Information Provider Reports

abuseDB Observed/Reported Behaviors

• Oct 3 15:58:30 betelgeuse sshd[654591]: Invalid user Antminer from 183.81.169.238 port 48648
  Oct 3 15:58:32 betelgeuse sshd[654598]: Invalid user Antminer from 183.81.169.238 port 51878
  ...

• Oct 3 14:56:35 AbuseCatcher sshd[88862]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 14:56:37 AbuseCatcher sshd[88862]: Failed password for root from 183.81.169.238 port 57254 ssh2
  ...

• [2024 Oct 3 14:33:45] Brute-Force detected from 183.81.169.238 for sshd fails: 2x () USER=baikal SPT=35170

• 2024-10-03 05:54:30,179 fail2ban.actions [689]: NOTICE [sshd] Ban 183.81.169.238

• list.rtbh.com.tr report: tcp/22

• 2024-10-03T13:54:16.608079+01:00 jane sshd[271284]: Failed password for root from 183.81.169.238 port 49188 ssh2
  2024-10-03T13:54:20.474980+01:00 jane sshd[271451]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T13:54:23.067921+01:00 jane sshd[271451]: Failed password for root from 183.81.169.238 port 43682 ssh2
  ...

• Oct 3 08:54:12 us-mfl-02 sshd[3658674]: Invalid user Antminer from 183.81.169.238 port 56760
  ...

• Oct 3 08:53:53 wise0wl sshd[3651004]: Invalid user Antminer from 183.81.169.238 port 59306
  Oct 3 08:53:54 wise0wl sshd[3651030]: Invalid user Antminer from 183.81.169.238 port 59316
  Oct 3 08:54:06 wise0wl sshd[3651168]: Invalid user admin from 183.81.169.238 port 50272
  ...

• 2024-10-03T14:53:36.281663vps773228.ovh.net sshd[10442]: Failed password for root from 183.81.169.238 port 48530 ssh2
  2024-10-03T14:53:38.681035vps773228.ovh.net sshd[10444]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T14:53:41.173845vps773228.ovh.net sshd[10444]: Failed password for root from 183.81.169.238 port 60428 ssh2
  2024-10-03T14:53:42.823089vps773228.ovh.net sshd[10446]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T14:53:45.200235vps773228.ovh.net sshd[10446]: Failed password for root from 183.81.169.238 port 60450 ssh2
  ...

• Oct 3 14:53:11 4429 sshd[97207]: Failed password for root from 183.81.169.238 port 42420 ssh2
  Oct 3 14:53:13 4429 sshd[97211]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 14:53:15 4429 sshd[97211]: Failed password for root from 183.81.169.238 port 42440 ssh2
  ...

• Oct 3 12:52:43 destiny sshd[2093649]: Connection closed by invalid user root 183.81.169.238 port 56872 [preauth]
  Oct 3 12:52:45 destiny sshd[2093651]: User root not allowed because account is locked
  Oct 3 12:52:45 destiny sshd[2093651]: Connection closed by invalid user root 183.81.169.238 port 39298 [preauth]
  Oct 3 12:52:46 destiny sshd[2093653]: User root not allowed because account is locked
  Oct 3 12:52:47 destiny sshd[2093653]: Connection closed by invalid user root 183.81.169.238 port 39304 [preauth]
  ...

• 2024-10-03T07:52:02.180149-05:00 BAW-C02 sshd[4045180]: Failed password for root from 183.81.169.238 port 51560 ssh2
  2024-10-03T07:52:05.530895-05:00 BAW-C02 sshd[4045243]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T07:52:07.259837-05:00 BAW-C02 sshd[4045243]: Failed password for root from 183.81.169.238 port 51584 ssh2
  2024-10-03T07:52:11.115288-05:00 BAW-C02 sshd[4045255]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T07:52:13.336314-05:00 BAW-C02 sshd[4045255]: Failed password for root from 183.81.169.238 port 35724 ssh2
  ...

• Oct 3 12:51:39 24fire sshd[197968]: Failed password for root from 183.81.169.238 port 59112 ssh2
  Oct 3 12:51:41 24fire sshd[197970]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 12:51:42 24fire sshd[197970]: Failed password for root from 183.81.169.238 port 59140 ssh2
  Oct 3 12:51:45 24fire sshd[197972]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 12:51:46 24fire sshd[197972]: Failed password for root from 183.81.169.238 port 59168 ssh2
  ...

• Oct 3 05:50:42 LU-VPS01 sshd[9994]: Failed password for root from 183.81.169.238 port 34542 ssh2
  Oct 3 05:50:46 LU-VPS01 sshd[9998]: Failed password for root from 183.81.169.238 port 34546 ssh2
  ...

• endlessh: 2024-10-03 14:50:42.168965988 2024-10-03T12:50:42.168Z CLOSE host=183.81.169.238 port=36336 fd=5 time=130.015 bytes=263
  ...

• Oct 3 08:49:23 scp sshd[3934187]: Invalid user Antminer from 183.81.169.238 port 49868
  Oct 3 08:49:24 scp sshd[3934251]: Invalid user Antminer from 183.81.169.238 port 49872
  Oct 3 08:49:39 scp sshd[3934601]: Invalid user admin from 183.81.169.238 port 39150
  ...

• Oct 3 14:48:30 vmi440488 sshd[3572732]: Failed password for root from 183.81.169.238 port 57670 ssh2
  Oct 3 14:48:33 vmi440488 sshd[3572735]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 14:48:35 vmi440488 sshd[3572735]: Failed password for root from 183.81.169.238 port 57680 ssh2
  Oct 3 14:48:38 vmi440488 sshd[3572741]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 14:48:41 vmi440488 sshd[3572741]: Failed password for root from 183.81.169.238 port 54066 ssh2
  ...

• Oct 3 14:48:08 ifog sshd[87225]: Invalid user Antminer from 183.81.169.238 port 35054
  Oct 3 14:48:10 ifog sshd[87227]: Invalid user Antminer from 183.81.169.238 port 35058
  Oct 3 14:48:20 ifog sshd[87239]: Invalid user admin from 183.81.169.238 port 54982
  ...

• Oct 3 12:46:35 xproot sshd[2033083]: Failed password for root from 183.81.169.238 port 59960 ssh2
  Oct 3 12:46:39 xproot sshd[2033094]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 12:46:41 xproot sshd[2033094]: Failed password for root from 183.81.169.238 port 47412 ssh2
  Oct 3 12:46:46 xproot sshd[2033096]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 12:46:47 xproot sshd[2033096]: Failed password for root from 183.81.169.238 port 47414 ssh2
  ...

• Oct 3 15:46:17 www sshd\[59914\]: Failed password for root from 183.81.169.238 port 52588 ssh2Oct 3 15:46:22 www sshd\[59916\]: Failed password for root from 183.81.169.238 port 52596 ssh2Oct 3 15:46:26 www sshd\[59918\]: Failed password for root from 183.81.169.238 port 52610 ssh2
  ...

• FW-PortScan: Traffic Blocked srcport=48996 dstport=22

• Oct 3 12:45:06 web-proxy02 sshd[1603757]: Failed password for root from 183.81.169.238 port 33352 ssh2
  Oct 3 12:45:08 web-proxy02 sshd[1603759]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 12:45:10 web-proxy02 sshd[1603759]: Failed password for root from 183.81.169.238 port 59722 ssh2
  ...

• PBK Oct 3 14:44:21 websrv01 sshd[1431394]: Failed password for root from 183.81.169.238 port 60548 ssh2
  Oct 3 14:44:26 websrv01 sshd[1431398]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 14:44:27 websrv01 sshd[1431398]: Failed password for root from 183.81.169.238 port 52564 ssh2
  Oct 3 14:44:30 websrv01 sshd[1431405]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 14:44:32 websrv01 sshd[1431405]: Failed password for root from 183.81.169.238 port 52572 ssh2

• Oct 3 15:44:14 community sshd[1540748]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 15:44:15 community sshd[1540748]: Failed password for root from 183.81.169.238 port 41696 ssh2
  ...

• I1003 14:42:46.340058 1 client.go:99] CLOSE host=183.81.169.238 port=50410 time=96.572288198 bytes=258
  ...

• 2024-10-03T14:41:07.258951+02:00 nc2.motyka.pro sshd[290757]: Failed password for root from 183.81.169.238 port 58356 ssh2
  2024-10-03T14:41:09.285226+02:00 nc2.motyka.pro sshd[290843]: Failed password for root from 183.81.169.238 port 58364 ssh2
  2024-10-03T14:41:11.400492+02:00 nc2.motyka.pro sshd[290981]: Failed password for root from 183.81.169.238 port 58370 ssh2
  2024-10-03T14:41:13.742192+02:00 nc2.motyka.pro sshd[291072]: Failed password for root from 183.81.169.238 port 58384 ssh2
  2024-10-03T14:41:15.958933+02:00 nc2.motyka.pro sshd[291227]: Failed password for root from 183.81.169.238 port 56598 ssh2
  ...

• Oct 3 14:40:03 Administration sshd[314008]: Failed password for root from 183.81.169.238 port 53402 ssh2
  Oct 3 14:40:06 Administration sshd[314014]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 14:40:08 Administration sshd[314014]: Failed password for root from 183.81.169.238 port 48182 ssh2
  Oct 3 14:40:11 Administration sshd[314019]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 14:40:12 Administration sshd[314019]: Failed password for root from 183.81.169.238 port 48204 ssh2
  Oct 3 14:40:15 Administration sshd[314021]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 14:40:17 Administration sshd[314021]: Failed password for root from 183.81.169.238 port 48228 ssh2
  ...

• Oct 3 14:40:10 root1896 sshd[2352126]: Failed password for root from 183.81.169.238 port 37358 ssh2
  Oct 3 14:40:13 root1896 sshd[2352133]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 14:40:15 root1896 sshd[2352133]: Failed password for root from 183.81.169.238 port 37370 ssh2
  Oct 3 14:40:18 root1896 sshd[2352165]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 14:40:20 root1896 sshd[2352165]: Failed password for root from 183.81.169.238 port 51816 ssh2
  ...

• Unsolicited connection attempt(s), port:22.

• 2024-10-03T14:39:46.998933+02:00 hvs sshd-session[54021]: Connection closed by authenticating user root 183.81.169.238 port 37382 [preauth]
  2024-10-03T14:39:48.978176+02:00 hvs sshd-session[54024]: Connection closed by authenticating user root 183.81.169.238 port 37390 [preauth]
  2024-10-03T14:39:50.486481+02:00 hvs sshd-session[54026]: Connection closed by authenticating user root 183.81.169.238 port 37404 [preauth]
  2024-10-03T14:39:52.028108+02:00 hvs sshd-session[54028]: Connection closed by authenticating user root 183.81.169.238 port 37414 [preauth]
  2024-10-03T14:39:53.556502+02:00 hvs sshd-session[54030]: Connection closed by authenticating user root 183.81.169.238 port 37416 [preauth]
  ...

• Oct 3 14:39:07 speedtaq-com-vm-vm sshd[8679]: Invalid user Antminer from 183.81.169.238 port 43676

• Oct 3 12:38:05 Proxmox-VE sshd[225043]: Failed password for root from 183.81.169.238 port 59042 ssh2
  Oct 3 12:38:07 Proxmox-VE sshd[225045]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 12:38:09 Proxmox-VE sshd[225045]: Failed password for root from 183.81.169.238 port 52308 ssh2
  Oct 3 12:38:12 Proxmox-VE sshd[225069]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 12:38:14 Proxmox-VE sshd[225069]: Failed password for root from 183.81.169.238 port 52374 ssh2
  ...

• Oct 3 14:36:02 kvm11438 sshd[2145]: Failed password for root from 183.81.169.238 port 46548 ssh2
  Oct 3 14:36:05 kvm11438 sshd[2156]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 14:36:07 kvm11438 sshd[2156]: Failed password for root from 183.81.169.238 port 46564 ssh2
  Oct 3 14:36:09 kvm11438 sshd[2158]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 14:36:12 kvm11438 sshd[2158]: Failed password for root from 183.81.169.238 port 41400 ssh2
  ...

• 2024-10-03T12:34:30.073522+00:00 srv67 sshd[44477]: Connection closed by authenticating user root 183.81.169.238 port 46172 [preauth]
  ...

• Oct 3 06:33:36 SRC=183.81.169.238 PROTO=TCP SPT=55457 DPT=22 SYN
  ...

• [12:33] Attempted SSH login on port 22 with credentials root:0

• Oct 3 14:32:51 m2369 sshd[916367]: Failed password for root from 183.81.169.238 port 60220 ssh2
  Oct 3 14:32:54 m2369 sshd[916371]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 14:32:56 m2369 sshd[916371]: Failed password for root from 183.81.169.238 port 60224 ssh2
  Oct 3 14:33:00 m2369 sshd[916406]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 14:33:01 m2369 sshd[916406]: Failed password for root from 183.81.169.238 port 60792 ssh2
  ...

• 2024-10-03T20:32:48.927207+08:00 raindance sshd[750524]: Failed password for root from 183.81.169.238 port 40984 ssh2
  2024-10-03T20:32:52.490054+08:00 raindance sshd[750752]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T20:32:54.928003+08:00 raindance sshd[750752]: Failed password for root from 183.81.169.238 port 41000 ssh2
  2024-10-03T20:32:59.750973+08:00 raindance sshd[750978]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T20:33:01.150138+08:00 raindance sshd[750978]: Failed password for root from 183.81.169.238 port 42930 ssh2
  ...

• Oct 3 14:31:44 AbuseCatcher sshd[86371]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 14:31:46 AbuseCatcher sshd[86371]: Failed password for root from 183.81.169.238 port 37590 ssh2
  ...

• 2024-10-03 10:00:12 UTC Unauthorized activity to TCP port 22. SSH

• (sshd) Failed SSH login from 183.81.169.238 (NL/The Netherlands/North Holland/Amsterdam/-/[AS206264 Amarutu Technology Ltd]): 5 in the last 3600 secs; IP: 183.81.169.238; Ports: *; Direction: 0; Trigger: LF_SSHD; Logs: 2024-10-03T14:30:02.481083+02:00 insightVM sshd[3530758]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root 2024-10-03T14:30:04.913377+02:00 insightVM sshd[3530758]: Failed password for root from 183.81.169.238 port 42096 ssh2 2024-10-03T14:30:09.348617+02:00 insightVM sshd[3530780]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root 2024-10-03T14:30:11.410188+02:00 insightVM sshd[3530780]: Failed password for root from 183.81.169.238 port 55342 ssh2 2024-10-03T14:30:13.824376+02:00 insightVM sshd[3530791]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root

• 2024-10-03T14:29:50.794190vmi1671272.contaboserver.net sshd[191533]: Failed password for root from 183.81.169.238 port 33666 ssh2
  2024-10-03T14:29:53.555958vmi1671272.contaboserver.net sshd[191535]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T14:29:55.753084vmi1671272.contaboserver.net sshd[191535]: Failed password for root from 183.81.169.238 port 33714 ssh2
  2024-10-03T14:29:58.619884vmi1671272.contaboserver.net sshd[191539]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T14:29:59.838276vmi1671272.contaboserver.net sshd[191539]: Failed password for root from 183.81.169.238 port 55516 ssh2

• Oct 3 08:27:14 sputnik sshd[3381]: Invalid user Antminer from 183.81.169.238 port 56154
  Oct 3 08:27:16 sputnik sshd[3801]: Invalid user Antminer from 183.81.169.238 port 56172
  Oct 3 08:27:30 sputnik sshd[6461]: Invalid user admin from 183.81.169.238 port 56512
  ...

• Oct 3 14:24:45 odin sshd[1677]: Failed password for root from 183.81.169.238 port 46320 ssh2
  Oct 3 14:24:49 odin sshd[1684]: Failed password for root from 183.81.169.238 port 56590 ssh2

• 2024-10-03T14:24:06.996547+02:00 vmi985635.contaboserver.net sshd[2633971]: Failed password for root from 183.81.169.238 port 35570 ssh2
  2024-10-03T14:24:09.584117+02:00 vmi985635.contaboserver.net sshd[2633997]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T14:24:11.529356+02:00 vmi985635.contaboserver.net sshd[2633997]: Failed password for root from 183.81.169.238 port 37372 ssh2
  2024-10-03T14:24:14.297240+02:00 vmi985635.contaboserver.net sshd[2634024]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T14:24:16.223555+02:00 vmi985635.contaboserver.net sshd[2634024]: Failed password for root from 183.81.169.238 port 37374 ssh2
  ...

• Oct 3 14:24:13 perf-2 sshd[230114]: Failed password for root from 183.81.169.238 port 48706 ssh2
  Oct 3 14:24:16 perf-2 sshd[230133]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 14:24:18 perf-2 sshd[230133]: Failed password for root from 183.81.169.238 port 48724 ssh2
  Oct 3 14:24:21 perf-2 sshd[230147]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 14:24:23 perf-2 sshd[230147]: Failed password for root from 183.81.169.238 port 54692 ssh2
  Oct 3 14:24:25 perf-2 sshd[230161]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 14:24:28 perf-2 sshd[230161]: Failed password for root from 183.81.169.238 port 54776 ssh2
  ...

• 2024-10-03T12:22:40.439541+00:00 Linux101 sshd[370855]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T12:22:42.194772+00:00 Linux101 sshd[370855]: Failed password for root from 183.81.169.238 port 52106 ssh2
  2024-10-03T12:22:44.164074+00:00 Linux101 sshd[371353]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T12:22:46.435927+00:00 Linux101 sshd[371353]: Failed password for root from 183.81.169.238 port 52122 ssh2
  2024-10-03T12:22:49.421499+00:00 Linux101 sshd[372238]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T12:22:52.079782+00:00 Linux101 sshd[372238]: Failed password for root from 183.81.169.238 port 55416 ssh2
  2024-10-03T12:22:54.509213+00:00 Linux101 sshd[372827]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= r
  ...

• 2024-10-03 12:22:29,115 fail2ban.actions [624]: NOTICE [sshd] Ban 183.81.169.238

• Oct 3 08:21:01 fremontnet-scca-01 sshd[20502]: Failed password for root from 183.81.169.238 port 48534 ssh2
  Oct 3 08:21:06 fremontnet-scca-01 sshd[20504]: Failed password for root from 183.81.169.238 port 48584 ssh2

• Oct 3 15:20:55 server2 sshd\[18882\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 15:20:57 server2 sshd\[18884\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 15:20:57 server2 sshd\[18886\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 15:20:59 server2 sshd\[18890\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 15:20:59 server2 sshd\[18893\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 15:21:00 server2 sshd\[18895\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers

• Oct 3 08:20:10 ny01 sshd[28606]: Failed password for root from 183.81.169.238 port 42216 ssh2
  Oct 3 08:20:14 ny01 sshd[28609]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 08:20:17 ny01 sshd[28609]: Failed password for root from 183.81.169.238 port 42238 ssh2
  Oct 3 08:20:18 ny01 sshd[28611]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 08:20:20 ny01 sshd[28611]: Failed password for root from 183.81.169.238 port 51470 ssh2

• Unsolicited connection attempt(s), port:22.

• 2024-10-03T14:19:39.994746+02:00 srv2 sshd[1678211]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T14:19:42.235954+02:00 srv2 sshd[1678211]: Failed password for root from 183.81.169.238 port 37334 ssh2
  ...

• Oct 3 12:19:32 vps-9 sshd[1047708]: Failed password for root from 183.81.169.238 port 34742 ssh2
  Oct 3 12:19:35 vps-9 sshd[1047710]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 12:19:37 vps-9 sshd[1047710]: Failed password for root from 183.81.169.238 port 46112 ssh2
  ...

• FW-PortScan: Traffic Blocked srcport=51008 dstport=22

• 2024-10-03T12:18:42.959640+00:00 deb0 sshd[61569]: Connection closed by authenticating user root 183.81.169.238 port 55958 [preauth]
  ...

• [rede-164-29] 10/03/2024-09:18:16.948239, 183.81.169.238, Protocol: 6, ET COMPROMISED Known Compromised or Hostile Host Traffic group 13

• Oct 3 12:17:50 ovh-docker-001 sshd[792807]: Failed password for root from 183.81.169.238 port 39416 ssh2
  Oct 3 12:17:52 ovh-docker-001 sshd[792949]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 12:17:54 ovh-docker-001 sshd[792949]: Failed password for root from 183.81.169.238 port 39424 ssh2
  Oct 3 12:17:57 ovh-docker-001 sshd[793026]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 12:17:59 ovh-docker-001 sshd[793026]: Failed password for root from 183.81.169.238 port 44562 ssh2
  ...

• 2024-10-03T20:17:30.715105+08:00 VM65536 sshd[920825]: Connection closed by authenticating user root 183.81.169.238 port 54124 [preauth]
  2024-10-03T20:17:33.401290+08:00 VM65536 sshd[920829]: Connection closed by authenticating user root 183.81.169.238 port 54136 [preauth]
  2024-10-03T20:17:35.691716+08:00 VM65536 sshd[920831]: Connection closed by authenticating user root 183.81.169.238 port 54160 [preauth]
  ...

• Events: TCP SYN Discovery or Flooding, Seen 134 times in the last 10800 seconds

• 2024-10-03T05:16:52.303104-07:00 goldcrest sshd[229074]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T05:16:53.948831-07:00 goldcrest sshd[229074]: Failed password for root from 183.81.169.238 port 35880 ssh2
  2024-10-03T05:16:56.382791-07:00 goldcrest sshd[229076]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T05:16:58.580268-07:00 goldcrest sshd[229076]: Failed password for root from 183.81.169.238 port 35892 ssh2
  ...

• Oct 3 14:16:32 arm-am sshd[79237]: Invalid user Antminer from 183.81.169.238 port 60240
  Oct 3 14:16:33 arm-am sshd[79239]: Invalid user Antminer from 183.81.169.238 port 60252
  Oct 3 14:16:38 arm-am sshd[79251]: Invalid user admin from 183.81.169.238 port 35692
  ...

• 2024-10-03T14:14:56.485750+02:00 devcricle sshd[2210]: Failed password for root from 183.81.169.238 port 60862 ssh2
  2024-10-03T14:14:58.609809+02:00 devcricle sshd[2212]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T14:15:00.608687+02:00 devcricle sshd[2212]: Failed password for root from 183.81.169.238 port 60878 ssh2
  ...

• Inteceptor Intrusion Detector: failed_password on sshd module PID: (1153474)

• unauthorized connection with user "root" and password "0" at 2024-10-03T12:14:13Z

• Oct 3 14:14:01 OPSO sshd\[28468\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 14:14:03 OPSO sshd\[28468\]: Failed password for root from 183.81.169.238 port 35842 ssh2
  Oct 3 14:14:04 OPSO sshd\[28488\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 14:14:06 OPSO sshd\[28488\]: Failed password for root from 183.81.169.238 port 48666 ssh2
  Oct 3 14:14:07 OPSO sshd\[28490\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root

• Oct 3 14:10:12 de-kae sshd[3500361]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 14:10:14 de-kae sshd[3500361]: Failed password for root from 183.81.169.238 port 37330 ssh2
  ...

• 3:12:47I1003 11:
  Fail2ban action triggered

• Oct 3 12:07:22 cknpih001 sshd[36664]: Failed password for root from 183.81.169.238 port 46340 ssh2
  Oct 3 12:07:25 cknpih001 sshd[36666]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 12:07:27 cknpih001 sshd[36666]: Failed password for root from 183.81.169.238 port 47884 ssh2
  Oct 3 12:07:28 cknpih001 sshd[36668]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 12:07:29 cknpih001 sshd[36668]: Failed password for root from 183.81.169.238 port 47892 ssh2
  ...

• 10/03/2024-14:07:23.899106 183.81.169.238 Protocol: 6 ET COMPROMISED Known Compromised or Hostile Host Traffic group 13

• Oct 3 05:56:54 web2 sshd\[11202\]: Failed password for root from 183.81.169.238 port 49784 ssh2Oct 3 05:56:57 web2 sshd\[11204\]: Failed password for root from 183.81.169.238 port 37488 ssh2Oct 3 05:57:00 web2 sshd\[11206\]: Failed password for root from 183.81.169.238 port 37504 ssh2Oct 3 05:57:03 web2 sshd\[11208\]: Failed password for root from 183.81.169.238 port 37530 ssh2Oct 3 05:57:05 web2 sshd\[11210\]: Failed password for root from 183.81.169.238 port 57396 ssh2Oct 3 05:57:09 web2 sshd\[11212\]: Failed password for root from 183.81.169.238 port 57426 ssh2
  ...

• Oct 3 14:05:16 AbuseCatcher sshd[85934]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 14:05:19 AbuseCatcher sshd[85934]: Failed password for root from 183.81.169.238 port 35152 ssh2
  ...

• Oct 3 14:04:49 DreamStateRP sshd[745892]: Failed password for root from 183.81.169.238 port 47220 ssh2
  Oct 3 14:04:50 DreamStateRP sshd[745894]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 14:04:51 DreamStateRP sshd[745894]: Failed password for root from 183.81.169.238 port 43152 ssh2
  Oct 3 14:04:52 DreamStateRP sshd[745899]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 14:04:54 DreamStateRP sshd[745899]: Failed password for root from 183.81.169.238 port 43156 ssh2
  Oct 3 14:04:55 DreamStateRP sshd[745901]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 14:04:58 DreamStateRP sshd[745901]: Failed password for root from 183.81.169.238 port 43168 ssh2
  ...

• tcp/22 (43 or more attempts)

• Oct 3 14:02:36 s1-4-gra7 sshd[2085808]: Invalid user Antminer from 183.81.169.238 port 56722
  Oct 3 14:02:36 s1-4-gra7 sshd[2085810]: Invalid user Antminer from 183.81.169.238 port 56734

• FW-PortScan: Traffic Blocked srcport=44870 dstport=22

• [12:00] Attempted SSH login on port 22 with credentials root:0

• Oct 3 14:00:17 m2048 sshd[323577]: Failed password for root from 183.81.169.238 port 46764 ssh2
  Oct 3 14:00:18 m2048 sshd[323579]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 14:00:19 m2048 sshd[323579]: Failed password for root from 183.81.169.238 port 46782 ssh2
  Oct 3 14:00:20 m2048 sshd[323581]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 14:00:21 m2048 sshd[323581]: Failed password for root from 183.81.169.238 port 46788 ssh2
  ...

• 10682 attempts since 14.07.2024 04:18:57 UTC - last one: 2024-10-03T12:51:51.504484+02:00 alpha sshd[2370849]: Connection closed by invalid user baikal 183.81.169.238 port 54428 [preauth]

• Oct 3 15:00:05 localhost sshd[1372158]: Failed password for root from 183.81.169.238 port 40378 ssh2
  Oct 3 15:00:06 localhost sshd[1372190]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 15:00:08 localhost sshd[1372190]: Failed password for root from 183.81.169.238 port 46516 ssh2
  Oct 3 15:00:09 localhost sshd[1372196]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 15:00:11 localhost sshd[1372196]: Failed password for root from 183.81.169.238 port 46522 ssh2
  ...

• 2024-10-03T11:59:33.290183us1.starnode.us sshd[1511082]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T11:59:34.634083us1.starnode.us sshd[1511082]: Failed password for root from 183.81.169.238 port 33698 ssh2
  ...

• 2024-10-03T11:58:55.380643+00:00 frhb72991flex sshd[2178067]: Invalid user Antminer from 183.81.169.238 port 34488
  2024-10-03T11:58:55.717796+00:00 frhb72991flex sshd[2178069]: Invalid user Antminer from 183.81.169.238 port 34502
  ...

• Oct 3 20:57:23 localhost sshd[3155928]: Failed password for root from 183.81.169.238 port 45342 ssh2
  Oct 3 20:57:26 localhost sshd[3155956]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 20:57:27 localhost sshd[3155956]: Failed password for root from 183.81.169.238 port 58178 ssh2
  Oct 3 20:57:30 localhost sshd[3155958]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 20:57:32 localhost sshd[3155958]: Failed password for root from 183.81.169.238 port 58188 ssh2
  ...

• Oct 3 13:55:40 athena sshd[897911]: Failed password for root from 183.81.169.238 port 57360 ssh2
  Oct 3 13:55:41 athena sshd[897913]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 13:55:43 athena sshd[897913]: Failed password for root from 183.81.169.238 port 57382 ssh2
  Oct 3 13:55:44 athena sshd[897917]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 13:55:46 athena sshd[897917]: Failed password for root from 183.81.169.238 port 58448 ssh2
  ...

• Oct 3 11:55:00 ice1 sshd[3553483]: Invalid user Antminer from 183.81.169.238 port 51588
  Oct 3 11:55:01 ice1 sshd[3553485]: Invalid user Antminer from 183.81.169.238 port 51598
  ...

• Oct 3 11:53:10 ovh sshd[3533693]: Failed password for root from 183.81.169.238 port 38204 ssh2
  Oct 3 11:53:11 ovh sshd[3533719]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 11:53:13 ovh sshd[3533719]: Failed password for root from 183.81.169.238 port 38206 ssh2
  Oct 3 11:53:15 ovh sshd[3533747]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 11:53:18 ovh sshd[3533747]: Failed password for root from 183.81.169.238 port 34796 ssh2
  ...

• Oct 3 04:52:34 *host* sshd[243831]: Connection from 183.81.169.238 port 55398 on 147.182.234.53 port 22 rdomain "" Oct 3 04:52:35 *host* sshd[243831]: Invalid user admin from 183.81.169.238 port 55398 Oct 3 04:52:36 *host* sshd[243833]: Connection from 183.81.169.238 port 55444 on 147.182.234.53 port 22 rdomain "" Oct 3 04:52:36 *host* sshd[243833]: Invalid user baikal from 183.81.169.238 port 55444

• Oct 3 14:52:23 pkdns2 sshd\[31079\]: Failed password for root from 183.81.169.238 port 49048 ssh2Oct 3 14:52:25 pkdns2 sshd\[31081\]: Failed password for root from 183.81.169.238 port 49070 ssh2Oct 3 14:52:28 pkdns2 sshd\[31083\]: Failed password for root from 183.81.169.238 port 39722 ssh2Oct 3 14:52:30 pkdns2 sshd\[31085\]: Failed password for root from 183.81.169.238 port 39732 ssh2Oct 3 14:52:32 pkdns2 sshd\[31087\]: Failed password for root from 183.81.169.238 port 39748 ssh2Oct 3 14:52:34 pkdns2 sshd\[31089\]: Failed password for root from 183.81.169.238 port 39750 ssh2
  ...

• Oct 3 11:51:23 localhost sshd[2311268]: Failed password for root from 183.81.169.238 port 39018 ssh2
  Oct 3 11:51:25 localhost sshd[2311271]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 11:51:27 localhost sshd[2311271]: Failed password for root from 183.81.169.238 port 47564 ssh2
  Oct 3 11:51:29 localhost sshd[2311275]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 11:51:32 localhost sshd[2311275]: Failed password for root from 183.81.169.238 port 47618 ssh2
  ...

• Oct 3 13:49:50 CDN sshd[1793193]: Failed password for root from 183.81.169.238 port 44316 ssh2
  Oct 3 13:49:51 CDN sshd[1793195]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 13:49:54 CDN sshd[1793195]: Failed password for root from 183.81.169.238 port 44320 ssh2
  Oct 3 13:49:55 CDN sshd[1793201]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 13:49:57 CDN sshd[1793201]: Failed password for root from 183.81.169.238 port 49812 ssh2

• 2024-10-03T14:49:34.467476+03:00 mummo sshd[2384873]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T14:49:36.579460+03:00 mummo sshd[2384873]: Failed password for root from 183.81.169.238 port 54494 ssh2
  ...

• 2024-10-03T11:49:21.912740shield sshd\[15898\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T11:49:24.239219shield sshd\[15898\]: Failed password for root from 183.81.169.238 port 37564 ssh2
  2024-10-03T11:49:25.093991shield sshd\[15908\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T11:49:26.969520shield sshd\[15908\]: Failed password for root from 183.81.169.238 port 56036 ssh2
  2024-10-03T11:49:27.576643shield sshd\[15910\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root

• Oct 3 13:48:04 fshubvidspace sshd[3006188]: Failed password for root from 183.81.169.238 port 48878 ssh2
  Oct 3 13:48:05 fshubvidspace sshd[3006190]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 13:48:06 fshubvidspace sshd[3006190]: Failed password for root from 183.81.169.238 port 54760 ssh2
  Oct 3 13:48:08 fshubvidspace sshd[3006193]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 13:48:10 fshubvidspace sshd[3006193]: Failed password for root from 183.81.169.238 port 54762 ssh2
  ...

• 2024-10-03T04:47:51.980228-07:00 panduhstudios sshd[2866180]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T04:47:54.282752-07:00 panduhstudios sshd[2866180]: Failed password for root from 183.81.169.238 port 56876 ssh2
  2024-10-03T04:47:56.775463-07:00 panduhstudios sshd[2866209]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T04:47:58.766779-07:00 panduhstudios sshd[2866209]: Failed password for root from 183.81.169.238 port 57078 ssh2
  ...

• Security system: Unauthorised SSH/Telnet login attempt with user "root" at 2024-10-03T11:47:16Z

• 2024-10-03T13:44:40.419221+02:00 vserver-20917 sshd-session[1984461]: Failed password for root from 183.81.169.238 port 52522 ssh2
  2024-10-03T13:44:42.073351+02:00 vserver-20917 sshd-session[1984465]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T13:44:44.431277+02:00 vserver-20917 sshd-session[1984465]: Failed password for root from 183.81.169.238 port 43734 ssh2
  2024-10-03T13:44:46.828755+02:00 vserver-20917 sshd-session[1984468]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T13:44:48.408600+02:00 vserver-20917 sshd-session[1984468]: Failed password for root from 183.81.169.238 port 43756 ssh2
  ...

• Oct 3 13:44:55 dsh1621 sshd[93847]: Failed password for root from 183.81.169.238 port 35210 ssh2
  Oct 3 13:44:58 dsh1621 sshd[93884]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 13:44:59 dsh1621 sshd[93884]: Failed password for root from 183.81.169.238 port 59704 ssh2
  Oct 3 13:45:02 dsh1621 sshd[93925]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 13:45:05 dsh1621 sshd[93925]: Failed password for root from 183.81.169.238 port 59726 ssh2
  ...

• Oct 3 14:44:15 server2 sshd\[14199\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 14:44:17 server2 sshd\[14201\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 14:44:18 server2 sshd\[14207\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 14:44:19 server2 sshd\[14209\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 14:44:21 server2 sshd\[14211\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 14:44:23 server2 sshd\[14213\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers

• Oct 3 14:42:18 DarkSquad sshd[121535]: Failed password for root from 183.81.169.238 port 44532 ssh2
  Oct 3 14:42:22 DarkSquad sshd[121540]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 14:42:24 DarkSquad sshd[121540]: Failed password for root from 183.81.169.238 port 44550 ssh2
  Oct 3 14:42:26 DarkSquad sshd[121546]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 14:42:28 DarkSquad sshd[121546]: Failed password for root from 183.81.169.238 port 38366 ssh2
  Oct 3 14:42:31 DarkSquad sshd[121551]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 14:42:33 DarkSquad sshd[121551]: Failed password for root from 183.81.169.238 port 38424 ssh2
  ...

• Oct 3 13:42:12 mail sshd[925885]: Failed password for root from 183.81.169.238 port 48814 ssh2
  Oct 3 13:42:15 mail sshd[925889]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 13:42:17 mail sshd[925889]: Failed password for root from 183.81.169.238 port 39484 ssh2
  ...

• Cowrie Honeypot: Unauthorised SSH/Telnet login attempt with user "root" at 2024-10-03T11:41:37Z

• 10959 attempts since 13.07.2024 23:53:03 UTC - last one: 2024-10-03T13:14:40.162557+02:00 beta sshd[2341537]: Connection closed by invalid user baikal 183.81.169.238 port 35662 [preauth]

• Oct 3 11:40:59 elasticsearch sshd[247519]: Invalid user Antminer from 183.81.169.238 port 46498
  Oct 3 11:41:01 elasticsearch sshd[247521]: Invalid user Antminer from 183.81.169.238 port 46538
  Oct 3 11:41:16 elasticsearch sshd[247533]: Invalid user admin from 183.81.169.238 port 33922
  ...

• 2024-10-03T11:40:45.099804+00:00 Linux13 sshd[2602405]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T11:40:47.255879+00:00 Linux13 sshd[2602405]: Failed password for root from 183.81.169.238 port 58322 ssh2
  2024-10-03T11:40:49.425798+00:00 Linux13 sshd[2602587]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T11:40:51.462010+00:00 Linux13 sshd[2602587]: Failed password for root from 183.81.169.238 port 42248 ssh2
  2024-10-03T11:40:53.340157+00:00 Linux13 sshd[2602764]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T11:40:55.260804+00:00 Linux13 sshd[2602764]: Failed password for root from 183.81.169.238 port 42276 ssh2
  2024-10-03T11:40:58.159246+00:00 Linux13 sshd[2603051]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= r
  ...

• 2024-10-03T11:40:39.579846+00:00 deb1 sshd[79021]: Connection closed by authenticating user root 183.81.169.238 port 38230 [preauth]
  ...

• Oct 3 07:40:11 ny01 sshd[25500]: Failed password for root from 183.81.169.238 port 37108 ssh2
  Oct 3 07:40:16 ny01 sshd[25512]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 07:40:17 ny01 sshd[25512]: Failed password for root from 183.81.169.238 port 46022 ssh2
  Oct 3 07:40:21 ny01 sshd[25520]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 07:40:23 ny01 sshd[25520]: Failed password for root from 183.81.169.238 port 46034 ssh2

• Oct 3 13:40:01 gateway1-old sshd[17692]: Failed password for root from 183.81.169.238 port 53350 ssh2
  Oct 3 13:40:06 gateway1-old sshd[17976]: Failed password for root from 183.81.169.238 port 52880 ssh2

• Oct 3 11:39:17 ovh-docker-001 sshd[743978]: Failed password for root from 183.81.169.238 port 49290 ssh2
  Oct 3 11:39:20 ovh-docker-001 sshd[744124]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 11:39:22 ovh-docker-001 sshd[744124]: Failed password for root from 183.81.169.238 port 49320 ssh2
  Oct 3 11:39:25 ovh-docker-001 sshd[744151]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 11:39:27 ovh-docker-001 sshd[744151]: Failed password for root from 183.81.169.238 port 36272 ssh2
  ...

• FW-PortScan: Traffic Blocked srcport=54501 dstport=22

• 2024-10-03T13:36:11.794345+02:00 PWS-PM-WEB01 sshd[3344261]: Failed password for root from 183.81.169.238 port 52072 ssh2
  2024-10-03T13:36:15.627325+02:00 PWS-PM-WEB01 sshd[3344266]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T13:36:17.382221+02:00 PWS-PM-WEB01 sshd[3344266]: Failed password for root from 183.81.169.238 port 50566 ssh2
  ...

• Oct 3 13:36:51 v2202301167543214332 sshd[2974115]: Failed password for root from 183.81.169.238 port 42808 ssh2
  Oct 3 13:36:55 v2202301167543214332 sshd[2974119]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 13:36:57 v2202301167543214332 sshd[2974119]: Failed password for root from 183.81.169.238 port 42812 ssh2
  Oct 3 13:37:00 v2202301167543214332 sshd[2974121]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 13:37:02 v2202301167543214332 sshd[2974121]: Failed password for root from 183.81.169.238 port 43508 ssh2
  ...

• Oct 3 13:35:52 m2048 sshd[323382]: Failed password for root from 183.81.169.238 port 35190 ssh2
  Oct 3 13:35:56 m2048 sshd[323384]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 13:35:59 m2048 sshd[323384]: Failed password for root from 183.81.169.238 port 40054 ssh2
  Oct 3 13:36:03 m2048 sshd[323387]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 13:36:05 m2048 sshd[323387]: Failed password for root from 183.81.169.238 port 40066 ssh2
  ...

• Oct 3 11:33:31 phpbb3 sshd[2578873]: Invalid user Antminer from 183.81.169.238 port 50648
  Oct 3 11:33:34 phpbb3 sshd[2578892]: Invalid user Antminer from 183.81.169.238 port 50672

• SSH scanning

• Oct 3 13:31:16 * sshd[2199800]: Failed password for root from 183.81.169.238 port 34810 ssh2
  Oct 3 13:31:20 * sshd[2199827]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 13:31:22 * sshd[2199827]: Failed password for root from 183.81.169.238 port 57166 ssh2

• Oct 3 11:30:51 c2 sshd[2059427]: Failed password for root from 183.81.169.238 port 41406 ssh2
  Oct 3 11:30:55 c2 sshd[2059431]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 11:30:57 c2 sshd[2059431]: Failed password for root from 183.81.169.238 port 41446 ssh2
  Oct 3 11:31:01 c2 sshd[2059435]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 11:31:03 c2 sshd[2059435]: Failed password for root from 183.81.169.238 port 40230 ssh2
  ...

• Oct 3 04:30:40 nunnother sshd\[8531\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 04:30:42 nunnother sshd\[8531\]: Failed password for root from 183.81.169.238 port 49708 ssh2
  Oct 3 04:30:44 nunnother sshd\[8533\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 04:30:46 nunnother sshd\[8533\]: Failed password for root from 183.81.169.238 port 49710 ssh2
  Oct 3 04:30:49 nunnother sshd\[8535\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  ...

• Oct 3 13:30:34 AbuseCatcher sshd[83915]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 13:30:36 AbuseCatcher sshd[83915]: Failed password for root from 183.81.169.238 port 39610 ssh2
  ...

• 183.81.169.238 (183.81.169.238) - SSH Brute force:
  Oct 3 14:28:26 XWEB sshd[21644]: Failed password for root from 183.81.169.238 port 34626 ssh2
  Oct 3 14:28:29 XWEB sshd[21646]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 14:28:31 XWEB sshd[21646]: Failed password for root from 183.81.169.238 port 33988 ssh2
  ...

• Oct 3 11:28:07 shirus29 sshd[2489879]: Failed password for root from 183.81.169.238 port 39792 ssh2
  Oct 3 11:28:10 shirus29 sshd[2489881]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 11:28:12 shirus29 sshd[2489881]: Failed password for root from 183.81.169.238 port 54592 ssh2
  Oct 3 11:28:16 shirus29 sshd[2489883]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 11:28:17 shirus29 sshd[2489883]: Failed password for root from 183.81.169.238 port 53408 ssh2
  ...

• Oct 3 11:27:37 mysql sshd[227546]: Failed password for root from 183.81.169.238 port 35018 ssh2
  Oct 3 11:27:41 mysql sshd[227548]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 11:27:43 mysql sshd[227548]: Failed password for root from 183.81.169.238 port 36800 ssh2
  Oct 3 11:27:47 mysql sshd[227550]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 11:27:49 mysql sshd[227550]: Failed password for root from 183.81.169.238 port 58710 ssh2
  ...

• Oct 3 13:27:48 h2930838 sshd[27458]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 13:27:49 h2930838 sshd[27458]: Failed password for invalid user root from 183.81.169.238 port 44358 ssh2

• Oct 3 13:27:03 amk sshd\[12196\]: Failed password for root from 183.81.169.238 port 42680 ssh2Oct 3 13:27:07 amk sshd\[12198\]: Failed password for root from 183.81.169.238 port 41332 ssh2
  ...

• Oct 3 04:26:46 server01 sshd[10841]: Failed password for root from 183.81.169.238 port 38808 ssh2
  Oct 3 04:26:51 server01 sshd[10843]: Failed password for root from 183.81.169.238 port 56004 ssh2
  ...

• 2024-10-03T13:25:51.301052+02:00 marvibiene sshd[139956]: Failed password for root from 183.81.169.238 port 41670 ssh2
  2024-10-03T13:25:55.574573+02:00 marvibiene sshd[140010]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T13:25:57.882365+02:00 marvibiene sshd[140010]: Failed password for root from 183.81.169.238 port 55248 ssh2
  2024-10-03T13:26:02.035199+02:00 marvibiene sshd[140013]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T13:26:03.304142+02:00 marvibiene sshd[140013]: Failed password for root from 183.81.169.238 port 55254 ssh2

• Oct 3 13:24:41 LimitlessRP sshd[234586]: Failed password for root from 183.81.169.238 port 54096 ssh2
  Oct 3 13:24:44 LimitlessRP sshd[234592]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 13:24:46 LimitlessRP sshd[234592]: Failed password for root from 183.81.169.238 port 54894 ssh2
  Oct 3 13:24:50 LimitlessRP sshd[234597]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 13:24:52 LimitlessRP sshd[234597]: Failed password for root from 183.81.169.238 port 54932 ssh2
  Oct 3 13:24:55 LimitlessRP sshd[234603]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 13:24:58 LimitlessRP sshd[234603]: Failed password for root from 183.81.169.238 port 55482 ssh2
  ...

• Failed password for root from 183.81.169.238 port 49370 ssh2
  pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Failed password for root from 183.81.169.238 port 49384 ssh2
  pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Failed password for root from 183.81.169.238 port 59224 ssh2

• 2024-10-03T11:20:31.995017+00:00 Linux02 sshd[2775412]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T11:20:34.157316+00:00 Linux02 sshd[2775412]: Failed password for root from 183.81.169.238 port 54236 ssh2
  2024-10-03T11:20:38.528141+00:00 Linux02 sshd[2775738]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T11:20:40.649770+00:00 Linux02 sshd[2775738]: Failed password for root from 183.81.169.238 port 60150 ssh2
  2024-10-03T11:20:44.971522+00:00 Linux02 sshd[2776152]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T11:20:46.249956+00:00 Linux02 sshd[2776152]: Failed password for root from 183.81.169.238 port 60154 ssh2
  2024-10-03T11:20:49.292712+00:00 Linux02 sshd[2776432]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= r
  ...

• Oct 3 13:22:15 server sshd[1335295]: Failed password for root from 183.81.169.238 port 52354 ssh2
  Oct 3 13:22:18 server sshd[1335299]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 13:22:19 server sshd[1335299]: Failed password for root from 183.81.169.238 port 42146 ssh2
  Oct 3 13:22:21 server sshd[1335301]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 13:22:23 server sshd[1335301]: Failed password for root from 183.81.169.238 port 42156 ssh2
  ...

• Oct 3 12:20:13 s1-jellyfish sshd[345840]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 12:20:15 s1-jellyfish sshd[345840]: Failed password for root from 183.81.169.238 port 53524 ssh2
  ...

• Oct 3 11:20:07 Sildom2 sshd[1565792]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 11:20:09 Sildom2 sshd[1565792]: Failed password for root from 183.81.169.238 port 46934 ssh2
  ...

• Oct 3 13:19:54 unifi sshd[751864]: Failed password for root from 183.81.169.238 port 45520 ssh2
  Oct 3 13:19:57 unifi sshd[751866]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 13:19:58 unifi sshd[751866]: Failed password for root from 183.81.169.238 port 50492 ssh2
  Oct 3 13:20:01 unifi sshd[751868]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 13:20:04 unifi sshd[751868]: Failed password for root from 183.81.169.238 port 50502 ssh2
  ...

• 2024-10-03T14:19:16.028562+03:00 gate kernel: [443285.427883] nftables: JAIL-SSH IN=wan OUT= MAC= SRC=183.81.169.238 DST=xxx.xxx.xxx.xxx LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=54321 PROTO=TCP SPT=38221 DPT=22 WINDOW=65535 RES=0x00 SYN URGP=0
  ...

• 2024-10-03T13:18:57.745543+02:00 ruddy-force sshd[548177]: Failed password for root from 183.81.169.238 port 35464 ssh2
  2024-10-03T13:19:01.015352+02:00 ruddy-force sshd[548179]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T13:19:03.018352+02:00 ruddy-force sshd[548179]: Failed password for root from 183.81.169.238 port 39606 ssh2
  2024-10-03T13:19:06.715053+02:00 ruddy-force sshd[548181]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T13:19:09.209818+02:00 ruddy-force sshd[548181]: Failed password for root from 183.81.169.238 port 37490 ssh2
  ...

• Oct 3 07:18:50 us-mfl-01 sshd[1864329]: Invalid user Antminer from 183.81.169.238 port 36542
  ...

• FW-PortScan: Traffic Blocked srcport=36081 dstport=22

• Oct 3 12:17:16 nervous-edison8 sshd[1708692]: Failed password for root from 183.81.169.238 port 44652 ssh2
  Oct 3 12:17:18 nervous-edison8 sshd[1708718]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 12:17:20 nervous-edison8 sshd[1708718]: Failed password for root from 183.81.169.238 port 59080 ssh2
  Oct 3 12:17:21 nervous-edison8 sshd[1708743]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 12:17:23 nervous-edison8 sshd[1708743]: Failed password for root from 183.81.169.238 port 59090 ssh2
  ...

• Oct 3 13:16:26 OPSO sshd\[22620\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 13:16:28 OPSO sshd\[22620\]: Failed password for root from 183.81.169.238 port 51834 ssh2
  Oct 3 13:16:31 OPSO sshd\[22622\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 13:16:33 OPSO sshd\[22622\]: Failed password for root from 183.81.169.238 port 51850 ssh2
  Oct 3 13:16:35 OPSO sshd\[22624\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root

• [rede-164-29] 10/03/2024-08:16:33.176326, 183.81.169.238, Protocol: 6, ET COMPROMISED Known Compromised or Hostile Host Traffic group 13

• Oct 3 11:15:53 localhost sshd[2310532]: Failed password for root from 183.81.169.238 port 54496 ssh2
  Oct 3 11:15:56 localhost sshd[2310534]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 11:15:57 localhost sshd[2310534]: Failed password for root from 183.81.169.238 port 51984 ssh2
  Oct 3 11:16:01 localhost sshd[2310537]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 11:16:03 localhost sshd[2310537]: Failed password for root from 183.81.169.238 port 52000 ssh2
  ...

• 2024-10-03T11:13:46.812411+00:00 frhb72991flex sshd[2177788]: Invalid user Antminer from 183.81.169.238 port 51824
  2024-10-03T11:13:49.147179+00:00 frhb72991flex sshd[2177790]: Invalid user Antminer from 183.81.169.238 port 51830
  ...

• 2024-10-03T13:12:30.753980+02:00 hosting13 sshd[296555]: Failed password for root from 183.81.169.238 port 50408 ssh2
  2024-10-03T13:12:34.176406+02:00 hosting13 sshd[296560]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T13:12:35.853877+02:00 hosting13 sshd[296560]: Failed password for root from 183.81.169.238 port 50452 ssh2
  2024-10-03T13:12:39.306415+02:00 hosting13 sshd[296562]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T13:12:41.654405+02:00 hosting13 sshd[296562]: Failed password for root from 183.81.169.238 port 51402 ssh2
  ...

• Oct 3 13:11:36 vmi147057 sshd[964453]: Failed password for root from 183.81.169.238 port 49334 ssh2
  Oct 3 13:11:38 vmi147057 sshd[964471]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 13:11:41 vmi147057 sshd[964471]: Failed password for root from 183.81.169.238 port 49860 ssh2
  Oct 3 13:11:45 vmi147057 sshd[964484]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 13:11:47 vmi147057 sshd[964484]: Failed password for root from 183.81.169.238 port 49886 ssh2
  ...

• 2024-10-03T11:11:24.535682+00:00 ubuntu sshd[1508327]: Invalid user Antminer from 183.81.169.238 port 52656
  2024-10-03T11:11:25.908050+00:00 ubuntu sshd[1508329]: Invalid user Antminer from 183.81.169.238 port 53970
  ...

• Oct 3 08:11:18 SRC=183.81.169.238 PROTO=TCP SPT=33679 DPT=22 SYN
  ...

• 2024-10-03 06:08:22.588162-0500 localhost sshd[45258]: Failed password for root from 183.81.169.238 port 52702 ssh2

• Oct 3 13:10:20 speedtaq-com-vm-vm sshd[28665]: Invalid user Antminer from 183.81.169.238 port 36572

• 2024-10-03T07:08:11.923552-04:00 ns05-a-ns-xyz sshd[2259141]: Failed password for root from 183.81.169.238 port 37350 ssh2
  2024-10-03T07:08:16.253507-04:00 ns05-a-ns-xyz sshd[2259143]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T07:08:17.845839-04:00 ns05-a-ns-xyz sshd[2259143]: Failed password for root from 183.81.169.238 port 37358 ssh2
  2024-10-03T07:08:22.462644-04:00 ns05-a-ns-xyz sshd[2259146]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T07:08:23.879445-04:00 ns05-a-ns-xyz sshd[2259146]: Failed password for root from 183.81.169.238 port 53016 ssh2
  ...

• Oct 3 11:06:38 mark sshd[1670366]: Failed password for root from 183.81.169.238 port 38800 ssh2
  Oct 3 11:06:42 mark sshd[1671322]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 11:06:44 mark sshd[1671322]: Failed password for root from 183.81.169.238 port 34598 ssh2
  Oct 3 11:06:47 mark sshd[1671800]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 11:06:49 mark sshd[1671800]: Failed password for root from 183.81.169.238 port 59482 ssh2
  ...

• 2024-10-03T11:06:24.090504+00:00 mapir-proxmox sshd[3404478]: Failed password for root from 183.81.169.238 port 55964 ssh2
  2024-10-03T11:06:26.693982+00:00 mapir-proxmox sshd[3405169]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T11:06:28.851232+00:00 mapir-proxmox sshd[3405169]: Failed password for root from 183.81.169.238 port 33876 ssh2
  ...

• Oct 3 11:05:50 Proxmox-VE sshd[212292]: Failed password for root from 183.81.169.238 port 47530 ssh2
  Oct 3 11:05:53 Proxmox-VE sshd[212316]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 11:05:55 Proxmox-VE sshd[212316]: Failed password for root from 183.81.169.238 port 47554 ssh2
  Oct 3 11:05:58 Proxmox-VE sshd[212318]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 11:06:00 Proxmox-VE sshd[212318]: Failed password for root from 183.81.169.238 port 41630 ssh2
  ...

• 2024-10-03T11:04:59.266413+00:00 mail sshd[934490]: Invalid user Antminer from 183.81.169.238 port 35180
  2024-10-03T11:05:00.743855+00:00 mail sshd[934492]: Invalid user Antminer from 183.81.169.238 port 35182
  2024-10-03T11:05:10.762942+00:00 mail sshd[934507]: Invalid user admin from 183.81.169.238 port 42938
  ...

• Oct 3 07:04:52 sputnik sshd[42387]: Invalid user Antminer from 183.81.169.238 port 55674
  Oct 3 07:04:55 sputnik sshd[43121]: Invalid user Antminer from 183.81.169.238 port 49102
  Oct 3 07:05:09 sputnik sshd[46094]: Invalid user admin from 183.81.169.238 port 59804
  ...

• Oct 3 13:04:54 AbuseCatcher sshd[77634]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 13:04:55 AbuseCatcher sshd[77634]: Failed password for root from 183.81.169.238 port 51698 ssh2
  ...

• tcp/22 (28 or more attempts)

• Oct 3 13:03:29 kroki sshd[306613]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 13:03:30 kroki sshd[306613]: Failed password for root from 183.81.169.238 port 50670 ssh2
  Oct 3 13:03:33 kroki sshd[306617]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 13:03:35 kroki sshd[306617]: Failed password for root from 183.81.169.238 port 50682 ssh2
  ...

• Oct 3 13:03:31 javastart sshd[4085083]: Failed password for root from 183.81.169.238 port 47864 ssh2
  Oct 3 13:03:34 javastart sshd[4085119]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 13:03:35 javastart sshd[4085119]: Failed password for root from 183.81.169.238 port 47910 ssh2
  Oct 3 13:03:39 javastart sshd[4085121]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 13:03:41 javastart sshd[4085121]: Failed password for root from 183.81.169.238 port 38140 ssh2
  ...

• I1003 13:01:58.227125 1 client.go:99] CLOSE host=183.81.169.238 port=53458 time=96.585824126 bytes=271
  ...

• 2024-10-03T13:01:55.786414vmi1671272.contaboserver.net sshd[151428]: Failed password for root from 183.81.169.238 port 45254 ssh2
  2024-10-03T13:01:59.094285vmi1671272.contaboserver.net sshd[151430]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T13:02:00.930669vmi1671272.contaboserver.net sshd[151430]: Failed password for root from 183.81.169.238 port 37476 ssh2
  2024-10-03T13:02:04.498357vmi1671272.contaboserver.net sshd[151482]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T13:02:06.018630vmi1671272.contaboserver.net sshd[151482]: Failed password for root from 183.81.169.238 port 37484 ssh2

• Oct 3 11:02:00 destiny sshd[2088933]: Connection closed by invalid user root 183.81.169.238 port 34240 [preauth]
  Oct 3 11:02:01 destiny sshd[2088935]: User root not allowed because account is locked
  Oct 3 11:02:01 destiny sshd[2088935]: Connection closed by invalid user root 183.81.169.238 port 34268 [preauth]
  Oct 3 11:02:03 destiny sshd[2088942]: User root not allowed because account is locked
  Oct 3 11:02:03 destiny sshd[2088942]: Connection closed by invalid user root 183.81.169.238 port 34276 [preauth]
  ...

• Oct 3 10:58:28 internal-mail-rafled-com sshd[1117339]: Invalid user Antminer from 183.81.169.238 port 40796
  ...

• 2024-10-03T12:57:27.004226+02:00 servidor1 sshd[413859]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-03T12:57:27.748993+02:00 servidor1 sshd[413859]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T12:57:29.244044+02:00 servidor1 sshd[413859]: Failed password for invalid user root from 183.81.169.238 port 59404 ssh2
  2024-10-03T12:57:31.554571+02:00 servidor1 sshd[413867]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-03T12:57:31.971803+02:00 servidor1 sshd[413867]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T12:57:34.018195+02:00 servidor1 sshd[413867]: Failed password for invalid user root from 183.81.169.238 port 59414 ssh2
  2024-10-03T12:57:37.233244+02:00 servidor1 sshd[413869]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  ...

• Oct 3 10:57:28 VPS sshd[1812708]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 10:57:29 VPS sshd[1812708]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 10:57:28 VPS sshd[1812708]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 10:57:30 VPS sshd[1812708]: Failed password for invalid user root from 183.81.169.238 port 55428 ssh2
  Oct 3 10:57:32 VPS sshd[1812718]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  ...

• Oct 3 12:57:17 Ina sshd[1993425]: Failed password for root from 183.81.169.238 port 33976 ssh2
  Oct 3 12:57:19 Ina sshd[1993427]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 12:57:21 Ina sshd[1993427]: Failed password for root from 183.81.169.238 port 42740 ssh2
  Oct 3 12:57:25 Ina sshd[1993429]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 12:57:27 Ina sshd[1993429]: Failed password for root from 183.81.169.238 port 42768 ssh2
  ...

• [rede-164-29] (sshd) Failed SSH login from 183.81.169.238 (NL/The Netherlands/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Oct 3 07:55:10 sshd[29598]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=[USERNAME]
  Oct 3 07:55:12 sshd[29598]: Failed password for [USERNAME] from 183.81.169.238 port 55556 ssh2
  Oct 3 07:55:15 sshd[29602]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=[USERNAME]
  Oct 3 07:55:17 sshd[29602]: Failed password for [USERNAME] from 183.81.169.238 port 55594 ssh2
  Oct 3 07:

• Inteceptor Intrusion Detector: failed_password on sshd module PID: (1141834)

• 2024-10-03T07:51:44.290107-03:00 dns1 sshd[20260]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T07:51:46.699490-03:00 dns1 sshd[20260]: Failed password for root from 183.81.169.238 port 46236 ssh2
  2024-10-03T07:51:47.383415-03:00 dns1 sshd[20260]: Connection closed by authenticating user root 183.81.169.238 port 46236 [preauth]
  2024-10-03T07:51:51.347659-03:00 dns1 sshd[20262]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T07:51:53.386026-03:00 dns1 sshd[20262]: Failed password for root from 183.81.169.238 port 46376 ssh2

• Oct 3 13:51:06 server2 sshd\[8325\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 13:51:08 server2 sshd\[8327\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 13:51:09 server2 sshd\[8329\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 13:51:11 server2 sshd\[8331\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 13:51:12 server2 sshd\[8333\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 13:51:14 server2 sshd\[8335\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers

• Oct 3 12:49:53 pinkypie sshd[82363]: Failed password for root from 183.81.169.238 port 47654 ssh2
  Oct 3 12:49:58 pinkypie sshd[82365]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 12:49:59 pinkypie sshd[82365]: Failed password for root from 183.81.169.238 port 46394 ssh2
  ...

• Oct 3 10:49:46 mlat sshd[3119354]: Failed password for root from 183.81.169.238 port 37438 ssh2
  Oct 3 10:49:49 mlat sshd[3119359]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 10:49:51 mlat sshd[3119359]: Failed password for root from 183.81.169.238 port 58662 ssh2
  ... azuremlat

• 10/03/2024-12:48:58.174535 183.81.169.238 Protocol: 6 ET COMPROMISED Known Compromised or Hostile Host Traffic group 13

• Oct 3 12:47:59 m2369 sshd[895379]: Failed password for root from 183.81.169.238 port 37102 ssh2
  Oct 3 12:48:03 m2369 sshd[895381]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 12:48:05 m2369 sshd[895381]: Failed password for root from 183.81.169.238 port 37134 ssh2
  Oct 3 12:48:08 m2369 sshd[895416]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 12:48:10 m2369 sshd[895416]: Failed password for root from 183.81.169.238 port 56800 ssh2
  ...

• Oct 3 12:47:51 git sshd[554593]: Invalid user Antminer from 183.81.169.238 port 34342
  Oct 3 12:47:53 git sshd[554595]: Invalid user Antminer from 183.81.169.238 port 34374
  Oct 3 12:48:04 git sshd[554607]: Invalid user admin from 183.81.169.238 port 56580
  ...

• 2024-10-03T10:47:21.126080+00:00 Linux05 sshd[20095]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T10:47:22.760877+00:00 Linux05 sshd[20095]: Failed password for root from 183.81.169.238 port 50402 ssh2
  2024-10-03T10:47:25.870580+00:00 Linux05 sshd[20330]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T10:47:28.057645+00:00 Linux05 sshd[20330]: Failed password for root from 183.81.169.238 port 50422 ssh2
  2024-10-03T10:47:32.774869+00:00 Linux05 sshd[20684]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T10:47:34.585980+00:00 Linux05 sshd[20684]: Failed password for root from 183.81.169.238 port 35522 ssh2
  2024-10-03T10:47:37.748169+00:00 Linux05 sshd[20867]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.16
  ...

• Oct 3 10:47:12 s158416 sshd[2752963]: Failed password for root from 183.81.169.238 port 53962 ssh2
  Oct 3 10:47:15 s158416 sshd[2752965]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 10:47:17 s158416 sshd[2752965]: Failed password for root from 183.81.169.238 port 38116 ssh2
  Oct 3 10:47:21 s158416 sshd[2752968]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 10:47:23 s158416 sshd[2752968]: Failed password for root from 183.81.169.238 port 38174 ssh2
  ...

• Oct 3 12:45:40 summercityrp sshd[1634188]: Failed password for root from 183.81.169.238 port 60204 ssh2
  Oct 3 12:45:44 summercityrp sshd[1634193]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 12:45:45 summercityrp sshd[1634193]: Failed password for root from 183.81.169.238 port 60254 ssh2
  Oct 3 12:45:48 summercityrp sshd[1634198]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 12:45:50 summercityrp sshd[1634198]: Failed password for root from 183.81.169.238 port 43934 ssh2
  Oct 3 12:45:54 summercityrp sshd[1634203]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 12:45:57 summercityrp sshd[1634203]: Failed password for root from 183.81.169.238 port 43976 ssh2
  ...

• Funeypot detected 4404 ssh attempts in 573h1m24s. Last by user "root", password "*", client "Go".

• 2024-10-03 05:46:20,872 fail2ban.actions [974]: NOTICE [sshd] Ban 183.81.169.238

• Oct 3 10:45:27 cknpih001 sshd[36135]: Failed password for root from 183.81.169.238 port 59562 ssh2
  Oct 3 10:45:32 cknpih001 sshd[36137]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 10:45:34 cknpih001 sshd[36137]: Failed password for root from 183.81.169.238 port 51058 ssh2
  Oct 3 10:45:38 cknpih001 sshd[36139]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 10:45:39 cknpih001 sshd[36139]: Failed password for root from 183.81.169.238 port 52392 ssh2
  ...

• Oct 3 12:44:53 arayat sshd[5858]: Failed password for root from 183.81.169.238 port 51682 ssh2
  Oct 3 12:44:56 arayat sshd[5862]: Failed password for root from 183.81.169.238 port 51706 ssh2
  Oct 3 12:44:58 arayat sshd[5864]: Failed password for root from 183.81.169.238 port 55328 ssh2
  Oct 3 12:45:00 arayat sshd[5866]: Failed password for root from 183.81.169.238 port 55334 ssh2
  ...

• Oct 3 12:44:00 maximus sshd[74139]: Failed password for root from 183.81.169.238 port 40018 ssh2
  Oct 3 12:44:04 maximus sshd[74156]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 12:44:05 maximus sshd[74156]: Failed password for root from 183.81.169.238 port 40044 ssh2
  Oct 3 12:44:08 maximus sshd[74158]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 12:44:10 maximus sshd[74158]: Failed password for root from 183.81.169.238 port 44042 ssh2
  ...

• 2024-10-03T10:44:00.644176+00:00 virt-hur-fmt-01.pdx.net.uk sshd[194166]: Invalid user Antminer from 183.81.169.238 port 49386
  2024-10-03T10:44:03.223511+00:00 virt-hur-fmt-01.pdx.net.uk sshd[194198]: Invalid user Antminer from 183.81.169.238 port 49394
  2024-10-03T10:44:18.601742+00:00 virt-hur-fmt-01.pdx.net.uk sshd[194249]: Invalid user admin from 183.81.169.238 port 41822
  ...

• 2024-10-03T12:43:55.367456 prodgateway sshd[64291]: Failed password for root from 183.81.169.238 port 47378 ssh2
  2024-10-03T12:43:57.865458 prodgateway sshd[64294]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T12:43:59.496364 prodgateway sshd[64294]: Failed password for root from 183.81.169.238 port 59014 ssh2
  ...

• 2024-10-03T03:42:59.770043-07:00 panduhstudios sshd[2859402]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T03:43:02.103166-07:00 panduhstudios sshd[2859402]: Failed password for root from 183.81.169.238 port 42732 ssh2
  2024-10-03T03:43:06.561009-07:00 panduhstudios sshd[2859411]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T03:43:08.522143-07:00 panduhstudios sshd[2859411]: Failed password for root from 183.81.169.238 port 42754 ssh2
  ...

• 2024-10-03T12:41:49.171161+02:00 cloud..de sshd[2458000]: Invalid user Antminer from 183.81.169.238 port 41074
  2024-10-03T12:41:50.734095+02:00 cloud..de sshd[2458003]: Invalid user Antminer from 183.81.169.238 port 41076
  2024-10-03T12:42:00.751994+02:00 cloud..de sshd[2458015]: Invalid user admin from 183.81.169.238 port 45634

• 2024-10-03T06:41:41.525654-04:00 prod-1 sshd[3602024]: Connection closed by authenticating user root 183.81.169.238 port 58498 [preauth]
  2024-10-03T06:41:44.249739-04:00 prod-1 sshd[3602026]: Connection closed by authenticating user root 183.81.169.238 port 58544 [preauth]
  2024-10-03T06:41:45.908095-04:00 prod-1 sshd[3602036]: Connection closed by authenticating user root 183.81.169.238 port 39300 [preauth]
  2024-10-03T06:41:48.090093-04:00 prod-1 sshd[3602039]: Connection closed by authenticating user root 183.81.169.238 port 39304 [preauth]
  2024-10-03T06:41:50.061268-04:00 prod-1 sshd[3602041]: Connection closed by authenticating user root 183.81.169.238 port 39338 [preauth]
  ...

• 2024-10-03T12:41:09.956773+02:00 ubuntu sshd[163082]: Failed password for root from 183.81.169.238 port 42878 ssh2
  2024-10-03T12:41:11.698376+02:00 ubuntu sshd[163084]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T12:41:13.208318+02:00 ubuntu sshd[163084]: Failed password for root from 183.81.169.238 port 42900 ssh2
  2024-10-03T12:41:15.544207+02:00 ubuntu sshd[163088]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T12:41:17.600986+02:00 ubuntu sshd[163088]: Failed password for root from 183.81.169.238 port 58322 ssh2
  ...

• 2024-10-03T17:40:24.428195+07:00 BAW-C03 sshd[64673]: Failed password for root from 183.81.169.238 port 36016 ssh2
  2024-10-03T17:40:29.523044+07:00 BAW-C03 sshd[64675]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T17:40:31.600130+07:00 BAW-C03 sshd[64675]: Failed password for root from 183.81.169.238 port 45100 ssh2
  2024-10-03T17:40:36.652335+07:00 BAW-C03 sshd[64677]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T17:40:38.689300+07:00 BAW-C03 sshd[64677]: Failed password for root from 183.81.169.238 port 45124 ssh2
  ...

• Oct 3 04:40:10 mortgagebase sshd[23010]: Failed password for root from 183.81.169.238 port 38566 ssh2
  Oct 3 04:40:14 mortgagebase sshd[23014]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 04:40:16 mortgagebase sshd[23014]: Failed password for root from 183.81.169.238 port 38588 ssh2
  Oct 3 04:40:18 mortgagebase sshd[23017]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 04:40:21 mortgagebase sshd[23017]: Failed password for root from 183.81.169.238 port 58058 ssh2
  ...

• Oct 3 13:39:12 www sshd\[59488\]: Failed password for root from 183.81.169.238 port 49832 ssh2Oct 3 13:39:16 www sshd\[59490\]: Failed password for root from 183.81.169.238 port 49868 ssh2Oct 3 13:39:21 www sshd\[59492\]: Failed password for root from 183.81.169.238 port 36882 ssh2
  ...

• FW-PortScan: Traffic Blocked srcport=55192 dstport=22

• Oct 3 10:35:41 DuoX sshd[3796893]: Failed password for root from 183.81.169.238 port 57896 ssh2
  Oct 3 10:35:46 DuoX sshd[3799400]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 10:35:49 DuoX sshd[3799400]: Failed password for root from 183.81.169.238 port 57920 ssh2
  Oct 3 10:35:52 DuoX sshd[3801312]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 10:35:54 DuoX sshd[3801312]: Failed password for root from 183.81.169.238 port 48876 ssh2
  ...

• Oct 3 10:35:31 proxy sshd[1591638]: Invalid user Antminer from 183.81.169.238 port 56424
  ...

• Oct 3 12:34:33 dev0-dcde-rnet sshd[13286]: Failed password for root from 183.81.169.238 port 56912 ssh2
  Oct 3 12:34:37 dev0-dcde-rnet sshd[13288]: Failed password for root from 183.81.169.238 port 56924 ssh2

• Oct 3 13:32:51 localhost sshd[1366525]: Failed password for root from 183.81.169.238 port 55726 ssh2
  Oct 3 13:32:54 localhost sshd[1366531]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 13:32:57 localhost sshd[1366531]: Failed password for root from 183.81.169.238 port 55742 ssh2
  Oct 3 13:33:01 localhost sshd[1366541]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 13:33:03 localhost sshd[1366541]: Failed password for root from 183.81.169.238 port 45436 ssh2
  ...

• Oct 3 12:32:09 hosting09 sshd[851324]: Failed password for root from 183.81.169.238 port 56746 ssh2
  Oct 3 12:32:11 hosting09 sshd[851384]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 12:32:13 hosting09 sshd[851384]: Failed password for root from 183.81.169.238 port 56760 ssh2
  ...

• 2024-10-03T12:32:13.039457+02:00 srv1 sshd[81539]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T12:32:14.689583+02:00 srv1 sshd[81539]: Failed password for root from 183.81.169.238 port 34294 ssh2
  ...

• Oct 3 12:32:10 AbuseCatcher sshd[73800]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 12:32:12 AbuseCatcher sshd[73800]: Failed password for root from 183.81.169.238 port 33938 ssh2
  ...

• Oct 3 06:31:38 graph sshd[2060804]: Failed password for root from 183.81.169.238 port 36382 ssh2
  Oct 3 06:31:42 graph sshd[2060806]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:31:44 graph sshd[2060806]: Failed password for root from 183.81.169.238 port 36384 ssh2
  Oct 3 06:31:48 graph sshd[2060818]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:31:50 graph sshd[2060818]: Failed password for root from 183.81.169.238 port 36224 ssh2
  ...

• 2024-10-03T12:31:40.099930+02:00 nc1.motyka.pro sshd[3510758]: Failed password for root from 183.81.169.238 port 60972 ssh2
  2024-10-03T12:31:42.589192+02:00 nc1.motyka.pro sshd[3510778]: Failed password for root from 183.81.169.238 port 60988 ssh2
  2024-10-03T12:31:44.682903+02:00 nc1.motyka.pro sshd[3510890]: Failed password for root from 183.81.169.238 port 60990 ssh2
  2024-10-03T12:31:46.639587+02:00 nc1.motyka.pro sshd[3510917]: Failed password for root from 183.81.169.238 port 53708 ssh2
  2024-10-03T12:31:49.178027+02:00 nc1.motyka.pro sshd[3511060]: Failed password for root from 183.81.169.238 port 53732 ssh2
  ...

• Oct 3 12:28:55 v4940 sshd[3995004]: Failed password for root from 183.81.169.238 port 56372 ssh2
  Oct 3 12:28:58 v4940 sshd[3995006]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 12:29:00 v4940 sshd[3995006]: Failed password for root from 183.81.169.238 port 38526 ssh2
  ...

• Oct 3 12:28:57 vmi1008219 sshd[406653]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 12:28:59 vmi1008219 sshd[406653]: Failed password for root from 183.81.169.238 port 58846 ssh2
  ...

• Oct 3 12:28:21 BalkanEmpireRP sshd[384163]: Failed password for root from 183.81.169.238 port 46978 ssh2
  Oct 3 12:28:24 BalkanEmpireRP sshd[384170]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 12:28:26 BalkanEmpireRP sshd[384170]: Failed password for root from 183.81.169.238 port 45428 ssh2
  Oct 3 12:28:29 BalkanEmpireRP sshd[384177]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 12:28:31 BalkanEmpireRP sshd[384177]: Failed password for root from 183.81.169.238 port 45486 ssh2
  Oct 3 12:28:35 BalkanEmpireRP sshd[384184]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 12:28:37 BalkanEmpireRP sshd[384184]: Failed password for root from 183.81.169.238 port 50652 ssh2
  ...

• 2024-10-03T13:28:26.355034+03:00 oh6ah sshd[1962510]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T13:28:28.507630+03:00 oh6ah sshd[1962510]: Failed password for root from 183.81.169.238 port 34068 ssh2
  ...

• unauthorized connection with user "root" and password "0" at 2024-10-03T10:27:05Z

• 2024-10-03T10:25:34.766915+00:00 srv67 sshd[31931]: Connection closed by authenticating user root 183.81.169.238 port 40396 [preauth]
  ...

• 2024-10-03T12:25:13.358874+02:00 vmi985635.contaboserver.net sshd[2597632]: Failed password for root from 183.81.169.238 port 53772 ssh2
  2024-10-03T12:25:16.434993+02:00 vmi985635.contaboserver.net sshd[2597660]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T12:25:18.414577+02:00 vmi985635.contaboserver.net sshd[2597660]: Failed password for root from 183.81.169.238 port 60208 ssh2
  2024-10-03T12:25:22.016299+02:00 vmi985635.contaboserver.net sshd[2597690]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T12:25:23.434588+02:00 vmi985635.contaboserver.net sshd[2597690]: Failed password for root from 183.81.169.238 port 60320 ssh2
  ...

• Oct 3 12:24:52 [redacted] sshd[1638462]: Failed password for [redacted] from 183.81.169.238 port 34048 ssh2
  Oct 3 12:24:53 [redacted] sshd[1638466]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=[redacted]
  Oct 3 12:24:55 [redacted] sshd[1638466]: Failed password for [redacted] from 183.81.169.238 port 34070 ssh2
  Oct 3 12:24:57 [redacted] sshd[1638470]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=[redacted]
  Oct 3 12:25:00 [redacted] sshd[1638470]: Failed password for [redacted] from 183.81.169.238 port 47202 ssh2
  ...

• Oct 3 10:24:58 ice2 sshd[1967659]: Invalid user Antminer from 183.81.169.238 port 50152
  Oct 3 10:24:59 ice2 sshd[1967661]: Invalid user Antminer from 183.81.169.238 port 50164
  ...

• Oct 3 12:23:35 vps2 sshd[1826889]: Invalid user Antminer from 183.81.169.238 port 59134
  Oct 3 12:23:37 vps2 sshd[1826891]: Invalid user Antminer from 183.81.169.238 port 59144
  Oct 3 12:23:48 vps2 sshd[1826903]: Invalid user admin from 183.81.169.238 port 37394
  Oct 3 12:23:50 vps2 sshd[1826905]: Invalid user baikal from 183.81.169.238 port 37400
  ...

• [10:23] Attempted SSH login on port 22 with credentials root:0

• 2024-10-03T12:22:39.926434+02:00 devcricle sshd[1497]: Failed password for root from 183.81.169.238 port 52802 ssh2
  2024-10-03T12:22:44.141424+02:00 devcricle sshd[1499]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T12:22:46.346333+02:00 devcricle sshd[1499]: Failed password for root from 183.81.169.238 port 52816 ssh2
  ...

• Oct 3 12:22:00 qube2 sshd[198439]: Failed password for root from 183.81.169.238 port 41748 ssh2
  Oct 3 12:22:04 qube2 sshd[198753]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 12:22:05 qube2 sshd[198753]: Failed password for root from 183.81.169.238 port 41762 ssh2
  ...

• Oct 3 12:20:55 markkoudstaal sshd[2929052]: Failed password for root from 183.81.169.238 port 55620 ssh2
  Oct 3 12:20:58 markkoudstaal sshd[2929098]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 12:20:59 markkoudstaal sshd[2929098]: Failed password for root from 183.81.169.238 port 37332 ssh2
  ...

• Oct 3 11:20:32 dev sshd[92480]: Failed password for root from 183.81.169.238 port 33670 ssh2
  Oct 3 11:20:35 dev sshd[92482]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 11:20:37 dev sshd[92482]: Failed password for root from 183.81.169.238 port 33690 ssh2
  Oct 3 11:20:40 dev sshd[92484]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 11:20:42 dev sshd[92484]: Failed password for root from 183.81.169.238 port 52586 ssh2
  ...

• Oct 3 07:18:55 SRC=183.81.169.238 PROTO=TCP SPT=33342 DPT=22 SYN
  ...

• 2024-10-03T10:18:48.510034+00:00 mail-backup sshd[63234]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-03T10:18:51.055116+00:00 mail-backup sshd[63236]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-03T10:18:52.992022+00:00 mail-backup sshd[63238]: User root from 183.81.169.238 not allowed because not listed in AllowUsers

• Oct 3 12:17:29 vmi174663 sshd[2300590]: Failed password for root from 183.81.169.238 port 52682 ssh2
  Oct 3 12:17:32 vmi174663 sshd[2300621]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 12:17:34 vmi174663 sshd[2300621]: Failed password for root from 183.81.169.238 port 52690 ssh2
  Oct 3 12:17:38 vmi174663 sshd[2300664]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 12:17:40 vmi174663 sshd[2300664]: Failed password for root from 183.81.169.238 port 54896 ssh2
  ...

• 2024-10-03T10:15:44.130293+00:00 Linux06 sshd[1446217]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T10:15:46.674074+00:00 Linux06 sshd[1446217]: Failed password for root from 183.81.169.238 port 47938 ssh2
  2024-10-03T10:15:50.999222+00:00 Linux06 sshd[1446475]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T10:15:52.698299+00:00 Linux06 sshd[1446475]: Failed password for root from 183.81.169.238 port 47380 ssh2
  2024-10-03T10:15:55.959992+00:00 Linux06 sshd[1446785]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T10:15:58.347981+00:00 Linux06 sshd[1446785]: Failed password for root from 183.81.169.238 port 47390 ssh2
  2024-10-03T10:16:02.832785+00:00 Linux06 sshd[1447133]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= r
  ...

• 2024-10-03T06:15:53.560210-04:00 collabhost.computernewb.com sshd-session[3715570]: Invalid user Antminer from 183.81.169.238 port 44318
  2024-10-03T06:15:56.124268-04:00 collabhost.computernewb.com sshd-session[3715573]: Invalid user Antminer from 183.81.169.238 port 33402
  2024-10-03T06:16:09.374287-04:00 collabhost.computernewb.com sshd-session[3715596]: Invalid user admin from 183.81.169.238 port 49648
  ...

• FW-PortScan: Traffic Blocked srcport=59906 dstport=22

• 2024-10-03T12:13:35.871652+02:00 pokevador sshd[826138]: Failed password for root from 183.81.169.238 port 46114 ssh2
  2024-10-03T12:13:39.347425+02:00 pokevador sshd[826182]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T12:13:41.063245+02:00 pokevador sshd[826182]: Failed password for root from 183.81.169.238 port 56616 ssh2
  ...

• Oct 3 12:10:45 GangLandRP sshd[315067]: Failed password for root from 183.81.169.238 port 42496 ssh2
  Oct 3 12:10:49 GangLandRP sshd[315072]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 12:10:52 GangLandRP sshd[315072]: Failed password for root from 183.81.169.238 port 54756 ssh2
  Oct 3 12:10:56 GangLandRP sshd[315077]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 12:10:58 GangLandRP sshd[315077]: Failed password for root from 183.81.169.238 port 54780 ssh2
  Oct 3 12:11:00 GangLandRP sshd[315082]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 12:11:03 GangLandRP sshd[315082]: Failed password for root from 183.81.169.238 port 46366 ssh2
  ...

• Oct 3 12:46:59 Digitalogic sshd[1464478]: Connection closed by authenticating user root 183.81.169.238 port 36234 [preauth]
  Oct 3 13:40:25 Digitalogic sshd[1479089]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 13:40:27 Digitalogic sshd[1479089]: Failed password for root from 183.81.169.238 port 49092 ssh2
  ...

• Unauthorized connection attempt detected from IP address 183.81.169.238 to port 22 (ger-03) [N]

• Oct 3 12:07:07 docker-01 sshd[312786]: Failed password for root from 183.81.169.238 port 58668 ssh2
  Oct 3 12:07:09 docker-01 sshd[312788]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 12:07:11 docker-01 sshd[312788]: Failed password for root from 183.81.169.238 port 33650 ssh2
  Oct 3 12:07:14 docker-01 sshd[312827]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 12:07:16 docker-01 sshd[312827]: Failed password for root from 183.81.169.238 port 33672 ssh2
  ...

• 2024-10-03T10:07:00.530255shield sshd\[5765\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T10:07:02.471077shield sshd\[5765\]: Failed password for root from 183.81.169.238 port 39798 ssh2
  2024-10-03T10:07:04.880851shield sshd\[5783\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T10:07:07.036564shield sshd\[5783\]: Failed password for root from 183.81.169.238 port 39802 ssh2
  2024-10-03T10:07:09.696266shield sshd\[5785\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root

• 2024-10-03T10:06:24.850354+00:00 localhost sshd[2616262]: Connection closed by authenticating user root 183.81.169.238 port 45096 [preauth]
  2024-10-03T10:06:27.311858+00:00 localhost sshd[2616281]: Connection closed by authenticating user root 183.81.169.238 port 53382 [preauth]
  2024-10-03T10:06:29.655135+00:00 localhost sshd[2616300]: Connection closed by authenticating user root 183.81.169.238 port 53392 [preauth]
  2024-10-03T10:06:32.224393+00:00 localhost sshd[2616304]: Connection closed by authenticating user root 183.81.169.238 port 53418 [preauth]
  2024-10-03T10:06:34.474929+00:00 localhost sshd[2616325]: Connection closed by authenticating user root 183.81.169.238 port 53422 [preauth]
  ...

• 2024-10-03T12:04:04.387981+02:00 secure sshd[52472]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-03T12:04:06.640072+02:00 secure sshd[52474]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-03T12:04:09.078336+02:00 secure sshd[52476]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  ...

• tcp/22 (19 or more attempts)

• 2024-10-03 05:03:29,584 fail2ban.actions [974]: NOTICE [sshd] Ban 183.81.169.238

• 2024-10-03T10:03:11.989174+00:00 cloud-server-0 sshd[2662362]: Failed password for root from 183.81.169.238 port 49114 ssh2
  2024-10-03T10:03:15.723379+00:00 cloud-server-0 sshd[2662364]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T10:03:17.776378+00:00 cloud-server-0 sshd[2662364]: Failed password for root from 183.81.169.238 port 32938 ssh2
  2024-10-03T10:03:21.398566+00:00 cloud-server-0 sshd[2662366]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T10:03:22.609140+00:00 cloud-server-0 sshd[2662366]: Failed password for root from 183.81.169.238 port 32966 ssh2
  ...

• 2024-10-03T10:03:09.434177+00:00 fluff sshd[82456]: Failed password for root from 183.81.169.238 port 37638 ssh2
  2024-10-03T10:03:13.533092+00:00 fluff sshd[82458]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T10:03:16.313196+00:00 fluff sshd[82458]: Failed password for root from 183.81.169.238 port 37656 ssh2
  2024-10-03T10:03:20.978336+00:00 fluff sshd[82460]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T10:03:22.719530+00:00 fluff sshd[82460]: Failed password for root from 183.81.169.238 port 50894 ssh2
  ...

• Oct 3 12:02:27 plesk sshd[23804]: Failed password for root from 183.81.169.238 port 58680 ssh2
  Oct 3 12:02:29 plesk sshd[23856]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 12:02:31 plesk sshd[23856]: Failed password for root from 183.81.169.238 port 58690 ssh2
  Oct 3 12:02:33 plesk sshd[23870]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 12:02:35 plesk sshd[23870]: Failed password for root from 183.81.169.238 port 58706 ssh2

• Oct 3 12:01:58 vmi440488 sshd[3559379]: Failed password for root from 183.81.169.238 port 40156 ssh2
  Oct 3 12:02:02 vmi440488 sshd[3559412]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 12:02:04 vmi440488 sshd[3559412]: Failed password for root from 183.81.169.238 port 40168 ssh2
  Oct 3 12:02:08 vmi440488 sshd[3559421]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 12:02:09 vmi440488 sshd[3559421]: Failed password for root from 183.81.169.238 port 47992 ssh2
  ...

• 2024-10-03T19:01:29.614126 mustar-kr-miso sshd[1458249]: Failed password for root from 183.81.169.238 port 51800 ssh2
  2024-10-03T19:01:33.855618 mustar-kr-miso sshd[1458252]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T19:01:35.572017 mustar-kr-miso sshd[1458252]: Failed password for root from 183.81.169.238 port 51854 ssh2
  2024-10-03T19:01:39.950474 mustar-kr-miso sshd[1458255]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T19:01:41.822634 mustar-kr-miso sshd[1458255]: Failed password for root from 183.81.169.238 port 49462 ssh2
  ...

• Oct 3 10:01:14 cloud-server-0 sshd[1862580]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 10:01:16 cloud-server-0 sshd[1862580]: Failed password for root from 183.81.169.238 port 41426 ssh2
  Oct 3 10:01:19 cloud-server-0 sshd[1862582]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 10:01:22 cloud-server-0 sshd[1862582]: Failed password for root from 183.81.169.238 port 57032 ssh2
  Oct 3 10:01:26 cloud-server-0 sshd[1862584]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 10:01:28 cloud-server-0 sshd[1862584]: Failed password for root from 183.81.169.238 port 60398 ssh2
  Oct 3 10:01:30 cloud-server-0 sshd[1862586]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 10:01:33 cloud-server-0 sshd[186
  ...

• Ports: 22; 2 attempts

• Oct 3 21:00:06 electronicohost sshd[2467137]: Failed password for root from 183.81.169.238 port 55026 ssh2
  Oct 3 21:00:09 electronicohost sshd[2467649]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 21:00:11 electronicohost sshd[2467649]: Failed password for root from 183.81.169.238 port 54380 ssh2
  Oct 3 21:00:14 electronicohost sshd[2467767]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 21:00:16 electronicohost sshd[2467767]: Failed password for root from 183.81.169.238 port 54406 ssh2

• 2024-10-03T11:59:13.922355+02:00 v220240537442267460 sshd[1475807]: Failed password for root from 183.81.169.238 port 58388 ssh2
  2024-10-03T11:59:15.949587+02:00 v220240537442267460 sshd[1475814]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T11:59:17.720984+02:00 v220240537442267460 sshd[1475814]: Failed password for root from 183.81.169.238 port 55944 ssh2
  2024-10-03T11:59:20.265031+02:00 v220240537442267460 sshd[1475820]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T11:59:22.056471+02:00 v220240537442267460 sshd[1475820]: Failed password for root from 183.81.169.238 port 55972 ssh2
  ...

• Oct 3 09:58:23 fedi sshd[3708511]: Invalid user Antminer from 183.81.169.238 port 52540
  Oct 3 09:58:25 fedi sshd[3708513]: Invalid user Antminer from 183.81.169.238 port 52544
  ...

• FW-PortScan: Traffic Blocked srcport=57936 dstport=22

• Oct 3 09:57:51 mail sshd[212286]: Failed password for root from 183.81.169.238 port 36596 ssh2
  Oct 3 09:57:55 mail sshd[212288]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 09:57:58 mail sshd[212288]: Failed password for root from 183.81.169.238 port 36608 ssh2
  ...

• 2024-10-03T11:56:55.338147+02:00 pve sshd[4044278]: Failed password for root from 183.81.169.238 port 55324 ssh2
  2024-10-03T11:56:57.832135+02:00 pve sshd[4044868]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T11:57:00.323627+02:00 pve sshd[4044868]: Failed password for root from 183.81.169.238 port 34436 ssh2
  2024-10-03T11:57:04.499634+02:00 pve sshd[4045443]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T11:57:05.954672+02:00 pve sshd[4045443]: Failed password for root from 183.81.169.238 port 34480 ssh2
  ...

