Unauthorized connection attempt detected from IP address 80.211.86.245 to port 2220 [J]

Jan  4 08:59:48 mail sshd\[10162\]: Invalid user test4 from 80.211.86.245
Jan  4 08:59:48 mail sshd\[10162\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.86.245
Jan  4 08:59:50 mail sshd\[10162\]: Failed password for invalid user test4 from 80.211.86.245 port 55574 ssh2
...

2020-01-02T14:29:23.585723xentho-1 sshd[387530]: Invalid user ts from 80.211.86.245 port 43658
2020-01-02T14:29:23.594396xentho-1 sshd[387530]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.86.245
2020-01-02T14:29:23.585723xentho-1 sshd[387530]: Invalid user ts from 80.211.86.245 port 43658
2020-01-02T14:29:25.946682xentho-1 sshd[387530]: Failed password for invalid user ts from 80.211.86.245 port 43658 ssh2
2020-01-02T14:31:14.890051xentho-1 sshd[387547]: Invalid user oracle from 80.211.86.245 port 32838
2020-01-02T14:31:14.896538xentho-1 sshd[387547]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.86.245
2020-01-02T14:31:14.890051xentho-1 sshd[387547]: Invalid user oracle from 80.211.86.245 port 32838
2020-01-02T14:31:16.485671xentho-1 sshd[387547]: Failed password for invalid user oracle from 80.211.86.245 port 32838 ssh2
2020-01-02T14:33:11.274783xentho-1 sshd[387571]: Invalid user user
...

Invalid user server from 80.211.86.245 port 43338

Fail2Ban - SSH Bruteforce Attempt

Dec 14 19:06:32 hosting sshd[27143]: Invalid user minority from 80.211.86.245 port 33544
...

Dec 13 20:27:08 sso sshd[12175]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.86.245
Dec 13 20:27:10 sso sshd[12175]: Failed password for invalid user tarrant from 80.211.86.245 port 47184 ssh2
...

Dec  4 05:06:47 auw2 sshd\[18949\]: Invalid user ib@123 from 80.211.86.245
Dec  4 05:06:47 auw2 sshd\[18949\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.86.245
Dec  4 05:06:49 auw2 sshd\[18949\]: Failed password for invalid user ib@123 from 80.211.86.245 port 56726 ssh2
Dec  4 05:12:35 auw2 sshd\[19636\]: Invalid user 12345 from 80.211.86.245
Dec  4 05:12:35 auw2 sshd\[19636\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.86.245

F2B jail: sshd. Time: 2019-12-03 16:54:01, Reported by: VKReport

Nov 29 07:28:16 MK-Soft-VM3 sshd[19551]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.86.245 
Nov 29 07:28:18 MK-Soft-VM3 sshd[19551]: Failed password for invalid user stolp from 80.211.86.245 port 60066 ssh2
...

Nov 25 01:04:23 SilenceServices sshd[2552]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.86.245
Nov 25 01:04:24 SilenceServices sshd[2552]: Failed password for invalid user test from 80.211.86.245 port 53154 ssh2
Nov 25 01:10:30 SilenceServices sshd[4378]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.86.245

SSH brutforce

Nov 11 06:21:32 ws19vmsma01 sshd[57550]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.86.245
Nov 11 06:21:34 ws19vmsma01 sshd[57550]: Failed password for invalid user shiro from 80.211.86.245 port 36352 ssh2
...

Nov  7 10:59:21 vps01 sshd[21378]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.86.245
Nov  7 10:59:23 vps01 sshd[21378]: Failed password for invalid user jwanza123 from 80.211.86.245 port 40024 ssh2

Nov  3 18:16:00 penfold sshd[7404]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.86.245  user=r.r
Nov  3 18:16:02 penfold sshd[7404]: Failed password for r.r from 80.211.86.245 port 57194 ssh2
Nov  3 18:16:02 penfold sshd[7404]: Received disconnect from 80.211.86.245 port 57194:11: Bye Bye [preauth]
Nov  3 18:16:02 penfold sshd[7404]: Disconnected from 80.211.86.245 port 57194 [preauth]
Nov  3 18:26:19 penfold sshd[7778]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.86.245  user=r.r
Nov  3 18:26:21 penfold sshd[7778]: Failed password for r.r from 80.211.86.245 port 45404 ssh2
Nov  3 18:26:21 penfold sshd[7778]: Received disconnect from 80.211.86.245 port 45404:11: Bye Bye [preauth]
Nov  3 18:26:21 penfold sshd[7778]: Disconnected from 80.211.86.245 port 45404 [preauth]
Nov  3 18:29:40 penfold sshd[7891]: Invalid user rails from 80.211.86.245 port 54044
Nov  3 18:29:40 pen........
-------------------------------

MALWARE-CNC User-Agent known malicious user-agent string ZmEu - vulnerability scanner

Nov  9 18:58:09 server sshd\[16490\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.86.96  user=root
Nov  9 18:58:11 server sshd\[16490\]: Failed password for root from 80.211.86.96 port 39140 ssh2
Nov  9 19:18:56 server sshd\[21597\]: Invalid user openvpn_as from 80.211.86.96
Nov  9 19:18:56 server sshd\[21597\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.86.96 
Nov  9 19:18:59 server sshd\[21597\]: Failed password for invalid user openvpn_as from 80.211.86.96 port 50682 ssh2
...

