$f2bV_matches

Apr 10 06:20:23 prox sshd[6252]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.113.45 
Apr 10 06:20:25 prox sshd[6252]: Failed password for invalid user warcraft from 51.38.113.45 port 44910 ssh2

Apr  6 04:47:15 game-panel sshd[6934]: Failed password for root from 51.38.113.45 port 37474 ssh2
Apr  6 04:51:16 game-panel sshd[7170]: Failed password for root from 51.38.113.45 port 49142 ssh2

(sshd) Failed SSH login from 51.38.113.45 (DE/Germany/45.ip-51-38-113.eu): 5 in the last 3600 secs

Apr  4 00:56:33 localhost sshd\[30697\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.113.45  user=root
Apr  4 00:56:35 localhost sshd\[30697\]: Failed password for root from 51.38.113.45 port 45262 ssh2
Apr  4 01:00:17 localhost sshd\[30803\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.113.45  user=root
...

Mar 29 23:22:54 ns382633 sshd\[1507\]: Invalid user chh from 51.38.113.45 port 53274
Mar 29 23:22:54 ns382633 sshd\[1507\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.113.45
Mar 29 23:22:56 ns382633 sshd\[1507\]: Failed password for invalid user chh from 51.38.113.45 port 53274 ssh2
Mar 29 23:33:42 ns382633 sshd\[3605\]: Invalid user jiangjiaqi from 51.38.113.45 port 37948
Mar 29 23:33:42 ns382633 sshd\[3605\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.113.45

Invalid user caidanwei from 51.38.113.45 port 51258

SSH Authentication Attempts Exceeded

fail2ban -- 51.38.113.45
...

Feb 27 10:52:36 ns381471 sshd[19923]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.113.45
Feb 27 10:52:37 ns381471 sshd[19923]: Failed password for invalid user amandabackup from 51.38.113.45 port 38678 ssh2

Feb 25 00:23:35 ourumov-web sshd\[12798\]: Invalid user zq from 51.38.113.45 port 32930
Feb 25 00:23:35 ourumov-web sshd\[12798\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.113.45
Feb 25 00:23:37 ourumov-web sshd\[12798\]: Failed password for invalid user zq from 51.38.113.45 port 32930 ssh2
...

Invalid user ts3bot5 from 51.38.113.45 port 41672

Feb 15 12:38:53 web1 sshd\[21906\]: Invalid user jenkins from 51.38.113.45
Feb 15 12:38:53 web1 sshd\[21906\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.113.45
Feb 15 12:38:55 web1 sshd\[21906\]: Failed password for invalid user jenkins from 51.38.113.45 port 53538 ssh2
Feb 15 12:40:35 web1 sshd\[22105\]: Invalid user hacker from 51.38.113.45
Feb 15 12:40:35 web1 sshd\[22105\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.113.45

Unauthorized connection attempt detected from IP address 51.38.113.45 to port 22

Unauthorized connection attempt detected from IP address 51.38.113.45 to port 2220 [J]

Unauthorized connection attempt detected from IP address 51.38.113.45 to port 2220 [J]

" "

2019-12-18T18:50:43.069132ns547587 sshd\[8512\]: Invalid user ftpuser from 51.38.113.45 port 34688
2019-12-18T18:50:43.074950ns547587 sshd\[8512\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.ip-51-38-113.eu
2019-12-18T18:50:45.120343ns547587 sshd\[8512\]: Failed password for invalid user ftpuser from 51.38.113.45 port 34688 ssh2
2019-12-18T18:56:26.375108ns547587 sshd\[17666\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.ip-51-38-113.eu  user=root
...

Dec 18 08:38:31 php1 sshd\[28392\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.113.45  user=root
Dec 18 08:38:33 php1 sshd\[28392\]: Failed password for root from 51.38.113.45 port 45722 ssh2
Dec 18 08:48:00 php1 sshd\[29429\]: Invalid user SYSMAN from 51.38.113.45
Dec 18 08:48:00 php1 sshd\[29429\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.113.45
Dec 18 08:48:02 php1 sshd\[29429\]: Failed password for invalid user SYSMAN from 51.38.113.45 port 35174 ssh2

Dec 15 00:51:19 MK-Soft-VM7 sshd[28888]: Failed password for root from 51.38.113.45 port 52998 ssh2
...

