Jun 14 20:17:01 onepixel sshd[1027891]: Invalid user oracle from 91.121.211.59 port 51524
Jun 14 20:17:02 onepixel sshd[1027891]: Failed password for invalid user oracle from 91.121.211.59 port 51524 ssh2
Jun 14 20:19:56 onepixel sshd[1028276]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.211.59  user=root
Jun 14 20:19:58 onepixel sshd[1028276]: Failed password for root from 91.121.211.59 port 52648 ssh2
Jun 14 20:23:02 onepixel sshd[1028723]: Invalid user manoj from 91.121.211.59 port 53812

Jun 12 13:47:56 ws22vmsma01 sshd[90862]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.211.59
Jun 12 13:47:58 ws22vmsma01 sshd[90862]: Failed password for invalid user tomcat from 91.121.211.59 port 53116 ssh2
...

Jun 10 13:01:48 rush sshd[8974]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.211.59
Jun 10 13:01:49 rush sshd[8974]: Failed password for invalid user eu from 91.121.211.59 port 39154 ssh2
Jun 10 13:05:07 rush sshd[9058]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.211.59
...

Failed password for invalid user kls from 91.121.211.59 port 37824 ssh2

Jun  8 13:57:41 cdc sshd[16757]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.211.59  user=root
Jun  8 13:57:43 cdc sshd[16757]: Failed password for invalid user root from 91.121.211.59 port 60580 ssh2

Jun  5 17:57:31 Tower sshd[43095]: Connection from 91.121.211.59 port 58498 on 192.168.10.220 port 22 rdomain ""
Jun  5 17:57:32 Tower sshd[43095]: Failed password for root from 91.121.211.59 port 58498 ssh2
Jun  5 17:57:32 Tower sshd[43095]: Received disconnect from 91.121.211.59 port 58498:11: Bye Bye [preauth]
Jun  5 17:57:32 Tower sshd[43095]: Disconnected from authenticating user root 91.121.211.59 port 58498 [preauth]

Jun  1 05:45:40 server sshd[5867]: Failed password for root from 91.121.211.59 port 44156 ssh2
Jun  1 05:49:08 server sshd[6010]: Failed password for root from 91.121.211.59 port 49534 ssh2
...

2020-05-30T07:23:28.347257lavrinenko.info sshd[7206]: Failed password for invalid user mario from 91.121.211.59 port 43142 ssh2
2020-05-30T07:25:19.646384lavrinenko.info sshd[7280]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.211.59  user=root
2020-05-30T07:25:21.303905lavrinenko.info sshd[7280]: Failed password for root from 91.121.211.59 port 47432 ssh2
2020-05-30T07:27:09.192264lavrinenko.info sshd[7321]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.211.59  user=root
2020-05-30T07:27:10.950147lavrinenko.info sshd[7321]: Failed password for root from 91.121.211.59 port 51720 ssh2
...

(sshd) Failed SSH login from 91.121.211.59 (FR/France/ns364518.ip-91-121-211.eu): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: May 26 13:04:25 elude sshd[6774]: Invalid user pgsql from 91.121.211.59 port 60258
May 26 13:04:27 elude sshd[6774]: Failed password for invalid user pgsql from 91.121.211.59 port 60258 ssh2
May 26 13:08:58 elude sshd[7493]: Invalid user ebd from 91.121.211.59 port 53502
May 26 13:09:00 elude sshd[7493]: Failed password for invalid user ebd from 91.121.211.59 port 53502 ssh2
May 26 13:12:07 elude sshd[8000]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.211.59  user=root

Invalid user classes from 91.121.211.59 port 57026

Apr 30 00:31:27 cloud sshd[26286]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.211.59 
Apr 30 00:31:29 cloud sshd[26286]: Failed password for invalid user zjy from 91.121.211.59 port 44926 ssh2

$f2bV_matches

Invalid user victoria from 91.121.211.59 port 45600

Invalid user victoria from 91.121.211.59 port 45600

2020-03-26T05:49:06.546134ionos.janbro.de sshd[121923]: Invalid user HTTP from 91.121.211.59 port 41488
2020-03-26T05:49:08.904248ionos.janbro.de sshd[121923]: Failed password for invalid user HTTP from 91.121.211.59 port 41488 ssh2
2020-03-26T05:52:24.611004ionos.janbro.de sshd[121930]: Invalid user lc from 91.121.211.59 port 55058
2020-03-26T05:52:24.839269ionos.janbro.de sshd[121930]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.211.59
2020-03-26T05:52:24.611004ionos.janbro.de sshd[121930]: Invalid user lc from 91.121.211.59 port 55058
2020-03-26T05:52:26.827131ionos.janbro.de sshd[121930]: Failed password for invalid user lc from 91.121.211.59 port 55058 ssh2
2020-03-26T05:55:54.786016ionos.janbro.de sshd[121954]: Invalid user nn from 91.121.211.59 port 40408
2020-03-26T05:55:56.342602ionos.janbro.de sshd[121954]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.211.59
2020-03-26T05:55:5
...