• Oct 3 11:56:50 ifog sshd[86133]: Invalid user Antminer from 183.81.169.238 port 34306
  Oct 3 11:56:51 ifog sshd[86135]: Invalid user Antminer from 183.81.169.238 port 34322
  Oct 3 11:57:01 ifog sshd[86147]: Invalid user admin from 183.81.169.238 port 51914
  ...

• Oct 3 11:56:27 vps-9f3cdc33 sshd[1885335]: Failed password for root from 183.81.169.238 port 35496 ssh2
  Oct 3 11:56:28 vps-9f3cdc33 sshd[1885337]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 11:56:30 vps-9f3cdc33 sshd[1885337]: Failed password for root from 183.81.169.238 port 54186 ssh2
  Oct 3 11:56:33 vps-9f3cdc33 sshd[1885339]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 11:56:35 vps-9f3cdc33 sshd[1885339]: Failed password for root from 183.81.169.238 port 54202 ssh2
  ...

• endlessh: 2024-10-03 11:54:55.583823963 2024-10-03T09:54:55.583Z CLOSE host=183.81.169.238 port=58308 fd=8 time=170.050 bytes=269
  ...

• [rede-176-124] 10/03/2024-06:54:39.708122, 183.81.169.238, Protocol: 6, ET COMPROMISED Known Compromised or Hostile Host Traffic group 13

• Oct 3 02:53:33 cohoe sshd[3020009]: Failed password for root from 183.81.169.238 port 44728 ssh2
  Oct 3 02:53:37 cohoe sshd[3020011]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 02:53:38 cohoe sshd[3020011]: Failed password for root from 183.81.169.238 port 56750 ssh2
  Oct 3 02:53:42 cohoe sshd[3020015]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 02:53:44 cohoe sshd[3020015]: Failed password for root from 183.81.169.238 port 56792 ssh2
  ...

• 2024-10-03T10:48:40.840419+01:00 pbs-bit-lib-01.int.pdx.net.uk sshd[1989446]: Invalid user Antminer from 183.81.169.238 port 46796
  2024-10-03T10:48:42.497179+01:00 pbs-bit-lib-01.int.pdx.net.uk sshd[1989448]: Invalid user Antminer from 183.81.169.238 port 46798
  2024-10-03T10:48:57.392700+01:00 pbs-bit-lib-01.int.pdx.net.uk sshd[1989460]: Invalid user admin from 183.81.169.238 port 55436
  ...

• Oct 3 03:42:27 web2 sshd\[10240\]: Failed password for root from 183.81.169.238 port 37434 ssh2Oct 3 03:42:31 web2 sshd\[10242\]: Failed password for root from 183.81.169.238 port 37478 ssh2Oct 3 03:42:36 web2 sshd\[10244\]: Failed password for root from 183.81.169.238 port 47986 ssh2Oct 3 03:42:40 web2 sshd\[10246\]: Failed password for root from 183.81.169.238 port 47998 ssh2Oct 3 03:42:44 web2 sshd\[10248\]: Failed password for root from 183.81.169.238 port 48010 ssh2Oct 3 03:42:50 web2 sshd\[10250\]: Failed password for root from 183.81.169.238 port 43376 ssh2
  ...

• 2024-10-03T09:52:15.741795+00:00 Linux01 sshd[3978690]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T09:52:17.187467+00:00 Linux01 sshd[3978690]: Failed password for root from 183.81.169.238 port 35238 ssh2
  2024-10-03T09:52:19.369023+00:00 Linux01 sshd[3979029]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T09:52:20.698467+00:00 Linux01 sshd[3979029]: Failed password for root from 183.81.169.238 port 35262 ssh2
  2024-10-03T09:52:23.814923+00:00 Linux01 sshd[3979202]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T09:52:26.027557+00:00 Linux01 sshd[3979202]: Failed password for root from 183.81.169.238 port 35284 ssh2
  2024-10-03T09:52:30.451343+00:00 Linux01 sshd[3979748]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= r
  ...

• Oct 3 11:49:49 [redacted] sshd[3913208]: Failed password for [redacted] from 183.81.169.238 port 40176 ssh2
  Oct 3 11:49:52 [redacted] sshd[3913252]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=[redacted]
  Oct 3 11:49:54 [redacted] sshd[3913252]: Failed password for [redacted] from 183.81.169.238 port 40208 ssh2
  Oct 3 11:49:56 [redacted] sshd[3913296]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=[redacted]
  Oct 3 11:49:58 [redacted] sshd[3913296]: Failed password for [redacted] from 183.81.169.238 port 51440 ssh2
  ...

• 2024-10-03T10:48:58.735872+01:00 jane sshd[90371]: Failed password for root from 183.81.169.238 port 43202 ssh2
  2024-10-03T10:49:00.432544+01:00 jane sshd[90374]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T10:49:03.111812+01:00 jane sshd[90374]: Failed password for root from 183.81.169.238 port 43230 ssh2
  ...

• Oct 3 09:48:42 lavalink sshd[3414853]: Invalid user Antminer from 183.81.169.238 port 33890
  Oct 3 09:48:44 lavalink sshd[3414862]: Invalid user Antminer from 183.81.169.238 port 33900
  Oct 3 09:48:57 lavalink sshd[3414922]: Invalid user admin from 183.81.169.238 port 52620
  ...

• Oct 3 12:48:19 server2 sshd\[2246\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 12:48:20 server2 sshd\[2250\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 12:48:21 server2 sshd\[2253\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 12:48:22 server2 sshd\[2255\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 12:48:23 server2 sshd\[2257\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 12:48:25 server2 sshd\[2259\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers

• Oct 3 11:48:16 hosting08 sshd[26447]: Failed password for root from 183.81.169.238 port 58202 ssh2
  Oct 3 11:48:20 hosting08 sshd[26453]: Failed password for root from 183.81.169.238 port 48584 ssh2
  ...

• 2024-10-03T11:48:06.787562+02:00 mail sshd[652285]: Failed password for root from 183.81.169.238 port 49822 ssh2
  2024-10-03T11:48:10.378874+02:00 mail sshd[652288]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T11:48:12.190423+02:00 mail sshd[652288]: Failed password for root from 183.81.169.238 port 44030 ssh2
  2024-10-03T11:48:16.748337+02:00 mail sshd[652291]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T11:48:18.713291+02:00 mail sshd[652291]: Failed password for root from 183.81.169.238 port 34284 ssh2
  ...

• Oct 3 11:47:13 proxy sshd[307093]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 11:47:15 proxy sshd[307095]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 11:47:17 proxy sshd[307099]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  ...

• Oct 3 11:46:58 mx1 sshd[2015616]: Failed password for root from 183.81.169.238 port 36252 ssh2
  Oct 3 11:47:00 mx1 sshd[2015618]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 11:47:02 mx1 sshd[2015618]: Failed password for root from 183.81.169.238 port 36276 ssh2
  Oct 3 11:47:06 mx1 sshd[2015636]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 11:47:08 mx1 sshd[2015636]: Failed password for root from 183.81.169.238 port 58958 ssh2
  ...

• Oct 3 12:47:56 betelgeuse sshd[778371]: Invalid user Antminer from 183.81.169.238 port 34056
  Oct 3 12:47:58 betelgeuse sshd[779540]: Invalid user Antminer from 183.81.169.238 port 34080
  ...

• 2024-10-03T11:46:36.056851+02:00 srv1 sshd[3045480]: Failed password for root from 183.81.169.238 port 57484 ssh2
  2024-10-03T11:46:38.889000+02:00 srv1 sshd[3045484]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T11:46:40.735006+02:00 srv1 sshd[3045484]: Failed password for root from 183.81.169.238 port 60342 ssh2
  2024-10-03T11:46:43.010413+02:00 srv1 sshd[3045568]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T11:46:45.073119+02:00 srv1 sshd[3045568]: Failed password for root from 183.81.169.238 port 60380 ssh2
  ...

• 2024-10-03T11:45:22.974449+02:00 sasrv sshd[6397]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-03T11:45:24.823302+02:00 sasrv sshd[6399]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-03T11:45:26.348998+02:00 sasrv sshd[6401]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-03T11:45:28.062707+02:00 sasrv sshd[6403]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-03T11:45:29.847722+02:00 sasrv sshd[6405]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  ...

• 2024-10-03T09:46:28.339156us1.starnode.us sshd[1509374]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T09:46:29.813277us1.starnode.us sshd[1509374]: Failed password for root from 183.81.169.238 port 39736 ssh2
  ...

• 2024-10-03T17:44:59.602325+08:00 raindance sshd[425118]: Failed password for root from 183.81.169.238 port 56570 ssh2
  2024-10-03T17:45:05.105586+08:00 raindance sshd[425128]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T17:45:07.520059+08:00 raindance sshd[425128]: Failed password for root from 183.81.169.238 port 56612 ssh2
  2024-10-03T17:45:13.167765+08:00 raindance sshd[425132]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T17:45:14.679170+08:00 raindance sshd[425132]: Failed password for root from 183.81.169.238 port 41506 ssh2
  ...

• Firewall IPS Detection on 03-10-2024 at 11:45:05

• 2024-10-03T17:44:35.069954+08:00 VM65536 sshd[920119]: Connection closed by authenticating user root 183.81.169.238 port 59778 [preauth]
  2024-10-03T17:44:38.314356+08:00 VM65536 sshd[920121]: Connection closed by authenticating user root 183.81.169.238 port 38942 [preauth]
  2024-10-03T17:44:42.049852+08:00 VM65536 sshd[920123]: Connection closed by authenticating user root 183.81.169.238 port 38954 [preauth]
  ...

• 2024-10-03T04:43:37.257146-05:00 BAW-C02 sshd[4028125]: Failed password for root from 183.81.169.238 port 46208 ssh2
  2024-10-03T04:43:40.760768-05:00 BAW-C02 sshd[4028127]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T04:43:42.510322-05:00 BAW-C02 sshd[4028127]: Failed password for root from 183.81.169.238 port 40674 ssh2
  2024-10-03T04:43:46.241239-05:00 BAW-C02 sshd[4028129]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T04:43:48.146570-05:00 BAW-C02 sshd[4028129]: Failed password for root from 183.81.169.238 port 49268 ssh2
  ...

• 2024-10-03T11:42:01.470204+02:00 docker sshd[1908855]: Failed password for root from 183.81.169.238 port 60024 ssh2
  2024-10-03T11:42:04.219995+02:00 docker sshd[1908867]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T11:42:05.787050+02:00 docker sshd[1908867]: Failed password for root from 183.81.169.238 port 60060 ssh2
  2024-10-03T11:42:09.109896+02:00 docker sshd[1908879]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T11:42:11.028289+02:00 docker sshd[1908879]: Failed password for root from 183.81.169.238 port 43632 ssh2
  ...

• 2024-10-03 09:41:28,571 fail2ban.actions [624]: NOTICE [sshd] Ban 183.81.169.238

• Oct 3 09:40:58 ovh sshd[3476409]: Failed password for root from 183.81.169.238 port 56556 ssh2
  Oct 3 09:41:02 ovh sshd[3476513]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 09:41:04 ovh sshd[3476513]: Failed password for root from 183.81.169.238 port 56558 ssh2
  Oct 3 09:41:07 ovh sshd[3476554]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 09:41:09 ovh sshd[3476554]: Failed password for root from 183.81.169.238 port 58264 ssh2
  ...

• (sshd) Failed SSH login from 183.81.169.238 (NL/The Netherlands/North Holland/Amsterdam/-/[AS206264 Amarutu Technology Ltd]): 5 in the last 3600 secs; IP: 183.81.169.238; Ports: *; Direction: 0; Trigger: LF_SSHD; Logs: 2024-10-03T11:39:59.244980+02:00 insightVM sshd[3495769]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root 2024-10-03T11:40:01.317860+02:00 insightVM sshd[3495769]: Failed password for root from 183.81.169.238 port 36472 ssh2 2024-10-03T11:40:02.699474+02:00 insightVM sshd[3495786]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root 2024-10-03T11:40:04.516620+02:00 insightVM sshd[3495786]: Failed password for root from 183.81.169.238 port 36524 ssh2 2024-10-03T11:40:07.057459+02:00 insightVM sshd[3495799]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root

• Oct 3 05:39:55 scp sshd[3651775]: Invalid user Antminer from 183.81.169.238 port 33690
  Oct 3 05:39:57 scp sshd[3651829]: Invalid user Antminer from 183.81.169.238 port 38136
  Oct 3 05:40:08 scp sshd[3652153]: Invalid user admin from 183.81.169.238 port 40926
  ...

• Oct 3 09:39:40 s158416 sshd[2729587]: Failed password for root from 183.81.169.238 port 35424 ssh2
  Oct 3 09:39:43 s158416 sshd[2729604]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 09:39:45 s158416 sshd[2729604]: Failed password for root from 183.81.169.238 port 35440 ssh2
  Oct 3 09:39:49 s158416 sshd[2729606]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 09:39:51 s158416 sshd[2729606]: Failed password for root from 183.81.169.238 port 36416 ssh2
  ...

• Oct 3 11:38:54 SFEEDS sshd[493785]: Failed password for root from 183.81.169.238 port 49102 ssh2
  Oct 3 11:38:57 SFEEDS sshd[493788]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 11:38:58 SFEEDS sshd[493788]: Failed password for root from 183.81.169.238 port 42736 ssh2
  Oct 3 11:39:02 SFEEDS sshd[493792]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 11:39:04 SFEEDS sshd[493792]: Failed password for root from 183.81.169.238 port 42758 ssh2
  ...

• Oct 3 11:38:53 odin sshd[27047]: Failed password for root from 183.81.169.238 port 48400 ssh2
  Oct 3 11:38:57 odin sshd[27051]: Failed password for root from 183.81.169.238 port 35644 ssh2

• FW-PortScan: Traffic Blocked srcport=35766 dstport=22

• Oct 3 05:37:52 wise0wl sshd[3511983]: Invalid user Antminer from 183.81.169.238 port 35224
  Oct 3 05:37:54 wise0wl sshd[3512011]: Invalid user Antminer from 183.81.169.238 port 35238
  Oct 3 05:38:08 wise0wl sshd[3512191]: Invalid user admin from 183.81.169.238 port 39826
  ...

• 2024-10-03T05:38:00.019411-04:00 srv-UXQS4A.incognet.io sshd[1920]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T05:38:01.755938-04:00 srv-UXQS4A.incognet.io sshd[1920]: Failed password for invalid user root from 183.81.169.238 port 52878 ssh2
  ...

• Oct 3 09:37:52 cloud-server-0 sshd[2894302]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 09:37:54 cloud-server-0 sshd[2894302]: Failed password for root from 183.81.169.238 port 47672 ssh2
  ...

• Oct 3 09:36:33 webserver sshd[744799]: Failed password for root from 183.81.169.238 port 54896 ssh2
  Oct 3 09:36:37 webserver sshd[744801]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 09:36:39 webserver sshd[744801]: Failed password for root from 183.81.169.238 port 45632 ssh2
  Oct 3 09:36:43 webserver sshd[744803]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 09:36:46 webserver sshd[744803]: Failed password for root from 183.81.169.238 port 45654 ssh2
  ...

• Oct 3 09:36:30 web-proxy02 sshd[1601255]: Failed password for root from 183.81.169.238 port 59602 ssh2
  Oct 3 09:36:33 web-proxy02 sshd[1601257]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 09:36:35 web-proxy02 sshd[1601257]: Failed password for root from 183.81.169.238 port 59626 ssh2
  ...

• Oct 3 09:35:29 ns5024002 sshd[2958192]: Failed password for root from 183.81.169.238 port 43838 ssh2
  Oct 3 09:35:33 ns5024002 sshd[2958316]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 09:35:35 ns5024002 sshd[2958316]: Failed password for root from 183.81.169.238 port 43854 ssh2
  Oct 3 09:35:39 ns5024002 sshd[2958460]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 09:35:40 ns5024002 sshd[2958460]: Failed password for root from 183.81.169.238 port 49190 ssh2
  ...

• Oct 3 09:34:44 scw-6657dc sshd[20230]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 09:34:44 scw-6657dc sshd[20230]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 09:34:46 scw-6657dc sshd[20230]: Failed password for root from 183.81.169.238 port 55568 ssh2
  ...

• SSH port scan (Tarpitted for 2m40s, wasted 265B)

• 2024-10-03T11:33:58.979720+02:00 Webserver sshd[702187]: Failed password for root from 183.81.169.238 port 36040 ssh2
  2024-10-03T11:34:02.427394+02:00 Webserver sshd[702189]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T11:34:04.490045+02:00 Webserver sshd[702189]: Failed password for root from 183.81.169.238 port 36066 ssh2
  2024-10-03T11:34:06.906147+02:00 Webserver sshd[702191]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T11:34:08.853234+02:00 Webserver sshd[702191]: Failed password for root from 183.81.169.238 port 55680 ssh2
  ...

• 2024-10-03 06:44:01 UTC Unauthorized activity to TCP port 22. SSH

• [rede-166-249] (sshd) Failed SSH login from 183.81.169.238 (NL/The Netherlands/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Oct 3 06:29:28 sshd[9321]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=[USERNAME]
  Oct 3 06:29:30 sshd[9321]: Failed password for [USERNAME] from 183.81.169.238 port 58338 ssh2
  Oct 3 06:29:33 sshd[9330]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=[USERNAME]
  Oct 3 06:29:35 sshd[9330]: Failed password for [USERNAME] from 183.81.169.238 port 58390 ssh2
  Oct 3 06:29:3

• Oct 3 11:29:19 ts-24 sshd[401370]: Failed password for root from 183.81.169.238 port 35050 ssh2
  Oct 3 11:29:22 ts-24 sshd[401374]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 11:29:24 ts-24 sshd[401374]: Failed password for root from 183.81.169.238 port 35058 ssh2
  Oct 3 11:29:26 ts-24 sshd[401378]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 11:29:29 ts-24 sshd[401378]: Failed password for root from 183.81.169.238 port 53930 ssh2
  ...

• Oct 3 16:28:45 honeypot sshd[19067]: Failed password for root from 183.81.169.238 port 39914 ssh2
  ...

• Erroneous Connections to port(s) (22) (8 Events between 2024-10-02 00:00 and 2024-10-03 00:00)

• Oct 3 11:27:33 BulgarianSquad sshd[257599]: Failed password for root from 183.81.169.238 port 45058 ssh2
  Oct 3 11:27:36 BulgarianSquad sshd[257604]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 11:27:38 BulgarianSquad sshd[257604]: Failed password for root from 183.81.169.238 port 45072 ssh2
  Oct 3 11:27:41 BulgarianSquad sshd[257610]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 11:27:43 BulgarianSquad sshd[257610]: Failed password for root from 183.81.169.238 port 56950 ssh2
  Oct 3 11:27:46 BulgarianSquad sshd[257615]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 11:27:48 BulgarianSquad sshd[257615]: Failed password for root from 183.81.169.238 port 56980 ssh2
  ...

• Oct 3 11:25:04 vps643776 sshd[1293504]: Failed password for root from 183.81.169.238 port 34262 ssh2
  Oct 3 11:25:08 vps643776 sshd[1293506]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 11:25:10 vps643776 sshd[1293506]: Failed password for root from 183.81.169.238 port 60868 ssh2
  Oct 3 11:25:13 vps643776 sshd[1293508]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 11:25:16 vps643776 sshd[1293508]: Failed password for root from 183.81.169.238 port 60882 ssh2
  ...

• Unauthorized attempt on (TCP on port 22).
  Source port: 51349
  TTL: 247
  Packet length: 40
  Timestamp: 2024-10-03 11:24:57

• 2024-10-03 02:23:08,779 fail2ban.actions [689]: NOTICE [sshd] Ban 183.81.169.238

• Oct 3 11:22:53 C1D543E sshd[777680]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 11:22:53 C1D543E sshd[777680]: Failed password for invalid user root from 183.81.169.238 port 59856 ssh2
  Oct 3 11:22:55 C1D543E sshd[777682]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 11:22:55 C1D543E sshd[777682]: Failed password for invalid user root from 183.81.169.238 port 33534 ssh2
  Oct 3 11:22:57 C1D543E sshd[777684]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  ...

• Oct 3 05:17:56 fremontnet-scca-01 sshd[19543]: Failed password for root from 183.81.169.238 port 52638 ssh2
  Oct 3 05:18:01 fremontnet-scca-01 sshd[19545]: Failed password for root from 183.81.169.238 port 53440 ssh2

• Oct 3 04:17:16 ivankin sshd[438131]: Failed password for root from 183.81.169.238 port 59788 ssh2
  Oct 3 04:17:20 ivankin sshd[438133]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 04:17:22 ivankin sshd[438133]: Failed password for root from 183.81.169.238 port 33362 ssh2
  ...

• FW-PortScan: Traffic Blocked srcport=35386 dstport=22

• Events: TCP SYN Discovery or Flooding, Seen 135 times in the last 10800 seconds

• 2024-10-03T11:15:06.766306+02:00 nc2.motyka.pro sshd[3815450]: Failed password for root from 183.81.169.238 port 34536 ssh2
  2024-10-03T11:15:08.651597+02:00 nc2.motyka.pro sshd[3815535]: Failed password for root from 183.81.169.238 port 34538 ssh2
  2024-10-03T11:15:11.131683+02:00 nc2.motyka.pro sshd[3815629]: Failed password for root from 183.81.169.238 port 34548 ssh2
  2024-10-03T11:15:13.158037+02:00 nc2.motyka.pro sshd[3815768]: Failed password for root from 183.81.169.238 port 34568 ssh2
  2024-10-03T11:15:14.434054+02:00 nc2.motyka.pro sshd[3815927]: Failed password for root from 183.81.169.238 port 34580 ssh2
  ...

• 2024-10-03T11:15:54.452708+02:00 runner3 sshd[133061]: Failed password for root from 183.81.169.238 port 51568 ssh2
  2024-10-03T11:15:57.448272+02:00 runner3 sshd[133352]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T11:15:59.568364+02:00 runner3 sshd[133352]: Failed password for root from 183.81.169.238 port 50926 ssh2
  2024-10-03T11:16:03.500282+02:00 runner3 sshd[134207]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T11:16:05.099965+02:00 runner3 sshd[134207]: Failed password for root from 183.81.169.238 port 50932 ssh2
  ...

• Oct 3 11:13:05 fshubvidspace sshd[3003947]: Failed password for root from 183.81.169.238 port 56820 ssh2
  Oct 3 11:13:08 fshubvidspace sshd[3003950]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 11:13:10 fshubvidspace sshd[3003950]: Failed password for root from 183.81.169.238 port 45310 ssh2
  Oct 3 11:13:13 fshubvidspace sshd[3003952]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 11:13:14 fshubvidspace sshd[3003952]: Failed password for root from 183.81.169.238 port 45344 ssh2
  ...

• [09:11] Attempted SSH login on port 22 with credentials root:0

• 2024-10-03T07:33:48.772505+02:00 hvs sshd-session[47270]: Connection closed by authenticating user root 183.81.169.238 port 46360 [preauth]
  2024-10-03T11:10:07.867495+02:00 hvs sshd-session[51039]: Connection closed by authenticating user root 183.81.169.238 port 59710 [preauth]
  2024-10-03T11:10:08.998305+02:00 hvs sshd-session[51041]: Connection closed by authenticating user root 183.81.169.238 port 59736 [preauth]
  2024-10-03T11:10:10.594845+02:00 hvs sshd-session[51043]: Connection closed by authenticating user root 183.81.169.238 port 59756 [preauth]
  2024-10-03T11:10:12.640367+02:00 hvs sshd-session[51045]: Connection closed by authenticating user root 183.81.169.238 port 59780 [preauth]
  ...

• Oct 3 09:09:51 vps-9 sshd[1025677]: Failed password for root from 183.81.169.238 port 32810 ssh2
  Oct 3 09:09:54 vps-9 sshd[1025679]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 09:09:56 vps-9 sshd[1025679]: Failed password for root from 183.81.169.238 port 32838 ssh2
  ...

• Oct 3 09:09:38 hardcore-tesla sshd[4009878]: Failed password for root from 183.81.169.238 port 46402 ssh2
  Oct 3 09:09:41 hardcore-tesla sshd[4009880]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 09:09:43 hardcore-tesla sshd[4009880]: Failed password for root from 183.81.169.238 port 46424 ssh2
  Oct 3 09:09:45 hardcore-tesla sshd[4009882]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 09:09:47 hardcore-tesla sshd[4009882]: Failed password for root from 183.81.169.238 port 50210 ssh2
  ...

• Oct 3 11:08:56 amk sshd\[11022\]: Failed password for root from 183.81.169.238 port 38696 ssh2Oct 3 11:09:00 amk sshd\[11024\]: Failed password for root from 183.81.169.238 port 47570 ssh2
  ...

• Oct 3 11:08:29 SlunchakaRP sshd[96190]: Failed password for root from 183.81.169.238 port 46184 ssh2
  Oct 3 11:08:33 SlunchakaRP sshd[96195]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 11:08:35 SlunchakaRP sshd[96195]: Failed password for root from 183.81.169.238 port 35452 ssh2
  Oct 3 11:08:39 SlunchakaRP sshd[96200]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 11:08:41 SlunchakaRP sshd[96200]: Failed password for root from 183.81.169.238 port 35464 ssh2
  Oct 3 11:08:45 SlunchakaRP sshd[96205]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 11:08:46 SlunchakaRP sshd[96205]: Failed password for root from 183.81.169.238 port 52846 ssh2
  ...

• Oct 3 11:07:55 endernation sshd[3874193]: Failed password for root from 183.81.169.238 port 46682 ssh2
  Oct 3 11:07:57 endernation sshd[3874270]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 11:07:58 endernation sshd[3874270]: Failed password for root from 183.81.169.238 port 56064 ssh2
  ...

• 2024-10-03T09:06:32.316119+00:00 BAW-C01 sshd-session[439463]: Failed password for root from 183.81.169.238 port 53312 ssh2
  2024-10-03T09:06:37.642009+00:00 BAW-C01 sshd-session[439466]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T09:06:40.184498+00:00 BAW-C01 sshd-session[439466]: Failed password for root from 183.81.169.238 port 36978 ssh2
  2024-10-03T09:06:44.195798+00:00 BAW-C01 sshd-session[439469]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T09:06:46.381922+00:00 BAW-C01 sshd-session[439469]: Failed password for root from 183.81.169.238 port 37024 ssh2
  ...

• Oct 3 09:05:50 alpha sshd[2804622]: Failed password for root from 183.81.169.238 port 37050 ssh2
  Oct 3 09:05:52 alpha sshd[2804626]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 09:05:54 alpha sshd[2804626]: Failed password for root from 183.81.169.238 port 37066 ssh2
  Oct 3 09:05:56 alpha sshd[2804726]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 09:05:58 alpha sshd[2804726]: Failed password for root from 183.81.169.238 port 51582 ssh2
  ...

• 2024-10-03T11:04:12.113045vps773228.ovh.net sshd[10235]: Failed password for root from 183.81.169.238 port 47286 ssh2
  2024-10-03T11:04:13.442252vps773228.ovh.net sshd[10237]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T11:04:15.573458vps773228.ovh.net sshd[10237]: Failed password for root from 183.81.169.238 port 47314 ssh2
  2024-10-03T11:04:16.550599vps773228.ovh.net sshd[10239]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T11:04:18.427758vps773228.ovh.net sshd[10239]: Failed password for root from 183.81.169.238 port 44464 ssh2
  ...

• tcp/22 (21 or more attempts)

• Inteceptor Intrusion Detector: failed_password on sshd module PID: (1547067)

• unauthorized connection with user "root" and password "0" at 2024-10-03T09:02:50Z

• 2024-10-03T11:01:51.395067+02:00 srv2 sshd[1660540]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T11:01:53.031113+02:00 srv2 sshd[1660540]: Failed password for root from 183.81.169.238 port 39212 ssh2
  ...

• Oct 3 09:01:40 ubuntu sshd[1501472]: Invalid user Antminer from 183.81.169.238 port 34682
  Oct 3 09:01:41 ubuntu sshd[1501475]: Invalid user Antminer from 183.81.169.238 port 34686
  Oct 3 09:01:48 ubuntu sshd[1501509]: Invalid user admin from 183.81.169.238 port 40586
  ...

• Oct 3 09:01:14 mail sshd[2564815]: Invalid user Antminer from 183.81.169.238 port 33800
  Oct 3 09:01:15 mail sshd[2564819]: Invalid user Antminer from 183.81.169.238 port 33818
  ...

• 10655 attempts since 14.07.2024 04:18:57 UTC - last one: 2024-10-03T09:23:35.878216+02:00 alpha sshd[2367507]: Connection closed by invalid user baikal 183.81.169.238 port 55158 [preauth]

• SSH login 54 attempt(s) in the last 1 hour(s).

• Oct 3 10:59:54 CDN sshd[1792300]: Failed password for root from 183.81.169.238 port 40896 ssh2
  Oct 3 10:59:56 CDN sshd[1792302]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 10:59:58 CDN sshd[1792302]: Failed password for root from 183.81.169.238 port 44016 ssh2
  Oct 3 11:00:00 CDN sshd[1792304]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 11:00:02 CDN sshd[1792304]: Failed password for root from 183.81.169.238 port 44038 ssh2

• Security system: Unauthorised SSH/Telnet login attempt with user "root" at 2024-10-03T08:58:22Z

• 2024-10-03T08:57:35.140954+00:00 Linux101 sshd[2466261]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T08:57:37.299986+00:00 Linux101 sshd[2466261]: Failed password for root from 183.81.169.238 port 42082 ssh2
  2024-10-03T08:57:39.665403+00:00 Linux101 sshd[2467096]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T08:57:41.371962+00:00 Linux101 sshd[2467096]: Failed password for root from 183.81.169.238 port 42106 ssh2
  2024-10-03T08:57:42.329315+00:00 Linux101 sshd[2467540]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T08:57:44.445967+00:00 Linux101 sshd[2467540]: Failed password for root from 183.81.169.238 port 42114 ssh2
  2024-10-03T08:57:46.411962+00:00 Linux101 sshd[2468167]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh r
  ...

• Oct 3 08:55:35 vps-d7931dc8 sshd[474250]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 08:55:37 vps-d7931dc8 sshd[474250]: Failed password for root from 183.81.169.238 port 34902 ssh2
  Oct 3 08:55:38 vps-d7931dc8 sshd[474250]: Connection closed by authenticating user root 183.81.169.238 port 34902 [preauth]
  Oct 3 08:55:39 vps-d7931dc8 sshd[474252]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 08:55:41 vps-d7931dc8 sshd[474252]: Failed password for root from 183.81.169.238 port 34928 ssh2

• PBK Oct 3 10:55:08 websrv01 sshd[1412947]: Failed password for root from 183.81.169.238 port 57812 ssh2
  Oct 3 10:55:09 websrv01 sshd[1412949]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 10:55:11 websrv01 sshd[1412949]: Failed password for root from 183.81.169.238 port 57824 ssh2
  Oct 3 10:55:13 websrv01 sshd[1412951]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 10:55:15 websrv01 sshd[1412951]: Failed password for root from 183.81.169.238 port 57838 ssh2

• Oct 3 08:54:27 ns520895 sshd[12901]: Failed password for root from 183.81.169.238 port 43098 ssh2
  ...

• list.rtbh.com.tr report: tcp/22

• FW-PortScan: Traffic Blocked srcport=38347 dstport=22

• Oct 3 10:53:46 kvm11438 sshd[58972]: Failed password for root from 183.81.169.238 port 46946 ssh2
  Oct 3 10:53:48 kvm11438 sshd[58974]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 10:53:51 kvm11438 sshd[58974]: Failed password for root from 183.81.169.238 port 46984 ssh2
  Oct 3 10:53:51 kvm11438 sshd[58976]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 10:53:53 kvm11438 sshd[58976]: Failed password for root from 183.81.169.238 port 47004 ssh2
  ...

• 2024-10-03 08:52:52,057 quad proftpd[1259833] quad (183.81.169.238[183.81.169.238]): USER root: no such user found from 183.81.169.238 [183.81.169.238] to 2.56.97.107:22

• Oct 3 04:52:34 vps196363 sshd[8184]: Failed password for root from 183.81.169.238 port 48148 ssh2
  Oct 3 04:52:37 vps196363 sshd[8187]: Failed password for root from 183.81.169.238 port 58360 ssh2
  Oct 3 04:52:41 vps196363 sshd[8189]: Failed password for root from 183.81.169.238 port 58366 ssh2
  ...

• Oct 3 10:52:15 root1896 sshd[2274265]: Failed password for root from 183.81.169.238 port 55378 ssh2
  Oct 3 10:52:17 root1896 sshd[2274272]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 10:52:19 root1896 sshd[2274272]: Failed password for root from 183.81.169.238 port 38634 ssh2
  Oct 3 10:52:20 root1896 sshd[2274294]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 10:52:23 root1896 sshd[2274294]: Failed password for root from 183.81.169.238 port 38696 ssh2
  ...

• Oct 3 04:50:53 us-mfl-03 sshd[1330196]: Invalid user Antminer from 183.81.169.238 port 55886
  ...

• Oct 3 10:49:27 emberveil sshd[1328783]: Failed password for root from 183.81.169.238 port 33264 ssh2
  Oct 3 10:49:30 emberveil sshd[1328788]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 10:49:32 emberveil sshd[1328788]: Failed password for root from 183.81.169.238 port 60896 ssh2
  Oct 3 10:49:35 emberveil sshd[1328793]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 10:49:37 emberveil sshd[1328793]: Failed password for root from 183.81.169.238 port 60900 ssh2
  Oct 3 10:49:39 emberveil sshd[1328795]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 10:49:40 emberveil sshd[1328795]: Failed password for root from 183.81.169.238 port 38708 ssh2
  ...

• Oct 3 09:48:18 sheikh-ahmed-abu-islam-v2 sshd[3669927]: Invalid user Antminer from 183.81.169.238 port 38716
  Oct 3 09:48:19 sheikh-ahmed-abu-islam-v2 sshd[3669944]: Invalid user Antminer from 183.81.169.238 port 38746
  ...

• Oct 3 08:47:54 xproot sshd[2029272]: Failed password for root from 183.81.169.238 port 43752 ssh2
  Oct 3 08:47:55 xproot sshd[2029275]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 08:47:58 xproot sshd[2029275]: Failed password for root from 183.81.169.238 port 56348 ssh2
  Oct 3 08:48:00 xproot sshd[2029277]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 08:48:02 xproot sshd[2029277]: Failed password for root from 183.81.169.238 port 56350 ssh2
  ...

• Oct 3 10:46:46 s1-4-gra7 sshd[2076733]: Invalid user Antminer from 183.81.169.238 port 60984
  Oct 3 10:46:47 s1-4-gra7 sshd[2076735]: Invalid user Antminer from 183.81.169.238 port 32778

• 2024-10-03T01:42:05.011667 web sshd[370315]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T01:42:07.365124 web sshd[370315]: Failed password for root from 183.81.169.238 port 50556 ssh2
  ...

• Oct 2 23:46:06 roki sshd[22733]: refused connect from 183.81.169.238 (183.81.169.238)
  Oct 3 01:27:26 roki sshd[31514]: refused connect from 183.81.169.238 (183.81.169.238)
  Oct 3 05:54:45 roki sshd[19534]: refused connect from 183.81.169.238 (183.81.169.238)
  Oct 3 10:05:04 roki sshd[6778]: refused connect from 183.81.169.238 (183.81.169.238)
  Oct 3 10:41:50 roki sshd[9537]: refused connect from 183.81.169.238 (183.81.169.238)
  ...

• Oct 3 09:41:46 dlcentre3 sshd[3402]: Failed password for root from 183.81.169.238 port 46402 ssh2

• Oct 3 11:41:10 pkdns2 sshd\[22757\]: Failed password for root from 183.81.169.238 port 36198 ssh2Oct 3 11:41:13 pkdns2 sshd\[22759\]: Failed password for root from 183.81.169.238 port 36212 ssh2Oct 3 11:41:15 pkdns2 sshd\[22764\]: Failed password for root from 183.81.169.238 port 36228 ssh2Oct 3 11:41:17 pkdns2 sshd\[22768\]: Failed password for root from 183.81.169.238 port 40100 ssh2Oct 3 11:41:20 pkdns2 sshd\[22772\]: Failed password for root from 183.81.169.238 port 40120 ssh2Oct 3 11:41:22 pkdns2 sshd\[22776\]: Failed password for root from 183.81.169.238 port 40138 ssh2
  ...

• 10932 attempts since 13.07.2024 23:53:03 UTC - last one: 2024-10-03T09:11:32.908024+02:00 beta sshd[2338296]: Connection closed by invalid user baikal 183.81.169.238 port 35702 [preauth]

• FW-PortScan: Traffic Blocked srcport=35113 dstport=22

• [rede-168-134] 10/03/2024-05:38:01.985101, 183.81.169.238, Protocol: 6, ET COMPROMISED Known Compromised or Hostile Host Traffic group 13

• Oct 3 01:37:19 LU-VPS01 sshd[2193]: Failed password for root from 183.81.169.238 port 49610 ssh2
  Oct 3 01:37:23 LU-VPS01 sshd[2197]: Failed password for root from 183.81.169.238 port 49634 ssh2
  ...

• 2024-10-03T08:35:47.090281+00:00 prod-3 sshd[1297894]: Connection closed by authenticating user root 183.81.169.238 port 46920 [preauth]
  2024-10-03T08:35:47.922446+00:00 prod-3 sshd[1297896]: Connection closed by authenticating user root 183.81.169.238 port 46930 [preauth]
  2024-10-03T08:35:48.647705+00:00 prod-3 sshd[1297898]: Connection closed by authenticating user root 183.81.169.238 port 46932 [preauth]
  2024-10-03T08:35:49.242577+00:00 prod-3 sshd[1297900]: Connection closed by authenticating user root 183.81.169.238 port 46934 [preauth]
  2024-10-03T08:35:49.842061+00:00 prod-3 sshd[1297919]: Connection closed by authenticating user root 183.81.169.238 port 46944 [preauth]
  ...

• Oct 3 04:35:35 thebatforge sshd[518564]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 04:35:35 thebatforge sshd[518575]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 04:35:36 thebatforge sshd[518577]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 04:35:37 thebatforge sshd[518579]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 04:35:37 thebatforge sshd[518581]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  ...

• 2024-10-03T11:35:34.694904+03:00 mummo sshd[2309084]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T11:35:36.170969+03:00 mummo sshd[2309084]: Failed password for root from 183.81.169.238 port 33446 ssh2
  ...

• Oct 3 10:34:21 AbuseCatcher sshd[55054]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 10:34:23 AbuseCatcher sshd[55054]: Failed password for root from 183.81.169.238 port 33386 ssh2
  ...

• Failed password for root from 183.81.169.238 port 44554 ssh2
  pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Failed password for root from 183.81.169.238 port 44576 ssh2
  pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Failed password for root from 183.81.169.238 port 42464 ssh2

• Oct 3 10:33:03 hosting sshd[3123680]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 10:33:05 hosting sshd[3123680]: Failed password for root from 183.81.169.238 port 34644 ssh2
  Oct 3 10:33:05 hosting sshd[3123694]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 10:33:07 hosting sshd[3123694]: Failed password for root from 183.81.169.238 port 57786 ssh2

• Oct 3 11:32:07 server2 sshd\[22115\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 11:32:07 server2 sshd\[22117\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 11:32:07 server2 sshd\[22119\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 11:32:07 server2 sshd\[22121\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 11:32:07 server2 sshd\[22123\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 11:32:08 server2 sshd\[22125\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers

• Oct 3 10:31:14 BugsBunnyS1 sshd[2694143]: Failed password for root from 183.81.169.238 port 46000 ssh2
  Oct 3 10:31:17 BugsBunnyS1 sshd[2694150]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 10:31:20 BugsBunnyS1 sshd[2694150]: Failed password for root from 183.81.169.238 port 51880 ssh2
  Oct 3 10:31:24 BugsBunnyS1 sshd[2694155]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 10:31:26 BugsBunnyS1 sshd[2694155]: Failed password for root from 183.81.169.238 port 52520 ssh2
  Oct 3 10:31:28 BugsBunnyS1 sshd[2694160]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 10:31:30 BugsBunnyS1 sshd[2694160]: Failed password for root from 183.81.169.238 port 52526 ssh2
  ...

• 2024-10-03T08:30:58.010225shield sshd\[27676\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T08:30:59.790905shield sshd\[27676\]: Failed password for root from 183.81.169.238 port 45552 ssh2
  2024-10-03T08:31:02.406887shield sshd\[27684\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T08:31:04.207285shield sshd\[27684\]: Failed password for root from 183.81.169.238 port 45608 ssh2
  2024-10-03T08:31:07.174574shield sshd\[27686\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root

• Oct 3 10:30:27 C1D543E sshd[776989]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 10:30:27 C1D543E sshd[776989]: Failed password for invalid user root from 183.81.169.238 port 41172 ssh2
  Oct 3 10:30:30 C1D543E sshd[776991]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 10:30:30 C1D543E sshd[776991]: Failed password for invalid user root from 183.81.169.238 port 41186 ssh2
  Oct 3 10:30:32 C1D543E sshd[776994]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  ...

• Oct 3 10:29:26 CDN sshd[1792236]: Failed password for root from 183.81.169.238 port 34718 ssh2
  Oct 3 10:29:30 CDN sshd[1792238]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 10:29:32 CDN sshd[1792238]: Failed password for root from 183.81.169.238 port 40324 ssh2
  Oct 3 10:29:36 CDN sshd[1792240]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 10:29:38 CDN sshd[1792240]: Failed password for root from 183.81.169.238 port 40360 ssh2

• Oct 3 10:29:33 CT6942 sshd[269110]: Failed password for root from 183.81.169.238 port 52640 ssh2
  Oct 3 10:29:36 CT6942 sshd[269113]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 10:29:38 CT6942 sshd[269113]: Failed password for root from 183.81.169.238 port 57428 ssh2
  ...

• Oct 3 05:29:24 SRC=183.81.169.238 PROTO=TCP SPT=40391 DPT=22 SYN
  ...

• Oct 3 10:27:17 arm-fr sshd[3122347]: Invalid user Antminer from 183.81.169.238 port 39200
  Oct 3 10:27:19 arm-fr sshd[3122369]: Invalid user Antminer from 183.81.169.238 port 39202
  Oct 3 10:27:30 arm-fr sshd[3122444]: Invalid user admin from 183.81.169.238 port 60394
  ...

• endlessh: 2024-10-03 10:25:18.656432891 2024-10-03T08:25:18.656Z CLOSE host=183.81.169.238 port=55174 fd=5 time=150.014 bytes=279
  ...

• Oct 3 10:24:55 Servo sshd[3500370]: Invalid user Antminer from 183.81.169.238 port 40360
  Oct 3 10:24:57 Servo sshd[3500387]: Invalid user Antminer from 183.81.169.238 port 40392
  Oct 3 10:25:08 Servo sshd[3500452]: Invalid user admin from 183.81.169.238 port 34806
  ...

• Oct 3 08:23:01 web-proxy02 sshd[1600374]: Failed password for root from 183.81.169.238 port 53794 ssh2
  Oct 3 08:23:05 web-proxy02 sshd[1600376]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 08:23:07 web-proxy02 sshd[1600376]: Failed password for root from 183.81.169.238 port 53816 ssh2
  ...

• Oct 3 10:22:40 arayat sshd[15111]: Failed password for root from 183.81.169.238 port 41088 ssh2
  Oct 3 10:22:42 arayat sshd[15241]: Failed password for root from 183.81.169.238 port 41114 ssh2
  Oct 3 10:22:45 arayat sshd[15268]: Failed password for root from 183.81.169.238 port 41130 ssh2
  Oct 3 10:22:48 arayat sshd[15270]: Failed password for root from 183.81.169.238 port 44566 ssh2
  ...

• Oct 3 10:22:16 s3 sshd[54080]: Invalid user Antminer from 183.81.169.238 port 40894
  Oct 3 10:22:18 s3 sshd[54082]: Invalid user Antminer from 183.81.169.238 port 40904
  Oct 3 10:22:30 s3 sshd[54101]: Invalid user admin from 183.81.169.238 port 45176
  ...

• 2024-10-03T10:21:48.622219vmi1671272.contaboserver.net sshd[68871]: Failed password for root from 183.81.169.238 port 36772 ssh2
  2024-10-03T10:21:52.166944vmi1671272.contaboserver.net sshd[68880]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T10:21:54.794838vmi1671272.contaboserver.net sshd[68880]: Failed password for root from 183.81.169.238 port 36776 ssh2
  2024-10-03T10:21:57.499132vmi1671272.contaboserver.net sshd[68887]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T10:21:59.482248vmi1671272.contaboserver.net sshd[68887]: Failed password for root from 183.81.169.238 port 36928 ssh2

• 2024-10-03 01:20:56,398 fail2ban.actions [689]: NOTICE [sshd] Ban 183.81.169.238

• Oct 3 08:19:53 cloud-server-0 sshd[1861654]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 08:19:54 cloud-server-0 sshd[1861654]: Failed password for root from 183.81.169.238 port 42908 ssh2
  Oct 3 08:19:57 cloud-server-0 sshd[1861656]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 08:19:59 cloud-server-0 sshd[1861656]: Failed password for root from 183.81.169.238 port 49046 ssh2
  Oct 3 08:20:01 cloud-server-0 sshd[1861658]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 08:20:04 cloud-server-0 sshd[1861658]: Failed password for root from 183.81.169.238 port 49088 ssh2
  Oct 3 08:20:07 cloud-server-0 sshd[1861660]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 08:20:10 cloud-server-0 sshd[186
  ...

• Failed ssh brute force login attempts

• FW-PortScan: Traffic Blocked srcport=58609 dstport=22

• Oct 3 10:17:16 gateway1-old sshd[31331]: Failed password for root from 183.81.169.238 port 44106 ssh2
  Oct 3 10:17:23 gateway1-old sshd[31554]: Failed password for root from 183.81.169.238 port 51298 ssh2

• Oct 3 08:17:10 s158416 sshd[2701068]: Failed password for root from 183.81.169.238 port 60412 ssh2
  Oct 3 08:17:13 s158416 sshd[2701285]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 08:17:15 s158416 sshd[2701285]: Failed password for root from 183.81.169.238 port 60434 ssh2
  Oct 3 08:17:19 s158416 sshd[2701291]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 08:17:21 s158416 sshd[2701291]: Failed password for root from 183.81.169.238 port 40784 ssh2
  ...

• 2024-10-03T10:14:48.226866+02:00 ruddy-force sshd[547186]: Failed password for root from 183.81.169.238 port 42330 ssh2
  2024-10-03T10:14:51.306662+02:00 ruddy-force sshd[547188]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T10:14:53.145952+02:00 ruddy-force sshd[547188]: Failed password for root from 183.81.169.238 port 42376 ssh2
  2024-10-03T10:14:56.978370+02:00 ruddy-force sshd[547190]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T10:14:58.832469+02:00 ruddy-force sshd[547190]: Failed password for root from 183.81.169.238 port 40760 ssh2
  ...

• Oct 3 08:13:50 mail sshd[2561430]: Invalid user Antminer from 183.81.169.238 port 59776
  Oct 3 08:13:51 mail sshd[2561432]: Invalid user Antminer from 183.81.169.238 port 59784
  ...

• Oct 3 04:13:20 us-mfl-03 sshd[4026822]: Invalid user Antminer from 183.81.169.238 port 47870
  ...

• 2024-10-03T10:11:01.626855+02:00 vserver-20917 sshd-session[1975550]: Failed password for root from 183.81.169.238 port 50538 ssh2
  2024-10-03T10:11:04.119686+02:00 vserver-20917 sshd-session[1975553]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T10:11:06.122958+02:00 vserver-20917 sshd-session[1975553]: Failed password for root from 183.81.169.238 port 44718 ssh2
  2024-10-03T10:11:08.820369+02:00 vserver-20917 sshd-session[1975558]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T10:11:11.039440+02:00 vserver-20917 sshd-session[1975558]: Failed password for root from 183.81.169.238 port 44740 ssh2
  ...

• Oct 3 08:13:03 edge-ora-lhr01 sshd[1827002]: Invalid user Antminer from 183.81.169.238 port 32982
  Oct 3 08:13:04 edge-ora-lhr01 sshd[1827009]: Invalid user Antminer from 183.81.169.238 port 33006
  Oct 3 08:13:13 edge-ora-lhr01 sshd[1827021]: Invalid user admin from 183.81.169.238 port 51190
  ...

• Oct 3 10:10:33 mazenvps-iliq sshd[2008431]: Failed password for root from 183.81.169.238 port 55944 ssh2
  Oct 3 10:10:35 mazenvps-iliq sshd[2008436]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 10:10:37 mazenvps-iliq sshd[2008436]: Failed password for root from 183.81.169.238 port 55968 ssh2
  Oct 3 10:10:39 mazenvps-iliq sshd[2008441]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 10:10:40 mazenvps-iliq sshd[2008441]: Failed password for root from 183.81.169.238 port 54168 ssh2
  Oct 3 10:10:44 mazenvps-iliq sshd[2008450]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 10:10:46 mazenvps-iliq sshd[2008450]: Failed password for root from 183.81.169.238 port 54194 ssh2
  ...

• Oct 3 08:09:58 ns5024002 sshd[2816845]: Failed password for root from 183.81.169.238 port 48556 ssh2
  Oct 3 08:10:02 ns5024002 sshd[2816983]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 08:10:03 ns5024002 sshd[2816983]: Failed password for root from 183.81.169.238 port 53028 ssh2
  Oct 3 08:10:08 ns5024002 sshd[2817147]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 08:10:10 ns5024002 sshd[2817147]: Failed password for root from 183.81.169.238 port 32984 ssh2
  ...

• 2024-10-03T08:09:17.603097+00:00 Linux08 sshd[1361061]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T08:09:19.250279+00:00 Linux08 sshd[1361061]: Failed password for root from 183.81.169.238 port 43178 ssh2
  2024-10-03T08:09:22.075580+00:00 Linux08 sshd[1361256]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T08:09:24.409859+00:00 Linux08 sshd[1361256]: Failed password for root from 183.81.169.238 port 43226 ssh2
  2024-10-03T08:09:28.838269+00:00 Linux08 sshd[1361782]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T08:09:30.329324+00:00 Linux08 sshd[1361782]: Failed password for root from 183.81.169.238 port 34436 ssh2
  2024-10-03T08:09:33.350052+00:00 Linux08 sshd[1362264]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= r
  ...

• Oct 3 10:09:24 m2369 sshd[863436]: Failed password for root from 183.81.169.238 port 51430 ssh2
  Oct 3 10:09:28 m2369 sshd[863471]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 10:09:29 m2369 sshd[863471]: Failed password for root from 183.81.169.238 port 48792 ssh2
  Oct 3 10:09:33 m2369 sshd[863474]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 10:09:35 m2369 sshd[863474]: Failed password for root from 183.81.169.238 port 48832 ssh2
  ...

• Oct 3 03:08:36 jumarpab sshd[300371]: Failed password for root from 183.81.169.238 port 53242 ssh2
  Oct 3 03:08:38 jumarpab sshd[300373]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:08:40 jumarpab sshd[300373]: Failed password for root from 183.81.169.238 port 37774 ssh2
  ...

• Oct 3 08:07:53 mysql sshd[226202]: Failed password for root from 183.81.169.238 port 46968 ssh2
  Oct 3 08:07:57 mysql sshd[226206]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 08:07:59 mysql sshd[226206]: Failed password for root from 183.81.169.238 port 52248 ssh2
  Oct 3 08:08:03 mysql sshd[226211]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 08:08:05 mysql sshd[226211]: Failed password for root from 183.81.169.238 port 52310 ssh2
  ...

• Inteceptor Intrusion Detector: failed_password on sshd module PID: (1538932)

• Oct 3 15:07:04 honeypot sshd[17662]: Failed password for root from 183.81.169.238 port 50308 ssh2
  ...

• tcp/22 (26 or more attempts)

• Oct 3 04:02:39 ny01 sshd[2779737]: Failed password for root from 183.81.169.238 port 45070 ssh2
  Oct 3 04:02:42 ny01 sshd[2779740]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 04:02:44 ny01 sshd[2779740]: Failed password for root from 183.81.169.238 port 45084 ssh2
  Oct 3 04:02:49 ny01 sshd[2779745]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 04:02:51 ny01 sshd[2779745]: Failed password for root from 183.81.169.238 port 58812 ssh2

• Oct 3 08:01:41 nlfr1 sshd[795738]: Invalid user Antminer from 183.81.169.238 port 34664
  Oct 3 08:01:42 nlfr1 sshd[795895]: Invalid user Antminer from 183.81.169.238 port 34688
  Oct 3 08:01:52 nlfr1 sshd[797810]: Invalid user admin from 183.81.169.238 port 34108
  ...

• Oct 3 04:01:40 www4 sshd[2068701]: Failed password for root from 183.81.169.238 port 33710 ssh2
  Oct 3 04:01:44 www4 sshd[2068708]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 04:01:45 www4 sshd[2068708]: Failed password for root from 183.81.169.238 port 33756 ssh2
  Oct 3 04:01:49 www4 sshd[2068717]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 04:01:51 www4 sshd[2068717]: Failed password for root from 183.81.169.238 port 37278 ssh2
  ...

• Oct 3 10:01:25 vmi440488 sshd[3550670]: Failed password for root from 183.81.169.238 port 54300 ssh2
  Oct 3 10:01:28 vmi440488 sshd[3550676]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 10:01:30 vmi440488 sshd[3550676]: Failed password for root from 183.81.169.238 port 46514 ssh2
  Oct 3 10:01:34 vmi440488 sshd[3550678]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 10:01:36 vmi440488 sshd[3550678]: Failed password for root from 183.81.169.238 port 46576 ssh2
  ...

• Oct 2 23:00:30 alpha-ef21b5050c sshd[1218934]: Invalid user Antminer from 183.81.169.238 port 57470
  ...

• Oct 3 07:59:49 ns520895 sshd[12091]: Failed password for root from 183.81.169.238 port 33844 ssh2
  ...

• FW-PortScan: Traffic Blocked srcport=52495 dstport=22

• [rede-166-249] (sshd) Failed SSH login from 183.81.169.238 (NL/The Netherlands/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Oct 3 04:58:55 sshd[30695]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=[USERNAME]
  Oct 3 04:58:57 sshd[30695]: Failed password for [USERNAME] from 183.81.169.238 port 37376 ssh2
  Oct 3 04:59:01 sshd[30705]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=[USERNAME]
  Oct 3 04:59:03 sshd[30705]: Failed password for [USERNAME] from 183.81.169.238 port 40276 ssh2
  Oct 3 04:

• Cowrie Honeypot: 10 unauthorised SSH/Telnet login attempts between 2024-10-03T07:57:58Z and 2024-10-03T07:58:32Z

• Security system: Unauthorised SSH/Telnet login attempt with user "root" at 2024-10-03T07:57:59Z

• Oct 3 09:57:27 AbuseCatcher sshd[50506]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 09:57:28 AbuseCatcher sshd[50506]: Failed password for root from 183.81.169.238 port 39624 ssh2
  ...

• 2024-10-03T09:56:51.820184+02:00 marvibiene sshd[85375]: Failed password for root from 183.81.169.238 port 37572 ssh2
  2024-10-03T09:56:56.139586+02:00 marvibiene sshd[85401]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T09:56:57.395684+02:00 marvibiene sshd[85401]: Failed password for root from 183.81.169.238 port 45450 ssh2
  2024-10-03T09:57:01.058107+02:00 marvibiene sshd[85431]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T09:57:03.331895+02:00 marvibiene sshd[85431]: Failed password for root from 183.81.169.238 port 45480 ssh2

• Oct 3 07:56:03 lavalink sshd[3389506]: Invalid user Antminer from 183.81.169.238 port 33620
  Oct 3 07:56:05 lavalink sshd[3389508]: Invalid user Antminer from 183.81.169.238 port 58640
  Oct 3 07:56:18 lavalink sshd[3389569]: Invalid user admin from 183.81.169.238 port 33066
  ...

• Oct 3 01:45:41 web2 sshd\[9648\]: Failed password for root from 183.81.169.238 port 58520 ssh2Oct 3 01:45:46 web2 sshd\[9650\]: Failed password for root from 183.81.169.238 port 39824 ssh2Oct 3 01:45:50 web2 sshd\[9652\]: Failed password for root from 183.81.169.238 port 39858 ssh2Oct 3 01:45:55 web2 sshd\[9654\]: Failed password for root from 183.81.169.238 port 52884 ssh2Oct 3 01:46:01 web2 sshd\[9656\]: Failed password for root from 183.81.169.238 port 52914 ssh2Oct 3 01:46:06 web2 sshd\[9658\]: Failed password for root from 183.81.169.238 port 47910 ssh2
  ...

• Oct 3 09:55:08 kroki sshd[287500]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 09:55:10 kroki sshd[287500]: Failed password for root from 183.81.169.238 port 34764 ssh2
  Oct 3 09:55:14 kroki sshd[287502]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 09:55:15 kroki sshd[287502]: Failed password for root from 183.81.169.238 port 57262 ssh2
  ...

• $f2bV_matches

• Oct 3 04:53:29 SRC=183.81.169.238 PROTO=TCP SPT=46943 DPT=22 SYN
  ...

• Oct 3 07:53:04 vm-networkmanager sshd[3772720]: Failed password for root from 183.81.169.238 port 47744 ssh2
  Oct 3 07:53:08 vm-networkmanager sshd[3772754]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 07:53:09 vm-networkmanager sshd[3772754]: Failed password for root from 183.81.169.238 port 34898 ssh2
  Oct 3 07:53:12 vm-networkmanager sshd[3772777]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 07:53:14 vm-networkmanager sshd[3772777]: Failed password for root from 183.81.169.238 port 34912 ssh2
  ...

• Oct 3 09:51:40 vps2 sshd[1825546]: Invalid user Antminer from 183.81.169.238 port 41946
  Oct 3 09:51:42 vps2 sshd[1825548]: Invalid user Antminer from 183.81.169.238 port 41952
  Oct 3 09:51:53 vps2 sshd[1825601]: Invalid user admin from 183.81.169.238 port 56952
  Oct 3 09:51:55 vps2 sshd[1825605]: Invalid user baikal from 183.81.169.238 port 59576
  ...

• 2024-10-03T07:50:54.895665+00:00 Linux15 sshd[3184491]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T07:50:56.787370+00:00 Linux15 sshd[3184491]: Failed password for root from 183.81.169.238 port 40656 ssh2
  2024-10-03T07:51:00.382224+00:00 Linux15 sshd[3184798]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T07:51:03.097432+00:00 Linux15 sshd[3184798]: Failed password for root from 183.81.169.238 port 33752 ssh2
  2024-10-03T07:51:08.277704+00:00 Linux15 sshd[3185367]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T07:51:10.089446+00:00 Linux15 sshd[3185367]: Failed password for root from 183.81.169.238 port 60950 ssh2
  2024-10-03T07:51:13.494364+00:00 Linux15 sshd[3185792]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= r
  ...

• Oct 3 08:51:03 l03 sshd[6577]: Invalid user Antminer from 183.81.169.238 port 38700
  ...

• Oct 3 08:48:51 dev sshd[89033]: Failed password for root from 183.81.169.238 port 57238 ssh2
  Oct 3 08:48:56 dev sshd[89039]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 08:48:57 dev sshd[89039]: Failed password for root from 183.81.169.238 port 52972 ssh2
  Oct 3 08:49:00 dev sshd[89042]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 08:49:03 dev sshd[89042]: Failed password for root from 183.81.169.238 port 52988 ssh2
  ...

• Oct 3 03:48:30 graph sshd[2043168]: Failed password for root from 183.81.169.238 port 38230 ssh2
  Oct 3 03:48:33 graph sshd[2043170]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:48:34 graph sshd[2043170]: Failed password for root from 183.81.169.238 port 38232 ssh2
  Oct 3 03:48:38 graph sshd[2043172]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:48:40 graph sshd[2043172]: Failed password for root from 183.81.169.238 port 60758 ssh2
  ...

• Oct 3 09:48:01 ourumov-web sshd\[1217\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 09:48:03 ourumov-web sshd\[1217\]: Failed password for root from 183.81.169.238 port 36078 ssh2
  Oct 3 09:48:06 ourumov-web sshd\[1222\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  ...

• Oct 3 03:47:38 us-mfl-01 sshd[2953561]: Invalid user Antminer from 183.81.169.238 port 55036
  ...

• Oct 3 09:46:23 netcup sshd[1066807]: Invalid user Antminer from 183.81.169.238 port 50898
  Oct 3 09:46:25 netcup sshd[1066809]: Invalid user Antminer from 183.81.169.238 port 56952
  Oct 3 09:46:36 netcup sshd[1066825]: Invalid user admin from 183.81.169.238 port 60872
  Oct 3 09:46:37 netcup sshd[1066853]: Invalid user baikal from 183.81.169.238 port 60890
  ...

• [rede-176-124] 10/03/2024-04:43:40.834407, 183.81.169.238, Protocol: 6, ET COMPROMISED Known Compromised or Hostile Host Traffic group 13

• Oct 3 08:43:15 s1-jellyfish sshd[1777500]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 08:43:17 s1-jellyfish sshd[1777500]: Failed password for root from 183.81.169.238 port 37914 ssh2
  ...

• 2024-10-03T07:42:16.470475+00:00 mail sshd[932922]: Invalid user Antminer from 183.81.169.238 port 44616
  2024-10-03T07:42:18.524263+00:00 mail sshd[932924]: Invalid user Antminer from 183.81.169.238 port 44630
  2024-10-03T07:42:29.390922+00:00 mail sshd[932937]: Invalid user admin from 183.81.169.238 port 48738
  ...

• Oct 3 09:42:12 mail sshd[860215]: Failed password for root from 183.81.169.238 port 35564 ssh2
  Oct 3 09:42:15 mail sshd[860226]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 09:42:17 mail sshd[860226]: Failed password for root from 183.81.169.238 port 35594 ssh2
  ...

• Cowrie Honeypot: Unauthorised SSH/Telnet login attempt with user "root" at 2024-10-03T07:41:32Z

• Oct 3 07:40:50 cloud sshd[3920064]: Invalid user Antminer from 183.81.169.238 port 46624
  Oct 3 07:40:51 cloud sshd[3920066]: Invalid user Antminer from 183.81.169.238 port 46626
  ...

• Oct 3 10:40:01 server2 sshd\[14902\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 10:40:03 server2 sshd\[15041\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 10:40:05 server2 sshd\[15081\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 10:40:06 server2 sshd\[15086\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 10:40:07 server2 sshd\[15090\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 10:40:08 server2 sshd\[15094\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers

• 2024-10-03T07:38:44.374591+00:00 virt-hur-fmt-01.pdx.net.uk sshd[158293]: Invalid user Antminer from 183.81.169.238 port 50106
  2024-10-03T07:38:47.057393+00:00 virt-hur-fmt-01.pdx.net.uk sshd[158295]: Invalid user Antminer from 183.81.169.238 port 46610
  2024-10-03T07:39:02.947444+00:00 virt-hur-fmt-01.pdx.net.uk sshd[158369]: Invalid user admin from 183.81.169.238 port 40114
  ...

• 2024-10-03T07:38:37.376864+00:00 fluff sshd[81794]: Failed password for root from 183.81.169.238 port 54500 ssh2
  2024-10-03T07:38:41.438382+00:00 fluff sshd[81796]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T07:38:43.702691+00:00 fluff sshd[81796]: Failed password for root from 183.81.169.238 port 42976 ssh2
  2024-10-03T07:38:46.471393+00:00 fluff sshd[81798]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T07:38:48.755792+00:00 fluff sshd[81798]: Failed password for root from 183.81.169.238 port 39276 ssh2
  ...

• 2024-10-03T09:37:07.951998+02:00 PWS-PM-WEB01 sshd[3325945]: Failed password for root from 183.81.169.238 port 42562 ssh2
  2024-10-03T09:37:11.863341+02:00 PWS-PM-WEB01 sshd[3325949]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T09:37:14.100730+02:00 PWS-PM-WEB01 sshd[3325949]: Failed password for root from 183.81.169.238 port 42580 ssh2
  ...

• Unwanted traffic detected by honeypot on October 02, 2024: brute force and hacking attacks (14 over ssh).

• Oct 3 07:38:04 ovh sshd[3423253]: Failed password for root from 183.81.169.238 port 60486 ssh2
  Oct 3 07:38:07 ovh sshd[3423329]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 07:38:10 ovh sshd[3423329]: Failed password for root from 183.81.169.238 port 46528 ssh2
  Oct 3 07:38:14 ovh sshd[3423336]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 07:38:16 ovh sshd[3423336]: Failed password for root from 183.81.169.238 port 46544 ssh2
  ...

• 2024-10-03T09:38:06.838378+02:00 pokevador sshd[747419]: Failed password for root from 183.81.169.238 port 44372 ssh2
  2024-10-03T09:38:10.327034+02:00 pokevador sshd[747456]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T09:38:12.334748+02:00 pokevador sshd[747456]: Failed password for root from 183.81.169.238 port 51922 ssh2
  ...

• 2024-10-03T09:37:36.130652+02:00 ubuntu sshd[161921]: Failed password for root from 183.81.169.238 port 41564 ssh2
  2024-10-03T09:37:39.676699+02:00 ubuntu sshd[161923]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T09:37:41.429126+02:00 ubuntu sshd[161923]: Failed password for root from 183.81.169.238 port 38640 ssh2
  2024-10-03T09:37:43.864388+02:00 ubuntu sshd[161925]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T09:37:46.164406+02:00 ubuntu sshd[161925]: Failed password for root from 183.81.169.238 port 38664 ssh2
  ...

• Oct 3 09:35:35 emberveil sshd[1325382]: Failed password for root from 183.81.169.238 port 34456 ssh2
  Oct 3 09:35:39 emberveil sshd[1325391]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 09:35:41 emberveil sshd[1325391]: Failed password for root from 183.81.169.238 port 35940 ssh2
  Oct 3 09:35:44 emberveil sshd[1325396]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 09:35:46 emberveil sshd[1325396]: Failed password for root from 183.81.169.238 port 35954 ssh2
  Oct 3 09:35:51 emberveil sshd[1325401]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 09:35:52 emberveil sshd[1325401]: Failed password for root from 183.81.169.238 port 36482 ssh2
  ...

• FW-PortScan: Traffic Blocked srcport=50893 dstport=22

• Oct 3 09:35:04 hosting09 sshd[757820]: Failed password for root from 183.81.169.238 port 52126 ssh2
  Oct 3 09:35:07 hosting09 sshd[758007]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 09:35:10 hosting09 sshd[758007]: Failed password for root from 183.81.169.238 port 47698 ssh2
  ...

• Oct 3 07:35:06 mlat sshd[3111848]: Failed password for root from 183.81.169.238 port 50024 ssh2
  Oct 3 07:35:09 mlat sshd[3111853]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 07:35:10 mlat sshd[3111853]: Failed password for root from 183.81.169.238 port 44654 ssh2
  ... azuremlat

• 10/03/2024-09:33:49.328966 183.81.169.238 Protocol: 6 ET COMPROMISED Known Compromised or Hostile Host Traffic group 13

• 2024-10-03T07:33:05.977706brfr sshd[3304135]: Invalid user Antminer from 183.81.169.238 port 57206
  2024-10-03T07:33:08.966639brfr sshd[3305903]: Invalid user Antminer from 183.81.169.238 port 57216
  2024-10-03T07:33:26.501479brfr sshd[3313361]: Invalid user admin from 183.81.169.238 port 37648
  ...

• Oct 3 09:33:02 maximus sshd[42848]: Failed password for root from 183.81.169.238 port 57300 ssh2
  Oct 3 09:33:05 maximus sshd[42853]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 09:33:07 maximus sshd[42853]: Failed password for root from 183.81.169.238 port 36752 ssh2
  Oct 3 09:33:11 maximus sshd[42865]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 09:33:13 maximus sshd[42865]: Failed password for root from 183.81.169.238 port 36782 ssh2
  ...

• Oct 3 09:32:41 kvm11438 sshd[31612]: Failed password for root from 183.81.169.238 port 44352 ssh2
  Oct 3 09:32:44 kvm11438 sshd[31800]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 09:32:46 kvm11438 sshd[31800]: Failed password for root from 183.81.169.238 port 44374 ssh2
  Oct 3 09:32:48 kvm11438 sshd[31802]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 09:32:50 kvm11438 sshd[31802]: Failed password for root from 183.81.169.238 port 51060 ssh2
  ...

• Oct 3 09:32:13 vmi1008219 sshd[394931]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 09:32:15 vmi1008219 sshd[394931]: Failed password for root from 183.81.169.238 port 56910 ssh2
  ...

• 2024-10-03T07:31:35.687177+00:00 Linux11 sshd[851631]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T07:31:37.800320+00:00 Linux11 sshd[851631]: Failed password for root from 183.81.169.238 port 53618 ssh2
  2024-10-03T07:31:41.018753+00:00 Linux11 sshd[851860]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T07:31:43.287326+00:00 Linux11 sshd[851860]: Failed password for root from 183.81.169.238 port 60950 ssh2
  2024-10-03T07:31:45.798301+00:00 Linux11 sshd[852105]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T07:31:47.284441+00:00 Linux11 sshd[852105]: Failed password for root from 183.81.169.238 port 46214 ssh2
  2024-10-03T07:31:50.037509+00:00 Linux11 sshd[852277]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=18
  ...

• Oct 3 09:31:43 pinkypie sshd[76910]: Failed password for root from 183.81.169.238 port 55424 ssh2
  Oct 3 09:31:47 pinkypie sshd[76912]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 09:31:49 pinkypie sshd[76912]: Failed password for root from 183.81.169.238 port 55264 ssh2
  ...

• 183.81.169.238 fell into Endlessh tarpit; 0/26 total connections are currently still open. Total time wasted: 1h 7m 43s. Total bytes sent by tarpit: 6.00KiB. Report generated by Endlessh Report Generator v1.2.3

• Oct 3 09:29:52 OPSO sshd\[29815\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 09:29:54 OPSO sshd\[29815\]: Failed password for root from 183.81.169.238 port 43996 ssh2
  Oct 3 09:29:57 OPSO sshd\[29817\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 09:29:59 OPSO sshd\[29817\]: Failed password for root from 183.81.169.238 port 39712 ssh2
  Oct 3 09:30:02 OPSO sshd\[29821\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root

• Oct 3 09:29:39 dev0-dcde-rnet sshd[12181]: Failed password for root from 183.81.169.238 port 37510 ssh2
  Oct 3 09:29:43 dev0-dcde-rnet sshd[12183]: Failed password for root from 183.81.169.238 port 37540 ssh2

• 2024-10-03T09:26:59.064868+02:00 nc1.motyka.pro sshd[3142044]: Failed password for root from 183.81.169.238 port 51954 ssh2
  2024-10-03T09:27:01.480605+02:00 nc1.motyka.pro sshd[3142092]: Failed password for root from 183.81.169.238 port 51958 ssh2
  2024-10-03T09:27:03.394828+02:00 nc1.motyka.pro sshd[3142225]: Failed password for root from 183.81.169.238 port 51974 ssh2
  2024-10-03T09:27:05.425495+02:00 nc1.motyka.pro sshd[3142252]: Failed password for root from 183.81.169.238 port 51986 ssh2
  2024-10-03T09:27:07.956000+02:00 nc1.motyka.pro sshd[3142310]: Failed password for root from 183.81.169.238 port 56192 ssh2
  ...

• Oct 3 03:25:58 thebatforge sshd[513485]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 03:26:00 thebatforge sshd[513498]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 03:26:03 thebatforge sshd[513500]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 03:26:04 thebatforge sshd[513502]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 03:26:07 thebatforge sshd[513506]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  ...

• 2024-10-03T09:24:33.338990+02:00 mail sshd[513398]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-03T09:24:35.414413+02:00 mail sshd[513406]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-03T09:24:37.858527+02:00 mail sshd[513413]: User root from 183.81.169.238 not allowed because not listed in AllowUsers

• [07:24] Attempted SSH login on port 22 with credentials root:0

• Oct 3 09:23:35 amk sshd\[10433\]: Failed password for root from 183.81.169.238 port 33656 ssh2Oct 3 09:23:40 amk sshd\[10435\]: Failed password for root from 183.81.169.238 port 41560 ssh2
  ...

• Oct 3 01:20:16 SRC=183.81.169.238 PROTO=TCP SPT=45186 DPT=22 SYN
  ...

• Oct 3 09:20:08 fshubvidspace sshd[3002204]: Failed password for root from 183.81.169.238 port 57088 ssh2
  Oct 3 09:20:10 fshubvidspace sshd[3002207]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 09:20:12 fshubvidspace sshd[3002207]: Failed password for root from 183.81.169.238 port 57130 ssh2
  Oct 3 09:20:15 fshubvidspace sshd[3002211]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 09:20:17 fshubvidspace sshd[3002211]: Failed password for root from 183.81.169.238 port 60918 ssh2
  ...

• 2024-10-03T09:19:56.502730 prodgateway sshd[63303]: Failed password for root from 183.81.169.238 port 48840 ssh2
  2024-10-03T09:19:58.224887 prodgateway sshd[63306]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T09:19:59.987923 prodgateway sshd[63306]: Failed password for root from 183.81.169.238 port 38314 ssh2
  ...

• Oct 3 00:18:57 node sshd[386087]: Failed password for root from 183.81.169.238 port 45144 ssh2
  Oct 3 00:19:01 node sshd[386089]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 00:19:03 node sshd[386089]: Failed password for root from 183.81.169.238 port 45160 ssh2
  Oct 3 00:19:07 node sshd[386091]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 00:19:09 node sshd[386091]: Failed password for root from 183.81.169.238 port 52072 ssh2

• Oct 3 09:18:26 qube2 sshd[3873811]: Failed password for root from 183.81.169.238 port 55666 ssh2
  Oct 3 09:18:29 qube2 sshd[3874116]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 09:18:31 qube2 sshd[3874116]: Failed password for root from 183.81.169.238 port 49812 ssh2
  ...

• Oct 3 07:18:13 scw-pizzadns-master sshd\[30789\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 07:18:15 scw-pizzadns-master sshd\[30789\]: Failed password for root from 183.81.169.238 port 49460 ssh2
  Oct 3 07:18:16 scw-pizzadns-master sshd\[30798\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root

• Attempted SSH connection from 183.81.169.238 port 41082 in apnic; no valid users in that region

• FW-PortScan: Traffic Blocked srcport=42765 dstport=22

• Oct 3 07:16:29 s158416 sshd[2680158]: Failed password for root from 183.81.169.238 port 47620 ssh2
  Oct 3 07:16:33 s158416 sshd[2680164]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 07:16:34 s158416 sshd[2680164]: Failed password for root from 183.81.169.238 port 47660 ssh2
  Oct 3 07:16:38 s158416 sshd[2680166]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 07:16:40 s158416 sshd[2680166]: Failed password for root from 183.81.169.238 port 60644 ssh2
  ...

• Oct 3 09:16:39 HighSpeed sshd[1690376]: Failed password for root from 183.81.169.238 port 46460 ssh2
  Oct 3 09:16:41 HighSpeed sshd[1690381]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 09:16:44 HighSpeed sshd[1690381]: Failed password for root from 183.81.169.238 port 46474 ssh2
  Oct 3 09:16:48 HighSpeed sshd[1690386]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 09:16:50 HighSpeed sshd[1690386]: Failed password for root from 183.81.169.238 port 56418 ssh2
  Oct 3 09:16:53 HighSpeed sshd[1690391]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 09:16:55 HighSpeed sshd[1690391]: Failed password for root from 183.81.169.238 port 53932 ssh2
  ...

• Oct 3 09:16:15 v2202301167543214332 sshd[2971182]: Failed password for root from 183.81.169.238 port 37598 ssh2
  Oct 3 09:16:19 v2202301167543214332 sshd[2971184]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 09:16:21 v2202301167543214332 sshd[2971184]: Failed password for root from 183.81.169.238 port 40830 ssh2
  Oct 3 09:16:25 v2202301167543214332 sshd[2971186]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 09:16:27 v2202301167543214332 sshd[2971186]: Failed password for root from 183.81.169.238 port 40894 ssh2
  ...

• Inteceptor Intrusion Detector: failed_password on sshd module PID: (1107590)

• Failed password for root from 183.81.169.238 port 58202 ssh2
  pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Failed password for root from 183.81.169.238 port 58216 ssh2
  pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Failed password for root from 183.81.169.238 port 36474 ssh2

• 2024-10-03T00:14:20.529016-07:00 panduhstudios sshd[2844449]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T00:14:22.556838-07:00 panduhstudios sshd[2844449]: Failed password for root from 183.81.169.238 port 55582 ssh2
  2024-10-03T00:14:27.437039-07:00 panduhstudios sshd[2844460]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T00:14:29.425072-07:00 panduhstudios sshd[2844460]: Failed password for root from 183.81.169.238 port 40252 ssh2
  ...

• Oct 3 10:14:09 www sshd\[58381\]: Failed password for root from 183.81.169.238 port 56936 ssh2Oct 3 10:14:13 www sshd\[58383\]: Failed password for root from 183.81.169.238 port 56960 ssh2Oct 3 10:14:18 www sshd\[58385\]: Failed password for root from 183.81.169.238 port 36822 ssh2
  ...

• Oct 3 09:12:01 endernation sshd[3765175]: Failed password for root from 183.81.169.238 port 34052 ssh2
  Oct 3 09:12:03 endernation sshd[3765348]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 09:12:05 endernation sshd[3765348]: Failed password for root from 183.81.169.238 port 34064 ssh2
  ...

• Detected 1 distributed attacks from 183.81.169.238. LF_DISTATTACK; Logs: 2024-10-03T08:42:27.560339+02:00 insightVM sshd[3462849]: Failed password for root from 183.81.169.238 port 51686 ssh2

• 2024-10-03T09:10:45.896336+02:00 Webserver sshd[701420]: Failed password for root from 183.81.169.238 port 53252 ssh2
  2024-10-03T09:10:48.921833+02:00 Webserver sshd[701422]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T09:10:51.512330+02:00 Webserver sshd[701422]: Failed password for root from 183.81.169.238 port 47560 ssh2
  2024-10-03T09:10:56.148170+02:00 Webserver sshd[701426]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T09:10:57.833991+02:00 Webserver sshd[701426]: Failed password for root from 183.81.169.238 port 48522 ssh2
  ...

• 3:12:47I1003 06:
  Fail2ban action triggered

• Oct 3 09:09:39 root1896 sshd[2239288]: Failed password for root from 183.81.169.238 port 41328 ssh2
  Oct 3 09:09:43 root1896 sshd[2239333]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 09:09:44 root1896 sshd[2239333]: Failed password for root from 183.81.169.238 port 41344 ssh2
  Oct 3 09:09:47 root1896 sshd[2239350]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 09:09:50 root1896 sshd[2239350]: Failed password for root from 183.81.169.238 port 35426 ssh2
  ...

• 2024-10-03 07:09:02,957 fail2ban.actions [624]: NOTICE [sshd] Ban 183.81.169.238

• Oct 3 07:08:26 ovh-docker-001 sshd[398205]: Failed password for root from 183.81.169.238 port 48864 ssh2
  Oct 3 07:08:29 ovh-docker-001 sshd[398223]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 07:08:31 ovh-docker-001 sshd[398223]: Failed password for root from 183.81.169.238 port 54728 ssh2
  Oct 3 07:08:35 ovh-docker-001 sshd[398463]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 07:08:37 ovh-docker-001 sshd[398463]: Failed password for root from 183.81.169.238 port 47614 ssh2
  ...

• Oct 3 10:07:05 localhost sshd[1353347]: Failed password for root from 183.81.169.238 port 50792 ssh2
  Oct 3 10:07:07 localhost sshd[1353355]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 10:07:09 localhost sshd[1353355]: Failed password for root from 183.81.169.238 port 51254 ssh2
  Oct 3 10:07:12 localhost sshd[1353365]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 10:07:14 localhost sshd[1353365]: Failed password for root from 183.81.169.238 port 51278 ssh2
  ...

• Oct 3 07:07:01 web4 sshd[3831490]: Failed password for root from 183.81.169.238 port 38560 ssh2
  Oct 3 07:07:04 web4 sshd[3831530]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 07:07:06 web4 sshd[3831530]: Failed password for root from 183.81.169.238 port 38572 ssh2
  Oct 3 07:07:10 web4 sshd[3831535]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 07:07:11 web4 sshd[3831535]: Failed password for root from 183.81.169.238 port 36966 ssh2

• 2024-10-03T00:06:39.868342 web sshd[367674]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T00:06:41.276195 web sshd[367674]: Failed password for root from 183.81.169.238 port 46032 ssh2
  ...

• 2024-10-03T07:06:06.311138+00:00 prod-3 sshd[1267674]: Connection closed by authenticating user root 183.81.169.238 port 55354 [preauth]
  2024-10-03T07:06:08.620965+00:00 prod-3 sshd[1267792]: Connection closed by authenticating user root 183.81.169.238 port 51726 [preauth]
  2024-10-03T07:06:10.890984+00:00 prod-3 sshd[1267794]: Connection closed by authenticating user root 183.81.169.238 port 51736 [preauth]
  2024-10-03T07:06:13.322383+00:00 prod-3 sshd[1267796]: Connection closed by authenticating user root 183.81.169.238 port 51758 [preauth]
  2024-10-03T07:06:15.819629+00:00 prod-3 sshd[1267798]: Connection closed by authenticating user root 183.81.169.238 port 51774 [preauth]
  ...

• unauthorized connection with user "root" and password "0" at 2024-10-03T07:04:39Z

• Oct 3 10:03:55 server2 sshd\[11235\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 10:03:57 server2 sshd\[11237\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 10:03:58 server2 sshd\[11239\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 10:04:00 server2 sshd\[11243\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 10:04:02 server2 sshd\[11245\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 10:04:03 server2 sshd\[11274\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers

• Invalid user Antminer from 183.81.169.238 port 38062

• Oct 3 07:03:49 ice2 sshd[1966881]: Invalid user Antminer from 183.81.169.238 port 53914
  Oct 3 07:03:51 ice2 sshd[1966883]: Invalid user Antminer from 183.81.169.238 port 53924
  ...

• tcp/22 (33 or more attempts)

• Oct 3 07:03:42 proxy sshd[1589912]: Invalid user Antminer from 183.81.169.238 port 36626
  ...

• 2024-10-03T03:03:34.152360-04:00 endlessh-abuse sshd[63375]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T03:03:36.159768-04:00 endlessh-abuse sshd[63375]: Failed password for root from 183.81.169.238 port 51450 ssh2
  ...

• Oct 3 07:02:12 VPS sshd[1780768]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 07:02:12 VPS sshd[1780768]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 07:02:12 VPS sshd[1780768]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 07:02:14 VPS sshd[1780768]: Failed password for invalid user root from 183.81.169.238 port 44964 ssh2
  Oct 3 07:02:18 VPS sshd[1780780]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  ...

• >20 unauthorized SSH connections

• Oct 3 10:01:55 vds-100908 sshd[118825]: Failed password for root from 183.81.169.238 port 44252 ssh2
  Oct 3 10:01:58 vds-100908 sshd[118827]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 10:02:00 vds-100908 sshd[118827]: Failed password for root from 183.81.169.238 port 55372 ssh2
  Oct 3 10:02:04 vds-100908 sshd[118829]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 10:02:06 vds-100908 sshd[118829]: Failed password for root from 183.81.169.238 port 42174 ssh2
  ...

• Oct 3 03:01:01 scp sshd[3415394]: Invalid user Antminer from 183.81.169.238 port 55212
  Oct 3 03:01:03 scp sshd[3415486]: Invalid user Antminer from 183.81.169.238 port 55220
  Oct 3 03:01:18 scp sshd[3415849]: Invalid user admin from 183.81.169.238 port 52170
  ...

• Unsolicited connection attempt(s), port:22.

• 2024-10-03T07:00:01.246217+00:00 mail-backup sshd[61144]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-03T07:00:03.743776+00:00 mail-backup sshd[61146]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-03T07:00:06.289172+00:00 mail-backup sshd[61148]: User root from 183.81.169.238 not allowed because not listed in AllowUsers

• Invalid user Antminer from 183.81.169.238 port 37620

• Invalid user Antminer from 183.81.169.238 port 55476

• Oct 3 09:59:40 emerald sshd[169849]: Failed password for root from 183.81.169.238 port 60828 ssh2
  Oct 3 09:59:43 emerald sshd[169854]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 09:59:45 emerald sshd[169854]: Failed password for root from 183.81.169.238 port 39414 ssh2
  Oct 3 09:59:50 emerald sshd[169859]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 09:59:51 emerald sshd[169859]: Failed password for root from 183.81.169.238 port 39430 ssh2
  Oct 3 09:59:54 emerald sshd[169864]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 09:59:56 emerald sshd[169864]: Failed password for root from 183.81.169.238 port 58752 ssh2
  ...

• Oct 3 06:59:45 xproot sshd[2027007]: Failed password for root from 183.81.169.238 port 36428 ssh2
  Oct 3 06:59:49 xproot sshd[2027009]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:59:51 xproot sshd[2027009]: Failed password for root from 183.81.169.238 port 37708 ssh2
  Oct 3 06:59:54 xproot sshd[2027011]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:59:56 xproot sshd[2027011]: Failed password for root from 183.81.169.238 port 37728 ssh2
  ...

• Oct 3 06:59:51 cloud-server-0 sshd[2892906]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:59:53 cloud-server-0 sshd[2892906]: Failed password for root from 183.81.169.238 port 53330 ssh2
  ...

• Oct 3 08:59:28 javastart sshd[4051494]: Failed password for root from 183.81.169.238 port 60238 ssh2
  Oct 3 08:59:32 javastart sshd[4051496]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 08:59:35 javastart sshd[4051496]: Failed password for root from 183.81.169.238 port 60258 ssh2
  Oct 3 08:59:38 javastart sshd[4051514]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 08:59:40 javastart sshd[4051514]: Failed password for root from 183.81.169.238 port 34270 ssh2
  ...

• Oct 3 15:58:35 localhost sshd[3028030]: Failed password for root from 183.81.169.238 port 52292 ssh2
  Oct 3 15:58:39 localhost sshd[3028041]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 15:58:41 localhost sshd[3028041]: Failed password for root from 183.81.169.238 port 43102 ssh2
  Oct 3 15:58:44 localhost sshd[3028082]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 15:58:47 localhost sshd[3028082]: Failed password for root from 183.81.169.238 port 43124 ssh2
  ...

• Oct 3 08:58:31 AbuseCatcher sshd[32953]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 08:58:33 AbuseCatcher sshd[32953]: Failed password for root from 183.81.169.238 port 54084 ssh2
  ...

• Oct 3 06:57:45 web8 sshd\[10081\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:57:47 web8 sshd\[10081\]: Failed password for root from 183.81.169.238 port 41524 ssh2
  Oct 3 06:57:50 web8 sshd\[10115\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:57:52 web8 sshd\[10115\]: Failed password for root from 183.81.169.238 port 54550 ssh2
  Oct 3 06:57:55 web8 sshd\[10150\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root

• Inteceptor Intrusion Detector: auth_failure on sshd module PID: (1107590)

• 2024-10-03T06:57:21.172418shield sshd\[18222\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T06:57:22.974248shield sshd\[18222\]: Failed password for root from 183.81.169.238 port 56854 ssh2
  2024-10-03T06:57:25.728887shield sshd\[18240\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T06:57:28.081183shield sshd\[18240\]: Failed password for root from 183.81.169.238 port 56860 ssh2
  2024-10-03T06:57:31.047683shield sshd\[18256\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root

• Oct 3 08:57:22 h2930838 sshd[26235]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 08:57:25 h2930838 sshd[26235]: Failed password for invalid user root from 183.81.169.238 port 55254 ssh2

• 2024-10-03T08:57:15.978223+02:00 pve sshd[2694171]: Failed password for root from 183.81.169.238 port 38418 ssh2
  2024-10-03T08:57:18.906425+02:00 pve sshd[2694385]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T08:57:20.964843+02:00 pve sshd[2694385]: Failed password for root from 183.81.169.238 port 60726 ssh2
  2024-10-03T08:57:23.297389+02:00 pve sshd[2694650]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T08:57:26.041799+02:00 pve sshd[2694650]: Failed password for root from 183.81.169.238 port 60742 ssh2
  ...

• Oct 3 10:26:46 Digitalogic sshd[1425642]: Connection closed by authenticating user root 183.81.169.238 port 49028 [preauth]
  Oct 3 10:26:49 Digitalogic sshd[1425671]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 10:26:51 Digitalogic sshd[1425671]: Failed password for root from 183.81.169.238 port 46512 ssh2
  ...

• Oct 3 08:56:13 arm-am sshd[78377]: Invalid user Antminer from 183.81.169.238 port 57878
  Oct 3 08:56:15 arm-am sshd[78379]: Invalid user Antminer from 183.81.169.238 port 42206
  Oct 3 08:56:25 arm-am sshd[78391]: Invalid user admin from 183.81.169.238 port 42248
  ...

• [2024 Oct 3 08:24:13] Brute-Force detected from 183.81.169.238 for sshd fails: 2x () USER=baikal SPT=37256

• 2024-10-03T09:55:31.074579+03:00 mummo sshd[2271034]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T09:55:33.112994+03:00 mummo sshd[2271034]: Failed password for root from 183.81.169.238 port 42890 ssh2
  ...

• Oct 3 02:54:04 us-mfl-02 sshd[1554867]: Invalid user Antminer from 183.81.169.238 port 38490
  ...

• Oct 3 06:53:12 destiny sshd[2077100]: Connection closed by invalid user root 183.81.169.238 port 48250 [preauth]
  Oct 3 06:53:13 destiny sshd[2077125]: User root not allowed because account is locked
  Oct 3 06:53:14 destiny sshd[2077125]: Connection closed by invalid user root 183.81.169.238 port 48256 [preauth]
  Oct 3 06:53:16 destiny sshd[2077127]: User root not allowed because account is locked
  Oct 3 06:53:16 destiny sshd[2077127]: Connection closed by invalid user root 183.81.169.238 port 35672 [preauth]
  ...

