Unauthorized connection attempt detected from IP address 80.211.86.245 to port 2220 [J]

Jan  4 08:59:48 mail sshd\[10162\]: Invalid user test4 from 80.211.86.245
Jan  4 08:59:48 mail sshd\[10162\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.86.245
Jan  4 08:59:50 mail sshd\[10162\]: Failed password for invalid user test4 from 80.211.86.245 port 55574 ssh2
...

2020-01-02T14:29:23.585723xentho-1 sshd[387530]: Invalid user ts from 80.211.86.245 port 43658
2020-01-02T14:29:23.594396xentho-1 sshd[387530]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.86.245
2020-01-02T14:29:23.585723xentho-1 sshd[387530]: Invalid user ts from 80.211.86.245 port 43658
2020-01-02T14:29:25.946682xentho-1 sshd[387530]: Failed password for invalid user ts from 80.211.86.245 port 43658 ssh2
2020-01-02T14:31:14.890051xentho-1 sshd[387547]: Invalid user oracle from 80.211.86.245 port 32838
2020-01-02T14:31:14.896538xentho-1 sshd[387547]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.86.245
2020-01-02T14:31:14.890051xentho-1 sshd[387547]: Invalid user oracle from 80.211.86.245 port 32838
2020-01-02T14:31:16.485671xentho-1 sshd[387547]: Failed password for invalid user oracle from 80.211.86.245 port 32838 ssh2
2020-01-02T14:33:11.274783xentho-1 sshd[387571]: Invalid user user
...

Invalid user server from 80.211.86.245 port 43338

Fail2Ban - SSH Bruteforce Attempt

Dec 14 19:06:32 hosting sshd[27143]: Invalid user minority from 80.211.86.245 port 33544
...

Dec 13 20:27:08 sso sshd[12175]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.86.245
Dec 13 20:27:10 sso sshd[12175]: Failed password for invalid user tarrant from 80.211.86.245 port 47184 ssh2
...

Dec  4 05:06:47 auw2 sshd\[18949\]: Invalid user ib@123 from 80.211.86.245
Dec  4 05:06:47 auw2 sshd\[18949\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.86.245
Dec  4 05:06:49 auw2 sshd\[18949\]: Failed password for invalid user ib@123 from 80.211.86.245 port 56726 ssh2
Dec  4 05:12:35 auw2 sshd\[19636\]: Invalid user 12345 from 80.211.86.245
Dec  4 05:12:35 auw2 sshd\[19636\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.86.245

F2B jail: sshd. Time: 2019-12-03 16:54:01, Reported by: VKReport

Nov 29 07:28:16 MK-Soft-VM3 sshd[19551]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.86.245 
Nov 29 07:28:18 MK-Soft-VM3 sshd[19551]: Failed password for invalid user stolp from 80.211.86.245 port 60066 ssh2
...

Nov 25 01:04:23 SilenceServices sshd[2552]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.86.245
Nov 25 01:04:24 SilenceServices sshd[2552]: Failed password for invalid user test from 80.211.86.245 port 53154 ssh2
Nov 25 01:10:30 SilenceServices sshd[4378]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.86.245

SSH brutforce

Nov 11 06:21:32 ws19vmsma01 sshd[57550]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.86.245
Nov 11 06:21:34 ws19vmsma01 sshd[57550]: Failed password for invalid user shiro from 80.211.86.245 port 36352 ssh2
...

Nov  7 10:59:21 vps01 sshd[21378]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.86.245
Nov  7 10:59:23 vps01 sshd[21378]: Failed password for invalid user jwanza123 from 80.211.86.245 port 40024 ssh2

