Aug 16 21:18:05 scw-6657dc sshd[31788]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.68.251.201
Aug 16 21:18:05 scw-6657dc sshd[31788]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.68.251.201
Aug 16 21:18:07 scw-6657dc sshd[31788]: Failed password for invalid user odoo1 from 51.68.251.201 port 54248 ssh2
...

Jun  3 15:21:35 gw1 sshd[14381]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.68.251.201
Jun  3 15:21:37 gw1 sshd[14381]: Failed password for invalid user teamspeak from 51.68.251.201 port 37494 ssh2
...

prod6
...

prod6
...

Apr  2 00:03:13 vps647732 sshd[543]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.68.251.201
Apr  2 00:03:15 vps647732 sshd[543]: Failed password for invalid user gmodserver from 51.68.251.201 port 50770 ssh2
...

Mar  7 11:53:53 vps647732 sshd[6788]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.68.251.201
Mar  7 11:53:55 vps647732 sshd[6788]: Failed password for invalid user vivek from 51.68.251.201 port 37888 ssh2
...

Mar  7 01:50:03 vps647732 sshd[19596]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.68.251.201
Mar  7 01:50:04 vps647732 sshd[19596]: Failed password for invalid user git-admin from 51.68.251.201 port 33492 ssh2
...

Automatic report - Banned IP Access

Unauthorized connection attempt detected from IP address 51.68.251.201 to port 2220 [J]

2020-01-13T16:49:59.036704shield sshd\[26149\]: Invalid user xh from 51.68.251.201 port 34912
2020-01-13T16:49:59.041244shield sshd\[26149\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ip201.ip-51-68-251.eu
2020-01-13T16:50:00.796174shield sshd\[26149\]: Failed password for invalid user xh from 51.68.251.201 port 34912 ssh2
2020-01-13T16:52:29.284905shield sshd\[26724\]: Invalid user naren from 51.68.251.201 port 60460
2020-01-13T16:52:29.293285shield sshd\[26724\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ip201.ip-51-68-251.eu

Unauthorized connection attempt detected from IP address 51.68.251.201 to port 2220 [J]

Dec  7 07:55:25 server sshd\[11386\]: Invalid user server from 51.68.251.201
Dec  7 07:55:25 server sshd\[11386\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ip201.ip-51-68-251.eu 
Dec  7 07:55:27 server sshd\[11386\]: Failed password for invalid user server from 51.68.251.201 port 44882 ssh2
Dec  7 08:01:20 server sshd\[12908\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ip201.ip-51-68-251.eu  user=ftp
Dec  7 08:01:22 server sshd\[12908\]: Failed password for ftp from 51.68.251.201 port 35222 ssh2
...

Dec  2 22:34:42 MK-Soft-Root1 sshd[23530]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.68.251.201 
Dec  2 22:34:44 MK-Soft-Root1 sshd[23530]: Failed password for invalid user hutten from 51.68.251.201 port 47570 ssh2
...

2019-10-20 08:04:51,133 fail2ban.actions        [792]: NOTICE  [sshd] Ban 51.68.251.201
2019-10-20 11:12:23,611 fail2ban.actions        [792]: NOTICE  [sshd] Ban 51.68.251.201
2019-10-20 15:16:40,904 fail2ban.actions        [792]: NOTICE  [sshd] Ban 51.68.251.201
...

Nov 18 03:51:49 plusreed sshd[3962]: Invalid user vargus from 51.68.251.201
...

Nov  8 19:07:56 MK-Soft-VM6 sshd[26206]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.68.251.201 
Nov  8 19:07:58 MK-Soft-VM6 sshd[26206]: Failed password for invalid user ksb from 51.68.251.201 port 40354 ssh2
...

