Sep 15 19:27:08 ns382633 sshd\[21758\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.38.180.93  user=root
Sep 15 19:27:10 ns382633 sshd\[21758\]: Failed password for root from 54.38.180.93 port 54130 ssh2
Sep 15 19:34:05 ns382633 sshd\[23159\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.38.180.93  user=root
Sep 15 19:34:08 ns382633 sshd\[23159\]: Failed password for root from 54.38.180.93 port 59438 ssh2
Sep 15 19:39:10 ns382633 sshd\[24203\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.38.180.93  user=root

$f2bV_matches

2020-08-29T01:47:41.842639paragon sshd[649231]: Invalid user bgs from 54.38.180.93 port 36542
2020-08-29T01:47:41.845141paragon sshd[649231]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.38.180.93
2020-08-29T01:47:41.842639paragon sshd[649231]: Invalid user bgs from 54.38.180.93 port 36542
2020-08-29T01:47:43.130071paragon sshd[649231]: Failed password for invalid user bgs from 54.38.180.93 port 36542 ssh2
2020-08-29T01:52:03.120110paragon sshd[649688]: Invalid user gsm from 54.38.180.93 port 43386
...

Aug 25 22:00:31 prox sshd[30139]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.38.180.93 
Aug 25 22:00:34 prox sshd[30139]: Failed password for invalid user wfx from 54.38.180.93 port 39964 ssh2

2020-08-03T18:23:03.2045531495-001 sshd[44957]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=93.ip-54-38-180.eu  user=root
2020-08-03T18:23:04.8713741495-001 sshd[44957]: Failed password for root from 54.38.180.93 port 37262 ssh2
2020-08-03T18:28:12.6830911495-001 sshd[45262]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=93.ip-54-38-180.eu  user=root
2020-08-03T18:28:15.4349721495-001 sshd[45262]: Failed password for root from 54.38.180.93 port 49224 ssh2
2020-08-03T18:33:15.2434071495-001 sshd[45473]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=93.ip-54-38-180.eu  user=root
2020-08-03T18:33:16.9247251495-001 sshd[45473]: Failed password for root from 54.38.180.93 port 32952 ssh2
...

Auto Fail2Ban report, multiple SSH login attempts.

Jul 19 12:06:35 server sshd[4445]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.38.180.93
Jul 19 12:06:37 server sshd[4445]: Failed password for invalid user postgres from 54.38.180.93 port 43552 ssh2
Jul 19 12:11:43 server sshd[5254]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.38.180.93
...

Jul  8 15:41:43 ns382633 sshd\[16751\]: Invalid user sapbep from 54.38.180.93 port 56686
Jul  8 15:41:43 ns382633 sshd\[16751\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.38.180.93
Jul  8 15:41:45 ns382633 sshd\[16751\]: Failed password for invalid user sapbep from 54.38.180.93 port 56686 ssh2
Jul  8 16:00:25 ns382633 sshd\[20098\]: Invalid user kierston from 54.38.180.93 port 43034
Jul  8 16:00:25 ns382633 sshd\[20098\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.38.180.93

SSH Invalid Login

Jul  6 12:01:51 ajax sshd[30240]: Failed password for root from 54.38.180.93 port 40878 ssh2

sshd jail - ssh hack attempt

Automatic report BANNED IP

Jun 29 08:53:15 h2646465 sshd[6695]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.38.180.93  user=root
Jun 29 08:53:18 h2646465 sshd[6695]: Failed password for root from 54.38.180.93 port 42042 ssh2
Jun 29 09:00:03 h2646465 sshd[7049]: Invalid user mch from 54.38.180.93
Jun 29 09:00:03 h2646465 sshd[7049]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.38.180.93
Jun 29 09:00:03 h2646465 sshd[7049]: Invalid user mch from 54.38.180.93
Jun 29 09:00:05 h2646465 sshd[7049]: Failed password for invalid user mch from 54.38.180.93 port 39872 ssh2
Jun 29 09:04:06 h2646465 sshd[7784]: Invalid user sshvpn from 54.38.180.93
Jun 29 09:04:06 h2646465 sshd[7784]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.38.180.93
Jun 29 09:04:06 h2646465 sshd[7784]: Invalid user sshvpn from 54.38.180.93
Jun 29 09:04:07 h2646465 sshd[7784]: Failed password for invalid user sshvpn from 54.38.180.93 port 3

