Automatic report - Banned IP Access

2019-11-13T15:27:38.639979abusebot-2.cloudsearch.cf sshd\[648\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ip235.ip-51-79-129.net  user=root

2019-10-22 05:28:11,307 fail2ban.actions        [1121]: NOTICE  [sshd] Ban 51.79.129.235
2019-10-22 06:41:07,494 fail2ban.actions        [1121]: NOTICE  [sshd] Ban 51.79.129.235
2019-10-22 07:53:32,805 fail2ban.actions        [1121]: NOTICE  [sshd] Ban 51.79.129.235
...

Oct 22 08:30:42 lnxded64 sshd[27435]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.79.129.235

2019-10-16T06:10:19.723583abusebot-7.cloudsearch.cf sshd\[1740\]: Invalid user vegetate from 51.79.129.235 port 36940

2019-10-02T08:01:55.836957abusebot-6.cloudsearch.cf sshd\[28613\]: Invalid user qf from 51.79.129.235 port 52682

Sep 29 16:10:41 vpn01 sshd[23777]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.79.129.235
Sep 29 16:10:43 vpn01 sshd[23777]: Failed password for invalid user skin from 51.79.129.235 port 42682 ssh2
...

fail2ban

Sep 22 22:04:04 vps647732 sshd[16462]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.79.129.235
Sep 22 22:04:06 vps647732 sshd[16462]: Failed password for invalid user crontab from 51.79.129.235 port 55670 ssh2
...

Sep 14 07:22:15 xtremcommunity sshd\[74407\]: Invalid user 123 from 51.79.129.235 port 33726
Sep 14 07:22:15 xtremcommunity sshd\[74407\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.79.129.235
Sep 14 07:22:17 xtremcommunity sshd\[74407\]: Failed password for invalid user 123 from 51.79.129.235 port 33726 ssh2
Sep 14 07:28:42 xtremcommunity sshd\[74601\]: Invalid user 123456 from 51.79.129.235 port 50538
Sep 14 07:28:42 xtremcommunity sshd\[74601\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.79.129.235
...

Aug 10 14:05:37 ovpn sshd\[13743\]: Invalid user user3 from 51.79.129.235
Aug 10 14:05:37 ovpn sshd\[13743\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.79.129.235
Aug 10 14:05:40 ovpn sshd\[13743\]: Failed password for invalid user user3 from 51.79.129.235 port 39450 ssh2
Aug 10 14:14:27 ovpn sshd\[15409\]: Invalid user venda from 51.79.129.235
Aug 10 14:14:27 ovpn sshd\[15409\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.79.129.235

Invalid user yang from 51.79.129.235 port 41874
pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.79.129.235
Failed password for invalid user yang from 51.79.129.235 port 41874 ssh2
Invalid user patrick from 51.79.129.235 port 37222
pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.79.129.235

Aug  2 09:23:17 MK-Soft-VM6 sshd\[15982\]: Invalid user paste from 51.79.129.235 port 48110
Aug  2 09:23:17 MK-Soft-VM6 sshd\[15982\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.79.129.235
Aug  2 09:23:18 MK-Soft-VM6 sshd\[15982\]: Failed password for invalid user paste from 51.79.129.235 port 48110 ssh2
...

Jul 20 07:46:41 ns41 sshd[1822]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.79.129.235
Jul 20 07:46:41 ns41 sshd[1822]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.79.129.235

Jul 19 20:13:50 localhost sshd\[42183\]: Invalid user mashby from 51.79.129.235 port 55536
Jul 19 20:13:50 localhost sshd\[42183\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.79.129.235
...

Jul 17 13:58:30 tux-35-217 sshd\[16938\]: Invalid user helen from 51.79.129.235 port 53406
Jul 17 13:58:30 tux-35-217 sshd\[16938\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.79.129.235
Jul 17 13:58:32 tux-35-217 sshd\[16938\]: Failed password for invalid user helen from 51.79.129.235 port 53406 ssh2
Jul 17 14:06:44 tux-35-217 sshd\[17014\]: Invalid user ts3 from 51.79.129.235 port 51808
Jul 17 14:06:44 tux-35-217 sshd\[17014\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.79.129.235
...

Multiple SSH auth failures recorded by fail2ban

Jul 11 05:02:44 localhost sshd\[1064\]: Invalid user zj from 51.79.129.235 port 37250
Jul 11 05:02:44 localhost sshd\[1064\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.79.129.235
...

Fail2Ban Ban Triggered (2)

Mar 17 00:10:21 server2 sshd\[10751\]: User root from ip7.ip-51-79-129.net not allowed because not listed in AllowUsers
Mar 17 00:10:22 server2 sshd\[10753\]: Invalid user admin from 51.79.129.7
Mar 17 00:10:23 server2 sshd\[10755\]: Invalid user ubnt from 51.79.129.7
Mar 17 00:10:25 server2 sshd\[10759\]: User root from ip7.ip-51-79-129.net not allowed because not listed in AllowUsers
Mar 17 00:10:26 server2 sshd\[10761\]: Invalid user support from 51.79.129.7
Mar 17 00:10:28 server2 sshd\[10763\]: User root from ip7.ip-51-79-129.net not allowed because not listed in AllowUsers

1580594210 - 02/01/2020 22:56:50 Host: ip211.ip-51-79-129.net/51.79.129.211 Port: 5060 UDP Blocked

Failed password for invalid user bunte from 51.79.129.253 port 56424 ssh2
Invalid user www from 51.79.129.253 port 33322
pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.79.129.253
Failed password for invalid user www from 51.79.129.253 port 33322 ssh2
pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.79.129.253  user=root

(sshd) Failed SSH login from 51.79.129.253 (CA/Canada/-/-/ip253.ip-51-79-129.net/[AS16276 OVH SAS]): 1 in the last 3600 secs

Nov 16 11:46:00 ws22vmsma01 sshd[79038]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.79.129.253
Nov 16 11:46:02 ws22vmsma01 sshd[79038]: Failed password for invalid user ftpuser from 51.79.129.253 port 55880 ssh2
...

