Oct  7 16:22:46 ws26vmsma01 sshd[71136]: Failed password for root from 51.68.71.239 port 57716 ssh2
...

prod8
...

prod11
...

Sep 18 20:05:54 web9 sshd\[31550\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.68.71.239  user=root
Sep 18 20:05:56 web9 sshd\[31550\]: Failed password for root from 51.68.71.239 port 60500 ssh2
Sep 18 20:09:48 web9 sshd\[32067\]: Invalid user deployer from 51.68.71.239
Sep 18 20:09:48 web9 sshd\[32067\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.68.71.239
Sep 18 20:09:50 web9 sshd\[32067\]: Failed password for invalid user deployer from 51.68.71.239 port 38158 ssh2

Failed password for root from 51.68.71.239 port 60136

Sep 11 12:25:08 santamaria sshd\[20058\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.68.71.239  user=root
Sep 11 12:25:10 santamaria sshd\[20058\]: Failed password for root from 51.68.71.239 port 42248 ssh2
Sep 11 12:29:08 santamaria sshd\[20094\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.68.71.239  user=root
...

Sep 11 06:22:40 rancher-0 sshd[1531970]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.68.71.239  user=root
Sep 11 06:22:43 rancher-0 sshd[1531970]: Failed password for root from 51.68.71.239 port 55992 ssh2
...

2020-09-10T22:40:06.139769+02:00  sshd[22018]: Failed password for root from 51.68.71.239 port 33926 ssh2

Sep  8 13:58:28 abendstille sshd\[4161\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.68.71.239  user=root
Sep  8 13:58:30 abendstille sshd\[4161\]: Failed password for root from 51.68.71.239 port 56191 ssh2
Sep  8 14:01:59 abendstille sshd\[7437\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.68.71.239  user=root
Sep  8 14:02:02 abendstille sshd\[7437\]: Failed password for root from 51.68.71.239 port 58579 ssh2
Sep  8 14:05:32 abendstille sshd\[11123\]: Invalid user cap from 51.68.71.239
Sep  8 14:05:32 abendstille sshd\[11123\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.68.71.239
...

Sep  8 05:41:20 buvik sshd[13681]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.68.71.239  user=root
Sep  8 05:41:22 buvik sshd[13681]: Failed password for root from 51.68.71.239 port 34120 ssh2
Sep  8 05:45:03 buvik sshd[14198]: Invalid user web from 51.68.71.239
...

Sep  7 18:43:41 ovpn sshd\[13951\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.68.71.239  user=root
Sep  7 18:43:43 ovpn sshd\[13951\]: Failed password for root from 51.68.71.239 port 56387 ssh2
Sep  7 18:51:52 ovpn sshd\[15994\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.68.71.239  user=root
Sep  7 18:51:54 ovpn sshd\[15994\]: Failed password for root from 51.68.71.239 port 53907 ssh2
Sep  7 18:55:34 ovpn sshd\[17003\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.68.71.239  user=root

2020-09-01T07:36:39.986317abusebot-4.cloudsearch.cf sshd[28340]: Invalid user applmgr from 51.68.71.239 port 50966
2020-09-01T07:36:39.992437abusebot-4.cloudsearch.cf sshd[28340]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=239.ip-51-68-71.eu
2020-09-01T07:36:39.986317abusebot-4.cloudsearch.cf sshd[28340]: Invalid user applmgr from 51.68.71.239 port 50966
2020-09-01T07:36:41.885216abusebot-4.cloudsearch.cf sshd[28340]: Failed password for invalid user applmgr from 51.68.71.239 port 50966 ssh2
2020-09-01T07:40:35.640371abusebot-4.cloudsearch.cf sshd[28402]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=239.ip-51-68-71.eu  user=root
2020-09-01T07:40:37.598321abusebot-4.cloudsearch.cf sshd[28402]: Failed password for root from 51.68.71.239 port 54924 ssh2
2020-09-01T07:44:19.844418abusebot-4.cloudsearch.cf sshd[28416]: Invalid user ubnt from 51.68.71.239 port 58885
...

