2020-06-29T03:56:35.344580abusebot-6.cloudsearch.cf sshd[18820]: Invalid user dir from 62.92.48.244 port 54589
2020-06-29T03:56:35.350633abusebot-6.cloudsearch.cf sshd[18820]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=244.48.92.62.static.cust.telenor.com
2020-06-29T03:56:35.344580abusebot-6.cloudsearch.cf sshd[18820]: Invalid user dir from 62.92.48.244 port 54589
2020-06-29T03:56:37.124435abusebot-6.cloudsearch.cf sshd[18820]: Failed password for invalid user dir from 62.92.48.244 port 54589 ssh2
2020-06-29T03:59:39.931502abusebot-6.cloudsearch.cf sshd[18878]: Invalid user sonia from 62.92.48.244 port 10667
2020-06-29T03:59:39.937239abusebot-6.cloudsearch.cf sshd[18878]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=244.48.92.62.static.cust.telenor.com
2020-06-29T03:59:39.931502abusebot-6.cloudsearch.cf sshd[18878]: Invalid user sonia from 62.92.48.244 port 10667
2020-06-29T03:59:41.972283abusebot-6
...

Fail2Ban Ban Triggered

2020-06-20T12:25:10+0200 Failed SSH Authentication/Brute Force Attack. (Server 5)

...

2020-06-11T21:13:59.489843sd-86998 sshd[27524]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=244.48.92.62.static.cust.telenor.com  user=root
2020-06-11T21:14:01.304067sd-86998 sshd[27524]: Failed password for root from 62.92.48.244 port 55921 ssh2
2020-06-11T21:16:23.075890sd-86998 sshd[27877]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=244.48.92.62.static.cust.telenor.com  user=root
2020-06-11T21:16:24.660074sd-86998 sshd[27877]: Failed password for root from 62.92.48.244 port 59975 ssh2
2020-06-11T21:18:43.469296sd-86998 sshd[28137]: Invalid user ftpuser from 62.92.48.244 port 31377
...

frenzy

Jun  5 21:20:32 OPSO sshd\[6165\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.92.48.244  user=root
Jun  5 21:20:34 OPSO sshd\[6165\]: Failed password for root from 62.92.48.244 port 3007 ssh2
Jun  5 21:24:09 OPSO sshd\[6440\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.92.48.244  user=root
Jun  5 21:24:11 OPSO sshd\[6440\]: Failed password for root from 62.92.48.244 port 13576 ssh2
Jun  5 21:27:47 OPSO sshd\[7058\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.92.48.244  user=root

Jun  3 22:13:29 odroid64 sshd\[18843\]: User root from 62.92.48.244 not allowed because not listed in AllowUsers
Jun  3 22:13:29 odroid64 sshd\[18843\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.92.48.244  user=root
...

Total attacks: 2

Oct 11 12:49:30 itv-usvr-02 sshd[18823]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.92.48.242  user=root
Oct 11 12:49:32 itv-usvr-02 sshd[18823]: Failed password for root from 62.92.48.242 port 41191 ssh2
Oct 11 12:55:20 itv-usvr-02 sshd[19038]: Invalid user majordomo from 62.92.48.242 port 32437

Invalid user vbox from 62.92.48.242 port 64485

Sep 21 18:29:59 wbs sshd\[25657\]: Invalid user import from 62.92.48.242
Sep 21 18:29:59 wbs sshd\[25657\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.92.48.242
Sep 21 18:30:00 wbs sshd\[25657\]: Failed password for invalid user import from 62.92.48.242 port 22974 ssh2
Sep 21 18:34:21 wbs sshd\[25991\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.92.48.242  user=www-data
Sep 21 18:34:24 wbs sshd\[25991\]: Failed password for www-data from 62.92.48.242 port 58029 ssh2

DATE:2020-09-22 00:27:23,IP:62.92.48.242,MATCHES:10,PORT:ssh

$f2bV_matches

Sep  2 06:54:28 vpn01 sshd[10671]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.92.48.242
Sep  2 06:54:30 vpn01 sshd[10671]: Failed password for invalid user sistemas from 62.92.48.242 port 59122 ssh2
...

