Aug 27 01:06:17 MK-Soft-Root2 sshd\[19872\]: Invalid user bowling from 51.75.248.159 port 50992
Aug 27 01:06:17 MK-Soft-Root2 sshd\[19872\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.248.159
Aug 27 01:06:20 MK-Soft-Root2 sshd\[19872\]: Failed password for invalid user bowling from 51.75.248.159 port 50992 ssh2
...

Aug 26 15:02:14 SilenceServices sshd[30315]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.248.159
Aug 26 15:02:15 SilenceServices sshd[30315]: Failed password for invalid user tomcat from 51.75.248.159 port 34144 ssh2
Aug 26 15:07:33 SilenceServices sshd[32366]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.248.159

Aug 23 21:00:01 SilenceServices sshd[25016]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.248.159
Aug 23 21:00:04 SilenceServices sshd[25016]: Failed password for invalid user spencer from 51.75.248.159 port 55210 ssh2
Aug 23 21:05:18 SilenceServices sshd[29852]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.248.159

$f2bV_matches

Brute force attempt

Jun 24 05:50:37 DAAP sshd[23307]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.248.241  user=root
Jun 24 05:50:40 DAAP sshd[23307]: Failed password for root from 51.75.248.241 port 45186 ssh2
Jun 24 05:58:27 DAAP sshd[23389]: Invalid user server from 51.75.248.241 port 33524
Jun 24 05:58:27 DAAP sshd[23389]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.248.241
Jun 24 05:58:27 DAAP sshd[23389]: Invalid user server from 51.75.248.241 port 33524
Jun 24 05:58:29 DAAP sshd[23389]: Failed password for invalid user server from 51.75.248.241 port 33524 ssh2
...

Jun 23 22:34:23 fhem-rasp sshd[2848]: Invalid user jiang from 51.75.248.241 port 39728
...

Jun  7 20:08:58 home sshd[31253]: Failed password for root from 51.75.248.241 port 46130 ssh2
Jun  7 20:10:13 home sshd[31540]: Failed password for root from 51.75.248.241 port 36930 ssh2
...

May  8 13:49:44 xeon sshd[16470]: Failed password for invalid user teamspeak from 51.75.248.241 port 36662 ssh2

May  5 21:27:49 vmd48417 sshd[1694]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.248.241

May  4 18:05:10 MainVPS sshd[22460]: Invalid user maileh from 51.75.248.57 port 59816
May  4 18:05:10 MainVPS sshd[22460]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.248.57
May  4 18:05:10 MainVPS sshd[22460]: Invalid user maileh from 51.75.248.57 port 59816
May  4 18:05:12 MainVPS sshd[22460]: Failed password for invalid user maileh from 51.75.248.57 port 59816 ssh2
May  4 18:09:02 MainVPS sshd[25903]: Invalid user my from 51.75.248.57 port 40548
...

May  3 17:08:15 ip-172-31-62-245 sshd\[16225\]: Invalid user gpadmin from 51.75.248.241\
May  3 17:08:17 ip-172-31-62-245 sshd\[16225\]: Failed password for invalid user gpadmin from 51.75.248.241 port 33222 ssh2\
May  3 17:12:02 ip-172-31-62-245 sshd\[16339\]: Invalid user mongod from 51.75.248.241\
May  3 17:12:04 ip-172-31-62-245 sshd\[16339\]: Failed password for invalid user mongod from 51.75.248.241 port 42558 ssh2\
May  3 17:15:43 ip-172-31-62-245 sshd\[16393\]: Invalid user xuyf from 51.75.248.241\

Invalid user zjw from 51.75.248.241 port 52924

May  1 00:29:41 php1 sshd\[15297\]: Invalid user desmond from 51.75.248.241
May  1 00:29:41 php1 sshd\[15297\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.248.241
May  1 00:29:43 php1 sshd\[15297\]: Failed password for invalid user desmond from 51.75.248.241 port 59980 ssh2
May  1 00:33:47 php1 sshd\[15646\]: Invalid user tester from 51.75.248.241
May  1 00:33:47 php1 sshd\[15646\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.248.241

Apr 29 17:23:14 ns382633 sshd\[27200\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.248.57  user=root
Apr 29 17:23:17 ns382633 sshd\[27200\]: Failed password for root from 51.75.248.57 port 60338 ssh2
Apr 29 17:33:04 ns382633 sshd\[29229\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.248.57  user=root
Apr 29 17:33:06 ns382633 sshd\[29229\]: Failed password for root from 51.75.248.57 port 33498 ssh2
Apr 29 17:37:06 ns382633 sshd\[30134\]: Invalid user webuser from 51.75.248.57 port 44006
Apr 29 17:37:06 ns382633 sshd\[30134\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.248.57