Sep  1 00:06:12 sxvn sshd[87085]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.68.71.239

Aug 29 06:33:11 xeon sshd[64614]: Failed password for invalid user grc from 51.68.71.239 port 53312 ssh2

Oct  9 15:21:40 email sshd\[5579\]: Invalid user renato from 51.68.71.102
Oct  9 15:21:40 email sshd\[5579\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.68.71.102
Oct  9 15:21:42 email sshd\[5579\]: Failed password for invalid user renato from 51.68.71.102 port 37976 ssh2
Oct  9 15:25:37 email sshd\[6322\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.68.71.102  user=root
Oct  9 15:25:38 email sshd\[6322\]: Failed password for root from 51.68.71.102 port 44330 ssh2
...

Bruteforce detected by fail2ban

Oct  4 05:17:01 gw1 sshd[27702]: Failed password for root from 51.68.71.102 port 54182 ssh2
...

prod8
...

SSH login attempts.

Brute-force attempt banned

ssh brute force

web-1 [ssh] SSH Attack

2020-09-17T13:42:01.356112shield sshd\[11548\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=102.ip-51-68-71.eu  user=root
2020-09-17T13:42:03.540045shield sshd\[11548\]: Failed password for root from 51.68.71.102 port 47040 ssh2
2020-09-17T13:44:53.857437shield sshd\[11786\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=102.ip-51-68-71.eu  user=root
2020-09-17T13:44:55.653990shield sshd\[11786\]: Failed password for root from 51.68.71.102 port 38304 ssh2
2020-09-17T13:47:44.006120shield sshd\[12008\]: Invalid user ADMN from 51.68.71.102 port 57798

2020-09-17T09:26:10.006900billing sshd[18842]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=102.ip-51-68-71.eu
2020-09-17T09:26:10.002854billing sshd[18842]: Invalid user test1 from 51.68.71.102 port 55138
2020-09-17T09:26:12.249241billing sshd[18842]: Failed password for invalid user test1 from 51.68.71.102 port 55138 ssh2
...

Triggered by Fail2Ban at Ares web server

Sep 15 13:14:30 vserver sshd\[24609\]: Failed password for root from 51.68.71.102 port 43542 ssh2Sep 15 13:18:20 vserver sshd\[24670\]: Invalid user ora8004 from 51.68.71.102Sep 15 13:18:23 vserver sshd\[24670\]: Failed password for invalid user ora8004 from 51.68.71.102 port 54964 ssh2Sep 15 13:22:20 vserver sshd\[24703\]: Failed password for root from 51.68.71.102 port 38160 ssh2
...

51.68.71.102 (FR/France/-), 5 distributed sshd attacks on account [root] in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_DISTATTACK; Logs: Sep 15 00:51:10 server2 sshd[23350]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.54.170.118  user=root
Sep 15 00:48:04 server2 sshd[21616]: Failed password for root from 164.132.44.218 port 46022 ssh2
Sep 15 00:47:44 server2 sshd[21314]: Failed password for root from 149.56.13.111 port 51542 ssh2
Sep 15 00:47:28 server2 sshd[21215]: Failed password for root from 91.121.176.34 port 50028 ssh2
Sep 15 00:47:48 server2 sshd[21393]: Failed password for root from 51.68.71.102 port 51132 ssh2

IP Addresses Blocked:

156.54.170.118 (IT/Italy/-)
164.132.44.218 (FR/France/-)
149.56.13.111 (CA/Canada/-)
91.121.176.34 (FR/France/-)

Sep 14 23:16:30 host2 sshd[1586542]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.68.71.102  user=root
Sep 14 23:16:32 host2 sshd[1586542]: Failed password for root from 51.68.71.102 port 52638 ssh2
Sep 14 23:20:28 host2 sshd[1587177]: Invalid user tankcommander117 from 51.68.71.102 port 36860
Sep 14 23:20:28 host2 sshd[1587177]: Invalid user tankcommander117 from 51.68.71.102 port 36860
...

