Fail2Ban Ban Triggered (2)

$f2bV_matches

Apr 21 16:33:16 xeon sshd[64600]: Failed password for root from 81.4.106.155 port 48282 ssh2

Invalid user test05 from 81.4.106.155 port 35340

2020-04-09T13:10:10.038434linuxbox-skyline sshd[49909]: Invalid user admin from 81.4.106.155 port 56190
...

DATE:2020-03-22 08:34:40, IP:81.4.106.78, PORT:ssh SSH brute force auth (docker-dc)

Invalid user cpanelrrdtool from 81.4.106.78 port 52018

Mar 18 13:55:46 *** sshd[859]: Invalid user Minecraft from 81.4.106.78

Mar 12 22:18:40 mail sshd[19111]: Invalid user dasusrl from 81.4.106.78
Mar 12 22:18:40 mail sshd[19111]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.4.106.78
Mar 12 22:18:40 mail sshd[19111]: Invalid user dasusrl from 81.4.106.78
Mar 12 22:18:43 mail sshd[19111]: Failed password for invalid user dasusrl from 81.4.106.78 port 45642 ssh2
Mar 12 22:28:36 mail sshd[20378]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.4.106.78  user=root
Mar 12 22:28:38 mail sshd[20378]: Failed password for root from 81.4.106.78 port 50418 ssh2
...

Feb 20 10:42:37 zulu1842 sshd[19300]: Invalid user vmail from 81.4.106.125
Feb 20 10:42:37 zulu1842 sshd[19300]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.4.106.125 
Feb 20 10:42:40 zulu1842 sshd[19300]: Failed password for invalid user vmail from 81.4.106.125 port 49664 ssh2
Feb 20 10:42:40 zulu1842 sshd[19300]: Received disconnect from 81.4.106.125: 11: Bye Bye [preauth]
Feb 20 11:02:52 zulu1842 sshd[20366]: Invalid user cpanelrrdtool from 81.4.106.125
Feb 20 11:02:52 zulu1842 sshd[20366]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.4.106.125 
Feb 20 11:02:54 zulu1842 sshd[20366]: Failed password for invalid user cpanelrrdtool from 81.4.106.125 port 60682 ssh2
Feb 20 11:02:54 zulu1842 sshd[20366]: Received disconnect from 81.4.106.125: 11: Bye Bye [preauth]
Feb 20 11:05:11 zulu1842 sshd[20468]: Invalid user wanghui from 81.4.106.125
Feb 20 11:05:11 zulu1842 sshd[20468]: pam........
-------------------------------

Invalid user admin from 81.4.106.78 port 47138

Dec 31 23:47:35 h2177944 sshd\[16124\]: Invalid user etemad from 81.4.106.78 port 59662
Dec 31 23:47:35 h2177944 sshd\[16124\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.4.106.78
Dec 31 23:47:37 h2177944 sshd\[16124\]: Failed password for invalid user etemad from 81.4.106.78 port 59662 ssh2
Dec 31 23:50:00 h2177944 sshd\[16209\]: Invalid user zaccone from 81.4.106.78 port 59440
...

Dec 31 11:49:10 server sshd\[10234\]: Invalid user franziska from 81.4.106.78
Dec 31 11:49:11 server sshd\[10234\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.4.106.78 
Dec 31 11:49:12 server sshd\[10234\]: Failed password for invalid user franziska from 81.4.106.78 port 44536 ssh2
Dec 31 20:21:15 server sshd\[23886\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.4.106.78  user=root
Dec 31 20:21:17 server sshd\[23886\]: Failed password for root from 81.4.106.78 port 36830 ssh2
...

SSH Login Bruteforce

Dec 20 09:35:03 mockhub sshd[23207]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.4.106.78
Dec 20 09:35:05 mockhub sshd[23207]: Failed password for invalid user dundee from 81.4.106.78 port 54796 ssh2
...

2019-12-18T16:55:43.612689abusebot-2.cloudsearch.cf sshd\[20295\]: Invalid user bernhardt from 81.4.106.78 port 55636
2019-12-18T16:55:43.621476abusebot-2.cloudsearch.cf sshd\[20295\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.4.106.78
2019-12-18T16:55:45.664898abusebot-2.cloudsearch.cf sshd\[20295\]: Failed password for invalid user bernhardt from 81.4.106.78 port 55636 ssh2
2019-12-18T17:02:18.165688abusebot-2.cloudsearch.cf sshd\[20344\]: Invalid user bari from 81.4.106.78 port 35970

Dec 16 08:37:59 h2177944 sshd\[31595\]: Failed password for invalid user margaud from 81.4.106.78 port 52750 ssh2
Dec 16 09:38:13 h2177944 sshd\[1984\]: Invalid user webmail from 81.4.106.78 port 51612
Dec 16 09:38:13 h2177944 sshd\[1984\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.4.106.78
Dec 16 09:38:15 h2177944 sshd\[1984\]: Failed password for invalid user webmail from 81.4.106.78 port 51612 ssh2
...

Dec 13 17:39:03 server sshd\[25561\]: Invalid user test from 81.4.106.78
Dec 13 17:39:03 server sshd\[25561\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.4.106.78 
Dec 13 17:39:05 server sshd\[25561\]: Failed password for invalid user test from 81.4.106.78 port 40942 ssh2
Dec 13 17:46:48 server sshd\[28121\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.4.106.78  user=root
Dec 13 17:46:51 server sshd\[28121\]: Failed password for root from 81.4.106.78 port 41376 ssh2
...

