2019-11-23T10:31:20.217574suse-nuc sshd[15508]: Invalid user administrator from 78.100.18.81 port 53671
...

Jan 13 02:51:14 ws12vmsma01 sshd[63583]: Invalid user git from 78.100.18.81
Jan 13 02:51:15 ws12vmsma01 sshd[63583]: Failed password for invalid user git from 78.100.18.81 port 45451 ssh2
Jan 13 02:56:02 ws12vmsma01 sshd[64291]: Invalid user gadmin from 78.100.18.81
...

SSH Brute Force

01/07/2020-08:40:37.306056 78.100.18.81 Protocol: 6 ET SCAN Potential SSH Scan

Dec 30 10:29:35 vpn sshd[3572]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=78.100.18.81
Dec 30 10:29:37 vpn sshd[3572]: Failed password for invalid user git from 78.100.18.81 port 33934 ssh2
Dec 30 10:33:29 vpn sshd[3575]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=78.100.18.81

Dec 24 18:25:21 ldap01vmsma01 sshd[56553]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=78.100.18.81
Dec 24 18:25:23 ldap01vmsma01 sshd[56553]: Failed password for invalid user ident from 78.100.18.81 port 34624 ssh2
...

Dec 20 13:29:03 lnxmysql61 sshd[20765]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=78.100.18.81

Dec 19 07:10:43 OPSO sshd\[8183\]: Invalid user anita from 78.100.18.81 port 58374
Dec 19 07:10:43 OPSO sshd\[8183\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=78.100.18.81
Dec 19 07:10:46 OPSO sshd\[8183\]: Failed password for invalid user anita from 78.100.18.81 port 58374 ssh2
Dec 19 07:15:58 OPSO sshd\[9199\]: Invalid user dimension from 78.100.18.81 port 57819
Dec 19 07:15:58 OPSO sshd\[9199\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=78.100.18.81

Dec 15 18:53:35 srv01 sshd[32335]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=78.100.18.81  user=root
Dec 15 18:53:37 srv01 sshd[32335]: Failed password for root from 78.100.18.81 port 41928 ssh2
Dec 15 18:59:47 srv01 sshd[32746]: Invalid user horta from 78.100.18.81 port 44894
Dec 15 18:59:47 srv01 sshd[32746]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=78.100.18.81
Dec 15 18:59:47 srv01 sshd[32746]: Invalid user horta from 78.100.18.81 port 44894
Dec 15 18:59:50 srv01 sshd[32746]: Failed password for invalid user horta from 78.100.18.81 port 44894 ssh2
...

2019-12-14T18:11:27.566644vps751288.ovh.net sshd\[1722\]: Invalid user petel from 78.100.18.81 port 55087
2019-12-14T18:11:27.575601vps751288.ovh.net sshd\[1722\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=78.100.18.81
2019-12-14T18:11:29.350785vps751288.ovh.net sshd\[1722\]: Failed password for invalid user petel from 78.100.18.81 port 55087 ssh2
2019-12-14T18:18:01.798588vps751288.ovh.net sshd\[1776\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=78.100.18.81  user=root
2019-12-14T18:18:03.999654vps751288.ovh.net sshd\[1776\]: Failed password for root from 78.100.18.81 port 57584 ssh2

Dec 12 12:56:10 linuxvps sshd\[11284\]: Invalid user sqlexec from 78.100.18.81
Dec 12 12:56:10 linuxvps sshd\[11284\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=78.100.18.81
Dec 12 12:56:12 linuxvps sshd\[11284\]: Failed password for invalid user sqlexec from 78.100.18.81 port 43092 ssh2
Dec 12 13:03:07 linuxvps sshd\[15356\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=78.100.18.81  user=sync
Dec 12 13:03:09 linuxvps sshd\[15356\]: Failed password for sync from 78.100.18.81 port 46250 ssh2

Dec  8 17:08:04 vps647732 sshd[2469]: Failed password for root from 78.100.18.81 port 60392 ssh2
...

Nov 23 21:27:18 tux-35-217 sshd\[19561\]: Invalid user edu328 from 78.100.18.81 port 53738
Nov 23 21:27:18 tux-35-217 sshd\[19561\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=78.100.18.81
Nov 23 21:27:20 tux-35-217 sshd\[19561\]: Failed password for invalid user edu328 from 78.100.18.81 port 53738 ssh2
Nov 23 21:34:00 tux-35-217 sshd\[19615\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=78.100.18.81  user=root
...