2020-06-28T02:27:29.818450sorsha.thespaminator.com sshd[20423]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=93.ip-54-38-180.eu  user=root
2020-06-28T02:27:32.425688sorsha.thespaminator.com sshd[20423]: Failed password for root from 54.38.180.93 port 45986 ssh2
...

2020-06-14T19:08:01.892871abusebot-5.cloudsearch.cf sshd[30513]: Invalid user www-data from 54.38.180.93 port 51060
2020-06-14T19:08:01.898255abusebot-5.cloudsearch.cf sshd[30513]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=93.ip-54-38-180.eu
2020-06-14T19:08:01.892871abusebot-5.cloudsearch.cf sshd[30513]: Invalid user www-data from 54.38.180.93 port 51060
2020-06-14T19:08:03.879265abusebot-5.cloudsearch.cf sshd[30513]: Failed password for invalid user www-data from 54.38.180.93 port 51060 ssh2
2020-06-14T19:11:21.148373abusebot-5.cloudsearch.cf sshd[30554]: Invalid user michael from 54.38.180.93 port 33604
2020-06-14T19:11:21.153585abusebot-5.cloudsearch.cf sshd[30554]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=93.ip-54-38-180.eu
2020-06-14T19:11:21.148373abusebot-5.cloudsearch.cf sshd[30554]: Invalid user michael from 54.38.180.93 port 33604
2020-06-14T19:11:23.591320abusebot-5.cloudsearch.cf s
...

SSH bruteforce

2020-06-12T08:55:49.300040snf-827550 sshd[23234]: Failed password for invalid user jedy from 54.38.180.93 port 38804 ssh2
2020-06-12T09:03:31.191514snf-827550 sshd[23331]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=93.ip-54-38-180.eu  user=root
2020-06-12T09:03:33.187486snf-827550 sshd[23331]: Failed password for root from 54.38.180.93 port 49170 ssh2
...

May 27 22:54:55 vmd48417 sshd[11143]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.38.180.93

May 21 11:05:47 pkdns2 sshd\[40303\]: Invalid user dh from 54.38.180.93May 21 11:05:50 pkdns2 sshd\[40303\]: Failed password for invalid user dh from 54.38.180.93 port 37578 ssh2May 21 11:09:41 pkdns2 sshd\[40467\]: Invalid user virtualbox from 54.38.180.93May 21 11:09:43 pkdns2 sshd\[40467\]: Failed password for invalid user virtualbox from 54.38.180.93 port 44584 ssh2May 21 11:13:34 pkdns2 sshd\[40687\]: Invalid user wzc from 54.38.180.93May 21 11:13:36 pkdns2 sshd\[40687\]: Failed password for invalid user wzc from 54.38.180.93 port 51590 ssh2
...

detected by Fail2Ban

$f2bV_matches

2020-05-09T11:41:18.388831vivaldi2.tree2.info sshd[12092]: Failed password for invalid user backup from 54.38.180.93 port 34518 ssh2
2020-05-09T11:45:43.987223vivaldi2.tree2.info sshd[12265]: Invalid user guest from 54.38.180.93
2020-05-09T11:45:43.998446vivaldi2.tree2.info sshd[12265]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=93.ip-54-38-180.eu
2020-05-09T11:45:43.987223vivaldi2.tree2.info sshd[12265]: Invalid user guest from 54.38.180.93
2020-05-09T11:45:46.319453vivaldi2.tree2.info sshd[12265]: Failed password for invalid user guest from 54.38.180.93 port 43720 ssh2
...

