Aug 22 09:06:43 mail sshd[26810]: refused connect from ns378266.ip-5-196-68.eu (5.196.68.145)
Aug 22 09:08:08 mail sshd[26895]: refused connect from ns378266.ip-5-196-68.eu (5.196.68.145)
Aug 22 09:09:36 mail sshd[26962]: refused connect from ns378266.ip-5-196-68.eu (5.196.68.145)
Aug 22 09:11:02 mail sshd[27012]: refused connect from ns378266.ip-5-196-68.eu (5.196.68.145)
Aug 22 09:12:27 mail sshd[27092]: refused connect from ns378266.ip-5-196-68.eu (5.196.68.145)
...

2020-06-08T23:24:54.395179vps751288.ovh.net sshd\[6385\]: Invalid user kiran from 5.196.68.145 port 54692
2020-06-08T23:24:54.403454vps751288.ovh.net sshd\[6385\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ns378266.ip-5-196-68.eu
2020-06-08T23:24:56.262784vps751288.ovh.net sshd\[6385\]: Failed password for invalid user kiran from 5.196.68.145 port 54692 ssh2
2020-06-08T23:25:47.136885vps751288.ovh.net sshd\[6400\]: Invalid user kiran from 5.196.68.145 port 39748
2020-06-08T23:25:47.146946vps751288.ovh.net sshd\[6400\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ns378266.ip-5-196-68.eu

Bruteforce SSH honeypot

Feb 20 06:19:24 haigwepa sshd[30405]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.196.68.145 
Feb 20 06:19:26 haigwepa sshd[30405]: Failed password for invalid user mq from 5.196.68.145 port 41445 ssh2
...

k+ssh-bruteforce

Dec 28 20:02:31 hcbbdb sshd\[4407\]: Invalid user sh from 5.196.68.145
Dec 28 20:02:31 hcbbdb sshd\[4407\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ns378266.ip-5-196-68.eu
Dec 28 20:02:32 hcbbdb sshd\[4407\]: Failed password for invalid user sh from 5.196.68.145 port 56683 ssh2
Dec 28 20:02:57 hcbbdb sshd\[4454\]: Invalid user soc from 5.196.68.145
Dec 28 20:02:57 hcbbdb sshd\[4454\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ns378266.ip-5-196-68.eu

2019-12-21T08:21:37.060083shield sshd\[24902\]: Invalid user proxy from 5.196.68.145 port 45626
2019-12-21T08:21:37.064500shield sshd\[24902\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ns378266.ip-5-196-68.eu
2019-12-21T08:21:39.138537shield sshd\[24902\]: Failed password for invalid user proxy from 5.196.68.145 port 45626 ssh2
2019-12-21T08:22:01.588686shield sshd\[25083\]: Invalid user prueba from 5.196.68.145 port 58856
2019-12-21T08:22:01.592703shield sshd\[25083\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ns378266.ip-5-196-68.eu

(sshd) Failed SSH login from 5.196.68.145 (FR/France/ns378266.ip-5-196-68.eu): 3 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Dec 10 18:11:13 andromeda sshd[21608]: Did not receive identification string from 5.196.68.145 port 60700
Dec 10 18:14:31 andromeda sshd[21971]: Invalid user arkserver from 5.196.68.145 port 54672
Dec 10 18:14:32 andromeda sshd[21980]: Invalid user arkserver from 5.196.68.145 port 56042

Nov  6 10:34:38 SilenceServices sshd[962]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.196.68.145
Nov  6 10:34:38 SilenceServices sshd[964]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.196.68.145