Feb 25 03:31:27 MK-Soft-VM8 sshd[30784]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.211.59 
Feb 25 03:31:28 MK-Soft-VM8 sshd[30784]: Failed password for invalid user atan from 91.121.211.59 port 53012 ssh2
...

Invalid user rr from 91.121.211.59 port 40230

Feb 18 14:38:30 sigma sshd\[31208\]: Invalid user cms from 91.121.211.59Feb 18 14:38:32 sigma sshd\[31208\]: Failed password for invalid user cms from 91.121.211.59 port 38512 ssh2
...

Feb 15 18:38:43 www1 sshd\[41216\]: Failed password for sys from 91.121.211.59 port 43384 ssh2Feb 15 18:40:54 www1 sshd\[41584\]: Invalid user tai from 91.121.211.59Feb 15 18:40:56 www1 sshd\[41584\]: Failed password for invalid user tai from 91.121.211.59 port 35388 ssh2Feb 15 18:43:04 www1 sshd\[41722\]: Invalid user ubuntu from 91.121.211.59Feb 15 18:43:06 www1 sshd\[41722\]: Failed password for invalid user ubuntu from 91.121.211.59 port 55588 ssh2Feb 15 18:45:17 www1 sshd\[42085\]: Invalid user paula from 91.121.211.59
...

Feb  9 06:58:02 MK-Soft-VM5 sshd[22968]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.211.59 
Feb  9 06:58:04 MK-Soft-VM5 sshd[22968]: Failed password for invalid user oux from 91.121.211.59 port 51304 ssh2
...

Unauthorized connection attempt detected from IP address 91.121.211.59 to port 2220 [J]

Unauthorized connection attempt detected from IP address 91.121.211.59 to port 2220 [J]

"SSH brute force auth login attempt."

$f2bV_matches

Unauthorized connection attempt detected from IP address 91.121.211.59 to port 2220 [J]

Dec 31 07:29:19 ns381471 sshd[31545]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.211.59
Dec 31 07:29:21 ns381471 sshd[31545]: Failed password for invalid user dovecot from 91.121.211.59 port 41718 ssh2

Dec 21 08:40:52 herz-der-gamer sshd[860]: Invalid user shoichi from 91.121.211.59 port 59354
Dec 21 08:40:52 herz-der-gamer sshd[860]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.211.59
Dec 21 08:40:52 herz-der-gamer sshd[860]: Invalid user shoichi from 91.121.211.59 port 59354
Dec 21 08:40:54 herz-der-gamer sshd[860]: Failed password for invalid user shoichi from 91.121.211.59 port 59354 ssh2
...

Dec 10 09:13:54 *** sshd[30116]: Failed password for invalid user mccomb from 91.121.211.59 port 33486 ssh2
Dec 10 09:19:25 *** sshd[30221]: Failed password for invalid user admin from 91.121.211.59 port 48644 ssh2
Dec 10 09:24:13 *** sshd[30385]: Failed password for invalid user haering from 91.121.211.59 port 56396 ssh2
Dec 10 09:29:05 *** sshd[30495]: Failed password for invalid user www from 91.121.211.59 port 35904 ssh2
Dec 10 09:38:55 *** sshd[30673]: Failed password for invalid user cundiff from 91.121.211.59 port 51426 ssh2
Dec 10 09:43:45 *** sshd[30885]: Failed password for invalid user centos from 91.121.211.59 port 59184 ssh2
Dec 10 09:48:35 *** sshd[30976]: Failed password for invalid user squid from 91.121.211.59 port 38718 ssh2
Dec 10 09:53:56 *** sshd[31086]: Failed password for invalid user guest from 91.121.211.59 port 46496 ssh2
Dec 10 10:14:27 *** sshd[31573]: Failed password for invalid user muhayat from 91.121.211.59 port 49416 ssh2
Dec 10 10:19:27 *** sshd[31654]: Failed password for in