• Oct 3 08:52:45 apo sshd[24914]: Failed password for root from 183.81.169.238 port 57010 ssh2
  Oct 3 08:52:47 apo sshd[24969]: Failed password for root from 183.81.169.238 port 57018 ssh2
  Oct 3 08:52:50 apo sshd[25136]: Failed password for root from 183.81.169.238 port 57028 ssh2
  Oct 3 08:52:52 apo sshd[25310]: Failed password for root from 183.81.169.238 port 57056 ssh2
  ...

• Oct 3 08:52:38 unifi sshd[749881]: Failed password for root from 183.81.169.238 port 36710 ssh2
  Oct 3 08:52:40 unifi sshd[749883]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 08:52:41 unifi sshd[749883]: Failed password for root from 183.81.169.238 port 36716 ssh2
  Oct 3 08:52:44 unifi sshd[749885]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 08:52:47 unifi sshd[749885]: Failed password for root from 183.81.169.238 port 53514 ssh2
  ...

• Oct 3 08:51:59 s1-4-gra7 sshd[2071611]: Invalid user Antminer from 183.81.169.238 port 58726
  Oct 3 08:52:01 s1-4-gra7 sshd[2071614]: Invalid user Antminer from 183.81.169.238 port 58734

• 2024-10-03T08:50:30.260702+02:00 Linux14 sshd[1527064]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T08:50:32.304936+02:00 Linux14 sshd[1527064]: Failed password for root from 183.81.169.238 port 46416 ssh2
  2024-10-03T08:50:35.573361+02:00 Linux14 sshd[1527446]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T08:50:37.972860+02:00 Linux14 sshd[1527446]: Failed password for root from 183.81.169.238 port 46438 ssh2
  2024-10-03T08:50:41.054189+02:00 Linux14 sshd[1527925]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T08:50:42.941864+02:00 Linux14 sshd[1527925]: Failed password for root from 183.81.169.238 port 60488 ssh2
  2024-10-03T08:50:46.002688+02:00 Linux14 sshd[1528328]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= r
  ...

• 2024-10-03T08:50:38.127951+02:00 vande sshd[1693701]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T08:50:39.604712+02:00 vande sshd[1693701]: Failed password for root from 183.81.169.238 port 40224 ssh2

• FW-PortScan: Traffic Blocked srcport=56562 dstport=22

• Oct 3 06:49:26 mark sshd[3430665]: Failed password for root from 183.81.169.238 port 50802 ssh2
  Oct 3 06:49:29 mark sshd[3431615]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:49:31 mark sshd[3431615]: Failed password for root from 183.81.169.238 port 34910 ssh2
  Oct 3 06:49:35 mark sshd[3432565]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:49:37 mark sshd[3432565]: Failed password for root from 183.81.169.238 port 34926 ssh2
  ...

• Oct 3 06:49:09 vps-9 sshd[1009472]: Failed password for root from 183.81.169.238 port 37954 ssh2
  Oct 3 06:49:12 vps-9 sshd[1009476]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:49:14 vps-9 sshd[1009476]: Failed password for root from 183.81.169.238 port 38190 ssh2
  ...

• Oct 3 06:49:00 scw-6657dc sshd[17154]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:49:00 scw-6657dc sshd[17154]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:49:02 scw-6657dc sshd[17154]: Failed password for root from 183.81.169.238 port 47118 ssh2
  ...

• 183.81.169.238 (MN/Mongolia/-), 6 distributed sshd attacks on account [root] in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_DISTATTACK; Logs: Oct 3 02:48:03 server5 sshd[16669]: Failed password for root from 62.169.27.73 port 42858 ssh2
  Oct 3 02:48:38 server5 sshd[16721]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 02:48:39 server5 sshd[16721]: Failed password for root from 183.81.169.238 port 43918 ssh2
  Oct 3 02:48:40 server5 sshd[16724]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.47.189.212 user=root
  Oct 3 02:47:40 server5 sshd[16560]: Failed password for root from 192.241.141.141 port 55880 ssh2
  Oct 3 02:47:38 server5 sshd[16560]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.241.141.141 user=root
  
  IP Addresses Blocked:
  
  62.169.27.73 (DE/Germany/-)

• Oct 3 09:48:05 pkdns2 sshd\[18229\]: Failed password for root from 183.81.169.238 port 59986 ssh2Oct 3 09:48:09 pkdns2 sshd\[18231\]: Failed password for root from 183.81.169.238 port 39786 ssh2Oct 3 09:48:14 pkdns2 sshd\[18233\]: Failed password for root from 183.81.169.238 port 39808 ssh2Oct 3 09:48:18 pkdns2 sshd\[18238\]: Failed password for root from 183.81.169.238 port 57856 ssh2Oct 3 09:48:22 pkdns2 sshd\[18240\]: Failed password for root from 183.81.169.238 port 57904 ssh2Oct 3 09:48:27 pkdns2 sshd\[18242\]: Failed password for root from 183.81.169.238 port 57932 ssh2
  ...

• 2024-10-03T01:48:07.560208-05:00 BAW-C02 sshd[4012405]: Failed password for root from 183.81.169.238 port 48342 ssh2
  2024-10-03T01:48:11.314374-05:00 BAW-C02 sshd[4012416]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T01:48:13.278965-05:00 BAW-C02 sshd[4012416]: Failed password for root from 183.81.169.238 port 41290 ssh2
  2024-10-03T01:48:17.426999-05:00 BAW-C02 sshd[4012418]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T01:48:19.548085-05:00 BAW-C02 sshd[4012418]: Failed password for root from 183.81.169.238 port 53560 ssh2
  ...

• Oct 3 08:47:51 mx1 sshd[2010016]: Failed password for root from 183.81.169.238 port 56494 ssh2
  Oct 3 08:47:53 mx1 sshd[2010018]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 08:47:55 mx1 sshd[2010018]: Failed password for root from 183.81.169.238 port 56512 ssh2
  Oct 3 08:48:00 mx1 sshd[2010020]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 08:48:01 mx1 sshd[2010020]: Failed password for root from 183.81.169.238 port 58084 ssh2
  ...

• Failed password for root from 183.81.169.238 port 42496 ssh2
  pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Failed password for root from 183.81.169.238 port 58550 ssh2
  pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Failed password for root from 183.81.169.238 port 58564 ssh2

• 2024-10-03T14:47:18.691954+08:00 VM65536 sshd[918651]: Connection closed by authenticating user root 183.81.169.238 port 45990 [preauth]
  2024-10-03T14:47:21.944678+08:00 VM65536 sshd[918653]: Connection closed by authenticating user root 183.81.169.238 port 45998 [preauth]
  2024-10-03T14:47:25.602686+08:00 VM65536 sshd[918657]: Connection closed by authenticating user root 183.81.169.238 port 46018 [preauth]
  ...

• [06:45] Attempted SSH login on port 22 with credentials root:0

• 2024-10-03T06:44:40.205033+00:00 mapir-proxmox sshd[1214514]: Failed password for root from 183.81.169.238 port 42318 ssh2
  2024-10-03T06:44:44.942906+00:00 mapir-proxmox sshd[1215501]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T06:44:47.156960+00:00 mapir-proxmox sshd[1215501]: Failed password for root from 183.81.169.238 port 42344 ssh2
  ...

• Oct 3 08:44:17 LimitlessRP sshd[222465]: Failed password for root from 183.81.169.238 port 51896 ssh2
  Oct 3 08:44:21 LimitlessRP sshd[222470]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 08:44:23 LimitlessRP sshd[222470]: Failed password for root from 183.81.169.238 port 49978 ssh2
  Oct 3 08:44:27 LimitlessRP sshd[222478]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 08:44:29 LimitlessRP sshd[222478]: Failed password for root from 183.81.169.238 port 50002 ssh2
  Oct 3 08:44:33 LimitlessRP sshd[222486]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 08:44:35 LimitlessRP sshd[222486]: Failed password for root from 183.81.169.238 port 52714 ssh2
  ...

• 2024-10-03T08:43:34.830048+02:00 docker sshd[1878720]: Failed password for root from 183.81.169.238 port 32884 ssh2
  2024-10-03T08:43:38.531727+02:00 docker sshd[1878736]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T08:43:40.351099+02:00 docker sshd[1878736]: Failed password for root from 183.81.169.238 port 57400 ssh2
  2024-10-03T08:43:44.375041+02:00 docker sshd[1878753]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T08:43:46.018724+02:00 docker sshd[1878753]: Failed password for root from 183.81.169.238 port 57420 ssh2
  ...

• Oct 3 08:42:38 de-kae sshd[3494110]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 08:42:40 de-kae sshd[3494110]: Failed password for root from 183.81.169.238 port 59592 ssh2
  ...

• Detected 3 distributed attacks from 183.81.169.238. LF_DISTATTACK; Logs: 2024-10-03T08:42:25.430928+02:00 insightVM sshd[3462849]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root 2024-10-03T08:42:18.187228+02:00 insightVM sshd[3462825]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root 2024-10-03T08:42:20.692331+02:00 insightVM sshd[3462825]: Failed password for root from 183.81.169.238 port 51656 ssh2

• Unsolicited connection attempt(s), port:22.

• Oct 3 08:39:44 server sshd[1329225]: Failed password for root from 183.81.169.238 port 55290 ssh2
  Oct 3 08:39:48 server sshd[1329228]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 08:39:50 server sshd[1329228]: Failed password for root from 183.81.169.238 port 33292 ssh2
  Oct 3 08:39:54 server sshd[1329230]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 08:39:57 server sshd[1329230]: Failed password for root from 183.81.169.238 port 33342 ssh2
  ...

• [rede-164-29] 10/03/2024-03:39:22.419756, 183.81.169.238, Protocol: 6, ET COMPROMISED Known Compromised or Hostile Host Traffic group 13

• FW-PortScan: Traffic Blocked srcport=53414 dstport=22

• Oct 3 08:34:10 [redacted] sshd[1626145]: Failed password for [redacted] from 183.81.169.238 port 35850 ssh2
  Oct 3 08:34:12 [redacted] sshd[1626148]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=[redacted]
  Oct 3 08:34:14 [redacted] sshd[1626148]: Failed password for [redacted] from 183.81.169.238 port 35882 ssh2
  Oct 3 08:34:17 [redacted] sshd[1626152]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=[redacted]
  Oct 3 08:34:19 [redacted] sshd[1626152]: Failed password for [redacted] from 183.81.169.238 port 52512 ssh2
  ...

• 2024-10-03T08:33:53.048525+02:00 mail sshd[645927]: Failed password for root from 183.81.169.238 port 34276 ssh2
  2024-10-03T08:33:56.877654+02:00 mail sshd[645930]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T08:33:59.132283+02:00 mail sshd[645930]: Failed password for root from 183.81.169.238 port 51066 ssh2
  2024-10-03T08:34:03.267817+02:00 mail sshd[645933]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T08:34:05.150555+02:00 mail sshd[645933]: Failed password for root from 183.81.169.238 port 51130 ssh2
  ...

• 2024-10-03T03:33:20.736286-03:00 dns1 sshd[19376]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T03:33:22.051660-03:00 dns1 sshd[19376]: Failed password for root from 183.81.169.238 port 41962 ssh2
  2024-10-03T03:33:23.843890-03:00 dns1 sshd[19376]: Connection closed by authenticating user root 183.81.169.238 port 41962 [preauth]
  2024-10-03T03:33:26.685578-03:00 dns1 sshd[19378]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T03:33:28.821101-03:00 dns1 sshd[19378]: Failed password for root from 183.81.169.238 port 41966 ssh2

• 2024-10-03T06:30:49.936111+00:00 Linux04 sshd[3713015]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T06:30:51.518277+00:00 Linux04 sshd[3713015]: Failed password for root from 183.81.169.238 port 48386 ssh2
  2024-10-03T06:30:54.373253+00:00 Linux04 sshd[3713281]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T06:30:56.642351+00:00 Linux04 sshd[3713281]: Failed password for root from 183.81.169.238 port 48392 ssh2
  2024-10-03T06:31:00.756604+00:00 Linux04 sshd[3713614]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T06:31:03.181426+00:00 Linux04 sshd[3713614]: Failed password for root from 183.81.169.238 port 51120 ssh2
  2024-10-03T06:31:07.306783+00:00 Linux04 sshd[3713907]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= r
  ...

• Oct 3 06:31:46 minio sshd[651158]: Invalid user Antminer from 183.81.169.238 port 57924
  Oct 3 06:31:49 minio sshd[651160]: Invalid user Antminer from 183.81.169.238 port 57938
  Oct 3 06:32:03 minio sshd[651178]: Invalid user admin from 183.81.169.238 port 32850
  ...

• 2024-10-03T06:30:55.610319+00:00 frhb72991flex sshd[2171337]: Invalid user Antminer from 183.81.169.238 port 56678
  2024-10-03T06:30:57.624979+00:00 frhb72991flex sshd[2171339]: Invalid user Antminer from 183.81.169.238 port 56702
  ...

• 2024-10-03 04:06:12 UTC Unauthorized activity to TCP port 22. SSH

• Oct 3 06:30:42 ice1 sshd[3549688]: Invalid user Antminer from 183.81.169.238 port 51834
  Oct 3 06:30:44 ice1 sshd[3549690]: Invalid user Antminer from 183.81.169.238 port 51842
  ...

• 2024-10-03 03:31:00 UTC Unauthorized activity to TCP port 22. SSH

• Oct 3 06:30:05 mail sshd[210754]: Failed password for root from 183.81.169.238 port 47076 ssh2
  Oct 3 06:30:08 mail sshd[210756]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:30:10 mail sshd[210756]: Failed password for root from 183.81.169.238 port 56404 ssh2
  ...

• Oct 3 06:29:26 localhost sshd[2307214]: Failed password for root from 183.81.169.238 port 48128 ssh2
  Oct 3 06:29:30 localhost sshd[2307217]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:29:33 localhost sshd[2307217]: Failed password for root from 183.81.169.238 port 36716 ssh2
  Oct 3 06:29:37 localhost sshd[2307220]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:29:39 localhost sshd[2307220]: Failed password for root from 183.81.169.238 port 60838 ssh2
  ...

• Oct 3 08:27:47 4429 sshd[91924]: Failed password for root from 183.81.169.238 port 55186 ssh2
  Oct 3 08:27:51 4429 sshd[91926]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 08:27:53 4429 sshd[91926]: Failed password for root from 183.81.169.238 port 55210 ssh2
  ...

• Oct 3 08:26:28 EMIRATESofBULGARIA sshd[3970717]: Failed password for root from 183.81.169.238 port 46408 ssh2
  Oct 3 08:26:31 EMIRATESofBULGARIA sshd[3970722]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 08:26:32 EMIRATESofBULGARIA sshd[3970722]: Failed password for root from 183.81.169.238 port 42364 ssh2
  Oct 3 08:26:36 EMIRATESofBULGARIA sshd[3970728]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 08:26:38 EMIRATESofBULGARIA sshd[3970728]: Failed password for root from 183.81.169.238 port 42368 ssh2
  Oct 3 08:26:41 EMIRATESofBULGARIA sshd[3970734]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 08:26:43 EMIRATESofBULGARIA sshd[3970734]: Failed password for root from 183.81.169.238 port 41858 ssh2
  ...

• 2024-10-03T02:25:07.395145-04:00 ns05-a-ns-xyz sshd[2257498]: Failed password for root from 183.81.169.238 port 38204 ssh2
  2024-10-03T02:25:10.739041-04:00 ns05-a-ns-xyz sshd[2257500]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T02:25:12.783922-04:00 ns05-a-ns-xyz sshd[2257500]: Failed password for root from 183.81.169.238 port 50970 ssh2
  2024-10-03T02:25:16.550309-04:00 ns05-a-ns-xyz sshd[2257502]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T02:25:19.089969-04:00 ns05-a-ns-xyz sshd[2257502]: Failed password for root from 183.81.169.238 port 36982 ssh2
  ...

• 2024-10-03T08:24:05.922050+02:00 secure sshd[52051]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-03T08:24:07.833685+02:00 secure sshd[52053]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-03T08:24:09.912121+02:00 secure sshd[52055]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  ...

• 2024-10-03T06:23:55.620473+00:00 srv67 sshd[64092]: Connection closed by authenticating user root 183.81.169.238 port 41382 [preauth]
  ...

• 2024-10-03T02:23:31.254894-04:00 collabhost.computernewb.com sshd-session[3703215]: Invalid user Antminer from 183.81.169.238 port 34816
  2024-10-03T02:23:33.442127-04:00 collabhost.computernewb.com sshd-session[3703217]: Invalid user Antminer from 183.81.169.238 port 34838
  2024-10-03T02:23:47.394549-04:00 collabhost.computernewb.com sshd-session[3703241]: Invalid user admin from 183.81.169.238 port 40476
  ...

• 2024-10-03T07:23:08.020104+01:00 jane sshd[4086504]: Failed password for root from 183.81.169.238 port 38630 ssh2
  2024-10-03T07:23:11.045709+01:00 jane sshd[4086579]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T07:23:13.420102+01:00 jane sshd[4086579]: Failed password for root from 183.81.169.238 port 38670 ssh2
  ...

• Oct 3 08:22:24 speedtaq-com-vm-vm sshd[25874]: Invalid user Antminer from 183.81.169.238 port 55880

• 2024-10-03T08:22:14.520671+02:00 srv1 sshd[70042]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T08:22:16.734972+02:00 srv1 sshd[70042]: Failed password for root from 183.81.169.238 port 33562 ssh2
  ...

• Oct 3 08:21:21 athena sshd[871707]: Failed password for root from 183.81.169.238 port 55576 ssh2
  Oct 3 08:21:24 athena sshd[871717]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 08:21:25 athena sshd[871717]: Failed password for root from 183.81.169.238 port 55600 ssh2
  Oct 3 08:21:29 athena sshd[871740]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 08:21:31 athena sshd[871740]: Failed password for root from 183.81.169.238 port 41382 ssh2
  ...

• Oct 3 06:20:33 c2 sshd[2049448]: Failed password for root from 183.81.169.238 port 43646 ssh2
  Oct 3 06:20:36 c2 sshd[2049454]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:20:38 c2 sshd[2049454]: Failed password for root from 183.81.169.238 port 49654 ssh2
  Oct 3 06:20:43 c2 sshd[2049458]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:20:45 c2 sshd[2049458]: Failed password for root from 183.81.169.238 port 49680 ssh2
  ...

• Unsolicited connection attempt(s), port:22.

• Oct 3 08:18:20 [redacted] sshd[3811017]: Failed password for [redacted] from 183.81.169.238 port 51740 ssh2
  Oct 3 08:18:24 [redacted] sshd[3811050]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=[redacted]
  Oct 3 08:18:25 [redacted] sshd[3811050]: Failed password for [redacted] from 183.81.169.238 port 51784 ssh2
  Oct 3 08:18:29 [redacted] sshd[3811104]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=[redacted]
  Oct 3 08:18:32 [redacted] sshd[3811104]: Failed password for [redacted] from 183.81.169.238 port 50720 ssh2
  ...

• Oct 3 09:18:00 server2 sshd\[7100\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 09:18:01 server2 sshd\[7103\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 09:18:03 server2 sshd\[7132\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 09:18:04 server2 sshd\[7134\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 09:18:06 server2 sshd\[7136\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 09:18:08 server2 sshd\[7138\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers

• Oct 2 23:16:04 LU-VPS01 sshd[30232]: Failed password for root from 183.81.169.238 port 59430 ssh2
  Oct 2 23:16:10 LU-VPS01 sshd[30236]: Failed password for root from 183.81.169.238 port 43368 ssh2
  ...

• 2024-10-03T02:15:53.596818-04:00 nova3 sshd[2020456]: Failed password for root from 183.81.169.238 port 47622 ssh2
  2024-10-03T02:15:56.514702-04:00 nova3 sshd[2020516]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T02:15:58.503506-04:00 nova3 sshd[2020516]: Failed password for root from 183.81.169.238 port 54486 ssh2
  2024-10-03T02:16:02.325964-04:00 nova3 sshd[2020564]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T02:16:04.474676-04:00 nova3 sshd[2020564]: Failed password for root from 183.81.169.238 port 54544 ssh2
  ...

• Oct 3 08:15:30 vps-9f3cdc33 sshd[1883538]: Failed password for root from 183.81.169.238 port 42990 ssh2
  Oct 3 08:15:34 vps-9f3cdc33 sshd[1883540]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 08:15:36 vps-9f3cdc33 sshd[1883540]: Failed password for root from 183.81.169.238 port 43006 ssh2
  Oct 3 08:15:38 vps-9f3cdc33 sshd[1883542]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 08:15:40 vps-9f3cdc33 sshd[1883542]: Failed password for root from 183.81.169.238 port 47916 ssh2
  ...

• Events: TCP SYN Discovery or Flooding, Seen 139 times in the last 10800 seconds

• FW-PortScan: Traffic Blocked srcport=34537 dstport=22

• Oct 3 09:43:41 Digitalogic sshd[1414077]: Connection closed by authenticating user root 183.81.169.238 port 58614 [preauth]
  Oct 3 09:43:43 Digitalogic sshd[1414105]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 09:43:45 Digitalogic sshd[1414105]: Failed password for root from 183.81.169.238 port 58630 ssh2
  ...

• Oct 3 08:12:29 host sshd[3723570]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 08:12:31 host sshd[3723570]: Failed password for root from 183.81.169.238 port 44014 ssh2
  Oct 3 08:12:34 host sshd[3723646]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 08:12:36 host sshd[3723646]: Failed password for root from 183.81.169.238 port 44022 ssh2
  Oct 3 08:12:40 host sshd[3723759]: Invalid user admin from 183.81.169.238 port 35784
  ...

• Oct 3 06:12:15 Proxmox-VE sshd[171029]: Failed password for root from 183.81.169.238 port 37544 ssh2
  Oct 3 06:12:17 Proxmox-VE sshd[171048]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:12:19 Proxmox-VE sshd[171048]: Failed password for root from 183.81.169.238 port 45476 ssh2
  Oct 3 06:12:22 Proxmox-VE sshd[171072]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:12:25 Proxmox-VE sshd[171072]: Failed password for root from 183.81.169.238 port 45490 ssh2
  ...

• 2024-10-03T08:10:44.104881+02:00 sasrv sshd[5568]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-03T08:10:46.216231+02:00 sasrv sshd[5570]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-03T08:10:48.328295+02:00 sasrv sshd[5572]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-03T08:10:50.491703+02:00 sasrv sshd[5575]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-03T08:10:52.275150+02:00 sasrv sshd[5577]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  ...

• Oct 3 08:10:55 docker-01 sshd[266417]: Failed password for root from 183.81.169.238 port 38188 ssh2
  Oct 3 08:11:00 docker-01 sshd[266421]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 08:11:02 docker-01 sshd[266421]: Failed password for root from 183.81.169.238 port 39920 ssh2
  Oct 3 08:11:04 docker-01 sshd[266423]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 08:11:06 docker-01 sshd[266423]: Failed password for root from 183.81.169.238 port 39938 ssh2
  ...

• Oct 3 09:09:25 DarkSquad sshd[107433]: Failed password for root from 183.81.169.238 port 42756 ssh2
  Oct 3 09:09:29 DarkSquad sshd[107442]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 09:09:30 DarkSquad sshd[107442]: Failed password for root from 183.81.169.238 port 38302 ssh2
  Oct 3 09:09:33 DarkSquad sshd[107444]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 09:09:34 DarkSquad sshd[107444]: Failed password for root from 183.81.169.238 port 38344 ssh2
  Oct 3 09:09:38 DarkSquad sshd[107449]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 09:09:39 DarkSquad sshd[107449]: Failed password for root from 183.81.169.238 port 37852 ssh2
  ...

• Oct 3 06:09:03 vps-d7931dc8 sshd[473026]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:09:05 vps-d7931dc8 sshd[473026]: Failed password for root from 183.81.169.238 port 59812 ssh2
  Oct 3 06:09:06 vps-d7931dc8 sshd[473026]: Connection closed by authenticating user root 183.81.169.238 port 59812 [preauth]
  Oct 3 06:09:08 vps-d7931dc8 sshd[473028]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:09:10 vps-d7931dc8 sshd[473028]: Failed password for root from 183.81.169.238 port 34868 ssh2

• Oct 3 01:07:06 ivankin sshd[436966]: Failed password for root from 183.81.169.238 port 38800 ssh2
  Oct 3 01:07:10 ivankin sshd[436969]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 01:07:12 ivankin sshd[436969]: Failed password for root from 183.81.169.238 port 44696 ssh2
  ...

• Oct 3 08:06:27 vmi147057 sshd[908477]: Failed password for root from 183.81.169.238 port 54272 ssh2
  Oct 3 08:06:31 vmi147057 sshd[908492]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 08:06:33 vmi147057 sshd[908492]: Failed password for root from 183.81.169.238 port 54304 ssh2
  Oct 3 08:06:38 vmi147057 sshd[908508]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 08:06:40 vmi147057 sshd[908508]: Failed password for root from 183.81.169.238 port 35940 ssh2
  ...

• 2024-10-03T08:06:10.873035+02:00 hosting13 sshd[263193]: Failed password for root from 183.81.169.238 port 50838 ssh2
  2024-10-03T08:06:14.136702+02:00 hosting13 sshd[263204]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T08:06:15.558341+02:00 hosting13 sshd[263204]: Failed password for root from 183.81.169.238 port 50848 ssh2
  2024-10-03T08:06:17.796053+02:00 hosting13 sshd[263262]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T08:06:19.963907+02:00 hosting13 sshd[263262]: Failed password for root from 183.81.169.238 port 37218 ssh2
  ...

• tcp/22 (29 or more attempts)

• Oct 3 06:03:47 shirus29 sshd[2475158]: Failed password for root from 183.81.169.238 port 35278 ssh2
  Oct 3 06:03:51 shirus29 sshd[2475161]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:03:52 shirus29 sshd[2475161]: Failed password for root from 183.81.169.238 port 57874 ssh2
  Oct 3 06:03:56 shirus29 sshd[2475163]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:03:58 shirus29 sshd[2475163]: Failed password for root from 183.81.169.238 port 37534 ssh2
  ...

• 2024-10-03T06:03:37.748639us1.starnode.us sshd[1506635]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T06:03:39.615697us1.starnode.us sshd[1506635]: Failed password for root from 183.81.169.238 port 55538 ssh2
  ...

• [rede-166-249] (sshd) Failed SSH login from 183.81.169.238 (NL/The Netherlands/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Oct 3 03:02:48 sshd[17875]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=[USERNAME]
  Oct 3 03:02:50 sshd[17875]: Failed password for [USERNAME] from 183.81.169.238 port 42650 ssh2
  Oct 3 03:02:54 sshd[17885]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=[USERNAME]
  Oct 3 03:02:55 sshd[17885]: Failed password for [USERNAME] from 183.81.169.238 port 42728 ssh2
  Oct 3 03:

• Ports: 22; 2 attempts

• 2024-10-03T08:00:22.408730+02:00 vmi985635.contaboserver.net sshd[2512761]: Failed password for root from 183.81.169.238 port 52330 ssh2
  2024-10-03T08:00:25.639131+02:00 vmi985635.contaboserver.net sshd[2512791]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T08:00:28.015442+02:00 vmi985635.contaboserver.net sshd[2512791]: Failed password for root from 183.81.169.238 port 50944 ssh2
  2024-10-03T08:00:31.229425+02:00 vmi985635.contaboserver.net sshd[2512819]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T08:00:33.136494+02:00 vmi985635.contaboserver.net sshd[2512819]: Failed password for root from 183.81.169.238 port 50976 ssh2
  ...

• 10628 attempts since 14.07.2024 04:18:57 UTC - last one: 2024-10-03T07:00:37.255960+02:00 alpha sshd[2346037]: Connection closed by invalid user baikal 183.81.169.238 port 42984 [preauth]

• Oct 3 05:59:09 alpha sshd[2682515]: Failed password for root from 183.81.169.238 port 54714 ssh2
  Oct 3 05:59:11 alpha sshd[2682568]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 05:59:13 alpha sshd[2682568]: Failed password for root from 183.81.169.238 port 54724 ssh2
  Oct 3 05:59:16 alpha sshd[2682628]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 05:59:18 alpha sshd[2682628]: Failed password for root from 183.81.169.238 port 37770 ssh2
  ...

• Invalid user Antminer from 183.81.169.238 port 37252

• Invalid user Antminer from 183.81.169.238 port 41434

• Oct 3 07:58:54 h2691902 sshd[7728]: Failed password for root from 183.81.169.238 port 34312 ssh2
  Oct 3 07:58:56 h2691902 sshd[7730]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 07:58:58 h2691902 sshd[7730]: Failed password for root from 183.81.169.238 port 53774 ssh2
  Oct 3 07:59:01 h2691902 sshd[7732]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 07:59:02 h2691902 sshd[7732]: Failed password for root from 183.81.169.238 port 53804 ssh2
  ...

• Oct 3 07:58:25 SFEEDS sshd[490124]: Failed password for root from 183.81.169.238 port 54706 ssh2
  Oct 3 07:58:27 SFEEDS sshd[490128]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 07:58:29 SFEEDS sshd[490128]: Failed password for root from 183.81.169.238 port 56360 ssh2
  Oct 3 07:58:32 SFEEDS sshd[490130]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 07:58:34 SFEEDS sshd[490130]: Failed password for root from 183.81.169.238 port 56390 ssh2
  ...

• Failed password for root from 183.81.169.238 port 38894 ssh2
  pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Failed password for root from 183.81.169.238 port 52356 ssh2
  pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Failed password for root from 183.81.169.238 port 55702 ssh2

• Firewall IPS Detection on 03-10-2024 at 07:56:05

• FW-PortScan: Traffic Blocked srcport=39740 dstport=22

• Oct 3 05:55:32 dn42 sshd[705860]: Invalid user Antminer from 183.81.169.238 port 45268
  Oct 3 05:55:34 dn42 sshd[705862]: Invalid user Antminer from 183.81.169.238 port 45294
  Oct 3 05:55:44 dn42 sshd[705874]: Invalid user admin from 183.81.169.238 port 47184
  ...

• 2024-10-03T07:53:48.250939+02:00 devcricle sshd[414]: Failed password for root from 183.81.169.238 port 56026 ssh2
  2024-10-03T07:53:51.366868+02:00 devcricle sshd[416]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T07:53:53.457962+02:00 devcricle sshd[416]: Failed password for root from 183.81.169.238 port 56066 ssh2
  ...

• 2024-10-03T05:53:16.062129+00:00 deb0 sshd[60741]: Connection closed by authenticating user root 183.81.169.238 port 37344 [preauth]
  ...

• Oct 3 07:52:39 spectralrp sshd[548757]: Failed password for root from 183.81.169.238 port 38438 ssh2
  Oct 3 07:52:43 spectralrp sshd[548765]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 07:52:45 spectralrp sshd[548765]: Failed password for root from 183.81.169.238 port 38996 ssh2
  Oct 3 07:52:48 spectralrp sshd[548770]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 07:52:50 spectralrp sshd[548770]: Failed password for root from 183.81.169.238 port 39000 ssh2
  Oct 3 07:52:55 spectralrp sshd[548775]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 07:52:57 spectralrp sshd[548775]: Failed password for root from 183.81.169.238 port 42064 ssh2
  ...

• Oct 3 05:48:46 webserver sshd[743278]: Failed password for root from 183.81.169.238 port 39066 ssh2
  Oct 3 05:48:48 webserver sshd[743280]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 05:48:50 webserver sshd[743280]: Failed password for root from 183.81.169.238 port 50788 ssh2
  Oct 3 05:48:54 webserver sshd[743282]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 05:48:57 webserver sshd[743282]: Failed password for root from 183.81.169.238 port 50804 ssh2
  ...

• [rede-168-134] 10/03/2024-02:47:32.368870, 183.81.169.238, Protocol: 6, ET COMPROMISED Known Compromised or Hostile Host Traffic group 13

• Funeypot detected 4377 ssh attempts in 568h2m18s. Last by user "root", password "*", client "Go".

• Oct 3 08:45:05 server2 sshd\[4333\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 08:45:06 server2 sshd\[4335\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 08:45:07 server2 sshd\[4337\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 08:45:09 server2 sshd\[4339\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 08:45:11 server2 sshd\[4341\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 08:45:12 server2 sshd\[4343\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers

• 2024-10-03T05:11:35.754795+00:00 Linux07 sshd[2590979]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T05:11:38.029750+00:00 Linux07 sshd[2590979]: Failed password for root from 183.81.169.238 port 43460 ssh2
  2024-10-03T05:11:42.231141+00:00 Linux07 sshd[2591249]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T05:11:44.133942+00:00 Linux07 sshd[2591249]: Failed password for root from 183.81.169.238 port 39872 ssh2
  2024-10-03T05:11:48.451470+00:00 Linux07 sshd[2591738]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T05:11:50.510694+00:00 Linux07 sshd[2591738]: Failed password for root from 183.81.169.238 port 52468 ssh2
  2024-10-03T05:11:54.470831+00:00 Linux07 sshd[2592238]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= r
  ...

• 8 attempts on TCP Port:22

• Oct 3 07:00:19 oghma sshd[2416128]: Invalid user baikal from 183.81.169.238 port 56712
  Oct 3 07:43:53 oghma sshd[2434616]: Invalid user Antminer from 183.81.169.238 port 42770
  Oct 3 07:43:54 oghma sshd[2434644]: Invalid user Antminer from 183.81.169.238 port 42780
  Oct 3 07:44:03 oghma sshd[2434768]: Invalid user admin from 183.81.169.238 port 59986
  Oct 3 07:44:04 oghma sshd[2434798]: Invalid user baikal from 183.81.169.238 port 51346
  ...

• Oct 3 07:42:18 AbuseCatcher sshd[24796]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 07:42:20 AbuseCatcher sshd[24796]: Failed password for root from 183.81.169.238 port 45614 ssh2
  ...

• 2024-10-03T07:41:57.067947+02:00 servidor1 sshd[312828]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-03T07:41:57.664868+02:00 servidor1 sshd[312828]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T07:41:59.734138+02:00 servidor1 sshd[312828]: Failed password for invalid user root from 183.81.169.238 port 46518 ssh2
  2024-10-03T07:42:02.547282+02:00 servidor1 sshd[312831]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-03T07:42:02.776664+02:00 servidor1 sshd[312831]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T07:42:04.534171+02:00 servidor1 sshd[312831]: Failed password for invalid user root from 183.81.169.238 port 46574 ssh2
  2024-10-03T07:42:06.012277+02:00 servidor1 sshd[312896]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  ...

• [05:41] Attempted SSH login on port 22 with credentials root:0

• 2024-10-03T01:41:46.841485-04:00 srv-UXQS4A.incognet.io sshd[1730]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T01:41:49.402526-04:00 srv-UXQS4A.incognet.io sshd[1730]: Failed password for invalid user root from 183.81.169.238 port 41116 ssh2
  ...

• Oct 3 01:41:01 www3 sshd[303775]: Failed password for root from 183.81.169.238 port 41294 ssh2
  Oct 3 01:41:04 www3 sshd[303777]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 01:41:07 www3 sshd[303777]: Failed password for root from 183.81.169.238 port 41318 ssh2
  Oct 3 01:41:11 www3 sshd[303779]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 01:41:14 www3 sshd[303779]: Failed password for root from 183.81.169.238 port 55854 ssh2
  ...

• unauthorized connection with user "root" and password "0" at 2024-10-03T05:40:54Z

• Oct 3 07:40:38 * sshd[2151156]: Failed password for root from 183.81.169.238 port 39566 ssh2
  Oct 3 07:40:40 * sshd[2151174]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 07:40:43 * sshd[2151174]: Failed password for root from 183.81.169.238 port 39568 ssh2

• FW-PortScan: Traffic Blocked srcport=43140 dstport=22

• 10905 attempts since 13.07.2024 23:53:03 UTC - last one: 2024-10-03T07:04:56.422292+02:00 beta sshd[2317235]: Connection closed by invalid user baikal 183.81.169.238 port 46908 [preauth]

• Oct 3 05:40:26 ubuntu sshd[1386155]: Invalid user Antminer from 183.81.169.238 port 58510
  Oct 3 05:40:27 ubuntu sshd[1386159]: Invalid user Antminer from 183.81.169.238 port 58524
  Oct 3 05:40:35 ubuntu sshd[1386235]: Invalid user admin from 183.81.169.238 port 48100
  ...

• 2024-10-03T07:40:24.019686+02:00 srv2 sshd[1643425]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T07:40:25.656352+02:00 srv2 sshd[1643425]: Failed password for root from 183.81.169.238 port 59676 ssh2
  ...

• Oct 3 02:40:24 SRC=183.81.169.238 PROTO=TCP SPT=42163 DPT=22 SYN
  ...

• Unsolicited connection attempt(s), port:22.

• 2024-10-03T13:39:25.323059+08:00 raindance sshd[331918]: Failed password for root from 183.81.169.238 port 51726 ssh2
  2024-10-03T13:39:27.996104+08:00 raindance sshd[331974]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T13:39:30.476428+08:00 raindance sshd[331974]: Failed password for root from 183.81.169.238 port 60872 ssh2
  2024-10-03T13:39:34.634943+08:00 raindance sshd[332022]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T13:39:36.740049+08:00 raindance sshd[332022]: Failed password for root from 183.81.169.238 port 60902 ssh2
  ...

• 2024-10-03T12:39:06.006302+07:00 BAW-C03 sshd[64052]: Failed password for root from 183.81.169.238 port 50210 ssh2
  2024-10-03T12:39:08.977613+07:00 BAW-C03 sshd[64054]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T12:39:11.180681+07:00 BAW-C03 sshd[64054]: Failed password for root from 183.81.169.238 port 33446 ssh2
  2024-10-03T12:39:15.461251+07:00 BAW-C03 sshd[64056]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T12:39:17.288360+07:00 BAW-C03 sshd[64056]: Failed password for root from 183.81.169.238 port 33450 ssh2
  ...

• Oct 3 06:38:45 dlcentre3 sshd[28763]: Failed password for root from 183.81.169.238 port 56654 ssh2

• Oct 2 22:37:43 server01 sshd[23036]: Failed password for root from 183.81.169.238 port 38820 ssh2
  Oct 2 22:37:49 server01 sshd[23038]: Failed password for root from 183.81.169.238 port 53232 ssh2
  ...

• I1003 07:35:35.103142 1 client.go:99] CLOSE host=183.81.169.238 port=56180 time=79.53291371 bytes=277
  ...

• 2024-10-03T00:35:00.033948-05:00 instance-20240522-152753 sshd[2556652]: Invalid user Antminer from 183.81.169.238 port 42392
  2024-10-03T00:35:01.207114-05:00 instance-20240522-152753 sshd[2556654]: Invalid user Antminer from 183.81.169.238 port 42408
  2024-10-03T00:35:07.741744-05:00 instance-20240522-152753 sshd[2556702]: Invalid user admin from 183.81.169.238 port 60942
  2024-10-03T00:35:09.216104-05:00 instance-20240522-152753 sshd[2556704]: Invalid user baikal from 183.81.169.238 port 60948
  ...

• Oct 3 05:34:37 hardcore-tesla sshd[4009024]: Failed password for root from 183.81.169.238 port 43138 ssh2
  Oct 3 05:34:38 hardcore-tesla sshd[4009026]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 05:34:40 hardcore-tesla sshd[4009026]: Failed password for root from 183.81.169.238 port 43154 ssh2
  Oct 3 05:34:42 hardcore-tesla sshd[4009028]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 05:34:44 hardcore-tesla sshd[4009028]: Failed password for root from 183.81.169.238 port 43160 ssh2
  ...

• Oct 3 07:34:36 hosting sshd[3012050]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 07:34:37 hosting sshd[3012050]: Failed password for root from 183.81.169.238 port 34676 ssh2
  Oct 3 07:34:39 hosting sshd[3012055]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 07:34:41 hosting sshd[3012055]: Failed password for root from 183.81.169.238 port 34690 ssh2

• Oct 3 07:34:17 vps643776 sshd[1290187]: Failed password for root from 183.81.169.238 port 48904 ssh2
  Oct 3 07:34:19 vps643776 sshd[1290189]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 07:34:21 vps643776 sshd[1290189]: Failed password for root from 183.81.169.238 port 48906 ssh2
  Oct 3 07:34:22 vps643776 sshd[1290191]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 07:34:24 vps643776 sshd[1290191]: Failed password for root from 183.81.169.238 port 48934 ssh2
  ...

• 2024-10-03T07:33:44.986439+02:00 hvs sshd-session[47254]: Connection closed by authenticating user root 183.81.169.238 port 46296 [preauth]
  2024-10-03T07:33:46.407720+02:00 hvs sshd-session[47258]: Connection closed by authenticating user root 183.81.169.238 port 46304 [preauth]
  2024-10-03T07:33:46.804141+02:00 hvs sshd-session[47260]: Connection closed by authenticating user root 183.81.169.238 port 46320 [preauth]
  2024-10-03T07:33:47.613761+02:00 hvs sshd-session[47262]: Connection closed by authenticating user root 183.81.169.238 port 46322 [preauth]
  2024-10-03T07:33:47.950642+02:00 hvs sshd-session[47264]: Connection closed by authenticating user root 183.81.169.238 port 46324 [preauth]
  ...

• Oct 3 07:33:35 ts-24 sshd[394659]: Failed password for root from 183.81.169.238 port 41602 ssh2
  Oct 3 07:33:37 ts-24 sshd[394661]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 07:33:38 ts-24 sshd[394661]: Failed password for root from 183.81.169.238 port 36502 ssh2
  Oct 3 07:33:40 ts-24 sshd[394663]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 07:33:43 ts-24 sshd[394663]: Failed password for root from 183.81.169.238 port 36512 ssh2
  ...

• Oct 3 01:32:11 vps196363 sshd[4718]: Failed password for root from 183.81.169.238 port 39506 ssh2
  Oct 3 01:32:14 vps196363 sshd[4721]: Failed password for root from 183.81.169.238 port 39534 ssh2
  Oct 3 01:32:17 vps196363 sshd[4723]: Failed password for root from 183.81.169.238 port 33904 ssh2
  ...

• Oct 3 07:30:29 SlunchakaRP sshd[87280]: Failed password for root from 183.81.169.238 port 57132 ssh2
  Oct 3 07:30:30 SlunchakaRP sshd[87285]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 07:30:32 SlunchakaRP sshd[87285]: Failed password for root from 183.81.169.238 port 57146 ssh2
  Oct 3 07:30:34 SlunchakaRP sshd[87292]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 07:30:36 SlunchakaRP sshd[87292]: Failed password for root from 183.81.169.238 port 36670 ssh2
  Oct 3 07:30:38 SlunchakaRP sshd[87298]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 07:30:40 SlunchakaRP sshd[87298]: Failed password for root from 183.81.169.238 port 36678 ssh2
  ...

• Oct 3 05:30:32 24fire sshd[196407]: Failed password for root from 183.81.169.238 port 54814 ssh2
  Oct 3 05:30:33 24fire sshd[196409]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 05:30:35 24fire sshd[196409]: Failed password for root from 183.81.169.238 port 54844 ssh2
  Oct 3 05:30:36 24fire sshd[196411]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 05:30:38 24fire sshd[196411]: Failed password for root from 183.81.169.238 port 35874 ssh2
  ...

• 2024-10-03T05:29:32.122716+00:00 ubuntu sshd[1504431]: Invalid user Antminer from 183.81.169.238 port 33922
  2024-10-03T05:29:32.491264+00:00 ubuntu sshd[1504433]: Invalid user Antminer from 183.81.169.238 port 33928
  ...

• Oct 3 07:29:10 odin sshd[32497]: Failed password for root from 183.81.169.238 port 49310 ssh2
  Oct 3 07:29:15 odin sshd[32501]: Failed password for root from 183.81.169.238 port 49318 ssh2

• [rede-164-29] (sshd) Failed SSH login from 183.81.169.238 (NL/The Netherlands/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Oct 3 02:28:17 sshd[22682]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=[USERNAME]
  Oct 3 02:28:19 sshd[22682]: Failed password for [USERNAME] from 183.81.169.238 port 55052 ssh2
  Oct 3 02:28:21 sshd[22690]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=[USERNAME]
  Oct 3 02:28:23 sshd[22690]: Failed password for [USERNAME] from 183.81.169.238 port 55082 ssh2
  Oct 3 02:

• Oct 3 05:27:54 DuoX sshd[930857]: Failed password for root from 183.81.169.238 port 46668 ssh2
  Oct 3 05:27:56 DuoX sshd[933040]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 05:27:58 DuoX sshd[933040]: Failed password for root from 183.81.169.238 port 52646 ssh2
  Oct 3 05:27:59 DuoX sshd[933113]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 05:28:02 DuoX sshd[933113]: Failed password for root from 183.81.169.238 port 52664 ssh2
  ...

• Oct 3 07:27:05 Ina sshd[1940163]: Failed password for root from 183.81.169.238 port 56574 ssh2
  Oct 3 07:27:08 Ina sshd[1940165]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 07:27:09 Ina sshd[1940165]: Failed password for root from 183.81.169.238 port 55848 ssh2
  Oct 3 07:27:10 Ina sshd[1940167]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 07:27:12 Ina sshd[1940167]: Failed password for root from 183.81.169.238 port 55882 ssh2
  ...

• Oct 3 07:26:43 vmi174663 sshd[2145732]: Failed password for root from 183.81.169.238 port 39706 ssh2
  Oct 3 07:26:45 vmi174663 sshd[2145781]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 07:26:46 vmi174663 sshd[2145781]: Failed password for root from 183.81.169.238 port 49430 ssh2
  Oct 3 07:26:48 vmi174663 sshd[2145808]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 07:26:50 vmi174663 sshd[2145808]: Failed password for root from 183.81.169.238 port 49444 ssh2
  ...

• Oct 3 05:26:30 internal-mail-rafled-com sshd[1114158]: Invalid user Antminer from 183.81.169.238 port 39550
  ...

• Oct 3 05:23:12 cknpih001 sshd[34052]: Failed password for root from 183.81.169.238 port 40436 ssh2
  Oct 3 05:23:13 cknpih001 sshd[34054]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 05:23:15 cknpih001 sshd[34054]: Failed password for root from 183.81.169.238 port 40444 ssh2
  Oct 3 05:23:18 cknpih001 sshd[34056]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 05:23:19 cknpih001 sshd[34056]: Failed password for root from 183.81.169.238 port 41450 ssh2
  ...

• FW-PortScan: Traffic Blocked srcport=44213 dstport=22

• Oct 3 05:21:36 Sildom2 sshd[1563312]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 05:21:38 Sildom2 sshd[1563312]: Failed password for root from 183.81.169.238 port 34848 ssh2
  ...

• Oct 3 07:21:25 dsh1621 sshd[4063508]: Failed password for root from 183.81.169.238 port 42000 ssh2
  Oct 3 07:21:25 dsh1621 sshd[4063515]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 07:21:27 dsh1621 sshd[4063515]: Failed password for root from 183.81.169.238 port 51572 ssh2
  Oct 3 07:21:28 dsh1621 sshd[4063550]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 07:21:31 dsh1621 sshd[4063550]: Failed password for root from 183.81.169.238 port 51594 ssh2
  ...

• 2024-10-03T05:20:52.582933+00:00 BAW-C01 sshd-session[428560]: Failed password for root from 183.81.169.238 port 40496 ssh2
  2024-10-03T05:20:55.787209+00:00 BAW-C01 sshd-session[428563]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T05:20:57.970437+00:00 BAW-C01 sshd-session[428563]: Failed password for root from 183.81.169.238 port 51496 ssh2
  2024-10-03T05:21:01.054818+00:00 BAW-C01 sshd-session[428566]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T05:21:02.589817+00:00 BAW-C01 sshd-session[428566]: Failed password for root from 183.81.169.238 port 51504 ssh2
  ...

• 2024-10-03T07:20:20.701567+02:00 srv1 sshd[2869578]: Failed password for root from 183.81.169.238 port 57592 ssh2
  2024-10-03T07:20:23.100665+02:00 srv1 sshd[2869680]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T07:20:25.526428+02:00 srv1 sshd[2869680]: Failed password for root from 183.81.169.238 port 57612 ssh2
  2024-10-03T07:20:27.867444+02:00 srv1 sshd[2869684]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T07:20:29.841399+02:00 srv1 sshd[2869684]: Failed password for root from 183.81.169.238 port 38182 ssh2
  ...

• Unsolicited connection attempt(s), port:22.

• Oct 3 00:19:12 jms-new-production sshd[85560]: Invalid user Antminer from 183.81.169.238 port 45614
  Oct 3 00:19:13 jms-new-production sshd[85562]: Invalid user Antminer from 183.81.169.238 port 45620
  ...

• Oct 2 23:18:52 mortgagebase sshd[18977]: Failed password for root from 183.81.169.238 port 46586 ssh2
  Oct 2 23:18:53 mortgagebase sshd[18979]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 23:18:55 mortgagebase sshd[18979]: Failed password for root from 183.81.169.238 port 46626 ssh2
  Oct 2 23:18:57 mortgagebase sshd[18981]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 23:18:59 mortgagebase sshd[18981]: Failed password for root from 183.81.169.238 port 44822 ssh2
  ...

• 2024-10-03T01:18:26.485724-04:00 prod-1 sshd[3548663]: Connection closed by authenticating user root 183.81.169.238 port 43268 [preauth]
  2024-10-03T01:18:27.004261-04:00 prod-1 sshd[3548665]: Connection closed by authenticating user root 183.81.169.238 port 43276 [preauth]
  2024-10-03T01:18:27.594807-04:00 prod-1 sshd[3548667]: Connection closed by authenticating user root 183.81.169.238 port 43282 [preauth]
  2024-10-03T01:18:28.252645-04:00 prod-1 sshd[3548669]: Connection closed by authenticating user root 183.81.169.238 port 43286 [preauth]
  2024-10-03T01:18:28.998445-04:00 prod-1 sshd[3548671]: Connection closed by authenticating user root 183.81.169.238 port 43298 [preauth]
  ...

• Oct 3 06:58:51 pinomail sshd[2134536]: Invalid user admin from 183.81.169.238 port 53828
  Oct 3 06:58:53 pinomail sshd[2134541]: Invalid user baikal from 183.81.169.238 port 53854
  Oct 3 07:17:20 pinomail sshd[2272115]: Invalid user Antminer from 183.81.169.238 port 54454
  Oct 3 07:17:20 pinomail sshd[2272117]: Invalid user Antminer from 183.81.169.238 port 54468
  Oct 3 07:17:21 pinomail sshd[2272141]: Invalid user admin from 183.81.169.238 port 54516
  ...

• Oct 3 06:17:20 sheikh-ahmed-abu-islam-v2 sshd[3378867]: Invalid user Antminer from 183.81.169.238 port 50560
  Oct 3 06:17:20 sheikh-ahmed-abu-islam-v2 sshd[3378869]: Invalid user Antminer from 183.81.169.238 port 50570
  ...

• Oct 3 01:17:05 fremontnet-scca-01 sshd[18049]: Failed password for root from 183.81.169.238 port 48668 ssh2
  Oct 3 01:17:09 fremontnet-scca-01 sshd[18052]: Failed password for root from 183.81.169.238 port 50532 ssh2

• SSH port scan (Tarpitted for 40s, wasted 41B)

• 2024-10-03T05:13:59.752646+00:00 Linux06 sshd[335269]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T05:14:02.128059+00:00 Linux06 sshd[335269]: Failed password for root from 183.81.169.238 port 49910 ssh2
  2024-10-03T05:14:06.582330+00:00 Linux06 sshd[335649]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T05:14:09.253075+00:00 Linux06 sshd[335649]: Failed password for root from 183.81.169.238 port 39052 ssh2
  2024-10-03T05:14:13.534911+00:00 Linux06 sshd[336079]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T05:14:15.499029+00:00 Linux06 sshd[336079]: Failed password for root from 183.81.169.238 port 39086 ssh2
  2024-10-03T05:14:18.004958+00:00 Linux06 sshd[336336]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=18
  ...

• Oct 3 07:16:04 AbuseCatcher sshd[22878]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 07:16:06 AbuseCatcher sshd[22878]: Failed password for root from 183.81.169.238 port 42504 ssh2
  ...

• Unauthorized connection attempt from IP address 183.81.169.238 on Port 22

• Oct 3 07:15:12 CDN sshd[1792007]: Failed password for root from 183.81.169.238 port 39056 ssh2
  Oct 3 07:15:15 CDN sshd[1792009]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 07:15:17 CDN sshd[1792009]: Failed password for root from 183.81.169.238 port 39068 ssh2
  Oct 3 07:15:20 CDN sshd[1792011]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 07:15:22 CDN sshd[1792011]: Failed password for root from 183.81.169.238 port 52480 ssh2

• 2024-10-03T07:12:33.468113vps773228.ovh.net sshd[9124]: Failed password for root from 183.81.169.238 port 49750 ssh2
  2024-10-03T07:12:36.171220vps773228.ovh.net sshd[9126]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T07:12:38.486781vps773228.ovh.net sshd[9126]: Failed password for root from 183.81.169.238 port 49756 ssh2
  2024-10-03T07:12:40.103562vps773228.ovh.net sshd[9128]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T07:12:41.967513vps773228.ovh.net sshd[9128]: Failed password for root from 183.81.169.238 port 44406 ssh2
  ...

• 2024-10-03T07:11:14.898444+02:00 docker sshd[1862817]: Failed password for root from 183.81.169.238 port 59856 ssh2
  2024-10-03T07:11:19.045010+02:00 docker sshd[1862849]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T07:11:21.652480+02:00 docker sshd[1862849]: Failed password for root from 183.81.169.238 port 58766 ssh2
  2024-10-03T07:11:24.765779+02:00 docker sshd[1862862]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T07:11:26.534181+02:00 docker sshd[1862862]: Failed password for root from 183.81.169.238 port 58776 ssh2
  ...

• Oct 3 01:10:33 graph sshd[2025144]: Failed password for root from 183.81.169.238 port 47970 ssh2
  Oct 3 01:10:37 graph sshd[2025147]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 01:10:38 graph sshd[2025147]: Failed password for root from 183.81.169.238 port 39428 ssh2
  Oct 3 01:10:41 graph sshd[2025159]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 01:10:43 graph sshd[2025159]: Failed password for root from 183.81.169.238 port 39462 ssh2
  ...

• Oct 3 07:09:53 BugsBunnyS1 sshd[2684786]: Failed password for root from 183.81.169.238 port 60114 ssh2
  Oct 3 07:09:56 BugsBunnyS1 sshd[2684791]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 07:09:58 BugsBunnyS1 sshd[2684791]: Failed password for root from 183.81.169.238 port 58448 ssh2
  Oct 3 07:10:03 BugsBunnyS1 sshd[2684801]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 07:10:05 BugsBunnyS1 sshd[2684801]: Failed password for root from 183.81.169.238 port 51440 ssh2
  Oct 3 07:10:08 BugsBunnyS1 sshd[2684807]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 07:10:10 BugsBunnyS1 sshd[2684807]: Failed password for root from 183.81.169.238 port 51444 ssh2
  ...

• 3:12:47I1003 03:
  Fail2ban action triggered

• 2024-10-03T07:08:56.814251+02:00 v220240537442267460 sshd[1450494]: Failed password for root from 183.81.169.238 port 49276 ssh2
  2024-10-03T07:09:00.734057+02:00 v220240537442267460 sshd[1450502]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T07:09:03.064464+02:00 v220240537442267460 sshd[1450502]: Failed password for root from 183.81.169.238 port 35108 ssh2
  2024-10-03T07:09:07.598442+02:00 v220240537442267460 sshd[1450620]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T07:09:09.551641+02:00 v220240537442267460 sshd[1450620]: Failed password for root from 183.81.169.238 port 55310 ssh2
  ...

• 2024-10-03T05:06:23.190198shield sshd\[6073\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T05:06:25.298740shield sshd\[6073\]: Failed password for root from 183.81.169.238 port 41112 ssh2
  2024-10-03T05:06:27.662427shield sshd\[6091\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T05:06:29.319268shield sshd\[6091\]: Failed password for root from 183.81.169.238 port 38098 ssh2
  2024-10-03T05:06:31.954788shield sshd\[6093\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root

• Oct 3 07:04:55 Servo sshd[3400119]: Invalid user Antminer from 183.81.169.238 port 35754
  Oct 3 07:04:57 Servo sshd[3400122]: Invalid user Antminer from 183.81.169.238 port 35762
  Oct 3 07:05:07 Servo sshd[3400403]: Invalid user admin from 183.81.169.238 port 38256
  ...

• tcp/22 (21 or more attempts)

• 2024-10-02 22:02:15,810 fail2ban.actions [689]: NOTICE [sshd] Ban 183.81.169.238

• Oct 3 07:01:40 markkoudstaal sshd[2866397]: Failed password for root from 183.81.169.238 port 42684 ssh2
  Oct 3 07:01:42 markkoudstaal sshd[2866411]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 07:01:44 markkoudstaal sshd[2866411]: Failed password for root from 183.81.169.238 port 42724 ssh2
  ...

• Ports: 22; 2 attempts

• Oct 3 07:00:28 git sshd[553228]: Invalid user Antminer from 183.81.169.238 port 42984
  Oct 3 07:00:30 git sshd[553230]: Invalid user Antminer from 183.81.169.238 port 42990
  Oct 3 07:00:41 git sshd[553242]: Invalid user admin from 183.81.169.238 port 32826
  ...

• Oct 2 22:00:30 nunnother sshd\[4914\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 22:00:31 nunnother sshd\[4914\]: Failed password for root from 183.81.169.238 port 46598 ssh2
  Oct 2 22:00:34 nunnother sshd\[4916\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 22:00:36 nunnother sshd\[4916\]: Failed password for root from 183.81.169.238 port 46616 ssh2
  Oct 2 22:00:39 nunnother sshd\[4918\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  ...

• FW-PortScan: Traffic Blocked srcport=36467 dstport=22

• 2024-10-03T05:00:29.786057+00:00 srv67 sshd[55494]: Connection closed by authenticating user root 183.81.169.238 port 55660 [preauth]
  ...

• 2024-10-03T07:00:08.337022+02:00 mail sshd[507963]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-03T07:00:11.028924+02:00 mail sshd[507968]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-03T07:00:13.329560+02:00 mail sshd[507970]: User root from 183.81.169.238 not allowed because not listed in AllowUsers

• Oct 3 04:59:31 VPS sshd[1763849]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 04:59:32 VPS sshd[1763849]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 04:59:31 VPS sshd[1763849]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 04:59:33 VPS sshd[1763849]: Failed password for invalid user root from 183.81.169.238 port 58638 ssh2
  Oct 3 04:59:36 VPS sshd[1763851]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  ...

• Oct 3 07:59:17 server2 sshd\[32099\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 07:59:19 server2 sshd\[32101\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 07:59:21 server2 sshd\[32108\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 07:59:22 server2 sshd\[32113\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 07:59:23 server2 sshd\[32116\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 07:59:24 server2 sshd\[32124\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers

• 2024-10-03 04:58:40,262 quad proftpd[1171319] quad (183.81.169.238[183.81.169.238]): USER root: no such user found from 183.81.169.238 [183.81.169.238] to 2.56.97.107:22

• Oct 3 04:57:12 scw-6657dc sshd[14721]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 04:57:12 scw-6657dc sshd[14721]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 04:57:14 scw-6657dc sshd[14721]: Failed password for root from 183.81.169.238 port 52396 ssh2
  ...

• 2024-10-02T21:56:36.717436-07:00 goldcrest sshd[224576]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T21:56:38.240736-07:00 goldcrest sshd[224576]: Failed password for root from 183.81.169.238 port 49116 ssh2
  2024-10-02T21:56:40.723288-07:00 goldcrest sshd[224578]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T21:56:43.465624-07:00 goldcrest sshd[224578]: Failed password for root from 183.81.169.238 port 46546 ssh2
  ...

• Oct 3 06:56:31 m2369 sshd[824481]: Failed password for root from 183.81.169.238 port 34050 ssh2
  Oct 3 06:56:34 m2369 sshd[824484]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:56:36 m2369 sshd[824484]: Failed password for root from 183.81.169.238 port 34064 ssh2
  Oct 3 06:56:39 m2369 sshd[824519]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:56:41 m2369 sshd[824519]: Failed password for root from 183.81.169.238 port 54506 ssh2
  ...

• Oct 3 00:55:01 scp sshd[3227650]: Invalid user Antminer from 183.81.169.238 port 48236
  Oct 3 00:55:04 scp sshd[3227730]: Invalid user Antminer from 183.81.169.238 port 48276
  Oct 3 00:55:18 scp sshd[3228081]: Invalid user admin from 183.81.169.238 port 57036
  ...

• list.rtbh.com.tr report: tcp/22

• Oct 3 06:54:17 server sshd[1327497]: Failed password for root from 183.81.169.238 port 46182 ssh2
  Oct 3 06:54:19 server sshd[1327499]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:54:21 server sshd[1327499]: Failed password for root from 183.81.169.238 port 39368 ssh2
  Oct 3 06:54:24 server sshd[1327501]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:54:25 server sshd[1327501]: Failed password for root from 183.81.169.238 port 39382 ssh2
  ...

• Oct 3 04:54:12 shirus29 sshd[2474595]: Failed password for root from 183.81.169.238 port 49220 ssh2
  Oct 3 04:54:15 shirus29 sshd[2474597]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 04:54:17 shirus29 sshd[2474597]: Failed password for root from 183.81.169.238 port 49236 ssh2
  Oct 3 04:54:20 shirus29 sshd[2474599]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 04:54:22 shirus29 sshd[2474599]: Failed password for root from 183.81.169.238 port 53134 ssh2
  ...

• Oct 3 04:54:00 s158416 sshd[2630941]: Failed password for root from 183.81.169.238 port 59412 ssh2
  Oct 3 04:54:04 s158416 sshd[2630983]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 04:54:07 s158416 sshd[2630983]: Failed password for root from 183.81.169.238 port 59444 ssh2
  Oct 3 04:54:10 s158416 sshd[2631273]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 04:54:12 s158416 sshd[2631273]: Failed password for root from 183.81.169.238 port 54098 ssh2
  ...

• Oct 3 06:53:01 host sshd[2763202]: Failed password for root from 183.81.169.238 port 34448 ssh2
  Oct 3 06:53:05 host sshd[2763324]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:53:07 host sshd[2763324]: Failed password for root from 183.81.169.238 port 50472 ssh2
  Oct 3 06:53:10 host sshd[2763391]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:53:12 host sshd[2763391]: Failed password for root from 183.81.169.238 port 50510 ssh2
  ...

• 2024-10-03T06:52:16.379381+02:00 mail sshd[642382]: Failed password for root from 183.81.169.238 port 45278 ssh2
  2024-10-03T06:52:20.570859+02:00 mail sshd[642384]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T06:52:22.951449+02:00 mail sshd[642384]: Failed password for root from 183.81.169.238 port 44856 ssh2
  2024-10-03T06:52:27.027026+02:00 mail sshd[642387]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T06:52:28.564517+02:00 mail sshd[642387]: Failed password for root from 183.81.169.238 port 60078 ssh2
  ...

• Oct 3 06:51:45 docker-01 sshd[250843]: Failed password for root from 183.81.169.238 port 49660 ssh2
  Oct 3 06:51:48 docker-01 sshd[250867]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:51:50 docker-01 sshd[250867]: Failed password for root from 183.81.169.238 port 42700 ssh2
  Oct 3 06:51:54 docker-01 sshd[250895]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:51:56 docker-01 sshd[250895]: Failed password for root from 183.81.169.238 port 42784 ssh2
  ...

• Oct 3 06:51:39 kroki sshd[268826]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:51:41 kroki sshd[268826]: Failed password for root from 183.81.169.238 port 34244 ssh2
  Oct 3 06:51:45 kroki sshd[268934]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:51:47 kroki sshd[268934]: Failed password for root from 183.81.169.238 port 49762 ssh2
  ...

• 2024-10-03T04:50:42.335596+00:00 vultrregeneration0 sshd[72915]: Connection closed by authenticating user root 183.81.169.238 port 34234 [preauth]
  2024-10-03T04:51:01.203300+00:00 vultrregeneration0 sshd[72928]: Connection closed by authenticating user root 183.81.169.238 port 49510 [preauth]
  ...

• Oct 3 12:49:13 pve-hkg1 sshd[1252668]: Failed password for root from 183.81.169.238 port 51716 ssh2
  Oct 3 12:49:17 pve-hkg1 sshd[1252812]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 12:49:19 pve-hkg1 sshd[1252812]: Failed password for root from 183.81.169.238 port 34920 ssh2
  Oct 3 12:49:24 pve-hkg1 sshd[1252949]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 12:49:26 pve-hkg1 sshd[1252949]: Failed password for root from 183.81.169.238 port 34972 ssh2
  ...

• Oct 3 04:48:31 ns5024002 sshd[2480072]: Failed password for root from 183.81.169.238 port 60766 ssh2
  Oct 3 04:48:36 ns5024002 sshd[2480279]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 04:48:38 ns5024002 sshd[2480279]: Failed password for root from 183.81.169.238 port 60796 ssh2
  Oct 3 04:48:42 ns5024002 sshd[2480440]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 04:48:43 ns5024002 sshd[2480440]: Failed password for root from 183.81.169.238 port 56176 ssh2
  ...

• 2024-10-03T00:48:23.316534-04:00 elijahr sshd[837484]: Connection closed by authenticating user root 183.81.169.238 port 47430 [preauth]
  2024-10-03T00:48:25.431600-04:00 elijahr sshd[837487]: Connection closed by authenticating user root 183.81.169.238 port 47460 [preauth]
  2024-10-03T00:48:27.916783-04:00 elijahr sshd[837489]: Connection closed by authenticating user root 183.81.169.238 port 35884 [preauth]
  2024-10-03T00:48:30.345050-04:00 elijahr sshd[837493]: Connection closed by authenticating user root 183.81.169.238 port 35898 [preauth]
  ...

• 2024-10-03T04:47:10.776140+00:00 prod-3 sshd[1220910]: Connection closed by authenticating user root 183.81.169.238 port 58194 [preauth]
  2024-10-03T04:47:13.007294+00:00 prod-3 sshd[1220920]: Connection closed by authenticating user root 183.81.169.238 port 58200 [preauth]
  2024-10-03T04:47:15.673193+00:00 prod-3 sshd[1220922]: Connection closed by authenticating user root 183.81.169.238 port 58208 [preauth]
  2024-10-03T04:47:18.044366+00:00 prod-3 sshd[1220924]: Connection closed by authenticating user root 183.81.169.238 port 45934 [preauth]
  2024-10-03T04:47:19.748115+00:00 prod-3 sshd[1220928]: Connection closed by authenticating user root 183.81.169.238 port 45948 [preauth]
  ...

• Oct 3 06:46:24 s1-4-gra7 sshd[2064865]: Invalid user Antminer from 183.81.169.238 port 44908
  Oct 3 06:46:26 s1-4-gra7 sshd[2064867]: Invalid user Antminer from 183.81.169.238 port 34052

• FW-PortScan: Traffic Blocked srcport=53626 dstport=22

• Oct 3 06:44:05 vmi440488 sshd[3537488]: Failed password for root from 183.81.169.238 port 50404 ssh2
  Oct 3 06:44:08 vmi440488 sshd[3537490]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:44:10 vmi440488 sshd[3537490]: Failed password for root from 183.81.169.238 port 56382 ssh2
  Oct 3 06:44:14 vmi440488 sshd[3537493]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:44:15 vmi440488 sshd[3537493]: Failed password for root from 183.81.169.238 port 56422 ssh2
  ...

• Oct 3 06:43:46 hosting08 sshd[8849]: Failed password for root from 183.81.169.238 port 48440 ssh2
  Oct 3 06:43:52 hosting08 sshd[8867]: Failed password for root from 183.81.169.238 port 44634 ssh2
  ...

• [rede-168-134] 10/03/2024-01:43:46.560668, 183.81.169.238, Protocol: 6, ET COMPROMISED Known Compromised or Hostile Host Traffic group 13

• [headscale] SSH login failed

• Oct 3 06:40:50 endernation sshd[3623053]: Failed password for root from 183.81.169.238 port 35944 ssh2
  Oct 3 06:40:53 endernation sshd[3623094]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:40:55 endernation sshd[3623094]: Failed password for root from 183.81.169.238 port 35956 ssh2
  ...

• Oct 3 06:40:24 h2691902 sshd[6196]: Failed password for root from 183.81.169.238 port 54964 ssh2
  Oct 3 06:40:26 h2691902 sshd[6198]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:40:28 h2691902 sshd[6198]: Failed password for root from 183.81.169.238 port 42988 ssh2
  Oct 3 06:40:31 h2691902 sshd[6202]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:40:32 h2691902 sshd[6202]: Failed password for root from 183.81.169.238 port 43042 ssh2
  ...

• Oct 3 07:38:09 www sshd\[57911\]: Failed password for root from 183.81.169.238 port 53256 ssh2Oct 3 07:38:13 www sshd\[57913\]: Failed password for root from 183.81.169.238 port 53292 ssh2Oct 3 07:38:17 www sshd\[57915\]: Failed password for root from 183.81.169.238 port 54996 ssh2
  ...

• 2024-10-03T11:37:26.932102+07:00 BAW-C03 sshd[63775]: Failed password for root from 183.81.169.238 port 47504 ssh2
  2024-10-03T11:37:32.194819+07:00 BAW-C03 sshd[63777]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T11:37:34.334875+07:00 BAW-C03 sshd[63777]: Failed password for root from 183.81.169.238 port 39058 ssh2
  2024-10-03T11:37:39.200430+07:00 BAW-C03 sshd[63779]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T11:37:41.299426+07:00 BAW-C03 sshd[63779]: Failed password for root from 183.81.169.238 port 53990 ssh2
  ...

• Oct 3 04:36:15 cknpih001 sshd[33725]: Failed password for root from 183.81.169.238 port 32902 ssh2
  Oct 3 04:36:17 cknpih001 sshd[33727]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 04:36:20 cknpih001 sshd[33727]: Failed password for root from 183.81.169.238 port 38982 ssh2
  Oct 3 04:36:24 cknpih001 sshd[33729]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 04:36:26 cknpih001 sshd[33729]: Failed password for root from 183.81.169.238 port 39012 ssh2
  ...

• Oct 3 04:35:37 ubuntu1 sshd[99726]: Invalid user Antminer from 183.81.169.238 port 44382
  ...

• 2024-10-03T06:35:22.678318+02:00 servidor1 sshd[293306]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-03T06:35:23.045412+02:00 servidor1 sshd[293306]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T06:35:25.474955+02:00 servidor1 sshd[293306]: Failed password for invalid user root from 183.81.169.238 port 39348 ssh2
  2024-10-03T06:35:28.586112+02:00 servidor1 sshd[293319]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-03T06:35:29.029000+02:00 servidor1 sshd[293319]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T06:35:30.948360+02:00 servidor1 sshd[293319]: Failed password for invalid user root from 183.81.169.238 port 44856 ssh2
  2024-10-03T06:35:34.224752+02:00 servidor1 sshd[293379]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  ...

• 2024-10-03T00:09:34.919320+02:00 isik-one sshd[1718413]: Invalid user Antminer from 183.81.169.238 port 43138
  2024-10-03T00:09:36.148488+02:00 isik-one sshd[1718415]: Invalid user Antminer from 183.81.169.238 port 55380
  2024-10-03T00:09:46.602855+02:00 isik-one sshd[1718487]: Invalid user admin from 183.81.169.238 port 37052
  2024-10-03T00:09:48.120778+02:00 isik-one sshd[1718506]: Invalid user baikal from 183.81.169.238 port 37056
  2024-10-03T06:35:32.828711+02:00 isik-one sshd[1820320]: Invalid user Antminer from 183.81.169.238 port 36702
  ...

• Oct 3 06:34:50 BalkanEmpireRP sshd[367760]: Failed password for root from 183.81.169.238 port 53398 ssh2
  Oct 3 06:34:55 BalkanEmpireRP sshd[367765]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:34:56 BalkanEmpireRP sshd[367765]: Failed password for root from 183.81.169.238 port 48794 ssh2
  Oct 3 06:35:00 BalkanEmpireRP sshd[367770]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:35:02 BalkanEmpireRP sshd[367770]: Failed password for root from 183.81.169.238 port 48850 ssh2
  Oct 3 06:35:05 BalkanEmpireRP sshd[367776]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:35:08 BalkanEmpireRP sshd[367776]: Failed password for root from 183.81.169.238 port 57136 ssh2
  ...

• 2024-10-03T06:33:45.419147+02:00 vande sshd[1669553]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T06:33:47.393834+02:00 vande sshd[1669553]: Failed password for root from 183.81.169.238 port 45456 ssh2

• Oct 3 06:33:25 AbuseCatcher sshd[7531]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:33:27 AbuseCatcher sshd[7531]: Failed password for root from 183.81.169.238 port 35000 ssh2
  ...

• Oct 2 23:32:49 mail sshd[3383613]: Failed password for root from 183.81.169.238 port 38198 ssh2
  Oct 2 23:32:52 mail sshd[3383633]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 23:32:54 mail sshd[3383633]: Failed password for root from 183.81.169.238 port 38220 ssh2
  ...

• 2024-10-03T06:33:12.136568+02:00 runner3 sshd[4106118]: Failed password for root from 183.81.169.238 port 36908 ssh2
  2024-10-03T06:33:15.175469+02:00 runner3 sshd[4106120]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T06:33:17.366213+02:00 runner3 sshd[4106120]: Failed password for root from 183.81.169.238 port 36920 ssh2
  2024-10-03T06:33:21.200589+02:00 runner3 sshd[4106122]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T06:33:23.215484+02:00 runner3 sshd[4106122]: Failed password for root from 183.81.169.238 port 46756 ssh2
  ...

• Oct 3 04:32:10 mlat sshd[3104725]: Failed password for root from 183.81.169.238 port 53148 ssh2
  Oct 3 04:32:12 mlat sshd[3104730]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 04:32:14 mlat sshd[3104730]: Failed password for root from 183.81.169.238 port 53168 ssh2
  ... azuremlat

• Oct 3 06:32:03 h2930838 sshd[24487]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:32:05 h2930838 sshd[24487]: Failed password for invalid user root from 183.81.169.238 port 37026 ssh2

• Oct 3 07:31:28 vds-100908 sshd[118336]: Failed password for root from 183.81.169.238 port 41344 ssh2
  Oct 3 07:31:32 vds-100908 sshd[118338]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 07:31:33 vds-100908 sshd[118338]: Failed password for root from 183.81.169.238 port 41388 ssh2
  Oct 3 07:31:37 vds-100908 sshd[118350]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 07:31:39 vds-100908 sshd[118350]: Failed password for root from 183.81.169.238 port 37720 ssh2
  ...

• 2024-10-03T04:31:00.645073shield sshd\[1312\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T04:31:03.301211shield sshd\[1312\]: Failed password for root from 183.81.169.238 port 52430 ssh2
  2024-10-03T04:31:05.924952shield sshd\[1322\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T04:31:07.934012shield sshd\[1322\]: Failed password for root from 183.81.169.238 port 52478 ssh2
  2024-10-03T04:31:10.604761shield sshd\[1332\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root

• Oct 3 04:27:55 mysql sshd[224505]: Failed password for root from 183.81.169.238 port 57904 ssh2
  Oct 3 04:27:58 mysql sshd[224507]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 04:28:01 mysql sshd[224507]: Failed password for root from 183.81.169.238 port 58916 ssh2
  Oct 3 04:28:05 mysql sshd[224509]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 04:28:07 mysql sshd[224509]: Failed password for root from 183.81.169.238 port 58922 ssh2
  ...

• Oct 3 00:27:52 vps196363 sshd[3822]: Failed password for root from 183.81.169.238 port 45528 ssh2
  Oct 3 00:27:56 vps196363 sshd[3824]: Failed password for root from 183.81.169.238 port 45562 ssh2
  Oct 3 00:28:02 vps196363 sshd[3826]: Failed password for root from 183.81.169.238 port 35930 ssh2
  ...

• 2024-10-03T06:27:49.898113+02:00 vmi985635.contaboserver.net sshd[2485575]: Failed password for root from 183.81.169.238 port 42030 ssh2
  2024-10-03T06:27:53.424437+02:00 vmi985635.contaboserver.net sshd[2485610]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T06:27:55.695604+02:00 vmi985635.contaboserver.net sshd[2485610]: Failed password for root from 183.81.169.238 port 42038 ssh2
  2024-10-03T06:27:59.240922+02:00 vmi985635.contaboserver.net sshd[2485637]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T06:28:00.575465+02:00 vmi985635.contaboserver.net sshd[2485637]: Failed password for root from 183.81.169.238 port 52756 ssh2
  ...

• Oct 3 06:27:42 vmi174663 sshd[2114120]: Failed password for root from 183.81.169.238 port 46430 ssh2
  Oct 3 06:27:44 vmi174663 sshd[2114137]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:27:46 vmi174663 sshd[2114137]: Failed password for root from 183.81.169.238 port 46442 ssh2
  Oct 3 06:27:49 vmi174663 sshd[2114174]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:27:50 vmi174663 sshd[2114174]: Failed password for root from 183.81.169.238 port 59784 ssh2
  ...

• [rede-164-29] (sshd) Failed SSH login from 183.81.169.238 (NL/The Netherlands/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Oct 3 00:36:05 sshd[14776]: Did not receive identification string from 183.81.169.238 port 41876
  Oct 3 01:26:36 sshd[17301]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=[USERNAME]
  Oct 3 01:26:37 sshd[17301]: Failed password for [USERNAME] from 183.81.169.238 port 50220 ssh2
  Oct 3 01:26:41 sshd[17314]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=[USERNAME]
  Oct 3 0

• FW-PortScan: Traffic Blocked srcport=51766 dstport=22

• [2024 Oct 3 06:22:31] Brute-Force detected from 183.81.169.238 for sshd fails: 2x () USER=baikal SPT=33200

• Oct 3 04:25:25 ice1 sshd[3548305]: Invalid user Antminer from 183.81.169.238 port 57372
  Oct 3 04:25:28 ice1 sshd[3548307]: Invalid user Antminer from 183.81.169.238 port 57386
  ...

• Oct 3 06:24:41 mail sshd[805865]: Failed password for root from 183.81.169.238 port 49290 ssh2
  Oct 3 06:24:45 mail sshd[805890]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:24:47 mail sshd[805890]: Failed password for root from 183.81.169.238 port 49314 ssh2
  ...

• Oct 3 06:23:51 dsh1621 sshd[4030190]: Failed password for root from 183.81.169.238 port 34270 ssh2
  Oct 3 06:23:53 dsh1621 sshd[4030233]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:23:55 dsh1621 sshd[4030233]: Failed password for root from 183.81.169.238 port 34302 ssh2
  Oct 3 06:24:00 dsh1621 sshd[4030329]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:24:02 dsh1621 sshd[4030329]: Failed password for root from 183.81.169.238 port 38814 ssh2
  ...

• Oct 3 11:22:58 honeypot sshd[13376]: Failed password for root from 183.81.169.238 port 55852 ssh2
  ...

• 2024-10-03T06:22:12.057357+02:00 Webserver sshd[700342]: Failed password for root from 183.81.169.238 port 57606 ssh2
  2024-10-03T06:22:13.954270+02:00 Webserver sshd[700344]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T06:22:15.597633+02:00 Webserver sshd[700344]: Failed password for root from 183.81.169.238 port 57620 ssh2
  2024-10-03T06:22:18.786619+02:00 Webserver sshd[700346]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T06:22:20.449980+02:00 Webserver sshd[700346]: Failed password for root from 183.81.169.238 port 40868 ssh2
  ...

• Oct 3 07:22:02 server2 sshd\[29090\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 07:22:04 server2 sshd\[29119\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 07:22:06 server2 sshd\[29125\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 07:22:07 server2 sshd\[29127\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 07:22:08 server2 sshd\[29131\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 07:22:10 server2 sshd\[29133\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers

• 2024-10-03T06:20:22.039362+02:00 pve sshd[1575100]: Failed password for root from 183.81.169.238 port 58914 ssh2
  2024-10-03T06:20:25.296410+02:00 pve sshd[1575721]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T06:20:27.444944+02:00 pve sshd[1575721]: Failed password for root from 183.81.169.238 port 58940 ssh2
  2024-10-03T06:20:30.356886+02:00 pve sshd[1576790]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T06:20:31.859794+02:00 pve sshd[1576790]: Failed password for root from 183.81.169.238 port 42906 ssh2
  ...

• Oct 3 06:16:35 MedellinCityRPS1 sshd[1897826]: Failed password for root from 183.81.169.238 port 41702 ssh2
  Oct 3 06:16:38 MedellinCityRPS1 sshd[1897832]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:16:40 MedellinCityRPS1 sshd[1897832]: Failed password for root from 183.81.169.238 port 41064 ssh2
  Oct 3 06:16:43 MedellinCityRPS1 sshd[1897834]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:16:45 MedellinCityRPS1 sshd[1897834]: Failed password for root from 183.81.169.238 port 41084 ssh2
  Oct 3 06:16:48 MedellinCityRPS1 sshd[1897839]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:16:50 MedellinCityRPS1 sshd[1897839]: Failed password for root from 183.81.169.238 port 57100 ssh2
  ...

• Oct 3 04:17:35 ns520895 sshd[9736]: Failed password for root from 183.81.169.238 port 33866 ssh2
  ...

• Oct 3 06:16:18 mx1 sshd[2004650]: Failed password for root from 183.81.169.238 port 33470 ssh2
  Oct 3 06:16:22 mx1 sshd[2004652]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:16:23 mx1 sshd[2004652]: Failed password for root from 183.81.169.238 port 33482 ssh2
  Oct 3 06:16:26 mx1 sshd[2004654]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:16:28 mx1 sshd[2004654]: Failed password for root from 183.81.169.238 port 55686 ssh2
  ...

• Oct 3 06:15:12 OPSO sshd\[8442\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:15:14 OPSO sshd\[8442\]: Failed password for root from 183.81.169.238 port 44518 ssh2
  Oct 3 06:15:16 OPSO sshd\[8444\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:15:18 OPSO sshd\[8444\]: Failed password for root from 183.81.169.238 port 42146 ssh2
  Oct 3 06:15:21 OPSO sshd\[8446\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root

• Failed password for root from 183.81.169.238 port 50874

• Firewall IPS Detection on 03-10-2024 at 06:14:05

• Oct 3 06:13:26 de-kae sshd[3491549]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:13:28 de-kae sshd[3491549]: Failed password for root from 183.81.169.238 port 34926 ssh2
  ...

• Oct 2 21:12:25 cohoe sshd[3006351]: Failed password for root from 183.81.169.238 port 33122 ssh2
  Oct 2 21:12:30 cohoe sshd[3006353]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 21:12:31 cohoe sshd[3006353]: Failed password for root from 183.81.169.238 port 49752 ssh2
  Oct 2 21:12:35 cohoe sshd[3006355]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 21:12:37 cohoe sshd[3006355]: Failed password for root from 183.81.169.238 port 49778 ssh2
  ...

• Oct 3 06:10:15 hosting sshd[2948309]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:10:18 hosting sshd[2948309]: Failed password for root from 183.81.169.238 port 53814 ssh2
  Oct 3 06:10:20 hosting sshd[2948371]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:10:22 hosting sshd[2948371]: Failed password for root from 183.81.169.238 port 42880 ssh2

• 2024-10-03T04:10:05.300184+00:00 BAW-C01 sshd-session[425388]: Failed password for root from 183.81.169.238 port 38150 ssh2
  2024-10-03T04:10:08.693960+00:00 BAW-C01 sshd-session[425391]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T04:10:10.997801+00:00 BAW-C01 sshd-session[425391]: Failed password for root from 183.81.169.238 port 35050 ssh2
  2024-10-03T04:10:16.296831+00:00 BAW-C01 sshd-session[425394]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T04:10:18.028432+00:00 BAW-C01 sshd-session[425394]: Failed password for root from 183.81.169.238 port 35090 ssh2
  ...

• [rede-166-249] (sshd) Failed SSH login from 183.81.169.238 (NL/The Netherlands/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Oct 3 01:10:01 sshd[4718]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=[USERNAME]
  Oct 3 01:10:03 sshd[4718]: Failed password for [USERNAME] from 183.81.169.238 port 33362 ssh2
  Oct 3 01:10:07 sshd[4733]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=[USERNAME]
  Oct 3 01:10:08 sshd[4733]: Failed password for [USERNAME] from 183.81.169.238 port 55886 ssh2
  Oct 3 01:10:1

• Oct 3 06:09:33 [redacted] sshd[1618255]: Failed password for [redacted] from 183.81.169.238 port 35984 ssh2
  Oct 3 06:09:35 [redacted] sshd[1618259]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=[redacted]
  Oct 3 06:09:37 [redacted] sshd[1618259]: Failed password for [redacted] from 183.81.169.238 port 49778 ssh2
  Oct 3 06:09:39 [redacted] sshd[1618263]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=[redacted]
  Oct 3 06:09:41 [redacted] sshd[1618263]: Failed password for [redacted] from 183.81.169.238 port 49780 ssh2
  ...

• Oct 3 06:08:49 * sshd[2138470]: Failed password for root from 183.81.169.238 port 52802 ssh2
  Oct 3 06:08:53 * sshd[2138489]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:08:54 * sshd[2138489]: Failed password for root from 183.81.169.238 port 52820 ssh2

• FW-PortScan: Traffic Blocked srcport=33565 dstport=22

• Oct 3 06:08:32 h3004354 sshd[2247816]: Failed password for root from 183.81.169.238 port 41006 ssh2
  Oct 3 06:08:37 h3004354 sshd[2247818]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:08:39 h3004354 sshd[2247818]: Failed password for root from 183.81.169.238 port 34322 ssh2
  Oct 3 06:08:43 h3004354 sshd[2247822]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:08:45 h3004354 sshd[2247822]: Failed password for root from 183.81.169.238 port 34358 ssh2
  ...

• Oct 3 04:08:11 elasticsearch sshd[245265]: Invalid user Antminer from 183.81.169.238 port 40898
  Oct 3 04:08:14 elasticsearch sshd[245267]: Invalid user Antminer from 183.81.169.238 port 40908
  Oct 3 04:08:29 elasticsearch sshd[245279]: Invalid user admin from 183.81.169.238 port 35084
  ...

• 2024-10-03T06:08:03.970333+02:00 pokevador sshd[641199]: Failed password for root from 183.81.169.238 port 57912 ssh2
  2024-10-03T06:08:07.616248+02:00 pokevador sshd[641248]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T06:08:10.117072+02:00 pokevador sshd[641248]: Failed password for root from 183.81.169.238 port 56154 ssh2
  ...

• Oct 3 06:07:20 javastart sshd[4028286]: Failed password for root from 183.81.169.238 port 35690 ssh2
  Oct 3 06:07:24 javastart sshd[4028302]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:07:26 javastart sshd[4028302]: Failed password for root from 183.81.169.238 port 35718 ssh2
  Oct 3 06:07:30 javastart sshd[4028304]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:07:32 javastart sshd[4028304]: Failed password for root from 183.81.169.238 port 43924 ssh2
  ...

• 2024-10-03 04:06:18,807 fail2ban.actions [624]: NOTICE [sshd] Ban 183.81.169.238

• Oct 3 04:04:37 Proxmox-VE sshd[153176]: Failed password for root from 183.81.169.238 port 49114 ssh2
  Oct 3 04:04:40 Proxmox-VE sshd[153178]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 04:04:42 Proxmox-VE sshd[153178]: Failed password for root from 183.81.169.238 port 43848 ssh2
  Oct 3 04:04:45 Proxmox-VE sshd[153203]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 04:04:47 Proxmox-VE sshd[153203]: Failed password for root from 183.81.169.238 port 43860 ssh2
  ...

• 2024-10-03T04:04:10.840444+00:00 Linux01 sshd[2692144]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T04:04:13.140613+00:00 Linux01 sshd[2692144]: Failed password for root from 183.81.169.238 port 34170 ssh2
  2024-10-03T04:04:17.531465+00:00 Linux01 sshd[2692500]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T04:04:19.460690+00:00 Linux01 sshd[2692500]: Failed password for root from 183.81.169.238 port 39914 ssh2
  2024-10-03T04:04:21.906039+00:00 Linux01 sshd[2692751]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T04:04:24.050608+00:00 Linux01 sshd[2692751]: Failed password for root from 183.81.169.238 port 39928 ssh2
  2024-10-03T04:04:28.548955+00:00 Linux01 sshd[2693078]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= r
  ...

• tcp/22 (33 or more attempts)

• Port 22 scanned.

• Failed password for root from 183.81.169.238 port 33438 ssh2

• Oct 3 05:00:27 sheikh-ahmed-abu-islam-v2 sshd[3273046]: Invalid user Antminer from 183.81.169.238 port 39424
  Oct 3 05:00:29 sheikh-ahmed-abu-islam-v2 sshd[3273091]: Invalid user Antminer from 183.81.169.238 port 39434
  ...

• [03:59] Attempted SSH login on port 22 with credentials root:0

• 10/03/2024-05:58:26.410855 183.81.169.238 Protocol: 6 ET COMPROMISED Known Compromised or Hostile Host Traffic group 13

• Oct 3 03:57:20 ovh sshd[3327681]: Failed password for root from 183.81.169.238 port 43274 ssh2
  Oct 3 03:57:25 ovh sshd[3327732]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:57:26 ovh sshd[3327732]: Failed password for root from 183.81.169.238 port 43314 ssh2
  Oct 3 03:57:30 ovh sshd[3327796]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:57:32 ovh sshd[3327796]: Failed password for root from 183.81.169.238 port 56166 ssh2
  ...

• 2024-10-03T06:57:29.972060+03:00 oh6ah sshd[1882710]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T06:57:32.220689+03:00 oh6ah sshd[1882710]: Failed password for root from 183.81.169.238 port 58656 ssh2
  ...

• 2024-10-02T20:57:23.020761 web sshd[363040]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T20:57:24.977066 web sshd[363040]: Failed password for root from 183.81.169.238 port 46436 ssh2
  ...