Jul 19 10:15:58 microserver sshd[11323]: Invalid user redmine from 5.196.68.203 port 41842
Jul 19 10:15:58 microserver sshd[11323]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.196.68.203
Jul 19 10:16:00 microserver sshd[11323]: Failed password for invalid user redmine from 5.196.68.203 port 41842 ssh2
Jul 19 10:21:33 microserver sshd[12004]: Invalid user hadoop from 5.196.68.203 port 39660
Jul 19 10:21:33 microserver sshd[12004]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.196.68.203
Jul 19 10:32:35 microserver sshd[13398]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.196.68.203  user=root
Jul 19 10:32:38 microserver sshd[13398]: Failed password for root from 5.196.68.203 port 35358 ssh2
Jul 19 10:38:12 microserver sshd[14073]: Invalid user uftp from 5.196.68.203 port 33184
Jul 19 10:38:12 microserver sshd[14073]: pam_unix(sshd:auth): authentication failure; logname= uid=0 e

Jul 18 13:07:36 microserver sshd[52197]: Invalid user utente from 5.196.68.203 port 45146
Jul 18 13:07:36 microserver sshd[52197]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.196.68.203
Jul 18 13:07:38 microserver sshd[52197]: Failed password for invalid user utente from 5.196.68.203 port 45146 ssh2
Jul 18 13:16:34 microserver sshd[53615]: Invalid user jc from 5.196.68.203 port 56712
Jul 18 13:16:34 microserver sshd[53615]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.196.68.203
Jul 18 13:28:17 microserver sshd[55077]: Invalid user me from 5.196.68.203 port 52382
Jul 18 13:28:17 microserver sshd[55077]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.196.68.203
Jul 18 13:28:18 microserver sshd[55077]: Failed password for invalid user me from 5.196.68.203 port 52382 ssh2
Jul 18 13:34:08 microserver sshd[55926]: Invalid user philip from 5.196.68.203 port 50218
Jul 18 13:34:08 micr

Jul 10 01:29:00 mail sshd[29455]: Invalid user carter from 5.196.68.203
Jul 10 01:29:00 mail sshd[29455]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.196.68.203
Jul 10 01:29:00 mail sshd[29455]: Invalid user carter from 5.196.68.203
Jul 10 01:29:02 mail sshd[29455]: Failed password for invalid user carter from 5.196.68.203 port 44186 ssh2
Jul 10 01:32:15 mail sshd[31771]: Invalid user sylvain from 5.196.68.203
...

Reported by AbuseIPDB proxy server.

May 31 22:25:26 host sshd[29839]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.158.2.118  user=root
May 31 22:25:28 host sshd[29839]: Failed password for root from 201.158.2.118 port 53207 ssh2
...

$f2bV_matches

May 31 22:37:02 vps687878 sshd\[12290\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.209.235.28  user=root
May 31 22:37:03 vps687878 sshd\[12290\]: Failed password for root from 91.209.235.28 port 37730 ssh2
May 31 22:41:21 vps687878 sshd\[12846\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.209.235.28  user=root
May 31 22:41:23 vps687878 sshd\[12846\]: Failed password for root from 91.209.235.28 port 41660 ssh2
May 31 22:45:28 vps687878 sshd\[13239\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.209.235.28  user=root
...

May 31 23:44:17 vmanager6029 postfix/smtpd\[24388\]: warning: unknown\[185.143.74.133\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
May 31 23:45:44 vmanager6029 postfix/smtpd\[24388\]: warning: unknown\[185.143.74.133\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6

May 30 23:32:13 kmh-wmh-003-nbg03 sshd[18227]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.15.245.63  user=r.r
May 30 23:32:16 kmh-wmh-003-nbg03 sshd[18227]: Failed password for r.r from 52.15.245.63 port 51956 ssh2
May 30 23:32:16 kmh-wmh-003-nbg03 sshd[18227]: Received disconnect from 52.15.245.63 port 51956:11: Bye Bye [preauth]
May 30 23:32:16 kmh-wmh-003-nbg03 sshd[18227]: Disconnected from 52.15.245.63 port 51956 [preauth]
May 31 00:51:37 kmh-wmh-003-nbg03 sshd[2765]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.15.245.63  user=r.r
May 31 00:51:39 kmh-wmh-003-nbg03 sshd[2765]: Failed password for r.r from 52.15.245.63 port 56992 ssh2
May 31 00:51:39 kmh-wmh-003-nbg03 sshd[2765]: Received disconnect from 52.15.245.63 port 56992:11: Bye Bye [preauth]
May 31 00:51:39 kmh-wmh-003-nbg03 sshd[2765]: Disconnected from 52.15.245.63 port 56992 [preauth]
May 31 00:54:09 kmh-wmh-003-........
-------------------------------

