Unauthorized connection attempt detected from IP address 49.247.214.67 to port 2220 [J]

Jan  3 11:06:38 vps46666688 sshd[13140]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.247.214.67
Jan  3 11:06:40 vps46666688 sshd[13140]: Failed password for invalid user wetserver from 49.247.214.67 port 45780 ssh2
...

Automatic report - SSH Brute-Force Attack

$f2bV_matches

Unauthorized connection attempt detected from IP address 49.247.214.67 to port 22

Dec 22 23:03:37 v22018086721571380 sshd[12152]: Failed password for invalid user www from 49.247.214.67 port 59602 ssh2

Dec 21 18:29:03 v22018086721571380 sshd[29748]: Failed password for invalid user ykitamur from 49.247.214.67 port 38894 ssh2

Dec 21 09:40:40 * sshd[16716]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.247.214.67
Dec 21 09:40:43 * sshd[16716]: Failed password for invalid user webadmin from 49.247.214.67 port 54170 ssh2

Dec 21 02:09:25 server sshd\[6482\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.247.214.67 
Dec 21 02:09:27 server sshd\[6482\]: Failed password for invalid user odlum from 49.247.214.67 port 54414 ssh2
Dec 21 08:19:44 server sshd\[10162\]: Invalid user backup from 49.247.214.67
Dec 21 08:19:44 server sshd\[10162\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.247.214.67 
Dec 21 08:19:45 server sshd\[10162\]: Failed password for invalid user backup from 49.247.214.67 port 39426 ssh2
...

Invalid user albany from 49.247.214.67 port 51054

"Fail2Ban detected SSH brute force attempt"

Dec 19 14:57:40 vps647732 sshd[32192]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.247.214.67
Dec 19 14:57:42 vps647732 sshd[32192]: Failed password for invalid user sampless from 49.247.214.67 port 47328 ssh2
...

2019-12-18T14:36:40.368659shield sshd\[4980\]: Invalid user crisanto from 49.247.214.67 port 46638
2019-12-18T14:36:40.373185shield sshd\[4980\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.247.214.67
2019-12-18T14:36:42.066544shield sshd\[4980\]: Failed password for invalid user crisanto from 49.247.214.67 port 46638 ssh2
2019-12-18T14:38:04.806028shield sshd\[5239\]: Invalid user mathildasu from 49.247.214.67 port 56854
2019-12-18T14:38:04.811087shield sshd\[5239\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.247.214.67

Dec 18 03:46:45 plusreed sshd[10830]: Invalid user lubis from 49.247.214.67
...

Invalid user braaksma from 49.247.214.67 port 60372

Dec 16 13:55:31 ns3042688 sshd\[15208\]: Invalid user quercia from 49.247.214.67
Dec 16 13:55:31 ns3042688 sshd\[15208\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.247.214.67 
Dec 16 13:55:33 ns3042688 sshd\[15208\]: Failed password for invalid user quercia from 49.247.214.67 port 41780 ssh2
Dec 16 14:05:14 ns3042688 sshd\[31172\]: Invalid user skavhaug from 49.247.214.67
Dec 16 14:05:14 ns3042688 sshd\[31172\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.247.214.67 
...

Invalid user rpm from 49.247.214.67 port 58666

Dec 13 15:16:46 MK-Soft-Root1 sshd[17068]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.247.214.67 
Dec 13 15:16:48 MK-Soft-Root1 sshd[17068]: Failed password for invalid user lipps from 49.247.214.67 port 43350 ssh2
...

Dec 10 08:36:12 hpm sshd\[25774\]: Invalid user kun from 49.247.214.67
Dec 10 08:36:12 hpm sshd\[25774\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.247.214.67
Dec 10 08:36:14 hpm sshd\[25774\]: Failed password for invalid user kun from 49.247.214.67 port 52490 ssh2
Dec 10 08:45:52 hpm sshd\[26780\]: Invalid user aminudin from 49.247.214.67
Dec 10 08:45:52 hpm sshd\[26780\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.247.214.67