Invalid user testmail from 62.92.48.242 port 32437

Aug 26 21:21:19 game-panel sshd[28927]: Failed password for root from 62.92.48.242 port 26949 ssh2
Aug 26 21:25:33 game-panel sshd[29201]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.92.48.242
Aug 26 21:25:35 game-panel sshd[29201]: Failed password for invalid user console from 62.92.48.242 port 19241 ssh2

web-1 [ssh] SSH Attack

Aug 21 16:40:18 inter-technics sshd[26843]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.92.48.242  user=root
Aug 21 16:40:20 inter-technics sshd[26843]: Failed password for root from 62.92.48.242 port 55453 ssh2
Aug 21 16:44:30 inter-technics sshd[27144]: Invalid user clara from 62.92.48.242 port 12503
Aug 21 16:44:30 inter-technics sshd[27144]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.92.48.242
Aug 21 16:44:30 inter-technics sshd[27144]: Invalid user clara from 62.92.48.242 port 12503
Aug 21 16:44:32 inter-technics sshd[27144]: Failed password for invalid user clara from 62.92.48.242 port 12503 ssh2
...

SSH authentication failure x 6 reported by Fail2Ban
...

2020-07-29T16:21:43+0200 Failed SSH Authentication/Brute Force Attack. (Server 4)

Jul 22 00:39:03 ift sshd\[19751\]: Invalid user fabiana from 62.92.48.242Jul 22 00:39:05 ift sshd\[19751\]: Failed password for invalid user fabiana from 62.92.48.242 port 64774 ssh2Jul 22 00:43:36 ift sshd\[20476\]: Invalid user wangjw from 62.92.48.242Jul 22 00:43:38 ift sshd\[20476\]: Failed password for invalid user wangjw from 62.92.48.242 port 7505 ssh2Jul 22 00:48:26 ift sshd\[21061\]: Invalid user af from 62.92.48.242
...

Jun 17 01:47:46 Host-KLAX-C sshd[31889]: Disconnected from invalid user marvin 62.92.48.242 port 13399 [preauth]
...

Jun  6 16:33:24 lukav-desktop sshd\[7995\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.92.48.242  user=root
Jun  6 16:33:26 lukav-desktop sshd\[7995\]: Failed password for root from 62.92.48.242 port 11003 ssh2
Jun  6 16:37:21 lukav-desktop sshd\[8081\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.92.48.242  user=root
Jun  6 16:37:23 lukav-desktop sshd\[8081\]: Failed password for root from 62.92.48.242 port 13216 ssh2
Jun  6 16:41:08 lukav-desktop sshd\[8198\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.92.48.242  user=root

2019-10-12T22:10:03.871442lon01.zurich-datacenter.net sshd\[23637\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.77.187.18  user=root
2019-10-12T22:10:05.875621lon01.zurich-datacenter.net sshd\[23637\]: Failed password for root from 115.77.187.18 port 41906 ssh2
2019-10-12T22:15:05.381248lon01.zurich-datacenter.net sshd\[23761\]: Invalid user 123 from 115.77.187.18 port 57866
2019-10-12T22:15:05.389757lon01.zurich-datacenter.net sshd\[23761\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.77.187.18
2019-10-12T22:15:07.855112lon01.zurich-datacenter.net sshd\[23761\]: Failed password for invalid user 123 from 115.77.187.18 port 57866 ssh2
...

2019-10-12T21:47:37.079535  sshd[1116]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.234.31.150  user=root
2019-10-12T21:47:38.637226  sshd[1116]: Failed password for root from 49.234.31.150 port 54956 ssh2
2019-10-12T21:51:27.392212  sshd[1158]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.234.31.150  user=root
2019-10-12T21:51:29.190753  sshd[1158]: Failed password for root from 49.234.31.150 port 34108 ssh2
2019-10-12T21:55:19.744062  sshd[1189]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.234.31.150  user=root
2019-10-12T21:55:21.392267  sshd[1189]: Failed password for root from 49.234.31.150 port 41496 ssh2
...

Oct 13 01:34:36 webhost01 sshd[27098]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.111.175
Oct 13 01:34:38 webhost01 sshd[27098]: Failed password for invalid user 123 from 157.245.111.175 port 53116 ssh2
...

Unsolicited bulk porn & phishing - varying ISPs (primarily Chinanet); spam volume up to 15/day.  Spam series change: shift from repetitive redirects from blacklisted IP 92.63.192.124 & .151 to malicious attachments.

Unsolicited bulk spam - panotetsu.com, CHINANET hebei province network - 106.115.39.239

Permitted sender domain jmramosmejia.com.ar = 67.222.7.109 PrivateSystems Networks

Repetitive reply to:
Reply-To: nanikarige@yahoo.com = 72.30.35.9 Oath Holdings Inc.

