Invalid user pinghuazhang from 51.161.8.70 port 55198

2020-07-25T15:11:51.261999vps1033 sshd[3283]: Invalid user bc from 51.161.8.70 port 40644
2020-07-25T15:11:51.265580vps1033 sshd[3283]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=70.ip-51-161-8.net
2020-07-25T15:11:51.261999vps1033 sshd[3283]: Invalid user bc from 51.161.8.70 port 40644
2020-07-25T15:11:53.464159vps1033 sshd[3283]: Failed password for invalid user bc from 51.161.8.70 port 40644 ssh2
2020-07-25T15:15:47.806883vps1033 sshd[11748]: Invalid user girl from 51.161.8.70 port 45156
...

Jul 25 05:57:47 xeon sshd[8713]: Failed password for invalid user chiara from 51.161.8.70 port 55338 ssh2

Jul 12 07:36:30 mout sshd[10012]: Invalid user jason from 51.161.8.70 port 47374

Jun 29 21:54:35 mockhub sshd[30113]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.161.8.70
Jun 29 21:54:37 mockhub sshd[30113]: Failed password for invalid user vod from 51.161.8.70 port 55102 ssh2
...

Jun 27 14:19:33 nextcloud sshd\[8047\]: Invalid user webadmin from 51.161.8.70
Jun 27 14:19:33 nextcloud sshd\[8047\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.161.8.70
Jun 27 14:19:34 nextcloud sshd\[8047\]: Failed password for invalid user webadmin from 51.161.8.70 port 54352 ssh2

(sshd) Failed SSH login from 51.161.8.70 (CA/Canada/70.ip-51-161-8.net): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Jun 14 23:10:31 amsweb01 sshd[18998]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.161.8.70  user=root
Jun 14 23:10:33 amsweb01 sshd[18998]: Failed password for root from 51.161.8.70 port 33210 ssh2
Jun 14 23:22:59 amsweb01 sshd[20656]: Invalid user rajat from 51.161.8.70 port 40508
Jun 14 23:23:01 amsweb01 sshd[20656]: Failed password for invalid user rajat from 51.161.8.70 port 40508 ssh2
Jun 14 23:26:10 amsweb01 sshd[21194]: Invalid user budi from 51.161.8.70 port 58126

Jun  3 05:46:56 cdc sshd[3342]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.161.8.70  user=root
Jun  3 05:46:57 cdc sshd[3342]: Failed password for invalid user root from 51.161.8.70 port 42266 ssh2

Jun  1 12:42:07 game-panel sshd[3765]: Failed password for root from 51.161.8.70 port 45058 ssh2
Jun  1 12:45:23 game-panel sshd[3929]: Failed password for root from 51.161.8.70 port 44744 ssh2

May 31 04:08:10 vps46666688 sshd[27307]: Failed password for root from 51.161.8.70 port 35486 ssh2
...

May 28 13:01:19 Tower sshd[14824]: Connection from 51.161.8.70 port 38542 on 192.168.10.220 port 22 rdomain ""
May 28 13:01:21 Tower sshd[14824]: Failed password for root from 51.161.8.70 port 38542 ssh2
May 28 13:01:21 Tower sshd[14824]: Received disconnect from 51.161.8.70 port 38542:11: Bye Bye [preauth]
May 28 13:01:21 Tower sshd[14824]: Disconnected from authenticating user root 51.161.8.70 port 38542 [preauth]

Invalid user nagios from 51.161.8.70 port 56934

SSH Brute Force

Invalid user grid from 51.161.8.70 port 40988

May 14 02:34:54 home sshd[3393]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.161.8.70
May 14 02:34:56 home sshd[3393]: Failed password for invalid user wagner from 51.161.8.70 port 52144 ssh2
May 14 02:39:17 home sshd[4214]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.161.8.70
...

May 13 14:36:48 h1745522 sshd[19466]: Invalid user deploy from 51.161.8.70 port 54824
May 13 14:36:48 h1745522 sshd[19466]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.161.8.70
May 13 14:36:48 h1745522 sshd[19466]: Invalid user deploy from 51.161.8.70 port 54824
May 13 14:36:50 h1745522 sshd[19466]: Failed password for invalid user deploy from 51.161.8.70 port 54824 ssh2
May 13 14:40:30 h1745522 sshd[19811]: Invalid user vps from 51.161.8.70 port 34428
May 13 14:40:30 h1745522 sshd[19811]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.161.8.70
May 13 14:40:30 h1745522 sshd[19811]: Invalid user vps from 51.161.8.70 port 34428
May 13 14:40:32 h1745522 sshd[19811]: Failed password for invalid user vps from 51.161.8.70 port 34428 ssh2
May 13 14:44:19 h1745522 sshd[20092]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.161.8.70  user=root
May 13 14:44:21 h1
...