2020-04-29T16:42:40.571972vivaldi2.tree2.info sshd[16333]: Invalid user fahad from 51.75.248.241
2020-04-29T16:42:40.589613vivaldi2.tree2.info sshd[16333]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=241.ip-51-75-248.eu
2020-04-29T16:42:40.571972vivaldi2.tree2.info sshd[16333]: Invalid user fahad from 51.75.248.241
2020-04-29T16:42:42.481587vivaldi2.tree2.info sshd[16333]: Failed password for invalid user fahad from 51.75.248.241 port 37616 ssh2
2020-04-29T16:46:29.062892vivaldi2.tree2.info sshd[16413]: Invalid user mysql from 51.75.248.241
...

$f2bV_matches

(sshd) Failed SSH login from 51.75.248.241 (FR/France/241.ip-51-75-248.eu): 2 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Apr 25 09:16:23 ubnt-55d23 sshd[15620]: Invalid user spark from 51.75.248.241 port 45912
Apr 25 09:16:25 ubnt-55d23 sshd[15620]: Failed password for invalid user spark from 51.75.248.241 port 45912 ssh2

Sep 11 00:15:07 lenivpn01 kernel: \[386511.509497\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:2f:6c:1b:d2:74:7f:6e:37:e3:08:00 SRC=174.138.11.251 DST=195.201.121.15 LEN=60 TOS=0x00 PREC=0x00 TTL=54 ID=28899 DF PROTO=TCP SPT=33059 DPT=6379 WINDOW=29200 RES=0x00 SYN URGP=0 
Sep 11 00:15:08 lenivpn01 kernel: \[386512.507608\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:2f:6c:1b:d2:74:7f:6e:37:e3:08:00 SRC=174.138.11.251 DST=195.201.121.15 LEN=60 TOS=0x00 PREC=0x00 TTL=54 ID=28900 DF PROTO=TCP SPT=33059 DPT=6379 WINDOW=29200 RES=0x00 SYN URGP=0 
Sep 11 00:15:10 lenivpn01 kernel: \[386514.511771\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:2f:6c:1b:d2:74:7f:6e:37:e3:08:00 SRC=174.138.11.251 DST=195.201.121.15 LEN=60 TOS=0x00 PREC=0x00 TTL=54 ID=28901 DF PROTO=TCP SPT=33059 DPT=6379 WINDOW=29200 RES=0x00 SYN URGP=0 
...

Sent Mail to address hacked/leaked/bought from crystalproductions.cz between 2011 and 2018

port 23 attempt blocked

Automatic report - Port Scan Attack

Unauthorized connection attempt from IP address 14.235.249.174 on Port 445(SMB)

2019-09-10T22:15:43.418110abusebot-2.cloudsearch.cf sshd\[21216\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.15.160  user=root

Sep 11 01:29:10 tuotantolaitos sshd[25643]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.255.174.164
Sep 11 01:29:12 tuotantolaitos sshd[25643]: Failed password for invalid user student from 51.255.174.164 port 38468 ssh2
...

Sep 11 00:36:19 legacy sshd[24796]: Failed password for root from 1.52.166.239 port 30348 ssh2
Sep 11 00:37:01 legacy sshd[24836]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.52.166.239
Sep 11 00:37:03 legacy sshd[24836]: Failed password for invalid user user from 1.52.166.239 port 14666 ssh2
...

\[2019-09-10 18:15:17\] NOTICE\[1827\] chan_sip.c: Registration from '"1009" \' failed for '77.247.110.216:6132' - Wrong password
\[2019-09-10 18:15:17\] SECURITY\[1849\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-09-10T18:15:17.476-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="1009",SessionID="0x7fd9a80077d8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/77.247.110.216/6132",Challenge="73695f36",ReceivedChallenge="73695f36",ReceivedHash="d595f358b2e5f0bd9da0dff44c230ad6"
\[2019-09-10 18:15:17\] NOTICE\[1827\] chan_sip.c: Registration from '"1009" \' failed for '77.247.110.216:6132' - Wrong password
\[2019-09-10 18:15:17\] SECURITY\[1849\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-09-10T18:15:17.570-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="1009",SessionID="0x7fd9a8a8c4f8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4