Apr 23 07:35:11 lock-38 sshd[1396177]: Invalid user tester from 54.38.180.93 port 44554
Apr 23 07:35:11 lock-38 sshd[1396177]: Failed password for invalid user tester from 54.38.180.93 port 44554 ssh2
Apr 23 07:35:11 lock-38 sshd[1396177]: Disconnected from invalid user tester 54.38.180.93 port 44554 [preauth]
Apr 23 07:43:21 lock-38 sshd[1396420]: Failed password for root from 54.38.180.93 port 47148 ssh2
Apr 23 07:43:21 lock-38 sshd[1396420]: Disconnected from authenticating user root 54.38.180.93 port 47148 [preauth]
...

ssh brute force

Apr  8 23:45:29 MainVPS sshd[31870]: Invalid user admin from 54.38.180.93 port 51104
Apr  8 23:45:29 MainVPS sshd[31870]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.38.180.93
Apr  8 23:45:29 MainVPS sshd[31870]: Invalid user admin from 54.38.180.93 port 51104
Apr  8 23:45:31 MainVPS sshd[31870]: Failed password for invalid user admin from 54.38.180.93 port 51104 ssh2
Apr  8 23:51:05 MainVPS sshd[11167]: Invalid user tfcserver from 54.38.180.93 port 37992
...

Lines containing failures of 54.38.180.93 (max 1000)
Apr  6 23:19:34 localhost sshd[22333]: Invalid user jacke from 54.38.180.93 port 52356
Apr  6 23:19:34 localhost sshd[22333]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.38.180.93 
Apr  6 23:19:36 localhost sshd[22333]: Failed password for invalid user jacke from 54.38.180.93 port 52356 ssh2
Apr  6 23:19:38 localhost sshd[22333]: Received disconnect from 54.38.180.93 port 52356:11: Bye Bye [preauth]
Apr  6 23:19:38 localhost sshd[22333]: Disconnected from invalid user jacke 54.38.180.93 port 52356 [preauth]
Apr  7 00:54:33 localhost sshd[14367]: Invalid user deploy from 54.38.180.93 port 42966
Apr  7 00:54:33 localhost sshd[14367]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.38.180.93 
Apr  7 00:54:35 localhost sshd[14367]: Failed password for invalid user deploy from 54.38.180.93 port 42966 ssh2
Apr  7 00:54:35 localhost sshd........
------------------------------

$f2bV_matches

Oct  5 01:01:21 ns37 sshd[20549]: Failed password for root from 54.38.180.185 port 46440 ssh2
Oct  5 01:01:21 ns37 sshd[20549]: Failed password for root from 54.38.180.185 port 46440 ssh2

Oct  4 14:55:08 vps sshd[28099]: Failed password for root from 54.38.180.185 port 45390 ssh2
Oct  4 15:18:36 vps sshd[29475]: Failed password for root from 54.38.180.185 port 42170 ssh2
...

Invalid user cedric from 54.38.180.185 port 46004

Aug 30 13:21:43 localhost sshd[10124]: Invalid user jitendra from 54.38.180.53 port 48430
Aug 30 13:21:43 localhost sshd[10124]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=53.ip-54-38-180.eu
Aug 30 13:21:43 localhost sshd[10124]: Invalid user jitendra from 54.38.180.53 port 48430
Aug 30 13:21:45 localhost sshd[10124]: Failed password for invalid user jitendra from 54.38.180.53 port 48430 ssh2
Aug 30 13:25:34 localhost sshd[10523]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=53.ip-54-38-180.eu  user=root
Aug 30 13:25:36 localhost sshd[10523]: Failed password for root from 54.38.180.53 port 55922 ssh2
...

Aug 28 05:05:15 dignus sshd[21579]: Failed password for invalid user redmine from 54.38.180.53 port 52372 ssh2
Aug 28 05:07:27 dignus sshd[21851]: Invalid user stagiaire from 54.38.180.53 port 34676
Aug 28 05:07:27 dignus sshd[21851]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.38.180.53
Aug 28 05:07:29 dignus sshd[21851]: Failed password for invalid user stagiaire from 54.38.180.53 port 34676 ssh2
Aug 28 05:09:41 dignus sshd[22149]: Invalid user gerry from 54.38.180.53 port 45212
...

