Oct 14 01:32:29 santamaria sshd\[17280\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.178.138.1  user=root
Oct 14 01:32:30 santamaria sshd\[17280\]: Failed password for root from 51.178.138.1 port 41596 ssh2
Oct 14 01:42:29 santamaria sshd\[17481\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.178.138.1  user=root
...

Oct  1 02:19:42 vlre-nyc-1 sshd\[31687\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.178.138.1  user=root
Oct  1 02:19:44 vlre-nyc-1 sshd\[31687\]: Failed password for root from 51.178.138.1 port 42262 ssh2
Oct  1 02:29:37 vlre-nyc-1 sshd\[31894\]: Invalid user ubuntu from 51.178.138.1
Oct  1 02:29:37 vlre-nyc-1 sshd\[31894\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.178.138.1
Oct  1 02:29:39 vlre-nyc-1 sshd\[31894\]: Failed password for invalid user ubuntu from 51.178.138.1 port 53836 ssh2
Oct  1 02:34:00 vlre-nyc-1 sshd\[31957\]: Invalid user ftpuser from 51.178.138.1
Oct  1 02:34:00 vlre-nyc-1 sshd\[31957\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.178.138.1
Oct  1 02:34:02 vlre-nyc-1 sshd\[31957\]: Failed password for invalid user ftpuser from 51.178.138.1 port 32914 ssh2
Oct  1 02:38:12 vlre-nyc-1 sshd\[32010\]: Invalid user w
...

Oct  3 13:04:46 124388 sshd[18927]: Invalid user erp from 51.178.138.1 port 36296
Oct  3 13:04:46 124388 sshd[18927]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.178.138.1
Oct  3 13:04:46 124388 sshd[18927]: Invalid user erp from 51.178.138.1 port 36296
Oct  3 13:04:48 124388 sshd[18927]: Failed password for invalid user erp from 51.178.138.1 port 36296 ssh2
Oct  3 13:09:12 124388 sshd[19152]: Invalid user postgres from 51.178.138.1 port 43800

Oct  3 09:23:58 ip-172-31-42-142 sshd\[27822\]: Invalid user allan from 51.178.138.1\
Oct  3 09:24:01 ip-172-31-42-142 sshd\[27822\]: Failed password for invalid user allan from 51.178.138.1 port 58830 ssh2\
Oct  3 09:27:59 ip-172-31-42-142 sshd\[27899\]: Invalid user usuario from 51.178.138.1\
Oct  3 09:28:02 ip-172-31-42-142 sshd\[27899\]: Failed password for invalid user usuario from 51.178.138.1 port 38544 ssh2\
Oct  3 09:32:25 ip-172-31-42-142 sshd\[27952\]: Invalid user dev from 51.178.138.1\

$f2bV_matches

SCAMMER FRAUD BASTARDE FICKTZ EUCH SCAMMER BETRÜGER BANDE 
Received: from app.inputcard.info (app.inputcard.info [51.178.138.80])
Date: Sat, 22 Aug 2020 12:08:11 +0000
Subject: Herzlichen =?utf-8?Q?Gl=C3=BCckwunsch!?= Sie wurden als Gewinner
 unseres monatlichen Amazon-Gewinnspiels gezogen
From: Samsung S20 Checkout 
Reply-To: info@inputcard.info

Herzlichen Glückwunsch!


Hallo  

Herzlichen Glückwunsch! Sie wurden als Gewinner unseres monatlichen Amazon-Gewinnspiels gezogen

Folgen Sie dem untenstehenden Link und entdecken Sie den Preis dieses Monats.
Bestätigen Sie Ihre Identität und geben Sie dann an, wohin wir Ihren Preis schicken sollen.

Unser gesamtes Amazon-Team gratuliert Ihnen ganz herzlich!