Dec  3 09:30:24 TORMINT sshd\[5205\]: Invalid user glum from 81.4.106.78
Dec  3 09:30:24 TORMINT sshd\[5205\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.4.106.78
Dec  3 09:30:26 TORMINT sshd\[5205\]: Failed password for invalid user glum from 81.4.106.78 port 40216 ssh2
...

Nov 24 01:27:41 vps647732 sshd[24878]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.4.106.78
Nov 24 01:27:43 vps647732 sshd[24878]: Failed password for invalid user 123 from 81.4.106.78 port 48094 ssh2
...

smtp auth brute force

"XSS Attack Detected via libinjection - Matched Data: XSS data found within ARGS_NAMES:

Jun  3 19:43:38 web9 sshd\[25197\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.178.51.152  user=root
Jun  3 19:43:40 web9 sshd\[25197\]: Failed password for root from 51.178.51.152 port 43514 ssh2
Jun  3 19:46:59 web9 sshd\[25668\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.178.51.152  user=root
Jun  3 19:47:01 web9 sshd\[25668\]: Failed password for root from 51.178.51.152 port 41938 ssh2
Jun  3 19:50:03 web9 sshd\[26161\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.178.51.152  user=root

2020-06-04T00:48:35.0044241495-001 sshd[38845]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=chbluxury.com.ng  user=root
2020-06-04T00:48:36.9537131495-001 sshd[38845]: Failed password for root from 68.183.12.80 port 53360 ssh2
2020-06-04T00:51:53.2507801495-001 sshd[38971]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=chbluxury.com.ng  user=root
2020-06-04T00:51:55.8137821495-001 sshd[38971]: Failed password for root from 68.183.12.80 port 57774 ssh2
2020-06-04T00:55:15.7589921495-001 sshd[39094]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=chbluxury.com.ng  user=root
2020-06-04T00:55:17.3840521495-001 sshd[39094]: Failed password for root from 68.183.12.80 port 33954 ssh2
...

2020-06-04T05:38:02.404140shield sshd\[15622\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.228.21  user=root
2020-06-04T05:38:03.767251shield sshd\[15622\]: Failed password for root from 106.13.228.21 port 59134 ssh2
2020-06-04T05:41:48.513266shield sshd\[16701\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.228.21  user=root
2020-06-04T05:41:50.568902shield sshd\[16701\]: Failed password for root from 106.13.228.21 port 51784 ssh2
2020-06-04T05:45:36.355086shield sshd\[17664\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.228.21  user=root

Unauthorised access (Jun  4) SRC=189.41.210.64 LEN=44 TTL=49 ID=45575 TCP DPT=23 WINDOW=957 SYN

Jun  4 06:27:26 ns381471 sshd[5105]: Failed password for root from 118.69.65.4 port 57547 ssh2

5x Failed Password

Jun  4 00:49:33 ws24vmsma01 sshd[28876]: Failed password for root from 132.232.135.203 port 45218 ssh2
Jun  4 00:56:20 ws24vmsma01 sshd[204486]: Failed password for root from 132.232.135.203 port 45064 ssh2
...

2020-06-04T05:47:52.591154vps773228.ovh.net sshd[16409]: Failed password for root from 110.43.49.47 port 55538 ssh2
2020-06-04T05:52:10.425092vps773228.ovh.net sshd[16464]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=110.43.49.47  user=root
2020-06-04T05:52:12.772463vps773228.ovh.net sshd[16464]: Failed password for root from 110.43.49.47 port 43324 ssh2
2020-06-04T05:56:25.885907vps773228.ovh.net sshd[16531]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=110.43.49.47  user=root
2020-06-04T05:56:27.571117vps773228.ovh.net sshd[16531]: Failed password for root from 110.43.49.47 port 31110 ssh2
...

Jun  4 02:07:19 mail sshd\[26763\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.54.160.180  user=root
...

Jun  4 06:42:49 h2646465 sshd[24128]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.131.179.87  user=root
Jun  4 06:42:50 h2646465 sshd[24128]: Failed password for root from 188.131.179.87 port 47194 ssh2
Jun  4 06:53:20 h2646465 sshd[24723]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.131.179.87  user=root
Jun  4 06:53:22 h2646465 sshd[24723]: Failed password for root from 188.131.179.87 port 33048 ssh2
Jun  4 06:56:18 h2646465 sshd[24933]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.131.179.87  user=root
Jun  4 06:56:20 h2646465 sshd[24933]: Failed password for root from 188.131.179.87 port 18323 ssh2
Jun  4 06:59:27 h2646465 sshd[25034]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.131.179.87  user=root
Jun  4 06:59:29 h2646465 sshd[25034]: Failed password for root from 188.131.179.87 port 60109 ssh2
Jun  4 07:02:23 h264

2020-06-04T00:22:29.993048homeassistant sshd[9880]: Failed password for root from 222.186.30.112 port 55268 ssh2
2020-06-04T06:00:39.409838homeassistant sshd[15607]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.30.112  user=root
...

Jun  4 07:19:56 eventyay sshd[13795]: Failed password for root from 122.225.230.10 port 48728 ssh2
Jun  4 07:24:02 eventyay sshd[13925]: Failed password for root from 122.225.230.10 port 56636 ssh2
...

Jun  4 08:13:22 vps sshd[696984]: Failed password for root from 222.186.175.23 port 59504 ssh2
Jun  4 08:13:24 vps sshd[696984]: Failed password for root from 222.186.175.23 port 59504 ssh2
Jun  4 08:13:27 vps sshd[697556]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.175.23  user=root
Jun  4 08:13:29 vps sshd[697556]: Failed password for root from 222.186.175.23 port 48312 ssh2
Jun  4 08:13:31 vps sshd[697556]: Failed password for root from 222.186.175.23 port 48312 ssh2
...