Automatic report - SSH Brute-Force Attack

Jul  6 23:14:22 MK-Soft-VM3 sshd\[17123\]: Invalid user elba from 96.78.175.37 port 53372
Jul  6 23:14:22 MK-Soft-VM3 sshd\[17123\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=96.78.175.37
Jul  6 23:14:23 MK-Soft-VM3 sshd\[17123\]: Failed password for invalid user elba from 96.78.175.37 port 53372 ssh2
...

Oct 12 04:29:23 vserver sshd\[3514\]: Failed password for root from 96.78.175.33 port 34764 ssh2Oct 12 04:34:08 vserver sshd\[3560\]: Failed password for root from 96.78.175.33 port 52312 ssh2Oct 12 04:37:32 vserver sshd\[3602\]: Invalid user support from 96.78.175.33Oct 12 04:37:34 vserver sshd\[3602\]: Failed password for invalid user support from 96.78.175.33 port 57202 ssh2
...

Oct 12 04:29:23 vserver sshd\[3514\]: Failed password for root from 96.78.175.33 port 34764 ssh2Oct 12 04:34:08 vserver sshd\[3560\]: Failed password for root from 96.78.175.33 port 52312 ssh2Oct 12 04:37:32 vserver sshd\[3602\]: Invalid user support from 96.78.175.33Oct 12 04:37:34 vserver sshd\[3602\]: Failed password for invalid user support from 96.78.175.33 port 57202 ssh2
...

fail2ban -- 96.78.175.36
...

fail2ban -- 96.78.175.36
...

Aug 28 23:41:20 electroncash sshd[12689]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=96.78.175.36 
Aug 28 23:41:20 electroncash sshd[12689]: Invalid user testbed from 96.78.175.36 port 42161
Aug 28 23:41:22 electroncash sshd[12689]: Failed password for invalid user testbed from 96.78.175.36 port 42161 ssh2
Aug 28 23:45:04 electroncash sshd[13683]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=96.78.175.36  user=root
Aug 28 23:45:06 electroncash sshd[13683]: Failed password for root from 96.78.175.36 port 45987 ssh2
...

2020-08-16T21:13:41.419674vps751288.ovh.net sshd\[29103\]: Invalid user dell from 96.78.175.33 port 48806
2020-08-16T21:13:41.429219vps751288.ovh.net sshd\[29103\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=96.78.175.33
2020-08-16T21:13:42.976471vps751288.ovh.net sshd\[29103\]: Failed password for invalid user dell from 96.78.175.33 port 48806 ssh2
2020-08-16T21:17:19.863695vps751288.ovh.net sshd\[29145\]: Invalid user gj from 96.78.175.33 port 57348
2020-08-16T21:17:19.869840vps751288.ovh.net sshd\[29145\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=96.78.175.33

Brute-force attempt banned

May 24 22:54:53 l02a sshd[26065]: Invalid user pacs from 96.78.175.36
May 24 22:54:53 l02a sshd[26065]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=96.78.175.36 
May 24 22:54:53 l02a sshd[26065]: Invalid user pacs from 96.78.175.36
May 24 22:54:55 l02a sshd[26065]: Failed password for invalid user pacs from 96.78.175.36 port 41106 ssh2

odoo8
...

May 13 08:48:52 lukav-desktop sshd\[12147\]: Invalid user etherpad-lite from 96.78.175.36
May 13 08:48:52 lukav-desktop sshd\[12147\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=96.78.175.36
May 13 08:48:55 lukav-desktop sshd\[12147\]: Failed password for invalid user etherpad-lite from 96.78.175.36 port 33368 ssh2
May 13 08:50:23 lukav-desktop sshd\[12169\]: Invalid user cun from 96.78.175.36
May 13 08:50:23 lukav-desktop sshd\[12169\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=96.78.175.36

May 12 05:54:51 sso sshd[729]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=96.78.175.36
May 12 05:54:52 sso sshd[729]: Failed password for invalid user support from 96.78.175.36 port 42624 ssh2
...