5x Failed Password

2019-11-10T04:31:02.426392WS-Zach sshd[2305621]: User root from 78.100.18.81 not allowed because none of user's groups are listed in AllowGroups
2019-11-10T04:31:02.437149WS-Zach sshd[2305621]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=78.100.18.81  user=root
2019-11-10T04:31:02.426392WS-Zach sshd[2305621]: User root from 78.100.18.81 not allowed because none of user's groups are listed in AllowGroups
2019-11-10T04:31:05.130376WS-Zach sshd[2305621]: Failed password for invalid user root from 78.100.18.81 port 56885 ssh2
2019-11-10T04:50:34.178676WS-Zach sshd[2307866]: User root from 78.100.18.81 not allowed because none of user's groups are listed in AllowGroups
...

Nov  9 01:23:11 woltan sshd[6758]: Failed password for root from 78.100.18.81 port 34977 ssh2

Nov  2 03:06:11 hanapaa sshd\[10505\]: Invalid user woland from 78.100.18.81
Nov  2 03:06:11 hanapaa sshd\[10505\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=78.100.18.81
Nov  2 03:06:13 hanapaa sshd\[10505\]: Failed password for invalid user woland from 78.100.18.81 port 53010 ssh2
Nov  2 03:11:01 hanapaa sshd\[11001\]: Invalid user washington from 78.100.18.81
Nov  2 03:11:01 hanapaa sshd\[11001\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=78.100.18.81

Oct 14 17:01:41 debian sshd\[11113\]: Invalid user watanabe from 78.100.18.81 port 35431
Oct 14 17:01:41 debian sshd\[11113\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=78.100.18.81
Oct 14 17:01:43 debian sshd\[11113\]: Failed password for invalid user watanabe from 78.100.18.81 port 35431 ssh2
...

Oct 10 05:54:37 ArkNodeAT sshd\[31347\]: Invalid user Kent123 from 78.100.18.81
Oct 10 05:54:37 ArkNodeAT sshd\[31347\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=78.100.18.81
Oct 10 05:54:38 ArkNodeAT sshd\[31347\]: Failed password for invalid user Kent123 from 78.100.18.81 port 59354 ssh2

Oct  7 10:09:29 MK-Soft-VM3 sshd[21354]: Failed password for root from 78.100.18.81 port 55622 ssh2
...

$f2bV_matches

Oct  2 01:36:32 TORMINT sshd\[9813\]: Invalid user brands from 78.100.18.81
Oct  2 01:36:32 TORMINT sshd\[9813\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=78.100.18.81
Oct  2 01:36:34 TORMINT sshd\[9813\]: Failed password for invalid user brands from 78.100.18.81 port 44838 ssh2
...

SSH Brute-Force reported by Fail2Ban

Sep 27 08:39:27 vps691689 sshd[714]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=78.100.18.81
Sep 27 08:39:29 vps691689 sshd[714]: Failed password for invalid user wx from 78.100.18.81 port 43548 ssh2
Sep 27 08:44:16 vps691689 sshd[797]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=78.100.18.81
...

Sep 26 18:38:36 aat-srv002 sshd[25294]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=78.100.18.81
Sep 26 18:38:38 aat-srv002 sshd[25294]: Failed password for invalid user carrie from 78.100.18.81 port 48756 ssh2
Sep 26 18:43:18 aat-srv002 sshd[25440]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=78.100.18.81
Sep 26 18:43:20 aat-srv002 sshd[25440]: Failed password for invalid user ubuntu from 78.100.18.81 port 38501 ssh2
...

Sep 24 07:07:25 taivassalofi sshd[104117]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=78.100.18.81
Sep 24 07:07:27 taivassalofi sshd[104117]: Failed password for invalid user password321 from 78.100.18.81 port 46573 ssh2
...

Sep 12 21:26:31 web9 sshd\[21286\]: Invalid user user100 from 78.100.18.81
Sep 12 21:26:31 web9 sshd\[21286\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=78.100.18.81
Sep 12 21:26:32 web9 sshd\[21286\]: Failed password for invalid user user100 from 78.100.18.81 port 58750 ssh2
Sep 12 21:31:26 web9 sshd\[22266\]: Invalid user admin from 78.100.18.81
Sep 12 21:31:26 web9 sshd\[22266\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=78.100.18.81

Sep 11 16:36:48 ny01 sshd[14981]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=78.100.18.81
Sep 11 16:36:50 ny01 sshd[14981]: Failed password for invalid user proxyuser from 78.100.18.81 port 56938 ssh2
Sep 11 16:44:11 ny01 sshd[16564]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=78.100.18.81