Nov  8 12:32:10 SilenceServices sshd[13466]: Failed password for root from 51.68.251.201 port 50220 ssh2
Nov  8 12:37:20 SilenceServices sshd[14949]: Failed password for root from 51.68.251.201 port 53776 ssh2

Nov  6 13:37:58 sachi sshd\[21040\]: Invalid user sharan from 51.68.251.201
Nov  6 13:37:58 sachi sshd\[21040\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ip201.ip-51-68-251.eu
Nov  6 13:38:00 sachi sshd\[21040\]: Failed password for invalid user sharan from 51.68.251.201 port 34674 ssh2
Nov  6 13:41:20 sachi sshd\[21394\]: Invalid user dreamway from 51.68.251.201
Nov  6 13:41:20 sachi sshd\[21394\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ip201.ip-51-68-251.eu

Oct 29 15:08:20 vpn01 sshd[22722]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.68.251.201
Oct 29 15:08:22 vpn01 sshd[22722]: Failed password for invalid user hca from 51.68.251.201 port 58472 ssh2
...

Oct 28 22:50:00 bouncer sshd\[12522\]: Invalid user user from 51.68.251.201 port 37118
Oct 28 22:50:00 bouncer sshd\[12522\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.68.251.201 
Oct 28 22:50:02 bouncer sshd\[12522\]: Failed password for invalid user user from 51.68.251.201 port 37118 ssh2
...

$f2bV_matches

SSH bruteforce (Triggered fail2ban)

*Port Scan* detected from 51.68.251.201 (FR/France/ip201.ip-51-68-251.eu). 4 hits in the last 231 seconds

Oct 25 05:57:32 [snip] sshd[23280]: Invalid user apotre from 51.68.251.201 port 35162
Oct 25 05:57:32 [snip] sshd[23280]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.68.251.201
Oct 25 05:57:35 [snip] sshd[23280]: Failed password for invalid user apotre from 51.68.251.201 port 35162 ssh2[...]

2019-10-24T14:18:24.788640shield sshd\[18367\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ip201.ip-51-68-251.eu  user=root
2019-10-24T14:18:26.525616shield sshd\[18367\]: Failed password for root from 51.68.251.201 port 41608 ssh2
2019-10-24T14:22:24.674255shield sshd\[19241\]: Invalid user asi from 51.68.251.201 port 33404
2019-10-24T14:22:24.678588shield sshd\[19241\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ip201.ip-51-68-251.eu
2019-10-24T14:22:26.692704shield sshd\[19241\]: Failed password for invalid user asi from 51.68.251.201 port 33404 ssh2

Tried sshing with brute force.

SSH bruteforce (Triggered fail2ban)

Invalid user p from 51.68.251.201 port 60718

Oct 16 08:10:56 vps691689 sshd[26618]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.68.251.201
Oct 16 08:10:58 vps691689 sshd[26618]: Failed password for invalid user Hobbit from 51.68.251.201 port 57818 ssh2
...

Oct  7 07:43:31 meumeu sshd[13953]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.68.251.201 
Oct  7 07:43:33 meumeu sshd[13953]: Failed password for invalid user Maria@123 from 51.68.251.201 port 34678 ssh2
Oct  7 07:47:35 meumeu sshd[14485]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.68.251.201 
...

Oct  6 18:50:53 scw-6657dc sshd[23087]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.68.251.202  user=root
Oct  6 18:50:53 scw-6657dc sshd[23087]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.68.251.202  user=root
Oct  6 18:50:55 scw-6657dc sshd[23087]: Failed password for root from 51.68.251.202 port 58626 ssh2
...

Failed password for root from 51.68.251.202 port 58312 ssh2

(sshd) Failed SSH login from 51.68.251.202 (FR/France/ip202.ip-51-68-251.eu): 3 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD

2020-09-22T05:11:52+0200 Failed SSH Authentication/Brute Force Attack. (Server 4)

Connection to SSH Honeypot - Detected by HoneypotDB

Invalid user admin from 51.68.251.202 port 40680

Sep  1 23:43:04 firewall sshd[23939]: Invalid user sysadmin from 51.68.251.202
Sep  1 23:43:06 firewall sshd[23939]: Failed password for invalid user sysadmin from 51.68.251.202 port 51018 ssh2
Sep  1 23:46:26 firewall sshd[23984]: Invalid user uftp from 51.68.251.202
...

Sep  1 23:43:04 firewall sshd[23939]: Invalid user sysadmin from 51.68.251.202
Sep  1 23:43:06 firewall sshd[23939]: Failed password for invalid user sysadmin from 51.68.251.202 port 51018 ssh2
Sep  1 23:46:26 firewall sshd[23984]: Invalid user uftp from 51.68.251.202
...