May  8 04:47:54 vps58358 sshd\[24469\]: Invalid user juanda from 51.161.8.70May  8 04:47:56 vps58358 sshd\[24469\]: Failed password for invalid user juanda from 51.161.8.70 port 51022 ssh2May  8 04:51:57 vps58358 sshd\[24529\]: Invalid user testftp from 51.161.8.70May  8 04:51:58 vps58358 sshd\[24529\]: Failed password for invalid user testftp from 51.161.8.70 port 33682 ssh2May  8 04:55:50 vps58358 sshd\[24592\]: Invalid user nagios from 51.161.8.70May  8 04:55:52 vps58358 sshd\[24592\]: Failed password for invalid user nagios from 51.161.8.70 port 44576 ssh2
...

2020-05-07T11:26:56.890744abusebot.cloudsearch.cf sshd[9555]: Invalid user michael from 51.161.8.70 port 43156
2020-05-07T11:26:56.896731abusebot.cloudsearch.cf sshd[9555]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=70.ip-51-161-8.net
2020-05-07T11:26:56.890744abusebot.cloudsearch.cf sshd[9555]: Invalid user michael from 51.161.8.70 port 43156
2020-05-07T11:26:59.112734abusebot.cloudsearch.cf sshd[9555]: Failed password for invalid user michael from 51.161.8.70 port 43156 ssh2
2020-05-07T11:31:16.860513abusebot.cloudsearch.cf sshd[9993]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=70.ip-51-161-8.net  user=root
2020-05-07T11:31:18.780144abusebot.cloudsearch.cf sshd[9993]: Failed password for root from 51.161.8.70 port 52630 ssh2
2020-05-07T11:35:10.663262abusebot.cloudsearch.cf sshd[10322]: Invalid user duo from 51.161.8.70 port 33868
...

Apr 30 20:54:59 *** sshd[29876]: Invalid user publico from 51.161.8.70

SSH brute force attempt

Apr 26 00:22:26 NPSTNNYC01T sshd[13918]: Failed password for root from 51.161.8.70 port 58726 ssh2
Apr 26 00:25:30 NPSTNNYC01T sshd[14172]: Failed password for root from 51.161.8.70 port 54202 ssh2
...

Apr 20 09:07:35  sshd\[17320\]: Invalid user cg from 51.161.8.70Apr 20 09:07:37  sshd\[17320\]: Failed password for invalid user cg from 51.161.8.70 port 38396 ssh2
...

2020-04-19T23:14:25.893937librenms sshd[18832]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=70.ip-51-161-8.net
2020-04-19T23:14:25.891690librenms sshd[18832]: Invalid user tu from 51.161.8.70 port 44778
2020-04-19T23:14:27.651250librenms sshd[18832]: Failed password for invalid user tu from 51.161.8.70 port 44778 ssh2
...

Apr 19 14:18:29 OPSO sshd\[21104\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.161.8.70  user=root
Apr 19 14:18:31 OPSO sshd\[21104\]: Failed password for root from 51.161.8.70 port 53846 ssh2
Apr 19 14:22:53 OPSO sshd\[21897\]: Invalid user ah from 51.161.8.70 port 40974
Apr 19 14:22:53 OPSO sshd\[21897\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.161.8.70
Apr 19 14:22:55 OPSO sshd\[21897\]: Failed password for invalid user ah from 51.161.8.70 port 40974 ssh2

Apr 15 21:21:32 vps647732 sshd[29829]: Failed password for root from 51.161.8.70 port 46442 ssh2
...

$f2bV_matches

SSH invalid-user multiple login try

Invalid user dk from 51.161.8.70 port 58836

Apr  1 08:25:37 server sshd[39829]: Failed password for root from 51.161.8.70 port 51244 ssh2
Apr  1 08:29:42 server sshd[40888]: Failed password for invalid user dping from 51.161.8.70 port 34766 ssh2
Apr  1 08:33:46 server sshd[41926]: Failed password for root from 51.161.8.70 port 46508 ssh2

$f2bV_matches | Triggered by Fail2Ban at Vostok web server

Apr  8 02:37:36 vps647732 sshd[5188]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.161.8.152
Apr  8 02:37:38 vps647732 sshd[5188]: Failed password for invalid user student from 51.161.8.152 port 33266 ssh2
...

Feb 17 17:16:44 server sshd\[14999\]: Invalid user libsys from 51.161.8.152
Feb 17 17:16:44 server sshd\[14999\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.ip-51-161-8.net 
Feb 17 17:16:45 server sshd\[14999\]: Failed password for invalid user libsys from 51.161.8.152 port 50520 ssh2
Feb 17 17:44:17 server sshd\[19571\]: Invalid user opc from 51.161.8.152
Feb 17 17:44:17 server sshd\[19571\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.ip-51-161-8.net 
...

Feb 17 00:27:30 plusreed sshd[18497]: Invalid user ncmdbuser from 51.161.8.152
...