Lines containing failures of 49.247.214.67
Dec  3 18:56:52 zabbix sshd[73959]: Invalid user engen from 49.247.214.67 port 60520
Dec  3 18:56:52 zabbix sshd[73959]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.247.214.67
Dec  3 18:56:53 zabbix sshd[73959]: Failed password for invalid user engen from 49.247.214.67 port 60520 ssh2
Dec  3 18:56:54 zabbix sshd[73959]: Received disconnect from 49.247.214.67 port 60520:11: Bye Bye [preauth]
Dec  3 18:56:54 zabbix sshd[73959]: Disconnected from invalid user engen 49.247.214.67 port 60520 [preauth]
Dec  3 19:08:15 zabbix sshd[75146]: Invalid user izalan from 49.247.214.67 port 49754
Dec  3 19:08:15 zabbix sshd[75146]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.247.214.67
Dec  3 19:08:16 zabbix sshd[75146]: Failed password for invalid user izalan from 49.247.214.67 port 49754 ssh2
Dec  3 19:08:16 zabbix sshd[75146]: Received disconnect fr........
------------------------------

Dec  4 11:47:42 kapalua sshd\[27505\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.247.214.67  user=root
Dec  4 11:47:44 kapalua sshd\[27505\]: Failed password for root from 49.247.214.67 port 53726 ssh2
Dec  4 11:54:27 kapalua sshd\[28158\]: Invalid user com from 49.247.214.67
Dec  4 11:54:27 kapalua sshd\[28158\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.247.214.67
Dec  4 11:54:29 kapalua sshd\[28158\]: Failed password for invalid user com from 49.247.214.67 port 36592 ssh2

detected by Fail2Ban

Dec  4 09:31:35 eventyay sshd[5010]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.247.214.67
Dec  4 09:31:37 eventyay sshd[5010]: Failed password for invalid user wq!5201614 from 49.247.214.67 port 48120 ssh2
Dec  4 09:38:09 eventyay sshd[5227]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.247.214.67
...

Jul 30 21:35:14 web-main sshd[749683]: Invalid user ldgxlog from 49.247.214.61 port 39714
Jul 30 21:35:15 web-main sshd[749683]: Failed password for invalid user ldgxlog from 49.247.214.61 port 39714 ssh2
Jul 30 21:40:02 web-main sshd[749715]: Invalid user shenboyu from 49.247.214.61 port 53212

Jul 28 14:58:34 pkdns2 sshd\[28208\]: Invalid user falcon2 from 49.247.214.61Jul 28 14:58:36 pkdns2 sshd\[28208\]: Failed password for invalid user falcon2 from 49.247.214.61 port 55872 ssh2Jul 28 15:03:14 pkdns2 sshd\[28412\]: Invalid user fml from 49.247.214.61Jul 28 15:03:16 pkdns2 sshd\[28412\]: Failed password for invalid user fml from 49.247.214.61 port 41706 ssh2Jul 28 15:07:59 pkdns2 sshd\[28581\]: Invalid user tanghao from 49.247.214.61Jul 28 15:08:01 pkdns2 sshd\[28581\]: Failed password for invalid user tanghao from 49.247.214.61 port 55774 ssh2
...

2020-07-26T14:01:24.671146shield sshd\[7600\]: Invalid user raptor from 49.247.214.61 port 42284
2020-07-26T14:01:24.681136shield sshd\[7600\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.247.214.61
2020-07-26T14:01:26.443688shield sshd\[7600\]: Failed password for invalid user raptor from 49.247.214.61 port 42284 ssh2
2020-07-26T14:03:14.909338shield sshd\[8012\]: Invalid user upload2 from 49.247.214.61 port 39824
2020-07-26T14:03:14.918205shield sshd\[8012\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.247.214.61

2020-07-15T17:23:59+0200 Failed SSH Authentication/Brute Force Attack. (Server 10)

Jul 15 03:13:51 ns381471 sshd[20456]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.247.214.61
Jul 15 03:13:54 ns381471 sshd[20456]: Failed password for invalid user info3 from 49.247.214.61 port 41172 ssh2

Jul  9 14:45:51 buvik sshd[7917]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.247.214.61
Jul  9 14:45:54 buvik sshd[7917]: Failed password for invalid user lindsay from 49.247.214.61 port 45692 ssh2
Jul  9 14:49:09 buvik sshd[8297]: Invalid user sos from 49.247.214.61
...