Dec  8 06:53:15 web8 sshd\[28892\]: Invalid user oracle from 91.121.211.59
Dec  8 06:53:15 web8 sshd\[28892\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.211.59
Dec  8 06:53:17 web8 sshd\[28892\]: Failed password for invalid user oracle from 91.121.211.59 port 35952 ssh2
Dec  8 06:58:42 web8 sshd\[31486\]: Invalid user sallehar from 91.121.211.59
Dec  8 06:58:42 web8 sshd\[31486\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.211.59

2019-12-05 22:40:15 server sshd[380]: Failed password for invalid user root from 91.121.211.59 port 39350 ssh2

Failed password for invalid user dead from 91.121.211.34 port 35156 ssh2
pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=ns337826.ip-91-121-211.eu  user=root
Failed password for root from 91.121.211.34 port 47642 ssh2
pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=ns337826.ip-91-121-211.eu  user=root
Failed password for root from 91.121.211.34 port 60062 ssh2

Invalid user ajay from 91.121.211.34 port 33328

SSH Invalid Login

Aug 25 21:54:55 abendstille sshd\[9926\]: Invalid user erp from 91.121.211.34
Aug 25 21:54:55 abendstille sshd\[9926\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.211.34
Aug 25 21:54:58 abendstille sshd\[9926\]: Failed password for invalid user erp from 91.121.211.34 port 54250 ssh2
Aug 25 21:58:28 abendstille sshd\[13817\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.211.34  user=root
Aug 25 21:58:30 abendstille sshd\[13817\]: Failed password for root from 91.121.211.34 port 34546 ssh2
...

Aug 25 12:16:45 scw-6657dc sshd[22636]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.211.34
Aug 25 12:16:45 scw-6657dc sshd[22636]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.211.34
Aug 25 12:16:47 scw-6657dc sshd[22636]: Failed password for invalid user loic from 91.121.211.34 port 58906 ssh2
...

Aug 24 23:53:39 PorscheCustomer sshd[4349]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.211.34
Aug 24 23:53:41 PorscheCustomer sshd[4349]: Failed password for invalid user hyq from 91.121.211.34 port 53442 ssh2
Aug 24 23:56:15 PorscheCustomer sshd[4442]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.211.34
...

Cowrie Honeypot: 3 unauthorised SSH/Telnet login attempts between 2020-08-21T07:02:48Z and 2020-08-21T07:09:51Z

Aug 19 13:28:28 l02a sshd[10202]: Invalid user chris from 91.121.211.34
Aug 19 13:28:28 l02a sshd[10202]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=ns337826.ip-91-121-211.eu 
Aug 19 13:28:28 l02a sshd[10202]: Invalid user chris from 91.121.211.34
Aug 19 13:28:30 l02a sshd[10202]: Failed password for invalid user chris from 91.121.211.34 port 40370 ssh2

Aug 16 23:06:50 PorscheCustomer sshd[4740]: Failed password for root from 91.121.211.34 port 38120 ssh2
Aug 16 23:10:14 PorscheCustomer sshd[4903]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.211.34
Aug 16 23:10:16 PorscheCustomer sshd[4903]: Failed password for invalid user liyinghui from 91.121.211.34 port 45590 ssh2
...

$f2bV_matches

Banned for a week because repeated abuses, for example SSH, but not only

Jul 30 05:55:38 vps647732 sshd[21041]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.211.34
Jul 30 05:55:41 vps647732 sshd[21041]: Failed password for invalid user qdgw from 91.121.211.34 port 51700 ssh2
...

Jul 22 16:58:05 vps687878 sshd\[11045\]: Failed password for invalid user username from 91.121.211.34 port 32824 ssh2
Jul 22 17:02:07 vps687878 sshd\[11221\]: Invalid user villa from 91.121.211.34 port 44400
Jul 22 17:02:07 vps687878 sshd\[11221\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.211.34
Jul 22 17:02:09 vps687878 sshd\[11221\]: Failed password for invalid user villa from 91.121.211.34 port 44400 ssh2
Jul 22 17:06:10 vps687878 sshd\[11568\]: Invalid user aono from 91.121.211.34 port 55986
Jul 22 17:06:10 vps687878 sshd\[11568\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.211.34
...

