Mar 23 23:22:22 vps691689 sshd[11031]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.86.62
Mar 23 23:22:24 vps691689 sshd[11031]: Failed password for invalid user vic from 91.121.86.62 port 33762 ssh2
Mar 23 23:25:39 vps691689 sshd[11067]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.86.62
...

SSH Brute Force

SSH bruteforce

Feb 25 00:25:29 ns41 sshd[17059]: Failed password for root from 91.121.86.62 port 39776 ssh2
Feb 25 00:25:29 ns41 sshd[17059]: Failed password for root from 91.121.86.62 port 39776 ssh2

5x Failed Password

Invalid user admin from 91.121.86.62 port 41386

Dec 19 13:18:23 web9 sshd\[22580\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.86.62  user=root
Dec 19 13:18:25 web9 sshd\[22580\]: Failed password for root from 91.121.86.62 port 59618 ssh2
Dec 19 13:23:15 web9 sshd\[23313\]: Invalid user server from 91.121.86.62
Dec 19 13:23:15 web9 sshd\[23313\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.86.62
Dec 19 13:23:18 web9 sshd\[23313\]: Failed password for invalid user server from 91.121.86.62 port 38948 ssh2

Dec 15 22:22:41 pi sshd\[15997\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.86.62
Dec 15 22:22:43 pi sshd\[15997\]: Failed password for invalid user tech1 from 91.121.86.62 port 48850 ssh2
Dec 15 22:27:42 pi sshd\[16274\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.86.62  user=root
Dec 15 22:27:45 pi sshd\[16274\]: Failed password for root from 91.121.86.62 port 56958 ssh2
Dec 15 22:32:41 pi sshd\[16506\]: Invalid user server from 91.121.86.62 port 36714
...

Dec 14 18:18:44 herz-der-gamer sshd[19381]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.86.62  user=mysql
Dec 14 18:18:46 herz-der-gamer sshd[19381]: Failed password for mysql from 91.121.86.62 port 42242 ssh2
Dec 14 18:27:41 herz-der-gamer sshd[19489]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.86.62  user=root
Dec 14 18:27:44 herz-der-gamer sshd[19489]: Failed password for root from 91.121.86.62 port 40872 ssh2
...

Dec 12 14:43:09 web9 sshd\[29051\]: Invalid user globalflash from 91.121.86.62
Dec 12 14:43:09 web9 sshd\[29051\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.86.62
Dec 12 14:43:11 web9 sshd\[29051\]: Failed password for invalid user globalflash from 91.121.86.62 port 55996 ssh2
Dec 12 14:48:19 web9 sshd\[29941\]: Invalid user delp from 91.121.86.62
Dec 12 14:48:19 web9 sshd\[29941\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.86.62

Dec  2 06:05:37 DAAP sshd[29714]: Invalid user 123456 from 91.121.86.62 port 55620
Dec  2 06:05:37 DAAP sshd[29714]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.86.62
Dec  2 06:05:37 DAAP sshd[29714]: Invalid user 123456 from 91.121.86.62 port 55620
Dec  2 06:05:39 DAAP sshd[29714]: Failed password for invalid user 123456 from 91.121.86.62 port 55620 ssh2
...

2019-12-01T17:17:31.289658abusebot-6.cloudsearch.cf sshd\[24956\]: Invalid user shuwan from 91.121.86.62 port 38556

Nov 27 17:57:48 meumeu sshd[19774]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.86.62 
Nov 27 17:57:50 meumeu sshd[19774]: Failed password for invalid user alex from 91.121.86.62 port 51934 ssh2
Nov 27 18:03:51 meumeu sshd[20946]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.86.62 
...

Nov 27 10:35:45 vps666546 sshd\[29245\]: Invalid user admin from 91.121.86.62 port 52670
Nov 27 10:35:45 vps666546 sshd\[29245\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.86.62
Nov 27 10:35:47 vps666546 sshd\[29245\]: Failed password for invalid user admin from 91.121.86.62 port 52670 ssh2
Nov 27 10:41:58 vps666546 sshd\[29502\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.86.62  user=root
Nov 27 10:42:00 vps666546 sshd\[29502\]: Failed password for root from 91.121.86.62 port 60918 ssh2
...