Unauthorized connection attempt detected from IP address 51.161.8.205 to port 2220 [J]

Invalid user ftpuser from 39.98.245.32 port 58740

Jun 10 02:02:21 server dovecot: pop3-login: Aborted login (auth failed, 1 attempts in 2 secs): user=, method=PLAIN, rip=94.102.51.7, lip=172.104.140.148, session=
Jun 10 02:03:29 server dovecot: pop3-login: Aborted login (auth failed, 1 attempts in 2 secs): user=, method=PLAIN, rip=94.102.51.7, lip=172.104.140.148, session=
Jun 10 02:04:06 server dovecot: pop3-login: Aborted login (auth failed, 1 attempts in 2 secs): user=, method=PLAIN, rip=94.102.51.7, lip=172.104.140.148, session=<58H8lK+nNnZeZjMH>
Jun 10 02:04:40 server dovecot: pop3-login: Aborted login (auth failed, 1 attempts in 2 secs): user=, method=PLAIN, rip=94.102.51.7, lip=172.104.140.148, session=
Jun 10 02:05:50 server dovecot: pop3-login: Aborted login (auth failed, 1 attempts in 2 secs): user=, method=PLAIN, rip=94.102.51.7, lip=172.104.140.148, ses
...

Jun  9 20:12:58 vlre-nyc-1 sshd\[7398\]: Invalid user monitor from 111.229.237.58
Jun  9 20:12:58 vlre-nyc-1 sshd\[7398\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.229.237.58
Jun  9 20:13:00 vlre-nyc-1 sshd\[7398\]: Failed password for invalid user monitor from 111.229.237.58 port 55640 ssh2
Jun  9 20:16:42 vlre-nyc-1 sshd\[7538\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.229.237.58  user=root
Jun  9 20:16:44 vlre-nyc-1 sshd\[7538\]: Failed password for root from 111.229.237.58 port 36770 ssh2
...

Jun  9 16:17:05 mail sshd\[33882\]: Invalid user parol from 125.91.127.21
Jun  9 16:17:05 mail sshd\[33882\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.91.127.21
...

 TCP (SYN) 92.118.161.53:56156 -> port 1521, len 44

Jun  9 23:16:35 debian kernel: [636351.584723] [UFW BLOCK] IN=eth0 OUT= MAC=52:54:00:be:e4:65:08:e8:4f:6e:48:0c:08:00 SRC=78.109.130.97 DST=89.252.131.35 LEN=40 TOS=0x00 PREC=0x00 TTL=244 ID=60717 PROTO=TCP SPT=48384 DPT=3389 WINDOW=1024 RES=0x00 SYN URGP=0

Jun 10 01:34:56 server sshd[32402]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.55.72.69
Jun 10 01:34:58 server sshd[32402]: Failed password for invalid user od123 from 45.55.72.69 port 52652 ssh2
Jun 10 01:38:21 server sshd[32693]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.55.72.69
...

Fail2Ban Ban Triggered (2)

Brute forcing email accounts

Jun 10 00:56:05 pkdns2 sshd\[44572\]: Failed password for root from 124.93.222.211 port 39490 ssh2Jun 10 00:59:07 pkdns2 sshd\[44754\]: Invalid user hacluster12345 from 124.93.222.211Jun 10 00:59:09 pkdns2 sshd\[44754\]: Failed password for invalid user hacluster12345 from 124.93.222.211 port 56104 ssh2Jun 10 01:02:28 pkdns2 sshd\[44951\]: Failed password for root from 124.93.222.211 port 44492 ssh2Jun 10 01:05:46 pkdns2 sshd\[45178\]: Invalid user marc from 124.93.222.211Jun 10 01:05:48 pkdns2 sshd\[45178\]: Failed password for invalid user marc from 124.93.222.211 port 32870 ssh2
...

prod8
...

Jun  9 22:13:23 home sshd[1518]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.18.216
Jun  9 22:13:25 home sshd[1518]: Failed password for invalid user yh from 148.70.18.216 port 33844 ssh2
Jun  9 22:16:44 home sshd[1907]: Failed password for root from 148.70.18.216 port 44032 ssh2
...

Jun  9 20:13:48 ns3033917 sshd[18395]: Failed password for root from 167.114.203.73 port 43260 ssh2
Jun  9 20:16:47 ns3033917 sshd[18419]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.114.203.73  user=root
Jun  9 20:16:49 ns3033917 sshd[18419]: Failed password for root from 167.114.203.73 port 47054 ssh2
...

Jun  9 23:23:29 ip-172-31-61-156 sshd[16644]: Invalid user admin from 162.248.52.82
Jun  9 23:23:31 ip-172-31-61-156 sshd[16644]: Failed password for invalid user admin from 162.248.52.82 port 49016 ssh2
Jun  9 23:23:29 ip-172-31-61-156 sshd[16644]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.248.52.82
Jun  9 23:23:29 ip-172-31-61-156 sshd[16644]: Invalid user admin from 162.248.52.82
Jun  9 23:23:31 ip-172-31-61-156 sshd[16644]: Failed password for invalid user admin from 162.248.52.82 port 49016 ssh2
...

Telnet Honeypot -> Telnet Bruteforce / Login