Nov  3 18:16:00 penfold sshd[7404]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.86.245  user=r.r
Nov  3 18:16:02 penfold sshd[7404]: Failed password for r.r from 80.211.86.245 port 57194 ssh2
Nov  3 18:16:02 penfold sshd[7404]: Received disconnect from 80.211.86.245 port 57194:11: Bye Bye [preauth]
Nov  3 18:16:02 penfold sshd[7404]: Disconnected from 80.211.86.245 port 57194 [preauth]
Nov  3 18:26:19 penfold sshd[7778]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.86.245  user=r.r
Nov  3 18:26:21 penfold sshd[7778]: Failed password for r.r from 80.211.86.245 port 45404 ssh2
Nov  3 18:26:21 penfold sshd[7778]: Received disconnect from 80.211.86.245 port 45404:11: Bye Bye [preauth]
Nov  3 18:26:21 penfold sshd[7778]: Disconnected from 80.211.86.245 port 45404 [preauth]
Nov  3 18:29:40 penfold sshd[7891]: Invalid user rails from 80.211.86.245 port 54044
Nov  3 18:29:40 pen........
-------------------------------

MALWARE-CNC User-Agent known malicious user-agent string ZmEu - vulnerability scanner

Nov  9 18:58:09 server sshd\[16490\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.86.96  user=root
Nov  9 18:58:11 server sshd\[16490\]: Failed password for root from 80.211.86.96 port 39140 ssh2
Nov  9 19:18:56 server sshd\[21597\]: Invalid user openvpn_as from 80.211.86.96
Nov  9 19:18:56 server sshd\[21597\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.86.96 
Nov  9 19:18:59 server sshd\[21597\]: Failed password for invalid user openvpn_as from 80.211.86.96 port 50682 ssh2
...

(sshd) Failed SSH login from 80.211.86.96 (IT/Italy/Province of Arezzo/Arezzo/host96-86-211-80.serverdedicati.aruba.it/[AS31034 Aruba S.p.A.]): 1 in the last 3600 secs

Oct 30 19:26:21 web9 sshd\[25853\]: Invalid user aobcd8663 from 80.211.86.96
Oct 30 19:26:21 web9 sshd\[25853\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.86.96
Oct 30 19:26:24 web9 sshd\[25853\]: Failed password for invalid user aobcd8663 from 80.211.86.96 port 50484 ssh2
Oct 30 19:30:35 web9 sshd\[26545\]: Invalid user 01zzzzxx from 80.211.86.96
Oct 30 19:30:35 web9 sshd\[26545\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.86.96

Invalid user vnc from 80.211.86.96 port 52936

Invalid user downloader from 80.211.86.96 port 42072

WordPress login Brute force / Web App Attack on client site.

Invalid user downloader from 80.211.86.96 port 42072

Oct 22 22:05:20 MK-Soft-Root2 sshd[5783]: Failed password for root from 80.211.86.96 port 43460 ssh2
...

$f2bV_matches

Oct  9 16:37:48 localhost sshd\[11704\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.86.96  user=root
Oct  9 16:37:50 localhost sshd\[11704\]: Failed password for root from 80.211.86.96 port 41298 ssh2
Oct  9 16:53:14 localhost sshd\[11987\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.86.96  user=root
...

Oct  9 12:40:58 vps647732 sshd[2817]: Failed password for root from 80.211.86.96 port 56602 ssh2
...

Lines containing failures of 80.211.86.96
Oct  5 19:07:03 nextcloud sshd[25540]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.86.96  user=r.r
Oct  5 19:07:05 nextcloud sshd[25540]: Failed password for r.r from 80.211.86.96 port 51026 ssh2
Oct  5 19:07:05 nextcloud sshd[25540]: Received disconnect from 80.211.86.96 port 51026:11: Bye Bye [preauth]
Oct  5 19:07:05 nextcloud sshd[25540]: Disconnected from authenticating user r.r 80.211.86.96 port 51026 [preauth]
Oct  5 19:14:09 nextcloud sshd[27834]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.86.96  user=r.r
Oct  5 19:14:11 nextcloud sshd[27834]: Failed password for r.r from 80.211.86.96 port 36472 ssh2
Oct  5 19:14:11 nextcloud sshd[27834]: Received disconnect from 80.211.86.96 port 36472:11: Bye Bye [preauth]
Oct  5 19:14:11 nextcloud sshd[27834]: Disconnected from authenticating user r.r 80.211.86.96 port 36472 [preauth]........
------------------------------