Lines containing failures of 91.121.86.62
Nov 26 13:04:29 jarvis sshd[25482]: Invalid user konton from 91.121.86.62 port 53922
Nov 26 13:04:29 jarvis sshd[25482]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.86.62 
Nov 26 13:04:31 jarvis sshd[25482]: Failed password for invalid user konton from 91.121.86.62 port 53922 ssh2
Nov 26 13:04:32 jarvis sshd[25482]: Received disconnect from 91.121.86.62 port 53922:11: Bye Bye [preauth]
Nov 26 13:04:32 jarvis sshd[25482]: Disconnected from invalid user konton 91.121.86.62 port 53922 [preauth]
Nov 26 13:26:03 jarvis sshd[29587]: Invalid user keslar from 91.121.86.62 port 43662
Nov 26 13:26:03 jarvis sshd[29587]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.86.62 
Nov 26 13:26:04 jarvis sshd[29587]: Failed password for invalid user keslar from 91.121.86.62 port 43662 ssh2
Nov 26 13:26:06 jarvis sshd[29587]: Received disconnect from 9........
------------------------------

Nov 25 00:44:51 SilenceServices sshd[29271]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.86.62
Nov 25 00:44:53 SilenceServices sshd[29271]: Failed password for invalid user test1 from 91.121.86.62 port 50378 ssh2
Nov 25 00:50:39 SilenceServices sshd[30873]: Failed password for root from 91.121.86.62 port 57784 ssh2

Invalid user low from 91.121.86.22 port 46692

Sep 12 03:23:25 marvibiene sshd[20273]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.86.22 
Sep 12 03:23:27 marvibiene sshd[20273]: Failed password for invalid user arma from 91.121.86.22 port 45908 ssh2

2020-08-28T17:00:10.752190paragon sshd[602627]: Failed password for invalid user rajeev from 91.121.86.22 port 40910 ssh2
2020-08-28T17:04:05.320422paragon sshd[602996]: Invalid user hz from 91.121.86.22 port 49584
2020-08-28T17:04:05.322992paragon sshd[602996]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.86.22
2020-08-28T17:04:05.320422paragon sshd[602996]: Invalid user hz from 91.121.86.22 port 49584
2020-08-28T17:04:07.409374paragon sshd[602996]: Failed password for invalid user hz from 91.121.86.22 port 49584 ssh2
...

Aug 21 04:11:17 firewall sshd[21388]: Invalid user omt from 91.121.86.22
Aug 21 04:11:19 firewall sshd[21388]: Failed password for invalid user omt from 91.121.86.22 port 44082 ssh2
Aug 21 04:18:18 firewall sshd[21649]: Invalid user xh from 91.121.86.22
...

Invalid user course from 91.121.86.22 port 46384

Aug 17 16:52:53 prox sshd[23704]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.86.22 
Aug 17 16:52:55 prox sshd[23704]: Failed password for invalid user 14 from 91.121.86.22 port 36486 ssh2

2020-08-16T07:22:00.876616server.mjenks.net sshd[2979490]: Failed password for invalid user vpnuser1 from 91.121.86.22 port 48180 ssh2
2020-08-16T07:25:29.282828server.mjenks.net sshd[2979846]: Invalid user toor from 91.121.86.22 port 59026
2020-08-16T07:25:29.288473server.mjenks.net sshd[2979846]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.86.22
2020-08-16T07:25:29.282828server.mjenks.net sshd[2979846]: Invalid user toor from 91.121.86.22 port 59026
2020-08-16T07:25:31.174621server.mjenks.net sshd[2979846]: Failed password for invalid user toor from 91.121.86.22 port 59026 ssh2
...

Aug 14 14:21:38 *hidden* sshd[35843]: Failed password for *hidden* from 91.121.86.22 port 40924 ssh2 Aug 14 14:25:37 *hidden* sshd[36461]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.86.22 user=root Aug 14 14:25:38 *hidden* sshd[36461]: Failed password for *hidden* from 91.121.86.22 port 52716 ssh2

Aug  9 22:43:22 ns382633 sshd\[9041\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.86.22  user=root
Aug  9 22:43:25 ns382633 sshd\[9041\]: Failed password for root from 91.121.86.22 port 53244 ssh2
Aug  9 22:49:11 ns382633 sshd\[10015\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.86.22  user=root
Aug  9 22:49:12 ns382633 sshd\[10015\]: Failed password for root from 91.121.86.22 port 53396 ssh2
Aug  9 22:52:31 ns382633 sshd\[10709\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.86.22  user=root

Aug  9 11:30:25 ws24vmsma01 sshd[97102]: Failed password for root from 91.121.86.22 port 39568 ssh2
...