Dec  5 21:45:20 auw2 sshd\[12901\]: Invalid user client from 51.38.113.45
Dec  5 21:45:20 auw2 sshd\[12901\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.ip-51-38-113.eu
Dec  5 21:45:22 auw2 sshd\[12901\]: Failed password for invalid user client from 51.38.113.45 port 49608 ssh2
Dec  5 21:51:02 auw2 sshd\[13461\]: Invalid user egina from 51.38.113.45
Dec  5 21:51:02 auw2 sshd\[13461\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.ip-51-38-113.eu

Dec  4 12:19:03 wbs sshd\[24023\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.ip-51-38-113.eu  user=root
Dec  4 12:19:05 wbs sshd\[24023\]: Failed password for root from 51.38.113.45 port 35586 ssh2
Dec  4 12:24:37 wbs sshd\[24523\]: Invalid user groups from 51.38.113.45
Dec  4 12:24:37 wbs sshd\[24523\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.ip-51-38-113.eu
Dec  4 12:24:39 wbs sshd\[24523\]: Failed password for invalid user groups from 51.38.113.45 port 45962 ssh2

Nov 26 08:33:01 mail sshd[5498]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.113.45 
Nov 26 08:33:03 mail sshd[5498]: Failed password for invalid user armando from 51.38.113.45 port 53886 ssh2
Nov 26 08:39:01 mail sshd[6814]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.113.45

2019-11-23T20:44:16.568741shield sshd\[12844\]: Invalid user smp from 51.38.113.45 port 35314
2019-11-23T20:44:16.573250shield sshd\[12844\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.ip-51-38-113.eu
2019-11-23T20:44:19.132473shield sshd\[12844\]: Failed password for invalid user smp from 51.38.113.45 port 35314 ssh2
2019-11-23T20:50:26.368845shield sshd\[14639\]: Invalid user tafat from 51.38.113.45 port 43742
2019-11-23T20:50:26.373228shield sshd\[14639\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.ip-51-38-113.eu

Nov 22 18:44:26 SilenceServices sshd[1104]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.113.45
Nov 22 18:44:28 SilenceServices sshd[1104]: Failed password for invalid user zoro from 51.38.113.45 port 57732 ssh2
Nov 22 18:47:58 SilenceServices sshd[5504]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.113.45

Nov 16 09:00:46 server sshd\[11590\]: Invalid user iwatan from 51.38.113.45
Nov 16 09:00:46 server sshd\[11590\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.ip-51-38-113.eu 
Nov 16 09:00:48 server sshd\[11590\]: Failed password for invalid user iwatan from 51.38.113.45 port 43536 ssh2
Nov 16 09:19:26 server sshd\[16239\]: Invalid user sou from 51.38.113.45
Nov 16 09:19:26 server sshd\[16239\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.ip-51-38-113.eu 
...

Nov  1 15:26:45 MK-Soft-VM5 sshd[15483]: Failed password for root from 51.38.113.45 port 47616 ssh2
...

Too many connections or unauthorized access detected from Arctic banned ip

2019-10-29T13:46:19.507508abusebot-2.cloudsearch.cf sshd\[3740\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.ip-51-38-113.eu  user=root

Oct 28 20:37:01 php1 sshd\[12410\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.ip-51-38-113.eu  user=root
Oct 28 20:37:03 php1 sshd\[12410\]: Failed password for root from 51.38.113.45 port 59588 ssh2
Oct 28 20:40:52 php1 sshd\[12969\]: Invalid user db2inst4 from 51.38.113.45
Oct 28 20:40:52 php1 sshd\[12969\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.ip-51-38-113.eu
Oct 28 20:40:54 php1 sshd\[12969\]: Failed password for invalid user db2inst4 from 51.38.113.45 port 42454 ssh2