Invalid user test from 45.227.255.173 port 24711

(From noreply@gplforest3431.tech) Hello There,

Are you using Wordpress/Woocommerce or maybe do you actually plan to work with it later on ? We currently offer more than 2500 premium plugins and also themes 100 % free to download : http://riply.xyz/Ne0XA

Cheers,

Mac

Oct 17 07:15:28 OPSO sshd\[5728\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.237.238  user=root
Oct 17 07:15:31 OPSO sshd\[5728\]: Failed password for root from 104.248.237.238 port 39650 ssh2
Oct 17 07:19:30 OPSO sshd\[6234\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.237.238  user=root
Oct 17 07:19:32 OPSO sshd\[6234\]: Failed password for root from 104.248.237.238 port 51074 ssh2
Oct 17 07:23:29 OPSO sshd\[7222\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.237.238  user=root

10/17/2019-09:54:40.001478 89.248.169.94 Protocol: 6 ET CINS Active Threat Intelligence Poor Reputation IP group 99

IP Ban Report : https://help-dysk.pl/wordpress-firewall-plugins/ip/80.43.241.201/ 
 GB - 1H : (85)  
 Protection Against DDoS WordPress plugin :  
 "odzyskiwanie danych help-dysk" 
 IP Address Ranges by Country : GB 
 NAME ASN : ASN9105 
 
 IP : 80.43.241.201 
 
 CIDR : 80.40.0.0/13 
 
 PREFIX COUNT : 42 
 
 UNIQUE IP COUNT : 3022848 
 
 
 WYKRYTE ATAKI Z ASN9105 :  
  1H - 1 
  3H - 1 
  6H - 1 
 12H - 2 
 24H - 7 
 
 DateTime : 2019-10-17 05:51:20 
 
 INFO : Port Scan TELNET Detected and Blocked by ADMIN  - data recovery

Oct 17 07:00:21 lvpxxxxxxx88-92-201-20 sshd[16913]: reveeclipse mapping checking getaddrinfo for 202.182.113.155.vultr.com [202.182.113.155] failed - POSSIBLE BREAK-IN ATTEMPT!
Oct 17 07:00:21 lvpxxxxxxx88-92-201-20 sshd[16913]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.182.113.155  user=r.r
Oct 17 07:00:24 lvpxxxxxxx88-92-201-20 sshd[16913]: Failed password for r.r from 202.182.113.155 port 52090 ssh2
Oct 17 07:00:24 lvpxxxxxxx88-92-201-20 sshd[16913]: Received disconnect from 202.182.113.155: 11: Bye Bye [preauth]
Oct 17 07:21:05 lvpxxxxxxx88-92-201-20 sshd[17229]: reveeclipse mapping checking getaddrinfo for 202.182.113.155.vultr.com [202.182.113.155] failed - POSSIBLE BREAK-IN ATTEMPT!
Oct 17 07:21:06 lvpxxxxxxx88-92-201-20 sshd[17229]: Failed password for invalid user pulse from 202.182.113.155 port 39772 ssh2
Oct 17 07:21:07 lvpxxxxxxx88-92-201-20 sshd[17229]: Received disconnect from 202.182.113.155: 11: Bye Bye [........
-------------------------------

Oct 16 23:10:28 home sshd[8541]: Invalid user db2fenc1 from 165.22.78.222 port 48632
Oct 16 23:10:28 home sshd[8541]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.78.222
Oct 16 23:10:28 home sshd[8541]: Invalid user db2fenc1 from 165.22.78.222 port 48632
Oct 16 23:10:30 home sshd[8541]: Failed password for invalid user db2fenc1 from 165.22.78.222 port 48632 ssh2
Oct 16 23:14:14 home sshd[8611]: Invalid user ubuntu from 165.22.78.222 port 60810
Oct 16 23:14:14 home sshd[8611]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.78.222
Oct 16 23:14:14 home sshd[8611]: Invalid user ubuntu from 165.22.78.222 port 60810
Oct 16 23:14:17 home sshd[8611]: Failed password for invalid user ubuntu from 165.22.78.222 port 60810 ssh2
Oct 16 23:17:46 home sshd[8678]: Invalid user bl from 165.22.78.222 port 42966
Oct 16 23:17:46 home sshd[8678]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=