(sshd) Failed SSH login from 80.211.86.96 (IT/Italy/Province of Arezzo/Arezzo/host96-86-211-80.serverdedicati.aruba.it/[AS31034 Aruba S.p.A.]): 1 in the last 3600 secs

Oct 30 19:26:21 web9 sshd\[25853\]: Invalid user aobcd8663 from 80.211.86.96
Oct 30 19:26:21 web9 sshd\[25853\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.86.96
Oct 30 19:26:24 web9 sshd\[25853\]: Failed password for invalid user aobcd8663 from 80.211.86.96 port 50484 ssh2
Oct 30 19:30:35 web9 sshd\[26545\]: Invalid user 01zzzzxx from 80.211.86.96
Oct 30 19:30:35 web9 sshd\[26545\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.86.96

Invalid user vnc from 80.211.86.96 port 52936

Invalid user downloader from 80.211.86.96 port 42072

WordPress login Brute force / Web App Attack on client site.

Invalid user downloader from 80.211.86.96 port 42072

Oct 22 22:05:20 MK-Soft-Root2 sshd[5783]: Failed password for root from 80.211.86.96 port 43460 ssh2
...

$f2bV_matches

Oct  9 16:37:48 localhost sshd\[11704\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.86.96  user=root
Oct  9 16:37:50 localhost sshd\[11704\]: Failed password for root from 80.211.86.96 port 41298 ssh2
Oct  9 16:53:14 localhost sshd\[11987\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.86.96  user=root
...

Oct  9 12:40:58 vps647732 sshd[2817]: Failed password for root from 80.211.86.96 port 56602 ssh2
...

Lines containing failures of 80.211.86.96
Oct  5 19:07:03 nextcloud sshd[25540]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.86.96  user=r.r
Oct  5 19:07:05 nextcloud sshd[25540]: Failed password for r.r from 80.211.86.96 port 51026 ssh2
Oct  5 19:07:05 nextcloud sshd[25540]: Received disconnect from 80.211.86.96 port 51026:11: Bye Bye [preauth]
Oct  5 19:07:05 nextcloud sshd[25540]: Disconnected from authenticating user r.r 80.211.86.96 port 51026 [preauth]
Oct  5 19:14:09 nextcloud sshd[27834]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.86.96  user=r.r
Oct  5 19:14:11 nextcloud sshd[27834]: Failed password for r.r from 80.211.86.96 port 36472 ssh2
Oct  5 19:14:11 nextcloud sshd[27834]: Received disconnect from 80.211.86.96 port 36472:11: Bye Bye [preauth]
Oct  5 19:14:11 nextcloud sshd[27834]: Disconnected from authenticating user r.r 80.211.86.96 port 36472 [preauth]........
------------------------------

Brute-Force,SSH

May  8 06:28:01 ns381471 sshd[20778]: Failed password for root from 186.101.32.102 port 33014 ssh2

May  8 09:42:48 web8 sshd\[16112\]: Invalid user samp from 190.102.140.7
May  8 09:42:48 web8 sshd\[16112\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.102.140.7
May  8 09:42:50 web8 sshd\[16112\]: Failed password for invalid user samp from 190.102.140.7 port 55042 ssh2
May  8 09:46:02 web8 sshd\[17756\]: Invalid user yong from 190.102.140.7
May  8 09:46:02 web8 sshd\[17756\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.102.140.7

(eximsyntax) Exim syntax errors from 162.243.135.200 (US/United States/zg-0428c-31.stretchoid.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 2020-05-08 02:42:43 SMTP call from [162.243.135.200]:40630 dropped: too many syntax or protocol errors (last command was "?\b?\006?\027?\030?\031?\v?\002\001??\r?&?$\006\001\006\003\006\002\005\001\005\003\005\002\004\001\004\003\004\002\003\001\003\003\003\002\002\001\002\003\002\002\001\001\001\003\001\002\377\001?\001??\017?\001\001?\022??\025\003\001?\002\002")

20/5/7@23:51:22: FAIL: Alarm-Network address from=14.241.39.26
...

WordPress login Brute force / Web App Attack on client site.

sshd

May  8 11:47:26 vmd48417 sshd[6035]: Failed password for root from 222.186.173.142 port 63168 ssh2

SSH bruteforce

(sshd) Failed SSH login from 200.141.166.170 (BR/Brazil/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: May  8 11:27:01 amsweb01 sshd[23033]: Invalid user cyu from 200.141.166.170 port 47084
May  8 11:27:03 amsweb01 sshd[23033]: Failed password for invalid user cyu from 200.141.166.170 port 47084 ssh2
May  8 11:37:33 amsweb01 sshd[24239]: Invalid user jenkin from 200.141.166.170 port 56490
May  8 11:37:35 amsweb01 sshd[24239]: Failed password for invalid user jenkin from 200.141.166.170 port 56490 ssh2
May  8 11:42:02 amsweb01 sshd[24771]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.141.166.170  user=root

(smtpauth) Failed SMTP AUTH login from 87.246.7.114 (BG/Bulgaria/114.0-255.7.246.87.in-addr.arpa): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 2020-05-08 13:38:40 login authenticator failed for (y3egW5f) [87.246.7.114]: 535 Incorrect authentication data (set_id=support@dirgodazesepahan.com)

May  8 02:34:01 ny01 sshd[23951]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.220.27.191
May  8 02:34:03 ny01 sshd[23951]: Failed password for invalid user gregoire from 211.220.27.191 port 54864 ssh2
May  8 02:38:26 ny01 sshd[24482]: Failed password for root from 211.220.27.191 port 38382 ssh2

(sshd) Failed SSH login from 83.118.194.4 (FR/France/4.194.118.83.in-addr.arpa.celeste.fr): 3 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: May  8 09:11:01 andromeda sshd[29012]: Invalid user sql from 83.118.194.4 port 48656
May  8 09:11:03 andromeda sshd[29012]: Failed password for invalid user sql from 83.118.194.4 port 48656 ssh2
May  8 09:14:39 andromeda sshd[29140]: Invalid user xu from 83.118.194.4 port 46210

Email rejected due to spam filtering

invalid user