• Cowrie Honeypot: Unauthorised SSH/Telnet login attempt with user "root" at 2024-10-03T03:57:06Z

• 2024-10-03T03:56:53.209419+00:00 localhost sshd[2486636]: Connection closed by authenticating user root 183.81.169.238 port 51368 [preauth]
  2024-10-03T03:56:55.915149+00:00 localhost sshd[2486663]: Connection closed by authenticating user root 183.81.169.238 port 51390 [preauth]
  2024-10-03T03:56:58.157976+00:00 localhost sshd[2486666]: Connection closed by authenticating user root 183.81.169.238 port 39898 [preauth]
  2024-10-03T03:57:01.221503+00:00 localhost sshd[2486668]: Connection closed by authenticating user root 183.81.169.238 port 39914 [preauth]
  2024-10-03T03:57:03.583958+00:00 localhost sshd[2486692]: Connection closed by authenticating user root 183.81.169.238 port 39926 [preauth]
  ...

• Oct 3 05:56:18 GangLandRP sshd[297145]: Failed password for root from 183.81.169.238 port 59366 ssh2
  Oct 3 05:56:22 GangLandRP sshd[297150]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 05:56:23 GangLandRP sshd[297150]: Failed password for root from 183.81.169.238 port 41846 ssh2
  Oct 3 05:56:27 GangLandRP sshd[297155]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 05:56:29 GangLandRP sshd[297155]: Failed password for root from 183.81.169.238 port 41856 ssh2
  Oct 3 05:56:31 GangLandRP sshd[297160]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 05:56:33 GangLandRP sshd[297160]: Failed password for root from 183.81.169.238 port 56164 ssh2
  ...

• endlessh: 2024-10-03 05:56:26.468823036 2024-10-03T03:56:26.468Z CLOSE host=183.81.169.238 port=38408 fd=5 time=160.035 bytes=282
  ...

• 2024-10-03T05:55:53.853044+02:00 srv2 sshd[1634950]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T05:55:55.923093+02:00 srv2 sshd[1634950]: Failed password for root from 183.81.169.238 port 37614 ssh2
  ...

• 2024-10-03T05:55:31.133012vmi1671272.contaboserver.net sshd[4130186]: Failed password for root from 183.81.169.238 port 60878 ssh2
  2024-10-03T05:55:35.316032vmi1671272.contaboserver.net sshd[4130207]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T05:55:37.913511vmi1671272.contaboserver.net sshd[4130207]: Failed password for root from 183.81.169.238 port 60906 ssh2
  2024-10-03T05:55:40.549304vmi1671272.contaboserver.net sshd[4130213]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T05:55:42.168002vmi1671272.contaboserver.net sshd[4130213]: Failed password for root from 183.81.169.238 port 48330 ssh2

• 2024-10-03T05:55:39.252178+02:00 devcricle sshd[32102]: Failed password for root from 183.81.169.238 port 33604 ssh2
  2024-10-03T05:55:43.433120+02:00 devcricle sshd[32105]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T05:55:44.797370+02:00 devcricle sshd[32105]: Failed password for root from 183.81.169.238 port 33624 ssh2
  ...

• Oct 3 03:55:30 cloud-server-0 sshd[2891811]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:55:32 cloud-server-0 sshd[2891811]: Failed password for root from 183.81.169.238 port 47644 ssh2
  ...

• Oct 2 23:55:17 us-mfl-02 sshd[510861]: Invalid user Antminer from 183.81.169.238 port 34418
  ...

• PBK Oct 3 05:53:21 websrv01 sshd[1390181]: Failed password for root from 183.81.169.238 port 32986 ssh2
  Oct 3 05:53:26 websrv01 sshd[1390183]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 05:53:27 websrv01 sshd[1390183]: Failed password for root from 183.81.169.238 port 44154 ssh2
  Oct 3 05:53:30 websrv01 sshd[1390187]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 05:53:33 websrv01 sshd[1390187]: Failed password for root from 183.81.169.238 port 44186 ssh2

• Oct 3 03:53:15 ovh-docker-001 sshd[148165]: Failed password for root from 183.81.169.238 port 44966 ssh2
  Oct 3 03:53:18 ovh-docker-001 sshd[148217]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:53:21 ovh-docker-001 sshd[148217]: Failed password for root from 183.81.169.238 port 43340 ssh2
  Oct 3 03:53:24 ovh-docker-001 sshd[148226]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:53:26 ovh-docker-001 sshd[148226]: Failed password for root from 183.81.169.238 port 43356 ssh2
  ...

• FW-PortScan: Traffic Blocked srcport=37579 dstport=22

• 2024-10-03T00:50:17.471197-03:00 dns1 sshd[18934]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T00:50:19.750882-03:00 dns1 sshd[18934]: Failed password for root from 183.81.169.238 port 56988 ssh2
  2024-10-03T00:50:20.781465-03:00 dns1 sshd[18934]: Connection closed by authenticating user root 183.81.169.238 port 56988 [preauth]
  2024-10-03T00:50:24.133133-03:00 dns1 sshd[18936]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T00:50:26.235152-03:00 dns1 sshd[18936]: Failed password for root from 183.81.169.238 port 57000 ssh2

• 2024-10-03T03:50:00.908122+00:00 minio-par-01.pdx.net.uk sshd[202615]: Invalid user Antminer from 183.81.169.238 port 55974
  2024-10-03T03:50:02.607054+00:00 minio-par-01.pdx.net.uk sshd[202617]: Invalid user Antminer from 183.81.169.238 port 55980
  2024-10-03T03:50:13.334857+00:00 minio-par-01.pdx.net.uk sshd[202632]: Invalid user admin from 183.81.169.238 port 38474
  ...

• Fail2Ban
  ...

• Oct 3 05:49:10 vinaca sshd[1736521]: Invalid user Antminer from 183.81.169.238 port 50632
  ...

• Oct 3 05:48:43 speedtaq-com-vm-vm sshd[7043]: Invalid user Antminer from 183.81.169.238 port 38584

• Oct 3 05:48:19 amk sshd\[9265\]: Failed password for root from 183.81.169.238 port 38370 ssh2Oct 3 05:48:24 amk sshd\[9267\]: Failed password for root from 183.81.169.238 port 38386 ssh2
  ...

• Oct 3 03:47:58 24fire sshd[195661]: Failed password for root from 183.81.169.238 port 60390 ssh2
  Oct 3 03:48:01 24fire sshd[195663]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:48:03 24fire sshd[195663]: Failed password for root from 183.81.169.238 port 60428 ssh2
  Oct 3 03:48:08 24fire sshd[195665]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:48:10 24fire sshd[195665]: Failed password for root from 183.81.169.238 port 54792 ssh2
  ...

• 183.81.169.238 (183.81.169.238) - SSH Brute force:
  Oct 3 06:46:12 XWEB sshd[15482]: Failed password for root from 183.81.169.238 port 47142 ssh2
  Oct 3 06:46:15 XWEB sshd[15484]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:46:17 XWEB sshd[15484]: Failed password for root from 183.81.169.238 port 47176 ssh2
  ...

• I1003 05:44:24.039211 1 client.go:99] CLOSE host=183.81.169.238 port=35042 time=79.53375175 bytes=274
  ...

• unauthorized connection with user "root" and password "0" at 2024-10-03T03:44:04Z

• 2024-10-02T23:41:08.490807-04:00 ns05-a-ns-xyz sshd[2256150]: Failed password for root from 183.81.169.238 port 56696 ssh2
  2024-10-02T23:41:12.210582-04:00 ns05-a-ns-xyz sshd[2256157]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T23:41:14.337781-04:00 ns05-a-ns-xyz sshd[2256157]: Failed password for root from 183.81.169.238 port 56716 ssh2
  2024-10-02T23:41:18.113292-04:00 ns05-a-ns-xyz sshd[2256168]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T23:41:19.397241-04:00 ns05-a-ns-xyz sshd[2256168]: Failed password for root from 183.81.169.238 port 36602 ssh2
  ...

• 2024-10-03T05:40:28.234061+02:00 sasrv sshd[5019]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-03T05:40:30.038274+02:00 sasrv sshd[5021]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-03T05:40:32.178025+02:00 sasrv sshd[5023]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-03T05:40:34.370748+02:00 sasrv sshd[5025]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-03T05:40:37.052815+02:00 sasrv sshd[5028]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  ...

• Oct 3 05:40:29 maximus sshd[5880]: Failed password for root from 183.81.169.238 port 46722 ssh2
  Oct 3 05:40:33 maximus sshd[5895]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 05:40:35 maximus sshd[5895]: Failed password for root from 183.81.169.238 port 46780 ssh2
  Oct 3 05:40:38 maximus sshd[5905]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 05:40:40 maximus sshd[5905]: Failed password for root from 183.81.169.238 port 40134 ssh2
  ...

• 2024-10-03T11:40:17.451787+08:00 raindance sshd[273463]: Failed password for root from 183.81.169.238 port 51098 ssh2
  2024-10-03T11:40:22.108536+08:00 raindance sshd[273483]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T11:40:24.034015+08:00 raindance sshd[273483]: Failed password for root from 183.81.169.238 port 38548 ssh2
  2024-10-03T11:40:27.240957+08:00 raindance sshd[273486]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T11:40:29.522352+08:00 raindance sshd[273486]: Failed password for root from 183.81.169.238 port 51444 ssh2
  ...

• Oct 3 05:39:37 5m-testing sshd[1408024]: Failed password for root from 183.81.169.238 port 53070 ssh2
  Oct 3 05:39:41 5m-testing sshd[1408034]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 05:39:44 5m-testing sshd[1408034]: Failed password for root from 183.81.169.238 port 47394 ssh2
  Oct 3 05:39:47 5m-testing sshd[1408050]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 05:39:49 5m-testing sshd[1408050]: Failed password for root from 183.81.169.238 port 47420 ssh2
  Oct 3 05:39:53 5m-testing sshd[1408064]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 05:39:55 5m-testing sshd[1408064]: Failed password for root from 183.81.169.238 port 57730 ssh2
  ...

• SSH Brute-force

• Oct 3 05:37:50 Ina sshd[1922421]: Failed password for root from 183.81.169.238 port 45342 ssh2
  Oct 3 05:37:54 Ina sshd[1922424]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 05:37:56 Ina sshd[1922424]: Failed password for root from 183.81.169.238 port 45348 ssh2
  Oct 3 05:38:00 Ina sshd[1922454]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 05:38:02 Ina sshd[1922454]: Failed password for root from 183.81.169.238 port 53768 ssh2
  ...

• 2024-10-03T03:36:37.216242+00:00 Linux08 sshd[256565]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T03:36:38.919226+00:00 Linux08 sshd[256565]: Failed password for root from 183.81.169.238 port 38696 ssh2
  2024-10-03T03:36:42.038830+00:00 Linux08 sshd[256862]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T03:36:43.431181+00:00 Linux08 sshd[256862]: Failed password for root from 183.81.169.238 port 38714 ssh2
  2024-10-03T03:36:46.874267+00:00 Linux08 sshd[257167]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T03:36:48.813365+00:00 Linux08 sshd[257167]: Failed password for root from 183.81.169.238 port 51902 ssh2
  2024-10-03T03:36:50.987081+00:00 Linux08 sshd[257460]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=18
  ...

• [rede-164-29] 10/03/2024-00:36:03.323093, 183.81.169.238, Protocol: 6, ET COMPROMISED Known Compromised or Hostile Host Traffic group 13

• Oct 3 05:35:37 pinkypie sshd[71072]: Failed password for root from 183.81.169.238 port 41550 ssh2
  Oct 3 05:35:41 pinkypie sshd[71074]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 05:35:43 pinkypie sshd[71074]: Failed password for root from 183.81.169.238 port 41562 ssh2
  ...

• 2024-10-03T05:33:54.846635 prodgateway sshd[62207]: Failed password for root from 183.81.169.238 port 52394 ssh2
  2024-10-03T05:33:57.482824 prodgateway sshd[62210]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T05:34:00.225621 prodgateway sshd[62210]: Failed password for root from 183.81.169.238 port 54890 ssh2
  ...

• Oct 3 05:32:55 AbuseCatcher sshd[5469]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 05:32:57 AbuseCatcher sshd[5469]: Failed password for root from 183.81.169.238 port 49346 ssh2
  ...

• 2024-10-02T22:32:14.527789-05:00 BAW-C02 sshd[3857475]: Failed password for root from 183.81.169.238 port 40236 ssh2
  2024-10-02T22:32:18.677971-05:00 BAW-C02 sshd[3857478]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T22:32:20.828073-05:00 BAW-C02 sshd[3857478]: Failed password for root from 183.81.169.238 port 48382 ssh2
  2024-10-02T22:32:24.560794-05:00 BAW-C02 sshd[3857480]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T22:32:26.200096-05:00 BAW-C02 sshd[3857480]: Failed password for root from 183.81.169.238 port 48390 ssh2
  ...

• Oct 3 03:31:45 minio sshd[648718]: Invalid user Antminer from 183.81.169.238 port 56428
  Oct 3 03:31:48 minio sshd[648720]: Invalid user Antminer from 183.81.169.238 port 49632
  Oct 3 03:32:03 minio sshd[648732]: Invalid user admin from 183.81.169.238 port 38040
  ...

• Oct 2 23:32:00 us-mfl-01 sshd[3524698]: Invalid user Antminer from 183.81.169.238 port 39180
  ...

• 2024-10-03 00:36:26 UTC Unauthorized activity to TCP port 22. SSH

• Drop from IP address 183.81.169.238 to tcp-port 22

• Oct 3 06:29:26 pkdns2 sshd\[10617\]: Failed password for root from 183.81.169.238 port 41912 ssh2Oct 3 06:29:32 pkdns2 sshd\[10740\]: Failed password for root from 183.81.169.238 port 41922 ssh2Oct 3 06:29:36 pkdns2 sshd\[10742\]: Failed password for root from 183.81.169.238 port 41950 ssh2Oct 3 06:29:40 pkdns2 sshd\[10744\]: Failed password for root from 183.81.169.238 port 50088 ssh2Oct 3 06:29:44 pkdns2 sshd\[10746\]: Failed password for root from 183.81.169.238 port 50120 ssh2Oct 3 06:29:49 pkdns2 sshd\[10748\]: Failed password for root from 183.81.169.238 port 37962 ssh2
  ...

• Oct 3 03:29:31 c2 sshd[2043926]: Failed password for root from 183.81.169.238 port 41960 ssh2
  Oct 3 03:29:34 c2 sshd[2043932]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:29:36 c2 sshd[2043932]: Failed password for root from 183.81.169.238 port 41988 ssh2
  Oct 3 03:29:41 c2 sshd[2043942]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:29:43 c2 sshd[2043942]: Failed password for root from 183.81.169.238 port 60682 ssh2
  ...

• Oct 3 05:28:34 gateway1-old sshd[26179]: Failed password for root from 183.81.169.238 port 37790 ssh2
  Oct 3 05:28:38 gateway1-old sshd[26376]: Failed password for root from 183.81.169.238 port 59326 ssh2

• 2024-10-03T06:27:36.113042+03:00 mummo sshd[2190005]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T06:27:37.881454+03:00 mummo sshd[2190005]: Failed password for root from 183.81.169.238 port 53768 ssh2
  ...

• Oct 3 05:27:08 fshubvidspace sshd[2998849]: Failed password for root from 183.81.169.238 port 49854 ssh2
  Oct 3 05:27:11 fshubvidspace sshd[2998851]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 05:27:13 fshubvidspace sshd[2998851]: Failed password for root from 183.81.169.238 port 49870 ssh2
  Oct 3 05:27:17 fshubvidspace sshd[2998853]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 05:27:18 fshubvidspace sshd[2998853]: Failed password for root from 183.81.169.238 port 40968 ssh2
  ...

• 2024-10-03T03:25:55.757818+00:00 mail sshd[930579]: Invalid user Antminer from 183.81.169.238 port 51686
  2024-10-03T03:25:57.850236+00:00 mail sshd[930581]: Invalid user Antminer from 183.81.169.238 port 51692
  2024-10-03T03:26:08.570997+00:00 mail sshd[930593]: Invalid user admin from 183.81.169.238 port 37092
  ...

• Inteceptor Intrusion Detector: failed_password on sshd module PID: (1496594)

• FW-PortScan: Traffic Blocked srcport=56673 dstport=22

• Oct 3 03:22:02 webserver sshd[741654]: Failed password for root from 183.81.169.238 port 44894 ssh2
  Oct 3 03:22:06 webserver sshd[741656]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:22:09 webserver sshd[741656]: Failed password for root from 183.81.169.238 port 37846 ssh2
  Oct 3 03:22:13 webserver sshd[741658]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:22:14 webserver sshd[741658]: Failed password for root from 183.81.169.238 port 37850 ssh2
  ...

• Oct 3 05:20:45 vmi1008219 sshd[380736]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 05:20:48 vmi1008219 sshd[380736]: Failed password for root from 183.81.169.238 port 46240 ssh2
  ...

• Events: TCP SYN Discovery or Flooding, Seen 139 times in the last 10800 seconds

• 2024-10-03T05:18:27.243628+02:00 PWS-PM-WEB01 sshd[3305824]: Failed password for root from 183.81.169.238 port 60270 ssh2
  2024-10-03T05:18:30.446710+02:00 PWS-PM-WEB01 sshd[3305844]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T05:18:32.256421+02:00 PWS-PM-WEB01 sshd[3305844]: Failed password for root from 183.81.169.238 port 59496 ssh2
  ...

• Oct 2 21:19:23 mortgagebase sshd[17025]: Failed password for root from 183.81.169.238 port 51920 ssh2
  Oct 2 21:19:26 mortgagebase sshd[17027]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 21:19:28 mortgagebase sshd[17027]: Failed password for root from 183.81.169.238 port 42128 ssh2
  Oct 2 21:19:31 mortgagebase sshd[17029]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 21:19:32 mortgagebase sshd[17029]: Failed password for root from 183.81.169.238 port 42148 ssh2
  ...

• Oct 3 03:18:25 vps-d7931dc8 sshd[472685]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:18:27 vps-d7931dc8 sshd[472685]: Failed password for root from 183.81.169.238 port 48796 ssh2
  Oct 3 03:18:28 vps-d7931dc8 sshd[472685]: Connection closed by authenticating user root 183.81.169.238 port 48796 [preauth]
  Oct 3 03:18:30 vps-d7931dc8 sshd[472687]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:18:32 vps-d7931dc8 sshd[472687]: Failed password for root from 183.81.169.238 port 43344 ssh2

• Oct 3 05:18:21 hosting09 sshd[649782]: Failed password for root from 183.81.169.238 port 41328 ssh2
  Oct 3 05:18:23 hosting09 sshd[649794]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 05:18:25 hosting09 sshd[649794]: Failed password for root from 183.81.169.238 port 41352 ssh2
  ...

• Oct 3 05:17:16 LimitlessRP sshd[213897]: Failed password for root from 183.81.169.238 port 53648 ssh2
  Oct 3 05:17:20 LimitlessRP sshd[213902]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 05:17:22 LimitlessRP sshd[213902]: Failed password for root from 183.81.169.238 port 53652 ssh2
  Oct 3 05:17:24 LimitlessRP sshd[213907]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 05:17:26 LimitlessRP sshd[213907]: Failed password for root from 183.81.169.238 port 54918 ssh2
  Oct 3 05:17:29 LimitlessRP sshd[213913]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 05:17:31 LimitlessRP sshd[213913]: Failed password for root from 183.81.169.238 port 54928 ssh2
  ...

• Oct 3 05:16:39 v2202301167543214332 sshd[2969178]: Failed password for root from 183.81.169.238 port 44112 ssh2
  Oct 3 05:16:42 v2202301167543214332 sshd[2969180]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 05:16:44 v2202301167543214332 sshd[2969180]: Failed password for root from 183.81.169.238 port 44136 ssh2
  Oct 3 05:16:47 v2202301167543214332 sshd[2969184]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 05:16:50 v2202301167543214332 sshd[2969184]: Failed password for root from 183.81.169.238 port 43080 ssh2
  ...

• 2024-10-03T04:16:39.420125+01:00 jane sshd[3905354]: Failed password for root from 183.81.169.238 port 49212 ssh2
  2024-10-03T04:16:40.994201+01:00 jane sshd[3905379]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T04:16:43.370841+01:00 jane sshd[3905379]: Failed password for root from 183.81.169.238 port 49226 ssh2
  ...

• Oct 2 23:16:32 sputnik sshd[32033]: Invalid user Antminer from 183.81.169.238 port 53836
  Oct 2 23:16:35 sputnik sshd[32662]: Invalid user Antminer from 183.81.169.238 port 51482
  Oct 2 23:16:50 sputnik sshd[35197]: Invalid user admin from 183.81.169.238 port 60748
  ...

• 2024-10-03T05:16:39.049709+02:00 srv1 sshd[61471]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T05:16:40.955312+02:00 srv1 sshd[61471]: Failed password for root from 183.81.169.238 port 57234 ssh2
  ...

• Oct 3 03:15:42 DuoX sshd[2095491]: Failed password for root from 183.81.169.238 port 33800 ssh2
  Oct 3 03:15:46 DuoX sshd[2098437]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:15:48 DuoX sshd[2098437]: Failed password for root from 183.81.169.238 port 34654 ssh2
  Oct 3 03:15:53 DuoX sshd[2099909]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:15:55 DuoX sshd[2099909]: Failed password for root from 183.81.169.238 port 34686 ssh2
  ...

• $f2bV_matches

• Oct 3 06:44:23 Digitalogic sshd[1364994]: Connection closed by authenticating user root 183.81.169.238 port 34006 [preauth]
  Oct 3 06:44:25 Digitalogic sshd[1365024]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:44:27 Digitalogic sshd[1365024]: Failed password for root from 183.81.169.238 port 34018 ssh2
  ...

• Failed password for root from 183.81.169.238 port 39262 ssh2
  pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Failed password for root from 183.81.169.238 port 52942 ssh2
  pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Failed password for root from 183.81.169.238 port 53002 ssh2

• 2024-10-03T03:12:41.620905+00:00 VM2772336 sshd[1869500]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T03:12:43.520737+00:00 VM2772336 sshd[1869500]: Failed password for root from 183.81.169.238 port 40290 ssh2
  ...

• Oct 3 06:12:24 localhost sshd[1338306]: Failed password for root from 183.81.169.238 port 38584 ssh2
  Oct 3 06:12:26 localhost sshd[1338312]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:12:28 localhost sshd[1338312]: Failed password for root from 183.81.169.238 port 46800 ssh2
  Oct 3 06:12:31 localhost sshd[1338318]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 06:12:33 localhost sshd[1338318]: Failed password for root from 183.81.169.238 port 46810 ssh2
  ...

• Funeypot detected 4350 ssh attempts in 565h26m47s. Last by user "root", password "*", client "Go".

• Oct 3 05:10:33 plesk sshd[5962]: Failed password for root from 183.81.169.238 port 58052 ssh2
  Oct 3 05:10:35 plesk sshd[5977]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 05:10:38 plesk sshd[5977]: Failed password for root from 183.81.169.238 port 39388 ssh2
  Oct 3 05:10:40 plesk sshd[6002]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 05:10:42 plesk sshd[6002]: Failed password for root from 183.81.169.238 port 39424 ssh2

• 2024-10-02T22:10:19.364833-05:00 instance-20240522-152753 sshd[2545952]: Invalid user Antminer from 183.81.169.238 port 53648
  2024-10-02T22:10:21.773673-05:00 instance-20240522-152753 sshd[2545954]: Invalid user Antminer from 183.81.169.238 port 53678
  2024-10-02T22:10:36.660490-05:00 instance-20240522-152753 sshd[2545966]: Invalid user admin from 183.81.169.238 port 44440
  2024-10-02T22:10:38.542553-05:00 instance-20240522-152753 sshd[2545968]: Invalid user baikal from 183.81.169.238 port 44454
  ...

• 2024-10-02T23:10:22.025943-04:00 nova3 sshd[1907608]: Failed password for root from 183.81.169.238 port 57908 ssh2
  2024-10-02T23:10:25.066932-04:00 nova3 sshd[1907654]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T23:10:26.961761-04:00 nova3 sshd[1907654]: Failed password for root from 183.81.169.238 port 48034 ssh2
  2024-10-02T23:10:30.541476-04:00 nova3 sshd[1907741]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T23:10:31.789195-04:00 nova3 sshd[1907741]: Failed password for root from 183.81.169.238 port 48062 ssh2
  ...

• 2024-10-03T03:10:19.596852+00:00 mapir-proxmox sshd[3606863]: Failed password for root from 183.81.169.238 port 39760 ssh2
  2024-10-03T03:10:23.482512+00:00 mapir-proxmox sshd[3607629]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T03:10:26.104948+00:00 mapir-proxmox sshd[3607629]: Failed password for root from 183.81.169.238 port 39774 ssh2
  ...

• 3:12:47I1003 01:
  Fail2ban action triggered

• Oct 3 05:09:24 vps2 sshd[1822116]: Invalid user Antminer from 183.81.169.238 port 47092
  Oct 3 05:09:26 vps2 sshd[1822118]: Invalid user Antminer from 183.81.169.238 port 40732
  Oct 3 05:09:37 vps2 sshd[1822133]: Invalid user admin from 183.81.169.238 port 47486
  Oct 3 05:09:38 vps2 sshd[1822135]: Invalid user baikal from 183.81.169.238 port 47514
  ...

• 2024-10-03T03:09:02.894055+00:00 Linux101 sshd[2065358]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T03:09:04.728123+00:00 Linux101 sshd[2065358]: Failed password for root from 183.81.169.238 port 40458 ssh2
  2024-10-03T03:09:08.903443+00:00 Linux101 sshd[2066845]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T03:09:10.907920+00:00 Linux101 sshd[2066845]: Failed password for root from 183.81.169.238 port 56820 ssh2
  2024-10-03T03:09:14.622829+00:00 Linux101 sshd[2067947]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T03:09:16.436006+00:00 Linux101 sshd[2067947]: Failed password for root from 183.81.169.238 port 56844 ssh2
  2024-10-03T03:09:20.664964+00:00 Linux101 sshd[2068903]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh r
  ...

• Oct 3 03:07:58 ubuntu sshd[1298818]: Invalid user Antminer from 183.81.169.238 port 55272
  Oct 3 03:08:00 ubuntu sshd[1298824]: Invalid user Antminer from 183.81.169.238 port 55276
  Oct 3 03:08:12 ubuntu sshd[1299014]: Invalid user admin from 183.81.169.238 port 54114
  ...

• abuse-sshd h4

• Inteceptor Intrusion Detector: failed_password on sshd module PID: (1062270)

• FW-PortScan: Traffic Blocked srcport=38696 dstport=22

• Oct 3 03:05:57 localhost sshd[2304485]: Failed password for root from 183.81.169.238 port 45870 ssh2
  Oct 3 03:06:01 localhost sshd[2304489]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:06:02 localhost sshd[2304489]: Failed password for root from 183.81.169.238 port 45950 ssh2
  Oct 3 03:06:06 localhost sshd[2304491]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:06:07 localhost sshd[2304491]: Failed password for root from 183.81.169.238 port 46012 ssh2
  ...

• Oct 3 05:05:30 dev0-dcde-rnet sshd[10324]: Failed password for root from 183.81.169.238 port 54664 ssh2
  Oct 3 05:05:34 dev0-dcde-rnet sshd[10326]: Failed password for root from 183.81.169.238 port 54670 ssh2

• Oct 3 04:05:19 nervous-edison8 sshd[1494456]: Failed password for root from 183.81.169.238 port 53078 ssh2
  Oct 3 04:05:24 nervous-edison8 sshd[1494486]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 04:05:25 nervous-edison8 sshd[1494486]: Failed password for root from 183.81.169.238 port 53166 ssh2
  Oct 3 04:05:29 nervous-edison8 sshd[1494538]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 04:05:31 nervous-edison8 sshd[1494538]: Failed password for root from 183.81.169.238 port 40676 ssh2
  ...

• 2024-10-02T23:04:12.777605-04:00 prod-1 sshd[3526905]: Connection closed by authenticating user root 183.81.169.238 port 51498 [preauth]
  2024-10-02T23:04:15.249574-04:00 prod-1 sshd[3526924]: Connection closed by authenticating user root 183.81.169.238 port 51528 [preauth]
  2024-10-02T23:04:17.764666-04:00 prod-1 sshd[3526928]: Connection closed by authenticating user root 183.81.169.238 port 47964 [preauth]
  2024-10-02T23:04:20.070329-04:00 prod-1 sshd[3526930]: Connection closed by authenticating user root 183.81.169.238 port 47978 [preauth]
  2024-10-02T23:04:22.566500-04:00 prod-1 sshd[3526934]: Connection closed by authenticating user root 183.81.169.238 port 47994 [preauth]
  ...

• tcp/22 (30 or more attempts)

• HPot-29: Multiple unauthorised login attempts

• Oct 3 12:02:42 localhost sshd[2925618]: Failed password for root from 183.81.169.238 port 35808 ssh2
  Oct 3 12:02:47 localhost sshd[2925664]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 12:02:49 localhost sshd[2925664]: Failed password for root from 183.81.169.238 port 48178 ssh2
  Oct 3 12:02:54 localhost sshd[2925697]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 12:02:55 localhost sshd[2925697]: Failed password for root from 183.81.169.238 port 48198 ssh2
  ...

• 2024-10-03T11:02:04.136868+08:00 ocLObk1008638 sshd[1523074]: Invalid user Antminer from 183.81.169.238 port 37002
  2024-10-03T11:02:06.890578+08:00 ocLObk1008638 sshd[1523076]: Invalid user Antminer from 183.81.169.238 port 46994
  2024-10-03T11:02:23.124992+08:00 ocLObk1008638 sshd[1523088]: Invalid user admin from 183.81.169.238 port 53458
  2024-10-03T11:02:25.751590+08:00 ocLObk1008638 sshd[1523095]: Invalid user baikal from 183.81.169.238 port 53470
  ...

• Oct 3 05:02:07 AbuseCatcher sshd[3512]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 05:02:09 AbuseCatcher sshd[3512]: Failed password for root from 183.81.169.238 port 41336 ssh2
  ...

• Oct 3 05:01:43 arayat sshd[26367]: Failed password for root from 183.81.169.238 port 37514 ssh2
  Oct 3 05:01:45 arayat sshd[26426]: Failed password for root from 183.81.169.238 port 37516 ssh2
  Oct 3 05:01:47 arayat sshd[26428]: Failed password for root from 183.81.169.238 port 55912 ssh2
  Oct 3 05:01:50 arayat sshd[26430]: Failed password for root from 183.81.169.238 port 55934 ssh2
  ...

• Oct 3 03:02:00 mail sshd[208528]: Failed password for root from 183.81.169.238 port 53508 ssh2
  Oct 3 03:02:03 mail sshd[208530]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:02:05 mail sshd[208530]: Failed password for root from 183.81.169.238 port 53522 ssh2
  ...

• Oct 3 05:01:40 root1896 sshd[2151577]: Failed password for root from 183.81.169.238 port 57758 ssh2
  Oct 3 05:01:42 root1896 sshd[2151623]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 05:01:44 root1896 sshd[2151623]: Failed password for root from 183.81.169.238 port 57808 ssh2
  Oct 3 05:01:47 root1896 sshd[2151630]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 05:01:49 root1896 sshd[2151630]: Failed password for root from 183.81.169.238 port 57292 ssh2
  ...

• Unsolicited connection attempts to port 22

• Oct 3 04:01:27 s1-jellyfish sshd[2388996]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 04:01:29 s1-jellyfish sshd[2388996]: Failed password for root from 183.81.169.238 port 35548 ssh2
  ...

• Oct 3 05:00:43 vmi147057 sshd[874205]: Failed password for root from 183.81.169.238 port 40132 ssh2
  Oct 3 05:00:45 vmi147057 sshd[874222]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 05:00:47 vmi147057 sshd[874222]: Failed password for root from 183.81.169.238 port 33304 ssh2
  Oct 3 05:00:49 vmi147057 sshd[874224]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 05:00:51 vmi147057 sshd[874224]: Failed password for root from 183.81.169.238 port 33328 ssh2
  ...

• 10601 attempts since 14.07.2024 04:18:57 UTC - last one: 2024-10-03T02:34:34.971450+02:00 alpha sshd[2343160]: Connection closed by invalid user baikal 183.81.169.238 port 42964 [preauth]

• Oct 3 04:57:48 TheNewCityRP sshd[1883574]: Failed password for root from 183.81.169.238 port 40372 ssh2
  Oct 3 04:57:52 TheNewCityRP sshd[1883688]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 04:57:54 TheNewCityRP sshd[1883688]: Failed password for root from 183.81.169.238 port 48110 ssh2
  Oct 3 04:57:58 TheNewCityRP sshd[1883693]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 04:58:00 TheNewCityRP sshd[1883693]: Failed password for root from 183.81.169.238 port 39028 ssh2
  Oct 3 04:58:04 TheNewCityRP sshd[1883698]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 04:58:07 TheNewCityRP sshd[1883698]: Failed password for root from 183.81.169.238 port 39078 ssh2
  ...

• Oct 3 02:57:47 instance-20221219-1303 sshd[2762718]: Invalid user Antminer from 183.81.169.238 port 56356
  ...

• Oct 2 22:57:09 thebatforge sshd[481582]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 22:57:11 thebatforge sshd[481584]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 22:57:13 thebatforge sshd[481609]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 22:57:16 thebatforge sshd[481612]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 22:57:18 thebatforge sshd[481614]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  ...

• Oct 3 02:56:05 alpha sshd[2564418]: Failed password for root from 183.81.169.238 port 40020 ssh2
  Oct 3 02:56:08 alpha sshd[2564456]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 02:56:10 alpha sshd[2564456]: Failed password for root from 183.81.169.238 port 51598 ssh2
  Oct 3 02:56:13 alpha sshd[2564548]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 02:56:15 alpha sshd[2564548]: Failed password for root from 183.81.169.238 port 51614 ssh2
  ...

• Oct 2 22:53:40 www4 sshd[2032247]: Failed password for root from 183.81.169.238 port 40612 ssh2
  Oct 2 22:53:43 www4 sshd[2032257]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 22:53:45 www4 sshd[2032257]: Failed password for root from 183.81.169.238 port 40632 ssh2
  Oct 2 22:53:50 www4 sshd[2032270]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 22:53:52 www4 sshd[2032270]: Failed password for root from 183.81.169.238 port 57198 ssh2
  ...

• Oct 3 02:53:15 fedi sshd[3683282]: Invalid user Antminer from 183.81.169.238 port 57946
  Oct 3 02:53:18 fedi sshd[3683306]: Invalid user Antminer from 183.81.169.238 port 57950
  ...

• 2024-10-03T02:52:45.830790+00:00 frhb72991flex sshd[2168605]: Invalid user Antminer from 183.81.169.238 port 47588
  2024-10-03T02:52:47.511893+00:00 frhb72991flex sshd[2168607]: Invalid user Antminer from 183.81.169.238 port 47600
  ...

• Oct 3 02:52:05 destiny sshd[2065953]: Connection closed by invalid user root 183.81.169.238 port 46744 [preauth]
  Oct 3 02:52:07 destiny sshd[2065955]: User root not allowed because account is locked
  Oct 3 02:52:07 destiny sshd[2065955]: Connection closed by invalid user root 183.81.169.238 port 46770 [preauth]
  Oct 3 02:52:09 destiny sshd[2065957]: User root not allowed because account is locked
  Oct 3 02:52:10 destiny sshd[2065957]: Connection closed by invalid user root 183.81.169.238 port 46788 [preauth]
  ...

• Scan the port number 22 (SSH)

• Oct 3 02:51:43 hardcore-tesla sshd[4008007]: Failed password for root from 183.81.169.238 port 39450 ssh2
  Oct 3 02:51:48 hardcore-tesla sshd[4008020]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 02:51:49 hardcore-tesla sshd[4008020]: Failed password for root from 183.81.169.238 port 47728 ssh2
  Oct 3 02:51:53 hardcore-tesla sshd[4008022]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 02:51:55 hardcore-tesla sshd[4008022]: Failed password for root from 183.81.169.238 port 47750 ssh2
  ...

• Oct 2 22:50:38 fremontnet-scca-01 sshd[17000]: Failed password for root from 183.81.169.238 port 59084 ssh2
  Oct 2 22:50:43 fremontnet-scca-01 sshd[17002]: Failed password for root from 183.81.169.238 port 59090 ssh2

• Oct 3 02:50:19 phpbb3 sshd[2552902]: Invalid user Antminer from 183.81.169.238 port 55488
  Oct 3 02:50:23 phpbb3 sshd[2552904]: Invalid user Antminer from 183.81.169.238 port 55510

• Oct 3 02:49:33 dn42 sshd[702102]: Invalid user Antminer from 183.81.169.238 port 59544
  Oct 3 02:49:36 dn42 sshd[702104]: Invalid user Antminer from 183.81.169.238 port 59088
  Oct 3 02:49:47 dn42 sshd[702116]: Invalid user admin from 183.81.169.238 port 40620
  ...

• Failed password for root from 183.81.169.238 port 47126 ssh2
  pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Failed password for root from 183.81.169.238 port 59294 ssh2
  pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Failed password for root from 183.81.169.238 port 41734 ssh2

• Oct 3 04:49:01 v4940 sshd[3991846]: Failed password for root from 183.81.169.238 port 47694 ssh2
  Oct 3 04:49:05 v4940 sshd[3991848]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 04:49:07 v4940 sshd[3991848]: Failed password for root from 183.81.169.238 port 40250 ssh2
  ...

• Oct 3 04:48:54 kvm11438 sshd[67149]: Failed password for root from 183.81.169.238 port 60502 ssh2
  Oct 3 04:48:59 kvm11438 sshd[67151]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 04:49:01 kvm11438 sshd[67151]: Failed password for root from 183.81.169.238 port 46810 ssh2
  Oct 3 04:49:04 kvm11438 sshd[67162]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 04:49:06 kvm11438 sshd[67162]: Failed password for root from 183.81.169.238 port 46862 ssh2
  ...

• Oct 3 04:48:39 ts-24 sshd[391098]: Failed password for root from 183.81.169.238 port 52452 ssh2
  Oct 3 04:48:42 ts-24 sshd[391100]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 04:48:44 ts-24 sshd[391100]: Failed password for root from 183.81.169.238 port 52464 ssh2
  Oct 3 04:48:48 ts-24 sshd[391103]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 04:48:50 ts-24 sshd[391103]: Failed password for root from 183.81.169.238 port 58560 ssh2
  ...

• Oct 3 02:48:02 lavalink sshd[3319562]: Invalid user Antminer from 183.81.169.238 port 46638
  Oct 3 02:48:05 lavalink sshd[3319606]: Invalid user Antminer from 183.81.169.238 port 46658
  Oct 3 02:48:18 lavalink sshd[3319676]: Invalid user admin from 183.81.169.238 port 39214
  ...

• 2024-10-02 21:47:26,101 fail2ban.actions [974]: NOTICE [sshd] Ban 183.81.169.238

• Oct 3 03:47:02 dlcentre3 sshd[25604]: Failed password for root from 183.81.169.238 port 41072 ssh2

• 2024-10-03T04:46:39.065244+02:00 Linux14 sshd[604914]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T04:46:40.864810+02:00 Linux14 sshd[604914]: Failed password for root from 183.81.169.238 port 49660 ssh2
  2024-10-03T04:46:44.755927+02:00 Linux14 sshd[605361]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T04:46:46.574865+02:00 Linux14 sshd[605361]: Failed password for root from 183.81.169.238 port 49680 ssh2
  2024-10-03T04:46:49.919117+02:00 Linux14 sshd[605749]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T04:46:52.090243+02:00 Linux14 sshd[605749]: Failed password for root from 183.81.169.238 port 42110 ssh2
  2024-10-03T04:46:55.565218+02:00 Linux14 sshd[606081]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=18
  ...

• [02:46] Attempted SSH login on port 22 with credentials root:0

• Oct 3 05:45:22 server2 sshd\[19490\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 05:45:24 server2 sshd\[19494\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 05:45:25 server2 sshd\[19498\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 05:45:27 server2 sshd\[19500\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 05:45:28 server2 sshd\[19502\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 05:45:29 server2 sshd\[19504\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers

• Oct 3 02:45:15 web-proxy02 sshd[1595951]: Failed password for root from 183.81.169.238 port 55202 ssh2
  Oct 3 02:45:19 web-proxy02 sshd[1595956]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 02:45:20 web-proxy02 sshd[1595956]: Failed password for root from 183.81.169.238 port 41966 ssh2
  ...

• 2024-10-03T04:44:47.790113+02:00 srv1 sshd[2766669]: Failed password for root from 183.81.169.238 port 52106 ssh2
  2024-10-03T04:44:50.888161+02:00 srv1 sshd[2766673]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T04:44:53.390082+02:00 srv1 sshd[2766673]: Failed password for root from 183.81.169.238 port 52110 ssh2
  2024-10-03T04:44:58.360432+02:00 srv1 sshd[2766776]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T04:44:59.959293+02:00 srv1 sshd[2766776]: Failed password for root from 183.81.169.238 port 33724 ssh2
  ...

• Oct 3 04:44:42 vps-9f3cdc33 sshd[1881574]: Failed password for root from 183.81.169.238 port 55230 ssh2
  Oct 3 04:44:46 vps-9f3cdc33 sshd[1881576]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 04:44:48 vps-9f3cdc33 sshd[1881576]: Failed password for root from 183.81.169.238 port 55422 ssh2
  Oct 3 04:44:51 vps-9f3cdc33 sshd[1881578]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 04:44:54 vps-9f3cdc33 sshd[1881578]: Failed password for root from 183.81.169.238 port 55426 ssh2
  ...

• Detected 5 distributed attacks from 183.81.169.238. LF_DISTATTACK; Logs: 2024-10-03T04:09:02.718812+02:00 insightVM sshd[3411564]: Failed password for root from 183.81.169.238 port 45468 ssh2 2024-10-03T04:09:03.615382+02:00 insightVM sshd[3411575]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root 2024-10-03T04:08:58.001060+02:00 insightVM sshd[3411553]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root 2024-10-03T04:09:00.267369+02:00 insightVM sshd[3411553]: Failed password for root from 183.81.169.238 port 45422 ssh2 2024-10-03T04:09:00.708217+02:00 insightVM sshd[3411564]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root

• Unauthorized connection attempt detected from IP address 183.81.169.238 to port 22 (ger-03) [t]

• Oct 3 02:41:35 mark sshd[1086141]: Failed password for root from 183.81.169.238 port 50020 ssh2
  Oct 3 02:41:39 mark sshd[1087108]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 02:41:42 mark sshd[1087108]: Failed password for root from 183.81.169.238 port 53918 ssh2
  Oct 3 02:41:46 mark sshd[1088073]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 02:41:48 mark sshd[1088073]: Failed password for root from 183.81.169.238 port 43810 ssh2
  ...

• Oct 3 04:41:20 SlunchakaRP sshd[79865]: Failed password for root from 183.81.169.238 port 59252 ssh2
  Oct 3 04:41:24 SlunchakaRP sshd[79870]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 04:41:26 SlunchakaRP sshd[79870]: Failed password for root from 183.81.169.238 port 55462 ssh2
  Oct 3 04:41:30 SlunchakaRP sshd[79875]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 04:41:32 SlunchakaRP sshd[79875]: Failed password for root from 183.81.169.238 port 55468 ssh2
  Oct 3 04:41:35 SlunchakaRP sshd[79880]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 04:41:37 SlunchakaRP sshd[79880]: Failed password for root from 183.81.169.238 port 35562 ssh2
  ...

• 2024-10-03T02:40:29.186466+00:00 t301 sshd[11000]: Failed password for root from 183.81.169.238 port 37638 ssh2
  2024-10-03T02:40:33.033157+00:00 t301 sshd[11002]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T02:40:35.254737+00:00 t301 sshd[11002]: Failed password for root from 183.81.169.238 port 37652 ssh2
  ...

• 10878 attempts since 13.07.2024 23:53:03 UTC - last one: 2024-10-03T01:47:16.904065+02:00 beta sshd[2314764]: Connection closed by invalid user baikal 183.81.169.238 port 53476 [preauth]

• Oct 2 21:40:00 ivankin sshd[435934]: Failed password for root from 183.81.169.238 port 60952 ssh2
  Oct 2 21:40:04 ivankin sshd[435936]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 21:40:05 ivankin sshd[435936]: Failed password for root from 183.81.169.238 port 60986 ssh2
  ...

• 2024-10-02T19:39:58.046529-07:00 panduhstudios sshd[2831033]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T19:39:59.795148-07:00 panduhstudios sshd[2831033]: Failed password for root from 183.81.169.238 port 54028 ssh2
  2024-10-02T19:40:02.819084-07:00 panduhstudios sshd[2831039]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T19:40:04.783855-07:00 panduhstudios sshd[2831039]: Failed password for root from 183.81.169.238 port 54040 ssh2
  ...

• FW-PortScan: Traffic Blocked srcport=56066 dstport=22

• Oct 3 02:38:07 cloud sshd[3887993]: Invalid user Antminer from 183.81.169.238 port 60162
  Oct 3 02:38:09 cloud sshd[3887995]: Invalid user Antminer from 183.81.169.238 port 60170
  ...

• Oct 3 02:37:29 vps-9 sshd[979927]: Failed password for root from 183.81.169.238 port 39032 ssh2
  Oct 3 02:37:33 vps-9 sshd[979929]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 02:37:35 vps-9 sshd[979929]: Failed password for root from 183.81.169.238 port 39038 ssh2
  ...

• 2024-10-03T04:36:41.573593+02:00 ubuntu sshd[159355]: Failed password for root from 183.81.169.238 port 39226 ssh2
  2024-10-03T04:36:44.456357+02:00 ubuntu sshd[159358]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T04:36:46.236358+02:00 ubuntu sshd[159358]: Failed password for root from 183.81.169.238 port 39252 ssh2
  2024-10-03T04:36:48.339898+02:00 ubuntu sshd[159360]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T04:36:50.671509+02:00 ubuntu sshd[159360]: Failed password for root from 183.81.169.238 port 46504 ssh2
  ...

• 2024-10-03T02:36:12.147879+00:00 deb1 sshd[76707]: Connection closed by authenticating user root 183.81.169.238 port 54568 [preauth]
  ...

• 2024-10-03T11:35:31.382905 mustar-kr-miso sshd[1456531]: Failed password for root from 183.81.169.238 port 49942 ssh2
  2024-10-03T11:35:34.910536 mustar-kr-miso sshd[1456534]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T11:35:37.081967 mustar-kr-miso sshd[1456534]: Failed password for root from 183.81.169.238 port 49968 ssh2
  2024-10-03T11:35:40.430057 mustar-kr-miso sshd[1456537]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T11:35:42.757318 mustar-kr-miso sshd[1456537]: Failed password for root from 183.81.169.238 port 60740 ssh2
  ...

• Oct 3 02:33:53 internal-mail-rafled-com sshd[1112283]: Invalid user Antminer from 183.81.169.238 port 40548
  ...

• 2024-10-03T04:30:09.069438+02:00 vserver-20917 sshd-session[1965217]: Failed password for root from 183.81.169.238 port 44006 ssh2
  2024-10-03T04:30:11.662552+02:00 vserver-20917 sshd-session[1965220]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T04:30:14.159850+02:00 vserver-20917 sshd-session[1965220]: Failed password for root from 183.81.169.238 port 44034 ssh2
  2024-10-03T04:30:16.409141+02:00 vserver-20917 sshd-session[1965223]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T04:30:18.588640+02:00 vserver-20917 sshd-session[1965223]: Failed password for root from 183.81.169.238 port 42082 ssh2
  ...

• 2024-10-03T04:31:55.451052+02:00 hvs sshd-session[44779]: Connection closed by authenticating user root 183.81.169.238 port 57130 [preauth]
  2024-10-03T04:31:56.790547+02:00 hvs sshd-session[44781]: Connection closed by authenticating user root 183.81.169.238 port 57146 [preauth]
  2024-10-03T04:31:58.112841+02:00 hvs sshd-session[44783]: Connection closed by authenticating user root 183.81.169.238 port 57178 [preauth]
  2024-10-03T04:31:59.440394+02:00 hvs sshd-session[44785]: Connection closed by authenticating user root 183.81.169.238 port 57196 [preauth]
  2024-10-03T04:32:00.700492+02:00 hvs sshd-session[44787]: Connection closed by authenticating user root 183.81.169.238 port 57218 [preauth]
  ...

• Oct 3 04:28:20 C1D543E sshd[771444]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 04:28:20 C1D543E sshd[771444]: Failed password for invalid user root from 183.81.169.238 port 53006 ssh2
  Oct 3 04:28:22 C1D543E sshd[771446]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 04:28:22 C1D543E sshd[771446]: Failed password for invalid user root from 183.81.169.238 port 53012 ssh2
  Oct 3 04:28:24 C1D543E sshd[771448]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  ...

• SSH Authentication Brute Force Attempt

• Oct 3 04:24:49 unifi sshd[747417]: Failed password for root from 183.81.169.238 port 47994 ssh2
  Oct 3 04:24:51 unifi sshd[747421]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 04:24:52 unifi sshd[747421]: Failed password for root from 183.81.169.238 port 48040 ssh2
  Oct 3 04:24:55 unifi sshd[747423]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 04:24:57 unifi sshd[747423]: Failed password for root from 183.81.169.238 port 34492 ssh2
  ...

• FW-PortScan: Traffic Blocked srcport=45880 dstport=22

• Oct 3 04:23:14 vps643776 sshd[1284954]: Failed password for root from 183.81.169.238 port 33416 ssh2
  Oct 3 04:23:16 vps643776 sshd[1284956]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 04:23:18 vps643776 sshd[1284956]: Failed password for root from 183.81.169.238 port 55942 ssh2
  Oct 3 04:23:19 vps643776 sshd[1284958]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 04:23:21 vps643776 sshd[1284958]: Failed password for root from 183.81.169.238 port 55986 ssh2
  ...

• [rede-176-124] 10/02/2024-23:23:13.376985, 183.81.169.238, Protocol: 6, ET COMPROMISED Known Compromised or Hostile Host Traffic group 13

• 2024-10-03T02:22:44.306066+00:00 fluff sshd[79966]: Failed password for root from 183.81.169.238 port 51466 ssh2
  2024-10-03T02:22:48.326501+00:00 fluff sshd[79968]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T02:22:50.006213+00:00 fluff sshd[79968]: Failed password for root from 183.81.169.238 port 56644 ssh2
  2024-10-03T02:22:53.114915+00:00 fluff sshd[79970]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T02:22:55.482066+00:00 fluff sshd[79970]: Failed password for root from 183.81.169.238 port 56654 ssh2
  ...

• Oct 3 03:21:43 dev sshd[71417]: Failed password for root from 183.81.169.238 port 53702 ssh2
  Oct 3 03:21:46 dev sshd[71419]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:21:48 dev sshd[71419]: Failed password for root from 183.81.169.238 port 49986 ssh2
  Oct 3 03:21:52 dev sshd[71422]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:21:54 dev sshd[71422]: Failed password for root from 183.81.169.238 port 50016 ssh2
  ...

• Oct 3 04:20:44 t7-core-development sshd[715401]: Failed password for root from 183.81.169.238 port 43052 ssh2
  Oct 3 04:20:48 t7-core-development sshd[715406]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 04:20:49 t7-core-development sshd[715406]: Failed password for root from 183.81.169.238 port 43054 ssh2
  Oct 3 04:20:51 t7-core-development sshd[715411]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 04:20:53 t7-core-development sshd[715411]: Failed password for root from 183.81.169.238 port 43064 ssh2
  Oct 3 04:20:55 t7-core-development sshd[715416]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 04:20:57 t7-core-development sshd[715416]: Failed password for root from 183.81.169.238 port 40616 ssh2
  ...

• 2024-10-03T10:20:43.986016+08:00 VM65536 sshd[917044]: Connection closed by authenticating user root 183.81.169.238 port 37700 [preauth]
  2024-10-03T10:20:46.710861+08:00 VM65536 sshd[917048]: Connection closed by authenticating user root 183.81.169.238 port 50730 [preauth]
  2024-10-03T10:20:49.393182+08:00 VM65536 sshd[917050]: Connection closed by authenticating user root 183.81.169.238 port 50760 [preauth]
  ...

• Oct 3 04:19:37 qube2 sshd[3060961]: Failed password for root from 183.81.169.238 port 57362 ssh2
  Oct 3 04:19:40 qube2 sshd[3061019]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 04:19:42 qube2 sshd[3061019]: Failed password for root from 183.81.169.238 port 57376 ssh2
  ...

• Oct 3 04:17:42 SFEEDS sshd[486028]: Failed password for root from 183.81.169.238 port 47678 ssh2
  Oct 3 04:17:45 SFEEDS sshd[486031]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 04:17:47 SFEEDS sshd[486031]: Failed password for root from 183.81.169.238 port 36724 ssh2
  Oct 3 04:17:49 SFEEDS sshd[486033]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 04:17:51 SFEEDS sshd[486033]: Failed password for root from 183.81.169.238 port 36746 ssh2
  ...

• 2024-10-03T02:14:53.512447+00:00 Linux04 sshd[2776166]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T02:14:54.981243+00:00 Linux04 sshd[2776166]: Failed password for root from 183.81.169.238 port 50142 ssh2
  2024-10-03T02:14:56.830901+00:00 Linux04 sshd[2776345]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T02:14:58.715319+00:00 Linux04 sshd[2776345]: Failed password for root from 183.81.169.238 port 50454 ssh2
  2024-10-03T02:14:59.889657+00:00 Linux04 sshd[2776522]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T02:15:01.518211+00:00 Linux04 sshd[2776522]: Failed password for root from 183.81.169.238 port 50470 ssh2
  2024-10-03T02:15:03.230091+00:00 Linux04 sshd[2776787]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= r
  ...

• Security system: Unauthorised SSH/Telnet login attempt with user "root" at 2024-10-03T02:15:35Z

• Oct 2 19:15:00 server01 sshd[10536]: Failed password for root from 183.81.169.238 port 33266 ssh2
  Oct 2 19:15:05 server01 sshd[10540]: Failed password for root from 183.81.169.238 port 33274 ssh2
  ...

• Oct 2 19:13:29 LU-VPS01 sshd[23768]: Failed password for root from 183.81.169.238 port 43536 ssh2
  Oct 2 19:13:33 LU-VPS01 sshd[23772]: Failed password for root from 183.81.169.238 port 43586 ssh2
  ...

• 2024-10-03T02:13:14.112383+00:00 mail-backup sshd[59549]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-03T02:13:15.088731+00:00 mail-backup sshd[59551]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-03T02:13:16.261057+00:00 mail-backup sshd[59553]: User root from 183.81.169.238 not allowed because not listed in AllowUsers

• Oct 3 05:42:52 Digitalogic sshd[1347890]: Connection closed by authenticating user root 183.81.169.238 port 47996 [preauth]
  Oct 3 05:42:53 Digitalogic sshd[1347913]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 05:42:55 Digitalogic sshd[1347913]: Failed password for root from 183.81.169.238 port 48012 ssh2
  ...

• Oct 3 04:12:42 odin sshd[14556]: Failed password for root from 183.81.169.238 port 33836 ssh2
  Oct 3 04:12:46 odin sshd[14563]: Failed password for root from 183.81.169.238 port 53446 ssh2

• Oct 3 02:11:22 cloud-server-0 sshd[1859248]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 02:11:25 cloud-server-0 sshd[1859248]: Failed password for root from 183.81.169.238 port 43342 ssh2
  Oct 3 02:11:27 cloud-server-0 sshd[1859250]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 02:11:29 cloud-server-0 sshd[1859250]: Failed password for root from 183.81.169.238 port 57768 ssh2
  Oct 3 02:11:31 cloud-server-0 sshd[1859257]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 02:11:33 cloud-server-0 sshd[1859257]: Failed password for root from 183.81.169.238 port 57790 ssh2
  Oct 3 02:11:35 cloud-server-0 sshd[1859259]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 02:11:37 cloud-server-0 sshd[185
  ...

• Oct 3 04:09:19 [redacted] sshd[3747567]: Failed password for [redacted] from 183.81.169.238 port 33326 ssh2
  Oct 3 04:09:19 [redacted] sshd[3747583]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=[redacted]
  Oct 3 04:09:21 [redacted] sshd[3747583]: Failed password for [redacted] from 183.81.169.238 port 33332 ssh2
  Oct 3 04:09:23 [redacted] sshd[3747593]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=[redacted]
  Oct 3 04:09:25 [redacted] sshd[3747593]: Failed password for [redacted] from 183.81.169.238 port 33348 ssh2
  ...

• (sshd) Failed SSH login from 183.81.169.238 (NL/The Netherlands/North Holland/Amsterdam/-/[AS206264 Amarutu Technology Ltd]): 5 in the last 3600 secs; IP: 183.81.169.238; Ports: *; Direction: 0; Trigger: LF_SSHD; Logs: 2024-10-03T04:08:58.001060+02:00 insightVM sshd[3411553]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root 2024-10-03T04:09:00.267369+02:00 insightVM sshd[3411553]: Failed password for root from 183.81.169.238 port 45422 ssh2 2024-10-03T04:09:00.708217+02:00 insightVM sshd[3411564]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root 2024-10-03T04:09:02.718812+02:00 insightVM sshd[3411564]: Failed password for root from 183.81.169.238 port 45468 ssh2 2024-10-03T04:09:03.615382+02:00 insightVM sshd[3411575]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root

• 2024-10-02T22:08:55.699833-04:00 collabhost.computernewb.com sshd-session[3689214]: Invalid user Antminer from 183.81.169.238 port 60464
  2024-10-02T22:08:56.633630-04:00 collabhost.computernewb.com sshd-session[3689218]: Invalid user Antminer from 183.81.169.238 port 60478
  2024-10-02T22:09:01.100336-04:00 collabhost.computernewb.com sshd-session[3689230]: Invalid user admin from 183.81.169.238 port 60522
  ...

• 2024-10-02T22:08:14.530643-04:00 srv-UXQS4A.incognet.io sshd[1570]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T22:08:16.225246-04:00 srv-UXQS4A.incognet.io sshd[1570]: Failed password for invalid user root from 183.81.169.238 port 53942 ssh2
  ...

• Oct 3 03:09:27 cloud sshd[281236]: Invalid user Antminer from 183.81.169.238 port 37012
  Oct 3 03:09:29 cloud sshd[281238]: Invalid user Antminer from 183.81.169.238 port 37034
  Oct 3 03:09:40 cloud sshd[281252]: Invalid user admin from 183.81.169.238 port 49132
  Oct 3 03:09:42 cloud sshd[281254]: Invalid user baikal from 183.81.169.238 port 49152
  Oct 3 04:08:10 cloud sshd[282493]: Invalid user Antminer from 183.81.169.238 port 59058

• FW-PortScan: Traffic Blocked srcport=34134 dstport=22

• Oct 2 22:06:04 ny01 sshd[2712546]: Failed password for root from 183.81.169.238 port 59208 ssh2
  Oct 2 22:06:07 ny01 sshd[2712549]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 22:06:09 ny01 sshd[2712549]: Failed password for root from 183.81.169.238 port 33950 ssh2
  Oct 2 22:06:10 ny01 sshd[2712559]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 22:06:12 ny01 sshd[2712559]: Failed password for root from 183.81.169.238 port 33962 ssh2

• Oct 3 02:05:40 ssh sshd[92395]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 02:05:40 ssh sshd[92395]: Connection reset by invalid user root 183.81.169.238 port 55660 [preauth]
  Oct 3 02:05:41 ssh sshd[92397]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  ...

• 2024-10-03T02:05:03.379848+00:00 minio-fra-01.pdx.net.uk sshd[155135]: Invalid user Antminer from 183.81.169.238 port 40258
  2024-10-03T02:05:03.489079+00:00 minio-fra-01.pdx.net.uk sshd[155137]: Invalid user Antminer from 183.81.169.238 port 40270
  2024-10-03T02:05:04.407503+00:00 minio-fra-01.pdx.net.uk sshd[155149]: Invalid user admin from 183.81.169.238 port 41126
  ...

• tcp/22 (35 or more attempts)

• Oct 3 04:03:36 m2048 sshd[317900]: Failed password for root from 183.81.169.238 port 59824 ssh2
  Oct 3 04:03:38 m2048 sshd[317902]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 04:03:41 m2048 sshd[317902]: Failed password for root from 183.81.169.238 port 59836 ssh2
  Oct 3 04:03:42 m2048 sshd[317907]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 04:03:44 m2048 sshd[317907]: Failed password for root from 183.81.169.238 port 59850 ssh2
  ...

• Oct 3 04:02:37 DarkStreetRP sshd[1183083]: Failed password for root from 183.81.169.238 port 51532 ssh2
  Oct 3 04:02:38 DarkStreetRP sshd[1183088]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 04:02:41 DarkStreetRP sshd[1183088]: Failed password for root from 183.81.169.238 port 50910 ssh2
  Oct 3 04:02:41 DarkStreetRP sshd[1183093]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 04:02:43 DarkStreetRP sshd[1183093]: Failed password for root from 183.81.169.238 port 50916 ssh2
  Oct 3 04:02:45 DarkStreetRP sshd[1183095]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 04:02:47 DarkStreetRP sshd[1183095]: Failed password for root from 183.81.169.238 port 50918 ssh2
  ...

• Oct 3 08:59:33 pve sshd[1502776]: Connection closed by authenticating user root 183.81.169.238 port 48440 [preauth]
  Oct 3 08:59:36 pve sshd[1502782]: Connection closed by authenticating user root 183.81.169.238 port 48446 [preauth]
  Oct 3 08:59:39 pve sshd[1502805]: Connection closed by authenticating user root 183.81.169.238 port 42550 [preauth]
  Oct 3 08:59:42 pve sshd[1502825]: Connection closed by authenticating user root 183.81.169.238 port 42574 [preauth]
  Oct 3 08:59:45 pve sshd[1502833]: Connection closed by authenticating user root 183.81.169.238 port 42586 [preauth]
  ...

• Oct 3 02:01:31 cloud sshd[3884435]: Invalid user Antminer from 183.81.169.238 port 56566
  Oct 3 02:01:32 cloud sshd[3884437]: Invalid user Antminer from 183.81.169.238 port 56584
  ...

• Ports: 22; 2 attempts

• Oct 3 04:01:03 h2930838 sshd[22999]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 04:01:05 h2930838 sshd[22999]: Failed password for invalid user root from 183.81.169.238 port 49254 ssh2

• Oct 3 02:00:41 cloud-server-0 sshd[2891004]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 02:00:43 cloud-server-0 sshd[2891004]: Failed password for root from 183.81.169.238 port 48420 ssh2
  ...

• 2024-10-03T03:58:57.359939+02:00 PWS-PM-WEB01 sshd[3300189]: Failed password for root from 183.81.169.238 port 48546 ssh2
  2024-10-03T03:59:01.114013+02:00 PWS-PM-WEB01 sshd[3300193]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T03:59:03.560967+02:00 PWS-PM-WEB01 sshd[3300193]: Failed password for root from 183.81.169.238 port 48584 ssh2
  ...

• Oct 2 23:00:26 SRC=183.81.169.238 PROTO=TCP SPT=55951 DPT=22 SYN
  ...

• Oct 3 03:59:48 h2691902 sshd[3138]: Failed password for root from 183.81.169.238 port 39716 ssh2
  Oct 3 03:59:50 h2691902 sshd[3141]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:59:52 h2691902 sshd[3141]: Failed password for root from 183.81.169.238 port 38840 ssh2
  Oct 3 03:59:54 h2691902 sshd[3143]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:59:56 h2691902 sshd[3143]: Failed password for root from 183.81.169.238 port 38874 ssh2
  ...

• Oct 3 03:59:30 v2202301167543214332 sshd[2968073]: Failed password for root from 183.81.169.238 port 40418 ssh2
  Oct 3 03:59:34 v2202301167543214332 sshd[2968075]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:59:36 v2202301167543214332 sshd[2968075]: Failed password for root from 183.81.169.238 port 40424 ssh2
  Oct 3 03:59:40 v2202301167543214332 sshd[2968077]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:59:42 v2202301167543214332 sshd[2968077]: Failed password for root from 183.81.169.238 port 37194 ssh2
  ...

• Oct 3 03:59:26 mx1 sshd[2000612]: Failed password for root from 183.81.169.238 port 41704 ssh2
  Oct 3 03:59:28 mx1 sshd[2000614]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:59:30 mx1 sshd[2000614]: Failed password for root from 183.81.169.238 port 58176 ssh2
  Oct 3 03:59:35 mx1 sshd[2000616]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:59:37 mx1 sshd[2000616]: Failed password for root from 183.81.169.238 port 58246 ssh2
  ...

• 2024-10-03T04:59:19.012202+03:00 mummo sshd[2155362]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T04:59:20.595394+03:00 mummo sshd[2155362]: Failed password for root from 183.81.169.238 port 36120 ssh2
  ...

• Oct 3 03:58:28 phoeve sshd[2682660]: Invalid user Antminer from 183.81.169.238 port 48218
  ...

• Oct 3 03:58:04 ifog sshd[82661]: Invalid user Antminer from 183.81.169.238 port 34104
  Oct 3 03:58:06 ifog sshd[82663]: Invalid user Antminer from 183.81.169.238 port 41132
  Oct 3 03:58:16 ifog sshd[82677]: Invalid user admin from 183.81.169.238 port 45080
  ...

• Oct 3 03:57:29 docker-01 sshd[216256]: Failed password for root from 183.81.169.238 port 34160 ssh2
  Oct 3 03:57:33 docker-01 sshd[216305]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:57:36 docker-01 sshd[216305]: Failed password for root from 183.81.169.238 port 34254 ssh2
  Oct 3 03:57:40 docker-01 sshd[216324]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:57:42 docker-01 sshd[216324]: Failed password for root from 183.81.169.238 port 37438 ssh2
  ...

• Oct 3 01:56:52 cknpih001 sshd[32296]: Failed password for root from 183.81.169.238 port 50736 ssh2
  Oct 3 01:56:57 cknpih001 sshd[32298]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 01:56:59 cknpih001 sshd[32298]: Failed password for root from 183.81.169.238 port 53362 ssh2
  Oct 3 01:57:01 cknpih001 sshd[32300]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 01:57:03 cknpih001 sshd[32300]: Failed password for root from 183.81.169.238 port 53392 ssh2
  ...

• [01:55] Attempted SSH login on port 22 with credentials root:0

• Oct 3 04:54:36 pkdns2 sshd\[6906\]: Failed password for root from 183.81.169.238 port 48172 ssh2Oct 3 04:54:39 pkdns2 sshd\[6908\]: Failed password for root from 183.81.169.238 port 43224 ssh2Oct 3 04:54:44 pkdns2 sshd\[6910\]: Failed password for root from 183.81.169.238 port 43232 ssh2Oct 3 04:54:48 pkdns2 sshd\[6912\]: Failed password for root from 183.81.169.238 port 58946 ssh2Oct 3 04:54:52 pkdns2 sshd\[6914\]: Failed password for root from 183.81.169.238 port 58960 ssh2Oct 3 04:54:57 pkdns2 sshd\[6916\]: Failed password for root from 183.81.169.238 port 58986 ssh2
  ...

• Oct 2 21:54:11 scp sshd[2957584]: Invalid user Antminer from 183.81.169.238 port 51086
  Oct 2 21:54:13 scp sshd[2957648]: Invalid user Antminer from 183.81.169.238 port 51118
  Oct 2 21:54:28 scp sshd[2957997]: Invalid user admin from 183.81.169.238 port 51904
  ...

• Oct 3 01:53:48 lavalink sshd[3304548]: Invalid user Antminer from 183.81.169.238 port 45206
  Oct 3 01:53:51 lavalink sshd[3304550]: Invalid user Antminer from 183.81.169.238 port 45224
  Oct 3 01:54:04 lavalink sshd[3304618]: Invalid user admin from 183.81.169.238 port 37722
  ...

• endlessh: 2024-10-03 03:52:03.711969112 2024-10-03T01:52:03.711Z CLOSE host=183.81.169.238 port=50126 fd=5 time=160.075 bytes=271
  ...

• Oct 3 03:52:01 AbuseCatcher sshd[4184532]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:52:03 AbuseCatcher sshd[4184532]: Failed password for root from 183.81.169.238 port 58646 ssh2
  ...

• Oct 3 03:51:24 Servo sshd[3299662]: Invalid user Antminer from 183.81.169.238 port 53374
  Oct 3 03:51:26 Servo sshd[3299676]: Invalid user Antminer from 183.81.169.238 port 43272
  Oct 3 03:51:37 Servo sshd[3299942]: Invalid user admin from 183.81.169.238 port 42314
  ...

• Oct 3 03:51:31 de-kae sshd[3489025]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:51:33 de-kae sshd[3489025]: Failed password for root from 183.81.169.238 port 54944 ssh2
  ...

• Inteceptor Intrusion Detector: failed_password on sshd module PID: (1484253)

• Detected multiple authentication failures and invalid user attempts from IP address 183.81.169.238 on [PT] Lis-26 Node.

• Oct 2 21:50:51 vps196363 sshd[975]: Failed password for root from 183.81.169.238 port 48880 ssh2
  Oct 2 21:50:56 vps196363 sshd[978]: Failed password for root from 183.81.169.238 port 48896 ssh2
  Oct 2 21:51:01 vps196363 sshd[980]: Failed password for root from 183.81.169.238 port 59122 ssh2
  ...

• Oct 3 04:50:47 server2 sshd\[14368\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 04:50:48 server2 sshd\[14370\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 04:50:49 server2 sshd\[14372\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 04:50:51 server2 sshd\[14374\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 04:50:52 server2 sshd\[14380\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 04:50:54 server2 sshd\[14382\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers

• Oct 3 03:50:46 unifi sshd[747166]: Failed password for root from 183.81.169.238 port 44702 ssh2
  Oct 3 03:50:49 unifi sshd[747168]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:50:51 unifi sshd[747168]: Failed password for root from 183.81.169.238 port 42892 ssh2
  Oct 3 03:50:54 unifi sshd[747170]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:50:56 unifi sshd[747170]: Failed password for root from 183.81.169.238 port 42904 ssh2
  ...

• Oct 2 18:50:11 LU-VPS01 sshd[23061]: Failed password for root from 183.81.169.238 port 56848 ssh2
  Oct 2 18:50:17 LU-VPS01 sshd[23067]: Failed password for root from 183.81.169.238 port 49420 ssh2
  ...

• 2024-10-03T03:48:53.049979+02:00 Webserver sshd[698634]: Failed password for root from 183.81.169.238 port 57066 ssh2
  2024-10-03T03:48:55.510263+02:00 Webserver sshd[698636]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T03:48:57.094542+02:00 Webserver sshd[698636]: Failed password for root from 183.81.169.238 port 57100 ssh2
  2024-10-03T03:49:00.408254+02:00 Webserver sshd[698638]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T03:49:01.676789+02:00 Webserver sshd[698638]: Failed password for root from 183.81.169.238 port 58028 ssh2
  ...

• Oct 3 03:48:13 ts-24 sshd[389901]: Failed password for root from 183.81.169.238 port 47616 ssh2
  Oct 3 03:48:18 ts-24 sshd[389903]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:48:19 ts-24 sshd[389903]: Failed password for root from 183.81.169.238 port 39290 ssh2
  Oct 3 03:48:22 ts-24 sshd[389905]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:48:23 ts-24 sshd[389905]: Failed password for root from 183.81.169.238 port 39292 ssh2
  ...

• [rede-166-249] (sshd) Failed SSH login from 183.81.169.238 (NL/The Netherlands/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Oct 2 22:47:02 sshd[20128]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=[USERNAME]
  Oct 2 22:47:03 sshd[20128]: Failed password for [USERNAME] from 183.81.169.238 port 44518 ssh2
  Oct 2 22:47:07 sshd[20141]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=[USERNAME]
  Oct 2 22:47:09 sshd[20141]: Failed password for [USERNAME] from 183.81.169.238 port 33676 ssh2
  Oct 2 22:

• Oct 3 03:46:30 performance sshd[250002]: Failed password for root from 183.81.169.238 port 40720 ssh2
  Oct 3 03:46:35 performance sshd[250008]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:46:37 performance sshd[250008]: Failed password for root from 183.81.169.238 port 36680 ssh2
  Oct 3 03:46:41 performance sshd[250016]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:46:43 performance sshd[250016]: Failed password for root from 183.81.169.238 port 60850 ssh2
  Oct 3 03:46:47 performance sshd[250022]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:46:50 performance sshd[250022]: Failed password for root from 183.81.169.238 port 60856 ssh2
  ...

• 2024-10-03T01:46:05.181197+00:00 Linux05 sshd[2218161]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T01:46:07.427929+00:00 Linux05 sshd[2218161]: Failed password for root from 183.81.169.238 port 57284 ssh2
  2024-10-03T01:46:12.117395+00:00 Linux05 sshd[2218556]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T01:46:14.323853+00:00 Linux05 sshd[2218556]: Failed password for root from 183.81.169.238 port 48992 ssh2
  2024-10-03T01:46:19.044202+00:00 Linux05 sshd[2218922]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T01:46:20.879339+00:00 Linux05 sshd[2218922]: Failed password for root from 183.81.169.238 port 48966 ssh2
  2024-10-03T01:46:23.315559+00:00 Linux05 sshd[2219128]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= r
  ...

• Oct 3 01:45:54 ovh-docker-001 sshd[4179784]: Failed password for root from 183.81.169.238 port 51652 ssh2
  Oct 3 01:45:57 ovh-docker-001 sshd[4179817]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 01:46:00 ovh-docker-001 sshd[4179817]: Failed password for root from 183.81.169.238 port 40766 ssh2
  Oct 3 01:46:03 ovh-docker-001 sshd[4179838]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 01:46:05 ovh-docker-001 sshd[4179838]: Failed password for root from 183.81.169.238 port 40784 ssh2
  ...

• 2024-10-03T01:44:49.911404+00:00 srv67 sshd[34125]: Connection closed by authenticating user root 183.81.169.238 port 39800 [preauth]
  ...

• Oct 2 22:44:32 SRC=183.81.169.238 PROTO=TCP SPT=48783 DPT=22 SYN
  ...

• Oct 3 02:43:31 dlcentre3 sshd[13737]: Failed password for root from 183.81.169.238 port 44042 ssh2

• PBK Oct 3 03:43:25 websrv01 sshd[1380587]: Failed password for root from 183.81.169.238 port 52326 ssh2
  Oct 3 03:43:27 websrv01 sshd[1380589]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:43:29 websrv01 sshd[1380589]: Failed password for root from 183.81.169.238 port 54482 ssh2
  Oct 3 03:43:34 websrv01 sshd[1380591]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:43:36 websrv01 sshd[1380591]: Failed password for root from 183.81.169.238 port 54524 ssh2

• SSH-Multi login attempt

• Oct 2 19:40:35 mortgagebase sshd[15500]: Failed password for root from 183.81.169.238 port 46528 ssh2
  Oct 2 19:40:38 mortgagebase sshd[15502]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 19:40:39 mortgagebase sshd[15502]: Failed password for root from 183.81.169.238 port 56838 ssh2
  Oct 2 19:40:42 mortgagebase sshd[15504]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 19:40:45 mortgagebase sshd[15504]: Failed password for root from 183.81.169.238 port 56862 ssh2
  ...

• Unsolicited connection attempt(s), port:22.

• 2024-10-03T03:37:04.480597+02:00 vserver-20917 sshd-session[1963569]: Failed password for root from 183.81.169.238 port 56972 ssh2
  2024-10-03T03:37:08.043090+02:00 vserver-20917 sshd-session[1963574]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T03:37:10.099185+02:00 vserver-20917 sshd-session[1963574]: Failed password for root from 183.81.169.238 port 38282 ssh2
  2024-10-03T03:37:12.893839+02:00 vserver-20917 sshd-session[1963577]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T03:37:14.632600+02:00 vserver-20917 sshd-session[1963577]: Failed password for root from 183.81.169.238 port 38312 ssh2
  ...

• Oct 3 03:37:45 maximus sshd[4180611]: Failed password for root from 183.81.169.238 port 38848 ssh2
  Oct 3 03:37:48 maximus sshd[4180613]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:37:49 maximus sshd[4180613]: Failed password for root from 183.81.169.238 port 56950 ssh2
  Oct 3 03:37:52 maximus sshd[4180642]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:37:54 maximus sshd[4180642]: Failed password for root from 183.81.169.238 port 56980 ssh2
  ...

• Oct 3 04:36:53 localhost sshd[1332370]: Failed password for root from 183.81.169.238 port 44688 ssh2
  Oct 3 04:36:55 localhost sshd[1332376]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 04:36:57 localhost sshd[1332376]: Failed password for root from 183.81.169.238 port 34714 ssh2
  Oct 3 04:37:00 localhost sshd[1332383]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 04:37:01 localhost sshd[1332383]: Failed password for root from 183.81.169.238 port 34742 ssh2
  ...

• 2024-10-03T03:36:33.181157+02:00 hvs sshd-session[43979]: Connection closed by authenticating user root 183.81.169.238 port 43100 [preauth]
  2024-10-03T03:36:35.601263+02:00 hvs sshd-session[43981]: Connection closed by authenticating user root 183.81.169.238 port 43112 [preauth]
  2024-10-03T03:36:36.754222+02:00 hvs sshd-session[43983]: Connection closed by authenticating user root 183.81.169.238 port 54948 [preauth]
  2024-10-03T03:36:40.606516+02:00 hvs sshd-session[43987]: Connection closed by authenticating user root 183.81.169.238 port 54984 [preauth]
  2024-10-03T03:36:42.085822+02:00 hvs sshd-session[43990]: Connection closed by authenticating user root 183.81.169.238 port 54998 [preauth]
  ...

• 2024-10-03T09:35:06.880265+08:00 raindance sshd[271238]: Failed password for root from 183.81.169.238 port 45120 ssh2
  2024-10-03T09:35:10.995002+08:00 raindance sshd[271241]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T09:35:12.654915+08:00 raindance sshd[271241]: Failed password for root from 183.81.169.238 port 49204 ssh2
  2024-10-03T09:35:16.553193+08:00 raindance sshd[271244]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T09:35:18.704765+08:00 raindance sshd[271244]: Failed password for root from 183.81.169.238 port 49212 ssh2
  ...

• Failed password for root from 183.81.169.238 port 50822 ssh2
  pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Failed password for root from 183.81.169.238 port 50838 ssh2
  pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Failed password for root from 183.81.169.238 port 49578 ssh2

• FW-PortScan: Traffic Blocked srcport=42425 dstport=22

• Oct 3 03:32:51 monitor sshd[3914269]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:32:58 monitor sshd[3914271]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:33:04 monitor sshd[3914273]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:33:10 monitor sshd[3914275]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:33:16 monitor sshd[3914278]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  ...

• 183.81.169.238 (183.81.169.238) - SSH Brute force:
  Oct 3 04:32:32 XWEB sshd[14047]: Failed password for root from 183.81.169.238 port 35352 ssh2
  Oct 3 04:32:37 XWEB sshd[14049]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 04:32:39 XWEB sshd[14049]: Failed password for root from 183.81.169.238 port 51094 ssh2
  ...

• 2024-10-03T03:31:47.654426+02:00 hosting13 sshd[237334]: Failed password for root from 183.81.169.238 port 59512 ssh2
  2024-10-03T03:31:50.540460+02:00 hosting13 sshd[237340]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T03:31:52.412264+02:00 hosting13 sshd[237340]: Failed password for root from 183.81.169.238 port 59554 ssh2
  2024-10-03T03:31:55.762851+02:00 hosting13 sshd[237345]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T03:31:57.318630+02:00 hosting13 sshd[237345]: Failed password for root from 183.81.169.238 port 48544 ssh2
  ...

• 2024-10-02T21:31:07.513847-04:00 prod-1 sshd[3510355]: Connection closed by authenticating user root 183.81.169.238 port 40016 [preauth]
  2024-10-02T21:31:09.429171-04:00 prod-1 sshd[3510362]: Connection closed by authenticating user root 183.81.169.238 port 40038 [preauth]
  2024-10-02T21:31:11.966788-04:00 prod-1 sshd[3510365]: Connection closed by authenticating user root 183.81.169.238 port 40076 [preauth]
  2024-10-02T21:31:14.097270-04:00 prod-1 sshd[3510368]: Connection closed by authenticating user root 183.81.169.238 port 40094 [preauth]
  2024-10-02T21:31:16.603759-04:00 prod-1 sshd[3510372]: Connection closed by authenticating user root 183.81.169.238 port 34148 [preauth]
  ...

• 2024-10-03T01:29:10.631213+00:00 Linux02 sshd[645523]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T01:29:13.534866+00:00 Linux02 sshd[645523]: Failed password for root from 183.81.169.238 port 52128 ssh2
  2024-10-03T01:29:16.971326+00:00 Linux02 sshd[645760]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T01:29:19.031827+00:00 Linux02 sshd[645760]: Failed password for root from 183.81.169.238 port 52698 ssh2
  2024-10-03T01:29:23.104039+00:00 Linux02 sshd[646076]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T01:29:24.793896+00:00 Linux02 sshd[646076]: Failed password for root from 183.81.169.238 port 52742 ssh2
  2024-10-03T01:29:27.085099+00:00 Linux02 sshd[646261]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=18
  ...

• Oct 3 03:27:41 arm-fr sshd[2969639]: Invalid user Antminer from 183.81.169.238 port 60236
  Oct 3 03:27:43 arm-fr sshd[2969641]: Invalid user Antminer from 183.81.169.238 port 60248
  Oct 3 03:27:53 arm-fr sshd[2969695]: Invalid user admin from 183.81.169.238 port 45038
  ...

• Oct 2 21:27:24 fremontnet-scca-01 sshd[16560]: Failed password for root from 183.81.169.238 port 34768 ssh2
  Oct 2 21:27:30 fremontnet-scca-01 sshd[16562]: Failed password for root from 183.81.169.238 port 42156 ssh2

• 2024-10-03T03:26:41.987602+02:00 pve sshd[360640]: Failed password for root from 183.81.169.238 port 52720 ssh2
  2024-10-03T03:26:44.381270+02:00 pve sshd[361119]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T03:26:46.907644+02:00 pve sshd[361119]: Failed password for root from 183.81.169.238 port 52770 ssh2
  2024-10-03T03:26:51.058469+02:00 pve sshd[361870]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T03:26:53.214894+02:00 pve sshd[361870]: Failed password for root from 183.81.169.238 port 60292 ssh2
  ...

• Oct 3 01:26:38 24fire sshd[195013]: Failed password for root from 183.81.169.238 port 54484 ssh2
  Oct 3 01:26:41 24fire sshd[195015]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 01:26:43 24fire sshd[195015]: Failed password for root from 183.81.169.238 port 54486 ssh2
  Oct 3 01:26:47 24fire sshd[195017]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 01:26:48 24fire sshd[195017]: Failed password for root from 183.81.169.238 port 38354 ssh2
  ...

• Oct 3 01:26:46 fedi sshd[3678030]: Invalid user Antminer from 183.81.169.238 port 38778
  Oct 3 01:26:47 fedi sshd[3678032]: Invalid user Antminer from 183.81.169.238 port 38784
  ...

• Oct 3 03:24:56 DEVELOPERSERVER sshd[581834]: Failed password for root from 183.81.169.238 port 48144 ssh2
  Oct 3 03:24:59 DEVELOPERSERVER sshd[581841]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:25:00 DEVELOPERSERVER sshd[581841]: Failed password for root from 183.81.169.238 port 48166 ssh2
  Oct 3 03:25:03 DEVELOPERSERVER sshd[581846]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:25:05 DEVELOPERSERVER sshd[581846]: Failed password for root from 183.81.169.238 port 49792 ssh2
  Oct 3 03:25:08 DEVELOPERSERVER sshd[581851]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:25:10 DEVELOPERSERVER sshd[581851]: Failed password for root from 183.81.169.238 port 49802 ssh2
  ...

• Oct 3 01:24:57 mail sshd[208058]: Failed password for root from 183.81.169.238 port 51194 ssh2
  Oct 3 01:25:00 mail sshd[208060]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 01:25:02 mail sshd[208060]: Failed password for root from 183.81.169.238 port 51246 ssh2
  ...

• Oct 2 18:23:57 server01 sshd[7320]: Failed password for root from 183.81.169.238 port 54532 ssh2
  Oct 2 18:24:03 server01 sshd[7322]: Failed password for root from 183.81.169.238 port 54918 ssh2
  ...

• 2024-10-03T03:23:16.782446online4.bobelweb.eu sshd[14062]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-03T03:23:18.768048online4.bobelweb.eu sshd[14064]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-03T03:23:20.326473online4.bobelweb.eu sshd[14066]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-03T03:23:21.992242online4.bobelweb.eu sshd[14068]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-03T03:23:23.628724online4.bobelweb.eu sshd[14070]: User root from 183.81.169.238 not allowed because not listed in AllowUsers

• Oct 3 01:22:25 web-proxy02 sshd[1594401]: Failed password for root from 183.81.169.238 port 42272 ssh2
  Oct 3 01:22:28 web-proxy02 sshd[1594413]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 01:22:29 web-proxy02 sshd[1594413]: Failed password for root from 183.81.169.238 port 40966 ssh2
  ...

• Oct 3 01:22:26 ns520895 sshd[7822]: Failed password for root from 183.81.169.238 port 44374 ssh2
  ...

• Oct 3 01:20:22 mysql sshd[222567]: Failed password for root from 183.81.169.238 port 49790 ssh2
  Oct 3 01:20:25 mysql sshd[222569]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 01:20:27 mysql sshd[222569]: Failed password for root from 183.81.169.238 port 49822 ssh2
  Oct 3 01:20:31 mysql sshd[222571]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 01:20:33 mysql sshd[222571]: Failed password for root from 183.81.169.238 port 38416 ssh2
  ...

• Unsolicited connection attempt(s), port:22.

• (sshd) Failed SSH login from 183.81.169.238 (MN/Mongolia/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Oct 2 21:19:02 server5 sshd[32674]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 21:19:04 server5 sshd[32674]: Failed password for root from 183.81.169.238 port 34858 ssh2
  Oct 2 21:19:07 server5 sshd[32685]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 21:19:09 server5 sshd[32685]: Failed password for root from 183.81.169.238 port 35410 ssh2
  Oct 2 21:19:13 server5 sshd[32699]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root

• Oct 3 03:16:54 v4940 sshd[3990876]: Failed password for root from 183.81.169.238 port 55504 ssh2
  Oct 3 03:16:57 v4940 sshd[3990878]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:16:59 v4940 sshd[3990878]: Failed password for root from 183.81.169.238 port 35452 ssh2
  ...

• Oct 3 03:16:49 s1-4-gra7 sshd[2055006]: Invalid user Antminer from 183.81.169.238 port 49310
  Oct 3 03:16:52 s1-4-gra7 sshd[2055008]: Invalid user Antminer from 183.81.169.238 port 49326

• Oct 3 08:15:43 honeypot sshd[10547]: Failed password for root from 183.81.169.238 port 34310 ssh2
  ...

• Oct 3 03:15:12 apo sshd[28474]: Failed password for root from 183.81.169.238 port 52206 ssh2
  Oct 3 03:15:14 apo sshd[28698]: Failed password for root from 183.81.169.238 port 52218 ssh2
  Oct 3 03:15:17 apo sshd[28701]: Failed password for root from 183.81.169.238 port 57766 ssh2
  Oct 3 03:15:19 apo sshd[28703]: Failed password for root from 183.81.169.238 port 57768 ssh2
  ...

• Oct 2 21:14:29 graph sshd[1999637]: Failed password for root from 183.81.169.238 port 51750 ssh2
  Oct 2 21:14:33 graph sshd[1999639]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 21:14:36 graph sshd[1999639]: Failed password for root from 183.81.169.238 port 51790 ssh2
  Oct 2 21:14:39 graph sshd[1999651]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 21:14:41 graph sshd[1999651]: Failed password for root from 183.81.169.238 port 43556 ssh2
  ...

• Oct 3 04:14:21 server2 sshd\[11042\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 04:14:23 server2 sshd\[11046\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 04:14:24 server2 sshd\[11048\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 04:14:25 server2 sshd\[11051\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 04:14:26 server2 sshd\[11053\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 04:14:29 server2 sshd\[11055\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers

• [01:12] Attempted SSH login on port 22 with credentials root:0

• 2024-10-03T03:11:53.866603+02:00 servidor1 sshd[219125]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-03T03:11:54.264379+02:00 servidor1 sshd[219125]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T03:11:55.944339+02:00 servidor1 sshd[219125]: Failed password for invalid user root from 183.81.169.238 port 43954 ssh2
  2024-10-03T03:11:57.961203+02:00 servidor1 sshd[219133]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-03T03:11:58.244150+02:00 servidor1 sshd[219133]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T03:11:59.808390+02:00 servidor1 sshd[219133]: Failed password for invalid user root from 183.81.169.238 port 42516 ssh2
  2024-10-03T03:12:02.462789+02:00 servidor1 sshd[219193]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  ...

• 2024-10-03T03:11:02.939561+02:00 cloud..de sshd[2426410]: Invalid user Antminer from 183.81.169.238 port 57156
  2024-10-03T03:11:04.752591+02:00 cloud..de sshd[2426412]: Invalid user Antminer from 183.81.169.238 port 57172
  2024-10-03T03:11:15.002490+02:00 cloud..de sshd[2426443]: Invalid user admin from 183.81.169.238 port 34936

• FW-PortScan: Traffic Blocked srcport=33246 dstport=22

• [rede-164-29] (sshd) Failed SSH login from 183.81.169.238 (NL/The Netherlands/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Oct 2 22:10:08 sshd[11536]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=[USERNAME]
  Oct 2 22:10:10 sshd[11536]: Failed password for [USERNAME] from 183.81.169.238 port 44046 ssh2
  Oct 2 22:10:13 sshd[11542]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=[USERNAME]
  Oct 2 22:10:15 sshd[11542]: Failed password for [USERNAME] from 183.81.169.238 port 42050 ssh2
  Oct 2 22:

• 2024-10-03T03:09:42.022374+02:00 Linux12 sshd[649102]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T03:09:43.912518+02:00 Linux12 sshd[649102]: Failed password for root from 183.81.169.238 port 59578 ssh2
  2024-10-03T03:09:48.079254+02:00 Linux12 sshd[649408]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T03:09:49.794449+02:00 Linux12 sshd[649408]: Failed password for root from 183.81.169.238 port 55992 ssh2
  2024-10-03T03:09:53.328987+02:00 Linux12 sshd[649604]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T03:09:56.063453+02:00 Linux12 sshd[649604]: Failed password for root from 183.81.169.238 port 55998 ssh2
  2024-10-03T03:09:59.956115+02:00 Linux12 sshd[650225]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=18
  ...