Oct 17 08:06:44 Ubuntu-1404-trusty-64-minimal sshd\[28265\]: Invalid user qb from 182.61.15.70
Oct 17 08:06:44 Ubuntu-1404-trusty-64-minimal sshd\[28265\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.15.70
Oct 17 08:06:45 Ubuntu-1404-trusty-64-minimal sshd\[28265\]: Failed password for invalid user qb from 182.61.15.70 port 44098 ssh2
Oct 17 08:12:49 Ubuntu-1404-trusty-64-minimal sshd\[2635\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.15.70  user=root
Oct 17 08:12:51 Ubuntu-1404-trusty-64-minimal sshd\[2635\]: Failed password for root from 182.61.15.70 port 55878 ssh2

Oct 17 09:24:54 server sshd\[10885\]: Invalid user imapuser from 151.80.254.73
Oct 17 09:24:54 server sshd\[10885\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=151.80.254.73 
Oct 17 09:24:56 server sshd\[10885\]: Failed password for invalid user imapuser from 151.80.254.73 port 47540 ssh2
Oct 17 09:37:46 server sshd\[14796\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=151.80.254.73  user=root
Oct 17 09:37:48 server sshd\[14796\]: Failed password for root from 151.80.254.73 port 45162 ssh2
...

Oct 16 18:03:51 auw2 sshd\[23616\]: Invalid user changeme from 96.19.3.46
Oct 16 18:03:51 auw2 sshd\[23616\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=96-19-3-46.cpe.cableone.net
Oct 16 18:03:53 auw2 sshd\[23616\]: Failed password for invalid user changeme from 96.19.3.46 port 41448 ssh2
Oct 16 18:07:54 auw2 sshd\[23913\]: Invalid user bot2017 from 96.19.3.46
Oct 16 18:07:54 auw2 sshd\[23913\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=96-19-3-46.cpe.cableone.net

2019-10-17T03:51:49.675675abusebot.cloudsearch.cf sshd\[10602\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.195.237.117  user=root

2019-10-17T03:51:54.075392abusebot-6.cloudsearch.cf sshd\[31446\]: Invalid user gq from 129.154.67.65 port 13581

Oct 17 10:51:16 itv-usvr-01 sshd[31583]: Invalid user admin from 222.86.159.208
Oct 17 10:51:16 itv-usvr-01 sshd[31583]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.86.159.208
Oct 17 10:51:16 itv-usvr-01 sshd[31583]: Invalid user admin from 222.86.159.208
Oct 17 10:51:18 itv-usvr-01 sshd[31583]: Failed password for invalid user admin from 222.86.159.208 port 39732 ssh2

Oct 17 00:39:37 Tower sshd[42950]: Connection from 113.80.86.2 port 41552 on 192.168.10.220 port 22
Oct 17 00:39:38 Tower sshd[42950]: Failed password for root from 113.80.86.2 port 41552 ssh2
Oct 17 00:39:39 Tower sshd[42950]: Received disconnect from 113.80.86.2 port 41552:11: Bye Bye [preauth]
Oct 17 00:39:39 Tower sshd[42950]: Disconnected from authenticating user root 113.80.86.2 port 41552 [preauth]

Oct 16 22:21:38 mailman postfix/smtpd[9315]: NOQUEUE: reject: RCPT from unknown[42.119.5.229]: 554 5.7.1 Service unavailable; Client host [42.119.5.229] blocked using sbl-xbl.spamhaus.org; https://www.spamhaus.org/query/ip/42.119.5.229; from= to= proto=ESMTP helo=<[0.0.0.0]>
Oct 16 22:51:32 mailman postfix/smtpd[9522]: NOQUEUE: reject: RCPT from unknown[42.119.5.229]: 554 5.7.1 Service unavailable; Client host [42.119.5.229] blocked using sbl-xbl.spamhaus.org; https://www.spamhaus.org/query/ip/42.119.5.229; from= to= proto=ESMTP helo=<[0.0.0.0]>