SpamScore above: 10.0

SSH brute-force attempt

May 28 22:09:33 mail postfix/submission/smtpd[46014]: lost connection after EHLO from unknown[162.243.136.24]

Ayuda 21449

May 28 23:02:40 lukav-desktop sshd\[3088\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.174.197  user=root
May 28 23:02:41 lukav-desktop sshd\[3088\]: Failed password for root from 180.76.174.197 port 53092 ssh2
May 28 23:06:08 lukav-desktop sshd\[14496\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.174.197  user=root
May 28 23:06:10 lukav-desktop sshd\[14496\]: Failed password for root from 180.76.174.197 port 46034 ssh2
May 28 23:09:38 lukav-desktop sshd\[27063\]: Invalid user aranganathan from 180.76.174.197

2020-05-28T23:25:56.193317lavrinenko.info sshd[17134]: Failed password for invalid user sybase from 178.33.169.134 port 34525 ssh2
2020-05-28T23:29:13.941895lavrinenko.info sshd[17316]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.33.169.134  user=root
2020-05-28T23:29:16.104953lavrinenko.info sshd[17316]: Failed password for root from 178.33.169.134 port 36607 ssh2
2020-05-28T23:32:30.121434lavrinenko.info sshd[17475]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.33.169.134  user=root
2020-05-28T23:32:31.993741lavrinenko.info sshd[17475]: Failed password for root from 178.33.169.134 port 38678 ssh2
...

2020-05-28T20:23:05.074466shield sshd\[4107\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=86.101.56.141  user=root
2020-05-28T20:23:07.388052shield sshd\[4107\]: Failed password for root from 86.101.56.141 port 34176 ssh2
2020-05-28T20:29:46.524805shield sshd\[5663\]: Invalid user admin from 86.101.56.141 port 39578
2020-05-28T20:29:46.527672shield sshd\[5663\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=86.101.56.141
2020-05-28T20:29:48.219111shield sshd\[5663\]: Failed password for invalid user admin from 86.101.56.141 port 39578 ssh2

May 28 22:06:03 nextcloud sshd\[10475\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.122.156.79  user=root
May 28 22:06:05 nextcloud sshd\[10475\]: Failed password for root from 62.122.156.79 port 58384 ssh2
May 28 22:09:49 nextcloud sshd\[16307\]: Invalid user informix from 62.122.156.79
May 28 22:09:49 nextcloud sshd\[16307\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.122.156.79

21449

(imapd) Failed IMAP login from 183.89.212.196 (TH/Thailand/mx-ll-183.89.212-196.dynamic.3bb.co.th): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: May 29 00:39:46 ir1 dovecot[2885757]: imap-login: Disconnected (auth failed, 1 attempts in 6 secs): user=, method=PLAIN, rip=183.89.212.196, lip=5.63.12.44, TLS: Connection closed, session=

May 28 22:27:10 vps687878 sshd\[15847\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.120.69.14  user=mysql
May 28 22:27:12 vps687878 sshd\[15847\]: Failed password for mysql from 45.120.69.14 port 42830 ssh2
May 28 22:30:56 vps687878 sshd\[16291\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.120.69.14  user=root
May 28 22:30:58 vps687878 sshd\[16291\]: Failed password for root from 45.120.69.14 port 42116 ssh2
May 28 22:34:33 vps687878 sshd\[16651\]: Invalid user signalhill from 45.120.69.14 port 41382
May 28 22:34:33 vps687878 sshd\[16651\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.120.69.14
...

May 28 22:09:34 debian-2gb-nbg1-2 kernel: \[12955363.262134\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=89.248.167.141 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=247 ID=49756 PROTO=TCP SPT=58343 DPT=4089 WINDOW=1024 RES=0x00 SYN URGP=0

Honeypot attack, port: 445, PTR: 82-112-51-17.k-telecom.org.

Bruteforce detected by fail2ban

21449