user=root
Failed password for root from 49.234.46.134 port 34668 ssh2

SSH Brute Force

Nov 24 06:39:09 localhost sshd\[21789\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.234.46.134  user=root
Nov 24 06:39:11 localhost sshd\[21789\]: Failed password for root from 49.234.46.134 port 59164 ssh2
Nov 24 06:46:42 localhost sshd\[22032\]: Invalid user buy from 49.234.46.134 port 36316
Nov 24 06:46:42 localhost sshd\[22032\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.234.46.134
Nov 24 06:46:44 localhost sshd\[22032\]: Failed password for invalid user buy from 49.234.46.134 port 36316 ssh2
...

$f2bV_matches

Nov 17 07:43:27 ws12vmsma01 sshd[18388]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.234.46.134 
Nov 17 07:43:27 ws12vmsma01 sshd[18388]: Invalid user jipe from 49.234.46.134
Nov 17 07:43:29 ws12vmsma01 sshd[18388]: Failed password for invalid user jipe from 49.234.46.134 port 44904 ssh2
...

Nov 12 21:06:40 areeb-Workstation sshd[15011]: Failed password for mail from 49.234.46.134 port 42878 ssh2
...

Nov  8 23:32:30 h2177944 sshd\[24267\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.234.46.134  user=root
Nov  8 23:32:32 h2177944 sshd\[24267\]: Failed password for root from 49.234.46.134 port 39400 ssh2
Nov  8 23:35:57 h2177944 sshd\[24389\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.234.46.134  user=root
Nov  8 23:35:59 h2177944 sshd\[24389\]: Failed password for root from 49.234.46.134 port 43844 ssh2
...

Oct 28 06:13:11 sauna sshd[40920]: Failed password for root from 49.234.46.134 port 51178 ssh2
Oct 28 06:18:20 sauna sshd[40943]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.234.46.134
...

Oct 24 05:56:00 dedicated sshd[7396]: Invalid user pass@word123! from 49.234.46.134 port 53156

Oct 23 19:59:32 mail sshd\[65442\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.234.46.134  user=root
...

Oct 17 22:53:45 hosting sshd[18009]: Invalid user 12345 from 49.234.46.134 port 41768
...

Oct 15 23:56:46 xtremcommunity sshd\[562420\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.234.46.134  user=root
Oct 15 23:56:48 xtremcommunity sshd\[562420\]: Failed password for root from 49.234.46.134 port 37726 ssh2
Oct 16 00:01:26 xtremcommunity sshd\[562494\]: Invalid user arthur from 49.234.46.134 port 49796
Oct 16 00:01:26 xtremcommunity sshd\[562494\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.234.46.134
Oct 16 00:01:28 xtremcommunity sshd\[562494\]: Failed password for invalid user arthur from 49.234.46.134 port 49796 ssh2
...

2019-10-05T09:42:42.9080991495-001 sshd\[21064\]: Failed password for invalid user 123Talent from 49.234.46.134 port 52628 ssh2
2019-10-05T09:53:41.3176911495-001 sshd\[21810\]: Invalid user 1q2w3e$R from 49.234.46.134 port 42056
2019-10-05T09:53:41.3210251495-001 sshd\[21810\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.234.46.134
2019-10-05T09:53:43.0403821495-001 sshd\[21810\]: Failed password for invalid user 1q2w3e$R from 49.234.46.134 port 42056 ssh2
2019-10-05T09:59:12.1773861495-001 sshd\[22170\]: Invalid user 12qwaszx from 49.234.46.134 port 50888
2019-10-05T09:59:12.1843091495-001 sshd\[22170\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.234.46.134
...

Oct  2 03:55:02 www_kotimaassa_fi sshd[15677]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.234.46.134
Oct  2 03:55:04 www_kotimaassa_fi sshd[15677]: Failed password for invalid user timson from 49.234.46.134 port 51386 ssh2
...

Automatic report - Banned IP Access

Sep 26 19:18:24 server sshd\[15437\]: Invalid user fh from 49.234.46.134 port 34400
Sep 26 19:18:24 server sshd\[15437\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.234.46.134
Sep 26 19:18:25 server sshd\[15437\]: Failed password for invalid user fh from 49.234.46.134 port 34400 ssh2
Sep 26 19:28:03 server sshd\[16058\]: Invalid user fl from 49.234.46.134 port 41470
Sep 26 19:28:03 server sshd\[16058\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.234.46.134

Sep 24 02:58:14 auw2 sshd\[8524\]: Invalid user 654321 from 49.234.46.134
Sep 24 02:58:14 auw2 sshd\[8524\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.234.46.134
Sep 24 02:58:15 auw2 sshd\[8524\]: Failed password for invalid user 654321 from 49.234.46.134 port 35164 ssh2
Sep 24 03:03:39 auw2 sshd\[8995\]: Invalid user Passw0rd from 49.234.46.134
Sep 24 03:03:39 auw2 sshd\[8995\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.234.46.134