• Failed password for root from 183.81.169.238 port 46564 ssh2
  pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Failed password for root from 183.81.169.238 port 46592 ssh2
  pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Failed password for root from 183.81.169.238 port 50364 ssh2

• 2024-10-03T03:08:49.747933+02:00 docker sshd[1821287]: Failed password for root from 183.81.169.238 port 49666 ssh2
  2024-10-03T03:08:52.077297+02:00 docker sshd[1821294]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T03:08:54.770639+02:00 docker sshd[1821294]: Failed password for root from 183.81.169.238 port 49696 ssh2
  2024-10-03T03:08:56.443564+02:00 docker sshd[1821329]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T03:08:58.686904+02:00 docker sshd[1821329]: Failed password for root from 183.81.169.238 port 52746 ssh2
  ...

• 2024-10-03T01:08:56.181562us1.starnode.us sshd[1497594]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T01:08:58.423432us1.starnode.us sshd[1497594]: Failed password for root from 183.81.169.238 port 40400 ssh2
  ...

• Oct 2 20:08:37 ivankin sshd[435606]: Failed password for root from 183.81.169.238 port 45270 ssh2
  Oct 2 20:08:41 ivankin sshd[435608]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 20:08:43 ivankin sshd[435608]: Failed password for root from 183.81.169.238 port 57248 ssh2
  ...

• Oct 2 18:57:51 web2 sshd\[960\]: Failed password for root from 183.81.169.238 port 34624 ssh2Oct 2 18:57:55 web2 sshd\[962\]: Failed password for root from 183.81.169.238 port 40292 ssh2Oct 2 18:58:00 web2 sshd\[964\]: Failed password for root from 183.81.169.238 port 40320 ssh2Oct 2 18:58:06 web2 sshd\[966\]: Failed password for root from 183.81.169.238 port 55326 ssh2Oct 2 18:58:11 web2 sshd\[968\]: Failed password for root from 183.81.169.238 port 55362 ssh2Oct 2 18:58:17 web2 sshd\[970\]: Failed password for root from 183.81.169.238 port 54264 ssh2
  ...

• Oct 3 03:07:56 vmi440488 sshd[3524182]: Failed password for root from 183.81.169.238 port 51562 ssh2
  Oct 3 03:07:59 vmi440488 sshd[3524192]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:08:02 vmi440488 sshd[3524192]: Failed password for root from 183.81.169.238 port 41238 ssh2
  Oct 3 03:08:05 vmi440488 sshd[3524203]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:08:08 vmi440488 sshd[3524203]: Failed password for root from 183.81.169.238 port 41258 ssh2
  ...

• Detected 4 distributed attacks from 183.81.169.238. LF_DISTATTACK; Logs: 2024-10-03T03:07:44.986329+02:00 insightVM sshd[3400319]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root 2024-10-03T03:07:40.542210+02:00 insightVM sshd[3400301]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root 2024-10-03T03:07:42.684149+02:00 insightVM sshd[3400301]: Failed password for root from 183.81.169.238 port 43642 ssh2 183.81.169.238 (NL/The Netherlands/North Holland/Amsterdam/-/[AS206264 Amarutu Technology Ltd])

• [mail-backup-1] SSH login failed

• Oct 3 03:05:04 mazenvps-iliq sshd[1990047]: Failed password for root from 183.81.169.238 port 33716 ssh2
  Oct 3 03:05:06 mazenvps-iliq sshd[1990049]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:05:08 mazenvps-iliq sshd[1990049]: Failed password for root from 183.81.169.238 port 33754 ssh2
  Oct 3 03:05:11 mazenvps-iliq sshd[1990054]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:05:13 mazenvps-iliq sshd[1990054]: Failed password for root from 183.81.169.238 port 44588 ssh2
  Oct 3 03:05:16 mazenvps-iliq sshd[1990059]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:05:17 mazenvps-iliq sshd[1990059]: Failed password for root from 183.81.169.238 port 44620 ssh2
  ...

• Oct 3 03:07:01 AbuseCatcher sshd[4182952]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:07:03 AbuseCatcher sshd[4182952]: Failed password for root from 183.81.169.238 port 48860 ssh2
  ...

• Oct 3 03:04:04 SFEEDS sshd[485107]: Failed password for root from 183.81.169.238 port 54976 ssh2
  Oct 3 03:04:07 SFEEDS sshd[485110]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:04:09 SFEEDS sshd[485110]: Failed password for root from 183.81.169.238 port 39654 ssh2
  Oct 3 03:04:13 SFEEDS sshd[485113]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:04:14 SFEEDS sshd[485113]: Failed password for root from 183.81.169.238 port 39658 ssh2
  ...

• tcp/22 (21 or more attempts)

• Oct 3 01:02:59 vm-networkmanager sshd[3679998]: Failed password for root from 183.81.169.238 port 42118 ssh2
  Oct 3 01:03:01 vm-networkmanager sshd[3680003]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 01:03:03 vm-networkmanager sshd[3680003]: Failed password for root from 183.81.169.238 port 42138 ssh2
  Oct 3 01:03:06 vm-networkmanager sshd[3680033]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 01:03:08 vm-networkmanager sshd[3680033]: Failed password for root from 183.81.169.238 port 37848 ssh2
  ...

• Cowrie Honeypot: Unauthorised SSH/Telnet login attempt with user "root" at 2024-10-03T01:02:44Z

• Oct 3 03:02:13 CT6942 sshd[263017]: Failed password for root from 183.81.169.238 port 53424 ssh2
  Oct 3 03:02:16 CT6942 sshd[263020]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:02:18 CT6942 sshd[263020]: Failed password for root from 183.81.169.238 port 60642 ssh2
  ...

• Oct 3 03:01:27 m2369 sshd[776872]: Failed password for root from 183.81.169.238 port 59240 ssh2
  Oct 3 03:01:31 m2369 sshd[776875]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:01:33 m2369 sshd[776875]: Failed password for root from 183.81.169.238 port 59242 ssh2
  Oct 3 03:01:37 m2369 sshd[776910]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:01:38 m2369 sshd[776910]: Failed password for root from 183.81.169.238 port 48382 ssh2
  ...

• Invalid user Antminer from 183.81.169.238 port 38498

• Failed password for root from 183.81.169.238 port 53724 ssh2

• Oct 3 00:58:07 vps-9 sshd[968179]: Failed password for root from 183.81.169.238 port 42546 ssh2
  Oct 3 00:58:11 vps-9 sshd[968182]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 00:58:12 vps-9 sshd[968182]: Failed password for root from 183.81.169.238 port 40556 ssh2
  ...

• Oct 3 01:58:02 sheikh-ahmed-abu-islam-v2 sshd[3021351]: Invalid user Antminer from 183.81.169.238 port 41958
  Oct 3 01:58:04 sheikh-ahmed-abu-islam-v2 sshd[3021390]: Invalid user Antminer from 183.81.169.238 port 41978
  ...

• $f2bV_matches

• 2024-10-03T03:57:10.915207+03:00 gate kernel: [405960.180517] nftables: JAIL-SSH IN=wan OUT= MAC= SRC=183.81.169.238 DST=xxx.xxx.xxx.xxx LEN=40 TOS=0x00 PREC=0x00 TTL=245 ID=54321 PROTO=TCP SPT=51850 DPT=22 WINDOW=65535 RES=0x00 SYN URGP=0
  ...

• 2024-10-03T02:56:51.512556+02:00 nc1.motyka.pro sshd[2361980]: Failed password for root from 183.81.169.238 port 54962 ssh2
  2024-10-03T02:56:53.684567+02:00 nc1.motyka.pro sshd[2362123]: Failed password for root from 183.81.169.238 port 55002 ssh2
  2024-10-03T02:56:56.243715+02:00 nc1.motyka.pro sshd[2362147]: Failed password for root from 183.81.169.238 port 43598 ssh2
  2024-10-03T02:56:58.948984+02:00 nc1.motyka.pro sshd[2362254]: Failed password for root from 183.81.169.238 port 43624 ssh2
  2024-10-03T02:57:01.433800+02:00 nc1.motyka.pro sshd[2362315]: Failed password for root from 183.81.169.238 port 43644 ssh2
  ...

• 2024-10-03T01:51:46.690390+01:00 pbs-bit-lib-01.int.pdx.net.uk sshd[1987568]: Invalid user Antminer from 183.81.169.238 port 58718
  2024-10-03T01:51:49.383652+01:00 pbs-bit-lib-01.int.pdx.net.uk sshd[1987570]: Invalid user Antminer from 183.81.169.238 port 58738
  2024-10-03T01:52:05.141904+01:00 pbs-bit-lib-01.int.pdx.net.uk sshd[1987583]: Invalid user admin from 183.81.169.238 port 60840
  ...

• Attempt from 183.81.169.238

• Oct 3 02:55:02 fshubvidspace sshd[2996525]: Failed password for root from 183.81.169.238 port 46934 ssh2
  Oct 3 02:55:05 fshubvidspace sshd[2996530]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 02:55:07 fshubvidspace sshd[2996530]: Failed password for root from 183.81.169.238 port 47000 ssh2
  Oct 3 02:55:10 fshubvidspace sshd[2996532]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 02:55:12 fshubvidspace sshd[2996532]: Failed password for root from 183.81.169.238 port 51852 ssh2
  ...

• list.rtbh.com.tr report: tcp/22

• Oct 2 20:54:18 us-mfl-03 sshd[3380412]: Invalid user Antminer from 183.81.169.238 port 53994
  ...

• Security system: Unauthorised SSH/Telnet login attempt with user "root" at 2024-10-03T00:54:17Z

• Oct 3 02:54:05 root1896 sshd[2106765]: Failed password for root from 183.81.169.238 port 33422 ssh2
  Oct 3 02:54:07 root1896 sshd[2106772]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 02:54:09 root1896 sshd[2106772]: Failed password for root from 183.81.169.238 port 36266 ssh2
  Oct 3 02:54:12 root1896 sshd[2106828]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 02:54:14 root1896 sshd[2106828]: Failed password for root from 183.81.169.238 port 36300 ssh2
  ...

• Oct 3 00:54:05 scw-6657dc sshd[10746]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 00:54:05 scw-6657dc sshd[10746]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 00:54:06 scw-6657dc sshd[10746]: Failed password for root from 183.81.169.238 port 43358 ssh2
  ...

• 2024-10-03T00:53:02.024561+00:00 frhb72991flex sshd[2167698]: Invalid user Antminer from 183.81.169.238 port 41626
  2024-10-03T00:53:04.120129+00:00 frhb72991flex sshd[2167700]: Invalid user Antminer from 183.81.169.238 port 41634
  ...

• 2024-10-03T02:52:44.445621+02:00 mail sshd[496760]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-03T02:52:47.042684+02:00 mail sshd[496763]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-03T02:52:49.065244+02:00 mail sshd[496766]: User root from 183.81.169.238 not allowed because not listed in AllowUsers

• 2024-10-03T02:52:46.742945+02:00 mail sshd[1721898]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  ...

• Oct 3 02:52:05 C1D543E sshd[770343]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 02:52:05 C1D543E sshd[770343]: Failed password for invalid user root from 183.81.169.238 port 58262 ssh2
  Oct 3 02:52:07 C1D543E sshd[770345]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 02:52:07 C1D543E sshd[770345]: Failed password for invalid user root from 183.81.169.238 port 41140 ssh2
  Oct 3 02:52:09 C1D543E sshd[770347]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  ...

• Oct 3 02:51:56 athena sshd[849771]: Failed password for root from 183.81.169.238 port 47686 ssh2
  Oct 3 02:51:59 athena sshd[849773]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 02:52:00 athena sshd[849773]: Failed password for root from 183.81.169.238 port 42658 ssh2
  Oct 3 02:52:03 athena sshd[849778]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 02:52:05 athena sshd[849778]: Failed password for root from 183.81.169.238 port 42666 ssh2
  ...

• 2024-10-03T00:50:54.288796+00:00 mail sshd[929754]: Invalid user Antminer from 183.81.169.238 port 49790
  2024-10-03T00:50:55.816026+00:00 mail sshd[929756]: Invalid user Antminer from 183.81.169.238 port 48436
  2024-10-03T00:51:06.823845+00:00 mail sshd[929768]: Invalid user admin from 183.81.169.238 port 59860
  ...

• FW-PortScan: Traffic Blocked srcport=42078 dstport=22

• Oct 3 00:50:19 alpha sshd[2481515]: Failed password for root from 183.81.169.238 port 38762 ssh2
  Oct 3 00:50:23 alpha sshd[2481551]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 00:50:25 alpha sshd[2481551]: Failed password for root from 183.81.169.238 port 38786 ssh2
  Oct 3 00:50:28 alpha sshd[2481621]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 00:50:30 alpha sshd[2481621]: Failed password for root from 183.81.169.238 port 46380 ssh2
  ...

• Oct 3 03:51:27 betelgeuse sshd[1933896]: Invalid user Antminer from 183.81.169.238 port 39326
  Oct 3 03:51:29 betelgeuse sshd[1934635]: Invalid user Antminer from 183.81.169.238 port 39342
  ...

• Oct 3 02:48:17 javastart sshd[4000872]: Failed password for root from 183.81.169.238 port 37618 ssh2
  Oct 3 02:48:21 javastart sshd[4000876]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 02:48:23 javastart sshd[4000876]: Failed password for root from 183.81.169.238 port 33996 ssh2
  Oct 3 02:48:26 javastart sshd[4000893]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 02:48:28 javastart sshd[4000893]: Failed password for root from 183.81.169.238 port 37210 ssh2
  ...

• Oct 2 17:48:10 nunnother sshd\[1995\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 17:48:13 nunnother sshd\[1995\]: Failed password for root from 183.81.169.238 port 55166 ssh2
  Oct 2 17:48:16 nunnother sshd\[2007\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 17:48:18 nunnother sshd\[2007\]: Failed password for root from 183.81.169.238 port 46378 ssh2
  Oct 2 17:48:21 nunnother sshd\[2011\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  ...

• SSH-BruteForce

• 2024-10-03T02:47:38.108749+02:00 berohost-6c24g sshd[122766]: Failed password for root from 183.81.169.238 port 49064 ssh2
  2024-10-03T02:47:40.745224+02:00 berohost-6c24g sshd[122864]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T02:47:43.483994+02:00 berohost-6c24g sshd[122864]: Failed password for root from 183.81.169.238 port 49086 ssh2
  2024-10-03T02:47:47.236180+02:00 berohost-6c24g sshd[123004]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T02:47:49.265739+02:00 berohost-6c24g sshd[123004]: Failed password for root from 183.81.169.238 port 60992 ssh2
  ...

• 2024-10-03T02:47:34.555345+02:00 vmi985635.contaboserver.net sshd[2420283]: Failed password for root from 183.81.169.238 port 50608 ssh2
  2024-10-03T02:47:37.940956+02:00 vmi985635.contaboserver.net sshd[2420311]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T02:47:39.949076+02:00 vmi985635.contaboserver.net sshd[2420311]: Failed password for root from 183.81.169.238 port 50486 ssh2
  2024-10-03T02:47:43.134240+02:00 vmi985635.contaboserver.net sshd[2420360]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T02:47:45.370074+02:00 vmi985635.contaboserver.net sshd[2420360]: Failed password for root from 183.81.169.238 port 50520 ssh2
  ...

• Oct 3 00:47:41 Sildom2 sshd[1561086]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 00:47:43 Sildom2 sshd[1561086]: Failed password for root from 183.81.169.238 port 49388 ssh2
  ...

• Oct 3 04:17:22 Digitalogic sshd[1324875]: Connection closed by authenticating user root 183.81.169.238 port 45064 [preauth]
  Oct 3 04:17:24 Digitalogic sshd[1324904]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 04:17:26 Digitalogic sshd[1324904]: Failed password for root from 183.81.169.238 port 45076 ssh2
  ...

• 2024-10-02T17:47:05.685575-07:00 panduhstudios sshd[2823996]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T17:47:07.615989-07:00 panduhstudios sshd[2823996]: Failed password for root from 183.81.169.238 port 46752 ssh2
  2024-10-02T17:47:12.469651-07:00 panduhstudios sshd[2823998]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T17:47:14.696124-07:00 panduhstudios sshd[2823998]: Failed password for root from 183.81.169.238 port 57144 ssh2
  ...

• 2024-10-03T02:45:31.721412+02:00 mail sshd[632282]: Failed password for root from 183.81.169.238 port 33190 ssh2
  2024-10-03T02:45:36.860116+02:00 mail sshd[632289]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T02:45:38.239505+02:00 mail sshd[632289]: Failed password for root from 183.81.169.238 port 39340 ssh2
  2024-10-03T02:45:42.329347+02:00 mail sshd[632291]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T02:45:44.056522+02:00 mail sshd[632291]: Failed password for root from 183.81.169.238 port 39360 ssh2
  ...

• 2024-10-03T02:45:40.574625 frenzy sshd[14524]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T02:45:42.505804 frenzy sshd[14524]: Failed password for root from 183.81.169.238 port 51202 ssh2
  2024-10-03T02:45:45.578332 frenzy sshd[14527]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T02:45:47.529885 frenzy sshd[14527]: Failed password for root from 183.81.169.238 port 51230 ssh2
  ...

• 2024-10-03T00:45:13.218873+00:00 fluff sshd[79640]: Failed password for root from 183.81.169.238 port 48850 ssh2
  2024-10-03T00:45:16.941848+00:00 fluff sshd[79642]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T00:45:18.913593+00:00 fluff sshd[79642]: Failed password for root from 183.81.169.238 port 60190 ssh2
  2024-10-03T00:45:22.188404+00:00 fluff sshd[79645]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T00:45:23.647919+00:00 fluff sshd[79645]: Failed password for root from 183.81.169.238 port 60206 ssh2
  ...

• Oct 3 02:44:11 fogg sshd[3677424]: Failed password for root from 183.81.169.238 port 40154 ssh2
  Oct 3 02:44:16 fogg sshd[3677481]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 02:44:17 fogg sshd[3677481]: Failed password for root from 183.81.169.238 port 48360 ssh2
  ...

• 2024-10-03T02:44:49.960901+02:00 runner3 sshd[3945801]: Failed password for root from 183.81.169.238 port 48164 ssh2
  2024-10-03T02:44:52.780388+02:00 runner3 sshd[3945803]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T02:44:54.786950+02:00 runner3 sshd[3945803]: Failed password for root from 183.81.169.238 port 48176 ssh2
  2024-10-03T02:44:58.224819+02:00 runner3 sshd[3946461]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T02:45:00.055867+02:00 runner3 sshd[3946461]: Failed password for root from 183.81.169.238 port 33590 ssh2
  ...

• 183.81.169.238 triggered Icarus honeypot on port 22. Check us out on github.

• Oct 3 00:43:25 shirus29 sshd[2472826]: Failed password for root from 183.81.169.238 port 56774 ssh2
  Oct 3 00:43:28 shirus29 sshd[2472828]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 00:43:29 shirus29 sshd[2472828]: Failed password for root from 183.81.169.238 port 60412 ssh2
  Oct 3 00:43:32 shirus29 sshd[2472830]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 00:43:35 shirus29 sshd[2472830]: Failed password for root from 183.81.169.238 port 60426 ssh2
  ...

• [00:43] Attempted SSH login on port 22 with credentials root:0

• Funeypot detected 4323 ssh attempts in 562h57m47s. Last by user "root", password "*", client "Go".

• Oct 3 03:41:52 server2 sshd\[8460\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 03:41:53 server2 sshd\[8462\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 03:41:55 server2 sshd\[8464\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 03:41:57 server2 sshd\[8466\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 03:41:59 server2 sshd\[8468\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 03:42:00 server2 sshd\[8470\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers

• 2024-10-02T20:41:41.971046-04:00 srv-UXQS4A.incognet.io sshd[1509]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T20:41:44.092548-04:00 srv-UXQS4A.incognet.io sshd[1509]: Failed password for invalid user root from 183.81.169.238 port 47000 ssh2
  ...

• Automatic report: Failed SSH login [3]

• PortscanM

• Oct 3 02:40:57 git sshd[551707]: Invalid user Antminer from 183.81.169.238 port 57162
  Oct 3 02:40:59 git sshd[551709]: Invalid user Antminer from 183.81.169.238 port 57176
  Oct 3 02:41:10 git sshd[551721]: Invalid user admin from 183.81.169.238 port 55728
  ...

• Oct 3 00:40:07 s158416 sshd[2541465]: Failed password for root from 183.81.169.238 port 48212 ssh2
  Oct 3 00:40:11 s158416 sshd[2541740]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 00:40:13 s158416 sshd[2541740]: Failed password for root from 183.81.169.238 port 60102 ssh2
  Oct 3 00:40:17 s158416 sshd[2541768]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 00:40:19 s158416 sshd[2541768]: Failed password for root from 183.81.169.238 port 60876 ssh2
  ...

• 2024-10-03T00:40:02.764097+00:00 localhost sshd[2414187]: Connection closed by authenticating user root 183.81.169.238 port 47154 [preauth]
  2024-10-03T00:40:05.179312+00:00 localhost sshd[2414193]: Connection closed by authenticating user root 183.81.169.238 port 47164 [preauth]
  2024-10-03T00:40:06.965351+00:00 localhost sshd[2414212]: Connection closed by authenticating user root 183.81.169.238 port 58552 [preauth]
  2024-10-03T00:40:09.446954+00:00 localhost sshd[2414214]: Connection closed by authenticating user root 183.81.169.238 port 58578 [preauth]
  2024-10-03T00:40:11.902603+00:00 localhost sshd[2414216]: Connection closed by authenticating user root 183.81.169.238 port 58600 [preauth]
  ...

• Oct 3 00:38:47 nlfr1 sshd[1409267]: Invalid user Antminer from 183.81.169.238 port 35662
  Oct 3 00:38:49 nlfr1 sshd[1409269]: Invalid user Antminer from 183.81.169.238 port 35664
  Oct 3 00:38:59 nlfr1 sshd[1412252]: Invalid user admin from 183.81.169.238 port 54650
  ...

• IPS:drop dstport=22

• Oct 3 00:38:15 edge-ora-lhr01 sshd[1528257]: Invalid user Antminer from 183.81.169.238 port 58126
  Oct 3 00:38:17 edge-ora-lhr01 sshd[1528260]: Invalid user Antminer from 183.81.169.238 port 58136
  Oct 3 00:38:29 edge-ora-lhr01 sshd[1528286]: Invalid user admin from 183.81.169.238 port 40144
  ...

• 2024-10-03T00:37:41.664858+00:00 Linux100 sshd[3814556]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T00:37:43.837170+00:00 Linux100 sshd[3814556]: Failed password for root from 183.81.169.238 port 49042 ssh2
  2024-10-03T00:37:47.238987+00:00 Linux100 sshd[3816231]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T00:37:48.567831+00:00 Linux100 sshd[3816231]: Failed password for root from 183.81.169.238 port 38998 ssh2
  2024-10-03T00:37:51.532786+00:00 Linux100 sshd[3817119]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T00:37:54.409368+00:00 Linux100 sshd[3817119]: Failed password for root from 183.81.169.238 port 39040 ssh2
  2024-10-03T00:37:56.895226+00:00 Linux100 sshd[3817955]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh r
  ...

• Oct 2 20:36:59 thebatforge sshd[467958]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 20:37:01 thebatforge sshd[467971]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 20:37:04 thebatforge sshd[467983]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 20:37:06 thebatforge sshd[467986]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 20:37:08 thebatforge sshd[467989]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  ...

• 2024-10-03T02:36:33.018541+02:00 sasrv sshd[4210]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-03T02:36:34.551812+02:00 sasrv sshd[4213]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-03T02:36:36.309108+02:00 sasrv sshd[4215]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-03T02:36:38.413088+02:00 sasrv sshd[4217]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-03T02:36:40.706940+02:00 sasrv sshd[4219]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  ...

• Oct 3 02:36:17 kvm11438 sshd[21645]: Failed password for root from 183.81.169.238 port 42388 ssh2
  Oct 3 02:36:22 kvm11438 sshd[21873]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 02:36:24 kvm11438 sshd[21873]: Failed password for root from 183.81.169.238 port 42400 ssh2
  Oct 3 02:36:26 kvm11438 sshd[21987]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 02:36:28 kvm11438 sshd[21987]: Failed password for root from 183.81.169.238 port 40028 ssh2
  ...

• Unauthorized connection attempt detected from IP address 183.81.169.238 to port 22 (ger-03) [U]

• I1003 02:34:47.607100 1 client.go:99] CLOSE host=183.81.169.238 port=57536 time=85.219891722 bytes=257
  ...

• Oct 3 02:34:13 LosAngelesGW sshd[337720]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 02:34:15 LosAngelesGW sshd[337720]: Failed password for root from 183.81.169.238 port 37924 ssh2
  Oct 3 02:34:19 LosAngelesGW sshd[337737]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 02:34:21 LosAngelesGW sshd[337737]: Failed password for root from 183.81.169.238 port 37950 ssh2
  ...

• Oct 3 03:33:57 community sshd[1493924]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:33:59 community sshd[1493924]: Failed password for root from 183.81.169.238 port 39970 ssh2
  ...

• [rede-164-62] (sshd) Failed SSH login from 183.81.169.238 (NL/The Netherlands/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Oct 2 21:32:47 sshd[31527]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=[USERNAME]

• Oct 3 00:32:52 VPS sshd[1726588]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 00:32:53 VPS sshd[1726588]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 00:32:52 VPS sshd[1726588]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 00:32:55 VPS sshd[1726588]: Failed password for invalid user root from 183.81.169.238 port 58128 ssh2
  Oct 3 00:32:58 VPS sshd[1726590]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  ...

• FW-PortScan: Traffic Blocked srcport=46718 dstport=22

• Oct 3 02:32:22 zurich-2 sshd[2375100]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 02:32:24 zurich-2 sshd[2375100]: Failed password for root from 183.81.169.238 port 60114 ssh2
  Oct 3 02:32:27 zurich-2 sshd[2375102]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  ...

• Oct 3 02:31:34 qube2 sshd[2773641]: Failed password for root from 183.81.169.238 port 42622 ssh2
  Oct 3 02:31:38 qube2 sshd[2773703]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 02:31:41 qube2 sshd[2773703]: Failed password for root from 183.81.169.238 port 37256 ssh2
  ...

• 2024-10-03T00:30:45.249084+00:00 ubuntu sshd[1501843]: Invalid user Antminer from 183.81.169.238 port 53280
  2024-10-03T00:30:47.094726+00:00 ubuntu sshd[1501845]: Invalid user Antminer from 183.81.169.238 port 42206
  ...

• 2024-10-02 21:39:26 UTC Unauthorized activity to TCP port 22. SSH

• Oct 2 20:29:42 ny01 sshd[2692499]: Failed password for root from 183.81.169.238 port 33672 ssh2
  Oct 2 20:29:47 ny01 sshd[2692502]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 20:29:49 ny01 sshd[2692502]: Failed password for root from 183.81.169.238 port 46910 ssh2
  Oct 2 20:29:53 ny01 sshd[2692512]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 20:29:55 ny01 sshd[2692512]: Failed password for root from 183.81.169.238 port 46924 ssh2

• Cowrie Honeypot: Unauthorised SSH/Telnet login attempt with user "root" at 2024-10-03T00:29:09Z

• Oct 3 00:26:33 xproot sshd[2022607]: Failed password for root from 183.81.169.238 port 47330 ssh2
  Oct 3 00:26:38 xproot sshd[2022609]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 00:26:39 xproot sshd[2022609]: Failed password for root from 183.81.169.238 port 47432 ssh2
  Oct 3 00:26:43 xproot sshd[2022611]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 00:26:45 xproot sshd[2022611]: Failed password for root from 183.81.169.238 port 47462 ssh2
  ...

• Oct 3 00:25:50 localhost sshd[2301964]: Failed password for root from 183.81.169.238 port 55700 ssh2
  Oct 3 00:25:55 localhost sshd[2301967]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 00:25:57 localhost sshd[2301967]: Failed password for root from 183.81.169.238 port 55716 ssh2
  Oct 3 00:26:00 localhost sshd[2301969]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 00:26:02 localhost sshd[2301969]: Failed password for root from 183.81.169.238 port 39578 ssh2
  ...

• Oct 3 02:25:19 hosting09 sshd[581719]: Failed password for root from 183.81.169.238 port 46606 ssh2
  Oct 3 02:25:22 hosting09 sshd[581727]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 02:25:25 hosting09 sshd[581727]: Failed password for root from 183.81.169.238 port 46614 ssh2
  ...

• Events: TCP SYN Discovery or Flooding, Seen 122 times in the last 10800 seconds

• Firewall IPS Detection on 03-10-2024 at 02:23:04

• Oct 3 02:22:42 arm-am sshd[77244]: Invalid user Antminer from 183.81.169.238 port 53144
  Oct 3 02:22:44 arm-am sshd[77246]: Invalid user Antminer from 183.81.169.238 port 53162
  Oct 3 02:22:53 arm-am sshd[77260]: Invalid user admin from 183.81.169.238 port 42924
  ...

• Oct 3 02:21:11 OPSO sshd\[14986\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 02:21:12 OPSO sshd\[14986\]: Failed password for root from 183.81.169.238 port 59702 ssh2
  Oct 3 02:21:15 OPSO sshd\[14994\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 02:21:17 OPSO sshd\[14994\]: Failed password for root from 183.81.169.238 port 59718 ssh2
  Oct 3 02:21:19 OPSO sshd\[14996\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root

• 2024-10-03T02:19:28.466311+02:00 devcricle sshd[30180]: Failed password for root from 183.81.169.238 port 55560 ssh2
  2024-10-03T02:19:32.566645+02:00 devcricle sshd[30183]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T02:19:34.906386+02:00 devcricle sshd[30183]: Failed password for root from 183.81.169.238 port 55570 ssh2
  ...

• Oct 3 00:18:39 destiny sshd[2059684]: Connection closed by invalid user root 183.81.169.238 port 34330 [preauth]
  Oct 3 00:18:41 destiny sshd[2059686]: User root not allowed because account is locked
  Oct 3 00:18:41 destiny sshd[2059686]: Connection closed by invalid user root 183.81.169.238 port 34334 [preauth]
  Oct 3 00:18:43 destiny sshd[2059688]: User root not allowed because account is locked
  Oct 3 00:18:44 destiny sshd[2059688]: Connection closed by invalid user root 183.81.169.238 port 34360 [preauth]
  ...

• Oct 3 02:15:23 PandaCityRP sshd[1507085]: Failed password for root from 183.81.169.238 port 39726 ssh2
  Oct 3 02:15:27 PandaCityRP sshd[1507090]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 02:15:29 PandaCityRP sshd[1507090]: Failed password for root from 183.81.169.238 port 39756 ssh2
  Oct 3 02:15:31 PandaCityRP sshd[1507095]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 02:15:33 PandaCityRP sshd[1507095]: Failed password for root from 183.81.169.238 port 57320 ssh2
  Oct 3 02:15:36 PandaCityRP sshd[1507100]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 02:15:38 PandaCityRP sshd[1507100]: Failed password for root from 183.81.169.238 port 57368 ssh2
  ...

• Oct 3 00:15:17 ice2 sshd[1964318]: Invalid user Antminer from 183.81.169.238 port 41268
  Oct 3 00:15:19 ice2 sshd[1964320]: Invalid user Antminer from 183.81.169.238 port 41270
  ...

• Oct 3 03:14:50 www sshd\[56754\]: Failed password for root from 183.81.169.238 port 43942 ssh2Oct 3 03:14:54 www sshd\[56756\]: Failed password for root from 183.81.169.238 port 43970 ssh2Oct 3 03:14:59 www sshd\[56758\]: Failed password for root from 183.81.169.238 port 35206 ssh2
  ...

• Oct 3 00:14:38 hardcore-tesla sshd[4007370]: Failed password for root from 183.81.169.238 port 41078 ssh2
  Oct 3 00:14:41 hardcore-tesla sshd[4007372]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 00:14:43 hardcore-tesla sshd[4007372]: Failed password for root from 183.81.169.238 port 41092 ssh2
  Oct 3 00:14:47 hardcore-tesla sshd[4007375]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 00:14:49 hardcore-tesla sshd[4007375]: Failed password for root from 183.81.169.238 port 43704 ssh2
  ...

• Oct 3 03:43:35 Digitalogic sshd[1315562]: Connection closed by authenticating user root 183.81.169.238 port 36104 [preauth]
  Oct 3 03:43:37 Digitalogic sshd[1315591]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:43:39 Digitalogic sshd[1315591]: Failed password for root from 183.81.169.238 port 57974 ssh2
  ...

• FW-PortScan: Traffic Blocked srcport=41819 dstport=22

• 2024-10-03T00:11:14.064637+00:00 virt-hur-fmt-01.pdx.net.uk sshd[70288]: Invalid user Antminer from 183.81.169.238 port 60486
  2024-10-03T00:11:16.758962+00:00 virt-hur-fmt-01.pdx.net.uk sshd[70292]: Invalid user Antminer from 183.81.169.238 port 53368
  2024-10-03T00:11:32.194335+00:00 virt-hur-fmt-01.pdx.net.uk sshd[70365]: Invalid user admin from 183.81.169.238 port 33884
  ...

• 2024-10-03T01:11:16.324023+01:00 wightpi sshd[3251977]: Invalid user Antminer from 183.81.169.238 port 60688
  2024-10-03T01:11:18.671466+01:00 wightpi sshd[3251979]: Invalid user Antminer from 183.81.169.238 port 60696
  ...

• endlessh-go tarpit accepted connection

• Oct 3 02:09:32 gateway1-old sshd[18402]: Failed password for root from 183.81.169.238 port 36010 ssh2
  Oct 3 02:09:37 gateway1-old sshd[18594]: Failed password for root from 183.81.169.238 port 44252 ssh2

• 2024-10-02T20:07:33.642108zeus sshd[2978090]: Invalid user Antminer from 183.81.169.238 port 60716
  2024-10-02T20:07:35.849124zeus sshd[2978094]: Invalid user Antminer from 183.81.169.238 port 50526
  2024-10-02T20:07:49.054641zeus sshd[2978109]: Invalid user admin from 183.81.169.238 port 44702
  ...

• Oct 3 02:07:11 pinkypie sshd[65947]: Failed password for root from 183.81.169.238 port 48226 ssh2
  Oct 3 02:07:15 pinkypie sshd[65949]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 02:07:18 pinkypie sshd[65949]: Failed password for root from 183.81.169.238 port 48228 ssh2
  ...

• Oct 3 00:06:36 internal-mail-rafled-com sshd[1110294]: Invalid user Antminer from 183.81.169.238 port 56500
  ...

• Oct 3 00:05:56 ns5024002 sshd[2012570]: Failed password for root from 183.81.169.238 port 38014 ssh2
  Oct 3 00:05:59 ns5024002 sshd[2012723]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 00:06:01 ns5024002 sshd[2012723]: Failed password for root from 183.81.169.238 port 43856 ssh2
  Oct 3 00:06:05 ns5024002 sshd[2012863]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 00:06:07 ns5024002 sshd[2012863]: Failed password for root from 183.81.169.238 port 43884 ssh2
  ...

• SSH login attempts (endlessh): I1003 00:04:55.299629 1 client.go:99] CLOSE host=183.81.169.238 port=44696 time=378.153415193 bytes=260

• Oct 3 03:05:08 vds-100908 sshd[98402]: Failed password for root from 183.81.169.238 port 55870 ssh2
  Oct 3 03:05:11 vds-100908 sshd[98440]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:05:14 vds-100908 sshd[98440]: Failed password for root from 183.81.169.238 port 55930 ssh2
  Oct 3 03:05:17 vds-100908 sshd[98472]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 03:05:19 vds-100908 sshd[98472]: Failed password for root from 183.81.169.238 port 43156 ssh2
  ...

• Oct 3 03:05:02 server2 sshd\[11387\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 03:05:04 server2 sshd\[11485\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 03:05:05 server2 sshd\[11567\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 03:05:07 server2 sshd\[11569\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 03:05:09 server2 sshd\[11571\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 03:05:10 server2 sshd\[11575\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers

• 2024-10-02T19:04:31.527643-05:00 BAW-C02 sshd[3838654]: Failed password for root from 183.81.169.238 port 37852 ssh2
  2024-10-02T19:04:35.728168-05:00 BAW-C02 sshd[3838656]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T19:04:37.591035-05:00 BAW-C02 sshd[3838656]: Failed password for root from 183.81.169.238 port 37860 ssh2
  2024-10-02T19:04:41.598328-05:00 BAW-C02 sshd[3838659]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T19:04:42.953693-05:00 BAW-C02 sshd[3838659]: Failed password for root from 183.81.169.238 port 47168 ssh2
  ...

• was attempting to break in as 'root' from port 50706

• Oct 3 00:04:10 dn42 sshd[699035]: Invalid user Antminer from 183.81.169.238 port 48650
  Oct 3 00:04:11 dn42 sshd[699037]: Invalid user Antminer from 183.81.169.238 port 48666
  Oct 3 00:04:22 dn42 sshd[699049]: Invalid user admin from 183.81.169.238 port 56498
  ...

• tcp/22 (23 or more attempts)

• unauthorized connection with user "root" and password "0" at 2024-10-03T00:03:10Z

• Oct 3 02:02:57 AbuseCatcher sshd[4173468]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 02:02:59 AbuseCatcher sshd[4173468]: Failed password for root from 183.81.169.238 port 46374 ssh2
  ...

• 2024-10-03T00:01:35.249202+00:00 Linux15 sshd[1408327]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T00:01:36.733380+00:00 Linux15 sshd[1408327]: Failed password for root from 183.81.169.238 port 40422 ssh2
  2024-10-03T00:01:40.448372+00:00 Linux15 sshd[1408620]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T00:01:41.953435+00:00 Linux15 sshd[1408620]: Failed password for root from 183.81.169.238 port 48042 ssh2
  2024-10-03T00:01:45.575617+00:00 Linux15 sshd[1408880]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T00:01:47.768284+00:00 Linux15 sshd[1408880]: Failed password for root from 183.81.169.238 port 48080 ssh2
  2024-10-03T00:01:50.354932+00:00 Linux15 sshd[1409275]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= r
  ...

• Failed password for root from 183.81.169.238 port 46836 ssh2

• Oct 3 02:00:16 arayat sshd[29399]: Failed password for root from 183.81.169.238 port 57062 ssh2
  Oct 3 02:00:18 arayat sshd[29401]: Failed password for root from 183.81.169.238 port 57068 ssh2
  Oct 3 02:00:20 arayat sshd[29403]: Failed password for root from 183.81.169.238 port 57102 ssh2
  Oct 3 02:00:23 arayat sshd[29405]: Failed password for root from 183.81.169.238 port 57116 ssh2
  ...

• 10574 attempts since 14.07.2024 04:18:57 UTC - last one: 2024-10-03T00:07:29.852221+02:00 alpha sshd[2341353]: Connection closed by invalid user baikal 183.81.169.238 port 44482 [preauth]

• Oct 3 01:59:17 emberveil sshd[1305593]: Failed password for root from 183.81.169.238 port 56380 ssh2
  Oct 3 01:59:22 emberveil sshd[1305598]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 01:59:23 emberveil sshd[1305598]: Failed password for root from 183.81.169.238 port 40096 ssh2
  Oct 3 01:59:27 emberveil sshd[1305605]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 01:59:30 emberveil sshd[1305605]: Failed password for root from 183.81.169.238 port 40124 ssh2
  Oct 3 01:59:33 emberveil sshd[1305614]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 01:59:35 emberveil sshd[1305614]: Failed password for root from 183.81.169.238 port 48596 ssh2
  ...

• 2024-10-03T01:58:54.039583+02:00 v220240537442267460 sshd[1423602]: Failed password for root from 183.81.169.238 port 44862 ssh2
  2024-10-03T01:58:58.481100+02:00 v220240537442267460 sshd[1423611]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T01:59:00.080292+02:00 v220240537442267460 sshd[1423611]: Failed password for root from 183.81.169.238 port 43244 ssh2
  2024-10-03T01:59:02.990128+02:00 v220240537442267460 sshd[1423617]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T01:59:05.137237+02:00 v220240537442267460 sshd[1423617]: Failed password for root from 183.81.169.238 port 43266 ssh2
  ...

• Oct 2 23:58:43 Proxmox-VE sshd[118667]: Failed password for root from 183.81.169.238 port 33466 ssh2
  Oct 2 23:58:47 Proxmox-VE sshd[118686]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 23:58:49 Proxmox-VE sshd[118686]: Failed password for root from 183.81.169.238 port 40070 ssh2
  Oct 2 23:58:52 Proxmox-VE sshd[118710]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 23:58:54 Proxmox-VE sshd[118710]: Failed password for root from 183.81.169.238 port 40120 ssh2
  ...

• Oct 3 01:56:38 vps-9f3cdc33 sshd[1879945]: Failed password for root from 183.81.169.238 port 52336 ssh2
  Oct 3 01:56:42 vps-9f3cdc33 sshd[1879947]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 01:56:45 vps-9f3cdc33 sshd[1879947]: Failed password for root from 183.81.169.238 port 52340 ssh2
  Oct 3 01:56:48 vps-9f3cdc33 sshd[1879949]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 01:56:50 vps-9f3cdc33 sshd[1879949]: Failed password for root from 183.81.169.238 port 56388 ssh2
  ...

• Fail2Ban - SSHD brute-force SSH server
  ...

• Oct 2 19:56:13 us-mfl-02 sshd[3308272]: Invalid user Antminer from 183.81.169.238 port 57604
  ...

• 2024-10-02T23:55:43.079122brfr sshd[3419852]: Invalid user Antminer from 183.81.169.238 port 42782
  2024-10-02T23:55:45.977710brfr sshd[3420393]: Invalid user Antminer from 183.81.169.238 port 42816
  2024-10-02T23:56:03.412798brfr sshd[3428399]: Invalid user admin from 183.81.169.238 port 55620
  ...

• Oct 3 01:55:50 Ina sshd[1886521]: Failed password for root from 183.81.169.238 port 36942 ssh2
  Oct 3 01:55:54 Ina sshd[1886523]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 01:55:56 Ina sshd[1886523]: Failed password for root from 183.81.169.238 port 36968 ssh2
  Oct 3 01:56:00 Ina sshd[1886551]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 01:56:03 Ina sshd[1886551]: Failed password for root from 183.81.169.238 port 51272 ssh2
  ...

• 2024-10-02 23:54:05,068 quad proftpd[1059544] quad (183.81.169.238[183.81.169.238]): USER root: no such user found from 183.81.169.238 [183.81.169.238] to 2.56.97.107:22

• [rede-164-29] (sshd) Failed SSH login from 183.81.169.238 (NL/The Netherlands/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Oct 2 20:52:45 sshd[8493]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=[USERNAME]
  Oct 2 20:52:47 sshd[8493]: Failed password for [USERNAME] from 183.81.169.238 port 41628 ssh2
  Oct 2 20:52:51 sshd[8501]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=[USERNAME]
  Oct 2 20:52:53 sshd[8501]: Failed password for [USERNAME] from 183.81.169.238 port 39088 ssh2
  Oct 2 20:52:5

• Oct 3 01:52:22 : pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root Oct 3 01:52:24 : Failed password for root from 183.81.169.238 port 55902 ssh2 Oct 3 01:52:27 : pam_unix(sshd:auth): auth

• SSH login attempts (endlessh): 2024-10-02T23:52:26.305Z ACCEPT host=::ffff:183.81.169.238 port=47672 fd=4 n=1/4096

• Oct 3 01:52:00 vps643776 sshd[1282214]: Failed password for root from 183.81.169.238 port 53446 ssh2
  Oct 3 01:52:04 vps643776 sshd[1282216]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 01:52:06 vps643776 sshd[1282216]: Failed password for root from 183.81.169.238 port 53462 ssh2
  Oct 3 01:52:09 vps643776 sshd[1282220]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 01:52:11 vps643776 sshd[1282220]: Failed password for root from 183.81.169.238 port 51656 ssh2
  ...

• Failed password for root from 183.81.169.238 port 43000 ssh2
  pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Failed password for root from 183.81.169.238 port 50876 ssh2
  pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Failed password for root from 183.81.169.238 port 50894 ssh2

• OCCO-Holding Oct 3 01:49:06 vmi702584 sshd[2281496]: Failed password for root from 183.81.169.238 port 48448 ssh2
  Oct 3 01:49:07 vmi702584 sshd[2281496]: Connection closed by authenticating user root 183.81.169.238 port 48448 [preauth]
  Oct 3 01:49:09 vmi702584 sshd[2281498]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 01:49:11 vmi702584 sshd[2281498]: Failed password for root from 183.81.169.238 port 37884 ssh2
  Oct 3 01:49:12 vmi702584 sshd[2281498]: Connection closed by authenticating user root 183.81.169.238 port 37884 [preauth]
  ...

• Oct 2 23:48:30 phpbb3 sshd[2544292]: Invalid user Antminer from 183.81.169.238 port 44574
  Oct 2 23:48:33 phpbb3 sshd[2544294]: Invalid user Antminer from 183.81.169.238 port 44638

• Oct 3 01:48:13 vmi147057 sshd[838298]: Failed password for root from 183.81.169.238 port 53494 ssh2
  Oct 3 01:48:15 vmi147057 sshd[838313]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 01:48:17 vmi147057 sshd[838313]: Failed password for root from 183.81.169.238 port 53514 ssh2
  Oct 3 01:48:20 vmi147057 sshd[838333]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 01:48:23 vmi147057 sshd[838333]: Failed password for root from 183.81.169.238 port 52056 ssh2
  ...

• Oct 3 01:48:11 dev0-dcde-rnet sshd[7544]: Failed password for root from 183.81.169.238 port 36736 ssh2
  Oct 3 01:48:16 dev0-dcde-rnet sshd[7546]: Failed password for root from 183.81.169.238 port 36752 ssh2

• Oct 2 23:47:14 DuoX sshd[1513533]: Failed password for root from 183.81.169.238 port 50810 ssh2
  Oct 2 23:47:19 DuoX sshd[1515586]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 23:47:21 DuoX sshd[1515586]: Failed password for root from 183.81.169.238 port 43678 ssh2
  Oct 2 23:47:25 DuoX sshd[1518526]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 23:47:27 DuoX sshd[1518526]: Failed password for root from 183.81.169.238 port 43692 ssh2
  ...

• [2024 Oct 3 01:44:44] Brute-Force detected from 183.81.169.238 for sshd fails: 2x () USER=baikal SPT=49280

• Oct 2 23:46:21 c2 sshd[2036287]: Failed password for root from 183.81.169.238 port 35116 ssh2
  Oct 2 23:46:24 c2 sshd[2036291]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 23:46:26 c2 sshd[2036291]: Failed password for root from 183.81.169.238 port 35124 ssh2
  Oct 2 23:46:30 c2 sshd[2036295]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 23:46:31 c2 sshd[2036295]: Failed password for root from 183.81.169.238 port 46196 ssh2
  ...

• SSH Brute-Force Attack on a server hosted by PulseServers.com - UK10 Honeypot
  ...

• Oct 3 01:45:59 * sshd[2101276]: Failed password for root from 183.81.169.238 port 35990 ssh2
  Oct 3 01:46:02 * sshd[2101296]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 01:46:05 * sshd[2101296]: Failed password for root from 183.81.169.238 port 35996 ssh2

• Oct 2 23:45:27 mail sshd[2520620]: Invalid user Antminer from 183.81.169.238 port 50084
  Oct 2 23:45:29 mail sshd[2520622]: Invalid user Antminer from 183.81.169.238 port 50098
  ...

• FW-PortScan: Traffic Blocked srcport=43445 dstport=22

• Oct 2 23:44:36 ovh sshd[3212600]: Failed password for root from 183.81.169.238 port 48066 ssh2
  Oct 2 23:44:41 ovh sshd[3212637]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 23:44:43 ovh sshd[3212637]: Failed password for root from 183.81.169.238 port 35888 ssh2
  Oct 2 23:44:47 ovh sshd[3212696]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 23:44:49 ovh sshd[3212696]: Failed password for root from 183.81.169.238 port 47674 ssh2
  ...

• 2024-10-02T20:43:35.213410-03:00 dns1 sshd[18385]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T20:43:37.770759-03:00 dns1 sshd[18385]: Failed password for root from 183.81.169.238 port 57936 ssh2
  2024-10-02T20:43:40.996502-03:00 dns1 sshd[18385]: Connection closed by authenticating user root 183.81.169.238 port 57936 [preauth]
  2024-10-02T20:43:44.081139-03:00 dns1 sshd[18387]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T20:43:46.400108-03:00 dns1 sshd[18387]: Failed password for root from 183.81.169.238 port 51984 ssh2

• 2024-10-02T19:43:08.610498-04:00 ns05-a-ns-xyz sshd[2254763]: Failed password for root from 183.81.169.238 port 44146 ssh2
  2024-10-02T19:43:12.993233-04:00 ns05-a-ns-xyz sshd[2254765]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T19:43:15.057130-04:00 ns05-a-ns-xyz sshd[2254765]: Failed password for root from 183.81.169.238 port 44160 ssh2
  2024-10-02T19:43:19.128613-04:00 ns05-a-ns-xyz sshd[2254767]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T19:43:21.152039-04:00 ns05-a-ns-xyz sshd[2254767]: Failed password for root from 183.81.169.238 port 36850 ssh2
  ...

• SSH port scan (Tarpitted for 2m20s, wasted 258B)

• Oct 2 14:40:37 alpha-ef21b5050c sshd[1130935]: Invalid user Antminer from 183.81.169.238 port 60294
  ...

• firewall-block, port(s): 22/tcp

• 2024-10-02T19:40:12.475066-04:00 collabhost.computernewb.com sshd-session[3681269]: Invalid user Antminer from 183.81.169.238 port 56160
  2024-10-02T19:40:14.616985-04:00 collabhost.computernewb.com sshd-session[3681271]: Invalid user Antminer from 183.81.169.238 port 56176
  2024-10-02T19:40:28.307721-04:00 collabhost.computernewb.com sshd-session[3681314]: Invalid user admin from 183.81.169.238 port 37940
  ...

• Inteceptor Intrusion Detector: failed_password on sshd module PID: (1032214)

• Unsolicited connection attempt(s), port:22.

• 10851 attempts since 13.07.2024 23:53:03 UTC - last one: 2024-10-02T23:21:37.631804+02:00 beta sshd[2312795]: Connection closed by authenticating user root 183.81.169.238 port 45070 [preauth]

• 2024-10-03T07:38:39.363615+08:00 vm95943 sshd[95350]: Invalid user Antminer from 183.81.169.238 port 33708
  ...

• [rede-164-29] 10/02/2024-20:37:07.589015, 183.81.169.238, Protocol: 6, ET COMPROMISED Known Compromised or Hostile Host Traffic group 13

• 2024-10-02T23:36:15.680186+00:00 mapir-proxmox sshd[1813067]: Failed password for root from 183.81.169.238 port 55866 ssh2
  2024-10-02T23:36:18.168827+00:00 mapir-proxmox sshd[1813691]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T23:36:20.060518+00:00 mapir-proxmox sshd[1813691]: Failed password for root from 183.81.169.238 port 35576 ssh2
  ...

• Oct 3 01:35:29 hosting08 sshd[30011]: Failed password for root from 183.81.169.238 port 46994 ssh2
  Oct 3 01:35:33 hosting08 sshd[30025]: Failed password for root from 183.81.169.238 port 47010 ssh2
  ...

• Oct 3 01:35:16 4429 sshd[86269]: Failed password for root from 183.81.169.238 port 46736 ssh2
  Oct 3 01:35:18 4429 sshd[86271]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 01:35:20 4429 sshd[86271]: Failed password for root from 183.81.169.238 port 53804 ssh2
  ...

• Oct 3 01:33:27 amk sshd\[7663\]: Failed password for root from 183.81.169.238 port 39336 ssh2Oct 3 01:33:31 amk sshd\[7665\]: Failed password for root from 183.81.169.238 port 49784 ssh2
  ...

• Oct 3 01:33:19 mail sshd[726153]: Failed password for root from 183.81.169.238 port 33144 ssh2
  Oct 3 01:33:21 mail sshd[726156]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 01:33:24 mail sshd[726156]: Failed password for root from 183.81.169.238 port 33156 ssh2
  ...

• Oct 3 01:32:19 [redacted] sshd[3686781]: Failed password for [redacted] from 183.81.169.238 port 53546 ssh2
  Oct 3 01:32:22 [redacted] sshd[3686814]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=[redacted]
  Oct 3 01:32:25 [redacted] sshd[3686814]: Failed password for [redacted] from 183.81.169.238 port 53564 ssh2
  Oct 3 01:32:27 [redacted] sshd[3686850]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=[redacted]
  Oct 3 01:32:30 [redacted] sshd[3686850]: Failed password for [redacted] from 183.81.169.238 port 43290 ssh2
  ...

• Oct 2 23:31:19 scw-pizzadns-master sshd\[5318\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 23:31:21 scw-pizzadns-master sshd\[5318\]: Failed password for root from 183.81.169.238 port 39850 ssh2
  Oct 2 23:31:23 scw-pizzadns-master sshd\[5348\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root

• Oct 3 00:30:07 kamergaz sshd[2592763]: Failed password for root from 183.81.169.238 port 36454 ssh2
  Oct 3 00:30:11 kamergaz sshd[2592765]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 00:30:12 kamergaz sshd[2592765]: Failed password for root from 183.81.169.238 port 55262 ssh2
  Oct 3 00:30:16 kamergaz sshd[2592767]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 00:30:18 kamergaz sshd[2592767]: Failed password for root from 183.81.169.238 port 45046 ssh2

• Oct 3 00:29:55 dev sshd[68224]: Failed password for root from 183.81.169.238 port 51382 ssh2
  Oct 3 00:29:58 dev sshd[68240]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 00:30:01 dev sshd[68240]: Failed password for root from 183.81.169.238 port 51988 ssh2
  Oct 3 00:30:05 dev sshd[68254]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 00:30:07 dev sshd[68254]: Failed password for root from 183.81.169.238 port 52020 ssh2
  ...

• endlessh trap: attempts=4 total_time_stuck=620.614s

• FW-PortScan: Traffic Blocked srcport=54417 dstport=22

• 2024-10-03T01:29:02.932983+02:00 pokevador sshd[502371]: Failed password for root from 183.81.169.238 port 34678 ssh2
  2024-10-03T01:29:05.729522+02:00 pokevador sshd[502421]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T01:29:07.179848+02:00 pokevador sshd[502421]: Failed password for root from 183.81.169.238 port 59344 ssh2
  ...

• Fail2Ban SSH Brute Force

• Oct 3 01:26:56 host sshd[423221]: Failed password for root from 183.81.169.238 port 48894 ssh2
  Oct 3 01:26:59 host sshd[423289]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 01:27:01 host sshd[423289]: Failed password for root from 183.81.169.238 port 54950 ssh2
  Oct 3 01:27:04 host sshd[423381]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 01:27:06 host sshd[423381]: Failed password for root from 183.81.169.238 port 54976 ssh2
  ...

• Oct 3 01:26:50 server sshd[1321544]: Failed password for root from 183.81.169.238 port 40340 ssh2
  Oct 3 01:26:52 server sshd[1321546]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 01:26:54 server sshd[1321546]: Failed password for root from 183.81.169.238 port 40356 ssh2
  Oct 3 01:26:56 server sshd[1321548]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 01:26:59 server sshd[1321548]: Failed password for root from 183.81.169.238 port 58002 ssh2
  ...

• 2024-10-02T16:26:41.252463 web sshd[356583]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T16:26:43.602236 web sshd[356583]: Failed password for root from 183.81.169.238 port 48532 ssh2
  ...

• Cowrie Honeypot: 10 unauthorised SSH/Telnet login attempts between 2024-10-02T23:26:03Z and 2024-10-02T23:26:38Z

• 2024-10-03T01:26:12.438585vps773228.ovh.net sshd[8185]: Failed password for root from 183.81.169.238 port 36474 ssh2
  2024-10-03T01:26:14.739263vps773228.ovh.net sshd[8187]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T01:26:17.045524vps773228.ovh.net sshd[8187]: Failed password for root from 183.81.169.238 port 36490 ssh2
  2024-10-03T01:26:19.653757vps773228.ovh.net sshd[8189]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T01:26:21.981994vps773228.ovh.net sshd[8189]: Failed password for root from 183.81.169.238 port 47090 ssh2
  ...

• 2024-10-02T23:25:34.737185shield sshd\[30610\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T23:25:36.888437shield sshd\[30610\]: Failed password for root from 183.81.169.238 port 60036 ssh2
  2024-10-02T23:25:39.473593shield sshd\[30620\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T23:25:41.975812shield sshd\[30620\]: Failed password for root from 183.81.169.238 port 38276 ssh2
  2024-10-02T23:25:44.875859shield sshd\[30630\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root

• Oct 2 23:25:13 s158416 sshd[2515729]: Failed password for root from 183.81.169.238 port 60110 ssh2
  Oct 2 23:25:17 s158416 sshd[2515731]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 23:25:19 s158416 sshd[2515731]: Failed password for root from 183.81.169.238 port 35412 ssh2
  Oct 2 23:25:23 s158416 sshd[2515743]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 23:25:25 s158416 sshd[2515743]: Failed password for root from 183.81.169.238 port 35436 ssh2
  ...

• 2024-10-03T01:25:10.385654+02:00 vande sshd[1614560]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T01:25:12.241824+02:00 vande sshd[1614560]: Failed password for root from 183.81.169.238 port 36844 ssh2

• Oct 2 23:24:38 cloud-server-0 sshd[1858259]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 23:24:40 cloud-server-0 sshd[1858259]: Failed password for root from 183.81.169.238 port 45872 ssh2
  Oct 2 23:24:44 cloud-server-0 sshd[1858261]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 23:24:46 cloud-server-0 sshd[1858261]: Failed password for root from 183.81.169.238 port 45926 ssh2
  Oct 2 23:24:50 cloud-server-0 sshd[1858263]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 23:24:53 cloud-server-0 sshd[1858263]: Failed password for root from 183.81.169.238 port 55748 ssh2
  Oct 2 23:24:57 cloud-server-0 sshd[1858265]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 23:24:59 cloud-server-0 sshd[185
  ...

• Oct 3 02:22:55 server2 sshd\[9939\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 02:22:57 server2 sshd\[9941\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 02:22:58 server2 sshd\[9943\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 02:23:00 server2 sshd\[9945\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 02:23:01 server2 sshd\[9947\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 02:23:03 server2 sshd\[9977\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers

• Oct 3 01:21:04 dsh1621 sshd[3853160]: Failed password for root from 183.81.169.238 port 58790 ssh2
  Oct 3 01:21:06 dsh1621 sshd[3853194]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 01:21:08 dsh1621 sshd[3853194]: Failed password for root from 183.81.169.238 port 40624 ssh2
  Oct 3 01:21:13 dsh1621 sshd[3853236]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 01:21:16 dsh1621 sshd[3853236]: Failed password for root from 183.81.169.238 port 40648 ssh2
  ...

• 2024-10-02T19:20:57.165542-04:00 nova3 sshd[1766675]: Failed password for root from 183.81.169.238 port 49286 ssh2
  2024-10-02T19:21:00.179487-04:00 nova3 sshd[1766749]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T19:21:01.714400-04:00 nova3 sshd[1766749]: Failed password for root from 183.81.169.238 port 53858 ssh2
  2024-10-02T19:21:04.693468-04:00 nova3 sshd[1766791]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T19:21:06.443268-04:00 nova3 sshd[1766791]: Failed password for root from 183.81.169.238 port 53860 ssh2
  ...

• Oct 3 01:20:44 hosting sshd[2784335]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 01:20:47 hosting sshd[2784335]: Failed password for root from 183.81.169.238 port 40674 ssh2
  Oct 3 01:20:52 hosting sshd[2784374]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 01:20:54 hosting sshd[2784374]: Failed password for root from 183.81.169.238 port 50496 ssh2

• Unsolicited connection attempt(s), port:22.

• Oct 2 23:19:53 vps-d7931dc8 sshd[471862]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 23:19:56 vps-d7931dc8 sshd[471862]: Failed password for root from 183.81.169.238 port 34724 ssh2
  Oct 2 23:19:57 vps-d7931dc8 sshd[471862]: Connection closed by authenticating user root 183.81.169.238 port 34724 [preauth]
  Oct 2 23:19:58 vps-d7931dc8 sshd[471864]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 23:20:00 vps-d7931dc8 sshd[471864]: Failed password for root from 183.81.169.238 port 59804 ssh2

• 2024-10-03T02:19:52.001258+03:00 oh6ah sshd[1838445]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T02:19:54.399427+03:00 oh6ah sshd[1838445]: Failed password for root from 183.81.169.238 port 39700 ssh2
  ...

• Oct 3 01:18:05 vmi1008219 sshd[369717]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 01:18:07 vmi1008219 sshd[369717]: Failed password for root from 183.81.169.238 port 54468 ssh2
  ...

• 2024-10-03T01:17:34.084184+02:00 ubuntu sshd[158008]: Failed password for root from 183.81.169.238 port 55142 ssh2
  2024-10-03T01:17:37.330879+02:00 ubuntu sshd[158010]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T01:17:39.332625+02:00 ubuntu sshd[158010]: Failed password for root from 183.81.169.238 port 48816 ssh2
  2024-10-03T01:17:42.800996+02:00 ubuntu sshd[158013]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T01:17:44.487025+02:00 ubuntu sshd[158013]: Failed password for root from 183.81.169.238 port 48830 ssh2
  ...

• 2024-10-03T01:16:27.700815+02:00 srv1 sshd[50289]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T01:16:29.758128+02:00 srv1 sshd[50289]: Failed password for root from 183.81.169.238 port 35150 ssh2
  ...

• Oct 3 00:14:56 s1-jellyfish sshd[3701600]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 00:14:58 s1-jellyfish sshd[3701600]: Failed password for root from 183.81.169.238 port 47718 ssh2
  ...

• $f2bV_matches

• Multiple SSH login attempts (endlessh) in the last 24 hours. Number of occurrences: 22

• 2024-10-03T01:09:17.114661 prodgateway sshd[60873]: Failed password for root from 183.81.169.238 port 58606 ssh2
  2024-10-03T01:09:21.016785 prodgateway sshd[60876]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T01:09:22.592544 prodgateway sshd[60876]: Failed password for root from 183.81.169.238 port 45038 ssh2
  ...

• Oct 2 23:09:02 instance-20221219-1303 sshd[2759637]: Invalid user Antminer from 183.81.169.238 port 53018
  ...

• FW-PortScan: Traffic Blocked srcport=53883 dstport=22

• Oct 2 22:37:06 rltx-geofeed sshd[452213]: Invalid user Antminer from 183.81.169.238 port 49178
  Oct 2 23:06:47 rltx-geofeed sshd[452274]: Invalid user Antminer from 183.81.169.238 port 60784
  Oct 2 23:06:48 rltx-geofeed sshd[452276]: Invalid user Antminer from 183.81.169.238 port 60800
  Oct 2 23:06:55 rltx-geofeed sshd[452288]: Invalid user admin from 183.81.169.238 port 54832
  Oct 2 23:06:56 rltx-geofeed sshd[452290]: Invalid user baikal from 183.81.169.238 port 54846
  ...

• Oct 2 19:06:43 us-mfl-01 sshd[3948145]: Invalid user Antminer from 183.81.169.238 port 39354
  ...

• Fail2Ban Ban Triggered

• [rede-166-249] (sshd) Failed SSH login from 183.81.169.238 (NL/The Netherlands/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Oct 2 20:05:18 sshd[31344]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=[USERNAME]
  Oct 2 20:05:20 sshd[31344]: Failed password for [USERNAME] from 183.81.169.238 port 45134 ssh2
  Oct 2 20:05:22 sshd[31357]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=[USERNAME]
  Oct 2 20:05:24 sshd[31357]: Failed password for [USERNAME] from 183.81.169.238 port 45144 ssh2
  Oct 2 20:

• Oct 3 01:04:31 CDN sshd[1790515]: Failed password for root from 183.81.169.238 port 35428 ssh2
  Oct 3 01:04:33 CDN sshd[1790519]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 01:04:35 CDN sshd[1790519]: Failed password for root from 183.81.169.238 port 35448 ssh2
  Oct 3 01:04:38 CDN sshd[1790521]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 01:04:40 CDN sshd[1790521]: Failed password for root from 183.81.169.238 port 47988 ssh2

• Oct 3 01:04:27 endernation sshd[3305749]: Failed password for root from 183.81.169.238 port 59634 ssh2
  Oct 3 01:04:28 endernation sshd[3305772]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 01:04:30 endernation sshd[3305772]: Failed password for root from 183.81.169.238 port 59646 ssh2
  ...

• tcp/22 (18 or more attempts)

• Oct 2 23:02:57 minio sshd[647638]: Invalid user Antminer from 183.81.169.238 port 57112
  Oct 2 23:02:59 minio sshd[647640]: Invalid user Antminer from 183.81.169.238 port 57126
  Oct 2 23:03:09 minio sshd[647652]: Invalid user admin from 183.81.169.238 port 55470
  ...

• 2024-10-03T01:02:29.874420+02:00 srv1 sshd[2619484]: Failed password for root from 183.81.169.238 port 45334 ssh2
  2024-10-03T01:02:32.028341+02:00 srv1 sshd[2619505]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T01:02:34.652053+02:00 srv1 sshd[2619505]: Failed password for root from 183.81.169.238 port 45342 ssh2
  2024-10-03T01:02:38.138606+02:00 srv1 sshd[2619589]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T01:02:39.387864+02:00 srv1 sshd[2619589]: Failed password for root from 183.81.169.238 port 36670 ssh2
  ...

• Oct 2 23:01:55 mlat sshd[3091517]: Failed password for root from 183.81.169.238 port 57418 ssh2
  Oct 2 23:01:56 mlat sshd[3091522]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 23:01:59 mlat sshd[3091522]: Failed password for root from 183.81.169.238 port 50692 ssh2
  ... azuremlat

• SSH authentication failed too many times.

• SSH login 27 attempt(s) in the last 1 hour(s).

• 2024-10-02T22:58:47.681712+00:00 Linux04 sshd[2063200]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T22:58:49.217289+00:00 Linux04 sshd[2063200]: Failed password for root from 183.81.169.238 port 54768 ssh2
  2024-10-02T22:58:50.915940+00:00 Linux04 sshd[2063310]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T22:58:52.862281+00:00 Linux04 sshd[2063310]: Failed password for root from 183.81.169.238 port 54802 ssh2
  2024-10-02T22:58:54.018046+00:00 Linux04 sshd[2063464]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T22:58:55.849402+00:00 Linux04 sshd[2063464]: Failed password for root from 183.81.169.238 port 54816 ssh2
  2024-10-02T22:58:56.822446+00:00 Linux04 sshd[2063618]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= r
  ...

• 2024-10-02T22:57:42.985220+00:00 deb0 sshd[59241]: Connection closed by authenticating user root 183.81.169.238 port 57906 [preauth]
  ...

• Oct 2 22:57:19 mark sshd[3157935]: Failed password for root from 183.81.169.238 port 34972 ssh2
  Oct 2 22:57:21 mark sshd[3158411]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 22:57:23 mark sshd[3158411]: Failed password for root from 183.81.169.238 port 34994 ssh2
  Oct 2 22:57:24 mark sshd[3158630]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 22:57:25 mark sshd[3158630]: Failed password for root from 183.81.169.238 port 35004 ssh2
  ...

• unauthorized connection with user "root" and password "0" at 2024-10-02T22:57:12Z

• 2024-10-02T23:56:19.332071+01:00 jane sshd[3654572]: Failed password for root from 183.81.169.238 port 40308 ssh2
  2024-10-02T23:56:20.454161+01:00 jane sshd[3654630]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T23:56:22.144102+01:00 jane sshd[3654630]: Failed password for root from 183.81.169.238 port 40344 ssh2
  ...

• Oct 2 22:53:48 ubuntu sshd[1152798]: Invalid user Antminer from 183.81.169.238 port 60072
  Oct 2 22:53:48 ubuntu sshd[1152800]: Invalid user Antminer from 183.81.169.238 port 60088
  Oct 2 22:53:50 ubuntu sshd[1152846]: Invalid user admin from 183.81.169.238 port 60130
  ...

• Oct 3 00:53:17 markkoudstaal sshd[2790699]: Failed password for root from 183.81.169.238 port 48404 ssh2
  Oct 3 00:53:20 markkoudstaal sshd[2790702]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 00:53:22 markkoudstaal sshd[2790702]: Failed password for root from 183.81.169.238 port 48424 ssh2
  ...

• Oct 2 22:52:45 ice1 sshd[3545266]: Invalid user Antminer from 183.81.169.238 port 34642
  Oct 2 22:52:46 ice1 sshd[3545268]: Invalid user Antminer from 183.81.169.238 port 34648
  ...

• 2024-10-02T08:01:06.085786correo.[domain] sshd[32277]: Failed password for root from 183.81.169.238 port 54216 ssh2 2024-10-02T08:01:08.767017correo.[domain] sshd[32281]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root 2024-10-02T08:01:10.634549correo.[domain] sshd[32281]: Failed password for root from 183.81.169.238 port 51022 ssh2 ...

• Oct 3 00:52:04 m2048 sshd[316516]: Failed password for root from 183.81.169.238 port 47910 ssh2
  Oct 3 00:52:06 m2048 sshd[316518]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 00:52:08 m2048 sshd[316518]: Failed password for root from 183.81.169.238 port 45608 ssh2
  Oct 3 00:52:08 m2048 sshd[316520]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 00:52:10 m2048 sshd[316520]: Failed password for root from 183.81.169.238 port 45612 ssh2
  ...

• 2024-10-02T17:51:47.070812-05:00 instance-20240522-152753 sshd[2526213]: Invalid user Antminer from 183.81.169.238 port 53090
  2024-10-02T17:51:47.826210-05:00 instance-20240522-152753 sshd[2526215]: Invalid user Antminer from 183.81.169.238 port 53096
  2024-10-02T17:51:51.981997-05:00 instance-20240522-152753 sshd[2526230]: Invalid user admin from 183.81.169.238 port 53164
  2024-10-02T17:51:52.702895-05:00 instance-20240522-152753 sshd[2526232]: Invalid user baikal from 183.81.169.238 port 53170
  ...

• FW-PortScan: Traffic Blocked srcport=33095 dstport=22

• Oct 2 22:49:09 webserver sshd[739705]: Failed password for root from 183.81.169.238 port 38718 ssh2
  Oct 2 22:49:10 webserver sshd[739707]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 22:49:11 webserver sshd[739707]: Failed password for root from 183.81.169.238 port 38726 ssh2
  Oct 2 22:49:12 webserver sshd[739709]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 22:49:14 webserver sshd[739709]: Failed password for root from 183.81.169.238 port 38736 ssh2
  ...

• Oct 3 00:47:57 odin sshd[23134]: Failed password for root from 183.81.169.238 port 41000 ssh2
  Oct 3 00:48:02 odin sshd[23140]: Failed password for root from 183.81.169.238 port 41004 ssh2

• 2024-10-02T22:47:02.027404shield sshd\[26246\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T22:47:04.445718shield sshd\[26246\]: Failed password for root from 183.81.169.238 port 48092 ssh2
  2024-10-02T22:47:05.001869shield sshd\[26248\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T22:47:07.028455shield sshd\[26248\]: Failed password for root from 183.81.169.238 port 47342 ssh2
  2024-10-02T22:47:07.631403shield sshd\[26258\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root

• [22:45] Attempted SSH login on port 22 with credentials root:0

• Last 24 hours Brute Force Attacks

• Security system: Unauthorised SSH/Telnet login attempt with user "root" at 2024-10-02T22:44:07Z

• Oct 3 01:43:51 server2 sshd\[5813\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 01:43:52 server2 sshd\[5815\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 01:43:53 server2 sshd\[5817\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 01:43:55 server2 sshd\[5821\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 01:43:57 server2 sshd\[5823\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 01:43:58 server2 sshd\[5825\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers

• Oct 3 00:43:31 ns37 sshd[6534]: Failed password for root from 183.81.169.238 port 34408 ssh2
  Oct 3 00:43:36 ns37 sshd[6538]: Failed password for root from 183.81.169.238 port 34414 ssh2
  ...

• 2024-10-02T22:42:17.342270+00:00 minio-fra-01.pdx.net.uk sshd[153802]: Invalid user Antminer from 183.81.169.238 port 55150
  2024-10-02T22:42:18.699115+00:00 minio-fra-01.pdx.net.uk sshd[153804]: Invalid user Antminer from 183.81.169.238 port 55162
  2024-10-02T22:42:29.400920+00:00 minio-fra-01.pdx.net.uk sshd[153816]: Invalid user admin from 183.81.169.238 port 33418
  ...

• Oct 2 18:41:50 us-mfl-03 sshd[2247549]: Invalid user Antminer from 183.81.169.238 port 37318
  ...

• 2024-10-03T06:41:35.927527+08:00 VM65536 sshd[915694]: Connection closed by authenticating user root 183.81.169.238 port 38488 [preauth]
  2024-10-03T06:41:38.686738+08:00 VM65536 sshd[915696]: Connection closed by authenticating user root 183.81.169.238 port 55452 [preauth]
  2024-10-03T06:41:42.166013+08:00 VM65536 sshd[915700]: Connection closed by authenticating user root 183.81.169.238 port 55466 [preauth]
  ...

• Oct 3 00:41:25 vmi174663 sshd[1929345]: Failed password for root from 183.81.169.238 port 51388 ssh2
  Oct 3 00:41:28 vmi174663 sshd[1929407]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 00:41:30 vmi174663 sshd[1929407]: Failed password for root from 183.81.169.238 port 37086 ssh2
  Oct 3 00:41:33 vmi174663 sshd[1929441]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 00:41:35 vmi174663 sshd[1929441]: Failed password for root from 183.81.169.238 port 37134 ssh2
  ...

• Oct 3 00:41:12 apo sshd[9288]: Failed password for root from 183.81.169.238 port 36706 ssh2
  Oct 3 00:41:15 apo sshd[9542]: Failed password for root from 183.81.169.238 port 36728 ssh2
  Oct 3 00:41:17 apo sshd[9544]: Failed password for root from 183.81.169.238 port 33354 ssh2
  Oct 3 00:41:19 apo sshd[9546]: Failed password for root from 183.81.169.238 port 33374 ssh2
  ...

• 2024-10-02 22:40:44,457 fail2ban.actions [624]: NOTICE [sshd] Ban 183.81.169.238

• SSH BruteForce attack

• Unsolicited connection attempt(s), port:22.

• 2024-10-02T15:38:33.917301-07:00 goldcrest sshd[221129]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T15:38:36.460784-07:00 goldcrest sshd[221129]: Failed password for root from 183.81.169.238 port 38048 ssh2
  2024-10-02T15:38:38.064995-07:00 goldcrest sshd[221131]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T15:38:40.293639-07:00 goldcrest sshd[221131]: Failed password for root from 183.81.169.238 port 38082 ssh2
  ...

• Oct 3 00:37:47 athena sshd[841250]: Failed password for root from 183.81.169.238 port 40084 ssh2
  Oct 3 00:37:51 athena sshd[841252]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 00:37:52 athena sshd[841252]: Failed password for root from 183.81.169.238 port 40100 ssh2
  Oct 3 00:37:55 athena sshd[841256]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 00:37:57 athena sshd[841256]: Failed password for root from 183.81.169.238 port 60460 ssh2
  ...

• Oct 2 15:37:42 cohoe sshd[2990061]: Failed password for root from 183.81.169.238 port 58020 ssh2
  Oct 2 15:37:45 cohoe sshd[2990063]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 15:37:48 cohoe sshd[2990063]: Failed password for root from 183.81.169.238 port 58048 ssh2
  Oct 2 15:37:52 cohoe sshd[2990068]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 15:37:54 cohoe sshd[2990068]: Failed password for root from 183.81.169.238 port 33302 ssh2
  ...

• 2024-10-03T00:37:07.070483+02:00 mail sshd[491347]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-03T00:37:09.515957+02:00 mail sshd[491349]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-03T00:37:11.699800+02:00 mail sshd[491351]: User root from 183.81.169.238 not allowed because not listed in AllowUsers

• Oct 2 22:36:49 ns520895 sshd[6586]: Failed password for root from 183.81.169.238 port 57154 ssh2
  ...

• Oct 2 22:36:45 destiny sshd[2055381]: Connection closed by invalid user root 183.81.169.238 port 50980 [preauth]
  Oct 2 22:36:47 destiny sshd[2055383]: User root not allowed because account is locked
  Oct 2 22:36:47 destiny sshd[2055383]: Connection closed by invalid user root 183.81.169.238 port 51002 [preauth]
  Oct 2 22:36:49 destiny sshd[2055387]: User root not allowed because account is locked
  Oct 2 22:36:49 destiny sshd[2055387]: Connection closed by invalid user root 183.81.169.238 port 51016 [preauth]
  ...

• [2024 Oct 3 00:35:08] Brute-Force detected from 183.81.169.238 for sshd fails: 2x () USER=Antminer SPT=52000

• 2024-10-03T00:35:31.357024+02:00 srv2 sshd[1607670]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T00:35:33.578090+02:00 srv2 sshd[1607670]: Failed password for root from 183.81.169.238 port 50718 ssh2
  ...

• 2024-10-02T22:35:15.048077+00:00 frhb72991flex sshd[2165810]: Invalid user Antminer from 183.81.169.238 port 46698
  2024-10-02T22:35:16.583508+00:00 frhb72991flex sshd[2165812]: Invalid user Antminer from 183.81.169.238 port 46702
  ...

• [rede-164-29] 10/02/2024-19:35:08.354307, 183.81.169.238, Protocol: 6, ET COMPROMISED Known Compromised or Hostile Host Traffic group 13

• Hacker syslog review 1727908505

• FW-PortScan: Traffic Blocked srcport=57994 dstport=22

• 2024-10-02T22:34:03.651353+00:00 srv67 sshd[15122]: Connection closed by authenticating user root 183.81.169.238 port 42282 [preauth]
  ...

• 2024-10-02T18:33:32.385021-04:00 ns05-a-ns-xyz sshd[2254375]: Failed password for root from 183.81.169.238 port 54434 ssh2
  2024-10-02T18:33:36.254996-04:00 ns05-a-ns-xyz sshd[2254377]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T18:33:38.028478-04:00 ns05-a-ns-xyz sshd[2254377]: Failed password for root from 183.81.169.238 port 43558 ssh2
  2024-10-02T18:33:42.044019-04:00 ns05-a-ns-xyz sshd[2254379]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T18:33:44.166675-04:00 ns05-a-ns-xyz sshd[2254379]: Failed password for root from 183.81.169.238 port 43640 ssh2
  ...

• Oct 2 22:33:05 24fire sshd[194541]: Failed password for root from 183.81.169.238 port 54498 ssh2
  Oct 2 22:33:08 24fire sshd[194543]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 22:33:10 24fire sshd[194543]: Failed password for root from 183.81.169.238 port 48588 ssh2
  Oct 2 22:33:14 24fire sshd[194545]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 22:33:16 24fire sshd[194545]: Failed password for root from 183.81.169.238 port 48624 ssh2
  ...

• Funeypot detected 4296 ssh attempts in 560h47m53s. Last by user "root", password "*", client "Go".

• 2024-10-02T18:32:31.684511-04:00 srv-UXQS4A.incognet.io sshd[1356]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T18:32:33.529844-04:00 srv-UXQS4A.incognet.io sshd[1356]: Failed password for invalid user root from 183.81.169.238 port 46820 ssh2
  ...

• Oct 2 22:30:53 ovh-docker-001 sshd[3930899]: Failed password for root from 183.81.169.238 port 45130 ssh2
  Oct 2 22:30:56 ovh-docker-001 sshd[3930926]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 22:30:59 ovh-docker-001 sshd[3930926]: Failed password for root from 183.81.169.238 port 47814 ssh2
  Oct 2 22:31:02 ovh-docker-001 sshd[3931120]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 22:31:04 ovh-docker-001 sshd[3931120]: Failed password for root from 183.81.169.238 port 47842 ssh2
  ...

• Oct 3 00:31:02 savine sshd[1587317]: Invalid user Antminer from 183.81.169.238 port 54584
  ...

• Oct 2 22:30:17 proxy sshd[1584686]: Invalid user Antminer from 183.81.169.238 port 38170
  ...

• Oct 2 17:30:00 ivankin sshd[434916]: Failed password for root from 183.81.169.238 port 34210 ssh2
  Oct 2 17:30:04 ivankin sshd[434918]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 17:30:06 ivankin sshd[434918]: Failed password for root from 183.81.169.238 port 34238 ssh2
  ...

• 2024-10-02T17:28:04.996593gateway sshd[1651922]: Failed password for root from 183.81.169.238 port 36406 ssh2
  2024-10-02T17:28:07.934944gateway sshd[1651925]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T17:28:09.872047gateway sshd[1651925]: Failed password for root from 183.81.169.238 port 60642 ssh2
  2024-10-02T17:28:13.080272gateway sshd[1651928]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T17:28:15.507066gateway sshd[1651928]: Failed password for root from 183.81.169.238 port 60664 ssh2
  2024-10-02T17:28:20.854815gateway sshd[1651931]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T17:28:23.243556gateway sshd[1651931]: Failed password for root from 183.81.169.238 port 54240 ssh2
  2024-10-02T17:28:28.295692gateway sshd[1651934]: pam_unix(sshd:auth): a
  ...

• Oct 2 19:16:05 localhost sshd[141119]: Invalid user Antminer from 183.81.169.238 port 37402
  Oct 2 19:16:07 localhost sshd[141121]: Invalid user Antminer from 183.81.169.238 port 37416
  Oct 2 19:16:19 localhost sshd[141133]: Invalid user admin from 183.81.169.238 port 37716
  Oct 2 19:16:21 localhost sshd[141135]: Invalid user baikal from 183.81.169.238 port 37742
  Oct 2 22:28:16 localhost sshd[141917]: Invalid user Antminer from 183.81.169.238 port 54960
  ...

• Failed password for root from 183.81.169.238 port 38066 ssh2
  pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Failed password for root from 183.81.169.238 port 37506 ssh2
  pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Failed password for root from 183.81.169.238 port 58700 ssh2

• Oct 3 00:25:47 vps643776 sshd[1280985]: Failed password for root from 183.81.169.238 port 34034 ssh2
  Oct 3 00:25:50 vps643776 sshd[1280987]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 00:25:52 vps643776 sshd[1280987]: Failed password for root from 183.81.169.238 port 48562 ssh2
  Oct 3 00:25:55 vps643776 sshd[1280989]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 00:25:56 vps643776 sshd[1280989]: Failed password for root from 183.81.169.238 port 48574 ssh2
  ...

• Oct 2 22:24:55 cloud sshd[3866563]: Invalid user Antminer from 183.81.169.238 port 36776
  Oct 2 22:24:57 cloud sshd[3866565]: Invalid user Antminer from 183.81.169.238 port 36804
  ...

• Oct 2 16:23:21 SRC=183.81.169.238 PROTO=TCP SPT=40040 DPT=22 SYN
  ...

• Oct 3 00:22:35 h3004354 sshd[2238045]: Failed password for root from 183.81.169.238 port 44274 ssh2
  Oct 3 00:22:39 h3004354 sshd[2238047]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 00:22:41 h3004354 sshd[2238047]: Failed password for root from 183.81.169.238 port 39626 ssh2
  Oct 3 00:22:44 h3004354 sshd[2238050]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 00:22:46 h3004354 sshd[2238050]: Failed password for root from 183.81.169.238 port 39662 ssh2
  ...

• Oct 2 18:21:01 thebatforge sshd[456656]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 18:21:03 thebatforge sshd[456658]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 18:21:05 thebatforge sshd[456660]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 18:21:07 thebatforge sshd[456664]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 18:21:09 thebatforge sshd[456666]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  ...

• Unsolicited connection attempt(s), port:22.

• Oct 3 00:19:28 CDN sshd[1790172]: Failed password for root from 183.81.169.238 port 58968 ssh2
  Oct 3 00:19:32 CDN sshd[1790174]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 00:19:33 CDN sshd[1790174]: Failed password for root from 183.81.169.238 port 59038 ssh2
  Oct 3 00:19:37 CDN sshd[1790176]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 00:19:39 CDN sshd[1790176]: Failed password for root from 183.81.169.238 port 48902 ssh2

• Oct 3 00:19:27 [redacted] sshd[1599565]: Failed password for [redacted] from 183.81.169.238 port 35192 ssh2
  Oct 3 00:19:28 [redacted] sshd[1599569]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=[redacted]
  Oct 3 00:19:30 [redacted] sshd[1599569]: Failed password for [redacted] from 183.81.169.238 port 35212 ssh2
  Oct 3 00:19:33 [redacted] sshd[1599573]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=[redacted]
  Oct 3 00:19:35 [redacted] sshd[1599573]: Failed password for [redacted] from 183.81.169.238 port 35244 ssh2
  ...

• Oct 3 00:19:22 hosting08 sshd[19590]: Failed password for root from 183.81.169.238 port 42208 ssh2
  Oct 3 00:19:26 hosting08 sshd[19594]: Failed password for root from 183.81.169.238 port 42218 ssh2
  ...

• 2024-10-02T05:39:05.632231+01:00 new-vm kernel: [495400.141292] [UFW BLOCK] IN=eth0 OUT= MAC=c6:1a:30:11:c3:71:fe:00:00:00:01:01:08:00 SRC=183.81.169.238 DST=178.62.105.126 LEN=40 TOS=0x00 PREC=0x00 TTL=249 ID=54321 PROTO=TCP SPT=36844 DPT=22 WINDOW=65535 RES=0x00 SYN URGP=0
  2024-10-02T13:13:37.113558+01:00 new-vm kernel: [522670.542640] [UFW BLOCK] IN=eth0 OUT= MAC=c6:1a:30:11:c3:71:fe:00:00:00:01:01:08:00 SRC=183.81.169.238 DST=178.62.105.126 LEN=40 TOS=0x00 PREC=0x00 TTL=249 ID=54321 PROTO=TCP SPT=33024 DPT=22 WINDOW=65535 RES=0x00 SYN URGP=0
  2024-10-02T14:27:08.689771+01:00 new-vm kernel: [527081.943996] [UFW BLOCK] IN=eth0 OUT= MAC=c6:1a:30:11:c3:71:fe:00:00:00:01:01:08:00 SRC=183.81.169.238 DST=178.62.105.126 LEN=40 TOS=0x00 PREC=0x00 TTL=249 ID=54321 PROTO=TCP SPT=39274 DPT=22 WINDOW=65535 RES=0x00 SYN URGP=0
  2024-10-02T20:23:19.994947+01:00 new-vm kernel: [548452.405936] [UFW BLOCK] IN=eth0 OUT= MAC=c6:1a:30:11:c3:71:fe:00:00:00:01:01:08:00 SRC=183.81.169.238 DST=178.62.105.
  ...

• Oct 2 16:17:31 mortgagebase sshd[13315]: Failed password for root from 183.81.169.238 port 43162 ssh2
  Oct 2 16:17:34 mortgagebase sshd[13319]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 16:17:36 mortgagebase sshd[13319]: Failed password for root from 183.81.169.238 port 43182 ssh2
  Oct 2 16:17:39 mortgagebase sshd[13321]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 16:17:42 mortgagebase sshd[13321]: Failed password for root from 183.81.169.238 port 40570 ssh2
  ...

• Oct 2 22:17:22 baguette sshd[11102]: Invalid user Antminer from 183.81.169.238 port 46546
  Oct 2 22:17:23 baguette sshd[11104]: Invalid user Antminer from 183.81.169.238 port 46552
  Oct 2 22:17:33 baguette sshd[11116]: Invalid user admin from 183.81.169.238 port 33640
  ...

• 183.81.169.238 (183.81.169.238) - SSH Brute force:
  Oct 3 01:17:20 XWEB sshd[11947]: Failed password for root from 183.81.169.238 port 58552 ssh2
  Oct 3 01:17:25 XWEB sshd[11949]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 01:17:26 XWEB sshd[11949]: Failed password for root from 183.81.169.238 port 58578 ssh2
  ...

• Oct 3 00:17:04 dsh1621 sshd[3815779]: Failed password for root from 183.81.169.238 port 47030 ssh2
  Oct 3 00:17:06 dsh1621 sshd[3815813]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 00:17:08 dsh1621 sshd[3815813]: Failed password for root from 183.81.169.238 port 35118 ssh2
  Oct 3 00:17:11 dsh1621 sshd[3815862]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 00:17:13 dsh1621 sshd[3815862]: Failed password for root from 183.81.169.238 port 35120 ssh2
  ...

• endlessh: 2024-10-03 00:16:36.783831704 2024-10-02T22:16:36.783Z CLOSE host=183.81.169.238 port=36880 fd=5 time=180.150 bytes=261
  ...

• Oct 2 22:13:39 scw-6657dc sshd[7835]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 22:13:39 scw-6657dc sshd[7835]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 22:13:41 scw-6657dc sshd[7835]: Failed password for root from 183.81.169.238 port 33938 ssh2
  ...