Sep 11 00:15:20 mail sshd[3725]: Invalid user admin from 117.63.175.155
Sep 11 00:15:20 mail sshd[3725]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.63.175.155
Sep 11 00:15:20 mail sshd[3725]: Invalid user admin from 117.63.175.155
Sep 11 00:15:22 mail sshd[3725]: Failed password for invalid user admin from 117.63.175.155 port 41908 ssh2
Sep 11 00:15:20 mail sshd[3725]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.63.175.155
Sep 11 00:15:20 mail sshd[3725]: Invalid user admin from 117.63.175.155
Sep 11 00:15:22 mail sshd[3725]: Failed password for invalid user admin from 117.63.175.155 port 41908 ssh2
Sep 11 00:15:24 mail sshd[3725]: Failed password for invalid user admin from 117.63.175.155 port 41908 ssh2
...

Sep 10 23:39:48 h2177944 kernel: \[1028109.645291\] \[UFW BLOCK\] IN=venet0 OUT= MAC= SRC=5.188.86.114 DST=85.214.117.9 LEN=40 TOS=0x00 PREC=0x00 TTL=250 ID=51922 PROTO=TCP SPT=50044 DPT=3030 WINDOW=1024 RES=0x00 SYN URGP=0 
Sep 10 23:51:52 h2177944 kernel: \[1028833.428688\] \[UFW BLOCK\] IN=venet0 OUT= MAC= SRC=5.188.86.114 DST=85.214.117.9 LEN=40 TOS=0x00 PREC=0x00 TTL=250 ID=62732 PROTO=TCP SPT=50044 DPT=3073 WINDOW=1024 RES=0x00 SYN URGP=0 
Sep 11 00:04:20 h2177944 kernel: \[1029581.949213\] \[UFW BLOCK\] IN=venet0 OUT= MAC= SRC=5.188.86.114 DST=85.214.117.9 LEN=40 TOS=0x00 PREC=0x00 TTL=250 ID=39943 PROTO=TCP SPT=50044 DPT=3000 WINDOW=1024 RES=0x00 SYN URGP=0 
Sep 11 00:25:08 h2177944 kernel: \[1030829.375930\] \[UFW BLOCK\] IN=venet0 OUT= MAC= SRC=5.188.86.114 DST=85.214.117.9 LEN=40 TOS=0x00 PREC=0x00 TTL=250 ID=57639 PROTO=TCP SPT=50044 DPT=3249 WINDOW=1024 RES=0x00 SYN URGP=0 
Sep 11 00:26:48 h2177944 kernel: \[1030929.371832\] \[UFW BLOCK\] IN=venet0 OUT= MAC= SRC=5.188.86.114 DST=85.214.117.9 LEN=

Sep 10 12:09:29 web9 sshd\[20343\]: Invalid user sysadmin from 192.227.252.3
Sep 10 12:09:29 web9 sshd\[20343\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.227.252.3
Sep 10 12:09:30 web9 sshd\[20343\]: Failed password for invalid user sysadmin from 192.227.252.3 port 48258 ssh2
Sep 10 12:15:42 web9 sshd\[21676\]: Invalid user suporte from 192.227.252.3
Sep 10 12:15:42 web9 sshd\[21676\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.227.252.3

Sep 10 12:09:09 hcbb sshd\[6951\]: Invalid user devel from 200.122.234.203
Sep 10 12:09:09 hcbb sshd\[6951\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.122.234.203
Sep 10 12:09:11 hcbb sshd\[6951\]: Failed password for invalid user devel from 200.122.234.203 port 49096 ssh2
Sep 10 12:15:40 hcbb sshd\[7513\]: Invalid user postgres from 200.122.234.203
Sep 10 12:15:40 hcbb sshd\[7513\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.122.234.203

Sep 10 18:28:26 vps200512 sshd\[11264\]: Invalid user userftp from 104.236.175.127
Sep 10 18:28:26 vps200512 sshd\[11264\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.236.175.127
Sep 10 18:28:28 vps200512 sshd\[11264\]: Failed password for invalid user userftp from 104.236.175.127 port 55640 ssh2
Sep 10 18:35:15 vps200512 sshd\[11377\]: Invalid user arma3server from 104.236.175.127
Sep 10 18:35:15 vps200512 sshd\[11377\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.236.175.127

Sep 10 22:27:29 game-panel sshd[13099]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=144.217.243.216
Sep 10 22:27:30 game-panel sshd[13099]: Failed password for invalid user nodejs from 144.217.243.216 port 59960 ssh2
Sep 10 22:33:26 game-panel sshd[13388]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=144.217.243.216