Sep 23 19:49:25 lcprod sshd\[32493\]: Invalid user constant from 49.234.46.134
Sep 23 19:49:25 lcprod sshd\[32493\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.234.46.134
Sep 23 19:49:26 lcprod sshd\[32493\]: Failed password for invalid user constant from 49.234.46.134 port 49774 ssh2
Sep 23 19:54:36 lcprod sshd\[449\]: Invalid user vail from 49.234.46.134
Sep 23 19:54:36 lcprod sshd\[449\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.234.46.134

SSH authentication failure x 6 reported by Fail2Ban
...

Aug 13 13:29:32 microserver sshd[1773]: Invalid user hl123 from 49.234.46.134 port 60478
Aug 13 13:29:32 microserver sshd[1773]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.234.46.134
Aug 13 13:29:34 microserver sshd[1773]: Failed password for invalid user hl123 from 49.234.46.134 port 60478 ssh2
Aug 13 13:35:34 microserver sshd[2916]: Invalid user qwerty from 49.234.46.134 port 53898
Aug 13 13:35:34 microserver sshd[2916]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.234.46.134
Aug 13 13:47:30 microserver sshd[4577]: Invalid user sysadmin@123 from 49.234.46.134 port 40722
Aug 13 13:47:30 microserver sshd[4577]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.234.46.134
Aug 13 13:47:32 microserver sshd[4577]: Failed password for invalid user sysadmin@123 from 49.234.46.134 port 40722 ssh2
Aug 13 13:53:29 microserver sshd[5366]: Invalid user nothing123 from 49.234.46.134 port

Aug  2 13:12:47 MK-Soft-VM4 sshd\[23946\]: Invalid user jason from 49.234.46.134 port 52096
Aug  2 13:12:47 MK-Soft-VM4 sshd\[23946\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.234.46.134
Aug  2 13:12:48 MK-Soft-VM4 sshd\[23946\]: Failed password for invalid user jason from 49.234.46.134 port 52096 ssh2
...

Nov  5 14:39:10 *** sshd[14253]: User root from 49.234.46.125 not allowed because not listed in AllowUsers

Oct 31 05:59:08 ns381471 sshd[14230]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.234.46.125
Oct 31 05:59:10 ns381471 sshd[14230]: Failed password for invalid user magyar from 49.234.46.125 port 54568 ssh2

Oct  4 04:42:45 php1 sshd\[32567\]: Invalid user Privaten from 49.234.46.125
Oct  4 04:42:45 php1 sshd\[32567\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.234.46.125
Oct  4 04:42:47 php1 sshd\[32567\]: Failed password for invalid user Privaten from 49.234.46.125 port 38204 ssh2
Oct  4 04:47:33 php1 sshd\[755\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.234.46.125  user=root
Oct  4 04:47:35 php1 sshd\[755\]: Failed password for root from 49.234.46.125 port 46156 ssh2

SSHAttack

SSH Brute Force

Bruteforce from 49.234.46.39

2019-09-09T07:53:35.098085abusebot.cloudsearch.cf sshd\[891\]: Invalid user arkserver from 49.234.46.125 port 58990

Aug 18 22:11:39 MK-Soft-VM3 sshd\[15902\]: Invalid user radio123 from 49.234.46.125 port 48452
Aug 18 22:11:39 MK-Soft-VM3 sshd\[15902\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.234.46.125
Aug 18 22:11:42 MK-Soft-VM3 sshd\[15902\]: Failed password for invalid user radio123 from 49.234.46.125 port 48452 ssh2
...

Aug 18 09:28:31 ns315508 sshd[25276]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.234.46.125  user=root
Aug 18 09:28:34 ns315508 sshd[25276]: Failed password for root from 49.234.46.125 port 59834 ssh2
Aug 18 09:31:22 ns315508 sshd[25296]: Invalid user lidia from 49.234.46.125 port 56122
Aug 18 09:31:22 ns315508 sshd[25296]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.234.46.125
Aug 18 09:31:22 ns315508 sshd[25296]: Invalid user lidia from 49.234.46.125 port 56122
Aug 18 09:31:24 ns315508 sshd[25296]: Failed password for invalid user lidia from 49.234.46.125 port 56122 ssh2
...

(mod_security) mod_security (id:210740) triggered by 191.102.148.103 (US/United States/-): 5 in the last 3600 secs

Jun 26 13:22:20 pve1 sshd[1593]: Failed password for root from 106.243.2.244 port 45088 ssh2
...