• [rede-168-134] 10/02/2024-19:13:41.290664, 183.81.169.238, Protocol: 6, ET COMPROMISED Known Compromised or Hostile Host Traffic group 13

• FW-PortScan: Traffic Blocked srcport=53234 dstport=22

• 2024-10-02T23:11:51.459963+01:00 hostvu2 sshd[680613]: Failed password for root from 183.81.169.238 port 47826 ssh2
  2024-10-02T23:11:53.716545+01:00 hostvu2 sshd[680615]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T23:11:55.273829+01:00 hostvu2 sshd[680615]: Failed password for root from 183.81.169.238 port 47834 ssh2
  2024-10-02T23:11:58.136995+01:00 hostvu2 sshd[680617]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T23:12:00.381342+01:00 hostvu2 sshd[680617]: Failed password for root from 183.81.169.238 port 32836 ssh2
  ...

• Oct 3 00:11:01 Servo sshd[3193002]: Invalid user Antminer from 183.81.169.238 port 34272
  Oct 3 00:11:03 Servo sshd[3193006]: Invalid user Antminer from 183.81.169.238 port 34276
  Oct 3 00:11:14 Servo sshd[3193281]: Invalid user admin from 183.81.169.238 port 33508
  ...

• Oct 2 22:10:48 s158416 sshd[2489953]: Failed password for root from 183.81.169.238 port 57732 ssh2
  Oct 2 22:10:53 s158416 sshd[2489960]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 22:10:54 s158416 sshd[2489960]: Failed password for root from 183.81.169.238 port 57762 ssh2
  Oct 2 22:10:59 s158416 sshd[2489962]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 22:11:00 s158416 sshd[2489962]: Failed password for root from 183.81.169.238 port 48818 ssh2
  ...

• 2024-10-03T00:10:24.686498+02:00 khatuna sshd[681151]: Failed password for root from 183.81.169.238 port 39406 ssh2
  2024-10-03T00:10:28.156123+02:00 khatuna sshd[681175]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T00:10:30.042437+02:00 khatuna sshd[681175]: Failed password for root from 183.81.169.238 port 47206 ssh2
  2024-10-03T00:10:32.983381+02:00 khatuna sshd[681199]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T00:10:35.085379+02:00 khatuna sshd[681199]: Failed password for root from 183.81.169.238 port 47216 ssh2
  ...

• Oct 2 22:10:17 VPS sshd[1707345]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 22:10:18 VPS sshd[1707345]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 22:10:17 VPS sshd[1707345]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 22:10:20 VPS sshd[1707345]: Failed password for invalid user root from 183.81.169.238 port 33366 ssh2
  Oct 2 22:10:23 VPS sshd[1707352]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  ...

• Oct 2 23:06:52 s1-jellyfish sshd[2837030]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 23:06:53 s1-jellyfish sshd[2837030]: Failed password for root from 183.81.169.238 port 47134 ssh2
  ...

• 2024-10-03T07:06:29.552965 mustar-kr-miso sshd[1455966]: Failed password for root from 183.81.169.238 port 48676 ssh2
  2024-10-03T07:06:34.501295 mustar-kr-miso sshd[1455969]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T07:06:35.932031 mustar-kr-miso sshd[1455969]: Failed password for root from 183.81.169.238 port 48684 ssh2
  2024-10-03T07:06:39.070850 mustar-kr-miso sshd[1455972]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T07:06:40.853406 mustar-kr-miso sshd[1455972]: Failed password for root from 183.81.169.238 port 34628 ssh2
  ...

• 2024-10-02T22:05:03.823508+00:00 Linux11 sshd[2970105]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T22:05:06.096449+00:00 Linux11 sshd[2970105]: Failed password for root from 183.81.169.238 port 58412 ssh2
  2024-10-02T22:05:09.315706+00:00 Linux11 sshd[2970468]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T22:05:11.744344+00:00 Linux11 sshd[2970468]: Failed password for root from 183.81.169.238 port 51296 ssh2
  2024-10-02T22:05:14.676962+00:00 Linux11 sshd[2970863]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T22:05:16.458303+00:00 Linux11 sshd[2970863]: Failed password for root from 183.81.169.238 port 51330 ssh2
  2024-10-02T22:05:20.366696+00:00 Linux11 sshd[2971158]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= r
  ...

• Malicious activity detected. Unauthorized connection attempt: SSH..

• 2024-10-03T00:04:00.426537+02:00 docker sshd[1789891]: Failed password for root from 183.81.169.238 port 42666 ssh2
  2024-10-03T00:04:03.854396+02:00 docker sshd[1789903]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T00:04:06.222622+02:00 docker sshd[1789903]: Failed password for root from 183.81.169.238 port 42678 ssh2
  2024-10-03T00:04:09.170914+02:00 docker sshd[1789915]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T00:04:11.365175+02:00 docker sshd[1789915]: Failed password for root from 183.81.169.238 port 39872 ssh2
  ...

• Oct 3 01:03:44 hasankayra04 sshd[150755]: Failed password for root from 183.81.169.238 port 48992 ssh2
  Oct 3 01:03:47 hasankayra04 sshd[150757]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 01:03:48 hasankayra04 sshd[150757]: Failed password for root from 183.81.169.238 port 50464 ssh2
  Oct 3 01:03:52 hasankayra04 sshd[150760]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 01:03:54 hasankayra04 sshd[150760]: Failed password for root from 183.81.169.238 port 50490 ssh2
  ...

• Oct 2 18:03:53 us-mfl-01 sshd[2929138]: Invalid user Antminer from 183.81.169.238 port 53176
  ...

• tcp/22 (33 or more attempts)

• 2024-10-03T00:03:06.119120+02:00 v220240537442267460 sshd[1413843]: Failed password for root from 183.81.169.238 port 60844 ssh2
  2024-10-03T00:03:10.194471+02:00 v220240537442267460 sshd[1413851]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T00:03:11.950928+02:00 v220240537442267460 sshd[1413851]: Failed password for root from 183.81.169.238 port 34268 ssh2
  2024-10-03T00:03:14.884879+02:00 v220240537442267460 sshd[1413858]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T00:03:17.193377+02:00 v220240537442267460 sshd[1413858]: Failed password for root from 183.81.169.238 port 34278 ssh2
  ...

• Oct 3 00:02:43 * sshd[2087184]: Failed password for root from 183.81.169.238 port 53088 ssh2
  Oct 3 00:02:47 * sshd[2087189]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 00:02:48 * sshd[2087189]: Failed password for root from 183.81.169.238 port 39160 ssh2

• Oct 3 00:01:59 monitoring sshd[1339761]: Failed password for root from 183.81.169.238 port 59800 ssh2
  Oct 3 00:02:04 monitoring sshd[1339786]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 00:02:06 monitoring sshd[1339786]: Failed password for root from 183.81.169.238 port 59850 ssh2
  Oct 3 00:02:09 monitoring sshd[1339788]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 00:02:12 monitoring sshd[1339788]: Failed password for root from 183.81.169.238 port 37114 ssh2
  ...

• Oct 3 00:01:58 docker-01 sshd[170643]: Failed password for root from 183.81.169.238 port 50006 ssh2
  Oct 3 00:02:02 docker-01 sshd[170687]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 00:02:05 docker-01 sshd[170687]: Failed password for root from 183.81.169.238 port 50020 ssh2
  Oct 3 00:02:09 docker-01 sshd[170692]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 00:02:12 docker-01 sshd[170692]: Failed password for root from 183.81.169.238 port 48608 ssh2
  ...

• Ports: 22; 2 attempts

• Failed password for invalid user root from 183.81.169.238 port 43136 ssh2 using password '0' | Failed password for invalid user root from 183.81.169.238 port 43168 ssh2 using password 'eve' | Failed password for invalid user root from 183.81.169.238 port 43182 ssh2 using password 'root' | Failed password for invalid user root from 183.81.169.238 port 43182 ssh2 using password '' | Failed password for invalid user root from 183.81.169.238 port 43182 ssh2 using password '' | Failed password for invalid user root from 183.81.169.238 port 54582 ssh2 using password '0' | Failed password for invalid user root from 183.81.169.238 port 54592 ssh2 using password 'eve' | Failed password for invalid user root from 183.81.169.238 port 54600 ssh2 using password 'root' | Failed password for invalid user root from 183.81.169.238 port 54600 ssh2 using password '' | Failed password for invalid user root from 183.81.169.238 port 54600 ssh2 using password '' | Failed password for invalid user root from 183.81.169.238 port 51202

• Oct 2 18:00:23 www4 sshd[2000102]: Failed password for root from 183.81.169.238 port 48612 ssh2
  Oct 2 18:00:28 www4 sshd[2000107]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:00:29 www4 sshd[2000107]: Failed password for root from 183.81.169.238 port 55502 ssh2
  Oct 2 18:00:33 www4 sshd[2000118]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:00:35 www4 sshd[2000118]: Failed password for root from 183.81.169.238 port 55518 ssh2
  ...

• Oct 2 15:49:53 web2 sshd\[32252\]: Failed password for root from 183.81.169.238 port 56510 ssh2Oct 2 15:49:58 web2 sshd\[32254\]: Failed password for root from 183.81.169.238 port 38980 ssh2Oct 2 15:50:03 web2 sshd\[32256\]: Failed password for root from 183.81.169.238 port 39018 ssh2Oct 2 15:50:08 web2 sshd\[32258\]: Failed password for root from 183.81.169.238 port 40054 ssh2Oct 2 15:50:12 web2 sshd\[32260\]: Failed password for root from 183.81.169.238 port 40088 ssh2Oct 2 15:50:17 web2 sshd\[32262\]: Failed password for root from 183.81.169.238 port 36574 ssh2
  ...

• Oct 3 00:59:59 localhost sshd[1319053]: Failed password for root from 183.81.169.238 port 42760 ssh2
  Oct 3 01:00:03 localhost sshd[1319066]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 01:00:05 localhost sshd[1319066]: Failed password for root from 183.81.169.238 port 42796 ssh2
  Oct 3 01:00:08 localhost sshd[1319077]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 01:00:10 localhost sshd[1319077]: Failed password for root from 183.81.169.238 port 47168 ssh2
  ...

• Attempted connection to SSH tarpit

• Oct 2 21:59:31 lavalink sshd[3251084]: Invalid user Antminer from 183.81.169.238 port 33082
  Oct 2 21:59:33 lavalink sshd[3251122]: Invalid user Antminer from 183.81.169.238 port 33086
  Oct 2 21:59:47 lavalink sshd[3251152]: Invalid user admin from 183.81.169.238 port 45120
  ...

• Oct 3 04:59:00 honeypot sshd[7073]: Failed password for root from 183.81.169.238 port 37422 ssh2
  ...

• Oct 2 21:58:18 mark sshd[2598859]: Failed password for root from 183.81.169.238 port 40314 ssh2
  Oct 2 21:58:21 mark sshd[2599335]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 21:58:24 mark sshd[2599335]: Failed password for root from 183.81.169.238 port 40350 ssh2
  Oct 2 21:58:28 mark sshd[2600285]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 21:58:30 mark sshd[2600285]: Failed password for root from 183.81.169.238 port 42530 ssh2
  ...

• 2024-10-02T18:57:03.142116-03:00 dns1 sshd[18104]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T18:57:05.385042-03:00 dns1 sshd[18104]: Failed password for root from 183.81.169.238 port 58712 ssh2
  2024-10-02T18:57:06.195579-03:00 dns1 sshd[18104]: Connection closed by authenticating user root 183.81.169.238 port 58712 [preauth]
  2024-10-02T18:57:09.516563-03:00 dns1 sshd[18106]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T18:57:10.717273-03:00 dns1 sshd[18106]: Failed password for root from 183.81.169.238 port 49930 ssh2

• [21:56] Attempted SSH login on port 22 with credentials root:0

• 2024-10-02 16:54:40.908469-0500 localhost sshd[10410]: Failed password for root from 183.81.169.238 port 39004 ssh2

• Oct 2 23:54:55 spotterlog sshd[447315]: Invalid user Antminer from 183.81.169.238 port 43332
  Oct 2 23:54:57 spotterlog sshd[447317]: Invalid user Antminer from 183.81.169.238 port 54466
  Oct 2 23:55:06 spotterlog sshd[447332]: Invalid user admin from 183.81.169.238 port 48090
  ...

• Oct 2 22:54:05 dev sshd[66275]: Failed password for root from 183.81.169.238 port 33168 ssh2
  Oct 2 22:54:08 dev sshd[66277]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 22:54:10 dev sshd[66277]: Failed password for root from 183.81.169.238 port 58894 ssh2
  Oct 2 22:54:12 dev sshd[66279]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 22:54:14 dev sshd[66279]: Failed password for root from 183.81.169.238 port 58912 ssh2
  ...

• Oct 2 23:53:52 v2202301167543214332 sshd[2965877]: Failed password for root from 183.81.169.238 port 34560 ssh2
  Oct 2 23:53:55 v2202301167543214332 sshd[2965879]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 23:53:58 v2202301167543214332 sshd[2965879]: Failed password for root from 183.81.169.238 port 34568 ssh2
  Oct 2 23:54:01 v2202301167543214332 sshd[2965881]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 23:54:03 v2202301167543214332 sshd[2965881]: Failed password for root from 183.81.169.238 port 33870 ssh2
  ...

• Oct 2 21:53:23 alpha sshd[2368009]: Failed password for root from 183.81.169.238 port 33692 ssh2
  Oct 2 21:53:27 alpha sshd[2368063]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 21:53:29 alpha sshd[2368063]: Failed password for root from 183.81.169.238 port 37352 ssh2
  Oct 2 21:53:32 alpha sshd[2368103]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 21:53:34 alpha sshd[2368103]: Failed password for root from 183.81.169.238 port 37366 ssh2
  ...

• Oct 2 23:49:56 mail sshd[698161]: Failed password for root from 183.81.169.238 port 60664 ssh2
  Oct 2 23:50:00 mail sshd[698193]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 23:50:02 mail sshd[698193]: Failed password for root from 183.81.169.238 port 34478 ssh2
  ...

• 2024-10-02T22:49:10.420201+01:00 jane sshd[3589052]: Failed password for root from 183.81.169.238 port 37320 ssh2
  2024-10-02T22:49:14.607714+01:00 jane sshd[3589167]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T22:49:17.267328+01:00 jane sshd[3589167]: Failed password for root from 183.81.169.238 port 37362 ssh2
  ...

• Oct 2 21:48:39 xproot sshd[2020564]: Failed password for root from 183.81.169.238 port 52638 ssh2
  Oct 2 21:48:44 xproot sshd[2020566]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 21:48:47 xproot sshd[2020566]: Failed password for root from 183.81.169.238 port 52676 ssh2
  Oct 2 21:48:51 xproot sshd[2020568]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 21:48:53 xproot sshd[2020568]: Failed password for root from 183.81.169.238 port 33064 ssh2
  ...

• Oct 2 21:46:05 ubuntu sshd[1113922]: Invalid user Antminer from 183.81.169.238 port 42254
  Oct 2 21:46:07 ubuntu sshd[1113931]: Invalid user Antminer from 183.81.169.238 port 42268
  Oct 2 21:46:18 ubuntu sshd[1114135]: Invalid user admin from 183.81.169.238 port 35928
  ...

• Oct 2 21:45:51 ice2 sshd[1963919]: Invalid user Antminer from 183.81.169.238 port 40486
  Oct 2 21:45:53 ice2 sshd[1963921]: Invalid user Antminer from 183.81.169.238 port 40498
  ...

• 2024-10-02 14:45:50,720 fail2ban.actions [689]: NOTICE [sshd] Ban 183.81.169.238

• [rede-176-124] 10/02/2024-18:45:00.023968, 183.81.169.238, Protocol: 6, ET COMPROMISED Known Compromised or Hostile Host Traffic group 13

• Oct 2 23:44:43 gateway1-old sshd[933]: Failed password for root from 183.81.169.238 port 46150 ssh2
  Oct 2 23:44:48 gateway1-old sshd[1196]: Failed password for root from 183.81.169.238 port 46200 ssh2

• 2024-10-02T14:44:30.179422 web sshd[353709]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T14:44:32.852978 web sshd[353709]: Failed password for root from 183.81.169.238 port 41430 ssh2
  ...

• 2024-10-02T21:43:43.616906+00:00 mail sshd[928386]: Invalid user Antminer from 183.81.169.238 port 39140
  2024-10-02T21:43:45.528456+00:00 mail sshd[928388]: Invalid user Antminer from 183.81.169.238 port 53384
  2024-10-02T21:43:56.738864+00:00 mail sshd[928400]: Invalid user admin from 183.81.169.238 port 49076
  ...

• 2024-10-02T21:43:23.286103 EUR sshd[1144]: Invalid user Antminer from 183.81.169.238 port 46616
  2024-10-02T21:43:25.668318 EUR sshd[1146]: Invalid user Antminer from 183.81.169.238 port 48430
  2024-10-02T21:43:39.351473 EUR sshd[1158]: Invalid user admin from 183.81.169.238 port 44092
  ...

• Oct 2 21:43:21 Proxmox-VE sshd[99726]: Failed password for root from 183.81.169.238 port 58644 ssh2
  Oct 2 21:43:25 Proxmox-VE sshd[99750]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 21:43:27 Proxmox-VE sshd[99750]: Failed password for root from 183.81.169.238 port 58668 ssh2
  Oct 2 21:43:30 Proxmox-VE sshd[99769]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 21:43:33 Proxmox-VE sshd[99769]: Failed password for root from 183.81.169.238 port 46438 ssh2
  ...

• Oct 2 21:42:16 localhost sshd[2300151]: Failed password for root from 183.81.169.238 port 54026 ssh2
  Oct 2 21:42:19 localhost sshd[2300154]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 21:42:22 localhost sshd[2300154]: Failed password for root from 183.81.169.238 port 53744 ssh2
  Oct 2 21:42:26 localhost sshd[2300156]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 21:42:28 localhost sshd[2300156]: Failed password for root from 183.81.169.238 port 39120 ssh2
  ...

• Oct 3 00:41:15 vds-100908 sshd[68791]: Failed password for root from 183.81.169.238 port 51804 ssh2
  Oct 3 00:41:18 vds-100908 sshd[68793]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 00:41:20 vds-100908 sshd[68793]: Failed password for root from 183.81.169.238 port 42716 ssh2
  Oct 3 00:41:24 vds-100908 sshd[68795]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 00:41:26 vds-100908 sshd[68795]: Failed password for root from 183.81.169.238 port 48058 ssh2
  ...

• Oct 2 23:40:33 odin sshd[7365]: Failed password for root from 183.81.169.238 port 54544 ssh2
  Oct 2 23:40:39 odin sshd[7370]: Failed password for root from 183.81.169.238 port 45374 ssh2

• FW-PortScan: Traffic Blocked srcport=49647 dstport=22

• Oct 2 21:37:56 vps-d7931dc8 sshd[471349]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 21:37:58 vps-d7931dc8 sshd[471349]: Failed password for root from 183.81.169.238 port 50286 ssh2
  Oct 2 21:37:59 vps-d7931dc8 sshd[471349]: Connection closed by authenticating user root 183.81.169.238 port 50286 [preauth]
  Oct 2 21:38:02 vps-d7931dc8 sshd[471351]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 21:38:03 vps-d7931dc8 sshd[471351]: Failed password for root from 183.81.169.238 port 50316 ssh2

• Oct 2 21:37:39 mail sshd[207260]: Failed password for root from 183.81.169.238 port 33044 ssh2
  Oct 2 21:37:43 mail sshd[207262]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 21:37:46 mail sshd[207262]: Failed password for root from 183.81.169.238 port 33132 ssh2
  ...

• 2024-10-02T23:36:55.255021+02:00 nc1.motyka.pro sshd[1961043]: Failed password for root from 183.81.169.238 port 37764 ssh2
  2024-10-02T23:36:57.697512+02:00 nc1.motyka.pro sshd[1961100]: Failed password for root from 183.81.169.238 port 39564 ssh2
  2024-10-02T23:36:59.862754+02:00 nc1.motyka.pro sshd[1961211]: Failed password for root from 183.81.169.238 port 39584 ssh2
  2024-10-02T23:37:02.521220+02:00 nc1.motyka.pro sshd[1961244]: Failed password for root from 183.81.169.238 port 39592 ssh2
  2024-10-02T23:37:04.229612+02:00 nc1.motyka.pro sshd[1961374]: Failed password for root from 183.81.169.238 port 39614 ssh2
  ...

• Oct 3 00:36:37 server2 sshd\[424\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 00:36:39 server2 sshd\[428\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 00:36:40 server2 sshd\[430\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 00:36:42 server2 sshd\[436\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 00:36:44 server2 sshd\[438\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 3 00:36:45 server2 sshd\[440\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers

• 2024-10-02T23:36:37.964856online4.bobelweb.eu sshd[4419]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-02T23:36:39.424040online4.bobelweb.eu sshd[4421]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-02T23:36:41.409849online4.bobelweb.eu sshd[4423]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-02T23:36:43.818954online4.bobelweb.eu sshd[4425]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-02T23:36:45.304056online4.bobelweb.eu sshd[4428]: User root from 183.81.169.238 not allowed because not listed in AllowUsers

• Oct 2 17:36:12 scp sshd[2573231]: Invalid user Antminer from 183.81.169.238 port 60872
  Oct 2 17:36:14 scp sshd[2573290]: Invalid user Antminer from 183.81.169.238 port 60876
  Oct 2 17:36:28 scp sshd[2573668]: Invalid user admin from 183.81.169.238 port 54682
  ...

• 2024-10-02T23:36:03.095420+02:00 mail sshd[625128]: Failed password for root from 183.81.169.238 port 36156 ssh2
  2024-10-02T23:36:08.623371+02:00 mail sshd[625148]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T23:36:10.037533+02:00 mail sshd[625148]: Failed password for root from 183.81.169.238 port 34574 ssh2
  2024-10-02T23:36:15.038312+02:00 mail sshd[625151]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T23:36:16.949514+02:00 mail sshd[625151]: Failed password for root from 183.81.169.238 port 34628 ssh2
  ...

• Oct 2 21:35:58 vps-9 sshd[943644]: Failed password for root from 183.81.169.238 port 44248 ssh2
  Oct 2 21:36:02 vps-9 sshd[943657]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 21:36:05 vps-9 sshd[943657]: Failed password for root from 183.81.169.238 port 44268 ssh2
  ...

• Oct 2 17:35:09 us-mfl-02 sshd[2484075]: Invalid user Antminer from 183.81.169.238 port 35686
  ...

• Oct 2 17:34:57 sputnik sshd[93580]: Invalid user Antminer from 183.81.169.238 port 48664
  Oct 2 17:35:00 sputnik sshd[93986]: Invalid user Antminer from 183.81.169.238 port 48678
  Oct 2 17:35:14 sputnik sshd[98374]: Invalid user admin from 183.81.169.238 port 58872
  ...

• [21:33] Attempted SSH login on port 22 with credentials root:0

• 2024-10-02T17:32:42.860499-04:00 behemoth sshd[3975374]: Invalid user Antminer from 183.81.169.238 port 56598
  ...

• Failed password for root from 183.81.169.238 port 33386 ssh2
  pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Failed password for root from 183.81.169.238 port 33436 ssh2
  pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Failed password for root from 183.81.169.238 port 50226 ssh2

• Oct 2 23:32:23 C1D543E sshd[767237]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 23:32:24 C1D543E sshd[767237]: Failed password for invalid user root from 183.81.169.238 port 47952 ssh2
  Oct 2 23:32:26 C1D543E sshd[767239]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 23:32:26 C1D543E sshd[767239]: Failed password for invalid user root from 183.81.169.238 port 58412 ssh2
  Oct 2 23:32:28 C1D543E sshd[767241]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  ...

• Events: TCP SYN Discovery or Flooding, Seen 134 times in the last 10800 seconds

• Oct 2 21:31:30 DuoX sshd[2585533]: Failed password for root from 183.81.169.238 port 46706 ssh2
  Oct 2 21:31:35 DuoX sshd[2588451]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 21:31:36 DuoX sshd[2588451]: Failed password for root from 183.81.169.238 port 46720 ssh2
  Oct 2 21:31:40 DuoX sshd[2589922]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 21:31:41 DuoX sshd[2589922]: Failed password for root from 183.81.169.238 port 55580 ssh2
  ...

• 2024-10-02T21:28:52.393361+00:00 Linux06 sshd[2873137]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T21:28:54.290615+00:00 Linux06 sshd[2873137]: Failed password for root from 183.81.169.238 port 45160 ssh2
  2024-10-02T21:28:57.124746+00:00 Linux06 sshd[2873413]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T21:28:59.041117+00:00 Linux06 sshd[2873413]: Failed password for root from 183.81.169.238 port 48622 ssh2
  2024-10-02T21:29:01.436803+00:00 Linux06 sshd[2873766]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T21:29:03.234203+00:00 Linux06 sshd[2873766]: Failed password for root from 183.81.169.238 port 48650 ssh2
  2024-10-02T21:29:05.894338+00:00 Linux06 sshd[2873989]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= r
  ...

• 2024-10-02 18:53:47 UTC Unauthorized activity to TCP port 22. SSH

• 2024-10-02T21:30:11.003097shield sshd\[16331\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T21:30:12.608142shield sshd\[16331\]: Failed password for root from 183.81.169.238 port 43922 ssh2
  2024-10-02T21:30:15.466970shield sshd\[16342\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T21:30:17.423071shield sshd\[16342\]: Failed password for root from 183.81.169.238 port 43958 ssh2
  2024-10-02T21:30:20.147248shield sshd\[16344\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root

• Oct 2 17:29:50 fremontnet-scca-01 sshd[15330]: Failed password for root from 183.81.169.238 port 44330 ssh2
  Oct 2 17:29:55 fremontnet-scca-01 sshd[15332]: Failed password for root from 183.81.169.238 port 44350 ssh2

• 2024-10-02T23:25:09.077889+02:00 PWS-PM-WEB01 sshd[3279389]: Failed password for root from 183.81.169.238 port 60236 ssh2
  2024-10-02T23:25:12.474635+02:00 PWS-PM-WEB01 sshd[3279396]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T23:25:14.838446+02:00 PWS-PM-WEB01 sshd[3279396]: Failed password for root from 183.81.169.238 port 60256 ssh2
  ...

• FW-PortScan: Traffic Blocked srcport=49016 dstport=22

• 2024-10-02T23:24:47.056345 prodgateway sshd[60308]: Failed password for root from 183.81.169.238 port 47914 ssh2
  2024-10-02T23:24:51.460088 prodgateway sshd[60311]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T23:24:53.940098 prodgateway sshd[60311]: Failed password for root from 183.81.169.238 port 40920 ssh2
  ...

• Oct 2 23:23:28 v4940 sshd[3989762]: Failed password for root from 183.81.169.238 port 44458 ssh2
  Oct 2 23:23:33 v4940 sshd[3989764]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 23:23:35 v4940 sshd[3989764]: Failed password for root from 183.81.169.238 port 44514 ssh2
  ...

• 2024-10-02T23:23:16.046075+02:00 pokevador sshd[438169]: Failed password for root from 183.81.169.238 port 50574 ssh2
  2024-10-02T23:23:18.695887+02:00 pokevador sshd[438206]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T23:23:20.407116+02:00 pokevador sshd[438206]: Failed password for root from 183.81.169.238 port 54068 ssh2
  ...

• Oct 2 21:22:47 web8 sshd\[31768\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 21:22:49 web8 sshd\[31768\]: Failed password for root from 183.81.169.238 port 48432 ssh2
  Oct 2 21:22:52 web8 sshd\[31829\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 21:22:54 web8 sshd\[31829\]: Failed password for root from 183.81.169.238 port 48446 ssh2
  Oct 2 21:22:57 web8 sshd\[31837\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root

• Oct 2 23:22:37 arayat sshd[4114]: Failed password for root from 183.81.169.238 port 60220 ssh2
  Oct 2 23:22:40 arayat sshd[4116]: Failed password for root from 183.81.169.238 port 60240 ssh2
  Oct 2 23:22:42 arayat sshd[4124]: Failed password for root from 183.81.169.238 port 60276 ssh2
  Oct 2 23:22:45 arayat sshd[4274]: Failed password for root from 183.81.169.238 port 60296 ssh2
  ...

• 2024-10-02T23:22:00.379655+02:00 pve sshd[2921838]: Failed password for root from 183.81.169.238 port 39050 ssh2
  2024-10-02T23:22:03.792136+02:00 pve sshd[2922351]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T23:22:05.875105+02:00 pve sshd[2922351]: Failed password for root from 183.81.169.238 port 39100 ssh2
  2024-10-02T23:22:08.151117+02:00 pve sshd[2922527]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T23:22:10.254089+02:00 pve sshd[2922527]: Failed password for root from 183.81.169.238 port 58330 ssh2
  ...

• Oct 3 08:21:55 electronicohost sshd[2359451]: Failed password for root from 183.81.169.238 port 54652 ssh2
  Oct 3 08:21:59 electronicohost sshd[2359462]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 08:22:00 electronicohost sshd[2359462]: Failed password for root from 183.81.169.238 port 33546 ssh2
  Oct 3 08:22:04 electronicohost sshd[2359476]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 08:22:05 electronicohost sshd[2359476]: Failed password for root from 183.81.169.238 port 33570 ssh2

• 2024-10-02T21:20:47.443599+00:00 mail-backup sshd[56931]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-02T21:20:49.294212+00:00 mail-backup sshd[56933]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-02T21:20:51.678585+00:00 mail-backup sshd[56935]: User root from 183.81.169.238 not allowed because not listed in AllowUsers

• 183.81.169.238 (MN/Mongolia/-), 5 distributed sshd attacks on account [root] in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_DISTATTACK; Logs: Oct 2 17:20:45 server2 sshd[4823]: Failed password for root from 183.81.169.238 port 43682 ssh2
  Oct 2 17:20:30 server2 sshd[4687]: Failed password for root from 122.166.49.42 port 59536 ssh2
  Oct 2 17:20:38 server2 sshd[4800]: Failed password for root from 202.29.229.132 port 47291 ssh2
  Oct 2 17:20:07 server2 sshd[4560]: Failed password for root from 196.188.59.130 port 48638 ssh2
  Oct 2 17:20:24 server2 sshd[4664]: Failed password for root from 59.63.211.229 port 38880 ssh2
  
  IP Addresses Blocked:

• Oct 2 23:20:36 server sshd[1319435]: Failed password for root from 183.81.169.238 port 42986 ssh2
  Oct 2 23:20:40 server sshd[1319439]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 23:20:42 server sshd[1319439]: Failed password for root from 183.81.169.238 port 40748 ssh2
  Oct 2 23:20:45 server sshd[1319441]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 23:20:47 server sshd[1319441]: Failed password for root from 183.81.169.238 port 40760 ssh2
  ...

• Oct 2 23:20:24 hosting sshd[2563633]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 23:20:25 hosting sshd[2563633]: Failed password for root from 183.81.169.238 port 58280 ssh2
  Oct 2 23:20:29 hosting sshd[2563647]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 23:20:30 hosting sshd[2563647]: Failed password for root from 183.81.169.238 port 40128 ssh2

• Oct 2 21:20:00 mlat sshd[3087309]: Failed password for root from 183.81.169.238 port 46800 ssh2
  Oct 2 21:20:04 mlat sshd[3087320]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 21:20:06 mlat sshd[3087320]: Failed password for root from 183.81.169.238 port 46820 ssh2
  ... azuremlat

• SSH Bruteforce Attempt (failed auth)

• 2024-10-02T23:19:13.464448+02:00 nc3.motyka.pro sshd[354005]: Failed password for root from 183.81.169.238 port 54414 ssh2
  2024-10-02T23:19:16.008785+02:00 nc3.motyka.pro sshd[354100]: Failed password for root from 183.81.169.238 port 54420 ssh2
  2024-10-02T23:19:18.324177+02:00 nc3.motyka.pro sshd[354183]: Failed password for root from 183.81.169.238 port 37556 ssh2
  2024-10-02T23:19:20.243422+02:00 nc3.motyka.pro sshd[354266]: Failed password for root from 183.81.169.238 port 37568 ssh2
  2024-10-02T23:19:22.834950+02:00 nc3.motyka.pro sshd[354318]: Failed password for root from 183.81.169.238 port 37578 ssh2
  ...

• Oct 2 23:18:48 vmi440488 sshd[3503243]: Failed password for root from 183.81.169.238 port 51416 ssh2
  Oct 2 23:18:52 vmi440488 sshd[3503248]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 23:18:54 vmi440488 sshd[3503248]: Failed password for root from 183.81.169.238 port 51472 ssh2
  Oct 2 23:18:57 vmi440488 sshd[3503256]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 23:19:00 vmi440488 sshd[3503256]: Failed password for root from 183.81.169.238 port 34804 ssh2
  ...

• Unauthorized connection attempt detected from IP address 183.81.169.238 to port 22 (ger-03) [c]

• Oct 2 23:18:52 unifi sshd[744340]: Failed password for root from 183.81.169.238 port 58020 ssh2
  Oct 2 23:18:55 unifi sshd[744342]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 23:18:56 unifi sshd[744342]: Failed password for root from 183.81.169.238 port 38314 ssh2
  Oct 2 23:18:58 unifi sshd[744344]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 23:19:00 unifi sshd[744344]: Failed password for root from 183.81.169.238 port 38344 ssh2
  ...

• Oct 2 23:18:17 plesk sshd[14607]: Failed password for root from 183.81.169.238 port 36424 ssh2
  Oct 2 23:18:19 plesk sshd[14621]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 23:18:21 plesk sshd[14621]: Failed password for root from 183.81.169.238 port 36468 ssh2
  Oct 2 23:18:23 plesk sshd[14635]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 23:18:24 plesk sshd[14635]: Failed password for root from 183.81.169.238 port 36488 ssh2

• SSH port scan (Tarpitted for 2m40s, wasted 272B)

• 2024-10-02T23:16:46.248439+02:00 sasrv sshd[3463]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-02T23:16:47.459794+02:00 sasrv sshd[3465]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-02T23:16:49.722847+02:00 sasrv sshd[3467]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-02T23:16:51.914726+02:00 sasrv sshd[3469]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-02T23:16:53.086653+02:00 sasrv sshd[3471]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  ...

• Oct 2 23:16:49 javastart sshd[3971678]: Failed password for root from 183.81.169.238 port 39560 ssh2
  Oct 2 23:16:51 javastart sshd[3971680]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 23:16:53 javastart sshd[3971680]: Failed password for root from 183.81.169.238 port 39588 ssh2
  Oct 2 23:16:56 javastart sshd[3971699]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 23:16:59 javastart sshd[3971699]: Failed password for root from 183.81.169.238 port 57800 ssh2
  ...

• Oct 2 21:16:48 ns5024002 sshd[1737116]: Failed password for root from 183.81.169.238 port 52670 ssh2
  Oct 2 21:16:52 ns5024002 sshd[1737257]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 21:16:53 ns5024002 sshd[1737257]: Failed password for root from 183.81.169.238 port 54362 ssh2
  Oct 2 21:16:57 ns5024002 sshd[1737488]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 21:16:59 ns5024002 sshd[1737488]: Failed password for root from 183.81.169.238 port 39516 ssh2
  ...

• Oct 3 00:16:40 www sshd\[55853\]: Failed password for root from 183.81.169.238 port 49132 ssh2Oct 3 00:16:44 www sshd\[55855\]: Failed password for root from 183.81.169.238 port 49144 ssh2Oct 3 00:16:48 www sshd\[55857\]: Failed password for root from 183.81.169.238 port 56154 ssh2
  ...

• Oct 2 23:15:55 vmi147057 sshd[810206]: Failed password for root from 183.81.169.238 port 41680 ssh2
  Oct 2 23:15:58 vmi147057 sshd[810224]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 23:15:59 vmi147057 sshd[810224]: Failed password for root from 183.81.169.238 port 53478 ssh2
  Oct 2 23:16:02 vmi147057 sshd[810243]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 23:16:05 vmi147057 sshd[810243]: Failed password for root from 183.81.169.238 port 53492 ssh2
  ...

• 2024-10-02T21:15:59.287396+00:00 ubuntu sshd[1500286]: Invalid user Antminer from 183.81.169.238 port 32998
  2024-10-02T21:16:01.520656+00:00 ubuntu sshd[1500288]: Invalid user Antminer from 183.81.169.238 port 33018
  ...

• Oct 2 18:14:37 SRC=183.81.169.238 PROTO=TCP SPT=53337 DPT=22 SYN
  ...

• 2024-10-02T23:13:24.993154+02:00 Linux14 sshd[3613004]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T23:13:27.160746+02:00 Linux14 sshd[3613004]: Failed password for root from 183.81.169.238 port 38316 ssh2
  2024-10-02T23:13:30.919904+02:00 Linux14 sshd[3613297]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T23:13:33.243424+02:00 Linux14 sshd[3613297]: Failed password for root from 183.81.169.238 port 51588 ssh2
  2024-10-02T23:13:36.527649+02:00 Linux14 sshd[3613671]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T23:13:38.674819+02:00 Linux14 sshd[3613671]: Failed password for root from 183.81.169.238 port 53760 ssh2
  2024-10-02T23:13:42.150005+02:00 Linux14 sshd[3614057]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= r
  ...

• 2024-10-02T23:12:50.681095vmi1671272.contaboserver.net sshd[3932693]: Failed password for root from 183.81.169.238 port 33688 ssh2
  2024-10-02T23:12:54.063118vmi1671272.contaboserver.net sshd[3932695]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T23:12:56.114383vmi1671272.contaboserver.net sshd[3932695]: Failed password for root from 183.81.169.238 port 33714 ssh2
  2024-10-02T23:12:59.518459vmi1671272.contaboserver.net sshd[3932697]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T23:13:01.586724vmi1671272.contaboserver.net sshd[3932697]: Failed password for root from 183.81.169.238 port 40980 ssh2

• 2024-10-02T23:12:45.314895+02:00 rpi4 sshd[15384]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T23:12:47.127268+02:00 rpi4 sshd[15384]: Failed password for root from 183.81.169.238 port 51540 ssh2
  ...

• Inteceptor Intrusion Detector: failed_password on sshd module PID: (1010434)

• Oct 2 23:11:35 ts-24 sshd[380142]: Failed password for root from 183.81.169.238 port 44728 ssh2
  Oct 2 23:11:39 ts-24 sshd[380149]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 23:11:40 ts-24 sshd[380149]: Failed password for root from 183.81.169.238 port 33464 ssh2
  Oct 2 23:11:44 ts-24 sshd[380155]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 23:11:46 ts-24 sshd[380155]: Failed password for root from 183.81.169.238 port 33490 ssh2
  ...

• Oct 2 14:11:01 nunnother sshd\[32503\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 14:11:03 nunnother sshd\[32503\]: Failed password for root from 183.81.169.238 port 48140 ssh2
  Oct 2 14:11:05 nunnother sshd\[32505\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 14:11:07 nunnother sshd\[32505\]: Failed password for root from 183.81.169.238 port 56626 ssh2
  Oct 2 14:11:10 nunnother sshd\[32507\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  ...

• 2024-10-02T23:10:05.605442+02:00 vmi985635.contaboserver.net sshd[2355949]: Failed password for root from 183.81.169.238 port 39524 ssh2
  2024-10-02T23:10:08.934481+02:00 vmi985635.contaboserver.net sshd[2355975]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T23:10:11.122186+02:00 vmi985635.contaboserver.net sshd[2355975]: Failed password for root from 183.81.169.238 port 37370 ssh2
  2024-10-02T23:10:14.292547+02:00 vmi985635.contaboserver.net sshd[2356001]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T23:10:16.294230+02:00 vmi985635.contaboserver.net sshd[2356001]: Failed password for root from 183.81.169.238 port 37386 ssh2
  ...

• 3:12:47I1002 19:
  Fail2ban action triggered

• Oct 2 22:09:47 web3 sshd[1373722]: Failed password for root from 183.81.169.238 port 53888 ssh2
  Oct 2 22:09:51 web3 sshd[1373730]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 22:09:53 web3 sshd[1373730]: Failed password for root from 183.81.169.238 port 53916 ssh2
  Oct 2 22:09:56 web3 sshd[1373740]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 22:09:58 web3 sshd[1373740]: Failed password for root from 183.81.169.238 port 48750 ssh2

• [rede-164-29] 10/02/2024-18:09:06.373069, 183.81.169.238, Protocol: 6, ET COMPROMISED Known Compromised or Hostile Host Traffic group 13

• Oct 2 23:08:40 mx1 sshd[1991942]: Failed password for root from 183.81.169.238 port 56848 ssh2
  Oct 2 23:08:44 mx1 sshd[1991944]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 23:08:47 mx1 sshd[1991944]: Failed password for root from 183.81.169.238 port 56886 ssh2
  Oct 2 23:08:51 mx1 sshd[1991946]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 23:08:53 mx1 sshd[1991946]: Failed password for root from 183.81.169.238 port 42164 ssh2
  ...

• 2024-10-02T14:07:58.102520-07:00 pixelmemory sshd[173606]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T14:07:59.849597-07:00 pixelmemory sshd[173606]: Failed password for root from 183.81.169.238 port 34190 ssh2
  2024-10-02T14:08:03.534585-07:00 pixelmemory sshd[173609]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T14:08:05.632644-07:00 pixelmemory sshd[173609]: Failed password for root from 183.81.169.238 port 34218 ssh2
  ...

• Connection to SSHTarpit

• 2024-10-02T00:35:52.090098+0300
  ET COMPROMISED Known Compromised or Hostile Host Traffic group 12

• 2024-10-02T23:04:22.488433+02:00 hosting13 sshd[213965]: Failed password for root from 183.81.169.238 port 34282 ssh2
  2024-10-02T23:04:25.776824+02:00 hosting13 sshd[213969]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T23:04:27.950077+02:00 hosting13 sshd[213969]: Failed password for root from 183.81.169.238 port 43176 ssh2
  2024-10-02T23:04:30.406458+02:00 hosting13 sshd[213975]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T23:04:32.261946+02:00 hosting13 sshd[213975]: Failed password for root from 183.81.169.238 port 43212 ssh2
  ...

• Oct 2 21:04:17 cknpih001 sshd[30412]: Failed password for root from 183.81.169.238 port 59272 ssh2
  Oct 2 21:04:19 cknpih001 sshd[30414]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 21:04:21 cknpih001 sshd[30414]: Failed password for root from 183.81.169.238 port 40944 ssh2
  Oct 2 21:04:26 cknpih001 sshd[30416]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 21:04:27 cknpih001 sshd[30416]: Failed password for root from 183.81.169.238 port 59134 ssh2
  ...

• 2024-10-02T17:03:58.855095-04:00 prod-1 sshd[3422426]: Connection closed by authenticating user root 183.81.169.238 port 49130 [preauth]
  2024-10-02T17:04:01.186857-04:00 prod-1 sshd[3422429]: Connection closed by authenticating user root 183.81.169.238 port 49144 [preauth]
  2024-10-02T17:04:03.590514-04:00 prod-1 sshd[3422435]: Connection closed by authenticating user root 183.81.169.238 port 49172 [preauth]
  2024-10-02T17:04:05.816821-04:00 prod-1 sshd[3422445]: Connection closed by authenticating user root 183.81.169.238 port 49184 [preauth]
  2024-10-02T17:04:08.203649-04:00 prod-1 sshd[3422450]: Connection closed by authenticating user root 183.81.169.238 port 51280 [preauth]
  ...

• tcp/22 (41 or more attempts)

• 2024-10-02T21:02:19.249464+00:00 BAW-C01 sshd-session[404807]: Failed password for root from 183.81.169.238 port 43062 ssh2
  2024-10-02T21:02:23.948097+00:00 BAW-C01 sshd-session[404810]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T21:02:25.109774+00:00 BAW-C01 sshd-session[404810]: Failed password for root from 183.81.169.238 port 43072 ssh2
  2024-10-02T21:02:28.827391+00:00 BAW-C01 sshd-session[404813]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T21:02:30.578730+00:00 BAW-C01 sshd-session[404813]: Failed password for root from 183.81.169.238 port 60282 ssh2
  ...

• Oct 02 01:54:16 Failed password for invalid user root from 183.81.169.238 port 58504

• Oct 02 01:58:03 Failed password for invalid user root from 183.81.169.238 port 41056

• 2024-10-02T23:01:48.088818+02:00 Webserver sshd[695663]: Failed password for root from 183.81.169.238 port 59982 ssh2
  2024-10-02T23:01:50.534346+02:00 Webserver sshd[695665]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T23:01:52.095363+02:00 Webserver sshd[695665]: Failed password for root from 183.81.169.238 port 59992 ssh2
  2024-10-02T23:01:55.294027+02:00 Webserver sshd[695667]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T23:01:57.206541+02:00 Webserver sshd[695667]: Failed password for root from 183.81.169.238 port 60008 ssh2
  ...

• Oct 3 00:30:42 Digitalogic sshd[1262291]: Connection closed by authenticating user root 183.81.169.238 port 52712 [preauth]
  Oct 3 00:30:45 Digitalogic sshd[1262324]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 00:30:47 Digitalogic sshd[1262324]: Failed password for root from 183.81.169.238 port 52732 ssh2
  ...

• Oct 2 23:00:33 CT6942 sshd[259942]: Failed password for root from 183.81.169.238 port 51232 ssh2
  Oct 2 23:00:37 CT6942 sshd[259945]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 23:00:40 CT6942 sshd[259945]: Failed password for root from 183.81.169.238 port 51428 ssh2
  ...

• Oct 2 21:00:17 edge-ora-lhr01 sshd[1390146]: Invalid user Antminer from 183.81.169.238 port 60124
  Oct 2 21:00:19 edge-ora-lhr01 sshd[1390158]: Invalid user Antminer from 183.81.169.238 port 60138
  Oct 2 21:00:29 edge-ora-lhr01 sshd[1390231]: Invalid user admin from 183.81.169.238 port 35046
  ...

• Firewall IPS Detection on 02-10-2024 at 23:00:04

• [20:59] Tried to connect to SSH on port 22 but didn't have a valid header (port scanner?)

• FW-PortScan: Traffic Blocked srcport=34269 dstport=22

• 2024-10-02T20:57:01.504619+00:00 Linux100 sshd[519116]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T20:57:03.721245+00:00 Linux100 sshd[519116]: Failed password for root from 183.81.169.238 port 48320 ssh2
  2024-10-02T20:57:07.825379+00:00 Linux100 sshd[520685]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T20:57:09.865207+00:00 Linux100 sshd[520685]: Failed password for root from 183.81.169.238 port 36032 ssh2
  2024-10-02T20:57:13.550664+00:00 Linux100 sshd[522481]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T20:57:15.749185+00:00 Linux100 sshd[522481]: Failed password for root from 183.81.169.238 port 36070 ssh2
  2024-10-02T20:57:19.200746+00:00 Linux100 sshd[524142]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= r
  ...

• 2024-10-02T16:56:02.543063-04:00 collabhost.computernewb.com sshd-session[3672012]: Invalid user Antminer from 183.81.169.238 port 47068
  2024-10-02T16:56:05.002125-04:00 collabhost.computernewb.com sshd-session[3672014]: Invalid user Antminer from 183.81.169.238 port 47106
  2024-10-02T16:56:19.223105-04:00 collabhost.computernewb.com sshd-session[3672059]: Invalid user admin from 183.81.169.238 port 40774
  ...

• Oct 2 20:55:33 c2 sshd[2030948]: Failed password for root from 183.81.169.238 port 35464 ssh2
  Oct 2 20:55:36 c2 sshd[2030952]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 20:55:38 c2 sshd[2030952]: Failed password for root from 183.81.169.238 port 47512 ssh2
  Oct 2 20:55:42 c2 sshd[2030958]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 20:55:44 c2 sshd[2030958]: Failed password for root from 183.81.169.238 port 47540 ssh2
  ...

• Oct 2 17:55:22 SRC=183.81.169.238 PROTO=TCP SPT=47727 DPT=22 SYN
  ...

• list.rtbh.com.tr report: tcp/22

• I1002 22:54:02.544700 1 client.go:99] CLOSE host=183.81.169.238 port=53144 time=107.937498545 bytes=274
  ...

• Oct 2 22:51:22 kvm11438 sshd[77600]: Failed password for root from 183.81.169.238 port 34528 ssh2
  Oct 2 22:51:24 kvm11438 sshd[77602]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 22:51:26 kvm11438 sshd[77602]: Failed password for root from 183.81.169.238 port 34548 ssh2
  Oct 2 22:51:29 kvm11438 sshd[77604]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 22:51:30 kvm11438 sshd[77604]: Failed password for root from 183.81.169.238 port 53080 ssh2
  ...

• unauthorized connection with user "root" and password "0" at 2024-10-02T20:51:22Z

• Oct 2 22:50:52 ns41 sshd[2083]: Failed password for root from 183.81.169.238 port 55036 ssh2
  Oct 2 22:50:56 ns41 sshd[2085]: Failed password for root from 183.81.169.238 port 46880 ssh2
  ...

• Oct 2 22:50:51 vmi1008219 sshd[360970]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 22:50:52 vmi1008219 sshd[360970]: Failed password for root from 183.81.169.238 port 32868 ssh2
  ...

• Oct 3 04:50:00 pve-hkg1 sshd[724818]: Failed password for root from 183.81.169.238 port 48740 ssh2
  Oct 3 04:50:04 pve-hkg1 sshd[724953]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 04:50:06 pve-hkg1 sshd[724953]: Failed password for root from 183.81.169.238 port 48752 ssh2
  Oct 3 04:50:09 pve-hkg1 sshd[725058]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 04:50:11 pve-hkg1 sshd[725058]: Failed password for root from 183.81.169.238 port 60390 ssh2
  ...

• Oct 2 22:49:29 vps2 sshd[1817880]: Invalid user Antminer from 183.81.169.238 port 42544
  Oct 2 22:49:30 vps2 sshd[1817882]: Invalid user Antminer from 183.81.169.238 port 42552
  Oct 2 22:49:41 vps2 sshd[1817894]: Invalid user admin from 183.81.169.238 port 41974
  Oct 2 22:49:42 vps2 sshd[1817896]: Invalid user baikal from 183.81.169.238 port 41984
  ...

• $f2bV_matches

• Oct 2 22:47:47 m2369 sshd[725916]: Failed password for root from 183.81.169.238 port 57500 ssh2
  Oct 2 22:47:49 m2369 sshd[725950]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 22:47:52 m2369 sshd[725950]: Failed password for root from 183.81.169.238 port 60004 ssh2
  Oct 2 22:47:55 m2369 sshd[725955]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 22:47:57 m2369 sshd[725955]: Failed password for root from 183.81.169.238 port 36512 ssh2
  ...

• Oct 2 22:47:34 amk sshd\[6510\]: Failed password for root from 183.81.169.238 port 41992 ssh2Oct 2 22:47:38 amk sshd\[6512\]: Failed password for root from 183.81.169.238 port 48310 ssh2
  ...

• Oct 2 20:47:24 web-proxy02 sshd[1590766]: Failed password for root from 183.81.169.238 port 44428 ssh2
  Oct 2 20:47:28 web-proxy02 sshd[1590768]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 20:47:30 web-proxy02 sshd[1590768]: Failed password for root from 183.81.169.238 port 46412 ssh2
  ...

• Oct 2 22:47:01 SFEEDS sshd[481109]: Failed password for root from 183.81.169.238 port 53452 ssh2
  Oct 2 22:47:04 SFEEDS sshd[481113]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 22:47:06 SFEEDS sshd[481113]: Failed password for root from 183.81.169.238 port 53464 ssh2
  Oct 2 22:47:09 SFEEDS sshd[481116]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 22:47:11 SFEEDS sshd[481116]: Failed password for root from 183.81.169.238 port 43668 ssh2
  ...

• Oct 2 22:45:36 dev0-dcde-rnet sshd[6050]: Failed password for root from 183.81.169.238 port 43904 ssh2
  Oct 2 22:45:40 dev0-dcde-rnet sshd[6052]: Failed password for root from 183.81.169.238 port 42948 ssh2

• Oct 2 23:44:18 server2 sshd\[26975\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 23:44:19 server2 sshd\[26977\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 23:44:21 server2 sshd\[26979\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 23:44:22 server2 sshd\[26981\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 23:44:24 server2 sshd\[26983\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 23:44:26 server2 sshd\[26985\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers

• PBK Oct 2 22:43:30 websrv01 sshd[1227665]: Failed password for root from 183.81.169.238 port 32932 ssh2
  Oct 2 22:43:34 websrv01 sshd[1227667]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 22:43:36 websrv01 sshd[1227667]: Failed password for root from 183.81.169.238 port 32934 ssh2
  Oct 2 22:43:38 websrv01 sshd[1227669]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 22:43:41 websrv01 sshd[1227669]: Failed password for root from 183.81.169.238 port 55082 ssh2

• FW-PortScan: Traffic Blocked srcport=46340 dstport=22

• 2024-10-02T22:42:08.889349+02:00 nc2.motyka.pro sshd[1324449]: Failed password for root from 183.81.169.238 port 59784 ssh2
  2024-10-02T22:42:11.141249+02:00 nc2.motyka.pro sshd[1324625]: Failed password for root from 183.81.169.238 port 59804 ssh2
  2024-10-02T22:42:13.235129+02:00 nc2.motyka.pro sshd[1324694]: Failed password for root from 183.81.169.238 port 59818 ssh2
  2024-10-02T22:42:15.881651+02:00 nc2.motyka.pro sshd[1324853]: Failed password for root from 183.81.169.238 port 59842 ssh2
  2024-10-02T22:42:18.026237+02:00 nc2.motyka.pro sshd[1324928]: Failed password for root from 183.81.169.238 port 51598 ssh2
  ...

• ufw_block_log_banned

• 10835 attempts since 13.07.2024 23:53:03 UTC - last one: 2024-10-02T20:02:57.114760+02:00 beta sshd[2310925]: Connection closed by invalid user baikal 183.81.169.238 port 59062 [preauth]

• Oct 2 22:39:29 pinkypie sshd[61027]: Failed password for root from 183.81.169.238 port 45332 ssh2
  Oct 2 22:39:33 pinkypie sshd[61030]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 22:39:35 pinkypie sshd[61030]: Failed password for root from 183.81.169.238 port 45346 ssh2
  ...

• Oct 2 22:38:58 ifog sshd[80281]: Invalid user Antminer from 183.81.169.238 port 32852
  Oct 2 22:39:00 ifog sshd[80283]: Invalid user Antminer from 183.81.169.238 port 32856
  Oct 2 22:39:10 ifog sshd[80295]: Invalid user admin from 183.81.169.238 port 36314
  ...

• Oct 2 20:39:03 nameserver-01 sshd[2846670]: Failed password for root from 183.81.169.238 port 53626 ssh2
  Oct 2 20:39:07 nameserver-01 sshd[2846672]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 20:39:09 nameserver-01 sshd[2846672]: Failed password for root from 183.81.169.238 port 37548 ssh2
  ...

• 2024-10-02T20:38:39.015213+00:00 Linux02 sshd[3815329]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T20:38:40.611958+00:00 Linux02 sshd[3815329]: Failed password for root from 183.81.169.238 port 49310 ssh2
  2024-10-02T20:38:43.256327+00:00 Linux02 sshd[3815639]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T20:38:45.403960+00:00 Linux02 sshd[3815639]: Failed password for root from 183.81.169.238 port 49324 ssh2
  2024-10-02T20:38:49.481813+00:00 Linux02 sshd[3815996]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T20:38:51.785803+00:00 Linux02 sshd[3815996]: Failed password for root from 183.81.169.238 port 55906 ssh2
  2024-10-02T20:38:55.575957+00:00 Linux02 sshd[3816373]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= r
  ...

• 2024-10-02T20:14:38.422749+02:00 hvs sshd-session[38739]: Connection closed by authenticating user root 183.81.169.238 port 36522 [preauth]
  2024-10-02T20:14:39.921091+02:00 hvs sshd-session[38741]: Connection closed by authenticating user root 183.81.169.238 port 36534 [preauth]
  2024-10-02T20:14:41.147407+02:00 hvs sshd-session[38743]: error: kex_exchange_identification: read: Connection reset by peer
  2024-10-02T20:14:41.147465+02:00 hvs sshd-session[38743]: Connection reset by 183.81.169.238 port 36546
  2024-10-02T22:38:59.941060+02:00 hvs sshd-session[40483]: Connection closed by authenticating user root 183.81.169.238 port 54064 [preauth]
  ...

• Oct 2 16:38:16 graph sshd[1970294]: Failed password for root from 183.81.169.238 port 48948 ssh2
  Oct 2 16:38:17 graph sshd[1970296]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 16:38:19 graph sshd[1970296]: Failed password for root from 183.81.169.238 port 35828 ssh2
  Oct 2 16:38:21 graph sshd[1970298]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 16:38:22 graph sshd[1970298]: Failed password for root from 183.81.169.238 port 35838 ssh2
  ...

• Oct 2 22:38:06 : pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root Oct 2 22:38:08 : Failed password for root from 183.81.169.238 port 56302 ssh2 Oct 2 22:38:10 : pam_unix(sshd:auth): auth

• Oct 2 20:37:39 cloud-server-0 sshd[2888252]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 20:37:40 cloud-server-0 sshd[2888252]: Failed password for root from 183.81.169.238 port 45012 ssh2
  ...

• 2024-10-02T22:36:05.593587vps773228.ovh.net sshd[7773]: Failed password for root from 183.81.169.238 port 41134 ssh2
  2024-10-02T22:36:08.224503vps773228.ovh.net sshd[7775]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T22:36:10.428277vps773228.ovh.net sshd[7775]: Failed password for root from 183.81.169.238 port 39658 ssh2
  2024-10-02T22:36:12.629200vps773228.ovh.net sshd[7777]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T22:36:14.381474vps773228.ovh.net sshd[7777]: Failed password for root from 183.81.169.238 port 39690 ssh2
  ...

• Oct 2 20:35:07 hardcore-tesla sshd[4005432]: Failed password for root from 183.81.169.238 port 59916 ssh2
  Oct 2 20:35:10 hardcore-tesla sshd[4005435]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 20:35:12 hardcore-tesla sshd[4005435]: Failed password for root from 183.81.169.238 port 60342 ssh2
  Oct 2 20:35:15 hardcore-tesla sshd[4005437]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 20:35:18 hardcore-tesla sshd[4005437]: Failed password for root from 183.81.169.238 port 60384 ssh2
  ...

• Oct 2 22:34:05 SN-E2-77 sshd[3643025]: Failed password for root from 183.81.169.238 port 46368 ssh2
  Oct 2 22:34:08 SN-E2-77 sshd[3643138]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 22:34:11 SN-E2-77 sshd[3643138]: Failed password for root from 183.81.169.238 port 41442 ssh2
  Oct 2 22:34:14 SN-E2-77 sshd[3643140]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 22:34:16 SN-E2-77 sshd[3643140]: Failed password for root from 183.81.169.238 port 41468 ssh2
  ...

• Oct 3 05:33:53 localhost sshd[2747710]: Failed password for root from 183.81.169.238 port 46948 ssh2
  Oct 3 05:33:59 localhost sshd[2747746]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 05:34:01 localhost sshd[2747746]: Failed password for root from 183.81.169.238 port 50848 ssh2
  Oct 3 05:34:06 localhost sshd[2747822]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 05:34:08 localhost sshd[2747822]: Failed password for root from 183.81.169.238 port 50860 ssh2
  ...

• 2024-10-02T22:31:08.767772+02:00 vserver-20917 sshd-session[1941813]: Failed password for root from 183.81.169.238 port 35220 ssh2
  2024-10-02T22:31:12.087642+02:00 vserver-20917 sshd-session[1941817]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T22:31:14.321711+02:00 vserver-20917 sshd-session[1941817]: Failed password for root from 183.81.169.238 port 35264 ssh2
  2024-10-02T22:31:17.327947+02:00 vserver-20917 sshd-session[1941820]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T22:31:18.914795+02:00 vserver-20917 sshd-session[1941820]: Failed password for root from 183.81.169.238 port 50176 ssh2
  ...

• unauthorized connection with user "root" and password "0" at 2024-10-02T20:32:09Z

• 2024-10-02T20:32:07.135953+00:00 office sshd[1260318]: Invalid user Antminer from 183.81.169.238 port 49610
  ...

• Oct 2 15:31:58 jumarpab sshd[198920]: Failed password for root from 183.81.169.238 port 53048 ssh2
  Oct 2 15:32:02 jumarpab sshd[198931]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 15:32:04 jumarpab sshd[198931]: Failed password for root from 183.81.169.238 port 53060 ssh2
  ...

• Oct 2 22:30:53 monitor sshd[3860050]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 22:30:58 monitor sshd[3860052]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 22:31:03 monitor sshd[3860054]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 22:31:07 monitor sshd[3860056]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 22:31:13 monitor sshd[3860065]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  ...

• Failed password for root from 183.81.169.238 port 35880 ssh2
  pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Failed password for root from 183.81.169.238 port 35906 ssh2
  pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Failed password for root from 183.81.169.238 port 36854 ssh2

• 2024-10-02T23:28:44.579476+03:00 oh6ah sshd[1811859]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T23:28:46.826840+03:00 oh6ah sshd[1811859]: Failed password for root from 183.81.169.238 port 52320 ssh2
  ...

• Oct 2 20:28:32 s158416 sshd[2454519]: Failed password for root from 183.81.169.238 port 41002 ssh2
  Oct 2 20:28:36 s158416 sshd[2454525]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 20:28:38 s158416 sshd[2454525]: Failed password for root from 183.81.169.238 port 60838 ssh2
  Oct 2 20:28:42 s158416 sshd[2454530]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 20:28:44 s158416 sshd[2454530]: Failed password for root from 183.81.169.238 port 60908 ssh2
  ...

• Oct 2 22:28:32 de-kae sshd[3478291]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 22:28:34 de-kae sshd[3478291]: Failed password for root from 183.81.169.238 port 51838 ssh2
  ...

• Oct 2 22:27:00 Ina sshd[1852551]: Failed password for root from 183.81.169.238 port 46098 ssh2
  Oct 2 22:27:04 Ina sshd[1852553]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 22:27:06 Ina sshd[1852553]: Failed password for root from 183.81.169.238 port 46138 ssh2
  Oct 2 22:27:10 Ina sshd[1852555]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 22:27:12 Ina sshd[1852555]: Failed password for root from 183.81.169.238 port 58964 ssh2
  ...

• Cowrie Honeypot: Unauthorised SSH/Telnet login attempt with user "root" at 2024-10-02T20:26:56Z

• 2024-10-02T21:24:27.213955 jumphost sshd[65340]: Connection from 183.81.169.238 port 38172 on 192.168.40.4 port 22 rdomain ""
  2024-10-02T21:24:28.664746 jumphost sshd[65340]: Invalid user Antminer from 183.81.169.238 port 38172
  ...

• Oct 2 20:24:00 ovh sshd[3124855]: Failed password for root from 183.81.169.238 port 57416 ssh2
  Oct 2 20:24:03 ovh sshd[3124913]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 20:24:05 ovh sshd[3124913]: Failed password for root from 183.81.169.238 port 57434 ssh2
  Oct 2 20:24:08 ovh sshd[3124984]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 20:24:09 ovh sshd[3124984]: Failed password for root from 183.81.169.238 port 60724 ssh2
  ...

• 2024-10-02T15:23:50.449499-05:00 instance-20240522-152753 sshd[2513504]: Invalid user Antminer from 183.81.169.238 port 53832
  2024-10-02T15:23:52.608744-05:00 instance-20240522-152753 sshd[2513506]: Invalid user Antminer from 183.81.169.238 port 53836
  2024-10-02T15:24:06.661175-05:00 instance-20240522-152753 sshd[2513547]: Invalid user admin from 183.81.169.238 port 34122
  2024-10-02T15:24:09.059846-05:00 instance-20240522-152753 sshd[2513549]: Invalid user baikal from 183.81.169.238 port 34146
  ...

• 2024-10-02T20:23:54.224950+00:00 mapir-proxmox sshd[206633]: Failed password for root from 183.81.169.238 port 52564 ssh2
  2024-10-02T20:23:56.559595+00:00 mapir-proxmox sshd[207185]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T20:23:57.603789+00:00 mapir-proxmox sshd[207185]: Failed password for root from 183.81.169.238 port 49346 ssh2
  ...

• 2024-10-02T22:24:13.249433+02:00 runner3 sshd[3747660]: Failed password for root from 183.81.169.238 port 45998 ssh2
  2024-10-02T22:24:16.866165+02:00 runner3 sshd[3747662]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T22:24:18.322584+02:00 runner3 sshd[3747662]: Failed password for root from 183.81.169.238 port 57830 ssh2
  2024-10-02T22:24:21.255905+02:00 runner3 sshd[3747664]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T22:24:23.068185+02:00 runner3 sshd[3747664]: Failed password for root from 183.81.169.238 port 57872 ssh2
  ...

• 2024-10-02T16:20:16.868256-04:00 nova3 sshd[1657233]: Failed password for root from 183.81.169.238 port 55682 ssh2
  2024-10-02T16:20:20.451172-04:00 nova3 sshd[1657279]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T16:20:22.176467-04:00 nova3 sshd[1657279]: Failed password for root from 183.81.169.238 port 39484 ssh2
  2024-10-02T16:20:25.495004-04:00 nova3 sshd[1657330]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T16:20:27.572445-04:00 nova3 sshd[1657330]: Failed password for root from 183.81.169.238 port 39334 ssh2
  ...

• Oct 2 20:20:02 cloud-server-0 sshd[1857608]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 20:20:03 cloud-server-0 sshd[1857608]: Failed password for root from 183.81.169.238 port 41200 ssh2
  Oct 2 20:20:06 cloud-server-0 sshd[1857611]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 20:20:08 cloud-server-0 sshd[1857611]: Failed password for root from 183.81.169.238 port 47256 ssh2
  Oct 2 20:20:10 cloud-server-0 sshd[1857613]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 20:20:12 cloud-server-0 sshd[1857613]: Failed password for root from 183.81.169.238 port 47270 ssh2
  Oct 2 20:20:16 cloud-server-0 sshd[1857615]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 20:20:18 cloud-server-0 sshd[185
  ...

• 2024-10-02T22:16:50.775985+02:00 ubuntu sshd[156731]: Failed password for root from 183.81.169.238 port 53600 ssh2
  2024-10-02T22:16:54.248901+02:00 ubuntu sshd[156733]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T22:16:56.362481+02:00 ubuntu sshd[156733]: Failed password for root from 183.81.169.238 port 53640 ssh2
  2024-10-02T22:16:59.889512+02:00 ubuntu sshd[156735]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T22:17:02.354601+02:00 ubuntu sshd[156735]: Failed password for root from 183.81.169.238 port 42794 ssh2
  ...

• Inteceptor Intrusion Detector: failed_password on sshd module PID: (1434267)

• [rede-164-29] (sshd) Failed SSH login from 183.81.169.238 (NL/The Netherlands/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Oct 2 17:12:06 sshd[4313]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=[USERNAME]
  Oct 2 17:12:08 sshd[4313]: Failed password for [USERNAME] from 183.81.169.238 port 59228 ssh2
  Oct 2 17:12:11 sshd[4320]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=[USERNAME]
  Oct 2 17:12:13 sshd[4320]: Failed password for [USERNAME] from 183.81.169.238 port 43438 ssh2
  Oct 2 17:12:1

• Detected multiple authentication failures and invalid user attempts from IP address 183.81.169.238 on [PT] Horse Node.

• Oct 2 23:09:36 server2 sshd\[24068\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 23:09:38 server2 sshd\[24070\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 23:09:40 server2 sshd\[24072\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 23:09:42 server2 sshd\[24074\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 23:09:44 server2 sshd\[24076\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 23:09:46 server2 sshd\[24078\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers

• FW-PortScan: Traffic Blocked srcport=37029 dstport=22

• Oct 2 22:09:13 qube2 sshd[2073154]: Failed password for root from 183.81.169.238 port 49494 ssh2
  Oct 2 22:09:17 qube2 sshd[2073483]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 22:09:19 qube2 sshd[2073483]: Failed password for root from 183.81.169.238 port 34622 ssh2
  ...

• Oct 2 13:08:54 server01 sshd[18952]: Failed password for root from 183.81.169.238 port 52034 ssh2
  Oct 2 13:09:01 server01 sshd[18957]: Failed password for root from 183.81.169.238 port 36714 ssh2
  ...

• 2024-10-02T15:08:24.478524 mail001 sshd[812485]: Failed password for root from 183.81.169.238 port 41342 ssh2
  2024-10-02T15:08:28.674833 mail001 sshd[812488]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T15:08:30.653295 mail001 sshd[812488]: Failed password for root from 183.81.169.238 port 60420 ssh2
  ...

• 2024-10-02T20:07:51.742933us1.starnode.us sshd[1421648]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T20:07:53.974892us1.starnode.us sshd[1421648]: Failed password for root from 183.81.169.238 port 58938 ssh2
  ...

• Oct 2 22:06:07 endernation sshd[3136508]: Failed password for root from 183.81.169.238 port 50550 ssh2
  Oct 2 22:06:09 endernation sshd[3136538]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 22:06:12 endernation sshd[3136538]: Failed password for root from 183.81.169.238 port 50552 ssh2
  ...

• Oct 2 22:04:43 raspberrypi sshd[1302]: Failed password for root from 183.81.169.238 port 38284 ssh2
  ...

• Oct 2 16:04:12 ny01 sshd[2643850]: Failed password for root from 183.81.169.238 port 47710 ssh2
  Oct 2 16:04:16 ny01 sshd[2643859]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 16:04:18 ny01 sshd[2643859]: Failed password for root from 183.81.169.238 port 47718 ssh2
  Oct 2 16:04:21 ny01 sshd[2643862]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 16:04:23 ny01 sshd[2643862]: Failed password for root from 183.81.169.238 port 58008 ssh2

• tcp/22 (38 or more attempts)

• Bot attempt ssh bruteforce

• 2024-10-02T22:03:16.251291+02:00 vande sshd[1578968]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T22:03:17.732634+02:00 vande sshd[1578968]: Failed password for root from 183.81.169.238 port 41284 ssh2

• (sshd) Failed SSH login from 183.81.169.238 (NL/The Netherlands/North Holland/Amsterdam/-/[AS206264 Amarutu Technology Ltd]): 5 in the last 3600 secs; IP: 183.81.169.238; Ports: *; Direction: 0; Trigger: LF_SSHD; Logs: 2024-10-02T22:02:59.894098+02:00 insightVM sshd[3336814]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root 2024-10-02T22:03:01.706997+02:00 insightVM sshd[3336814]: Failed password for root from 183.81.169.238 port 48802 ssh2 2024-10-02T22:03:04.792545+02:00 insightVM sshd[3336834]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root 2024-10-02T22:03:05.957304+02:00 insightVM sshd[3336834]: Failed password for root from 183.81.169.238 port 48832 ssh2 2024-10-02T22:03:09.621402+02:00 insightVM sshd[3336848]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root

• 2024-10-03T03:00:57.110661+07:00 BAW-C03 sshd[62277]: Failed password for root from 183.81.169.238 port 34738 ssh2
  2024-10-03T03:01:02.006391+07:00 BAW-C03 sshd[62279]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T03:01:04.426168+07:00 BAW-C03 sshd[62279]: Failed password for root from 183.81.169.238 port 41762 ssh2
  2024-10-03T03:01:09.157532+07:00 BAW-C03 sshd[62281]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T03:01:11.536399+07:00 BAW-C03 sshd[62281]: Failed password for root from 183.81.169.238 port 42740 ssh2
  ...

• Oct 2 20:59:53 sheikh-ahmed-abu-islam-v2 sshd[2607810]: Invalid user Antminer from 183.81.169.238 port 38068
  Oct 2 20:59:55 sheikh-ahmed-abu-islam-v2 sshd[2607839]: Invalid user Antminer from 183.81.169.238 port 55594
  ...

• Oct 2 21:58:39 h2691902 sshd[16204]: Failed password for root from 183.81.169.238 port 34108 ssh2
  Oct 2 21:58:40 h2691902 sshd[16206]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 21:58:42 h2691902 sshd[16206]: Failed password for root from 183.81.169.238 port 34166 ssh2
  Oct 2 21:58:44 h2691902 sshd[16208]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 21:58:47 h2691902 sshd[16208]: Failed password for root from 183.81.169.238 port 34194 ssh2
  ...

• 2024-10-02T12:57:15.572339-07:00 panduhstudios sshd[2807530]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T12:57:17.826103-07:00 panduhstudios sshd[2807530]: Failed password for root from 183.81.169.238 port 46028 ssh2
  2024-10-02T12:57:22.513497-07:00 panduhstudios sshd[2807533]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T12:57:24.396000-07:00 panduhstudios sshd[2807533]: Failed password for root from 183.81.169.238 port 57670 ssh2
  ...

• Oct 2 21:56:53 fshubvidspace sshd[2991987]: Failed password for root from 183.81.169.238 port 39650 ssh2
  Oct 2 21:56:55 fshubvidspace sshd[2991990]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 21:56:58 fshubvidspace sshd[2991990]: Failed password for root from 183.81.169.238 port 52472 ssh2
  Oct 2 21:56:59 fshubvidspace sshd[2991993]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 21:57:01 fshubvidspace sshd[2991993]: Failed password for root from 183.81.169.238 port 52484 ssh2
  ...

• Oct 2 21:55:38 h2930838 sshd[17913]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 21:55:41 h2930838 sshd[17913]: Failed password for invalid user root from 183.81.169.238 port 44632 ssh2

• Oct 2 19:54:40 instance-20221219-1303 sshd[2757379]: Invalid user Antminer from 183.81.169.238 port 41250
  ...

• Oct 2 19:52:06 mysql sshd[220851]: Failed password for root from 183.81.169.238 port 51098 ssh2
  Oct 2 19:52:09 mysql sshd[220853]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 19:52:10 mysql sshd[220853]: Failed password for root from 183.81.169.238 port 43860 ssh2
  Oct 2 19:52:13 mysql sshd[220855]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 19:52:15 mysql sshd[220855]: Failed password for root from 183.81.169.238 port 43894 ssh2
  ...

• 2024-10-02T19:50:49.191575+00:00 Linux15 sshd[490181]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T19:50:51.455522+00:00 Linux15 sshd[490181]: Failed password for root from 183.81.169.238 port 51760 ssh2
  2024-10-02T19:50:53.016350+00:00 Linux15 sshd[490419]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T19:50:54.828319+00:00 Linux15 sshd[490419]: Failed password for root from 183.81.169.238 port 51770 ssh2
  2024-10-02T19:50:57.136187+00:00 Linux15 sshd[490654]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T19:50:58.832320+00:00 Linux15 sshd[490654]: Failed password for root from 183.81.169.238 port 45838 ssh2
  2024-10-02T19:51:01.373183+00:00 Linux15 sshd[490899]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=18
  ...

• Oct 2 20:50:24 dlcentre3 sshd[1703]: Failed password for root from 183.81.169.238 port 35744 ssh2

• Oct 2 21:48:21 OPSO sshd\[18988\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 21:48:23 OPSO sshd\[18988\]: Failed password for root from 183.81.169.238 port 57842 ssh2
  Oct 2 21:48:24 OPSO sshd\[18990\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 21:48:26 OPSO sshd\[18990\]: Failed password for root from 183.81.169.238 port 57852 ssh2
  Oct 2 21:48:27 OPSO sshd\[18992\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root

• 2024-10-02T19:48:16.560767+00:00 fluff sshd[78636]: Failed password for root from 183.81.169.238 port 38444 ssh2
  2024-10-02T19:48:20.056484+00:00 fluff sshd[78638]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T19:48:22.868237+00:00 fluff sshd[78638]: Failed password for root from 183.81.169.238 port 52490 ssh2
  2024-10-02T19:48:25.846934+00:00 fluff sshd[78640]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T19:48:28.343933+00:00 fluff sshd[78640]: Failed password for root from 183.81.169.238 port 36954 ssh2
  ...

• FW-PortScan: Traffic Blocked srcport=44400 dstport=22

• Oct 2 21:46:18 root1896 sshd[2000880]: Failed password for root from 183.81.169.238 port 55890 ssh2
  Oct 2 21:46:20 root1896 sshd[2000904]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 21:46:21 root1896 sshd[2000904]: Failed password for root from 183.81.169.238 port 55940 ssh2
  Oct 2 21:46:23 root1896 sshd[2000940]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 21:46:25 root1896 sshd[2000940]: Failed password for root from 183.81.169.238 port 55980 ssh2
  ...

• 2024-10-02T19:45:58.373554shield sshd\[1276\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T19:46:00.356255shield sshd\[1276\]: Failed password for root from 183.81.169.238 port 39252 ssh2
  2024-10-02T19:46:01.446122shield sshd\[1278\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T19:46:03.172401shield sshd\[1278\]: Failed password for root from 183.81.169.238 port 39288 ssh2
  2024-10-02T19:46:04.469237shield sshd\[1280\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root

• Oct 2 21:45:35 vps-9f3cdc33 sshd[1877313]: Failed password for root from 183.81.169.238 port 46812 ssh2
  Oct 2 21:45:37 vps-9f3cdc33 sshd[1877320]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 21:45:39 vps-9f3cdc33 sshd[1877320]: Failed password for root from 183.81.169.238 port 36014 ssh2
  Oct 2 21:45:39 vps-9f3cdc33 sshd[1877322]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 21:45:41 vps-9f3cdc33 sshd[1877322]: Failed password for root from 183.81.169.238 port 36044 ssh2
  ...

• [rede-166-249] (sshd) Failed SSH login from 183.81.169.238 (NL/The Netherlands/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Oct 2 16:44:47 sshd[8046]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=[USERNAME]
  Oct 2 16:44:50 sshd[8046]: Failed password for [USERNAME] from 183.81.169.238 port 51078 ssh2
  Oct 2 16:44:52 sshd[8061]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=[USERNAME]
  Oct 2 16:44:54 sshd[8061]: Failed password for [USERNAME] from 183.81.169.238 port 51092 ssh2
  Oct 2 16:44:5

• Oct 3 02:44:30 pve sshd[1357668]: Connection closed by authenticating user root 183.81.169.238 port 56066 [preauth]
  Oct 3 02:44:32 pve sshd[1357672]: Connection closed by authenticating user root 183.81.169.238 port 56076 [preauth]
  Oct 3 02:44:33 pve sshd[1357676]: Connection closed by authenticating user root 183.81.169.238 port 56090 [preauth]
  Oct 3 02:44:35 pve sshd[1357678]: Connection closed by authenticating user root 183.81.169.238 port 56100 [preauth]
  Oct 3 02:44:36 pve sshd[1357682]: Connection closed by authenticating user root 183.81.169.238 port 38482 [preauth]
  ...

• Detected multiple authentication failures and invalid user attempts from IP address 183.81.169.238 on [UK] Projects Node.

• Oct 2 20:42:57 kamergaz sshd[2489396]: Failed password for root from 183.81.169.238 port 33602 ssh2
  Oct 2 20:42:58 kamergaz sshd[2489402]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 20:43:00 kamergaz sshd[2489402]: Failed password for root from 183.81.169.238 port 33620 ssh2
  Oct 2 20:43:01 kamergaz sshd[2489404]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 20:43:04 kamergaz sshd[2489404]: Failed password for root from 183.81.169.238 port 33636 ssh2

• 2024-10-02T21:42:52.968239+02:00 servidor1 sshd[99589]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-02T21:42:53.041703+02:00 servidor1 sshd[99589]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T21:42:54.958251+02:00 servidor1 sshd[99589]: Failed password for invalid user root from 183.81.169.238 port 40136 ssh2
  2024-10-02T21:42:56.926916+02:00 servidor1 sshd[99593]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-02T21:42:57.119587+02:00 servidor1 sshd[99593]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T21:42:59.253515+02:00 servidor1 sshd[99593]: Failed password for invalid user root from 183.81.169.238 port 42988 ssh2
  2024-10-02T21:43:00.961976+02:00 servidor1 sshd[99595]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  ...

• Oct 2 21:41:46 hosting09 sshd[468280]: Failed password for root from 183.81.169.238 port 39994 ssh2
  Oct 2 21:41:48 hosting09 sshd[468291]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 21:41:51 hosting09 sshd[468291]: Failed password for root from 183.81.169.238 port 40032 ssh2
  ...

• 2024-10-02T22:41:49.463448+03:00 mummo sshd[2012577]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T22:41:51.928920+03:00 mummo sshd[2012577]: Failed password for root from 183.81.169.238 port 55286 ssh2
  ...

• 2024-10-02T19:41:39.367775+00:00 prod-3 sshd[1059616]: Connection closed by authenticating user root 183.81.169.238 port 38352 [preauth]
  2024-10-02T19:41:40.163735+00:00 prod-3 sshd[1059618]: Connection closed by authenticating user root 183.81.169.238 port 38360 [preauth]
  2024-10-02T19:41:40.759813+00:00 prod-3 sshd[1059638]: Connection closed by authenticating user root 183.81.169.238 port 38364 [preauth]
  2024-10-02T19:41:41.665658+00:00 prod-3 sshd[1059640]: Connection closed by authenticating user root 183.81.169.238 port 38376 [preauth]
  2024-10-02T19:41:42.429453+00:00 prod-3 sshd[1059642]: Connection closed by authenticating user root 183.81.169.238 port 38386 [preauth]
  ...

• Unsolicited connection attempt(s), port:22.

• (sshd) Failed SSH login from 183.81.169.238 (MN/Mongolia/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Oct 2 15:37:41 server5 sshd[13679]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 15:37:43 server5 sshd[13679]: Failed password for root from 183.81.169.238 port 60880 ssh2
  Oct 2 15:37:44 server5 sshd[13690]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 15:37:46 server5 sshd[13690]: Failed password for root from 183.81.169.238 port 45566 ssh2
  Oct 2 15:37:47 server5 sshd[13694]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root

• Oct 2 12:37:04 LU-VPS01 sshd[11391]: Failed password for root from 183.81.169.238 port 32946 ssh2
  Oct 2 12:37:07 LU-VPS01 sshd[11393]: Failed password for root from 183.81.169.238 port 47290 ssh2
  ...

• Oct 2 19:37:02 jump sshd[3236886]: Failed password for root from 183.81.169.238 port 56946 ssh2
  Oct 2 19:37:04 jump sshd[3236893]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 19:37:07 jump sshd[3236893]: Failed password for root from 183.81.169.238 port 43952 ssh2
  ...

• 2024-10-02T21:36:35.217861+02:00 devcricle sshd[28988]: Failed password for root from 183.81.169.238 port 53276 ssh2
  2024-10-02T21:36:36.704112+02:00 devcricle sshd[28990]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T21:36:38.869636+02:00 devcricle sshd[28990]: Failed password for root from 183.81.169.238 port 42384 ssh2
  ...

• 2024-10-02T21:36:13.704175+02:00 ruddy-force sshd[543100]: Failed password for root from 183.81.169.238 port 53550 ssh2
  2024-10-02T21:36:15.406574+02:00 ruddy-force sshd[543102]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T21:36:17.357206+02:00 ruddy-force sshd[543102]: Failed password for root from 183.81.169.238 port 33466 ssh2
  2024-10-02T21:36:19.479542+02:00 ruddy-force sshd[543104]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T21:36:21.975822+02:00 ruddy-force sshd[543104]: Failed password for root from 183.81.169.238 port 33482 ssh2
  ...

• Oct 2 21:35:48 s1-4-gra7 sshd[1908381]: Invalid user Antminer from 183.81.169.238 port 49060
  Oct 2 21:35:48 s1-4-gra7 sshd[1908383]: Invalid user Antminer from 183.81.169.238 port 49062

• Oct 2 12:35:04 SRC=183.81.169.238 PROTO=TCP SPT=43839 DPT=22 SYN
  ...

• Oct 2 22:34:48 pkdns2 sshd\[23199\]: Failed password for root from 183.81.169.238 port 38236 ssh2Oct 2 22:34:50 pkdns2 sshd\[23201\]: Failed password for root from 183.81.169.238 port 38252 ssh2Oct 2 22:34:52 pkdns2 sshd\[23205\]: Failed password for root from 183.81.169.238 port 38260 ssh2Oct 2 22:34:54 pkdns2 sshd\[23207\]: Failed password for root from 183.81.169.238 port 38276 ssh2Oct 2 22:34:56 pkdns2 sshd\[23209\]: Failed password for root from 183.81.169.238 port 57900 ssh2Oct 2 22:34:58 pkdns2 sshd\[23211\]: Failed password for root from 183.81.169.238 port 57914 ssh2
  ...

• Oct 2 19:34:18 webserver sshd[738487]: Failed password for root from 183.81.169.238 port 53144 ssh2
  Oct 2 19:34:18 webserver sshd[738489]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 19:34:20 webserver sshd[738489]: Failed password for root from 183.81.169.238 port 53178 ssh2
  Oct 2 19:34:22 webserver sshd[738491]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 19:34:24 webserver sshd[738491]: Failed password for root from 183.81.169.238 port 53194 ssh2
  ...

• Oct 2 16:10:43 synth sshd[687072]: Invalid user Antminer from 183.81.169.238 port 40748
  Oct 2 16:10:45 synth sshd[687074]: Invalid user Antminer from 183.81.169.238 port 40788
  Oct 2 16:10:58 synth sshd[687128]: Invalid user admin from 183.81.169.238 port 43458
  Oct 2 16:11:01 synth sshd[687130]: Invalid user baikal from 183.81.169.238 port 43460
  Oct 2 17:54:23 synth sshd[704461]: Invalid user Antminer from 183.81.169.238 port 50000
  Oct 2 17:54:25 synth sshd[704463]: Invalid user Antminer from 183.81.169.238 port 53660
  Oct 2 17:54:39 synth sshd[704515]: Invalid user admin from 183.81.169.238 port 51768
  Oct 2 17:54:41 synth sshd[704537]: Invalid user baikal from 183.81.169.238 port 51790
  Oct 2 19:32:36 synth sshd[720800]: Invalid user Antminer from 183.81.169.238 port 42204
  Oct 2 19:32:36 synth sshd[720802]: Invalid user Antminer from 183.81.169.238 port 42206
  ...

• Oct 2 21:31:37 markkoudstaal sshd[2751352]: Failed password for root from 183.81.169.238 port 58192 ssh2
  Oct 2 21:31:37 markkoudstaal sshd[2751361]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 21:31:39 markkoudstaal sshd[2751361]: Failed password for root from 183.81.169.238 port 58208 ssh2
  ...

• 2024-10-02T19:29:55.838390+00:00 mail sshd[927538]: Invalid user Antminer from 183.81.169.238 port 32958
  2024-10-02T19:29:57.194904+00:00 mail sshd[927540]: Invalid user Antminer from 183.81.169.238 port 32968
  2024-10-02T19:30:08.324285+00:00 mail sshd[927552]: Invalid user admin from 183.81.169.238 port 33390
  ...

• FW-PortScan: Traffic Blocked srcport=48529 dstport=22

• Oct 2 19:29:12 xproot sshd[2018080]: Failed password for root from 183.81.169.238 port 57308 ssh2
  Oct 2 19:29:16 xproot sshd[2018082]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 19:29:18 xproot sshd[2018082]: Failed password for root from 183.81.169.238 port 49758 ssh2
  Oct 2 19:29:23 xproot sshd[2018086]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 19:29:25 xproot sshd[2018086]: Failed password for root from 183.81.169.238 port 49816 ssh2
  ...

• Oct 2 19:29:08 mysql sshd[220786]: Failed password for root from 183.81.169.238 port 57074 ssh2
  Oct 2 19:29:12 mysql sshd[220788]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 19:29:14 mysql sshd[220788]: Failed password for root from 183.81.169.238 port 41694 ssh2
  Oct 2 19:29:18 mysql sshd[220790]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 19:29:20 mysql sshd[220790]: Failed password for root from 183.81.169.238 port 45622 ssh2
  ...

• Oct 2 15:29:08 us-mfl-01 sshd[307111]: Invalid user Antminer from 183.81.169.238 port 43398
  ...

• Oct 2 **REMOVED** sshd[551087]: Failed password for root from 183.81.169.238 port 33782 ssh2
  Oct 2 **REMOVED** sshd[551089]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 **REMOVED** sshd[551089]: Failed password for root from 183.81.169.238 port 33804 ssh2

• Oct 2 19:28:43 VPS sshd[1684615]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 19:28:43 VPS sshd[1684615]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 19:28:43 VPS sshd[1684615]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 19:28:45 VPS sshd[1684615]: Failed password for invalid user root from 183.81.169.238 port 42640 ssh2
  Oct 2 19:28:49 VPS sshd[1684622]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  ...

• Oct 2 19:28:45 Neptun sshd[672105]: Invalid user Antminer from 183.81.169.238 port 44000
  ...

• SSHD brute force attack detected by fail2ban

• Oct 2 21:27:45 ns41 sshd[28412]: Failed password for root from 183.81.169.238 port 39456 ssh2
  Oct 2 21:27:49 ns41 sshd[28414]: Failed password for root from 183.81.169.238 port 34662 ssh2
  ...

• Report-by-bigbear3

• Oct 2 19:27:22 scw-6657dc sshd[4591]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 19:27:22 scw-6657dc sshd[4591]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 19:27:23 scw-6657dc sshd[4591]: Failed password for root from 183.81.169.238 port 45978 ssh2
  ...

• ssh bruteforce

• Oct 2 21:25:29 4429 sshd[82817]: Failed password for root from 183.81.169.238 port 47978 ssh2
  Oct 2 21:25:33 4429 sshd[82819]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 21:25:36 4429 sshd[82819]: Failed password for root from 183.81.169.238 port 47996 ssh2
  ...

• Oct 2 21:24:57 vps-9f3cdc33 sshd[1876719]: Failed password for root from 183.81.169.238 port 42814 ssh2
  Oct 2 21:25:00 vps-9f3cdc33 sshd[1876721]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 21:25:01 vps-9f3cdc33 sshd[1876721]: Failed password for root from 183.81.169.238 port 42822 ssh2
  Oct 2 21:25:05 vps-9f3cdc33 sshd[1876730]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 21:25:07 vps-9f3cdc33 sshd[1876730]: Failed password for root from 183.81.169.238 port 42836 ssh2
  ...

• Oct 2 19:22:06 nameserver-01 sshd[2845717]: Failed password for root from 183.81.169.238 port 35908 ssh2
  Oct 2 19:22:09 nameserver-01 sshd[2845720]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 19:22:12 nameserver-01 sshd[2845720]: Failed password for root from 183.81.169.238 port 44970 ssh2
  ...