May 31 22:25:22 icecube postfix/smtpd[64615]: NOQUEUE: reject: RCPT from unknown[49.68.144.139]: 554 5.7.1 Service unavailable; Client host [49.68.144.139] blocked using zen.spamhaus.org; https://www.spamhaus.org/sbl/query/SBLCSS / https://www.spamhaus.org/query/ip/49.68.144.139; from= to= proto=ESMTP helo=

*Port Scan* detected from 70.35.201.143 (US/United States/Missouri/Kansas City (Financial District)/-). 4 hits in the last 105 seconds

May 31 17:22:04 firewall sshd[13695]: Failed password for root from 188.166.164.10 port 42320 ssh2
May 31 17:25:10 firewall sshd[13813]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.166.164.10  user=root
May 31 17:25:11 firewall sshd[13813]: Failed password for root from 188.166.164.10 port 45828 ssh2
...

05/31/2020-16:25:13.852605 193.106.29.75 Protocol: 6 ET SCAN NMAP -sS window 1024

May 31 17:19:48 mail sshd\[529\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.122.226.164  user=root
...

May 31 22:19:02 roki sshd[12652]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.165.48  user=root
May 31 22:19:04 roki sshd[12652]: Failed password for root from 180.76.165.48 port 60156 ssh2
May 31 22:36:23 roki sshd[13838]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.165.48  user=root
May 31 22:36:24 roki sshd[13838]: Failed password for root from 180.76.165.48 port 43424 ssh2
May 31 22:40:43 roki sshd[14232]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.165.48  user=root
...

2020-05-31T23:46:02.724699struts4.enskede.local sshd\[26294\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.175.151  user=root
2020-05-31T23:46:06.040936struts4.enskede.local sshd\[26294\]: Failed password for root from 222.186.175.151 port 43044 ssh2
2020-05-31T23:46:11.097870struts4.enskede.local sshd\[26294\]: Failed password for root from 222.186.175.151 port 43044 ssh2
2020-05-31T23:46:14.687954struts4.enskede.local sshd\[26294\]: Failed password for root from 222.186.175.151 port 43044 ssh2
2020-05-31T23:46:18.894776struts4.enskede.local sshd\[26294\]: Failed password for root from 222.186.175.151 port 43044 ssh2
...

May 31 23:50:28 abendstille sshd\[20201\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.56.249  user=root
May 31 23:50:30 abendstille sshd\[20201\]: Failed password for root from 106.13.56.249 port 58176 ssh2
May 31 23:54:07 abendstille sshd\[24255\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.56.249  user=root
May 31 23:54:09 abendstille sshd\[24255\]: Failed password for root from 106.13.56.249 port 56448 ssh2
May 31 23:57:48 abendstille sshd\[28007\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.56.249  user=root
...

Port scan: Attack repeated for 24 hours

May 31 23:42:41 abendstille sshd\[12409\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.138.23.149  user=root
May 31 23:42:43 abendstille sshd\[12409\]: Failed password for root from 164.138.23.149 port 51538 ssh2
May 31 23:45:30 abendstille sshd\[15281\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.138.23.149  user=root
May 31 23:45:32 abendstille sshd\[15281\]: Failed password for root from 164.138.23.149 port 44071 ssh2
May 31 23:48:14 abendstille sshd\[18098\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.138.23.149  user=root
...