Jul  7 05:08:07 mail sshd[32212]: Failed password for nobody from 49.247.214.61 port 54806 ssh2
Jul  7 05:21:02 mail sshd[1530]: Failed password for mysql from 49.247.214.61 port 53428 ssh2
...

Jun 16 11:44:09 jane sshd[1354]: Failed password for root from 49.247.214.61 port 41092 ssh2
Jun 16 11:47:40 jane sshd[5005]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.247.214.61 
...

Invalid user raja from 49.247.214.61 port 38784

May  1 17:50:14 ift sshd\[58305\]: Failed password for root from 49.247.214.61 port 58248 ssh2May  1 17:52:03 ift sshd\[58463\]: Invalid user purnima from 49.247.214.61May  1 17:52:05 ift sshd\[58463\]: Failed password for invalid user purnima from 49.247.214.61 port 53888 ssh2May  1 17:53:05 ift sshd\[58489\]: Failed password for root from 49.247.214.61 port 40902 ssh2May  1 17:54:06 ift sshd\[58598\]: Invalid user user4 from 49.247.214.61
...

Apr 23 13:31:08 webhost01 sshd[15291]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.247.214.61
Apr 23 13:31:10 webhost01 sshd[15291]: Failed password for invalid user ultra from 49.247.214.61 port 47718 ssh2
...

2020-04-19 UTC: (14x) - admin,cr,ftpuser,mq,ow,rl,root(7x),test

2020-04-15 UTC: (30x) - MMR,RPM,bin,elemental,firefart,flw,j,local,noc,ping,root(19x),vyos

Bruteforce detected by fail2ban

Port Scan
...

Sep 15 17:14:11 pornomens sshd\[19627\]: Invalid user ubnt from 104.248.123.197 port 39688
Sep 15 17:14:11 pornomens sshd\[19627\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.123.197
Sep 15 17:14:14 pornomens sshd\[19627\]: Failed password for invalid user ubnt from 104.248.123.197 port 39688 ssh2
...

$f2bV_matches

Sep 14 20:05:01 mout sshd[23846]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=41.111.135.196  user=root
Sep 14 20:05:03 mout sshd[23846]: Failed password for root from 41.111.135.196 port 58842 ssh2

Automatic report - Port Scan Attack

84.42.45.165 (RU/Russia/-), 7 distributed sshd attacks on account [root] in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_DISTATTACK; Logs: Sep 15 05:14:18 server5 sshd[16562]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=84.42.45.165  user=root
Sep 15 05:14:20 server5 sshd[16562]: Failed password for root from 84.42.45.165 port 60044 ssh2
Sep 15 05:13:46 server5 sshd[16272]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.122.69.50  user=root
Sep 15 05:13:48 server5 sshd[16272]: Failed password for root from 134.122.69.50 port 49358 ssh2
Sep 15 05:13:39 server5 sshd[15955]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.203.177  user=root
Sep 15 05:13:41 server5 sshd[15955]: Failed password for root from 122.51.203.177 port 39134 ssh2
Sep 15 05:14:27 server5 sshd[16630]: Failed password for root from 195.148.21.69 port 42294 ssh2

IP Addresses Blocked:

C2,WP GET /wp-login.php

prod6
...

Sep 15 17:28:06 XXXXXX sshd[57564]: Invalid user memcache from 183.82.121.34 port 43736

2020-09-15T19:29:07.405866n23.at sshd[2270618]: Failed password for root from 104.248.130.10 port 35014 ssh2
2020-09-15T19:32:41.912417n23.at sshd[2273782]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.130.10  user=root
2020-09-15T19:32:44.317227n23.at sshd[2273782]: Failed password for root from 104.248.130.10 port 47248 ssh2
...

Port Scan
...

20 attempts against mh-ssh on drop

Sep 15 19:05:36 melroy-server sshd[11897]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.68.172.217 
Sep 15 19:05:38 melroy-server sshd[11897]: Failed password for invalid user ubuntu from 51.68.172.217 port 59008 ssh2
...

1600184709 - 09/15/2020 22:45:09 Host: scan-06.shadowserver.org/216.218.206.67 Port: 21 TCP Blocked
...

$lgm