"XSS Attack Detected via libinjection - Matched Data: XSS data found within ARGS_NAMES:

SSH bruteforce

20 attempts against mh-ssh on install-test

TCP port 8086: Scan and connection

May 10 20:53:40 pixelmemory sshd[3575866]: Invalid user prakash from 145.239.95.241 port 39660
May 10 20:53:40 pixelmemory sshd[3575866]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=145.239.95.241 
May 10 20:53:40 pixelmemory sshd[3575866]: Invalid user prakash from 145.239.95.241 port 39660
May 10 20:53:41 pixelmemory sshd[3575866]: Failed password for invalid user prakash from 145.239.95.241 port 39660 ssh2
May 10 20:57:03 pixelmemory sshd[3579849]: Invalid user jmartin from 145.239.95.241 port 47586
...

May 11 05:50:23 vps sshd[28822]: Failed password for invalid user shop from 190.15.59.5 port 43767 ssh2
May 11 05:55:14 vps sshd[51319]: Invalid user sa from 190.15.59.5 port 47692
May 11 05:55:14 vps sshd[51319]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190-15-59-5.net11.com.br
May 11 05:55:16 vps sshd[51319]: Failed password for invalid user sa from 190.15.59.5 port 47692 ssh2
May 11 05:59:58 vps sshd[68503]: Invalid user oracle from 190.15.59.5 port 51622
...

"Unauthorized connection attempt on SSHD detected"

05/10/2020-19:52:47.448921 92.118.234.186 Protocol: 17 ET SCAN Sipvicious Scan

May 11 03:56:22 vlre-nyc-1 sshd\[10431\]: Invalid user aman from 91.237.25.28
May 11 03:56:22 vlre-nyc-1 sshd\[10431\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.237.25.28
May 11 03:56:24 vlre-nyc-1 sshd\[10431\]: Failed password for invalid user aman from 91.237.25.28 port 41766 ssh2
May 11 04:01:57 vlre-nyc-1 sshd\[10536\]: Invalid user admin from 91.237.25.28
May 11 04:01:58 vlre-nyc-1 sshd\[10536\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.237.25.28
...

2020-05-11T05:57:40.4831371240 sshd\[27591\]: Invalid user sphinx from 218.2.204.125 port 43052
2020-05-11T05:57:40.4871141240 sshd\[27591\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.2.204.125
2020-05-11T05:57:41.9697281240 sshd\[27591\]: Failed password for invalid user sphinx from 218.2.204.125 port 43052 ssh2
...

SSH invalid-user multiple login attempts

May 11 06:51:57 lukav-desktop sshd\[11985\]: Invalid user hl from 111.67.195.129
May 11 06:51:57 lukav-desktop sshd\[11985\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.67.195.129
May 11 06:51:59 lukav-desktop sshd\[11985\]: Failed password for invalid user hl from 111.67.195.129 port 44348 ssh2
May 11 06:56:16 lukav-desktop sshd\[12087\]: Invalid user gitblit from 111.67.195.129
May 11 06:56:16 lukav-desktop sshd\[12087\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.67.195.129

ET CINS Active Threat Intelligence Poor Reputation IP group 86 - port: 1723 proto: TCP cat: Misc Attack

May 11 00:51:58 firewall sshd[28678]: Invalid user obus from 58.87.67.226
May 11 00:52:00 firewall sshd[28678]: Failed password for invalid user obus from 58.87.67.226 port 48826 ssh2
May 11 00:56:14 firewall sshd[28752]: Invalid user fms from 58.87.67.226
...

k+ssh-bruteforce

May 11 06:00:59 vps333114 sshd[11852]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.196.89.78
May 11 06:01:01 vps333114 sshd[11852]: Failed password for invalid user vlee from 116.196.89.78 port 34476 ssh2
...