Aug  9 07:42:25 xeon sshd[35212]: Failed password for root from 91.121.86.22 port 51452 ssh2

*Port Scan* detected from 91.121.86.22 (FR/France/Hauts-de-France/Roubaix/ns319899.ip-91-121-86.eu). 4 hits in the last 221 seconds

SSH brutforce

Jul 15 17:41:46 pornomens sshd\[13632\]: Invalid user cpf from 91.121.86.22 port 59646
Jul 15 17:41:46 pornomens sshd\[13632\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.86.22
Jul 15 17:41:48 pornomens sshd\[13632\]: Failed password for invalid user cpf from 91.121.86.22 port 59646 ssh2
...

Invalid user linux from 91.121.86.22 port 58198

Jul  6 08:35:06 our-server-hostname sshd[22796]: Invalid user update from 218.94.103.226
Jul  6 08:35:06 our-server-hostname sshd[22796]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.94.103.226 
Jul  6 08:35:08 our-server-hostname sshd[22796]: Failed password for invalid user update from 218.94.103.226 port 35354 ssh2
Jul  6 08:37:15 our-server-hostname sshd[23207]: Invalid user compta from 218.94.103.226
Jul  6 08:37:15 our-server-hostname sshd[23207]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.94.103.226 


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=218.94.103.226

$f2bV_matches

 TCP (SYN) 80.82.77.33:20012 -> port 311, len 44

$f2bV_matches

Jul  6 08:52:53 * sshd[20081]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=198.245.53.163
Jul  6 08:52:55 * sshd[20081]: Failed password for invalid user hadoop from 198.245.53.163 port 32862 ssh2

1594007566 - 07/06/2020 05:52:46 Host: 200.109.0.76/200.109.0.76 Port: 445 TCP Blocked

Jul  6 03:08:54 firewall sshd[6121]: Failed password for root from 49.88.112.118 port 17555 ssh2
Jul  6 03:08:56 firewall sshd[6121]: Failed password for root from 49.88.112.118 port 17555 ssh2
Jul  6 03:08:58 firewall sshd[6121]: Failed password for root from 49.88.112.118 port 17555 ssh2
...

$f2bV_matches

Unauthorized connection attempt from IP address 221.189.229.31 on Port 445(SMB)

Jul  6 08:09:57 dev0-dcde-rnet sshd[14404]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=124.192.225.221
Jul  6 08:09:59 dev0-dcde-rnet sshd[14404]: Failed password for invalid user cosmos from 124.192.225.221 port 14204 ssh2
Jul  6 08:12:39 dev0-dcde-rnet sshd[14421]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=124.192.225.221

Jul  6 02:39:31 NPSTNNYC01T sshd[7349]: Failed password for root from 218.92.0.215 port 63342 ssh2
Jul  6 02:39:51 NPSTNNYC01T sshd[7360]: Failed password for root from 218.92.0.215 port 61655 ssh2
...

$f2bV_matches

2020-07-06T07:58:18.811619vps751288.ovh.net sshd\[7755\]: Invalid user kafka from 51.77.147.5 port 48152
2020-07-06T07:58:18.820989vps751288.ovh.net sshd\[7755\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.ip-51-77-147.eu
2020-07-06T07:58:20.676616vps751288.ovh.net sshd\[7755\]: Failed password for invalid user kafka from 51.77.147.5 port 48152 ssh2
2020-07-06T08:01:40.198940vps751288.ovh.net sshd\[7839\]: Invalid user nvm from 51.77.147.5 port 46616
2020-07-06T08:01:40.206835vps751288.ovh.net sshd\[7839\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.ip-51-77-147.eu

Jul  6 01:05:04 vmd46520 sshd[28885]: Invalid user web from 106.12.102.210 port 52504
Jul  6 01:05:05 vmd46520 sshd[28885]: Failed password for invalid user web from 106.12.102.210 port 52504 ssh2
Jul  6 01:10:56 vmd46520 sshd[29399]: Invalid user ubuntu from 106.12.102.210 port 57842


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=106.12.102.210

 TCP (SYN) 101.51.208.55:26959 -> port 23, len 44