Jul 21 00:40:22 ny01 sshd[13110]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.211.34
Jul 21 00:40:23 ny01 sshd[13110]: Failed password for invalid user bil from 91.121.211.34 port 50600 ssh2
Jul 21 00:44:20 ny01 sshd[13508]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.211.34

Jul 20 20:20:45 *hidden* sshd[3055]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.211.34 Jul 20 20:20:47 *hidden* sshd[3055]: Failed password for invalid user temp from 91.121.211.34 port 37640 ssh2 Jul 20 20:34:06 *hidden* sshd[13692]: Invalid user matlab from 91.121.211.34 port 59590

Telnet Server BruteForce Attack

[Sat Jan 11 11:54:07.162593 2020] [:error] [pid 8800:tid 140478062237440] [client 178.167.121.37:39267] [client 178.167.121.37] ModSecurity: Access denied with code 403 (phase 2). Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/modsecurity/owasp-modsecurity-crs-3.2.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "696"] [id "920350"] [msg "Host header is a numeric IP address"] [data "103.27.207.197:80"] [severity "WARNING"] [ver "OWASP_CRS/3.2.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/IP_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "103.27.207.197"] [uri "/"] [unique_id "XhlU70FSo6M0xj5ZHKj41wAAAAo"]
...

01/11/2020-05:54:48.528474 202.218.128.207 Protocol: 6 SURICATA TLS invalid record/traffic

20/1/10@23:55:09: FAIL: Alarm-Network address from=60.249.206.148
...

Jan 11 07:20:29 vtv3 sshd[30236]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.56.153.229 
Jan 11 07:20:31 vtv3 sshd[30236]: Failed password for invalid user cloud from 185.56.153.229 port 38832 ssh2
Jan 11 07:28:23 vtv3 sshd[1246]: Failed password for root from 185.56.153.229 port 52704 ssh2
Jan 11 07:40:01 vtv3 sshd[6388]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.56.153.229 
Jan 11 07:40:04 vtv3 sshd[6388]: Failed password for invalid user plex from 185.56.153.229 port 53922 ssh2
Jan 11 07:42:02 vtv3 sshd[7568]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.56.153.229 
Jan 11 07:52:09 vtv3 sshd[12140]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.56.153.229 
Jan 11 07:52:11 vtv3 sshd[12140]: Failed password for invalid user ns from 185.56.153.229 port 55156 ssh2
Jan 11 07:54:12 vtv3 sshd[12875]: pam_unix(sshd:auth): aut

Jan 11 07:53:06 v22018076622670303 sshd\[6778\]: Invalid user ftp_user from 181.30.101.162 port 41586
Jan 11 07:53:06 v22018076622670303 sshd\[6778\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.30.101.162
Jan 11 07:53:08 v22018076622670303 sshd\[6778\]: Failed password for invalid user ftp_user from 181.30.101.162 port 41586 ssh2
...

Jan 11 08:33:29 vmanager6029 postfix/smtpd\[31782\]: warning: unknown\[46.38.144.146\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jan 11 08:34:23 vmanager6029 postfix/smtpd\[31691\]: warning: unknown\[46.38.144.146\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6

01/11/2020-05:54:26.030192 138.118.56.22 Protocol: 6 ET SCAN Suspicious inbound to MSSQL port 1433

Unauthorized connection attempt detected from IP address 106.13.82.224 to port 22 [T]

35.200.161.138 - - \[11/Jan/2020:08:13:31 +0100\] "POST /wp-login.php HTTP/1.0" 200 7556 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"
35.200.161.138 - - \[11/Jan/2020:08:13:35 +0100\] "POST /wp-login.php HTTP/1.0" 200 7381 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"
35.200.161.138 - - \[11/Jan/2020:08:13:39 +0100\] "POST /wp-login.php HTTP/1.0" 200 7376 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"

Honeypot attack, port: 445, PTR: node-o2.ll-118-174.static.totisp.net.

" "

Jan 11 05:46:25 ovpn sshd\[18898\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.141.202  user=root
Jan 11 05:46:27 ovpn sshd\[18898\]: Failed password for root from 106.13.141.202 port 39022 ssh2
Jan 11 05:49:58 ovpn sshd\[19783\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.141.202  user=root
Jan 11 05:49:59 ovpn sshd\[19783\]: Failed password for root from 106.13.141.202 port 44024 ssh2
Jan 11 05:54:23 ovpn sshd\[20911\]: Invalid user open from 106.13.141.202
Jan 11 05:54:23 ovpn sshd\[20911\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.141.202

Jan 11 05:54:08 grey postfix/smtpd\[10796\]: NOQUEUE: reject: RCPT from unknown\[143.255.252.53\]: 554 5.7.1 Service unavailable\; Client host \[143.255.252.53\] blocked using truncate.gbudb.net\; http://www.gbudb.com/truncate/ \[143.255.252.53\]\; from=\ to=\ proto=ESMTP helo=\
...

Jan 11 05:55:02 hosting180 sshd[25888]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.253.133  user=root
Jan 11 05:55:04 hosting180 sshd[25888]: Failed password for root from 128.199.253.133 port 51834 ssh2
...