Aug 31 18:50:27 lcprod sshd\[25025\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=78.100.18.81  user=root
Aug 31 18:50:28 lcprod sshd\[25025\]: Failed password for root from 78.100.18.81 port 48172 ssh2
Aug 31 18:55:06 lcprod sshd\[25461\]: Invalid user mschwartz from 78.100.18.81
Aug 31 18:55:06 lcprod sshd\[25461\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=78.100.18.81
Aug 31 18:55:09 lcprod sshd\[25461\]: Failed password for invalid user mschwartz from 78.100.18.81 port 40326 ssh2

Aug 31 07:16:48 dedicated sshd[6660]: Invalid user hanover from 78.100.18.81 port 54708

Lines containing failures of 78.100.181.174
Jul 20 22:25:29 nemesis sshd[14765]: Invalid user user from 78.100.181.174 port 39806
Jul 20 22:25:29 nemesis sshd[14765]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=78.100.181.174 
Jul 20 22:25:31 nemesis sshd[14765]: Failed password for invalid user user from 78.100.181.174 port 39806 ssh2


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=78.100.181.174

IP Ban Report : https://help-dysk.pl/wordpress-firewall-plugins/ip/78.100.187.145/ 
 QA - 1H : (4)  
 Protection Against DDoS WordPress plugin :  
 "odzyskiwanie danych help-dysk" 
 IP Address Ranges by Country : QA 
 NAME ASN : ASN42298 
 
 IP : 78.100.187.145 
 
 CIDR : 78.100.176.0/20 
 
 PREFIX COUNT : 115 
 
 UNIQUE IP COUNT : 344064 
 
 
 WYKRYTE ATAKI Z ASN42298 :  
  1H - 1 
  3H - 2 
  6H - 2 
 12H - 2 
 24H - 4 
 
 INFO : SERVER - ABB - Looking for resource vulnerabilities Detected and Blocked by ADMIN  - data recovery

Jul 30 22:59:24 MK-Soft-VM6 sshd\[25339\]: Invalid user pma from 78.100.189.88 port 58346
Jul 30 22:59:24 MK-Soft-VM6 sshd\[25339\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=78.100.189.88
Jul 30 22:59:26 MK-Soft-VM6 sshd\[25339\]: Failed password for invalid user pma from 78.100.189.88 port 58346 ssh2
...

Jul 30 15:14:10 debian sshd\[4028\]: Invalid user tester from 78.100.189.88 port 53418
Jul 30 15:14:10 debian sshd\[4028\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=78.100.189.88
...

SSH invalid-user multiple login try

Jul 25 05:32:07 * sshd[19704]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=78.100.189.88
Jul 25 05:32:10 * sshd[19704]: Failed password for invalid user office from 78.100.189.88 port 51156 ssh2

Invalid user su from 78.100.189.88 port 46594

Lines containing failures of 78.100.189.88
Jun 25 14:05:01 server-name sshd[6275]: Invalid user testuser from 78.100.189.88 port 39636
Jun 25 14:05:01 server-name sshd[6275]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=78.100.189.88 
Jun 25 14:05:04 server-name sshd[6275]: Failed password for invalid user testuser from 78.100.189.88 port 39636 ssh2
Jun 25 14:05:04 server-name sshd[6275]: Received disconnect from 78.100.189.88 port 39636:11: Bye Bye [preauth]
Jun 25 14:05:04 server-name sshd[6275]: Disconnected from invalid user testuser 78.100.189.88 port 39636 [preauth]


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=78.100.189.88

23/tcp
[2019-06-21]1pkt

Sep 10 05:02:43 legacy sshd[7456]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.169.238.109
Sep 10 05:02:45 legacy sshd[7456]: Failed password for invalid user ts from 81.169.238.109 port 38126 ssh2
Sep 10 05:07:58 legacy sshd[7602]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.169.238.109
...

Sep  9 22:13:00 lcdev sshd\[11969\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.98.40.146  user=root
Sep  9 22:13:02 lcdev sshd\[11969\]: Failed password for root from 218.98.40.146 port 57914 ssh2
Sep  9 22:13:10 lcdev sshd\[11983\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.98.40.146  user=root
Sep  9 22:13:11 lcdev sshd\[11983\]: Failed password for root from 218.98.40.146 port 23761 ssh2
Sep  9 22:13:13 lcdev sshd\[11983\]: Failed password for root from 218.98.40.146 port 23761 ssh2

Sep  9 21:53:06 friendsofhawaii sshd\[13077\]: Invalid user butter from 187.16.96.37
Sep  9 21:53:06 friendsofhawaii sshd\[13077\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=mvx-187-16-96-37.mundivox.com
Sep  9 21:53:08 friendsofhawaii sshd\[13077\]: Failed password for invalid user butter from 187.16.96.37 port 54372 ssh2
Sep  9 22:00:10 friendsofhawaii sshd\[13671\]: Invalid user demo from 187.16.96.37
Sep  9 22:00:10 friendsofhawaii sshd\[13671\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=mvx-187-16-96-37.mundivox.com