• 2024-10-02T21:21:36.364105+02:00 srv1 sshd[2473675]: Failed password for root from 183.81.169.238 port 39438 ssh2
  2024-10-02T21:21:40.704595+02:00 srv1 sshd[2473679]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T21:21:42.191151+02:00 srv1 sshd[2473679]: Failed password for root from 183.81.169.238 port 59406 ssh2
  2024-10-02T21:21:45.232586+02:00 srv1 sshd[2473780]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T21:21:47.741565+02:00 srv1 sshd[2473780]: Failed password for root from 183.81.169.238 port 59414 ssh2
  ...

• Oct 2 21:21:13 netcup sshd[1030888]: Invalid user Antminer from 183.81.169.238 port 34180
  Oct 2 21:21:15 netcup sshd[1030890]: Invalid user Antminer from 183.81.169.238 port 34194
  Oct 2 21:21:24 netcup sshd[1030906]: Invalid user admin from 183.81.169.238 port 54738
  Oct 2 21:21:25 netcup sshd[1030908]: Invalid user baikal from 183.81.169.238 port 54420
  ...

• 2024-10-02T21:21:13.351887news0.dwmp.it sshd[1518]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T21:21:15.134935news0.dwmp.it sshd[1518]: Failed password for invalid user root from 183.81.169.238 port 50812 ssh2
  2024-10-02T21:21:16.631870news0.dwmp.it sshd[1520]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  ...

• Oct 2 12:20:54 server01 sshd[16115]: Failed password for root from 183.81.169.238 port 34138 ssh2
  Oct 2 12:21:00 server01 sshd[16117]: Failed password for root from 183.81.169.238 port 50926 ssh2
  ...

• 2024-10-02T20:20:40.880831racknerd-2df238 sshd[475903]: Failed password for root from 183.81.169.238 port 50844 ssh2
  2024-10-02T20:20:43.639761racknerd-2df238 sshd[475906]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T20:20:45.302992racknerd-2df238 sshd[475906]: Failed password for root from 183.81.169.238 port 50858 ssh2
  ...

• ...

• 2024-10-02T21:20:23.417487+02:00 v220240537442267460 sshd[1398748]: Failed password for root from 183.81.169.238 port 34822 ssh2
  2024-10-02T21:20:26.034518+02:00 v220240537442267460 sshd[1398755]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T21:20:28.033166+02:00 v220240537442267460 sshd[1398755]: Failed password for root from 183.81.169.238 port 58134 ssh2
  2024-10-02T21:20:29.642831+02:00 v220240537442267460 sshd[1398761]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T21:20:31.385476+02:00 v220240537442267460 sshd[1398761]: Failed password for root from 183.81.169.238 port 58160 ssh2
  ...

• Oct 2 19:20:10 Proxmox-VE sshd[79899]: Failed password for root from 183.81.169.238 port 53186 ssh2
  Oct 2 19:20:13 Proxmox-VE sshd[79923]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 19:20:15 Proxmox-VE sshd[79923]: Failed password for root from 183.81.169.238 port 53204 ssh2
  Oct 2 19:20:17 Proxmox-VE sshd[79925]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 19:20:19 Proxmox-VE sshd[79925]: Failed password for root from 183.81.169.238 port 59014 ssh2
  ...

• 2024-10-02 19:20:15 bullz SSH

• Unsolicited connection attempt(s), port:22.

• 2024-10-02T21:19:47.095109+02:00 kittycat sshd-session[171229]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T21:19:48.473442+02:00 kittycat sshd-session[171229]: Failed password for root from 183.81.169.238 port 39166 ssh2
  2024-10-02T21:19:49.855861+02:00 kittycat sshd-session[171232]: Connection from 183.81.169.238 port 39184 on 144.91.110.176 port 22 rdomain ""
  2024-10-02T21:19:51.787588+02:00 kittycat sshd-session[171232]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T21:19:53.836478+02:00 kittycat sshd-session[171232]: Failed password for root from 183.81.169.238 port 39184 ssh2
  ...

• 2024-10-02T22:19:35.536691+03:00 gogo-server sshd-session[98891]: Failed password for root from 183.81.169.238 port 51972 ssh2
  2024-10-02T22:19:39.336212+03:00 gogo-server sshd-session[98894]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T22:19:41.213461+03:00 gogo-server sshd-session[98894]: Failed password for root from 183.81.169.238 port 42380 ssh2
  ...

• 2024-10-02T19:19:09.582767+00:00 cloud-server-0 sshd[2622055]: Failed password for root from 183.81.169.238 port 51654 ssh2
  2024-10-02T19:19:12.730185+00:00 cloud-server-0 sshd[2622057]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T19:19:15.236340+00:00 cloud-server-0 sshd[2622057]: Failed password for root from 183.81.169.238 port 51682 ssh2
  2024-10-02T19:19:17.488478+00:00 cloud-server-0 sshd[2622059]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T19:19:19.347509+00:00 cloud-server-0 sshd[2622059]: Failed password for root from 183.81.169.238 port 60862 ssh2
  ...

• unauthorized connection with user "root" and password "0" at 2024-10-02T19:19:00Z

• RouterOS: Scanning detected TCP 183.81.169.238:37496 > x.x.x.x:22

• Oct 2 21:17:37 arm-fr sshd[2836408]: Invalid user Antminer from 183.81.169.238 port 56282
  Oct 2 21:17:39 arm-fr sshd[2836410]: Invalid user Antminer from 183.81.169.238 port 56290
  Oct 2 21:17:50 arm-fr sshd[2836471]: Invalid user admin from 183.81.169.238 port 55624
  ...

• $f2bV_matches

• fail2banned (ssh brute)

• 2024-10-02T21:17:00.073978+02:00 mail sshd[483654]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-02T21:17:02.514762+02:00 mail sshd[483659]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-02T21:17:04.781059+02:00 mail sshd[483664]: User root from 183.81.169.238 not allowed because not listed in AllowUsers

• SSH login attempt

• Fail2Ban - \[SSHD\]Brute-force SSH server
  ...

• [19:15] Attempted SSH login on port 22 with credentials root:0

• [rede-164-29] 10/02/2024-16:15:10.506389, 183.81.169.238, Protocol: 6, ET COMPROMISED Known Compromised or Hostile Host Traffic group 13

• 2024-10-02T19:13:34.112197+00:00 virt-hur-fmt-01.pdx.net.uk sshd[12325]: Invalid user Antminer from 183.81.169.238 port 51746
  2024-10-02T19:13:36.902067+00:00 virt-hur-fmt-01.pdx.net.uk sshd[12329]: Invalid user Antminer from 183.81.169.238 port 59534
  2024-10-02T19:13:52.115391+00:00 virt-hur-fmt-01.pdx.net.uk sshd[12401]: Invalid user admin from 183.81.169.238 port 39112
  ...

• Oct 2 21:13:20 vmi1008219 sshd[356218]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 21:13:22 vmi1008219 sshd[356218]: Failed password for root from 183.81.169.238 port 36294 ssh2
  ...

• Oct 2 21:12:36 docker-01 sshd[137350]: Failed password for root from 183.81.169.238 port 42248 ssh2
  Oct 2 21:12:38 docker-01 sshd[137352]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 21:12:41 docker-01 sshd[137352]: Failed password for root from 183.81.169.238 port 49604 ssh2
  Oct 2 21:12:45 docker-01 sshd[137399]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 21:12:47 docker-01 sshd[137399]: Failed password for root from 183.81.169.238 port 49636 ssh2
  ...

• 2024-10-02T15:11:45.376877-04:00 srv-UXQS4A.incognet.io sshd[1232]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T15:11:47.516425-04:00 srv-UXQS4A.incognet.io sshd[1232]: Failed password for invalid user root from 183.81.169.238 port 40704 ssh2
  ...

• Oct 2 21:11:41 amk sshd\[5808\]: Failed password for root from 183.81.169.238 port 55862 ssh2Oct 2 21:11:45 amk sshd\[5811\]: Failed password for root from 183.81.169.238 port 55880 ssh2
  ...

• 2024-10-02T19:11:08.217947+00:00 Linux05 sshd[781310]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T19:11:10.612902+00:00 Linux05 sshd[781310]: Failed password for root from 183.81.169.238 port 37618 ssh2
  2024-10-02T19:11:15.203490+00:00 Linux05 sshd[781629]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T19:11:17.226925+00:00 Linux05 sshd[781629]: Failed password for root from 183.81.169.238 port 37622 ssh2
  2024-10-02T19:11:19.652247+00:00 Linux05 sshd[781920]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T19:11:22.222833+00:00 Linux05 sshd[781920]: Failed password for root from 183.81.169.238 port 60932 ssh2
  2024-10-02T19:11:26.704831+00:00 Linux05 sshd[782232]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=18
  ...

• Oct 2 19:10:59 web-proxy02 sshd[1589177]: Failed password for root from 183.81.169.238 port 37942 ssh2
  Oct 2 19:11:03 web-proxy02 sshd[1589180]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 19:11:04 web-proxy02 sshd[1589180]: Failed password for root from 183.81.169.238 port 37966 ssh2
  ...

• f2b report

• Oct 2 21:10:35 pinkypie sshd[58403]: Failed password for root from 183.81.169.238 port 53170 ssh2
  Oct 2 21:10:40 pinkypie sshd[58405]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 21:10:42 pinkypie sshd[58405]: Failed password for root from 183.81.169.238 port 37676 ssh2
  ...

• 2024-10-02T21:10:19.920025+02:00 lXXX.com sshd[316042]: Failed password for root from 183.81.169.238 port 33146 ssh2
  2024-10-02T21:10:22.469376+02:00 lXXX.com sshd[316044]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T21:10:24.548480+02:00 lXXX.com sshd[316044]: Failed password for root from 183.81.169.238 port 33152 ssh2
  ...

• 3:12:47I1002 18:
  Fail2ban action triggered

• Oct 2 19:09:40 internal-mail-rafled-com sshd[1105940]: Invalid user Antminer from 183.81.169.238 port 56352
  ...

• Oct 2 20:09:27 nervous-edison8 sshd[1288498]: Failed password for root from 183.81.169.238 port 34252 ssh2
  Oct 2 20:09:29 nervous-edison8 sshd[1288530]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 20:09:31 nervous-edison8 sshd[1288530]: Failed password for root from 183.81.169.238 port 46438 ssh2
  Oct 2 20:09:33 nervous-edison8 sshd[1288556]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 20:09:35 nervous-edison8 sshd[1288556]: Failed password for root from 183.81.169.238 port 46462 ssh2
  ...

• 2024-10-03T02:09:22.677622 vm01 sshd[2810957]: Invalid user Antminer from 183.81.169.238 port 50586
  2024-10-03T02:09:24.451236 vm01 sshd[2810959]: Invalid user Antminer from 183.81.169.238 port 50598
  2024-10-03T02:09:34.200993 vm01 sshd[2810971]: Invalid user admin from 183.81.169.238 port 47576

• Oct 2 21:09:17 v22019038103785759 sshd\[26080\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 21:09:19 v22019038103785759 sshd\[26080\]: Failed password for root from 183.81.169.238 port 56734 ssh2
  Oct 2 21:09:20 v22019038103785759 sshd\[26082\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 21:09:22 v22019038103785759 sshd\[26082\]: Failed password for root from 183.81.169.238 port 56764 ssh2
  Oct 2 21:09:25 v22019038103785759 sshd\[26084\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  ...

• Failed password for root from 183.81.169.238 port 38644 ssh2
  pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Failed password for root from 183.81.169.238 port 46056 ssh2
  pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Failed password for root from 183.81.169.238 port 46068 ssh2

• Bruteforce detected by fail2ban

• FW-PortScan: Traffic Blocked srcport=48950 dstport=22

• Oct 2 20:08:15 fplmcserver sshd[6423]: Invalid user Antminer from 183.81.169.238 port 40532
  Oct 2 20:08:16 fplmcserver sshd[6428]: Invalid user Antminer from 183.81.169.238 port 40538
  ...

• (sshd) Failed SSH login from 183.81.169.238 (NL/The Netherlands/-): 3 in the last 3600 secs

• Oct 2 21:06:40 * sshd[2060659]: Failed password for root from 183.81.169.238 port 50822 ssh2
  Oct 2 21:06:43 * sshd[2060662]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 21:06:46 * sshd[2060662]: Failed password for root from 183.81.169.238 port 50830 ssh2

• Banned after 3 attempts against sshd

• 2024-10-02T12:06:16.611680 web sshd[350055]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T12:06:18.255433 web sshd[350055]: Failed password for root from 183.81.169.238 port 53758 ssh2
  ...

• SSH Brute-Force Attack on a server hosted by PulseServers.com - CA10 Honeypot
  ...

• Oct 2 19:06:05 Sildom2 sshd[1559384]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 19:06:07 Sildom2 sshd[1559384]: Failed password for root from 183.81.169.238 port 50896 ssh2
  ...

• Sep 29 04:32:35 wh02 sshd[1964684]: Connection closed by authenticating user root 183.81.169.238 port 34140 [preauth]
  Sep 29 04:32:37 wh02 sshd[1964687]: Connection closed by authenticating user root 183.81.169.238 port 34170 [preauth]
  Sep 29 04:32:39 wh02 sshd[1964689]: Connection closed by authenticating user root 183.81.169.238 port 34180 [preauth]
  Sep 29 04:32:41 wh02 sshd[1964691]: Connection closed by authenticating user root 183.81.169.238 port 34200 [preauth]
  Sep 29 04:32:42 wh02 sshd[1964693]: Connection closed by authenticating user root 183.81.169.238 port 34202 [preauth]
  Sep 29 04:32:45 wh02 sshd[1964695]: Connection closed by authenticating user root 183.81.169.238 port 34212 [preauth]
  Sep 29 04:32:46 wh02 sshd[1964698]: Connection closed by authenticating user root 183.81.169.238 port 39934 [preauth]
  Sep 29 04:32:48 wh02 sshd[1964700]: Connection closed by authenticating user root 183.81.169.238 port 39952 [preauth]
  Sep 29 04:32:49 wh02 sshd[1964703]: Connection closed by

• Oct 2 15:05:53 www sshd\[17893\]: Invalid user Antminer from 183.81.169.238
  Oct 2 15:05:55 www sshd\[17895\]: Invalid user Antminer from 183.81.169.238
  ...

• Oct 2 19:05:15 24fire sshd[193129]: Failed password for root from 183.81.169.238 port 60932 ssh2
  Oct 2 19:05:19 24fire sshd[193131]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 19:05:21 24fire sshd[193131]: Failed password for root from 183.81.169.238 port 41170 ssh2
  Oct 2 19:05:25 24fire sshd[193135]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 19:05:27 24fire sshd[193135]: Failed password for root from 183.81.169.238 port 41216 ssh2
  ...

• Oct 2 19:04:49 alpha sshd[2257248]: Failed password for root from 183.81.169.238 port 46242 ssh2
  Oct 2 19:04:52 alpha sshd[2257324]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 19:04:54 alpha sshd[2257324]: Failed password for root from 183.81.169.238 port 46252 ssh2
  Oct 2 19:04:57 alpha sshd[2257400]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 19:04:59 alpha sshd[2257400]: Failed password for root from 183.81.169.238 port 34984 ssh2
  ...

• tcp/22 (27 or more attempts)

• Failed SSH attempt from 183.81.169.238 (on Stockholm)

• 10547 attempts since 14.07.2024 04:18:57 UTC - last one: 2024-10-02T19:54:03.489632+02:00 alpha sshd[2338413]: Connection closed by invalid user baikal 183.81.169.238 port 33910 [preauth]

• was attempting to break in as 'root' from port 56492

• Invalid user Antminer from 183.81.169.238 port 43990

• Oct 2 21:58:23 server2 sshd\[17064\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 21:58:25 server2 sshd\[17066\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 21:58:26 server2 sshd\[17068\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 21:58:28 server2 sshd\[17070\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 21:58:29 server2 sshd\[17073\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 21:58:31 server2 sshd\[17075\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers

• Oct 2 18:58:02 database sshd[942438]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:58:04 database sshd[942438]: Failed password for root from 183.81.169.238 port 58214 ssh2
  ...

• 2024-10-02T20:56:57.323805+02:00 ubuntu sshd[156264]: Failed password for root from 183.81.169.238 port 55474 ssh2
  2024-10-02T20:57:00.290775+02:00 ubuntu sshd[156266]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T20:57:02.269604+02:00 ubuntu sshd[156266]: Failed password for root from 183.81.169.238 port 43124 ssh2
  2024-10-02T20:57:05.439676+02:00 ubuntu sshd[156270]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T20:57:07.774071+02:00 ubuntu sshd[156270]: Failed password for root from 183.81.169.238 port 53474 ssh2
  ...

• Oct 2 20:55:44 h2930838 sshd[17318]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 20:55:46 h2930838 sshd[17318]: Failed password for invalid user root from 183.81.169.238 port 56090 ssh2

• Oct 2 18:55:21 archivo-colectivo sshd[3871508]: Connection closed by authenticating user root 183.81.169.238 port 39566 [preauth]
  Oct 2 18:55:23 archivo-colectivo sshd[3871510]: Connection closed by authenticating user root 183.81.169.238 port 39586 [preauth]
  Oct 2 18:55:25 archivo-colectivo sshd[3871512]: Connection closed by authenticating user root 183.81.169.238 port 45744 [preauth]
  ...

• Oct 2 14:54:43 ny01 sshd[2629856]: Failed password for root from 183.81.169.238 port 42298 ssh2
  Oct 2 14:54:45 ny01 sshd[2629858]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 14:54:47 ny01 sshd[2629858]: Failed password for root from 183.81.169.238 port 41192 ssh2
  Oct 2 14:54:50 ny01 sshd[2629860]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 14:54:52 ny01 sshd[2629860]: Failed password for root from 183.81.169.238 port 41246 ssh2

• 2024-10-02T20:54:43.582430+02:00 ondrej-desktop sshd[999389]: Failed password for root from 183.81.169.238 port 53944 ssh2
  2024-10-02T20:54:46.336153+02:00 ondrej-desktop sshd[999570]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T20:54:47.918645+02:00 ondrej-desktop sshd[999570]: Failed password for root from 183.81.169.238 port 55664 ssh2
  ...

• Oct 2 12:52:09 mortgagebase sshd[10585]: Failed password for root from 183.81.169.238 port 41930 ssh2
  Oct 2 12:52:13 mortgagebase sshd[10587]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 12:52:15 mortgagebase sshd[10587]: Failed password for root from 183.81.169.238 port 41958 ssh2
  Oct 2 12:52:18 mortgagebase sshd[10590]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 12:52:20 mortgagebase sshd[10590]: Failed password for root from 183.81.169.238 port 47378 ssh2
  ...

• Oct 2 20:52:15 arayat sshd[11599]: Failed password for root from 183.81.169.238 port 39586 ssh2
  Oct 2 20:52:18 arayat sshd[11601]: Failed password for root from 183.81.169.238 port 39590 ssh2
  Oct 2 20:52:20 arayat sshd[11603]: Failed password for root from 183.81.169.238 port 39612 ssh2
  Oct 2 20:52:22 arayat sshd[11605]: Failed password for root from 183.81.169.238 port 39628 ssh2
  ...

• Unauthorized SSH connection attempt detected / 3 attempts (via Fail2Ban)

• Oct 2 18:51:57 destiny sshd[2045234]: Connection closed by invalid user root 183.81.169.238 port 53594 [preauth]
  Oct 2 18:51:59 destiny sshd[2045247]: User root not allowed because account is locked
  Oct 2 18:51:59 destiny sshd[2045247]: Connection closed by invalid user root 183.81.169.238 port 53604 [preauth]
  Oct 2 18:52:01 destiny sshd[2045250]: User root not allowed because account is locked
  Oct 2 18:52:01 destiny sshd[2045250]: Connection closed by invalid user root 183.81.169.238 port 53618 [preauth]
  ...

• 2024-10-02T18:51:46.816959us1.starnode.us sshd[1353082]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T18:51:49.355378us1.starnode.us sshd[1353082]: Failed password for root from 183.81.169.238 port 48822 ssh2
  ...

• Oct 2 20:51:10 mx1 sshd[4023083]: User root from 183.81.169.238 not allowed because not listed in AllowUsers

• Oct 2 20:51:00 arm-am sshd[75425]: Invalid user Antminer from 183.81.169.238 port 50220
  Oct 2 20:51:01 arm-am sshd[75427]: Invalid user Antminer from 183.81.169.238 port 50234
  Oct 2 20:51:09 arm-am sshd[75439]: Invalid user admin from 183.81.169.238 port 58772
  ...

• 2024-10-02T13:49:52.303984-05:00 instance-20240522-152753 sshd[2505504]: Invalid user Antminer from 183.81.169.238 port 37044
  2024-10-02T13:49:54.791114-05:00 instance-20240522-152753 sshd[2505506]: Invalid user Antminer from 183.81.169.238 port 37058
  2024-10-02T13:50:09.280120-05:00 instance-20240522-152753 sshd[2505581]: Invalid user admin from 183.81.169.238 port 45020
  2024-10-02T13:50:11.694039-05:00 instance-20240522-152753 sshd[2505587]: Invalid user baikal from 183.81.169.238 port 45024
  ...

• Oct 2 18:49:58 shirus29 sshd[2470156]: Failed password for root from 183.81.169.238 port 51498 ssh2
  Oct 2 18:50:02 shirus29 sshd[2470158]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:50:04 shirus29 sshd[2470158]: Failed password for root from 183.81.169.238 port 51522 ssh2
  Oct 2 18:50:08 shirus29 sshd[2470160]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:50:09 shirus29 sshd[2470160]: Failed password for root from 183.81.169.238 port 56310 ssh2
  ...

• Invalid user Antminer from 183.81.169.238 port 48166

• 2024-10-02T18:49:36.596364+00:00 srv67 sshd[57200]: Connection closed by authenticating user root 183.81.169.238 port 54796 [preauth]
  ...

• 2024-10-03T02:47:02.873651+08:00 raindance sshd[259873]: Failed password for root from 183.81.169.238 port 45856 ssh2
  2024-10-03T02:47:05.512106+08:00 raindance sshd[259875]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T02:47:08.143617+08:00 raindance sshd[259875]: Failed password for root from 183.81.169.238 port 45880 ssh2
  2024-10-03T02:47:13.092789+08:00 raindance sshd[259880]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T02:47:15.488021+08:00 raindance sshd[259880]: Failed password for root from 183.81.169.238 port 60514 ssh2
  ...

• Oct 2 22:16:36 Digitalogic sshd[1225453]: Connection closed by authenticating user root 183.81.169.238 port 37638 [preauth]
  Oct 2 22:16:38 Digitalogic sshd[1225483]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 22:16:40 Digitalogic sshd[1225483]: Failed password for root from 183.81.169.238 port 47288 ssh2
  ...

• FW-PortScan: Traffic Blocked srcport=51944 dstport=22

• Oct 2 18:45:38 webserver sshd[738394]: Failed password for root from 183.81.169.238 port 52652 ssh2
  Oct 2 18:45:41 webserver sshd[738396]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:45:44 webserver sshd[738396]: Failed password for root from 183.81.169.238 port 52694 ssh2
  Oct 2 18:45:48 webserver sshd[738398]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:45:50 webserver sshd[738398]: Failed password for root from 183.81.169.238 port 39710 ssh2
  ...

• 2024-10-02T20:45:04.196632+02:00 rpi1 sshd[5187]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T20:45:05.806089+02:00 rpi1 sshd[5187]: Failed password for root from 183.81.169.238 port 56170 ssh2
  ...

• 2024-10-02T18:44:04.630424+00:00 mail-backup sshd[56556]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-02T18:44:06.168911+00:00 mail-backup sshd[56558]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-02T18:44:08.215678+00:00 mail-backup sshd[56560]: User root from 183.81.169.238 not allowed because not listed in AllowUsers

• Oct 2 20:43:53 s3 sshd[42631]: Invalid user Antminer from 183.81.169.238 port 50888
  Oct 2 20:43:54 s3 sshd[42633]: Invalid user Antminer from 183.81.169.238 port 45242
  Oct 2 20:44:05 s3 sshd[42645]: Invalid user admin from 183.81.169.238 port 57044
  ...

• Oct 2 11:43:36 nunnother sshd\[31084\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 11:43:38 nunnother sshd\[31084\]: Failed password for root from 183.81.169.238 port 43004 ssh2
  Oct 2 11:43:41 nunnother sshd\[31086\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 11:43:42 nunnother sshd\[31086\]: Failed password for root from 183.81.169.238 port 43008 ssh2
  Oct 2 11:43:45 nunnother sshd\[31088\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  ...

• Invalid SSH login attempt

• 2024-10-02T20:42:02.748062+02:00 nirox sshd[188085]: Invalid user Antminer from 183.81.169.238 port 49750
  ...

• Oct 2 18:41:20 ice2 sshd[1963264]: Invalid user Antminer from 183.81.169.238 port 38492
  Oct 2 18:41:22 ice2 sshd[1963266]: Invalid user Antminer from 183.81.169.238 port 38504
  ...

• Bruteforce detected by fail2ban SSH

• Oct 2 15:41:02 SRC=183.81.169.238 PROTO=TCP SPT=50328 DPT=22 SYN
  ...

• 2024-10-02T20:40:45.207514+02:00 pokevador sshd[356342]: Failed password for root from 183.81.169.238 port 44748 ssh2
  2024-10-02T20:40:48.630601+02:00 pokevador sshd[356381]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T20:40:51.171610+02:00 pokevador sshd[356381]: Failed password for root from 183.81.169.238 port 44944 ssh2
  ...

• 2024-10-02T21:40:35.915921+03:00 gate kernel: [383373.461443] nftables: JAIL-SSH IN=wan OUT= MAC= SRC=183.81.169.238 DST=xxx.xxx.xxx.xxx LEN=40 TOS=0x00 PREC=0x00 TTL=245 ID=54321 PROTO=TCP SPT=49527 DPT=22 WINDOW=65535 RES=0x00 SYN URGP=0
  ...

• 2024-10-02T20:40:17.023800+02:00 pve sshd[1839300]: Failed password for root from 183.81.169.238 port 45318 ssh2
  2024-10-02T20:40:19.535583+02:00 pve sshd[1839943]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T20:40:21.759615+02:00 pve sshd[1839943]: Failed password for root from 183.81.169.238 port 35134 ssh2
  2024-10-02T20:40:24.005708+02:00 pve sshd[1841252]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T20:40:25.778946+02:00 pve sshd[1841252]: Failed password for root from 183.81.169.238 port 35168 ssh2
  ...

• 2024-10-02T18:40:10.672745+00:00 vultrregeneration0 sshd[54294]: Connection closed by authenticating user root 183.81.169.238 port 50196 [preauth]
  ...

• 2024-10-02T20:39:49.466761 mail2.akcurate.de sshd[237996]: Connection closed by authenticating user root 183.81.169.238 port 36598 [preauth]
  ...

• Oct 2 20:39:29 ns37 sshd[24592]: Failed password for root from 183.81.169.238 port 54712 ssh2
  Oct 2 20:39:34 ns37 sshd[24594]: Failed password for root from 183.81.169.238 port 54736 ssh2
  ...

• 2024-10-02T18:38:21.572826+00:00 minio-par-01.pdx.net.uk sshd[199062]: Invalid user Antminer from 183.81.169.238 port 40502
  2024-10-02T18:38:22.866381+00:00 minio-par-01.pdx.net.uk sshd[199064]: Invalid user Antminer from 183.81.169.238 port 40504
  2024-10-02T18:38:33.432232+00:00 minio-par-01.pdx.net.uk sshd[199076]: Invalid user admin from 183.81.169.238 port 44698
  ...

• Oct 2 20:37:50 gateway1-old sshd[20430]: Failed password for root from 183.81.169.238 port 32974 ssh2
  Oct 2 20:37:56 gateway1-old sshd[20739]: Failed password for root from 183.81.169.238 port 32986 ssh2

• Oct 2 18:36:45 ubuntu sshd[656789]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:36:47 ubuntu sshd[656789]: Failed password for root from 183.81.169.238 port 43266 ssh2
  ...

• Oct 2 18:36:13 jump sshd[3234947]: Failed password for root from 183.81.169.238 port 39518 ssh2
  Oct 2 18:36:16 jump sshd[3234951]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:36:18 jump sshd[3234951]: Failed password for root from 183.81.169.238 port 39050 ssh2
  ...

• Oct 2 11:35:58 LU-VPS01 sshd[9435]: Failed password for root from 183.81.169.238 port 47422 ssh2
  Oct 2 11:36:03 LU-VPS01 sshd[9439]: Failed password for root from 183.81.169.238 port 47436 ssh2
  ...

• 2024-10-02T18:35:44.776465+00:00 deb1 sshd[74183]: Connection closed by authenticating user root 183.81.169.238 port 55532 [preauth]
  ...

• Detected 3 distributed attacks from 183.81.169.238. LF_DISTATTACK; Logs: 2024-10-02T20:34:17.273483+02:00 insightVM sshd[3320844]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root 2024-10-02T20:34:19.136818+02:00 insightVM sshd[3320844]: Failed password for root from 183.81.169.238 port 58176 ssh2 2024-10-02T20:34:21.652614+02:00 insightVM sshd[3320858]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root

• Oct 2 21:33:57 vds-100908 sshd[67755]: Failed password for root from 183.81.169.238 port 40048 ssh2
  Oct 2 21:34:00 vds-100908 sshd[67757]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 21:34:03 vds-100908 sshd[67757]: Failed password for root from 183.81.169.238 port 40060 ssh2
  Oct 2 21:34:06 vds-100908 sshd[67759]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 21:34:08 vds-100908 sshd[67759]: Failed password for root from 183.81.169.238 port 56460 ssh2
  ...

• 2024-10-03T02:32:10.272130+08:00 VM65536 sshd[914150]: Connection closed by authenticating user root 183.81.169.238 port 37716 [preauth]
  2024-10-03T02:32:13.133922+08:00 VM65536 sshd[914152]: Connection closed by authenticating user root 183.81.169.238 port 37728 [preauth]
  2024-10-03T02:32:16.270997+08:00 VM65536 sshd[914156]: Connection closed by authenticating user root 183.81.169.238 port 37760 [preauth]
  ...

• Failed password for root from 183.81.169.238 port 52366 ssh2
  pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Failed password for root from 183.81.169.238 port 52372 ssh2
  pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Failed password for root from 183.81.169.238 port 56904 ssh2

• SSH bruteforce

• Failed SSH attempt from 183.81.169.238 (on Viken)

• 2024-10-02 15:42:14 UTC Unauthorized activity to TCP port 22. SSH

• Automatic ban by Fail2Ban

• Oct 2 19:30:33 jackstringer sshd[1996860]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 19:30:34 jackstringer sshd[1996860]: Failed password for root from 183.81.169.238 port 41788 ssh2
  Oct 2 19:30:36 jackstringer sshd[1996881]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 19:30:38 jackstringer sshd[1996881]: Failed password for root from 183.81.169.238 port 41804 ssh2
  ...

• Oct 2 14:30:07 fremontnet-scca-01 sshd[14125]: Failed password for root from 183.81.169.238 port 50060 ssh2
  Oct 2 14:30:12 fremontnet-scca-01 sshd[14127]: Failed password for root from 183.81.169.238 port 60546 ssh2

• Events: TCP SYN Discovery or Flooding, Seen 136 times in the last 10800 seconds

• Oct 2 14:27:32 graph sshd[1955778]: Failed password for root from 183.81.169.238 port 36462 ssh2
  Oct 2 14:27:35 graph sshd[1955790]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 14:27:37 graph sshd[1955790]: Failed password for root from 183.81.169.238 port 55172 ssh2
  Oct 2 14:27:41 graph sshd[1955792]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 14:27:43 graph sshd[1955792]: Failed password for root from 183.81.169.238 port 55198 ssh2
  ...

• Oct 2 18:27:05 lavalink sshd[3203095]: Invalid user Antminer from 183.81.169.238 port 44566
  Oct 2 18:27:08 lavalink sshd[3203097]: Invalid user Antminer from 183.81.169.238 port 44586
  Oct 2 18:27:21 lavalink sshd[3203164]: Invalid user admin from 183.81.169.238 port 46002
  ...

• FW-PortScan: Traffic Blocked srcport=53288 dstport=22

• [2024 Oct 2 20:13:49] Brute-Force detected from 183.81.169.238 for sshd fails: 2x () USER=baikal SPT=41850

• [rede-166-249] (sshd) Failed SSH login from 183.81.169.238 (NL/The Netherlands/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Oct 2 15:26:14 sshd[31001]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=[USERNAME]
  Oct 2 15:26:16 sshd[31001]: Failed password for [USERNAME] from 183.81.169.238 port 34274 ssh2
  Oct 2 15:26:20 sshd[31012]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=[USERNAME]
  Oct 2 15:26:23 sshd[31012]: Failed password for [USERNAME] from 183.81.169.238 port 39568 ssh2
  Oct 2 15:

• Oct 2 20:26:09 git sshd[549111]: Invalid user Antminer from 183.81.169.238 port 58136
  Oct 2 20:26:11 git sshd[549113]: Invalid user Antminer from 183.81.169.238 port 58154
  Oct 2 20:26:22 git sshd[549135]: Invalid user admin from 183.81.169.238 port 60944
  ...

• Oct 2 20:26:08 hosting sshd[2471316]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 20:26:09 hosting sshd[2471316]: Failed password for root from 183.81.169.238 port 36538 ssh2
  Oct 2 20:26:12 hosting sshd[2471357]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 20:26:15 hosting sshd[2471357]: Failed password for root from 183.81.169.238 port 36568 ssh2

• Invalid user Antminer from 183.81.169.238 port 39430

• Oct 2 20:25:26 v4940 sshd[3976916]: Failed password for root from 183.81.169.238 port 49376 ssh2
  Oct 2 20:25:28 v4940 sshd[3976942]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 20:25:30 v4940 sshd[3976942]: Failed password for root from 183.81.169.238 port 47596 ssh2
  ...

• Oct 2 20:25:22 s1-4-gra7 sshd[1905268]: Invalid user Antminer from 183.81.169.238 port 37002
  Oct 2 20:25:23 s1-4-gra7 sshd[1905270]: Invalid user Antminer from 183.81.169.238 port 37004

• Caught by Fail2Ban

• Oct 2 18:23:01 ovh sshd[3071293]: Failed password for root from 183.81.169.238 port 51816 ssh2
  Oct 2 18:23:04 ovh sshd[3071384]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:23:06 ovh sshd[3071384]: Failed password for root from 183.81.169.238 port 51822 ssh2
  Oct 2 18:23:08 ovh sshd[3071389]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:23:10 ovh sshd[3071389]: Failed password for root from 183.81.169.238 port 38238 ssh2
  ...

• 2024-10-02T14:21:54.341538-04:00 site sshd[221387]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-02T14:21:56.834584-04:00 site sshd[221389]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-02T14:21:59.288541-04:00 site sshd[221391]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  ...

• Brute force SSH login

• 2024-10-02 18:20:32,644 fail2ban.actions [624]: NOTICE [sshd] Ban 183.81.169.238

• PBK Oct 2 20:19:28 websrv01 sshd[1216969]: Failed password for root from 183.81.169.238 port 33774 ssh2
  Oct 2 20:19:31 websrv01 sshd[1216971]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 20:19:33 websrv01 sshd[1216971]: Failed password for root from 183.81.169.238 port 33834 ssh2
  Oct 2 20:19:37 websrv01 sshd[1216973]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 20:19:40 websrv01 sshd[1216973]: Failed password for root from 183.81.169.238 port 46784 ssh2

• Oct 2 20:19:16 maximus sshd[4113778]: Failed password for root from 183.81.169.238 port 47860 ssh2
  Oct 2 20:19:20 maximus sshd[4113808]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 20:19:22 maximus sshd[4113808]: Failed password for root from 183.81.169.238 port 47832 ssh2
  Oct 2 20:19:26 maximus sshd[4113810]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 20:19:28 maximus sshd[4113810]: Failed password for root from 183.81.169.238 port 40560 ssh2
  ...

• 2024-10-02T19:19:07.267767+01:00 jane sshd[3386980]: Failed password for root from 183.81.169.238 port 49722 ssh2
  2024-10-02T19:19:09.788760+01:00 jane sshd[3387054]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T19:19:11.331288+01:00 jane sshd[3387054]: Failed password for root from 183.81.169.238 port 49744 ssh2
  ...

• Fail2Ban62

• 2024-10-02T14:17:39.824856-04:00 collabhost.computernewb.com sshd-session[3663476]: Invalid user Antminer from 183.81.169.238 port 50454
  2024-10-02T14:17:42.098278-04:00 collabhost.computernewb.com sshd-session[3663478]: Invalid user Antminer from 183.81.169.238 port 50460
  2024-10-02T14:17:54.511168-04:00 collabhost.computernewb.com sshd-session[3663498]: Invalid user admin from 183.81.169.238 port 60768
  ...

• Oct 2 21:16:37 server2 sshd\[13672\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 21:16:39 server2 sshd\[13690\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 21:16:39 server2 sshd\[13696\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 21:16:41 server2 sshd\[13698\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 21:16:43 server2 sshd\[13707\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 21:16:45 server2 sshd\[13711\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers

• Oct 2 20:16:12 hosting08 sshd[19540]: Failed password for root from 183.81.169.238 port 56170 ssh2
  Oct 2 20:16:17 hosting08 sshd[19544]: Failed password for root from 183.81.169.238 port 55012 ssh2
  ...

• 2024-10-02T20:15:48.389070+02:00 servidor1 sshd[73362]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-02T20:15:48.732437+02:00 servidor1 sshd[73362]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T20:15:50.349922+02:00 servidor1 sshd[73362]: Failed password for invalid user root from 183.81.169.238 port 49536 ssh2
  2024-10-02T20:15:52.565180+02:00 servidor1 sshd[73364]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-02T20:15:53.367868+02:00 servidor1 sshd[73364]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T20:15:56.002120+02:00 servidor1 sshd[73364]: Failed password for invalid user root from 183.81.169.238 port 49554 ssh2
  2024-10-02T20:15:59.196946+02:00 servidor1 sshd[73380]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  ...

• Oct 2 18:15:21 elasticsearch sshd[242774]: Invalid user Antminer from 183.81.169.238 port 53036
  Oct 2 18:15:24 elasticsearch sshd[242777]: Invalid user Antminer from 183.81.169.238 port 53072
  Oct 2 18:15:38 elasticsearch sshd[242789]: Invalid user admin from 183.81.169.238 port 60242
  ...

• Invalid user Antminer from 183.81.169.238 port 54624

• 2024-10-02 18:13:53,152 quad proftpd[935948] quad (183.81.169.238[183.81.169.238]): USER root: no such user found from 183.81.169.238 [183.81.169.238] to 2.56.97.107:22

• 2024-10-03T02:12:26.856264 jp3.cdn.420422709.xyz sshd[92023]: Failed password for root from 183.81.169.238 port 60266 ssh2
  2024-10-03T02:12:31.711016 jp3.cdn.420422709.xyz sshd[92026]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T02:12:33.283790 jp3.cdn.420422709.xyz sshd[92026]: Failed password for root from 183.81.169.238 port 55300 ssh2
  ...

• Oct 2 18:12:15 mail sshd[206199]: Failed password for root from 183.81.169.238 port 53860 ssh2
  Oct 2 18:12:17 mail sshd[206201]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:12:19 mail sshd[206201]: Failed password for root from 183.81.169.238 port 60172 ssh2
  ...

• 2024-10-02T20:11:55.665789+02:00 cloud..de sshd[2403211]: Invalid user Antminer from 183.81.169.238 port 42508
  2024-10-02T20:11:57.404541+02:00 cloud..de sshd[2403214]: Invalid user Antminer from 183.81.169.238 port 42538
  2024-10-02T20:12:07.191759+02:00 cloud..de sshd[2403228]: Invalid user admin from 183.81.169.238 port 56376

• Oct 2 18:11:48 nlfr1 sshd[2572642]: Invalid user Antminer from 183.81.169.238 port 53348
  Oct 2 18:11:49 nlfr1 sshd[2573396]: Invalid user Antminer from 183.81.169.238 port 53366
  Oct 2 18:11:58 nlfr1 sshd[2576101]: Invalid user admin from 183.81.169.238 port 42242
  ...

• Invalid user Antminer from 183.81.169.238 port 52956

• [18:10] Attempted SSH login on port 22 with credentials root:0

• Oct 2 20:10:04 monitor sshd[3811472]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 20:10:10 monitor sshd[3811474]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 20:10:15 monitor sshd[3811477]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 20:10:20 monitor sshd[3811479]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 20:10:25 monitor sshd[3811481]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  ...

• Oct 2 18:10:23 cloud sshd[3846449]: Invalid user Antminer from 183.81.169.238 port 35252
  Oct 2 18:10:25 cloud sshd[3846455]: Invalid user Antminer from 183.81.169.238 port 54820
  ...

• Security system: Unauthorised SSH/Telnet login attempt with user "root" at 2024-10-02T18:10:05Z

• 2024-10-02T18:09:30.405985+00:00 Linux11 sshd[2107280]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T18:09:32.465414+00:00 Linux11 sshd[2107280]: Failed password for root from 183.81.169.238 port 47966 ssh2
  2024-10-02T18:09:36.522524+00:00 Linux11 sshd[2107551]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T18:09:39.404836+00:00 Linux11 sshd[2107551]: Failed password for root from 183.81.169.238 port 53898 ssh2
  2024-10-02T18:09:41.951575+00:00 Linux11 sshd[2107880]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T18:09:44.186437+00:00 Linux11 sshd[2107880]: Failed password for root from 183.81.169.238 port 53920 ssh2
  2024-10-02T18:09:47.743731+00:00 Linux11 sshd[2108101]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= r
  ...

• FW-PortScan: Traffic Blocked srcport=60093 dstport=22

• Oct 2 14:09:19 scp sshd[2264234]: Invalid user Antminer from 183.81.169.238 port 52260
  Oct 2 14:09:22 scp sshd[2264314]: Invalid user Antminer from 183.81.169.238 port 52262
  Oct 2 14:09:37 scp sshd[2264658]: Invalid user admin from 183.81.169.238 port 56186
  ...

• Oct 2 18:09:21 mark sshd[432787]: Failed password for root from 183.81.169.238 port 47286 ssh2
  Oct 2 18:09:24 mark sshd[433263]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:09:27 mark sshd[433263]: Failed password for root from 183.81.169.238 port 47294 ssh2
  Oct 2 18:09:31 mark sshd[434213]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:09:32 mark sshd[434213]: Failed password for root from 183.81.169.238 port 56550 ssh2
  ...

• Oct 2 21:39:16 Digitalogic sshd[1215182]: Connection closed by authenticating user root 183.81.169.238 port 48282 [preauth]
  Oct 2 21:39:19 Digitalogic sshd[1215267]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 21:39:20 Digitalogic sshd[1215267]: Failed password for root from 183.81.169.238 port 53996 ssh2
  ...

• ssh-bruteforce/k3

• Oct 2 20:08:19 de-kae sshd[3475797]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 20:08:20 de-kae sshd[3475797]: Failed password for root from 183.81.169.238 port 37768 ssh2
  ...

• $f2bV_matches

• 2024-10-02T14:06:48.192039-04:00 raspberrypi sshd[91559]: Connection closed by authenticating user root 183.81.169.238 port 33278 [preauth]
  2024-10-02T14:06:50.444817-04:00 raspberrypi sshd[91561]: Connection closed by authenticating user root 183.81.169.238 port 33294 [preauth]
  2024-10-02T14:06:52.350846-04:00 raspberrypi sshd[91563]: Connection closed by authenticating user root 183.81.169.238 port 33318 [preauth]
  ...

• Oct 2 18:06:16 c2 sshd[2025108]: Failed password for root from 183.81.169.238 port 41516 ssh2
  Oct 2 18:06:19 c2 sshd[2025110]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:06:20 c2 sshd[2025110]: Failed password for root from 183.81.169.238 port 45740 ssh2
  Oct 2 18:06:23 c2 sshd[2025114]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:06:25 c2 sshd[2025114]: Failed password for root from 183.81.169.238 port 45790 ssh2
  ...

• Fail2ban: Attempted SSH Brute Force

• Oct 2 18:05:28 ns5024002 sshd[1423447]: Failed password for root from 183.81.169.238 port 52140 ssh2
  Oct 2 18:05:33 ns5024002 sshd[1423704]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:05:35 ns5024002 sshd[1423704]: Failed password for root from 183.81.169.238 port 52148 ssh2
  Oct 2 18:05:39 ns5024002 sshd[1423836]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:05:41 ns5024002 sshd[1423836]: Failed password for root from 183.81.169.238 port 49156 ssh2
  ...

• 2024-10-02T20:04:38.064259+02:00 neo sshd[1938596]: Invalid user Antminer from 183.81.169.238 port 36660
  ...

• 2024-10-02T20:04:21.161778+02:00 devcricle sshd[28669]: Failed password for root from 183.81.169.238 port 58074 ssh2
  2024-10-02T20:04:24.722111+02:00 devcricle sshd[28671]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T20:04:26.773123+02:00 devcricle sshd[28671]: Failed password for root from 183.81.169.238 port 58098 ssh2
  ...

• Oct 2 10:54:53 cm0zabbbix00 sshd[428186]: Invalid user Antminer from 183.81.169.238 port 55322
  Oct 2 10:54:56 cm0zabbbix00 sshd[428188]: Invalid user Antminer from 183.81.169.238 port 46586
  Oct 2 10:55:11 cm0zabbbix00 sshd[428210]: Invalid user admin from 183.81.169.238 port 57348
  Oct 2 10:55:13 cm0zabbbix00 sshd[428212]: Invalid user baikal from 183.81.169.238 port 57360
  Oct 2 11:04:24 cm0zabbbix00 sshd[428589]: Invalid user Antminer from 183.81.169.238 port 60250
  ...

• tcp/22 (42 or more attempts)

• Oct 2 18:03:25 cknpih001 sshd[29256]: Failed password for root from 183.81.169.238 port 51012 ssh2
  Oct 2 18:03:29 cknpih001 sshd[29258]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:03:31 cknpih001 sshd[29258]: Failed password for root from 183.81.169.238 port 55616 ssh2
  Oct 2 18:03:33 cknpih001 sshd[29260]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:03:35 cknpih001 sshd[29260]: Failed password for root from 183.81.169.238 port 55638 ssh2
  ...

• 2024-10-02T14:03:04.364096-04:00 nova3 sshd[1574375]: Failed password for root from 183.81.169.238 port 51448 ssh2
  2024-10-02T14:03:07.809296-04:00 nova3 sshd[1574412]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T14:03:09.286348-04:00 nova3 sshd[1574412]: Failed password for root from 183.81.169.238 port 59402 ssh2
  2024-10-02T14:03:12.110589-04:00 nova3 sshd[1574448]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T14:03:14.941746-04:00 nova3 sshd[1574448]: Failed password for root from 183.81.169.238 port 59406 ssh2
  ...

• Inteceptor Intrusion Detector: failed_password on sshd module PID: (980955)

• Ports: 22; 2 attempts

• Oct 2 20:00:33 markkoudstaal sshd[2733082]: Failed password for root from 183.81.169.238 port 54480 ssh2
  Oct 2 20:00:37 markkoudstaal sshd[2733130]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 20:00:39 markkoudstaal sshd[2733130]: Failed password for root from 183.81.169.238 port 49542 ssh2
  ...

• 2024-10-02T14:00:05.392257 VOSTOK sshd[20434]: Failed password for root from 183.81.169.238 port 42102 ssh2
  2024-10-02T14:00:08.134032 VOSTOK sshd[20488]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T14:00:10.705505 VOSTOK sshd[20488]: Failed password for root from 183.81.169.238 port 42108 ssh2
  2024-10-02T14:00:13.173829 VOSTOK sshd[20500]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T14:00:15.427765 VOSTOK sshd[20500]: Failed password for root from 183.81.169.238 port 44638 ssh2
  ...

• Oct 2 17:59:38 vps-d7931dc8 sshd[470762]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 17:59:41 vps-d7931dc8 sshd[470762]: Failed password for root from 183.81.169.238 port 42350 ssh2
  Oct 2 17:59:41 vps-d7931dc8 sshd[470762]: Connection closed by authenticating user root 183.81.169.238 port 42350 [preauth]
  Oct 2 17:59:43 vps-d7931dc8 sshd[470764]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 17:59:45 vps-d7931dc8 sshd[470764]: Failed password for root from 183.81.169.238 port 42374 ssh2

• [rede-164-29] (sshd) Failed SSH login from 183.81.169.238 (NL/The Netherlands/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Oct 2 14:59:25 sshd[32332]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=[USERNAME]
  Oct 2 14:59:27 sshd[32332]: Failed password for [USERNAME] from 183.81.169.238 port 46836 ssh2
  Oct 2 14:59:30 sshd[32337]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=[USERNAME]
  Oct 2 14:59:32 sshd[32337]: Failed password for [USERNAME] from 183.81.169.238 port 58352 ssh2
  Oct 2 14:

• Oct 2 17:59:24 mvscweb sshd[1286440]: Failed password for root from 183.81.169.238 port 53274 ssh2
  Oct 2 17:59:29 mvscweb sshd[1286442]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 17:59:30 mvscweb sshd[1286442]: Failed password for root from 183.81.169.238 port 55200 ssh2
  ...

• Oct 2 19:58:50 : pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root Oct 2 19:58:52 : Failed password for root from 183.81.169.238 port 51710 ssh2 Oct 2 19:58:54 : pam_unix(sshd:auth): auth

• 2024-10-02T19:58:33.126081 prodgateway sshd[59121]: Failed password for root from 183.81.169.238 port 35856 ssh2
  2024-10-02T19:58:34.586834 prodgateway sshd[59124]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T19:58:35.918510 prodgateway sshd[59124]: Failed password for root from 183.81.169.238 port 35902 ssh2
  ...

• 2024-10-02T19:57:34.634685vmi1671272.contaboserver.net sshd[3843211]: Failed password for root from 183.81.169.238 port 35486 ssh2
  2024-10-02T19:57:38.362501vmi1671272.contaboserver.net sshd[3843213]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T19:57:40.673407vmi1671272.contaboserver.net sshd[3843213]: Failed password for root from 183.81.169.238 port 49460 ssh2
  2024-10-02T19:57:44.571785vmi1671272.contaboserver.net sshd[3843215]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T19:57:46.706720vmi1671272.contaboserver.net sshd[3843215]: Failed password for root from 183.81.169.238 port 49488 ssh2

• 2024-10-02T17:56:50.824992+00:00 arch.xny sshd[543943]: Failed password for root from 183.81.169.238 port 53844 ssh2
  2024-10-02T17:56:54.783964+00:00 arch.xny sshd[543947]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T17:56:56.387604+00:00 arch.xny sshd[543947]: Failed password for root from 183.81.169.238 port 53878 ssh2
  2024-10-02T17:56:59.083700+00:00 arch.xny sshd[543953]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T17:57:00.707401+00:00 arch.xny sshd[543953]: Failed password for root from 183.81.169.238 port 42802 ssh2
  ...

• 2024-10-02T19:56:40.647118+02:00 vande sshd[1556780]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T19:56:41.994335+02:00 vande sshd[1556780]: Failed password for root from 183.81.169.238 port 38818 ssh2

• Oct 2 13:56:06 sputnik sshd[58479]: Invalid user Antminer from 183.81.169.238 port 46880
  Oct 2 13:56:08 sputnik sshd[59443]: Invalid user Antminer from 183.81.169.238 port 46904
  Oct 2 13:56:22 sputnik sshd[62475]: Invalid user admin from 183.81.169.238 port 50534
  ...

• SSH ⎆ Honeypot login with user "root" at 2024-10-02

• 2024-10-02T13:55:24.341721 SPARTAN sshd[10425]: Failed password for root from 183.81.169.238 port 42468 ssh2
  2024-10-02T13:55:26.809603 SPARTAN sshd[10448]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T13:55:29.005961 SPARTAN sshd[10448]: Failed password for root from 183.81.169.238 port 39478 ssh2
  2024-10-02T13:55:32.002825 SPARTAN sshd[10455]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T13:55:34.212855 SPARTAN sshd[10455]: Failed password for root from 183.81.169.238 port 39480 ssh2
  ...

• Oct 2 19:55:19 h2691902 sshd[14414]: Failed password for root from 183.81.169.238 port 50224 ssh2
  Oct 2 19:55:21 h2691902 sshd[14417]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 19:55:23 h2691902 sshd[14417]: Failed password for root from 183.81.169.238 port 50254 ssh2
  Oct 2 19:55:26 h2691902 sshd[14419]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 19:55:28 h2691902 sshd[14419]: Failed password for root from 183.81.169.238 port 35282 ssh2
  ...

• Oct 2 18:55:00 kamergaz sshd[2463614]: Failed password for root from 183.81.169.238 port 57450 ssh2
  Oct 2 18:55:03 kamergaz sshd[2463621]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:55:05 kamergaz sshd[2463621]: Failed password for root from 183.81.169.238 port 57488 ssh2
  Oct 2 18:55:09 kamergaz sshd[2463628]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:55:11 kamergaz sshd[2463628]: Failed password for root from 183.81.169.238 port 37286 ssh2

• Oct 2 12:53:47 mail sshd[3267994]: Failed password for root from 183.81.169.238 port 41484 ssh2
  Oct 2 12:53:50 mail sshd[3268020]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 12:53:52 mail sshd[3268020]: Failed password for root from 183.81.169.238 port 41490 ssh2
  ...

• [17:53] Attempted SSH login on port 22 with credentials root:0

• Oct 2 20:52:17 www sshd\[54894\]: Failed password for root from 183.81.169.238 port 56242 ssh2Oct 2 20:52:22 www sshd\[54896\]: Failed password for root from 183.81.169.238 port 58172 ssh2Oct 2 20:52:26 www sshd\[54898\]: Failed password for root from 183.81.169.238 port 58192 ssh2
  ...

• 2024-10-02T13:51:55.872024-04:00 ns05-a-ns-xyz sshd[2249266]: Failed password for root from 183.81.169.238 port 54570 ssh2
  2024-10-02T13:51:59.538793-04:00 ns05-a-ns-xyz sshd[2249270]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T13:52:00.978455-04:00 ns05-a-ns-xyz sshd[2249270]: Failed password for root from 183.81.169.238 port 45300 ssh2
  2024-10-02T13:52:04.014199-04:00 ns05-a-ns-xyz sshd[2249274]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T13:52:06.007187-04:00 ns05-a-ns-xyz sshd[2249274]: Failed password for root from 183.81.169.238 port 45324 ssh2
  ...

• 2024-10-02T17:51:58.387381nc2 sshd[411685]: Invalid user Antminer from 183.81.169.238 port 54088
  2024-10-02T17:51:59.721889nc2 sshd[411715]: Invalid user Antminer from 183.81.169.238 port 54096
  ...

• 2024-10-02T19:51:15.505365+02:00 khatuna sshd[605462]: Failed password for root from 183.81.169.238 port 41958 ssh2
  2024-10-02T19:51:17.520820+02:00 khatuna sshd[605496]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T19:51:19.193488+02:00 khatuna sshd[605496]: Failed password for root from 183.81.169.238 port 57128 ssh2
  2024-10-02T19:51:22.427671+02:00 khatuna sshd[605498]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T19:51:24.120306+02:00 khatuna sshd[605498]: Failed password for root from 183.81.169.238 port 57132 ssh2
  ...

• Oct 2 17:51:22 uptime sshd[2080154]: Connection closed by authenticating user root 183.81.169.238 port 52274 [preauth]
  ...

• Oct 2 19:50:19 SFEEDS sshd[478533]: Failed password for root from 183.81.169.238 port 54634 ssh2
  Oct 2 19:50:21 SFEEDS sshd[478536]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 19:50:23 SFEEDS sshd[478536]: Failed password for root from 183.81.169.238 port 54648 ssh2
  Oct 2 19:50:26 SFEEDS sshd[478538]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 19:50:28 SFEEDS sshd[478538]: Failed password for root from 183.81.169.238 port 33846 ssh2
  ...

• Oct 2 11:38:55 web2 sshd\[30576\]: Failed password for root from 183.81.169.238 port 33610 ssh2Oct 2 11:39:00 web2 sshd\[30578\]: Failed password for root from 183.81.169.238 port 33622 ssh2Oct 2 11:39:05 web2 sshd\[30589\]: Failed password for root from 183.81.169.238 port 41140 ssh2Oct 2 11:39:09 web2 sshd\[30591\]: Failed password for root from 183.81.169.238 port 41170 ssh2Oct 2 11:39:13 web2 sshd\[30593\]: Failed password for root from 183.81.169.238 port 52530 ssh2Oct 2 11:39:18 web2 sshd\[30595\]: Failed password for root from 183.81.169.238 port 52548 ssh2
  ...

• 2024-10-02T19:48:58.820893+02:00 nc1.motyka.pro sshd[1508520]: Failed password for root from 183.81.169.238 port 56480 ssh2
  2024-10-02T19:49:00.510312+02:00 nc1.motyka.pro sshd[1508551]: Failed password for root from 183.81.169.238 port 56496 ssh2
  2024-10-02T19:49:02.772553+02:00 nc1.motyka.pro sshd[1508636]: Failed password for root from 183.81.169.238 port 56512 ssh2
  2024-10-02T19:49:04.864169+02:00 nc1.motyka.pro sshd[1508707]: Failed password for root from 183.81.169.238 port 56526 ssh2
  2024-10-02T19:49:07.251468+02:00 nc1.motyka.pro sshd[1508710]: Failed password for root from 183.81.169.238 port 47298 ssh2
  ...

• Failed SSH attempts on port 22

• Oct 2 19:48:05 serv248043 sshd[1404034]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 19:48:07 serv248043 sshd[1404034]: Failed password for root from 183.81.169.238 port 43692 ssh2
  ...

• Oct 2 19:46:45 dsh1621 sshd[3657690]: Failed password for root from 183.81.169.238 port 42448 ssh2
  Oct 2 19:46:48 dsh1621 sshd[3657728]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 19:46:50 dsh1621 sshd[3657728]: Failed password for root from 183.81.169.238 port 57416 ssh2
  Oct 2 19:46:53 dsh1621 sshd[3657754]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 19:46:55 dsh1621 sshd[3657754]: Failed password for root from 183.81.169.238 port 57454 ssh2
  ...

• 183.81.169.238 (183.81.169.238) - SSH Brute force:
  Oct 2 20:46:34 XWEB sshd[7215]: Failed password for root from 183.81.169.238 port 58862 ssh2
  Oct 2 20:46:37 XWEB sshd[7217]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 20:46:40 XWEB sshd[7217]: Failed password for root from 183.81.169.238 port 56150 ssh2
  ...

• Oct 2 17:46:15 cloud-server-0 sshd[2887426]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 17:46:16 cloud-server-0 sshd[2887426]: Failed password for root from 183.81.169.238 port 48374 ssh2
  ...

• $f2bV_matches

• Inteceptor Intrusion Detector: failed_password on sshd module PID: (1412649)

• Oct 2 19:43:23 ananke sshd[1642750]: Invalid user Antminer from 183.81.169.238 port 57772
  ...

• Oct 2 11:43:12 phoenix sshd[1987868]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 11:43:14 phoenix sshd[1987868]: Failed password for root from 183.81.169.238 port 36360 ssh2
  ...

• FW-PortScan: Traffic Blocked srcport=52276 dstport=22

• Oct 2 19:42:22 ifog sshd[79560]: Invalid user Antminer from 183.81.169.238 port 58600
  Oct 2 19:42:23 ifog sshd[79562]: Invalid user Antminer from 183.81.169.238 port 58604
  Oct 2 19:42:34 ifog sshd[79574]: Invalid user admin from 183.81.169.238 port 34338
  ...

• 2024-10-02T17:40:59.868902+00:00 edge-mini sshd[506371]: Failed password for root from 183.81.169.238 port 47614 ssh2
  2024-10-02T17:41:03.973889+00:00 edge-mini sshd[506373]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T17:41:06.024224+00:00 edge-mini sshd[506373]: Failed password for root from 183.81.169.238 port 47654 ssh2
  ...

• Oct 2 19:40:27 ns sshd[28026]: Failed password for root from 183.81.169.238 port 46984 ssh2
  Oct 2 19:40:28 ns sshd[28026]: Connection closed by authenticating user root 183.81.169.238 port 46984 [preauth]
  Oct 2 19:40:30 ns sshd[28186]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 19:40:32 ns sshd[28186]: Failed password for root from 183.81.169.238 port 52156 ssh2
  Oct 2 19:40:33 ns sshd[28186]: Connection closed by authenticating user root 183.81.169.238 port 52156 [preauth]
  Oct 2 19:40:36 ns sshd[28458]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 19:40:38 ns sshd[28458]: Failed password for root from 183.81.169.238 port 57996 ssh2
  ...

• Unsolicited connection attempt(s), port:22.

• 2024-10-02T20:39:59.581500ztui.private.ru.net sshd[61051]: Invalid user Antminer from 183.81.169.238 port 43746
  2024-10-02T20:40:01.987832ztui.private.ru.net sshd[61053]: Invalid user Antminer from 183.81.169.238 port 43756
  ...

• 10808 attempts since 13.07.2024 23:53:03 UTC - last one: 2024-10-02T16:37:44.602727+02:00 beta sshd[2309093]: Connection closed by invalid user baikal 183.81.169.238 port 36530 [preauth]

• Fail2Ban Triggered By 183.81.169.238

• Oct 2 18:38:33 s1-jellyfish sshd[3614934]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:38:35 s1-jellyfish sshd[3614934]: Failed password for root from 183.81.169.238 port 55140 ssh2
  ...

• Oct 2 14:38:29 SRC=183.81.169.238 PROTO=TCP SPT=51324 DPT=22 SYN
  ...

• Oct 2 19:37:47 vps2 sshd[1815894]: Invalid user Antminer from 183.81.169.238 port 33572
  Oct 2 19:37:49 vps2 sshd[1815900]: Invalid user Antminer from 183.81.169.238 port 33584
  Oct 2 19:38:00 vps2 sshd[1815916]: Invalid user admin from 183.81.169.238 port 49540
  Oct 2 19:38:02 vps2 sshd[1815920]: Invalid user baikal from 183.81.169.238 port 49550
  ...

• 2024-10-02T17:37:23.439940+00:00 Linux08 sshd[2281472]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T17:37:24.952277+00:00 Linux08 sshd[2281472]: Failed password for root from 183.81.169.238 port 48388 ssh2
  2024-10-02T17:37:28.071313+00:00 Linux08 sshd[2281787]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T17:37:30.271205+00:00 Linux08 sshd[2281787]: Failed password for root from 183.81.169.238 port 41642 ssh2
  2024-10-02T17:37:35.022345+00:00 Linux08 sshd[2282189]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T17:37:36.514226+00:00 Linux08 sshd[2282189]: Failed password for root from 183.81.169.238 port 41676 ssh2
  2024-10-02T17:37:39.626313+00:00 Linux08 sshd[2282376]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= r
  ...

• LT: TCP-Scanner. Port: 22

• SSH Brute-Force

• 2024-10-02T19:35:06.703993+02:00 Webserver sshd[695088]: Failed password for root from 183.81.169.238 port 51854 ssh2
  2024-10-02T19:35:09.018477+02:00 Webserver sshd[695090]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T19:35:11.137958+02:00 Webserver sshd[695090]: Failed password for root from 183.81.169.238 port 50586 ssh2
  2024-10-02T19:35:13.630193+02:00 Webserver sshd[695092]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T19:35:15.629642+02:00 Webserver sshd[695092]: Failed password for root from 183.81.169.238 port 50606 ssh2
  ...

• Oct 2 19:34:51 vps643776 sshd[1275981]: Failed password for root from 183.81.169.238 port 53836 ssh2
  Oct 2 19:34:54 vps643776 sshd[1275983]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 19:34:56 vps643776 sshd[1275983]: Failed password for root from 183.81.169.238 port 53856 ssh2
  Oct 2 19:35:01 vps643776 sshd[1275985]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 19:35:03 vps643776 sshd[1275985]: Failed password for root from 183.81.169.238 port 46716 ssh2
  ...

• Oct 2 18:34:39 vm20 sshd[530639]: Invalid user Antminer from 183.81.169.238 port 51318
  Oct 2 18:34:40 vm20 sshd[530641]: Invalid user Antminer from 183.81.169.238 port 51336
  ...

• Oct 2 19:34:09 CDN sshd[1788084]: Failed password for root from 183.81.169.238 port 46832 ssh2
  Oct 2 19:34:13 CDN sshd[1788086]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 19:34:15 CDN sshd[1788086]: Failed password for root from 183.81.169.238 port 46890 ssh2
  Oct 2 19:34:18 CDN sshd[1788088]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 19:34:20 CDN sshd[1788088]: Failed password for root from 183.81.169.238 port 50104 ssh2

• Oct 2 19:31:33 m2048 sshd[313596]: Failed password for root from 183.81.169.238 port 52138 ssh2
  Oct 2 19:31:37 m2048 sshd[313598]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 19:31:38 m2048 sshd[313598]: Failed password for root from 183.81.169.238 port 52992 ssh2
  Oct 2 19:31:41 m2048 sshd[313600]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 19:31:44 m2048 sshd[313600]: Failed password for root from 183.81.169.238 port 53016 ssh2
  ...

• Oct 2 20:30:46 localhost sshd[1300311]: Failed password for root from 183.81.169.238 port 53006 ssh2
  Oct 2 20:30:50 localhost sshd[1300317]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 20:30:52 localhost sshd[1300317]: Failed password for root from 183.81.169.238 port 59704 ssh2
  Oct 2 20:30:55 localhost sshd[1300324]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 20:30:57 localhost sshd[1300324]: Failed password for root from 183.81.169.238 port 59732 ssh2
  ...

• Oct 2 19:30:10 mx1 sshd[1985720]: Failed password for root from 183.81.169.238 port 40066 ssh2
  Oct 2 19:30:12 mx1 sshd[1985722]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 19:30:15 mx1 sshd[1985722]: Failed password for root from 183.81.169.238 port 40082 ssh2
  Oct 2 19:30:19 mx1 sshd[1985726]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 19:30:21 mx1 sshd[1985726]: Failed password for root from 183.81.169.238 port 35652 ssh2
  ...

• Oct 2 17:30:09 mlat sshd[3078146]: Failed password for root from 183.81.169.238 port 42518 ssh2
  Oct 2 17:30:12 mlat sshd[3078151]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 17:30:14 mlat sshd[3078151]: Failed password for root from 183.81.169.238 port 42528 ssh2
  ... azuremlat

• abuse-sshd h3

• 2024-10-02T17:30:02.204296shield sshd\[15187\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T17:30:04.508227shield sshd\[15187\]: Failed password for root from 183.81.169.238 port 35364 ssh2
  2024-10-02T17:30:07.433965shield sshd\[15189\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T17:30:09.092024shield sshd\[15189\]: Failed password for root from 183.81.169.238 port 57006 ssh2
  2024-10-02T17:30:11.915159shield sshd\[15199\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root

• Oct 2 18:29:23 sheikh-ahmed-abu-islam-v2 sshd[2400436]: Invalid user Antminer from 183.81.169.238 port 35722
  Oct 2 18:29:25 sheikh-ahmed-abu-islam-v2 sshd[2400489]: Invalid user Antminer from 183.81.169.238 port 35736
  ...

• 2024-10-03T02:28:35.717560 mustar-kr-miso sshd[1454555]: Failed password for root from 183.81.169.238 port 48788 ssh2
  2024-10-03T02:28:39.605646 mustar-kr-miso sshd[1454558]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T02:28:41.515337 mustar-kr-miso sshd[1454558]: Failed password for root from 183.81.169.238 port 60744 ssh2
  2024-10-03T02:28:45.763588 mustar-kr-miso sshd[1454561]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-03T02:28:47.833320 mustar-kr-miso sshd[1454561]: Failed password for root from 183.81.169.238 port 60800 ssh2
  ...

• 2024-10-02T17:28:04.693009+00:00 mapir-proxmox sshd[2929091]: Failed password for root from 183.81.169.238 port 35168 ssh2
  2024-10-02T17:28:07.202964+00:00 mapir-proxmox sshd[2929727]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T17:28:08.720553+00:00 mapir-proxmox sshd[2929727]: Failed password for root from 183.81.169.238 port 36180 ssh2
  ...

• Oct 2 17:27:51 hardcore-tesla sshd[4004462]: Failed password for root from 183.81.169.238 port 33748 ssh2
  Oct 2 17:27:54 hardcore-tesla sshd[4004464]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 17:27:56 hardcore-tesla sshd[4004464]: Failed password for root from 183.81.169.238 port 33828 ssh2
  Oct 2 17:27:59 hardcore-tesla sshd[4004466]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 17:28:02 hardcore-tesla sshd[4004466]: Failed password for root from 183.81.169.238 port 37798 ssh2
  ...

• Oct 2 17:27:32 localhost sshd[2297446]: Failed password for root from 183.81.169.238 port 33680 ssh2
  Oct 2 17:27:37 localhost sshd[2297448]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 17:27:39 localhost sshd[2297448]: Failed password for root from 183.81.169.238 port 45612 ssh2
  Oct 2 17:27:44 localhost sshd[2297451]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 17:27:46 localhost sshd[2297451]: Failed password for root from 183.81.169.238 port 45676 ssh2
  ...

• Oct 2 20:27:16 server2 sshd\[9270\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 20:27:18 server2 sshd\[9272\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 20:27:20 server2 sshd\[9274\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 20:27:21 server2 sshd\[9276\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 20:27:22 server2 sshd\[9278\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 20:27:24 server2 sshd\[9280\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers

• Oct 2 17:26:59 gibson-app sshd[1539757]: Invalid user Antminer from 183.81.169.238 port 45386
  Oct 2 17:27:02 gibson-app sshd[1539759]: Invalid user Antminer from 183.81.169.238 port 45392
  Oct 2 17:27:15 gibson-app sshd[1539776]: Invalid user admin from 183.81.169.238 port 43562
  ...

• Oct 2 14:25:39 ica-cluster sshd[3598249]: Failed password for root from 183.81.169.238 port 42596 ssh2
  Oct 2 14:25:44 ica-cluster sshd[3598275]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 14:25:46 ica-cluster sshd[3598275]: Failed password for root from 183.81.169.238 port 42616 ssh2
  Oct 2 14:25:51 ica-cluster sshd[3598302]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 14:25:53 ica-cluster sshd[3598302]: Failed password for root from 183.81.169.238 port 45378 ssh2
  ...

• 2024-10-02T17:24:32.642383 EUR sshd[11404]: Invalid user Antminer from 183.81.169.238 port 48928
  2024-10-02T17:24:34.778521 EUR sshd[11406]: Invalid user Antminer from 183.81.169.238 port 48960
  2024-10-02T17:24:46.439716 EUR sshd[11418]: Invalid user admin from 183.81.169.238 port 42986
  ...

• Oct 2 17:23:41 cloud-server-0 sshd[1856829]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 17:23:43 cloud-server-0 sshd[1856829]: Failed password for root from 183.81.169.238 port 35262 ssh2
  Oct 2 17:23:47 cloud-server-0 sshd[1856831]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 17:23:50 cloud-server-0 sshd[1856831]: Failed password for root from 183.81.169.238 port 56162 ssh2
  Oct 2 17:23:54 cloud-server-0 sshd[1856833]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 17:23:55 cloud-server-0 sshd[1856833]: Failed password for root from 183.81.169.238 port 56172 ssh2
  Oct 2 17:23:58 cloud-server-0 sshd[1856835]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 17:24:01 cloud-server-0 sshd[185
  ...

• Oct 2 18:23:02 l03 sshd[6796]: Invalid user Antminer from 183.81.169.238 port 50800
  ...

• FW-PortScan: Traffic Blocked srcport=48972 dstport=22

• Unauthorized connection attempts on port 22

• Oct 2 19:22:24 v2202301167543214332 sshd[2962729]: Failed password for root from 183.81.169.238 port 32798 ssh2
  Oct 2 19:22:27 v2202301167543214332 sshd[2962731]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 19:22:29 v2202301167543214332 sshd[2962731]: Failed password for root from 183.81.169.238 port 37456 ssh2
  Oct 2 19:22:31 v2202301167543214332 sshd[2962733]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 19:22:33 v2202301167543214332 sshd[2962733]: Failed password for root from 183.81.169.238 port 37466 ssh2
  ...

• 2024-10-02T17:19:10.749888+00:00 Linux02 sshd[3122089]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T17:19:12.547726+00:00 Linux02 sshd[3122089]: Failed password for root from 183.81.169.238 port 33132 ssh2
  2024-10-02T17:19:16.702188+00:00 Linux02 sshd[3122341]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T17:19:19.324074+00:00 Linux02 sshd[3122341]: Failed password for root from 183.81.169.238 port 43628 ssh2
  2024-10-02T17:19:22.367585+00:00 Linux02 sshd[3122568]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T17:19:24.145803+00:00 Linux02 sshd[3122568]: Failed password for root from 183.81.169.238 port 43630 ssh2
  2024-10-02T17:19:28.258333+00:00 Linux02 sshd[3122887]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= r
  ...

• SSH login attempts (endlessh): 2024-10-02T17:21:34.403Z ACCEPT host=::ffff:183.81.169.238 port=58058 fd=4 n=1/4096

• 2024-10-02T19:20:52.772111online4.bobelweb.eu sshd[28947]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-02T19:20:54.523531online4.bobelweb.eu sshd[28949]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-02T19:20:56.352557online4.bobelweb.eu sshd[28951]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-02T19:20:58.306977online4.bobelweb.eu sshd[28953]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-02T19:20:59.832080online4.bobelweb.eu sshd[28955]: User root from 183.81.169.238 not allowed because not listed in AllowUsers

• Failed password for root from 183.81.169.238 port 50446 ssh2
  pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Failed password for root from 183.81.169.238 port 50486 ssh2
  pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Failed password for root from 183.81.169.238 port 59442 ssh2

• Unsolicited connection attempt(s), port:22.

• Oct 2 19:19:02 fshubvidspace sshd[2989823]: Failed password for root from 183.81.169.238 port 53706 ssh2
  Oct 2 19:19:06 fshubvidspace sshd[2989825]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 19:19:08 fshubvidspace sshd[2989825]: Failed password for root from 183.81.169.238 port 43088 ssh2
  Oct 2 19:19:10 fshubvidspace sshd[2989828]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 19:19:12 fshubvidspace sshd[2989828]: Failed password for root from 183.81.169.238 port 43102 ssh2
  ...

• Oct 2 17:18:47 ice1 sshd[3542644]: Invalid user Antminer from 183.81.169.238 port 50464
  Oct 2 17:18:49 ice1 sshd[3542646]: Invalid user Antminer from 183.81.169.238 port 50470
  ...

• Cowrie Honeypot: Unauthorised SSH/Telnet login attempt with user "root" at 2024-10-02T17:18:20Z

• Oct 2 19:16:44 niove sshd[526309]: Invalid user Antminer from 183.81.169.238 port 52178
  ...

• Oct 2 17:15:59 vps-9 sshd[912916]: Failed password for root from 183.81.169.238 port 44286 ssh2
  Oct 2 17:16:04 vps-9 sshd[912939]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 17:16:06 vps-9 sshd[912939]: Failed password for root from 183.81.169.238 port 44300 ssh2
  ...

• Oct 2 17:15:59 instance-20221219-1303 sshd[2755096]: Invalid user Antminer from 183.81.169.238 port 40328
  ...

• 2024-10-02T19:14:36.948083+02:00 srv2 sshd[1579896]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T19:14:39.127422+02:00 srv2 sshd[1579896]: Failed password for root from 183.81.169.238 port 50422 ssh2
  ...

• Oct 2 19:14:26 [redacted] sshd[1584407]: Failed password for [redacted] from 183.81.169.238 port 52588 ssh2
  Oct 2 19:14:27 [redacted] sshd[1584411]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=[redacted]
  Oct 2 19:14:29 [redacted] sshd[1584411]: Failed password for [redacted] from 183.81.169.238 port 58384 ssh2
  Oct 2 19:14:31 [redacted] sshd[1584415]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=[redacted]
  Oct 2 19:14:34 [redacted] sshd[1584415]: Failed password for [redacted] from 183.81.169.238 port 58398 ssh2
  ...

• 2024-10-02T20:14:24.527721+03:00 oh6ah sshd[1780377]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T20:14:26.728849+03:00 oh6ah sshd[1780377]: Failed password for root from 183.81.169.238 port 43148 ssh2
  ...

• Oct 2 12:08:51 news1 sshd[2705200]: refused connect from 183.81.169.238 (183.81.169.238)
  Oct 2 14:23:23 news1 sshd[2711596]: refused connect from 183.81.169.238 (183.81.169.238)
  Oct 2 17:14:16 news1 sshd[2720168]: refused connect from 183.81.169.238 (183.81.169.238)
  ...

• 2024-10-02T17:10:06.575429+00:00 BAW-C01 sshd-session[394355]: Failed password for root from 183.81.169.238 port 38708 ssh2
  2024-10-02T17:10:11.717295+00:00 BAW-C01 sshd-session[394358]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T17:10:13.300689+00:00 BAW-C01 sshd-session[394358]: Failed password for root from 183.81.169.238 port 36304 ssh2
  2024-10-02T17:10:17.162955+00:00 BAW-C01 sshd-session[394382]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T17:10:19.025808+00:00 BAW-C01 sshd-session[394382]: Failed password for root from 183.81.169.238 port 49096 ssh2
  ...

• Firewall IPS Detection on 02-10-2024 at 19:10:04

• Oct 2 19:09:10 DEVELOPERSERVER sshd[556954]: Failed password for root from 183.81.169.238 port 57936 ssh2
  Oct 2 19:09:13 DEVELOPERSERVER sshd[556961]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 19:09:16 DEVELOPERSERVER sshd[556961]: Failed password for root from 183.81.169.238 port 57956 ssh2
  Oct 2 19:09:21 DEVELOPERSERVER sshd[556969]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 19:09:22 DEVELOPERSERVER sshd[556969]: Failed password for root from 183.81.169.238 port 34774 ssh2
  Oct 2 19:09:26 DEVELOPERSERVER sshd[556976]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 19:09:28 DEVELOPERSERVER sshd[556976]: Failed password for root from 183.81.169.238 port 46474 ssh2
  ...

• Brute-force SSH server

• Oct 2 19:08:22 C1D543E sshd[763934]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 19:08:22 C1D543E sshd[763934]: Failed password for invalid user root from 183.81.169.238 port 45902 ssh2
  Oct 2 19:08:24 C1D543E sshd[763936]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 19:08:25 C1D543E sshd[763936]: Failed password for invalid user root from 183.81.169.238 port 45908 ssh2
  Oct 2 19:08:27 C1D543E sshd[763938]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  ...

• Oct 2 19:08:10 root1896 sshd[1947272]: Failed password for root from 183.81.169.238 port 33626 ssh2
  Oct 2 19:08:14 root1896 sshd[1947310]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 19:08:16 root1896 sshd[1947310]: Failed password for root from 183.81.169.238 port 33664 ssh2
  Oct 2 19:08:19 root1896 sshd[1947336]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 19:08:21 root1896 sshd[1947336]: Failed password for root from 183.81.169.238 port 34072 ssh2
  ...

• Oct 2 19:08:06 mail sshd[620756]: Failed password for root from 183.81.169.238 port 39692 ssh2
  Oct 2 19:08:09 mail sshd[620778]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 19:08:11 mail sshd[620778]: Failed password for root from 183.81.169.238 port 57062 ssh2
  ...

• 2024-10-02T19:06:31.653115+02:00 PWS-PM-WEB01 sshd[3260616]: Failed password for root from 183.81.169.238 port 50788 ssh2
  2024-10-02T19:06:35.471309+02:00 PWS-PM-WEB01 sshd[3260635]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T19:06:37.285309+02:00 PWS-PM-WEB01 sshd[3260635]: Failed password for root from 183.81.169.238 port 50806 ssh2
  ...

• Oct 2 19:07:04 odin sshd[6133]: Failed password for root from 183.81.169.238 port 56394 ssh2
  Oct 2 19:07:08 odin sshd[6159]: Failed password for root from 183.81.169.238 port 51672 ssh2

• Oct 2 18:06:57 dev sshd[62428]: Failed password for root from 183.81.169.238 port 43538 ssh2
  Oct 2 18:07:00 dev sshd[62430]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:07:02 dev sshd[62430]: Failed password for root from 183.81.169.238 port 55774 ssh2
  Oct 2 18:07:04 dev sshd[62432]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:07:06 dev sshd[62432]: Failed password for root from 183.81.169.238 port 55800 ssh2
  ...

• Funeypot detected 4269 ssh attempts in 555h21m59s. Last by user "root", password "*", client "Go".

• 2024-10-02T19:06:37.319933+02:00 sasrv sshd[1959]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-02T19:06:39.521705+02:00 sasrv sshd[1961]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-02T19:06:40.849287+02:00 sasrv sshd[1963]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-02T19:06:42.834919+02:00 sasrv sshd[1965]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-02T19:06:45.128692+02:00 sasrv sshd[1967]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  ...

• 2024-10-02T17:05:24.183889shield sshd\[12668\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T17:05:25.916811shield sshd\[12668\]: Failed password for root from 183.81.169.238 port 40704 ssh2
  2024-10-02T17:05:28.604458shield sshd\[12678\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T17:05:30.553636shield sshd\[12678\]: Failed password for root from 183.81.169.238 port 43680 ssh2
  2024-10-02T17:05:33.307820shield sshd\[12705\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root

• 2024-10-02T14:03:58.121768-03:00 dns1 sshd[17483]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T14:04:00.250356-03:00 dns1 sshd[17483]: Failed password for root from 183.81.169.238 port 54264 ssh2
  2024-10-02T14:04:01.210882-03:00 dns1 sshd[17483]: Connection closed by authenticating user root 183.81.169.238 port 54264 [preauth]
  2024-10-02T14:04:04.252802-03:00 dns1 sshd[17486]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T14:04:06.677441-03:00 dns1 sshd[17486]: Failed password for root from 183.81.169.238 port 54324 ssh2

• tcp/22 (41 or more attempts)

• Oct 2 19:03:09 endernation sshd[3001579]: Failed password for root from 183.81.169.238 port 46166 ssh2
  Oct 2 19:03:12 endernation sshd[3001600]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 19:03:14 endernation sshd[3001600]: Failed password for root from 183.81.169.238 port 46170 ssh2
  ...

• Oct 2 19:03:09 qube2 sshd[1577257]: Failed password for root from 183.81.169.238 port 49790 ssh2
  Oct 2 19:03:12 qube2 sshd[1577290]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 19:03:14 qube2 sshd[1577290]: Failed password for root from 183.81.169.238 port 49798 ssh2
  ...

• Oct 2 17:02:39 DuoX sshd[605462]: Failed password for root from 183.81.169.238 port 49458 ssh2
  Oct 2 17:02:44 DuoX sshd[608400]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 17:02:45 DuoX sshd[608400]: Failed password for root from 183.81.169.238 port 49494 ssh2
  Oct 2 17:02:50 DuoX sshd[610902]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 17:02:52 DuoX sshd[610902]: Failed password for root from 183.81.169.238 port 46196 ssh2
  ...

• 2024-10-02T19:01:52.491196+02:00 vmi985635.contaboserver.net sshd[2277204]: Failed password for root from 183.81.169.238 port 49210 ssh2
  2024-10-02T19:01:55.759309+02:00 vmi985635.contaboserver.net sshd[2277230]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T19:01:58.061432+02:00 vmi985635.contaboserver.net sshd[2277230]: Failed password for root from 183.81.169.238 port 49232 ssh2
  2024-10-02T19:02:01.328253+02:00 vmi985635.contaboserver.net sshd[2277256]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T19:02:03.580662+02:00 vmi985635.contaboserver.net sshd[2277256]: Failed password for root from 183.81.169.238 port 33608 ssh2
  ...

• Oct 2 18:01:16 dlcentre3 sshd[2349]: Failed password for root from 183.81.169.238 port 33138 ssh2

• Oct 2 17:00:07 proxy sshd[1581490]: Invalid user Antminer from 183.81.169.238 port 34974
  ...

• 2024-10-02T19:00:03.363761+02:00 apollo sshd[563735]: Invalid user Antminer from 183.81.169.238 port 47810
  ...

• Oct 2 18:59:02 host sshd[913084]: Failed password for root from 183.81.169.238 port 39344 ssh2
  Oct 2 18:59:06 host sshd[916507]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:59:08 host sshd[916507]: Failed password for root from 183.81.169.238 port 39568 ssh2
  Oct 2 18:59:11 host sshd[922106]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:59:13 host sshd[922106]: Failed password for root from 183.81.169.238 port 39582 ssh2
  ...

• abuse-sshd h1

• 2024-10-02T12:57:26.333545-04:00 babblingstream sshd[1911036]: Invalid user Antminer from 183.81.169.238 port 38530
  ...

• Oct 2 19:57:03 server2 sshd\[6380\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 19:57:04 server2 sshd\[6382\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 19:57:05 server2 sshd\[6388\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 19:57:07 server2 sshd\[6390\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 19:57:09 server2 sshd\[6392\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 19:57:10 server2 sshd\[6394\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers

• [rede-164-29] (sshd) Failed SSH login from 183.81.169.238 (NL/The Netherlands/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Oct 2 13:56:32 sshd[21605]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=[USERNAME]
  Oct 2 13:56:34 sshd[21605]: Failed password for [USERNAME] from 183.81.169.238 port 35366 ssh2
  Oct 2 13:56:37 sshd[21613]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=[USERNAME]
  Oct 2 13:56:39 sshd[21613]: Failed password for [USERNAME] from 183.81.169.238 port 44048 ssh2
  Oct 2 13:

• 2024-10-02T16:55:36.886567+00:00 localhost sshd[2232497]: Connection closed by authenticating user root 183.81.169.238 port 40718 [preauth]
  2024-10-02T16:55:38.904496+00:00 localhost sshd[2232499]: Connection closed by authenticating user root 183.81.169.238 port 40726 [preauth]
  2024-10-02T16:55:40.685587+00:00 localhost sshd[2232501]: Connection closed by authenticating user root 183.81.169.238 port 40738 [preauth]
  2024-10-02T16:55:43.114667+00:00 localhost sshd[2232522]: Connection closed by authenticating user root 183.81.169.238 port 40748 [preauth]
  2024-10-02T16:55:45.086372+00:00 localhost sshd[2232554]: Connection closed by authenticating user root 183.81.169.238 port 40762 [preauth]
  ...

• 10/02/2024-18:55:34.422725 183.81.169.238 Protocol: 6 ET COMPROMISED Known Compromised or Hostile Host Traffic group 13

• 2024-10-02T18:55:18.756648vps773228.ovh.net sshd[6726]: Failed password for root from 183.81.169.238 port 58958 ssh2
  2024-10-02T18:55:20.582988vps773228.ovh.net sshd[6728]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T18:55:22.065988vps773228.ovh.net sshd[6728]: Failed password for root from 183.81.169.238 port 58976 ssh2
  2024-10-02T18:55:24.719179vps773228.ovh.net sshd[6730]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T18:55:26.749362vps773228.ovh.net sshd[6730]: Failed password for root from 183.81.169.238 port 59026 ssh2
  ...

• Oct 2 18:54:36 CT6942 sshd[256974]: Failed password for root from 183.81.169.238 port 37938 ssh2
  Oct 2 18:54:38 CT6942 sshd[256977]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:54:40 CT6942 sshd[256977]: Failed password for root from 183.81.169.238 port 38006 ssh2
  ...

• VPS-DE-L-NLCheck

• list.rtbh.com.tr report: tcp/22

• Oct 2 09:54:58 SRC=183.81.169.238 PROTO=TCP SPT=54995 DPT=22 SYN
  Oct 2 10:52:48 SRC=183.81.169.238 PROTO=TCP SPT=34623 DPT=22 SYN
  ...

• Oct 2 16:50:56 NL2 sshd[5944]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 16:50:58 NL2 sshd[5944]: Failed password for root from 183.81.169.238 port 49240 ssh2
  ...

• 2024-10-02 11:50:40,866 fail2ban.actions [974]: NOTICE [sshd] Ban 183.81.169.238

• Unauthorized SSH connection on tarpit
  ...

• Connection attemp from 183.81.169.238 to port 22

• Oct 2 16:49:34 ns520895 sshd[2161]: Failed password for root from 183.81.169.238 port 50766 ssh2
  ...

• Oct 2 19:48:04 emerald sshd[131257]: Failed password for root from 183.81.169.238 port 59276 ssh2
  Oct 2 19:48:06 emerald sshd[131262]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 19:48:08 emerald sshd[131262]: Failed password for root from 183.81.169.238 port 59290 ssh2
  Oct 2 19:48:11 emerald sshd[131267]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 19:48:14 emerald sshd[131267]: Failed password for root from 183.81.169.238 port 59342 ssh2
  Oct 2 19:48:17 emerald sshd[131272]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 19:48:19 emerald sshd[131272]: Failed password for root from 183.81.169.238 port 41372 ssh2
  ...

• Oct 2 18:48:08 ts-24 sshd[364160]: Failed password for root from 183.81.169.238 port 33468 ssh2
  Oct 2 18:48:10 ts-24 sshd[364164]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:48:12 ts-24 sshd[364164]: Failed password for root from 183.81.169.238 port 33474 ssh2
  Oct 2 18:48:15 ts-24 sshd[364167]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:48:17 ts-24 sshd[364167]: Failed password for root from 183.81.169.238 port 52854 ssh2
  ...

• FW-PortScan: Traffic Blocked srcport=60232 dstport=22

• 2024-10-02T19:47:04.142946+03:00 mummo sshd[1943859]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T19:47:05.866959+03:00 mummo sshd[1943859]: Failed password for root from 183.81.169.238 port 40482 ssh2
  ...

