CloudCIX Reconnaissance Scan Detected, PTR: 33.ip-51-38-239.eu.

CloudCIX Reconnaissance Scan Detected, PTR: 33.ip-51-38-239.eu.

2020-09-07T17:39:38.543557upcloud.m0sh1x2.com sshd[27841]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=solution-info-services.fr  user=root
2020-09-07T17:39:40.482707upcloud.m0sh1x2.com sshd[27841]: Failed password for root from 51.38.239.53 port 48996 ssh2

Failed password for root from 51.38.239.53 port 51458 ssh2
pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=solution-info-services.fr  user=root
Failed password for root from 51.38.239.53 port 58096 ssh2
pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=solution-info-services.fr  user=root
Failed password for root from 51.38.239.53 port 36496 ssh2

2020-03-18T21:04:50.552334shield sshd\[13224\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=50.ip-51-38-239.eu  user=root
2020-03-18T21:04:53.161869shield sshd\[13224\]: Failed password for root from 51.38.239.50 port 47172 ssh2
2020-03-18T21:10:38.101629shield sshd\[14831\]: Invalid user mining from 51.38.239.50 port 40970
2020-03-18T21:10:38.111523shield sshd\[14831\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=50.ip-51-38-239.eu
2020-03-18T21:10:40.486913shield sshd\[14831\]: Failed password for invalid user mining from 51.38.239.50 port 40970 ssh2

Invalid user csgoserver from 51.38.239.50 port 44896

2020-03-04T16:02:58.278522abusebot-7.cloudsearch.cf sshd[18096]: Invalid user default from 51.38.239.50 port 58436
2020-03-04T16:02:58.285096abusebot-7.cloudsearch.cf sshd[18096]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=50.ip-51-38-239.eu
2020-03-04T16:02:58.278522abusebot-7.cloudsearch.cf sshd[18096]: Invalid user default from 51.38.239.50 port 58436
2020-03-04T16:03:00.067475abusebot-7.cloudsearch.cf sshd[18096]: Failed password for invalid user default from 51.38.239.50 port 58436 ssh2
2020-03-04T16:11:26.433591abusebot-7.cloudsearch.cf sshd[18587]: Invalid user mc3 from 51.38.239.50 port 36452
2020-03-04T16:11:26.437464abusebot-7.cloudsearch.cf sshd[18587]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=50.ip-51-38-239.eu
2020-03-04T16:11:26.433591abusebot-7.cloudsearch.cf sshd[18587]: Invalid user mc3 from 51.38.239.50 port 36452
2020-03-04T16:11:27.958127abusebot-7.cloudsearch.cf sshd[18587]:
...

Mar  4 03:01:37 wbs sshd\[25861\]: Invalid user cyril from 51.38.239.50
Mar  4 03:01:37 wbs sshd\[25861\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=50.ip-51-38-239.eu
Mar  4 03:01:40 wbs sshd\[25861\]: Failed password for invalid user cyril from 51.38.239.50 port 48386 ssh2
Mar  4 03:10:26 wbs sshd\[26670\]: Invalid user sai from 51.38.239.50
Mar  4 03:10:26 wbs sshd\[26670\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=50.ip-51-38-239.eu

Feb 23 17:34:06 silence02 sshd[27576]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.239.50
Feb 23 17:34:08 silence02 sshd[27576]: Failed password for invalid user testnet from 51.38.239.50 port 43628 ssh2
Feb 23 17:36:50 silence02 sshd[28847]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.239.50

Unauthorized connection attempt detected from IP address 51.38.239.50 to port 2220 [J]

Dec 21 16:54:58 microserver sshd[55390]: Invalid user aage from 51.38.239.50 port 45740
Dec 21 16:54:58 microserver sshd[55390]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.239.50
Dec 21 16:55:00 microserver sshd[55390]: Failed password for invalid user aage from 51.38.239.50 port 45740 ssh2
Dec 21 17:00:34 microserver sshd[56585]: Invalid user sallas from 51.38.239.50 port 52026
Dec 21 17:00:34 microserver sshd[56585]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.239.50
Dec 21 17:11:40 microserver sshd[58210]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.239.50  user=news
Dec 21 17:11:42 microserver sshd[58210]: Failed password for news from 51.38.239.50 port 36248 ssh2
Dec 21 17:17:17 microserver sshd[58972]: Invalid user fullmer from 51.38.239.50 port 42440
Dec 21 17:17:17 microserver sshd[58972]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid

Mar 30 08:42:07 vtv3 sshd[31370]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.239.50
Apr 14 00:42:21 vtv3 sshd[28734]: Invalid user ajenti from 51.38.239.50 port 45138
Apr 14 00:42:21 vtv3 sshd[28734]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.239.50
Apr 14 00:42:24 vtv3 sshd[28734]: Failed password for invalid user ajenti from 51.38.239.50 port 45138 ssh2
Apr 14 00:47:36 vtv3 sshd[31241]: Invalid user admin from 51.38.239.50 port 39118
Apr 14 00:47:36 vtv3 sshd[31241]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.239.50
Apr 18 11:40:40 vtv3 sshd[17829]: Invalid user jet from 51.38.239.50 port 52242
Apr 18 11:40:40 vtv3 sshd[17829]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.239.50
Apr 18 11:40:42 vtv3 sshd[17829]: Failed password for invalid user jet from 51.38.239.50 port 52242 ssh2
Apr 18 11:46:08 vtv3 sshd[

Autoban   51.38.239.171 AUTH/CONNECT

Dec  9 18:46:12 ns41 sshd[17431]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.239.50

Dec  4 20:19:04 ns37 sshd[32115]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.239.50
Dec  4 20:19:06 ns37 sshd[32115]: Failed password for invalid user alysa from 51.38.239.50 port 34342 ssh2
Dec  4 20:28:06 ns37 sshd[32599]: Failed password for root from 51.38.239.50 port 44360 ssh2

Nov 29 04:25:50 hanapaa sshd\[28468\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=50.ip-51-38-239.eu  user=root
Nov 29 04:25:52 hanapaa sshd\[28468\]: Failed password for root from 51.38.239.50 port 38250 ssh2
Nov 29 04:29:00 hanapaa sshd\[28686\]: Invalid user steam from 51.38.239.50
Nov 29 04:29:00 hanapaa sshd\[28686\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=50.ip-51-38-239.eu
Nov 29 04:29:02 hanapaa sshd\[28686\]: Failed password for invalid user steam from 51.38.239.50 port 46346 ssh2

Nov 25 09:09:18 www sshd\[63460\]: Invalid user hoch from 51.38.239.50
Nov 25 09:09:18 www sshd\[63460\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.239.50
Nov 25 09:09:20 www sshd\[63460\]: Failed password for invalid user hoch from 51.38.239.50 port 47494 ssh2
...

Apr  3 15:12:13 MainVPS sshd[32041]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.200.30.151  user=root
Apr  3 15:12:15 MainVPS sshd[32041]: Failed password for root from 81.200.30.151 port 54710 ssh2
Apr  3 15:16:24 MainVPS sshd[7815]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.200.30.151  user=root
Apr  3 15:16:26 MainVPS sshd[7815]: Failed password for root from 81.200.30.151 port 37312 ssh2
Apr  3 15:20:32 MainVPS sshd[16054]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.200.30.151  user=root
Apr  3 15:20:33 MainVPS sshd[16054]: Failed password for root from 81.200.30.151 port 48148 ssh2
...

Lines containing failures of 34.92.121.178 (max 1000)
Apr  1 01:05:06 localhost sshd[30831]: User r.r from 34.92.121.178 not allowed because listed in DenyUsers
Apr  1 01:05:06 localhost sshd[30831]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.92.121.178  user=r.r
Apr  1 01:05:08 localhost sshd[30831]: Failed password for invalid user r.r from 34.92.121.178 port 58624 ssh2
Apr  1 01:05:10 localhost sshd[30831]: Received disconnect from 34.92.121.178 port 58624:11: Bye Bye [preauth]
Apr  1 01:05:10 localhost sshd[30831]: Disconnected from invalid user r.r 34.92.121.178 port 58624 [preauth]
Apr  1 01:16:00 localhost sshd[1572]: User r.r from 34.92.121.178 not allowed because listed in DenyUsers
Apr  1 01:16:00 localhost sshd[1572]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.92.121.178  user=r.r
Apr  1 01:16:02 localhost sshd[1572]: Failed password for invalid user r.r from 34.92.........
------------------------------

Masscan Port Scanning Tool Detection

Apr  3 19:55:14 webhost01 sshd[13341]: Failed password for root from 34.92.31.13 port 36840 ssh2
...