Repetitive Apple mail:
-	boundary=" Apple-Mail-B7687EC7-712A-D2F6-E174-B1707B9FFC68"
-	X-Mailer: iPad Mail (13E238)

Spam series change: no phishing redirect spam link.  Malicious attachment - Outlook blocked access to unsafe attachment: 22.jpg

Oct 12 20:25:55 ns41 sshd[9054]: Failed password for root from 188.166.159.148 port 45235 ssh2
Oct 12 20:25:55 ns41 sshd[9054]: Failed password for root from 188.166.159.148 port 45235 ssh2

Invalid user 123 from 45.55.38.39 port 48661

Oct 12 **REMOVED** dovecot: imap-login: Disconnected \(auth failed, 1 attempts in 5 secs\): user=\, method=PLAIN, rip=200.94.22.27, lip=**REMOVED**, TLS: Disconnected, session=\
Oct 12 **REMOVED** dovecot: imap-login: Disconnected \(auth failed, 1 attempts in 5 secs\): user=\, method=PLAIN, rip=200.94.22.27, lip=**REMOVED**, TLS, session=\
Oct 12 **REMOVED** dovecot: imap-login: Disconnected \(auth failed, 1 attempts in 4 secs\): user=\<**REMOVED**.deekaterina_ushakova@**REMOVED**.de\>, method=PLAIN, rip=200.94.22.27, lip=**REMOVED**, TLS, session=\

2019-10-12T16:58:39.962916abusebot-2.cloudsearch.cf sshd\[22903\]: Invalid user ROOT@2017 from 152.136.76.134 port 53541

Oct 12 05:19:43 hpm sshd\[10130\]: Invalid user lian from 124.41.211.27
Oct 12 05:19:43 hpm sshd\[10130\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=124.41.211.27
Oct 12 05:19:45 hpm sshd\[10130\]: Failed password for invalid user lian from 124.41.211.27 port 52802 ssh2
Oct 12 05:26:01 hpm sshd\[10696\]: Invalid user fredy from 124.41.211.27
Oct 12 05:26:01 hpm sshd\[10696\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=124.41.211.27

Oct 12 18:01:41 microserver sshd[47731]: Invalid user 321 from 139.199.88.93 port 44264
Oct 12 18:01:41 microserver sshd[47731]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.199.88.93
Oct 12 18:01:42 microserver sshd[47731]: Failed password for invalid user 321 from 139.199.88.93 port 44264 ssh2
Oct 12 18:07:46 microserver sshd[48492]: Invalid user Genius@123 from 139.199.88.93 port 54616
Oct 12 18:07:46 microserver sshd[48492]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.199.88.93
Oct 12 18:20:28 microserver sshd[50324]: Invalid user P4rol4@1 from 139.199.88.93 port 47128
Oct 12 18:20:28 microserver sshd[50324]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.199.88.93
Oct 12 18:20:30 microserver sshd[50324]: Failed password for invalid user P4rol4@1 from 139.199.88.93 port 47128 ssh2
Oct 12 18:26:33 microserver sshd[51095]: Invalid user Premier@123 from 139.199.88.93 por

ssh failed login

Oct 12 20:21:03 heicom postfix/smtpd\[30668\]: warning: unknown\[92.118.38.53\]: SASL LOGIN authentication failed: authentication failure
Oct 12 20:24:10 heicom postfix/smtpd\[30668\]: warning: unknown\[92.118.38.53\]: SASL LOGIN authentication failed: authentication failure
Oct 12 20:27:15 heicom postfix/smtpd\[30668\]: warning: unknown\[92.118.38.53\]: SASL LOGIN authentication failed: authentication failure
Oct 12 20:30:23 heicom postfix/smtpd\[30816\]: warning: unknown\[92.118.38.53\]: SASL LOGIN authentication failed: authentication failure
Oct 12 20:33:26 heicom postfix/smtpd\[30972\]: warning: unknown\[92.118.38.53\]: SASL LOGIN authentication failed: authentication failure
...

\[2019-10-12 15:56:10\] SECURITY\[1898\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-10-12T15:56:10.222-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="3075101148413828012",SessionID="0x7fc3ad578188",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/77.247.110.232/19251",ACLName="no_extension_match"
\[2019-10-12 15:56:39\] SECURITY\[1898\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-10-12T15:56:39.913-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="2656701148632170013",SessionID="0x7fc3ac2ed548",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/77.247.110.232/57048",ACLName="no_extension_match"
\[2019-10-12 15:56:42\] SECURITY\[1898\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-10-12T15:56:42.684-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="3492601148323235001",SessionID="0x7fc3ad578188",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/77.247.110.232/4915",A

SSH invalid-user multiple login attempts

xmlrpc attack