Invalid user pokus from 51.68.251.202 port 34524

2020-08-28T11:19:46.711437sorsha.thespaminator.com sshd[543]: Invalid user jds from 51.68.251.202 port 52692
2020-08-28T11:19:48.921130sorsha.thespaminator.com sshd[543]: Failed password for invalid user jds from 51.68.251.202 port 52692 ssh2
...

Aug 25 22:58:32 lukav-desktop sshd\[25962\]: Invalid user zookeeper from 51.68.251.202
Aug 25 22:58:32 lukav-desktop sshd\[25962\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.68.251.202
Aug 25 22:58:35 lukav-desktop sshd\[25962\]: Failed password for invalid user zookeeper from 51.68.251.202 port 49704 ssh2
Aug 25 23:02:00 lukav-desktop sshd\[25998\]: Invalid user q from 51.68.251.202
Aug 25 23:02:00 lukav-desktop sshd\[25998\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.68.251.202

Aug 24 23:23:02 vps647732 sshd[16534]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.68.251.202
Aug 24 23:23:03 vps647732 sshd[16534]: Failed password for invalid user mysqler from 51.68.251.202 port 50698 ssh2
...

SSH Brute-Forcing (server2)

*Port Scan* detected from 51.68.251.202 (PL/Poland/Mazovia/Warsaw/ip202.ip-51-68-251.eu). 4 hits in the last 85 seconds

Ssh brute force

77.48.13.54 (CZ/Czechia/-), 6 distributed sshd attacks on account [root] in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_DISTATTACK; Logs: Oct  5 18:14:08 server sshd[14154]: Failed password for root from 51.68.122.147 port 59666 ssh2
Oct  5 18:21:05 server sshd[15129]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.156.178  user=root
Oct  5 18:14:41 server sshd[14257]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.172.222.127  user=root
Oct  5 18:14:42 server sshd[14257]: Failed password for root from 167.172.222.127 port 43568 ssh2
Oct  5 18:13:55 server sshd[14148]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=77.48.13.54  user=root
Oct  5 18:13:56 server sshd[14148]: Failed password for root from 77.48.13.54 port 57426 ssh2

IP Addresses Blocked:

51.68.122.147 (FR/France/-)
180.76.156.178 (CN/China/-)
167.172.222.127 (US/United States/-)

Oct  5 10:43:19 ny01 sshd[19332]: Failed password for root from 211.95.84.146 port 44262 ssh2
Oct  5 10:47:53 ny01 sshd[19861]: Failed password for root from 211.95.84.146 port 42231 ssh2

Oct 5 20:13:31 *host* sshd\[32045\]: User *user* from 222.186.31.166 not allowed because none of user's groups are listed in AllowGroups

SSH login attempts.

Found on   CINS badguys     / proto=6  .  srcport=54634  .  dstport=8088  .     (3510)

81.68.137.90 (CN/China/-), 6 distributed sshd attacks on account [root] in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_DISTATTACK; Logs: Oct  5 06:06:57 jbs1 sshd[17433]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.122.156.74  user=root
Oct  5 06:06:28 jbs1 sshd[17265]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.68.137.90  user=root
Oct  5 06:06:29 jbs1 sshd[17265]: Failed password for root from 81.68.137.90 port 35198 ssh2
Oct  5 06:06:14 jbs1 sshd[17139]: Failed password for root from 58.87.120.53 port 60146 ssh2
Oct  5 06:07:00 jbs1 sshd[17433]: Failed password for root from 62.122.156.74 port 43024 ssh2
Oct  5 06:07:43 jbs1 sshd[17733]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.186.74  user=root

IP Addresses Blocked:

62.122.156.74 (UA/Ukraine/-)

Port probing on unauthorized port 23

Web app vulnerability scanning

Oct  5 15:46:44 ns381471 sshd[15654]: Failed password for root from 59.126.108.47 port 50275 ssh2

Bokep

Automatic report - Port Scan Attack

"Test Inject  t'a=0"

sina.com.cn

Oct  5 15:43:22 h2829583 sshd[5240]: Failed password for root from 211.155.225.104 port 49953 ssh2

Listed on    zen-spamhaus   / proto=17  .  srcport=55119  .  dstport=51759  .     (3508)