2020-04-03T15:34:03.205217struts4.enskede.local sshd\[13755\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.144.134.27  user=root
2020-04-03T15:34:06.628396struts4.enskede.local sshd\[13755\]: Failed password for root from 122.144.134.27 port 5447 ssh2
2020-04-03T15:36:45.498438struts4.enskede.local sshd\[13795\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.144.134.27  user=root
2020-04-03T15:36:48.281595struts4.enskede.local sshd\[13795\]: Failed password for root from 122.144.134.27 port 5448 ssh2
2020-04-03T15:42:43.277004struts4.enskede.local sshd\[13911\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.144.134.27  user=root
...

2020-04-03T09:00:11.873896mail.thespaminator.com sshd[5152]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=ip100.ip-144-217-214.net  user=root
2020-04-03T09:00:14.237470mail.thespaminator.com sshd[5152]: Failed password for root from 144.217.214.100 port 50114 ssh2
...

Apr  3 02:55:12 php1 sshd\[27966\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.153.107  user=root
Apr  3 02:55:14 php1 sshd\[27966\]: Failed password for root from 106.12.153.107 port 38464 ssh2
Apr  3 02:58:00 php1 sshd\[28221\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.153.107  user=root
Apr  3 02:58:02 php1 sshd\[28221\]: Failed password for root from 106.12.153.107 port 40518 ssh2
Apr  3 03:00:28 php1 sshd\[28426\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.153.107  user=root

Apr  3 12:55:18 vlre-nyc-1 sshd\[14203\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=172.81.238.222  user=root
Apr  3 12:55:20 vlre-nyc-1 sshd\[14203\]: Failed password for root from 172.81.238.222 port 48094 ssh2
Apr  3 13:00:40 vlre-nyc-1 sshd\[14387\]: Invalid user mo from 172.81.238.222
Apr  3 13:00:40 vlre-nyc-1 sshd\[14387\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=172.81.238.222
Apr  3 13:00:42 vlre-nyc-1 sshd\[14387\]: Failed password for invalid user mo from 172.81.238.222 port 46800 ssh2
...

Apr  3 14:56:36 vps647732 sshd[16630]: Failed password for root from 220.178.75.153 port 15798 ssh2
...

Apr  3 02:55:45 php1 sshd\[28016\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.124.64.126  user=root
Apr  3 02:55:47 php1 sshd\[28016\]: Failed password for root from 115.124.64.126 port 40846 ssh2
Apr  3 03:00:30 php1 sshd\[28428\]: Invalid user tanwei from 115.124.64.126
Apr  3 03:00:30 php1 sshd\[28428\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.124.64.126
Apr  3 03:00:32 php1 sshd\[28428\]: Failed password for invalid user tanwei from 115.124.64.126 port 55946 ssh2

Apr  3 14:47:24 sip sshd[23372]: Failed password for root from 181.52.172.107 port 33128 ssh2
Apr  3 14:55:54 sip sshd[25470]: Failed password for root from 181.52.172.107 port 38108 ssh2

SSH brute-force: detected 6 distinct usernames within a 24-hour window.

Apr  3 15:21:18 mout sshd[18621]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=35.203.18.146  user=root
Apr  3 15:21:20 mout sshd[18621]: Failed password for root from 35.203.18.146 port 32976 ssh2

Apr  3 12:56:20 powerpi2 sshd[6691]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.132.225.229  user=root
Apr  3 12:56:22 powerpi2 sshd[6691]: Failed password for root from 164.132.225.229 port 38086 ssh2
Apr  3 13:00:19 powerpi2 sshd[6971]: Invalid user user from 164.132.225.229 port 48604
...

fail2ban