Nov  2 11:39:26 SilenceServices sshd[13651]: Failed password for root from 51.79.129.252 port 41760 ssh2
Nov  2 11:44:13 SilenceServices sshd[16805]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.79.129.252
Nov  2 11:44:14 SilenceServices sshd[16805]: Failed password for invalid user alaa from 51.79.129.252 port 52834 ssh2

Oct 31 20:45:43 unicornsoft sshd\[9536\]: User root from 51.79.129.236 not allowed because not listed in AllowUsers
Oct 31 20:45:43 unicornsoft sshd\[9536\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.79.129.236  user=root
Oct 31 20:45:45 unicornsoft sshd\[9536\]: Failed password for invalid user root from 51.79.129.236 port 53548 ssh2

Oct 31 19:54:55 vps666546 sshd\[10648\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.79.129.236  user=root
Oct 31 19:54:57 vps666546 sshd\[10648\]: Failed password for root from 51.79.129.236 port 48015 ssh2
Oct 31 19:59:10 vps666546 sshd\[10727\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.79.129.236  user=root
Oct 31 19:59:12 vps666546 sshd\[10727\]: Failed password for root from 51.79.129.236 port 38917 ssh2
Oct 31 20:03:33 vps666546 sshd\[10826\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.79.129.236  user=root
...

Oct 29 20:42:11 auw2 sshd\[14940\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ip252.ip-51-79-129.net  user=root
Oct 29 20:42:13 auw2 sshd\[14940\]: Failed password for root from 51.79.129.252 port 43420 ssh2
Oct 29 20:46:57 auw2 sshd\[15314\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ip252.ip-51-79-129.net  user=root
Oct 29 20:46:59 auw2 sshd\[15314\]: Failed password for root from 51.79.129.252 port 53824 ssh2
Oct 29 20:51:42 auw2 sshd\[15849\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ip252.ip-51-79-129.net  user=root

Oct 24 17:27:40 server sshd\[12735\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ip236.ip-51-79-129.net  user=root
Oct 24 17:27:43 server sshd\[12735\]: Failed password for root from 51.79.129.236 port 59953 ssh2
Oct 24 17:39:31 server sshd\[15422\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ip236.ip-51-79-129.net  user=root
Oct 24 17:39:33 server sshd\[15422\]: Failed password for root from 51.79.129.236 port 42859 ssh2
Oct 24 17:43:32 server sshd\[16468\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ip236.ip-51-79-129.net  user=root
...

SSH-BruteForce

Oct 21 16:17:17 ns37 sshd[25101]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.79.129.236

Automatic report - SSH Brute-Force Attack

Oct 19 07:54:28 ns381471 sshd[26973]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.79.129.252
Oct 19 07:54:30 ns381471 sshd[26973]: Failed password for invalid user junk from 51.79.129.252 port 41688 ssh2
Oct 19 07:59:38 ns381471 sshd[27162]: Failed password for root from 51.79.129.252 port 53468 ssh2

Unauthorized connection attempt detected from IP address 202.142.191.162 to port 80 [J]

Unauthorized connection attempt detected from IP address 85.9.70.35 to port 23 [J]

Unauthorized connection attempt detected from IP address 80.98.32.157 to port 81 [J]

Unauthorized connection attempt detected from IP address 164.52.36.239 to port 5900 [J]

Unauthorized connection attempt detected from IP address 92.118.161.25 to port 111 [J]

Unauthorized connection attempt detected from IP address 179.24.166.201 to port 81 [J]

Invalid user ethan from 118.27.1.93 port 46770

Jan 18 19:15:10 linuxvps sshd\[61213\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.42.4  user=root
Jan 18 19:15:11 linuxvps sshd\[61213\]: Failed password for root from 222.186.42.4 port 65250 ssh2
Jan 18 19:15:27 linuxvps sshd\[61387\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.42.4  user=root
Jan 18 19:15:29 linuxvps sshd\[61387\]: Failed password for root from 222.186.42.4 port 19834 ssh2
Jan 18 19:15:48 linuxvps sshd\[61617\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.42.4  user=root

Unauthorized connection attempt detected from IP address 121.227.31.162 to port 7002 [J]

Invalid user tju1 from 190.113.142.197 port 57111

Invalid user dis from 94.191.76.19 port 33004

Invalid user admin from 139.59.86.171 port 59042

Unauthorized connection attempt detected from IP address 201.88.171.122 to port 1433 [J]

Unauthorized connection attempt detected from IP address 88.106.229.236 to port 23 [J]

Unauthorized connection attempt detected from IP address 101.89.151.127 to port 2220 [J]