198.199.80.239 - - [09/Sep/2019:21:17:06 -0400] "GET /?page=products&action=view&manufacturerID=36&productID=9681C21&linkID=13048999999.1%20union%20select%20unhex(hex(version()))%20--%20and%201%3D1 HTTP/1.1" 200 57616 "-" "-"
198.199.80.239 - - [09/Sep/2019:21:17:06 -0400] "GET /?page=products&action=view&manufacturerID=36&productID=9681C21&linkID=1304899999%27%20union%20select%20unhex(hex(version()))%20--%20%27x%27=%27x HTTP/1.1" 200 57616 "-" "-"
198.199.80.239 - - [09/Sep/2019:21:17:06 -0400] "GET /?page=products&action=view&manufacturerID=36&productID=9681C21&linkID=1304899999%22%20union%20select%20unhex(hex(version()))%20--%20%22x%22=%22x HTTP/1.1" 200 57616 "-" "-"
...

MYH,DEF GET /blog/wp-admin/

Sep 10 03:16:26 smtp postfix/smtpd[11485]: NOQUEUE: reject: RCPT from unknown[190.64.68.106]: 554 5.7.1 Service unavailable; Client host [190.64.68.106] blocked using bl.spamcop.net; Blocked - see https://www.spamcop.net/bl.shtml?190.64.68.106; from= to= proto=ESMTP helo=
...

Sep 10 03:16:32 smtp postfix/smtpd[11485]: NOQUEUE: reject: RCPT from unknown[200.149.244.202]: 554 5.7.1 Service unavailable; Client host [200.149.244.202] blocked using bl.spamcop.net; Blocked - see https://www.spamcop.net/bl.shtml?200.149.244.202; from= to= proto=ESMTP helo=
...

Sep 10 14:49:27 webhost01 sshd[17361]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.230.123.136
Sep 10 14:49:29 webhost01 sshd[17361]: Failed password for invalid user oracle from 157.230.123.136 port 60150 ssh2
...

Sep 10 09:39:27 nextcloud sshd\[7185\]: Invalid user user from 134.209.70.255
Sep 10 09:39:27 nextcloud sshd\[7185\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.70.255
Sep 10 09:39:29 nextcloud sshd\[7185\]: Failed password for invalid user user from 134.209.70.255 port 46928 ssh2
...

Sep 10 09:37:26 bouncer sshd\[17154\]: Invalid user vnc from 154.68.39.6 port 35467
Sep 10 09:37:26 bouncer sshd\[17154\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=154.68.39.6 
Sep 10 09:37:28 bouncer sshd\[17154\]: Failed password for invalid user vnc from 154.68.39.6 port 35467 ssh2
...

Sep  9 22:10:15 home sshd[30756]: Invalid user minecraft from 129.21.226.211 port 59476
Sep  9 22:10:15 home sshd[30756]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.21.226.211
Sep  9 22:10:15 home sshd[30756]: Invalid user minecraft from 129.21.226.211 port 59476
Sep  9 22:10:16 home sshd[30756]: Failed password for invalid user minecraft from 129.21.226.211 port 59476 ssh2
Sep  9 22:17:56 home sshd[30809]: Invalid user rodomantsev from 129.21.226.211 port 56782
Sep  9 22:17:56 home sshd[30809]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.21.226.211
Sep  9 22:17:56 home sshd[30809]: Invalid user rodomantsev from 129.21.226.211 port 56782
Sep  9 22:17:58 home sshd[30809]: Failed password for invalid user rodomantsev from 129.21.226.211 port 56782 ssh2
Sep  9 22:22:55 home sshd[30841]: Invalid user teamspeak3 from 129.21.226.211 port 33014
Sep  9 22:22:55 home sshd[30841]: pam_unix(sshd:auth): authentication failure

Sep 10 03:59:41 game-panel sshd[30270]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.74.123
Sep 10 03:59:44 game-panel sshd[30270]: Failed password for invalid user 12345 from 106.12.74.123 port 37410 ssh2
Sep 10 04:06:46 game-panel sshd[30550]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.74.123

$f2bV_matches

Triggered by Fail2Ban at Ares web server

Sep 10 09:25:52 saschabauer sshd[13677]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.14.142.109
Sep 10 09:25:53 saschabauer sshd[13677]: Failed password for invalid user user01 from 31.14.142.109 port 46201 ssh2