HIER KLICKEN

Aug 22 05:46:23 ns382633 sshd\[9238\]: Invalid user teamspeak from 51.178.138.1 port 42492
Aug 22 05:46:23 ns382633 sshd\[9238\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.178.138.1
Aug 22 05:46:25 ns382633 sshd\[9238\]: Failed password for invalid user teamspeak from 51.178.138.1 port 42492 ssh2
Aug 22 05:56:20 ns382633 sshd\[10938\]: Invalid user adolfo from 51.178.138.1 port 57036
Aug 22 05:56:20 ns382633 sshd\[10938\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.178.138.1

Automatic report BANNED IP

Connection to SSH Honeypot - Detected by HoneypotDB

bruteforce detected

Jul 29 22:42:05 buvik sshd[2085]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.178.138.1
Jul 29 22:42:08 buvik sshd[2085]: Failed password for invalid user tbjeong from 51.178.138.1 port 46228 ssh2
Jul 29 22:46:40 buvik sshd[2739]: Invalid user webdev from 51.178.138.1
...

Jul 29 02:09:34 server1 sshd\[15693\]: Invalid user sima from 51.178.138.1
Jul 29 02:09:34 server1 sshd\[15693\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.178.138.1 
Jul 29 02:09:36 server1 sshd\[15693\]: Failed password for invalid user sima from 51.178.138.1 port 48354 ssh2
Jul 29 02:13:48 server1 sshd\[19019\]: Invalid user zhangchunxu from 51.178.138.1
Jul 29 02:13:48 server1 sshd\[19019\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.178.138.1 
...

(sshd) Failed SSH login from 51.178.138.1 (FR/France/vps-fa71e64b.vps.ovh.net): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Jul 27 13:40:43 grace sshd[14934]: Invalid user mass from 51.178.138.1 port 34764
Jul 27 13:40:46 grace sshd[14934]: Failed password for invalid user mass from 51.178.138.1 port 34764 ssh2
Jul 27 13:51:50 grace sshd[16232]: Invalid user gpadmin from 51.178.138.1 port 44144
Jul 27 13:51:52 grace sshd[16232]: Failed password for invalid user gpadmin from 51.178.138.1 port 44144 ssh2
Jul 27 13:57:05 grace sshd[16887]: Invalid user avr from 51.178.138.1 port 58560

Jul 27 10:58:18 rotator sshd\[8676\]: Invalid user gangadhar from 51.178.138.1Jul 27 10:58:19 rotator sshd\[8676\]: Failed password for invalid user gangadhar from 51.178.138.1 port 49554 ssh2Jul 27 11:02:54 rotator sshd\[9551\]: Invalid user ftptest from 51.178.138.1Jul 27 11:02:56 rotator sshd\[9551\]: Failed password for invalid user ftptest from 51.178.138.1 port 33350 ssh2Jul 27 11:07:23 rotator sshd\[10358\]: Invalid user angie from 51.178.138.1Jul 27 11:07:26 rotator sshd\[10358\]: Failed password for invalid user angie from 51.178.138.1 port 45376 ssh2
...

2020-07-25T00:13:43.593041snf-827550 sshd[18503]: Invalid user lzhang from 51.178.138.1 port 46518
2020-07-25T00:13:44.914484snf-827550 sshd[18503]: Failed password for invalid user lzhang from 51.178.138.1 port 46518 ssh2
2020-07-25T00:21:27.333981snf-827550 sshd[18557]: Invalid user version from 51.178.138.1 port 39626
...

Nov 29 13:21:01 tdfoods sshd\[1102\]: Invalid user admin from 79.135.245.89
Nov 29 13:21:01 tdfoods sshd\[1102\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=79.135.245.89
Nov 29 13:21:03 tdfoods sshd\[1102\]: Failed password for invalid user admin from 79.135.245.89 port 36592 ssh2
Nov 29 13:24:15 tdfoods sshd\[1355\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=79.135.245.89  user=root
Nov 29 13:24:18 tdfoods sshd\[1355\]: Failed password for root from 79.135.245.89 port 43218 ssh2

2019-11-29T23:50:21.082718abusebot-7.cloudsearch.cf sshd\[8033\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.166.34.129  user=root

11/29/2019-19:28:17.040316 185.176.27.246 Protocol: 6 ET DROP Dshield Block Listed Source group 1