Aug 26 00:45:49 nextcloud sshd\[10323\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.38.180.53  user=root
Aug 26 00:45:51 nextcloud sshd\[10323\]: Failed password for root from 54.38.180.53 port 54116 ssh2
Aug 26 00:59:26 nextcloud sshd\[23879\]: Invalid user compta from 54.38.180.53
Aug 26 00:59:26 nextcloud sshd\[23879\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.38.180.53

Cowrie Honeypot: 3 unauthorised SSH/Telnet login attempts between 2020-08-03T17:04:59Z and 2020-08-03T17:12:56Z

SSH Invalid Login

(sshd) Failed SSH login from 54.38.180.53 (FR/France/53.ip-54-38-180.eu): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Jul 19 16:51:35 grace sshd[20486]: Invalid user ubuntu from 54.38.180.53 port 37188
Jul 19 16:51:38 grace sshd[20486]: Failed password for invalid user ubuntu from 54.38.180.53 port 37188 ssh2
Jul 19 16:59:32 grace sshd[21276]: Invalid user pdj from 54.38.180.53 port 43454
Jul 19 16:59:34 grace sshd[21276]: Failed password for invalid user pdj from 54.38.180.53 port 43454 ssh2
Jul 19 17:03:19 grace sshd[21888]: Invalid user backup1 from 54.38.180.53 port 56790

Jul 18 14:05:50 dev0-dcde-rnet sshd[11147]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.38.180.53
Jul 18 14:05:52 dev0-dcde-rnet sshd[11147]: Failed password for invalid user share from 54.38.180.53 port 60632 ssh2
Jul 18 14:10:02 dev0-dcde-rnet sshd[11225]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.38.180.53

Jul 12 06:29:11 pve1 sshd[31839]: Failed password for mail from 54.38.180.53 port 46192 ssh2
...

Jul  9 05:47:40 server sshd[48925]: Failed password for invalid user allan from 54.38.180.53 port 54710 ssh2
Jul  9 05:54:42 server sshd[54294]: Failed password for invalid user narita from 54.38.180.53 port 33642 ssh2
Jul  9 05:57:42 server sshd[56465]: Failed password for invalid user ronica from 54.38.180.53 port 57928 ssh2

Jul  6 05:46:58 ajax sshd[7436]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.38.180.53 
Jul  6 05:46:59 ajax sshd[7436]: Failed password for invalid user poa from 54.38.180.53 port 38404 ssh2

Jun  8 13:52:43 ns382633 sshd\[6727\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.38.180.53  user=root
Jun  8 13:52:45 ns382633 sshd\[6727\]: Failed password for root from 54.38.180.53 port 51800 ssh2
Jun  8 14:06:08 ns382633 sshd\[9614\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.38.180.53  user=root
Jun  8 14:06:09 ns382633 sshd\[9614\]: Failed password for root from 54.38.180.53 port 50276 ssh2
Jun  8 14:09:20 ns382633 sshd\[10039\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.38.180.53  user=root

Jun  3 09:57:52 NPSTNNYC01T sshd[27409]: Failed password for root from 54.38.180.53 port 53400 ssh2
Jun  3 09:59:56 NPSTNNYC01T sshd[27581]: Failed password for root from 54.38.180.53 port 60120 ssh2
...