2020-05-11T03:49:40.594547abusebot.cloudsearch.cf sshd[29906]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=96.78.175.36  user=root
2020-05-11T03:49:42.182462abusebot.cloudsearch.cf sshd[29906]: Failed password for root from 96.78.175.36 port 47645 ssh2
2020-05-11T03:51:41.584825abusebot.cloudsearch.cf sshd[30096]: Invalid user temp from 96.78.175.36 port 37699
2020-05-11T03:51:41.591286abusebot.cloudsearch.cf sshd[30096]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=96.78.175.36
2020-05-11T03:51:41.584825abusebot.cloudsearch.cf sshd[30096]: Invalid user temp from 96.78.175.36 port 37699
2020-05-11T03:51:43.791256abusebot.cloudsearch.cf sshd[30096]: Failed password for invalid user temp from 96.78.175.36 port 37699 ssh2
2020-05-11T03:53:49.256074abusebot.cloudsearch.cf sshd[30331]: Invalid user pal from 96.78.175.36 port 55984
...

Apr 27 14:39:42 home sshd[14833]: Failed password for root from 96.78.175.33 port 43550 ssh2
Apr 27 14:43:53 home sshd[15439]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=96.78.175.33
Apr 27 14:43:55 home sshd[15439]: Failed password for invalid user nacho from 96.78.175.33 port 55362 ssh2
...

2020-04-27T07:45:07.130867shield sshd\[8788\]: Invalid user wocloud from 96.78.175.33 port 55506
2020-04-27T07:45:07.135310shield sshd\[8788\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=96.78.175.33
2020-04-27T07:45:09.436415shield sshd\[8788\]: Failed password for invalid user wocloud from 96.78.175.33 port 55506 ssh2
2020-04-27T07:48:34.293755shield sshd\[9590\]: Invalid user ruud from 96.78.175.33 port 57020
2020-04-27T07:48:34.298903shield sshd\[9590\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=96.78.175.33

Apr 24 14:36:50 h2779839 sshd[29790]: Invalid user webline from 96.78.175.36 port 47697
Apr 24 14:36:50 h2779839 sshd[29790]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=96.78.175.36
Apr 24 14:36:50 h2779839 sshd[29790]: Invalid user webline from 96.78.175.36 port 47697
Apr 24 14:36:52 h2779839 sshd[29790]: Failed password for invalid user webline from 96.78.175.36 port 47697 ssh2
Apr 24 14:40:44 h2779839 sshd[29844]: Invalid user webmaster from 96.78.175.36 port 41432
Apr 24 14:40:44 h2779839 sshd[29844]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=96.78.175.36
Apr 24 14:40:44 h2779839 sshd[29844]: Invalid user webmaster from 96.78.175.36 port 41432
Apr 24 14:40:46 h2779839 sshd[29844]: Failed password for invalid user webmaster from 96.78.175.36 port 41432 ssh2
Apr 24 14:45:00 h2779839 sshd[29888]: Invalid user vagrant from 96.78.175.36 port 35168
...

Honeypot attack, port: 445, PTR: PTR record not found

Feb  4 10:55:23 hanapaa sshd\[14217\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.88.112.65  user=root
Feb  4 10:55:25 hanapaa sshd\[14217\]: Failed password for root from 49.88.112.65 port 64888 ssh2
Feb  4 10:56:28 hanapaa sshd\[14295\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.88.112.65  user=root
Feb  4 10:56:29 hanapaa sshd\[14295\]: Failed password for root from 49.88.112.65 port 47879 ssh2
Feb  4 10:56:31 hanapaa sshd\[14295\]: Failed password for root from 49.88.112.65 port 47879 ssh2

Feb  4 21:08:48 srv206 sshd[30516]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.175.212  user=root
Feb  4 21:08:51 srv206 sshd[30516]: Failed password for root from 222.186.175.212 port 18102 ssh2
...

Unauthorized SSH login attempts

2019-06-22 15:10:08 1hefmO-0005z4-Qd SMTP connection from \(\[131.196.0.136\]\) \[131.196.0.137\]:31823 I=\[193.107.88.166\]:25 closed by DROP in ACL
2019-06-22 15:10:50 1hefn4-00061X-AO SMTP connection from \(\[131.196.0.136\]\) \[131.196.0.137\]:31996 I=\[193.107.88.166\]:25 closed by DROP in ACL
2019-06-22 15:11:26 1hefnf-000625-MQ SMTP connection from \(\[131.196.0.136\]\) \[131.196.0.137\]:32143 I=\[193.107.88.166\]:25 closed by DROP in ACL
...