Nov 30 01:23:44 SilenceServices sshd[870]: Failed password for root from 218.92.0.148 port 39543 ssh2
Nov 30 01:23:58 SilenceServices sshd[870]: error: maximum authentication attempts exceeded for root from 218.92.0.148 port 39543 ssh2 [preauth]
Nov 30 01:24:03 SilenceServices sshd[959]: Failed password for root from 218.92.0.148 port 9622 ssh2

Invalid user guest from 130.61.118.231 port 39592

[portscan] Port scan

(sshd) Failed SSH login from 218.92.0.187 (CN/China/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Nov 30 01:03:22 elude sshd[9664]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.187  user=root
Nov 30 01:03:24 elude sshd[9664]: Failed password for root from 218.92.0.187 port 16481 ssh2
Nov 30 01:03:37 elude sshd[9664]: error: maximum authentication attempts exceeded for root from 218.92.0.187 port 16481 ssh2 [preauth]
Nov 30 01:03:41 elude sshd[9707]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.187  user=root
Nov 30 01:03:42 elude sshd[9707]: Failed password for root from 218.92.0.187 port 44487 ssh2

3389BruteforceFW22

2019-11-30T00:01:46.056563abusebot-2.cloudsearch.cf sshd\[10210\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.138  user=root

Nov 30 01:01:29 mc1 kernel: \[6358309.373537\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:11:a9:7b:d2:74:7f:6e:37:e3:08:00 SRC=92.118.37.97 DST=159.69.205.51 LEN=40 TOS=0x00 PREC=0x00 TTL=247 ID=55178 PROTO=TCP SPT=42885 DPT=2019 WINDOW=1024 RES=0x00 SYN URGP=0 
Nov 30 01:09:50 mc1 kernel: \[6358809.434622\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:11:a9:7b:d2:74:7f:6e:37:e3:08:00 SRC=92.118.37.97 DST=159.69.205.51 LEN=40 TOS=0x00 PREC=0x00 TTL=247 ID=29749 PROTO=TCP SPT=42885 DPT=2062 WINDOW=1024 RES=0x00 SYN URGP=0 
Nov 30 01:10:48 mc1 kernel: \[6358867.935988\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:11:a9:7b:d2:74:7f:6e:37:e3:08:00 SRC=92.118.37.97 DST=159.69.205.51 LEN=40 TOS=0x00 PREC=0x00 TTL=247 ID=3261 PROTO=TCP SPT=42885 DPT=3386 WINDOW=1024 RES=0x00 SYN URGP=0 
...

Nov 29 23:56:14 herz-der-gamer sshd[7133]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=41.81.150.131  user=root
Nov 29 23:56:15 herz-der-gamer sshd[7133]: Failed password for root from 41.81.150.131 port 15518 ssh2
Nov 30 00:19:28 herz-der-gamer sshd[7484]: Invalid user info from 41.81.150.131 port 16317
...

SSH invalid-user multiple login try

Nov 30 00:19:13 ArkNodeAT sshd\[18957\]: Invalid user inatsuki from 129.211.130.37
Nov 30 00:19:13 ArkNodeAT sshd\[18957\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.211.130.37
Nov 30 00:19:16 ArkNodeAT sshd\[18957\]: Failed password for invalid user inatsuki from 129.211.130.37 port 44771 ssh2

Nov 29 23:55:22 localhost sshd\[87061\]: Invalid user sa from 111.230.10.176 port 34606
Nov 29 23:55:22 localhost sshd\[87061\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.230.10.176
Nov 29 23:55:24 localhost sshd\[87061\]: Failed password for invalid user sa from 111.230.10.176 port 34606 ssh2
Nov 29 23:58:46 localhost sshd\[87127\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.230.10.176  user=root
Nov 29 23:58:48 localhost sshd\[87127\]: Failed password for root from 111.230.10.176 port 39818 ssh2
...

Nov 30 01:38:37 MK-Soft-Root1 sshd[19818]: Failed password for root from 49.88.112.55 port 59752 ssh2
Nov 30 01:38:42 MK-Soft-Root1 sshd[19818]: Failed password for root from 49.88.112.55 port 59752 ssh2
...