TCP port 445 (SMB) attempt blocked by firewall. [2019-07-06 05:52:58]

Wordpress XMLRPC attack

Jul  6 06:32:27 lnxweb62 sshd[7543]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=132.232.18.128

2019-07-06T03:50:36.227679abusebot-5.cloudsearch.cf sshd\[7649\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.221.111.203  user=root

Human Trafficking Spam

Subject: (Awakened Mind)

Jul  6 05:46:20 apollo sshd\[1882\]: Failed password for root from 69.17.158.101 port 56506 ssh2Jul  6 05:51:59 apollo sshd\[1891\]: Invalid user dspace from 69.17.158.101Jul  6 05:52:02 apollo sshd\[1891\]: Failed password for invalid user dspace from 69.17.158.101 port 57590 ssh2
...

\[2019-07-06 06:51:09\] NOTICE\[13863\] res_pjsip/pjsip_distributor.c: Request 'REGISTER' from '\' failed for '5.62.19.38:2707' \(callid: 2117504373-29420955-1024868709\) - Failed to authenticate
\[2019-07-06 06:51:09\] SECURITY\[3671\] res_security_log.c: SecurityEvent="ChallengeResponseFailed",EventTV="2019-07-06T06:51:09.236+0200",Severity="Error",Service="PJSIP",EventVersion="1",AccountID="\",SessionID="2117504373-29420955-1024868709",LocalAddress="IPV4/UDP/188.40.118.248/5060",RemoteAddress="IPV4/UDP/5.62.19.38/2707",Challenge="1562388669/f33469600a8bcb84b6028d2026ae750c",Response="c1d545ce8536ee6dc75a9ddc1cfea83a",ExpectedResponse=""
\[2019-07-06 06:51:09\] NOTICE\[4808\] res_pjsip/pjsip_distributor.c: Request 'REGISTER' from '\' failed for '5.62.19.38:2707' \(callid: 2117504373-29420955-1024868709\) - Failed to authenticate
\[2019-07-06 06:51:09\] SECURITY\[3671\] res_security_log.c: SecurityEvent="ChallengeResponseFailed",Event

SMB Server BruteForce Attack

Jul  5 23:50:39 web1 postfix/smtpd[1318]: warning: unknown[185.234.218.149]: SASL LOGIN authentication failed: authentication failure
...

Invalid user estelle from 222.72.140.18 port 21085
pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.72.140.18
Failed password for invalid user estelle from 222.72.140.18 port 21085 ssh2
Invalid user zhuan from 222.72.140.18 port 29834
pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.72.140.18

Jul  6 06:19:39 vtv3 sshd\[22400\]: Invalid user discovery from 125.227.236.60 port 49278
Jul  6 06:19:39 vtv3 sshd\[22400\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.227.236.60
Jul  6 06:19:41 vtv3 sshd\[22400\]: Failed password for invalid user discovery from 125.227.236.60 port 49278 ssh2
Jul  6 06:24:04 vtv3 sshd\[24559\]: Invalid user ntadmin from 125.227.236.60 port 35982
Jul  6 06:24:04 vtv3 sshd\[24559\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.227.236.60
Jul  6 06:36:15 vtv3 sshd\[30974\]: Invalid user production from 125.227.236.60 port 47452
Jul  6 06:36:15 vtv3 sshd\[30974\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.227.236.60
Jul  6 06:36:16 vtv3 sshd\[30974\]: Failed password for invalid user production from 125.227.236.60 port 47452 ssh2
Jul  6 06:38:47 vtv3 sshd\[31949\]: Invalid user ubuntu from 125.227.236.60 port 44098
Jul  6 06:3

SMTP-sasl brute force
...

DATE:2019-07-06 05:50:51, IP:117.2.48.39, PORT:telnet - Telnet brute force auth on a honeypot server (epe-dc)

Jul  6 05:42:07 ovpn sshd\[12553\]: Invalid user wildfly from 121.15.140.178
Jul  6 05:42:07 ovpn sshd\[12553\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.15.140.178
Jul  6 05:42:09 ovpn sshd\[12553\]: Failed password for invalid user wildfly from 121.15.140.178 port 34926 ssh2
Jul  6 05:52:12 ovpn sshd\[14345\]: Invalid user mp3 from 121.15.140.178
Jul  6 05:52:12 ovpn sshd\[14345\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.15.140.178

@LucianNitescu Personal Honeypot Network <<<>>> Donate at paypal.me/LNitescu <<<>>> 2019-07-06 03:32:28,163 INFO [amun_request_handler] PortScan Detected on Port: 445 (117.6.94.132)