Feb  4 21:20:57 dedicated sshd[12164]: Invalid user teamspeak from 106.13.86.236 port 54580
Feb  4 21:20:59 dedicated sshd[12164]: Failed password for invalid user teamspeak from 106.13.86.236 port 54580 ssh2
Feb  4 21:20:57 dedicated sshd[12164]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.86.236 
Feb  4 21:20:57 dedicated sshd[12164]: Invalid user teamspeak from 106.13.86.236 port 54580
Feb  4 21:20:59 dedicated sshd[12164]: Failed password for invalid user teamspeak from 106.13.86.236 port 54580 ssh2

Honeypot attack, port: 81, PTR: pool-71-167-134-24.nycmny.fios.verizon.net.

Feb  4 10:33:17 hpm sshd\[18938\]: Invalid user ftpuser from 151.80.254.78
Feb  4 10:33:17 hpm sshd\[18938\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=151.80.254.78
Feb  4 10:33:19 hpm sshd\[18938\]: Failed password for invalid user ftpuser from 151.80.254.78 port 60122 ssh2
Feb  4 10:36:31 hpm sshd\[19220\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=151.80.254.78  user=root
Feb  4 10:36:33 hpm sshd\[19220\]: Failed password for root from 151.80.254.78 port 33320 ssh2

2019-02-26 18:56:06 H=\(\[131.196.13.8\]\) \[131.196.13.8\]:38031 I=\[193.107.88.166\]:25 F=\ rejected RCPT \: Sender verify failed
2019-02-26 18:56:09 H=\(\[131.196.13.8\]\) \[131.196.13.8\]:38096 I=\[193.107.88.166\]:25 F=\ rejected RCPT \: Sender verify failed
2019-02-26 18:56:11 H=\(\[131.196.13.8\]\) \[131.196.13.8\]:38152 I=\[193.107.88.166\]:25 F=\ rejected RCPT \: Sender verify failed
...

Lines containing failures of 123.20.11.246
Feb  4 21:02:14 jarvis sshd[24588]: Invalid user admin from 123.20.11.246 port 53673
Feb  4 21:02:14 jarvis sshd[24588]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.20.11.246 
Feb  4 21:02:16 jarvis sshd[24588]: Failed password for invalid user admin from 123.20.11.246 port 53673 ssh2
Feb  4 21:02:19 jarvis sshd[24588]: Connection closed by invalid user admin 123.20.11.246 port 53673 [preauth]
Feb  4 21:02:23 jarvis sshd[24590]: Invalid user admin from 123.20.11.246 port 47424
Feb  4 21:02:23 jarvis sshd[24590]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.20.11.246 
Feb  4 21:02:26 jarvis sshd[24590]: Failed password for invalid user admin from 123.20.11.246 port 47424 ssh2


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=123.20.11.246

Feb  4 10:18:08 hpm sshd\[17197\]: Invalid user monitor1 from 167.99.83.237
Feb  4 10:18:08 hpm sshd\[17197\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.99.83.237
Feb  4 10:18:10 hpm sshd\[17197\]: Failed password for invalid user monitor1 from 167.99.83.237 port 49724 ssh2
Feb  4 10:21:03 hpm sshd\[17521\]: Invalid user docker123 from 167.99.83.237
Feb  4 10:21:03 hpm sshd\[17521\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.99.83.237

Honeypot attack, port: 5555, PTR: a174.broadband8.quicknet.se.

Feb  4 21:18:48 sd-53420 sshd\[20790\]: User root from 171.34.173.17 not allowed because none of user's groups are listed in AllowGroups
Feb  4 21:18:48 sd-53420 sshd\[20790\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=171.34.173.17  user=root
Feb  4 21:18:50 sd-53420 sshd\[20790\]: Failed password for invalid user root from 171.34.173.17 port 39806 ssh2
Feb  4 21:21:05 sd-53420 sshd\[21019\]: User root from 171.34.173.17 not allowed because none of user's groups are listed in AllowGroups
Feb  4 21:21:05 sd-53420 sshd\[21019\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=171.34.173.17  user=root
...

1580847661 - 02/04/2020 21:21:01 Host: 190.204.194.182/190.204.194.182 Port: 445 TCP Blocked

Brute force attempt