Jun 26 15:51:50 jumpserver sshd[227423]: Invalid user gian from 164.52.106.199 port 58612
Jun 26 15:51:51 jumpserver sshd[227423]: Failed password for invalid user gian from 164.52.106.199 port 58612 ssh2
Jun 26 15:55:47 jumpserver sshd[227471]: Invalid user martin from 164.52.106.199 port 44600
...

Jun 26 17:25:34 abendstille sshd\[18451\]: Invalid user PlcmSpIp from 175.125.95.160
Jun 26 17:25:34 abendstille sshd\[18451\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.160
Jun 26 17:25:36 abendstille sshd\[18451\]: Failed password for invalid user PlcmSpIp from 175.125.95.160 port 46160 ssh2
Jun 26 17:29:04 abendstille sshd\[22212\]: Invalid user asd from 175.125.95.160
Jun 26 17:29:04 abendstille sshd\[22212\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.160
...

Jun 26 15:43:21 ip-172-31-62-245 sshd\[31459\]: Failed password for root from 222.186.31.127 port 34934 ssh2\
Jun 26 15:43:24 ip-172-31-62-245 sshd\[31459\]: Failed password for root from 222.186.31.127 port 34934 ssh2\
Jun 26 15:43:26 ip-172-31-62-245 sshd\[31459\]: Failed password for root from 222.186.31.127 port 34934 ssh2\
Jun 26 15:43:26 ip-172-31-62-245 sshd\[31462\]: Failed password for root from 222.186.31.127 port 11707 ssh2\
Jun 26 15:43:29 ip-172-31-62-245 sshd\[31461\]: Failed password for root from 222.186.31.127 port 64546 ssh2\

(imapd) Failed IMAP login from 194.28.133.40 (UA/Ukraine/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Jun 26 15:56:06 ir1 dovecot[2885757]: imap-login: Disconnected (auth failed, 1 attempts in 5 secs): user=, method=PLAIN, rip=194.28.133.40, lip=5.63.12.44, TLS, session=

2020-06-26T15:26:32.571634n23.at sshd[1422492]: Invalid user zmm from 61.84.196.50 port 48352
2020-06-26T15:26:34.358486n23.at sshd[1422492]: Failed password for invalid user zmm from 61.84.196.50 port 48352 ssh2
2020-06-26T15:30:34.755814n23.at sshd[1425646]: Invalid user mapr from 61.84.196.50 port 36280
...

2020-06-26T17:31:28.808302+02:00  sshd[23460]: Failed password for invalid user cheng from 51.254.141.211 port 50578 ssh2

reported through recidive - multiple failed attempts(SSH)

Jun 26 14:17:08 saturn sshd[434919]: Failed password for root from 139.59.14.136 port 60000 ssh2
Jun 26 14:22:34 saturn sshd[435116]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.14.136  user=root
Jun 26 14:22:36 saturn sshd[435116]: Failed password for root from 139.59.14.136 port 60530 ssh2
...

 TCP (SYN) 49.72.212.22:56455 -> port 3694, len 44

SSH Brute-Force Attack

Jun 25 22:17:35 xxx sshd[23380]: Failed password for r.r from 46.41.148.222 port 51412 ssh2
Jun 25 22:17:35 xxx sshd[23380]: Received disconnect from 46.41.148.222 port 51412:11: Bye Bye [preauth]
Jun 25 22:17:35 xxx sshd[23380]: Disconnected from 46.41.148.222 port 51412 [preauth]
Jun 25 22:24:04 xxx sshd[24418]: Failed password for r.r from 46.41.148.222 port 55068 ssh2
Jun 25 22:24:04 xxx sshd[24418]: Received disconnect from 46.41.148.222 port 55068:11: Bye Bye [preauth]
Jun 25 22:24:04 xxx sshd[24418]: Disconnected from 46.41.148.222 port 55068 [preauth]
Jun 25 22:27:16 xxx sshd[25333]: Invalid user postgre from 46.41.148.222 port 41374
Jun 25 22:27:16 xxx sshd[25333]: Failed password for invalid user postgre from 46.41.148.222 port 41374 ssh2
Jun 25 22:27:16 xxx sshd[25333]: Received disconnect from 46.41.148.222 port 41374:11: Bye Bye [preauth]
Jun 25 22:27:16 xxx sshd[25333]: Disconnected from 46.41.148.222 port 41374 [preauth]


........
-----------------------------------------------
https://www.blo

Jun 26 14:23:59 piServer sshd[15742]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.234.41.108 
Jun 26 14:24:01 piServer sshd[15742]: Failed password for invalid user blog from 49.234.41.108 port 54904 ssh2
Jun 26 14:27:05 piServer sshd[16121]: Failed password for root from 49.234.41.108 port 37946 ssh2
...

Jun 26 14:50:53 IngegnereFirenze sshd[22037]: Failed password for invalid user wb from 51.68.127.137 port 55471 ssh2
...