• Oct 2 16:44:49 ovh-docker-001 sshd[3489616]: Failed password for root from 183.81.169.238 port 41182 ssh2
  Oct 2 16:44:53 ovh-docker-001 sshd[3489979]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 16:44:55 ovh-docker-001 sshd[3489979]: Failed password for root from 183.81.169.238 port 41204 ssh2
  Oct 2 16:44:58 ovh-docker-001 sshd[3490047]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 16:45:00 ovh-docker-001 sshd[3490047]: Failed password for root from 183.81.169.238 port 35236 ssh2
  ...

• Oct 2 16:44:18 ubuntu sshd[939820]: Invalid user Antminer from 183.81.169.238 port 55192
  Oct 2 16:44:19 ubuntu sshd[939832]: Invalid user Antminer from 183.81.169.238 port 55216
  Oct 2 16:44:30 ubuntu sshd[939946]: Invalid user admin from 183.81.169.238 port 43016
  ...

• 2024-10-02T18:44:00.534107+02:00 docker sshd[1735236]: Failed password for root from 183.81.169.238 port 47736 ssh2
  2024-10-02T18:44:03.766885+02:00 docker sshd[1735265]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T18:44:05.979042+02:00 docker sshd[1735265]: Failed password for root from 183.81.169.238 port 47768 ssh2
  2024-10-02T18:44:08.863650+02:00 docker sshd[1735282]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T18:44:11.095493+02:00 docker sshd[1735282]: Failed password for root from 183.81.169.238 port 58402 ssh2
  ...

• Oct 3 01:43:32 localhost sshd[2629503]: Failed password for root from 183.81.169.238 port 46444 ssh2
  Oct 3 01:43:36 localhost sshd[2629540]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 01:43:38 localhost sshd[2629540]: Failed password for root from 183.81.169.238 port 33394 ssh2
  Oct 3 01:43:41 localhost sshd[2629640]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 01:43:43 localhost sshd[2629640]: Failed password for root from 183.81.169.238 port 33398 ssh2
  ...

• 2024-10-02T18:43:07.307608+02:00 Linux14 sshd[2646657]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T18:43:09.497289+02:00 Linux14 sshd[2646657]: Failed password for root from 183.81.169.238 port 38324 ssh2
  2024-10-02T18:43:12.897564+02:00 Linux14 sshd[2646890]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T18:43:14.771818+02:00 Linux14 sshd[2646890]: Failed password for root from 183.81.169.238 port 38356 ssh2
  2024-10-02T18:43:18.186311+02:00 Linux14 sshd[2647308]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T18:43:19.884813+02:00 Linux14 sshd[2647308]: Failed password for root from 183.81.169.238 port 58444 ssh2
  2024-10-02T18:43:23.485900+02:00 Linux14 sshd[2647656]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= r
  ...

• Oct 2 18:42:03 vmi147057 sshd[760446]: Failed password for root from 183.81.169.238 port 37632 ssh2
  Oct 2 18:42:07 vmi147057 sshd[760474]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:42:08 vmi147057 sshd[760474]: Failed password for root from 183.81.169.238 port 44088 ssh2
  Oct 2 18:42:11 vmi147057 sshd[760476]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:42:13 vmi147057 sshd[760476]: Failed password for root from 183.81.169.238 port 44096 ssh2
  ...

• Oct 2 18:41:43 Ina sshd[1815687]: Failed password for root from 183.81.169.238 port 34320 ssh2
  Oct 2 18:41:47 Ina sshd[1815715]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:41:49 Ina sshd[1815715]: Failed password for root from 183.81.169.238 port 44140 ssh2
  Oct 2 18:41:53 Ina sshd[1815717]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:41:55 Ina sshd[1815717]: Failed password for root from 183.81.169.238 port 44178 ssh2
  ...

• Oct 2 18:40:26 javastart sshd[3933041]: Failed password for root from 183.81.169.238 port 55778 ssh2
  Oct 2 18:40:29 javastart sshd[3933043]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:40:32 javastart sshd[3933043]: Failed password for root from 183.81.169.238 port 55796 ssh2
  Oct 2 18:40:35 javastart sshd[3933060]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:40:37 javastart sshd[3933060]: Failed password for root from 183.81.169.238 port 55830 ssh2
  ...

• Oct 2 12:40:06 corp sshd[31158]: Failed password for root from 183.81.169.238 port 34998 ssh2
  Oct 2 12:40:08 corp sshd[31167]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 12:40:10 corp sshd[31167]: Failed password for root from 183.81.169.238 port 48974 ssh2
  ...

• Oct 2 18:39:54 h2427292 sshd\[14054\]: Invalid user Antminer from 183.81.169.238
  Oct 2 18:39:54 h2427292 sshd\[14054\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238
  Oct 2 18:39:56 h2427292 sshd\[14054\]: Failed password for invalid user Antminer from 183.81.169.238 port 34092 ssh2
  ...

• Oct 2 18:39:38 OPSO sshd\[841\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:39:40 OPSO sshd\[841\]: Failed password for root from 183.81.169.238 port 41254 ssh2
  Oct 2 18:39:42 OPSO sshd\[924\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:39:44 OPSO sshd\[924\]: Failed password for root from 183.81.169.238 port 41266 ssh2
  Oct 2 18:39:46 OPSO sshd\[1000\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root

• Oct 2 16:39:35 web8 sshd\[27712\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 16:39:38 web8 sshd\[27712\]: Failed password for root from 183.81.169.238 port 51190 ssh2
  Oct 2 16:39:41 web8 sshd\[27738\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 16:39:43 web8 sshd\[27738\]: Failed password for root from 183.81.169.238 port 47022 ssh2
  Oct 2 16:39:46 web8 sshd\[27764\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root

• Oct 2 11:39:00 jms-staging sshd[715022]: Invalid user Antminer from 183.81.169.238 port 44922
  Oct 2 11:39:01 jms-staging sshd[715093]: Invalid user Antminer from 183.81.169.238 port 44958
  Oct 2 11:39:12 jms-staging sshd[715170]: Invalid user admin from 183.81.169.238 port 54800
  ...

• Oct 2 23:36:49 honeypot sshd[32740]: Failed password for root from 183.81.169.238 port 43738 ssh2
  ...

• Oct 2 18:00:09 oghma sshd[2010452]: Invalid user baikal from 183.81.169.238 port 57896
  Oct 2 18:36:41 oghma sshd[2032348]: Invalid user Antminer from 183.81.169.238 port 44790
  Oct 2 18:36:43 oghma sshd[2032351]: Invalid user Antminer from 183.81.169.238 port 44794
  Oct 2 18:36:49 oghma sshd[2032411]: Invalid user admin from 183.81.169.238 port 59320
  Oct 2 18:36:50 oghma sshd[2032414]: Invalid user baikal from 183.81.169.238 port 59336
  ...

• SSH Brute Force

• 2024-10-02T18:33:19.488604+02:00 vserver-20917 sshd-session[1933593]: Failed password for root from 183.81.169.238 port 33146 ssh2
  2024-10-02T18:33:21.122106+02:00 vserver-20917 sshd-session[1933598]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T18:33:22.860630+02:00 vserver-20917 sshd-session[1933598]: Failed password for root from 183.81.169.238 port 33162 ssh2
  2024-10-02T18:33:25.326164+02:00 vserver-20917 sshd-session[1933604]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T18:33:27.280593+02:00 vserver-20917 sshd-session[1933604]: Failed password for root from 183.81.169.238 port 33190 ssh2
  ...

• 2024-10-02 16:35:15,956 fail2ban.actions [880]: NOTICE [sshd] Ban 183.81.169.238

• 2024-10-02T09:34:52.655814-07:00 panduhstudios sshd[2794198]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T09:34:54.555104-07:00 panduhstudios sshd[2794198]: Failed password for root from 183.81.169.238 port 55392 ssh2
  2024-10-02T09:34:57.917866-07:00 panduhstudios sshd[2794200]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T09:34:59.501082-07:00 panduhstudios sshd[2794200]: Failed password for root from 183.81.169.238 port 40874 ssh2
  ...

• Oct 2 18:34:43 m2369 sshd[675013]: Failed password for root from 183.81.169.238 port 55016 ssh2
  Oct 2 18:34:45 m2369 sshd[675016]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:34:47 m2369 sshd[675016]: Failed password for root from 183.81.169.238 port 40970 ssh2
  Oct 2 18:34:48 m2369 sshd[675049]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:34:50 m2369 sshd[675049]: Failed password for root from 183.81.169.238 port 40976 ssh2
  ...

• Oct 2 12:34:29 thebatforge sshd[423563]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 12:34:30 thebatforge sshd[423565]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 12:34:33 thebatforge sshd[423568]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 12:34:33 thebatforge sshd[423580]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 12:34:35 thebatforge sshd[423582]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  ...

• endlessh: 2024-10-02 18:31:42.340222792 2024-10-02T16:31:42.340Z CLOSE host=183.81.169.238 port=60502 fd=5 time=150.051 bytes=262
  ...

• Oct 2 18:31:31 unifi sshd[742755]: Failed password for root from 183.81.169.238 port 58126 ssh2
  Oct 2 18:31:33 unifi sshd[742757]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:31:35 unifi sshd[742757]: Failed password for root from 183.81.169.238 port 58132 ssh2
  Oct 2 18:31:37 unifi sshd[742759]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:31:40 unifi sshd[742759]: Failed password for root from 183.81.169.238 port 50900 ssh2
  ...

• Oct 2 19:31:29 ru sshd[233660]: Invalid user Antminer from 183.81.169.238 port 54846
  ...

• Oct 2 18:30:19 HighSpeed sshd[1683892]: Failed password for root from 183.81.169.238 port 57312 ssh2
  Oct 2 18:30:21 HighSpeed sshd[1683897]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:30:22 HighSpeed sshd[1683897]: Failed password for root from 183.81.169.238 port 34108 ssh2
  Oct 2 18:30:24 HighSpeed sshd[1683899]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:30:26 HighSpeed sshd[1683899]: Failed password for root from 183.81.169.238 port 34122 ssh2
  Oct 2 18:30:27 HighSpeed sshd[1683904]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:30:30 HighSpeed sshd[1683904]: Failed password for root from 183.81.169.238 port 34136 ssh2
  ...

• SSH bruteforce attempted to a eugenio.wtf infrastructure client.
  ...

• Unauthorized connection attempt detected from IP address 183.81.169.238 to port 22 (ger-03) [l]

• SSH auth scanning - multiple failed logins

• Oct 2 18:28:57 kvm11438 sshd[109103]: Failed password for root from 183.81.169.238 port 53790 ssh2
  Oct 2 18:28:57 kvm11438 sshd[109295]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:28:58 kvm11438 sshd[109295]: Failed password for root from 183.81.169.238 port 53798 ssh2
  Oct 2 18:28:59 kvm11438 sshd[109342]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:29:01 kvm11438 sshd[109342]: Failed password for root from 183.81.169.238 port 53814 ssh2
  ...

• Oct 2 12:28:48 us-mfl-03 sshd[4069048]: Invalid user Antminer from 183.81.169.238 port 46672
  ...

• 2024-10-02T16:26:31.844088+00:00 ubuntu sshd[1497592]: Invalid user Antminer from 183.81.169.238 port 51180
  2024-10-02T16:26:32.102755+00:00 ubuntu sshd[1497594]: Invalid user Antminer from 183.81.169.238 port 51184
  ...

• SSH port scan (Tarpitted for 2m20s, wasted 273B)

• Oct 2 16:25:01 s158416 sshd[2370223]: Failed password for root from 183.81.169.238 port 60032 ssh2
  Oct 2 16:25:03 s158416 sshd[2370264]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 16:25:05 s158416 sshd[2370264]: Failed password for root from 183.81.169.238 port 60040 ssh2
  Oct 2 16:25:07 s158416 sshd[2370286]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 16:25:09 s158416 sshd[2370286]: Failed password for root from 183.81.169.238 port 35128 ssh2
  ...

• 2024-10-02T18:24:49.078325+02:00 yucca sshd[640212]: Invalid user Antminer from 183.81.169.238 port 40776
  ...

• Oct 2 17:18:04 ubuntu sshd[1939301]: Invalid user baikal from 183.81.169.238 port 43364
  Oct 2 18:24:36 ubuntu sshd[1985502]: Invalid user Antminer from 183.81.169.238 port 33194
  Oct 2 18:24:36 ubuntu sshd[1985504]: Invalid user Antminer from 183.81.169.238 port 33218
  Oct 2 18:24:39 ubuntu sshd[1985518]: Invalid user admin from 183.81.169.238 port 33292
  Oct 2 18:24:39 ubuntu sshd[1985520]: Invalid user baikal from 183.81.169.238 port 33296
  ...

• Repeated unauthorized access attempts via SSH

• unauthorized connection with user "root" and password "0" at 2024-10-02T16:22:39Z

• [rede-166-249] (sshd) Failed SSH login from 183.81.169.238 (NL/The Netherlands/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Oct 2 13:22:32 sshd[17324]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=[USERNAME]
  Oct 2 13:22:34 sshd[17324]: Failed password for [USERNAME] from 183.81.169.238 port 53384 ssh2
  Oct 2 13:22:36 sshd[17330]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=[USERNAME]
  Oct 2 13:22:38 sshd[17330]: Failed password for [USERNAME] from 183.81.169.238 port 50276 ssh2
  Oct 2 13:

• 2024-10-02T18:22:13.344477+02:00 mail sshd[613067]: Failed password for root from 183.81.169.238 port 37340 ssh2
  2024-10-02T18:22:15.997368+02:00 mail sshd[613070]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T18:22:17.641519+02:00 mail sshd[613070]: Failed password for root from 183.81.169.238 port 48640 ssh2
  2024-10-02T18:22:19.394802+02:00 mail sshd[613072]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T18:22:21.585401+02:00 mail sshd[613072]: Failed password for root from 183.81.169.238 port 48658 ssh2
  ...

• 2024-10-02T16:22:10.485026+00:00 frhb72991flex sshd[2162701]: Invalid user Antminer from 183.81.169.238 port 48492
  2024-10-02T16:22:10.696624+00:00 frhb72991flex sshd[2162703]: Invalid user Antminer from 183.81.169.238 port 48500
  ...

• Oct 2 18:21:51 vmi440488 sshd[3477282]: Failed password for root from 183.81.169.238 port 41908 ssh2
  Oct 2 18:21:52 vmi440488 sshd[3477288]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:21:54 vmi440488 sshd[3477288]: Failed password for root from 183.81.169.238 port 41924 ssh2
  Oct 2 18:21:56 vmi440488 sshd[3477295]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:21:58 vmi440488 sshd[3477295]: Failed password for root from 183.81.169.238 port 39582 ssh2
  ...

• 2024-10-02T16:20:52.927405+00:00 prod-3 sshd[1018851]: Connection closed by authenticating user root 183.81.169.238 port 39422 [preauth]
  2024-10-02T16:20:53.627874+00:00 prod-3 sshd[1018853]: Connection closed by authenticating user root 183.81.169.238 port 39424 [preauth]
  2024-10-02T16:20:54.200002+00:00 prod-3 sshd[1018891]: Connection closed by authenticating user root 183.81.169.238 port 39436 [preauth]
  2024-10-02T16:20:54.879959+00:00 prod-3 sshd[1018893]: Connection closed by authenticating user root 183.81.169.238 port 47002 [preauth]
  2024-10-02T16:20:55.458513+00:00 prod-3 sshd[1018895]: Connection closed by authenticating user root 183.81.169.238 port 47020 [preauth]
  ...

• Oct 2 18:19:26 server sshd[1314868]: Failed password for root from 183.81.169.238 port 35450 ssh2
  Oct 2 18:19:28 server sshd[1314870]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:19:30 server sshd[1314870]: Failed password for root from 183.81.169.238 port 35454 ssh2
  Oct 2 18:19:31 server sshd[1314872]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:19:33 server sshd[1314872]: Failed password for root from 183.81.169.238 port 35466 ssh2
  ...

• Oct 2 18:19:13 athena sshd[813302]: Failed password for root from 183.81.169.238 port 33036 ssh2
  Oct 2 18:19:13 athena sshd[813304]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:19:15 athena sshd[813304]: Failed password for root from 183.81.169.238 port 33062 ssh2
  Oct 2 18:19:16 athena sshd[813306]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:19:18 athena sshd[813306]: Failed password for root from 183.81.169.238 port 52548 ssh2
  ...

• UFW:High-frequency access to non-released SSH or Telnet ports

• 2024-10-02T18:19:28.698725+02:00 runner3 sshd[3576553]: Failed password for root from 183.81.169.238 port 37428 ssh2
  2024-10-02T18:19:30.149627+02:00 runner3 sshd[3576555]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T18:19:32.475562+02:00 runner3 sshd[3576555]: Failed password for root from 183.81.169.238 port 37510 ssh2
  2024-10-02T18:19:33.800457+02:00 runner3 sshd[3576557]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T18:19:35.870718+02:00 runner3 sshd[3576557]: Failed password for root from 183.81.169.238 port 37544 ssh2
  ...

• Oct 2 19:17:51 pkdns2 sshd\[15813\]: Failed password for root from 183.81.169.238 port 59144 ssh2Oct 2 19:17:52 pkdns2 sshd\[15815\]: Failed password for root from 183.81.169.238 port 59158 ssh2Oct 2 19:17:55 pkdns2 sshd\[15817\]: Failed password for root from 183.81.169.238 port 59164 ssh2Oct 2 19:17:56 pkdns2 sshd\[15819\]: Failed password for root from 183.81.169.238 port 41878 ssh2Oct 2 19:17:59 pkdns2 sshd\[15821\]: Failed password for root from 183.81.169.238 port 41884 ssh2Oct 2 19:18:01 pkdns2 sshd\[15823\]: Failed password for root from 183.81.169.238 port 41886 ssh2
  ...

• 2024-10-02T16:15:33.465076+00:00 Linux07 sshd[4015468]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T16:15:35.253683+00:00 Linux07 sshd[4015468]: Failed password for root from 183.81.169.238 port 50714 ssh2
  2024-10-02T16:15:38.976763+00:00 Linux07 sshd[4015713]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T16:15:40.785756+00:00 Linux07 sshd[4015713]: Failed password for root from 183.81.169.238 port 35498 ssh2
  2024-10-02T16:15:44.096254+00:00 Linux07 sshd[4016091]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T16:15:45.729644+00:00 Linux07 sshd[4016091]: Failed password for root from 183.81.169.238 port 35528 ssh2
  2024-10-02T16:15:47.243615+00:00 Linux07 sshd[4016316]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= r
  ...

• Oct 2 18:14:00 dev0-dcde-rnet sshd[4380]: Failed password for root from 183.81.169.238 port 54898 ssh2
  Oct 2 18:14:04 dev0-dcde-rnet sshd[4382]: Failed password for root from 183.81.169.238 port 54918 ssh2

• Oct 2 18:13:24 EclipseRealms sshd[935488]: Failed password for root from 183.81.169.238 port 50756 ssh2
  Oct 2 18:13:27 EclipseRealms sshd[935493]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:13:29 EclipseRealms sshd[935493]: Failed password for root from 183.81.169.238 port 50764 ssh2
  Oct 2 18:13:33 EclipseRealms sshd[935498]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:13:35 EclipseRealms sshd[935498]: Failed password for root from 183.81.169.238 port 34866 ssh2
  Oct 2 18:13:39 EclipseRealms sshd[935503]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:13:41 EclipseRealms sshd[935503]: Failed password for root from 183.81.169.238 port 34868 ssh2
  ...

• FW-PortScan: Traffic Blocked srcport=38538 dstport=22

• Oct 2 18:13:04 hosting08 sshd[1603]: Failed password for root from 183.81.169.238 port 46442 ssh2
  Oct 2 18:13:09 hosting08 sshd[1634]: Failed password for root from 183.81.169.238 port 49276 ssh2
  ...

• Unauthorized connection

• Oct 2 18:11:40 SFEEDS sshd[477057]: Failed password for root from 183.81.169.238 port 43722 ssh2
  Oct 2 18:11:43 SFEEDS sshd[477060]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:11:44 SFEEDS sshd[477060]: Failed password for root from 183.81.169.238 port 43770 ssh2
  Oct 2 18:11:47 SFEEDS sshd[477063]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:11:50 SFEEDS sshd[477063]: Failed password for root from 183.81.169.238 port 52982 ssh2
  ...

• Oct 2 18:11:26 host sshd[543823]: Failed password for root from 183.81.169.238 port 48790 ssh2
  Oct 2 18:11:28 host sshd[543896]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:11:30 host sshd[543896]: Failed password for root from 183.81.169.238 port 39152 ssh2
  Oct 2 18:11:32 host sshd[543971]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:11:33 host sshd[543971]: Failed password for root from 183.81.169.238 port 39168 ssh2
  ...

• Oct 2 16:10:01 scw-pizzadns-master sshd\[28375\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 16:10:03 scw-pizzadns-master sshd\[28375\]: Failed password for root from 183.81.169.238 port 40172 ssh2
  Oct 2 16:10:05 scw-pizzadns-master sshd\[28394\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root

• 3:12:47I1002 15:
  Fail2ban action triggered

• 2024-10-02 16:10:01 frank SSH

• 2024-10-02T18:09:42.875773+02:00 v220240537442267460 sshd[1381567]: Failed password for root from 183.81.169.238 port 56044 ssh2
  2024-10-02T18:09:47.551986+02:00 v220240537442267460 sshd[1381576]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T18:09:49.507020+02:00 v220240537442267460 sshd[1381576]: Failed password for root from 183.81.169.238 port 37700 ssh2
  2024-10-02T18:09:51.626028+02:00 v220240537442267460 sshd[1381583]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T18:09:53.465444+02:00 v220240537442267460 sshd[1381583]: Failed password for root from 183.81.169.238 port 37726 ssh2
  ...

• Oct 2 12:09:38 graph sshd[1941163]: Failed password for root from 183.81.169.238 port 59798 ssh2
  Oct 2 12:09:40 graph sshd[1941166]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 12:09:42 graph sshd[1941166]: Failed password for root from 183.81.169.238 port 59814 ssh2
  Oct 2 12:09:45 graph sshd[1941168]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 12:09:47 graph sshd[1941168]: Failed password for root from 183.81.169.238 port 54840 ssh2
  ...

• [16:08] Attempted SSH login on port 22 with credentials root:0

• Oct 2 18:07:38 m2048 sshd[312403]: Failed password for root from 183.81.169.238 port 51494 ssh2
  Oct 2 18:07:42 m2048 sshd[312405]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:07:45 m2048 sshd[312405]: Failed password for root from 183.81.169.238 port 51500 ssh2
  Oct 2 18:07:48 m2048 sshd[312407]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:07:50 m2048 sshd[312407]: Failed password for root from 183.81.169.238 port 55858 ssh2
  ...

• Cowrie Honeypot: 2 unauthorised SSH/Telnet login attempts between 2024-10-02T16:07:22Z and 2024-10-02T16:07:26Z

• Oct 2 12:06:11 www4 sshd[1960023]: Failed password for root from 183.81.169.238 port 41560 ssh2
  Oct 2 12:06:14 www4 sshd[1960026]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 12:06:16 www4 sshd[1960026]: Failed password for root from 183.81.169.238 port 41584 ssh2
  Oct 2 12:06:19 www4 sshd[1960033]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 12:06:21 www4 sshd[1960033]: Failed password for root from 183.81.169.238 port 56472 ssh2
  ...

• Oct 2 18:06:09 mail sshd[603730]: Failed password for root from 183.81.169.238 port 47340 ssh2
  Oct 2 18:06:12 mail sshd[603756]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:06:15 mail sshd[603756]: Failed password for root from 183.81.169.238 port 47378 ssh2
  ...

• SSH bruteforce attempted to a customer of eugenio.wtf infrastructure services.
  ...

• Port scanning

• 2024-10-02T18:05:27.759160+02:00 pve sshd[798462]: Failed password for root from 183.81.169.238 port 55994 ssh2
  2024-10-02T18:05:31.020865+02:00 pve sshd[798884]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T18:05:33.164618+02:00 pve sshd[798884]: Failed password for root from 183.81.169.238 port 55998 ssh2
  2024-10-02T18:05:34.962503+02:00 pve sshd[799390]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T18:05:36.851701+02:00 pve sshd[799390]: Failed password for root from 183.81.169.238 port 41544 ssh2
  ...

• tcp/22 (44 or more attempts)

• Oct 2 18:02:08 *host* sshd\[26105\]: User *user* from 183.81.169.238 not allowed because none of user\'s groups are listed in AllowGroups

• Oct 2 18:00:48 kvm11438 sshd[98882]: Failed password for root from 183.81.169.238 port 59632 ssh2
  Oct 2 18:00:50 kvm11438 sshd[98903]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:00:52 kvm11438 sshd[98903]: Failed password for root from 183.81.169.238 port 59658 ssh2
  Oct 2 18:00:54 kvm11438 sshd[98905]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:00:56 kvm11438 sshd[98905]: Failed password for root from 183.81.169.238 port 59682 ssh2
  ...

• Oct 2 16:00:38 jump sshd[3230015]: Failed password for root from 183.81.169.238 port 44850 ssh2
  Oct 2 16:00:41 jump sshd[3230019]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 16:00:43 jump sshd[3230019]: Failed password for root from 183.81.169.238 port 44880 ssh2
  ...

• 10520 attempts since 14.07.2024 04:18:57 UTC - last one: 2024-10-02T17:26:39.550092+02:00 alpha sshd[2337050]: Connection closed by invalid user baikal 183.81.169.238 port 49492 [preauth]

• Invalid user Antminer from 183.81.169.238 port 38184

• Failed password for root from 183.81.169.238 port 36784 ssh2

• [2024 Oct 2 17:57:03] Brute-Force detected from 183.81.169.238 for sshd fails: 2x () USER=baikal SPT=34626

• Oct 2 17:58:46 zadana sshd[110193]: Invalid user Antminer from 183.81.169.238 port 59352
  ...

• Attempt from 183.81.169.238

• Oct 2 15:58:00 cloud-server-0 sshd[1856173]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 15:58:01 cloud-server-0 sshd[1856173]: Failed password for root from 183.81.169.238 port 38058 ssh2
  Oct 2 15:58:04 cloud-server-0 sshd[1856175]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 15:58:06 cloud-server-0 sshd[1856175]: Failed password for root from 183.81.169.238 port 38100 ssh2
  Oct 2 15:58:09 cloud-server-0 sshd[1856179]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 15:58:10 cloud-server-0 sshd[1856179]: Failed password for root from 183.81.169.238 port 50342 ssh2
  Oct 2 15:58:13 cloud-server-0 sshd[1856181]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 15:58:15 cloud-server-0 sshd[185
  ...

• Oct 2 17:58:20 LosAngelesGW sshd[260377]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 17:58:22 LosAngelesGW sshd[260377]: Failed password for root from 183.81.169.238 port 60892 ssh2
  Oct 2 17:58:24 LosAngelesGW sshd[260391]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 17:58:26 LosAngelesGW sshd[260391]: Failed password for root from 183.81.169.238 port 55718 ssh2
  ...

• Fail2ban jail:
  Oct 2 17:57:47 x sshd[1342771]: User root from 183.81.169.238 not allowed because listed in DenyUsers
  Oct 2 17:57:48 x sshd[1342773]: User root from 183.81.169.238 not allowed because listed in DenyUsers
  Oct 2 17:57:50 x sshd[1342775]: User root from 183.81.169.238 not allowed because listed in DenyUsers
  Oct 2 17:57:51 x sshd[1342777]: User root from 183.81.169.238 not allowed because listed in DenyUsers
  ...

• Oct 2 15:57:22 nameserver-01 sshd[2843329]: Failed password for root from 183.81.169.238 port 36642 ssh2
  Oct 2 15:57:26 nameserver-01 sshd[2843333]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 15:57:27 nameserver-01 sshd[2843333]: Failed password for root from 183.81.169.238 port 57926 ssh2
  ...

• Detected multiple authentication failures and invalid user attempts from IP address 183.81.169.238 on [PT] A01 Node

• Oct 2 15:54:48 vm-networkmanager sshd[3578398]: Failed password for root from 183.81.169.238 port 40094 ssh2
  Oct 2 15:54:51 vm-networkmanager sshd[3578405]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 15:54:53 vm-networkmanager sshd[3578405]: Failed password for root from 183.81.169.238 port 40136 ssh2
  Oct 2 15:54:55 vm-networkmanager sshd[3578431]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 15:54:57 vm-networkmanager sshd[3578431]: Failed password for root from 183.81.169.238 port 43980 ssh2
  ...

• 2024-10-02T15:54:31.571098shield sshd\[2240\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T15:54:33.776332shield sshd\[2240\]: Failed password for root from 183.81.169.238 port 41134 ssh2
  2024-10-02T15:54:36.662134shield sshd\[2250\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T15:54:37.888862shield sshd\[2250\]: Failed password for root from 183.81.169.238 port 41524 ssh2
  2024-10-02T15:54:41.185895shield sshd\[2260\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root

• Oct 2 15:53:56 s158416 sshd[2359380]: Failed password for root from 183.81.169.238 port 53290 ssh2
  Oct 2 15:53:59 s158416 sshd[2359382]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 15:54:01 s158416 sshd[2359382]: Failed password for root from 183.81.169.238 port 39224 ssh2
  Oct 2 15:54:05 s158416 sshd[2359440]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 15:54:08 s158416 sshd[2359440]: Failed password for root from 183.81.169.238 port 39252 ssh2
  ...

• 2024-10-02T15:53:46.752363 EUR sshd[23011]: Failed password for root from 183.81.169.238 port 39126 ssh2
  2024-10-02T15:53:49.514169 EUR sshd[23767]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T15:53:51.288380 EUR sshd[23767]: Failed password for root from 183.81.169.238 port 38118 ssh2
  ...

• 2024-10-02T17:53:23.647272+02:00 nc2.motyka.pro sshd[378617]: Failed password for root from 183.81.169.238 port 41068 ssh2
  2024-10-02T17:53:25.623949+02:00 nc2.motyka.pro sshd[378742]: Failed password for root from 183.81.169.238 port 35062 ssh2
  2024-10-02T17:53:27.880235+02:00 nc2.motyka.pro sshd[378838]: Failed password for root from 183.81.169.238 port 35066 ssh2
  2024-10-02T17:53:30.162304+02:00 nc2.motyka.pro sshd[378952]: Failed password for root from 183.81.169.238 port 35096 ssh2
  2024-10-02T17:53:32.006106+02:00 nc2.motyka.pro sshd[379096]: Failed password for root from 183.81.169.238 port 35100 ssh2
  ...

• $f2bV_matches

• Oct 2 15:50:15 mail sshd[205765]: Failed password for root from 183.81.169.238 port 33730 ssh2
  Oct 2 15:50:19 mail sshd[205767]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 15:50:21 mail sshd[205767]: Failed password for root from 183.81.169.238 port 38850 ssh2
  ...

• 2024-10-02T16:45:01.931873+01:00 pbs-bit-lib-01.int.pdx.net.uk sshd[1983738]: Invalid user Antminer from 183.81.169.238 port 59150
  2024-10-02T16:45:04.054763+01:00 pbs-bit-lib-01.int.pdx.net.uk sshd[1983740]: Invalid user Antminer from 183.81.169.238 port 59166
  2024-10-02T16:45:19.685507+01:00 pbs-bit-lib-01.int.pdx.net.uk sshd[1983752]: Invalid user admin from 183.81.169.238 port 42864
  ...

• Oct 2 17:49:31 vps575891 sshd[1172375]: Failed password for root from 183.81.169.238 port 43560 ssh2
  Oct 2 17:49:33 vps575891 sshd[1172377]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 17:49:35 vps575891 sshd[1172377]: Failed password for root from 183.81.169.238 port 43582 ssh2
  ...

• 2024-10-02T17:48:20.879481+02:00 sasrv sshd[1728]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-02T17:48:21.984796+02:00 sasrv sshd[1730]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-02T17:48:24.012688+02:00 sasrv sshd[1732]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-02T17:48:26.288748+02:00 sasrv sshd[1734]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-02T17:48:28.010507+02:00 sasrv sshd[1736]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  ...

• Cowrie Honeypot: Unauthorised SSH/Telnet login attempt with user "root" at 2024-10-02T15:47:43Z

• 2024-10-02T23:47:28.321040+08:00 VM65536 sshd[912247]: Connection closed by authenticating user root 183.81.169.238 port 42614 [preauth]
  2024-10-02T23:47:31.414017+08:00 VM65536 sshd[912249]: Connection closed by authenticating user root 183.81.169.238 port 42624 [preauth]
  2024-10-02T23:47:34.223472+08:00 VM65536 sshd[912253]: Connection closed by authenticating user root 183.81.169.238 port 42638 [preauth]
  ...

• FW-PortScan: Traffic Blocked srcport=38014 dstport=22

• Oct 2 17:47:09 qube2 sshd[1372259]: Failed password for root from 183.81.169.238 port 36050 ssh2
  Oct 2 17:47:12 qube2 sshd[1372592]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 17:47:15 qube2 sshd[1372592]: Failed password for root from 183.81.169.238 port 36056 ssh2
  ...

• 2024-10-02T15:46:56.322106+00:00 frhb72991flex sshd[2162464]: Invalid user Antminer from 183.81.169.238 port 46308
  2024-10-02T15:46:57.558931+00:00 frhb72991flex sshd[2162466]: Invalid user Antminer from 183.81.169.238 port 46326
  ...

• Oct 2 08:46:16 nunnother sshd\[29211\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 08:46:18 nunnother sshd\[29211\]: Failed password for root from 183.81.169.238 port 41510 ssh2
  Oct 2 08:46:21 nunnother sshd\[29213\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 08:46:23 nunnother sshd\[29213\]: Failed password for root from 183.81.169.238 port 41542 ssh2
  Oct 2 08:46:26 nunnother sshd\[29215\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  ...

• Oct 2 15:46:09 AU1 sshd[166911]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 15:46:11 AU1 sshd[166911]: Failed password for root from 183.81.169.238 port 53088 ssh2
  ...

• Oct 2 17:44:40 amk sshd\[4782\]: Failed password for root from 183.81.169.238 port 40432 ssh2Oct 2 17:44:45 amk sshd\[4784\]: Failed password for root from 183.81.169.238 port 40440 ssh2
  ...

• Oct 2 17:44:31 dsh1621 sshd[3586465]: Failed password for root from 183.81.169.238 port 55362 ssh2
  Oct 2 17:44:33 dsh1621 sshd[3586501]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 17:44:35 dsh1621 sshd[3586501]: Failed password for root from 183.81.169.238 port 55396 ssh2
  Oct 2 17:44:39 dsh1621 sshd[3586523]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 17:44:40 dsh1621 sshd[3586523]: Failed password for root from 183.81.169.238 port 47598 ssh2
  ...

• Auto Fail2Ban report, multiple SSH login attempts.

• 2024-10-02T12:43:45.816794vmi1989674.contaboserver.net sshd[2281657]: Invalid user Antminer from 183.81.169.238 port 55964
  2024-10-02T12:43:47.730362vmi1989674.contaboserver.net sshd[2281660]: Invalid user Antminer from 183.81.169.238 port 55978
  ...

• 2024-10-02 15:43:46,298 fail2ban.actions [624]: NOTICE [sshd] Ban 183.81.169.238

• Oct 2 15:43:39 web-proxy02 sshd[1586472]: Failed password for root from 183.81.169.238 port 56686 ssh2
  Oct 2 15:43:42 web-proxy02 sshd[1586474]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 15:43:44 web-proxy02 sshd[1586474]: Failed password for root from 183.81.169.238 port 56722 ssh2
  ...

• $f2bV_matches

• Oct 2 17:42:40 vps2 sshd[1814415]: Invalid user Antminer from 183.81.169.238 port 54012
  Oct 2 17:42:42 vps2 sshd[1814417]: Invalid user Antminer from 183.81.169.238 port 54028
  Oct 2 17:42:51 vps2 sshd[1814431]: Invalid user admin from 183.81.169.238 port 50562
  Oct 2 17:42:53 vps2 sshd[1814433]: Invalid user baikal from 183.81.169.238 port 50576
  ...

• Oct 2 17:42:27 h3004354 sshd[2226637]: Failed password for root from 183.81.169.238 port 37452 ssh2
  Oct 2 17:42:30 h3004354 sshd[2226639]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 17:42:32 h3004354 sshd[2226639]: Failed password for root from 183.81.169.238 port 49606 ssh2
  Oct 2 17:42:37 h3004354 sshd[2226641]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 17:42:39 h3004354 sshd[2226641]: Failed password for root from 183.81.169.238 port 51154 ssh2
  ...

• Oct 2 17:42:12 Servo sshd[3001771]: Invalid user Antminer from 183.81.169.238 port 39696
  Oct 2 17:42:13 Servo sshd[3001776]: Invalid user Antminer from 183.81.169.238 port 39700
  Oct 2 17:42:25 Servo sshd[3002019]: Invalid user admin from 183.81.169.238 port 52118
  ...

• 2024-10-02T17:42:08.838093+02:00 servidor1 sshd[30995]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-02T17:42:09.540405+02:00 servidor1 sshd[30995]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T17:42:11.879772+02:00 servidor1 sshd[30995]: Failed password for invalid user root from 183.81.169.238 port 55928 ssh2
  2024-10-02T17:42:14.495686+02:00 servidor1 sshd[30997]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-02T17:42:15.163889+02:00 servidor1 sshd[30997]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T17:42:16.993786+02:00 servidor1 sshd[30997]: Failed password for invalid user root from 183.81.169.238 port 55972 ssh2
  2024-10-02T17:42:20.926983+02:00 servidor1 sshd[31061]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  ...

• 2024-10-02T17:39:46.600461+02:00 hvs sshd-session[36749]: Connection closed by authenticating user root 183.81.169.238 port 40580 [preauth]
  2024-10-02T17:39:52.121802+02:00 hvs sshd-session[36755]: Connection closed by authenticating user root 183.81.169.238 port 40624 [preauth]
  2024-10-02T17:39:53.650919+02:00 hvs sshd-session[36757]: Connection closed by authenticating user root 183.81.169.238 port 40632 [preauth]
  2024-10-02T17:39:55.700273+02:00 hvs sshd-session[36759]: Connection closed by authenticating user root 183.81.169.238 port 40648 [preauth]
  2024-10-02T17:39:57.533236+02:00 hvs sshd-session[36762]: Connection closed by authenticating user root 183.81.169.238 port 44610 [preauth]
  ...

• Oct 2 17:39:25 git sshd[548143]: Invalid user Antminer from 183.81.169.238 port 36952
  Oct 2 17:39:27 git sshd[548145]: Invalid user Antminer from 183.81.169.238 port 60262
  Oct 2 17:39:38 git sshd[548157]: Invalid user admin from 183.81.169.238 port 42088
  ...

• 2024-10-02T15:39:13.676483brfr sshd[60899]: Invalid user Antminer from 183.81.169.238 port 40700
  2024-10-02T15:39:16.261518brfr sshd[61827]: Invalid user Antminer from 183.81.169.238 port 56794
  2024-10-02T15:39:33.492922brfr sshd[68504]: Invalid user admin from 183.81.169.238 port 50554
  ...

• Oct 2 10:39:01 ivankin sshd[432582]: Failed password for root from 183.81.169.238 port 48936 ssh2
  Oct 2 10:39:04 ivankin sshd[432584]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 10:39:06 ivankin sshd[432584]: Failed password for root from 183.81.169.238 port 48956 ssh2
  ...

• Oct 2 17:37:52 DarkStreetRP sshd[1157112]: Failed password for root from 183.81.169.238 port 48440 ssh2
  Oct 2 17:37:55 DarkStreetRP sshd[1157117]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 17:37:57 DarkStreetRP sshd[1157117]: Failed password for root from 183.81.169.238 port 48450 ssh2
  Oct 2 17:38:01 DarkStreetRP sshd[1157123]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 17:38:02 DarkStreetRP sshd[1157123]: Failed password for root from 183.81.169.238 port 51432 ssh2
  Oct 2 17:38:05 DarkStreetRP sshd[1157128]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 17:38:06 DarkStreetRP sshd[1157128]: Failed password for root from 183.81.169.238 port 51464 ssh2
  ...

• Oct 2 17:38:07 v2202301167543214332 sshd[2961588]: Failed password for root from 183.81.169.238 port 60580 ssh2
  Oct 2 17:38:11 v2202301167543214332 sshd[2961590]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 17:38:13 v2202301167543214332 sshd[2961590]: Failed password for root from 183.81.169.238 port 60654 ssh2
  Oct 2 17:38:16 v2202301167543214332 sshd[2961592]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 17:38:18 v2202301167543214332 sshd[2961592]: Failed password for root from 183.81.169.238 port 55872 ssh2
  ...

• Oct 2 11:37:20 us-mfl-03 sshd[1986951]: Invalid user Antminer from 183.81.169.238 port 60608
  ...

• Oct 2 17:35:57 ns37 sshd[8725]: Failed password for root from 183.81.169.238 port 33896 ssh2
  Oct 2 17:36:00 ns37 sshd[8727]: Failed password for root from 183.81.169.238 port 58278 ssh2
  ...

• 2024-10-02T15:35:12.102161+00:00 Linux15 sshd[3777204]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T15:35:14.864388+00:00 Linux15 sshd[3777204]: Failed password for root from 183.81.169.238 port 46200 ssh2
  2024-10-02T15:35:19.606787+00:00 Linux15 sshd[3777861]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T15:35:20.994341+00:00 Linux15 sshd[3777861]: Failed password for root from 183.81.169.238 port 42166 ssh2
  2024-10-02T15:35:24.351660+00:00 Linux15 sshd[3778180]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T15:35:27.094353+00:00 Linux15 sshd[3778180]: Failed password for root from 183.81.169.238 port 42226 ssh2
  2024-10-02T15:35:31.805873+00:00 Linux15 sshd[3778665]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= r
  ...

• Oct 2 17:34:14 mail sshd[460479]: Failed password for root from 183.81.169.238 port 60224 ssh2
  Oct 2 17:34:16 mail sshd[460487]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 17:34:18 mail sshd[460487]: Failed password for root from 183.81.169.238 port 35516 ssh2
  Oct 2 17:34:20 mail sshd[460495]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 17:34:22 mail sshd[460495]: Failed password for root from 183.81.169.238 port 35526 ssh2
  ...

• Oct 2 11:32:56 vps196363 sshd[23047]: Failed password for root from 183.81.169.238 port 33058 ssh2
  Oct 2 11:33:01 vps196363 sshd[23075]: Failed password for root from 183.81.169.238 port 58110 ssh2
  Oct 2 11:33:05 vps196363 sshd[23078]: Failed password for root from 183.81.169.238 port 58118 ssh2
  ...

• 2024-10-02T17:31:16.840584+02:00 PWS-PM-WEB01 sshd[3253462]: Failed password for root from 183.81.169.238 port 36818 ssh2
  2024-10-02T17:31:20.141152+02:00 PWS-PM-WEB01 sshd[3253465]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T17:31:21.719738+02:00 PWS-PM-WEB01 sshd[3253465]: Failed password for root from 183.81.169.238 port 44978 ssh2
  ...

• Oct 2 17:31:01 h2930838 sshd[15712]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 17:31:02 h2930838 sshd[15712]: Failed password for invalid user root from 183.81.169.238 port 49190 ssh2

• FW-PortScan: Traffic Blocked srcport=34493 dstport=22

• 2024-10-02 12:55:15 UTC Unauthorized activity to TCP port 22. SSH

• SSH Bruteforce Attempt (failed auth)

• Oct 2 15:29:32 vps-d7931dc8 sshd[469688]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 15:29:34 vps-d7931dc8 sshd[469688]: Failed password for root from 183.81.169.238 port 46562 ssh2
  Oct 2 15:29:35 vps-d7931dc8 sshd[469688]: Connection closed by authenticating user root 183.81.169.238 port 46562 [preauth]
  Oct 2 15:29:37 vps-d7931dc8 sshd[469690]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 15:29:39 vps-d7931dc8 sshd[469690]: Failed password for root from 183.81.169.238 port 47800 ssh2

• Oct 2 17:29:16 web sshd[992036]: Failed password for root from 183.81.169.238 port 58352 ssh2
  Oct 2 17:29:18 web sshd[992042]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 17:29:21 web sshd[992042]: Failed password for root from 183.81.169.238 port 59388 ssh2
  Oct 2 17:29:24 web sshd[992056]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 17:29:27 web sshd[992056]: Failed password for root from 183.81.169.238 port 59404 ssh2
  ...

• 2024-10-02T17:29:14.067883vmi1671272.contaboserver.net sshd[3775044]: Failed password for root from 183.81.169.238 port 50712 ssh2
  2024-10-02T17:29:16.990921vmi1671272.contaboserver.net sshd[3775046]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T17:29:18.880975vmi1671272.contaboserver.net sshd[3775046]: Failed password for root from 183.81.169.238 port 53556 ssh2
  2024-10-02T17:29:21.993903vmi1671272.contaboserver.net sshd[3775060]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T17:29:24.235435vmi1671272.contaboserver.net sshd[3775060]: Failed password for root from 183.81.169.238 port 53586 ssh2

• Funeypot detected 4257 ssh attempts in 553h43m3s. Last by user "root", password "*", client "Go".

• [rede-164-29] (sshd) Failed SSH login from 183.81.169.238 (NL/The Netherlands/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Oct 2 12:27:29 sshd[27430]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=[USERNAME]
  Oct 2 12:27:31 sshd[27430]: Failed password for [USERNAME] from 183.81.169.238 port 40462 ssh2
  Oct 2 12:27:34 sshd[27440]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=[USERNAME]
  Oct 2 12:27:36 sshd[27440]: Failed password for [USERNAME] from 183.81.169.238 port 40468 ssh2
  Oct 2 12:

• Oct 2 15:27:01 cloud sshd[3833818]: Invalid user Antminer from 183.81.169.238 port 37974
  Oct 2 15:27:02 cloud sshd[3833820]: Invalid user Antminer from 183.81.169.238 port 37986
  ...

• Oct 2 18:26:49 server2 sshd\[28510\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 18:26:50 server2 sshd\[28512\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 18:26:51 server2 sshd\[28514\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 18:26:53 server2 sshd\[28516\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 18:26:54 server2 sshd\[28519\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 18:26:55 server2 sshd\[28521\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers

• Failed password for root from 183.81.169.238 port 51244 ssh2
  pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Failed password for root from 183.81.169.238 port 50876 ssh2
  pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Failed password for root from 183.81.169.238 port 50892 ssh2

• Fail2Ban - \(SSHD\) Brute-force SSH server from this IP
  ...

• Scenario: crowdsecurity/ssh-bf

• Oct 2 15:24:07 thecount sshd[1293304]: Connection closed by authenticating user root 183.81.169.238 port 51910 [preauth]
  ...

• 2024-10-02T17:24:02.073343+02:00 siena sshd[1237842]: Invalid user Antminer from 183.81.169.238 port 34400
  ...

• Oct 2 17:22:10 KADIN sshd[1222512]: Failed password for root from 183.81.169.238 port 44780 ssh2
  Oct 2 17:22:13 KADIN sshd[1222517]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 17:22:15 KADIN sshd[1222517]: Failed password for root from 183.81.169.238 port 44786 ssh2
  Oct 2 17:22:18 KADIN sshd[1222522]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 17:22:20 KADIN sshd[1222522]: Failed password for root from 183.81.169.238 port 45644 ssh2
  Oct 2 17:22:24 KADIN sshd[1222527]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 17:22:26 KADIN sshd[1222527]: Failed password for root from 183.81.169.238 port 45700 ssh2
  ...

• 2024-10-02T08:22:55.768091 web sshd[344212]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T08:22:58.020428 web sshd[344212]: Failed password for root from 183.81.169.238 port 36130 ssh2
  ...

• Drop from IP address 183.81.169.238 to tcp-port 22

• 2024-10-02T15:21:42.453504+00:00 srv67 sshd[36689]: Connection closed by authenticating user root 183.81.169.238 port 57506 [preauth]
  ...

• Oct 2 17:21:28 vmi1008219 sshd[343767]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 17:21:31 vmi1008219 sshd[343767]: Failed password for root from 183.81.169.238 port 38436 ssh2
  ...

• 2024-10-02T17:20:07.071384+02:00 fangorn sshd[264775]: Failed password for root from 183.81.169.238 port 41158 ssh2
  2024-10-02T17:20:11.386944+02:00 fangorn sshd[264778]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T17:20:13.457721+02:00 fangorn sshd[264778]: Failed password for root from 183.81.169.238 port 38346 ssh2
  ...

• unauthorized connection with user "root" and password "0" at 2024-10-02T15:19:12Z

• Oct 2 15:18:32 server sshd[2254002]: Invalid user Antminer from 183.81.169.238 port 40960
  Oct 2 15:18:35 server sshd[2254004]: Invalid user Antminer from 183.81.169.238 port 40972
  Oct 2 15:18:53 server sshd[2254018]: Invalid user admin from 183.81.169.238 port 33880
  ...

• Events: TCP SYN Discovery or Flooding, Seen 133 times in the last 10800 seconds

• ...

• Oct 2 15:16:41 f2b auth.info sshd[102990]: Failed password for root from 183.81.169.238 port 49438 ssh2
  Oct 2 15:16:43 f2b auth.info sshd[102992]: Failed password for root from 183.81.169.238 port 49444 ssh2
  Oct 2 15:16:46 f2b auth.info sshd[102994]: Failed password for root from 183.81.169.238 port 33434 ssh2
  ...

• [bulkvm.com/honeypot] SSH-Multi login Attempt

• 338 times SMTP brute-force

• SSH login attempt with user Antminer

• Oct 2 17:15:57 pinkypie sshd[51779]: Failed password for root from 183.81.169.238 port 49734 ssh2
  Oct 2 17:16:01 pinkypie sshd[51781]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 17:16:02 pinkypie sshd[51781]: Failed password for root from 183.81.169.238 port 49790 ssh2
  ...

• 2024-10-02T17:14:38.364444+02:00 ubuntu sshd[153985]: Failed password for root from 183.81.169.238 port 40478 ssh2
  2024-10-02T17:14:41.518518+02:00 ubuntu sshd[153987]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T17:14:43.619261+02:00 ubuntu sshd[153987]: Failed password for root from 183.81.169.238 port 40502 ssh2
  2024-10-02T17:14:47.055623+02:00 ubuntu sshd[153989]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T17:14:49.648033+02:00 ubuntu sshd[153989]: Failed password for root from 183.81.169.238 port 43296 ssh2
  ...

• Oct 2 16:13:44 sheikh-ahmed-abu-islam-v2 sshd[2213541]: Invalid user Antminer from 183.81.169.238 port 59476
  Oct 2 16:13:45 sheikh-ahmed-abu-islam-v2 sshd[2213561]: Invalid user Antminer from 183.81.169.238 port 53704
  ...

• Oct 2 17:12:04 vmi440488 sshd[3470655]: Failed password for root from 183.81.169.238 port 58878 ssh2
  Oct 2 17:12:07 vmi440488 sshd[3470657]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 17:12:09 vmi440488 sshd[3470657]: Failed password for root from 183.81.169.238 port 60250 ssh2
  Oct 2 17:12:12 vmi440488 sshd[3470660]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 17:12:14 vmi440488 sshd[3470660]: Failed password for root from 183.81.169.238 port 60252 ssh2
  ...

• SSH port scan (Tarpitted for 2m30s, wasted 278B)

• Oct 2 17:11:01 AbuseCatcher sshd[4097936]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 17:11:03 AbuseCatcher sshd[4097936]: Failed password for root from 183.81.169.238 port 43892 ssh2
  ...

• (sshd) Failed SSH login from 183.81.169.238 (NL/The Netherlands/North Holland/Amsterdam/-/[AS206264 Amarutu Technology Ltd]): 5 in the last 3600 secs; IP: 183.81.169.238; Ports: *; Direction: 0; Trigger: LF_SSHD; Logs: 2024-10-02T17:10:11.336056+02:00 insightVM sshd[3281884]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root 2024-10-02T17:10:13.371364+02:00 insightVM sshd[3281884]: Failed password for root from 183.81.169.238 port 55108 ssh2 2024-10-02T17:10:16.002642+02:00 insightVM sshd[3281902]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root 2024-10-02T17:10:18.253818+02:00 insightVM sshd[3281902]: Failed password for root from 183.81.169.238 port 33558 ssh2 2024-10-02T17:10:20.144481+02:00 insightVM sshd[3281915]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root

• 2024-10-02T12:08:30.530058-03:00 dns1 sshd[17161]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T12:08:33.036062-03:00 dns1 sshd[17161]: Failed password for root from 183.81.169.238 port 39334 ssh2
  2024-10-02T12:08:33.518611-03:00 dns1 sshd[17161]: Connection closed by authenticating user root 183.81.169.238 port 39334 [preauth]
  2024-10-02T12:08:36.891134-03:00 dns1 sshd[17163]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T12:08:38.885798-03:00 dns1 sshd[17163]: Failed password for root from 183.81.169.238 port 39366 ssh2

• Oct 2 17:07:25 CDN sshd[1786971]: Failed password for root from 183.81.169.238 port 48552 ssh2
  Oct 2 17:07:27 CDN sshd[1786973]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 17:07:29 CDN sshd[1786973]: Failed password for root from 183.81.169.238 port 59408 ssh2
  Oct 2 17:07:32 CDN sshd[1786975]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 17:07:34 CDN sshd[1786975]: Failed password for root from 183.81.169.238 port 59418 ssh2

• 2024-10-02T17:05:12.440614+02:00 vserver-20917 sshd-session[1929467]: Failed password for root from 183.81.169.238 port 49324 ssh2
  2024-10-02T17:05:15.585020+02:00 vserver-20917 sshd-session[1929474]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T17:05:17.315298+02:00 vserver-20917 sshd-session[1929474]: Failed password for root from 183.81.169.238 port 49330 ssh2
  2024-10-02T17:05:20.638713+02:00 vserver-20917 sshd-session[1929481]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T17:05:22.388605+02:00 vserver-20917 sshd-session[1929481]: Failed password for root from 183.81.169.238 port 33494 ssh2
  ...

• Oct 2 08:06:10 server01 sshd[32177]: Failed password for root from 183.81.169.238 port 51828 ssh2
  Oct 2 08:06:15 server01 sshd[32179]: Failed password for root from 183.81.169.238 port 51884 ssh2
  ...

• 2024-10-02T17:06:07.987103+02:00 marvibiene sshd[4016487]: Failed password for root from 183.81.169.238 port 34726 ssh2
  2024-10-02T17:06:11.551221+02:00 marvibiene sshd[4016631]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T17:06:13.637101+02:00 marvibiene sshd[4016631]: Failed password for root from 183.81.169.238 port 34772 ssh2
  2024-10-02T17:06:15.309442+02:00 marvibiene sshd[4016634]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T17:06:16.607936+02:00 marvibiene sshd[4016634]: Failed password for root from 183.81.169.238 port 47112 ssh2

• 2024-10-02T17:05:47.056217+02:00 mail sshd[609860]: Failed password for root from 183.81.169.238 port 51178 ssh2
  2024-10-02T17:05:51.761486+02:00 mail sshd[609863]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T17:05:53.099377+02:00 mail sshd[609863]: Failed password for root from 183.81.169.238 port 36640 ssh2
  2024-10-02T17:05:56.806173+02:00 mail sshd[609866]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T17:05:58.164513+02:00 mail sshd[609866]: Failed password for root from 183.81.169.238 port 59302 ssh2
  ...

• Oct 2 17:05:39 server sshd[1313562]: Failed password for root from 183.81.169.238 port 49748 ssh2
  Oct 2 17:05:43 server sshd[1313566]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 17:05:45 server sshd[1313566]: Failed password for root from 183.81.169.238 port 49768 ssh2
  Oct 2 17:05:50 server sshd[1313569]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 17:05:51 server sshd[1313569]: Failed password for root from 183.81.169.238 port 43892 ssh2
  ...

• Oct 2 15:05:19 scw-6657dc sshd[32426]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 15:05:19 scw-6657dc sshd[32426]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 15:05:22 scw-6657dc sshd[32426]: Failed password for root from 183.81.169.238 port 35086 ssh2
  ...

• Oct 2 17:05:01 trevata sshd[104579]: Failed password for root from 183.81.169.238 port 60424 ssh2
  Oct 2 17:05:04 trevata sshd[104584]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 17:05:06 trevata sshd[104584]: Failed password for root from 183.81.169.238 port 60452 ssh2
  Oct 2 17:05:10 trevata sshd[104589]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 17:05:12 trevata sshd[104589]: Failed password for root from 183.81.169.238 port 42808 ssh2
  Oct 2 17:05:15 trevata sshd[104596]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 17:05:17 trevata sshd[104596]: Failed password for root from 183.81.169.238 port 42842 ssh2
  ...

• tcp/22 (38 or more attempts)

• Oct 2 15:02:41 c2 sshd[2019058]: Failed password for root from 183.81.169.238 port 33174 ssh2
  Oct 2 15:02:45 c2 sshd[2019062]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 15:02:47 c2 sshd[2019062]: Failed password for root from 183.81.169.238 port 52986 ssh2
  Oct 2 15:02:49 c2 sshd[2019066]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 15:02:52 c2 sshd[2019066]: Failed password for root from 183.81.169.238 port 53004 ssh2
  ...

• 2024-10-02 10:02:48,346 fail2ban.actions [974]: NOTICE [sshd] Ban 183.81.169.238

• 2024-10-02T11:02:25.340898-04:00 ns05-a-ns-xyz sshd[2248394]: Failed password for root from 183.81.169.238 port 34422 ssh2
  2024-10-02T11:02:28.768419-04:00 ns05-a-ns-xyz sshd[2248396]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T11:02:31.242024-04:00 ns05-a-ns-xyz sshd[2248396]: Failed password for root from 183.81.169.238 port 60516 ssh2
  2024-10-02T11:02:34.156084-04:00 ns05-a-ns-xyz sshd[2248398]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T11:02:36.119314-04:00 ns05-a-ns-xyz sshd[2248398]: Failed password for root from 183.81.169.238 port 60570 ssh2
  ...

• Oct 3 00:02:13 localhost sshd[2586250]: Failed password for root from 183.81.169.238 port 59826 ssh2
  Oct 3 00:02:17 localhost sshd[2586301]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 00:02:19 localhost sshd[2586301]: Failed password for root from 183.81.169.238 port 51846 ssh2
  Oct 3 00:02:24 localhost sshd[2586368]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 3 00:02:26 localhost sshd[2586368]: Failed password for root from 183.81.169.238 port 51858 ssh2
  ...

• FW-PortScan: Traffic Blocked srcport=54898 dstport=22

• 2024-10-02T17:01:14.857473+02:00 vmi985635.contaboserver.net sshd[2241378]: Failed password for root from 183.81.169.238 port 47642 ssh2
  2024-10-02T17:01:16.352306+02:00 vmi985635.contaboserver.net sshd[2241407]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T17:01:18.450596+02:00 vmi985635.contaboserver.net sshd[2241407]: Failed password for root from 183.81.169.238 port 50306 ssh2
  2024-10-02T17:01:21.229521+02:00 vmi985635.contaboserver.net sshd[2241435]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T17:01:23.511082+02:00 vmi985635.contaboserver.net sshd[2241435]: Failed password for root from 183.81.169.238 port 50326 ssh2
  ...

• Ports: 22

• 2024-10-02T15:00:37.651429+00:00 Linux09 sshd[2793700]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T15:00:40.218627+00:00 Linux09 sshd[2793700]: Failed password for root from 183.81.169.238 port 49936 ssh2
  2024-10-02T15:00:44.079167+00:00 Linux09 sshd[2794106]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T15:00:45.938498+00:00 Linux09 sshd[2794106]: Failed password for root from 183.81.169.238 port 49944 ssh2
  2024-10-02T15:00:48.356058+00:00 Linux09 sshd[2794449]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T15:00:50.433273+00:00 Linux09 sshd[2794449]: Failed password for root from 183.81.169.238 port 38370 ssh2
  2024-10-02T15:00:54.006071+00:00 Linux09 sshd[2794821]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= r
  ...

• Oct 2 11:00:34 frank sshd[2311635]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 11:00:39 frank sshd[2312189]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 11:00:45 frank sshd[2312741]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 11:00:50 frank sshd[2313019]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 11:00:55 frank sshd[2313296]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  ...

• Oct 2 17:00:40 gateway1-old sshd[3324]: Failed password for root from 183.81.169.238 port 51828 ssh2
  Oct 2 17:00:43 gateway1-old sshd[3531]: Failed password for root from 183.81.169.238 port 51842 ssh2

• Invalid user Antminer from 183.81.169.238 port 55460

• Invalid user Antminer from 183.81.169.238 port 41596

• Invalid user Antminer from 183.81.169.238 port 39428

• Invalid user Antminer from 183.81.169.238 port 60340

• Invalid user Antminer from 183.81.169.238 port 59672

• Invalid user Antminer from 183.81.169.238 port 54448

• Oct 2 15:59:38 kamergaz sshd[2421452]: Failed password for root from 183.81.169.238 port 59470 ssh2
  Oct 2 15:59:42 kamergaz sshd[2421454]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 15:59:44 kamergaz sshd[2421454]: Failed password for root from 183.81.169.238 port 59488 ssh2
  Oct 2 15:59:47 kamergaz sshd[2421457]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 15:59:49 kamergaz sshd[2421457]: Failed password for root from 183.81.169.238 port 59482 ssh2

• Oct 2 08:48:56 web2 sshd\[29401\]: Failed password for root from 183.81.169.238 port 54858 ssh2Oct 2 08:49:00 web2 sshd\[29403\]: Failed password for root from 183.81.169.238 port 54874 ssh2Oct 2 08:49:05 web2 sshd\[29405\]: Failed password for root from 183.81.169.238 port 34356 ssh2Oct 2 08:49:10 web2 sshd\[29407\]: Failed password for root from 183.81.169.238 port 34376 ssh2Oct 2 08:49:15 web2 sshd\[29409\]: Failed password for root from 183.81.169.238 port 51066 ssh2Oct 2 08:49:19 web2 sshd\[29413\]: Failed password for root from 183.81.169.238 port 51074 ssh2
  ...

• Oct 2 14:58:21 ns520895 sshd[32690]: Failed password for root from 183.81.169.238 port 51646 ssh2
  ...

• tarpit

• [rede-164-29] 10/02/2024-11:57:56.411276, 183.81.169.238, Protocol: 6, ET COMPROMISED Known Compromised or Hostile Host Traffic group 13

• Oct 2 14:56:10 destiny sshd[2034584]: Connection closed by invalid user root 183.81.169.238 port 41424 [preauth]
  Oct 2 14:56:12 destiny sshd[2034586]: User root not allowed because account is locked
  Oct 2 14:56:12 destiny sshd[2034586]: Connection closed by invalid user root 183.81.169.238 port 41438 [preauth]
  Oct 2 14:56:13 destiny sshd[2034588]: User root not allowed because account is locked
  Oct 2 14:56:14 destiny sshd[2034588]: Connection closed by invalid user root 183.81.169.238 port 41452 [preauth]
  ...

• Oct 2 14:55:20 ns5024002 sshd[1115800]: Failed password for root from 183.81.169.238 port 35356 ssh2
  Oct 2 14:55:24 ns5024002 sshd[1115955]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 14:55:26 ns5024002 sshd[1115955]: Failed password for root from 183.81.169.238 port 35376 ssh2
  Oct 2 14:55:29 ns5024002 sshd[1116103]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 14:55:31 ns5024002 sshd[1116103]: Failed password for root from 183.81.169.238 port 38848 ssh2
  ...

• 2024-10-02T16:54:59.047198+02:00 pokevador sshd[243690]: Failed password for root from 183.81.169.238 port 54276 ssh2
  2024-10-02T16:55:02.092704+02:00 pokevador sshd[244071]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T16:55:04.002159+02:00 pokevador sshd[244071]: Failed password for root from 183.81.169.238 port 54302 ssh2
  ...

• Oct 2 16:54:44 hosting sshd[2311593]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 16:54:46 hosting sshd[2311593]: Failed password for root from 183.81.169.238 port 41532 ssh2
  Oct 2 16:54:49 hosting sshd[2311667]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 16:54:50 hosting sshd[2311667]: Failed password for root from 183.81.169.238 port 33126 ssh2

• Oct 2 16:52:57 vps-9f3cdc33 sshd[1874148]: Failed password for root from 183.81.169.238 port 33982 ssh2
  Oct 2 16:53:00 vps-9f3cdc33 sshd[1874151]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 16:53:02 vps-9f3cdc33 sshd[1874151]: Failed password for root from 183.81.169.238 port 34014 ssh2
  Oct 2 16:53:04 vps-9f3cdc33 sshd[1874153]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 16:53:06 vps-9f3cdc33 sshd[1874153]: Failed password for root from 183.81.169.238 port 34048 ssh2
  ...

• Oct 2 16:52:16 plesk sshd[11782]: Failed password for root from 183.81.169.238 port 35254 ssh2
  Oct 2 16:52:19 plesk sshd[11797]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 16:52:21 plesk sshd[11797]: Failed password for root from 183.81.169.238 port 36820 ssh2
  Oct 2 16:52:22 plesk sshd[11821]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 16:52:24 plesk sshd[11821]: Failed password for root from 183.81.169.238 port 36870 ssh2

• Oct 2 17:51:19 pkdns2 sshd\[12713\]: Failed password for root from 183.81.169.238 port 59904 ssh2Oct 2 17:51:22 pkdns2 sshd\[12715\]: Failed password for root from 183.81.169.238 port 59926 ssh2Oct 2 17:51:26 pkdns2 sshd\[12717\]: Failed password for root from 183.81.169.238 port 59942 ssh2Oct 2 17:51:31 pkdns2 sshd\[12719\]: Failed password for root from 183.81.169.238 port 36406 ssh2Oct 2 17:51:34 pkdns2 sshd\[12721\]: Failed password for root from 183.81.169.238 port 36418 ssh2Oct 2 17:51:39 pkdns2 sshd\[12723\]: Failed password for root from 183.81.169.238 port 54394 ssh2
  ...

• Oct 2 10:49:56 sputnik sshd[55927]: Invalid user Antminer from 183.81.169.238 port 58082
  Oct 2 10:49:58 sputnik sshd[56490]: Invalid user Antminer from 183.81.169.238 port 58084
  Oct 2 10:50:12 sputnik sshd[62883]: Invalid user admin from 183.81.169.238 port 35398
  ...

• Oct 2 14:48:58 VPS sshd[1645935]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 14:48:59 VPS sshd[1645935]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 14:48:58 VPS sshd[1645935]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 14:49:01 VPS sshd[1645935]: Failed password for invalid user root from 183.81.169.238 port 51586 ssh2
  Oct 2 14:49:04 VPS sshd[1645937]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  ...

• endlessh: 2024-10-02 16:48:53.527626149 2024-10-02T14:48:53.527Z CLOSE host=183.81.169.238 port=33766 fd=5 time=160.042 bytes=265
  ...

• Auto Fail2Ban report, multiple SSH login attempts.

• Oct 2 16:47:01 docker-01 sshd[86608]: Failed password for root from 183.81.169.238 port 42904 ssh2
  Oct 2 16:47:05 docker-01 sshd[86627]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 16:47:07 docker-01 sshd[86627]: Failed password for root from 183.81.169.238 port 42918 ssh2
  Oct 2 16:47:09 docker-01 sshd[86630]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 16:47:11 docker-01 sshd[86630]: Failed password for root from 183.81.169.238 port 47614 ssh2
  ...

• Oct 2 14:45:30 Proxmox-VE sshd[41446]: Failed password for root from 183.81.169.238 port 48554 ssh2
  Oct 2 14:45:33 Proxmox-VE sshd[41470]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 14:45:34 Proxmox-VE sshd[41470]: Failed password for root from 183.81.169.238 port 48564 ssh2
  Oct 2 14:45:38 Proxmox-VE sshd[41476]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 14:45:40 Proxmox-VE sshd[41476]: Failed password for root from 183.81.169.238 port 47468 ssh2
  ...

• Oct 2 16:28:24 ucs sshd\[22298\]: Invalid user Antminer from 183.81.169.238 port 43262
  Oct 2 16:28:25 ucs sshd\[22303\]: Invalid user Antminer from 183.81.169.238 port 43304
  Oct 2 16:28:36 ucs sshd\[22319\]: Invalid user admin from 183.81.169.238 port 40656
  ...

• 2024-10-02T16:45:18.861907vps773228.ovh.net sshd[6587]: Failed password for root from 183.81.169.238 port 53204 ssh2
  2024-10-02T16:45:20.714938vps773228.ovh.net sshd[6589]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T16:45:22.394388vps773228.ovh.net sshd[6589]: Failed password for root from 183.81.169.238 port 53250 ssh2
  2024-10-02T16:45:24.910443vps773228.ovh.net sshd[6591]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T16:45:26.138350vps773228.ovh.net sshd[6591]: Failed password for root from 183.81.169.238 port 53276 ssh2
  ...

• Oct 2 14:44:29 logger sshd[998950]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 14:44:31 logger sshd[998950]: Failed password for root from 183.81.169.238 port 40152 ssh2
  ...

• Oct 2 16:42:31 OPSO sshd\[22243\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 16:42:33 OPSO sshd\[22243\]: Failed password for root from 183.81.169.238 port 43444 ssh2
  Oct 2 16:42:36 OPSO sshd\[22245\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 16:42:37 OPSO sshd\[22245\]: Failed password for root from 183.81.169.238 port 43456 ssh2
  Oct 2 16:42:39 OPSO sshd\[22247\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root

• 70 failed SSH login attempts between Tue, 01 Oct 2024 18:25:42 +0200 and Wed, 02 Oct 2024 14:38:42 +0200, port 22.

• Oct 2 16:41:12 mx1 sshd[1981055]: Failed password for root from 183.81.169.238 port 47612 ssh2
  Oct 2 16:41:14 mx1 sshd[1981057]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 16:41:16 mx1 sshd[1981057]: Failed password for root from 183.81.169.238 port 47646 ssh2
  Oct 2 16:41:18 mx1 sshd[1981059]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 16:41:20 mx1 sshd[1981059]: Failed password for root from 183.81.169.238 port 52174 ssh2
  ...

• 2024-10-02T14:39:42.833419+00:00 Linux101 sshd[2529384]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T14:39:44.111309+00:00 Linux101 sshd[2529384]: Failed password for root from 183.81.169.238 port 58632 ssh2
  2024-10-02T14:39:47.256151+00:00 Linux101 sshd[2530103]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T14:39:49.519166+00:00 Linux101 sshd[2530103]: Failed password for root from 183.81.169.238 port 36920 ssh2
  2024-10-02T14:39:53.665805+00:00 Linux101 sshd[2531030]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T14:39:55.786770+00:00 Linux101 sshd[2531030]: Failed password for root from 183.81.169.238 port 36946 ssh2
  2024-10-02T14:39:59.926686+00:00 Linux101 sshd[2531867]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh r
  ...

• Oct 2 14:39:52 cloud-server-0 sshd[2885931]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 14:39:53 cloud-server-0 sshd[2885931]: Failed password for root from 183.81.169.238 port 46756 ssh2
  ...

• Oct 2 16:39:27 kroki sshd[181637]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 16:39:29 kroki sshd[181637]: Failed password for root from 183.81.169.238 port 33588 ssh2
  Oct 2 16:39:33 kroki sshd[181639]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 16:39:35 kroki sshd[181639]: Failed password for root from 183.81.169.238 port 33610 ssh2
  ...

• SSH login attempts (endlessh): 2024-10-02T14:39:25.338Z ACCEPT host=::ffff:183.81.169.238 port=54262 fd=4 n=2/4096

• Oct 2 17:39:08 server2 sshd\[23262\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 17:39:10 server2 sshd\[23266\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 17:39:12 server2 sshd\[23268\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 17:39:13 server2 sshd\[23271\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 17:39:14 server2 sshd\[23276\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 17:39:16 server2 sshd\[23278\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers

• Oct 2 16:38:39 v4940 sshd[3894831]: Failed password for root from 183.81.169.238 port 37782 ssh2
  Oct 2 16:38:43 v4940 sshd[3894875]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 16:38:45 v4940 sshd[3894875]: Failed password for root from 183.81.169.238 port 37812 ssh2
  ...

• 2024-10-02T14:38:09.360497+00:00 prod-3 sshd[997978]: Connection closed by authenticating user root 183.81.169.238 port 39938 [preauth]
  2024-10-02T14:38:11.851746+00:00 prod-3 sshd[997980]: Connection closed by authenticating user root 183.81.169.238 port 39948 [preauth]
  2024-10-02T14:38:14.338765+00:00 prod-3 sshd[998000]: Connection closed by authenticating user root 183.81.169.238 port 39964 [preauth]
  2024-10-02T14:38:16.742377+00:00 prod-3 sshd[998002]: Connection closed by authenticating user root 183.81.169.238 port 38496 [preauth]
  2024-10-02T14:38:18.700443+00:00 prod-3 sshd[998005]: Connection closed by authenticating user root 183.81.169.238 port 38504 [preauth]
  ...

• 2024-10-02 07:38:00,826 fail2ban.actions [689]: NOTICE [sshd] Ban 183.81.169.238

• 2024-10-02T16:38:40.935332+02:00 runner3 sshd[3506474]: Failed password for root from 183.81.169.238 port 35106 ssh2
  2024-10-02T16:38:43.960449+02:00 runner3 sshd[3506476]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T16:38:45.805591+02:00 runner3 sshd[3506476]: Failed password for root from 183.81.169.238 port 35154 ssh2
  2024-10-02T16:38:49.581945+02:00 runner3 sshd[3506478]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T16:38:51.583222+02:00 runner3 sshd[3506478]: Failed password for root from 183.81.169.238 port 35696 ssh2
  ...

• Oct 2 16:36:27 maximus sshd[4077499]: Failed password for root from 183.81.169.238 port 56262 ssh2
  Oct 2 16:36:31 maximus sshd[4077517]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 16:36:34 maximus sshd[4077517]: Failed password for root from 183.81.169.238 port 56344 ssh2
  Oct 2 16:36:37 maximus sshd[4077520]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 16:36:39 maximus sshd[4077520]: Failed password for root from 183.81.169.238 port 37202 ssh2
  ...

• Oct 2 14:36:29 instance-20221219-1303 sshd[2753897]: Invalid user Antminer from 183.81.169.238 port 60172
  ...

• 2024-10-02T14:36:03.451448+00:00 virt-hur-fmt-01.pdx.net.uk sshd[4152386]: Invalid user Antminer from 183.81.169.238 port 44054
  2024-10-02T14:36:06.118676+00:00 virt-hur-fmt-01.pdx.net.uk sshd[4152388]: Invalid user Antminer from 183.81.169.238 port 35356
  2024-10-02T14:36:20.776466+00:00 virt-hur-fmt-01.pdx.net.uk sshd[4152461]: Invalid user admin from 183.81.169.238 port 52772
  ...

• 2024-10-02T16:36:08.345626+02:00 khatuna sshd[547703]: Failed password for root from 183.81.169.238 port 37452 ssh2
  2024-10-02T16:36:11.470002+02:00 khatuna sshd[547734]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T16:36:13.781565+02:00 khatuna sshd[547734]: Failed password for root from 183.81.169.238 port 37472 ssh2
  2024-10-02T16:36:18.621475+02:00 khatuna sshd[547767]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T16:36:20.225743+02:00 khatuna sshd[547767]: Failed password for root from 183.81.169.238 port 60866 ssh2
  ...

• 10/02/2024-16:34:57.584657 183.81.169.238 Protocol: 6 ET COMPROMISED Known Compromised or Hostile Host Traffic group 13

• 2024-10-02T16:34:46.584471+02:00 vande sshd[1520936]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T16:34:48.559935+02:00 vande sshd[1520936]: Failed password for root from 183.81.169.238 port 59274 ssh2

• Oct 2 16:34:14 fshubvidspace sshd[2987487]: Failed password for root from 183.81.169.238 port 42574 ssh2
  Oct 2 16:34:17 fshubvidspace sshd[2987489]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 16:34:19 fshubvidspace sshd[2987489]: Failed password for root from 183.81.169.238 port 59364 ssh2
  Oct 2 16:34:22 fshubvidspace sshd[2987491]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 16:34:25 fshubvidspace sshd[2987491]: Failed password for root from 183.81.169.238 port 59386 ssh2
  ...

• FW-PortScan: Traffic Blocked srcport=45575 dstport=22

• Oct 2 18:01:36 Digitalogic sshd[1156540]: Connection closed by authenticating user root 183.81.169.238 port 49388 [preauth]
  Oct 2 18:01:38 Digitalogic sshd[1156573]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 18:01:41 Digitalogic sshd[1156573]: Failed password for root from 183.81.169.238 port 45966 ssh2
  ...

• Oct 2 10:30:37 ny01 sshd[2581484]: Failed password for root from 183.81.169.238 port 54882 ssh2
  Oct 2 10:30:40 ny01 sshd[2581486]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 10:30:43 ny01 sshd[2581486]: Failed password for root from 183.81.169.238 port 58010 ssh2
  Oct 2 10:30:47 ny01 sshd[2581489]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 10:30:49 ny01 sshd[2581489]: Failed password for root from 183.81.169.238 port 42132 ssh2

• SSH Brute-Force Attack on a server hosted by PulseServers.com - US10 Honeypot
  ...

• Oct 2 16:28:12 OakCottage sshd[28556]: Failed password for root from 183.81.169.238 port 45542 ssh2
  Oct 2 16:28:17 OakCottage sshd[28561]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 16:28:18 OakCottage sshd[28561]: Failed password for root from 183.81.169.238 port 49948 ssh2
  ...

• Oct 2 15:28:11 dlcentre3 sshd[7582]: Failed password for root from 183.81.169.238 port 38500 ssh2

• Oct 2 14:27:49 web8 sshd\[14104\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 14:27:51 web8 sshd\[14104\]: Failed password for root from 183.81.169.238 port 47614 ssh2
  Oct 2 14:27:54 web8 sshd\[14139\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 14:27:56 web8 sshd\[14139\]: Failed password for root from 183.81.169.238 port 47626 ssh2
  Oct 2 14:27:59 web8 sshd\[14165\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root

• 2024-10-02T14:26:17.303795+00:00 ubuntu sshd[1496208]: Invalid user Antminer from 183.81.169.238 port 50488
  2024-10-02T14:26:19.273874+00:00 ubuntu sshd[1496210]: Invalid user Antminer from 183.81.169.238 port 50502
  ...

• Oct 2 16:25:58 [redacted] sshd[3464344]: Failed password for [redacted] from 183.81.169.238 port 57404 ssh2
  Oct 2 16:26:01 [redacted] sshd[3464377]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 16:26:03 [redacted] sshd[3464377]: Failed password for [redacted] from 183.81.169.238 port 57428 ssh2
  Oct 2 16:26:06 [redacted] sshd[3464412]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 16:26:08 [redacted] sshd[3464412]: Failed password for [redacted] from 183.81.169.238 port 43876 ssh2
  ...

• Cowrie Honeypot: 10 unauthorised SSH/Telnet login attempts between 2024-10-02T14:25:05Z and 2024-10-02T14:25:37Z

• 2024-10-02T16:25:18.241462+02:00 docker sshd[1711674]: Failed password for root from 183.81.169.238 port 41054 ssh2
  2024-10-02T16:25:21.477855+02:00 docker sshd[1711686]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T16:25:23.555443+02:00 docker sshd[1711686]: Failed password for root from 183.81.169.238 port 41068 ssh2
  2024-10-02T16:25:26.558986+02:00 docker sshd[1711714]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T16:25:28.320584+02:00 docker sshd[1711714]: Failed password for root from 183.81.169.238 port 51328 ssh2
  ...

• 2024-10-02T14:24:16.492615+00:00 deb0 sshd[57274]: Connection closed by authenticating user root 183.81.169.238 port 40256 [preauth]
  ...

• 2024-10-02T16:23:37.098775+02:00 nc1.motyka.pro sshd[1100621]: Failed password for root from 183.81.169.238 port 52908 ssh2
  2024-10-02T16:23:39.132975+02:00 nc1.motyka.pro sshd[1100759]: Failed password for root from 183.81.169.238 port 52936 ssh2
  2024-10-02T16:23:40.626197+02:00 nc1.motyka.pro sshd[1100788]: Failed password for root from 183.81.169.238 port 52944 ssh2
  2024-10-02T16:23:42.349871+02:00 nc1.motyka.pro sshd[1100869]: Failed password for root from 183.81.169.238 port 52950 ssh2
  2024-10-02T16:23:44.534604+02:00 nc1.motyka.pro sshd[1100956]: Failed password for root from 183.81.169.238 port 52962 ssh2
  ...

• Oct 2 16:22:27 summercityrp sshd[1579753]: Failed password for root from 183.81.169.238 port 39982 ssh2
  Oct 2 16:22:30 summercityrp sshd[1579758]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 16:22:33 summercityrp sshd[1579758]: Failed password for root from 183.81.169.238 port 52242 ssh2
  Oct 2 16:22:36 summercityrp sshd[1579763]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 16:22:38 summercityrp sshd[1579763]: Failed password for root from 183.81.169.238 port 52250 ssh2
  Oct 2 16:22:41 summercityrp sshd[1579768]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 16:22:43 summercityrp sshd[1579768]: Failed password for root from 183.81.169.238 port 44712 ssh2
  ...

• Oct 2 14:22:03 cknpih001 sshd[27802]: Failed password for root from 183.81.169.238 port 38412 ssh2
  Oct 2 14:22:07 cknpih001 sshd[27805]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 14:22:09 cknpih001 sshd[27805]: Failed password for root from 183.81.169.238 port 42356 ssh2
  Oct 2 14:22:14 cknpih001 sshd[27807]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 14:22:15 cknpih001 sshd[27807]: Failed password for root from 183.81.169.238 port 42422 ssh2
  ...

• 2024-10-02T14:22:02.153342shield sshd\[21259\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T14:22:03.576832shield sshd\[21259\]: Failed password for root from 183.81.169.238 port 46152 ssh2
  2024-10-02T14:22:05.876017shield sshd\[21269\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T14:22:07.711021shield sshd\[21269\]: Failed password for root from 183.81.169.238 port 35016 ssh2
  2024-10-02T14:22:09.859276shield sshd\[21271\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root

• 2024-10-02T21:21:33.596691+07:00 BAW-C03 sshd[61282]: Failed password for root from 183.81.169.238 port 38704 ssh2
  2024-10-02T21:21:37.976525+07:00 BAW-C03 sshd[61284]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T21:21:40.635015+07:00 BAW-C03 sshd[61284]: Failed password for root from 183.81.169.238 port 59532 ssh2
  2024-10-02T21:21:45.221990+07:00 BAW-C03 sshd[61286]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T21:21:46.977297+07:00 BAW-C03 sshd[61286]: Failed password for root from 183.81.169.238 port 59554 ssh2
  ...

• Oct 2 14:20:15 24fire sshd[191271]: Failed password for root from 183.81.169.238 port 52418 ssh2
  Oct 2 14:20:18 24fire sshd[191273]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 14:20:20 24fire sshd[191273]: Failed password for root from 183.81.169.238 port 34556 ssh2
  Oct 2 14:20:25 24fire sshd[191275]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 14:20:26 24fire sshd[191275]: Failed password for root from 183.81.169.238 port 34570 ssh2
  ...

• Oct 2 14:20:03 nlfr1 sshd[2825915]: Invalid user Antminer from 183.81.169.238 port 40790
  Oct 2 14:20:05 nlfr1 sshd[2826569]: Invalid user Antminer from 183.81.169.238 port 57794
  Oct 2 14:20:14 nlfr1 sshd[2828885]: Invalid user admin from 183.81.169.238 port 57862
  ...

• Security system: Unauthorised SSH/Telnet login attempt with user "root" at 2024-10-02T14:20:12Z

• Oct 2 14:20:00 mlat sshd[3070168]: Failed password for root from 183.81.169.238 port 50476 ssh2
  Oct 2 14:20:02 mlat sshd[3070173]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 14:20:04 mlat sshd[3070173]: Failed password for root from 183.81.169.238 port 50532 ssh2
  ... azuremlat

• Oct 2 16:19:43 vmi174663 sshd[1661328]: Failed password for root from 183.81.169.238 port 60286 ssh2
  Oct 2 16:19:45 vmi174663 sshd[1661375]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 16:19:48 vmi174663 sshd[1661375]: Failed password for root from 183.81.169.238 port 34858 ssh2
  Oct 2 16:19:51 vmi174663 sshd[1661422]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 16:19:52 vmi174663 sshd[1661422]: Failed password for root from 183.81.169.238 port 34892 ssh2
  ...

• Oct 2 16:19:38 amk sshd\[4606\]: Failed password for root from 183.81.169.238 port 34856 ssh2Oct 2 16:19:43 amk sshd\[4608\]: Failed password for root from 183.81.169.238 port 34870 ssh2
  ...

• Oct 2 16:19:13 apo sshd[26586]: Failed password for root from 183.81.169.238 port 36876 ssh2
  Oct 2 16:19:15 apo sshd[26798]: Failed password for root from 183.81.169.238 port 36880 ssh2
  Oct 2 16:19:18 apo sshd[27022]: Failed password for root from 183.81.169.238 port 51934 ssh2
  Oct 2 16:19:21 apo sshd[27024]: Failed password for root from 183.81.169.238 port 51978 ssh2
  ...

• Oct 2 14:18:51 mark sshd[2445697]: Failed password for root from 183.81.169.238 port 35606 ssh2
  Oct 2 14:18:54 mark sshd[2446677]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 14:18:56 mark sshd[2446677]: Failed password for root from 183.81.169.238 port 35614 ssh2
  Oct 2 14:19:01 mark sshd[2447627]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 14:19:03 mark sshd[2447627]: Failed password for root from 183.81.169.238 port 54304 ssh2
  ...

• Oct 2 10:18:47 scp sshd[1920902]: Invalid user Antminer from 183.81.169.238 port 46848
  Oct 2 10:18:49 scp sshd[1920956]: Invalid user Antminer from 183.81.169.238 port 46852
  Oct 2 10:19:04 scp sshd[1921338]: Invalid user admin from 183.81.169.238 port 43058
  ...

• Oct 2 17:18:39 localhost sshd[1287493]: Failed password for root from 183.81.169.238 port 56802 ssh2
  Oct 2 17:18:42 localhost sshd[1287499]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 17:18:44 localhost sshd[1287499]: Failed password for root from 183.81.169.238 port 56808 ssh2
  Oct 2 17:18:47 localhost sshd[1287506]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 17:18:49 localhost sshd[1287506]: Failed password for root from 183.81.169.238 port 38860 ssh2
  ...

• Oct 2 14:18:30 ovh-docker-001 sshd[3302498]: Failed password for root from 183.81.169.238 port 59888 ssh2
  Oct 2 14:18:33 ovh-docker-001 sshd[3302608]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 14:18:35 ovh-docker-001 sshd[3302608]: Failed password for root from 183.81.169.238 port 59914 ssh2
  Oct 2 14:18:39 ovh-docker-001 sshd[3302777]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 14:18:41 ovh-docker-001 sshd[3302777]: Failed password for root from 183.81.169.238 port 45914 ssh2
  ...

• Oct 2 16:18:33 de-kae sshd[3471326]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 16:18:36 de-kae sshd[3471326]: Failed password for root from 183.81.169.238 port 56376 ssh2
  ...

• 2024-10-02T09:17:51.234109-05:00 instance-20240522-152753 sshd[2484770]: Invalid user Antminer from 183.81.169.238 port 42224
  2024-10-02T09:17:53.630006-05:00 instance-20240522-152753 sshd[2484772]: Invalid user Antminer from 183.81.169.238 port 42250
  2024-10-02T09:18:07.966056-05:00 instance-20240522-152753 sshd[2484801]: Invalid user admin from 183.81.169.238 port 53058
  2024-10-02T09:18:09.886495-05:00 instance-20240522-152753 sshd[2484803]: Invalid user baikal from 183.81.169.238 port 53078
  ...

• Oct 2 14:17:08 DuoX sshd[994002]: Failed password for root from 183.81.169.238 port 43424 ssh2
  Oct 2 14:17:12 DuoX sshd[996233]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 14:17:15 DuoX sshd[996233]: Failed password for root from 183.81.169.238 port 60002 ssh2
  Oct 2 14:17:19 DuoX sshd[998418]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 14:17:21 DuoX sshd[998418]: Failed password for root from 183.81.169.238 port 44346 ssh2
  ...

• 2024-10-02T14:16:54.282302+00:00 fluff sshd[77525]: Failed password for root from 183.81.169.238 port 51726 ssh2
  2024-10-02T14:16:59.232309+00:00 fluff sshd[77527]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T14:17:01.058119+00:00 fluff sshd[77527]: Failed password for root from 183.81.169.238 port 37646 ssh2
  2024-10-02T14:17:03.866097+00:00 fluff sshd[77535]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T14:17:06.243509+00:00 fluff sshd[77535]: Failed password for root from 183.81.169.238 port 37732 ssh2
  ...

• FW-PortScan: Traffic Blocked srcport=45996 dstport=22

• 2024-10-02T14:13:48.981252+00:00 Linux04 sshd[188495]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T14:13:50.921433+00:00 Linux04 sshd[188495]: Failed password for root from 183.81.169.238 port 53476 ssh2
  2024-10-02T14:13:53.145792+00:00 Linux04 sshd[188759]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T14:13:55.437694+00:00 Linux04 sshd[188759]: Failed password for root from 183.81.169.238 port 53484 ssh2
  2024-10-02T14:13:59.915479+00:00 Linux04 sshd[189070]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T14:14:02.032000+00:00 Linux04 sshd[189070]: Failed password for root from 183.81.169.238 port 41558 ssh2
  2024-10-02T14:14:06.657762+00:00 Linux04 sshd[189410]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=18
  ...

• Oct 2 10:13:27 thebatforge sshd[404013]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 10:13:29 thebatforge sshd[404016]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 10:13:31 thebatforge sshd[404020]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 10:13:33 thebatforge sshd[404022]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 10:13:35 thebatforge sshd[404024]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  ...

• Oct 2 16:10:56 unifi sshd[741744]: Failed password for root from 183.81.169.238 port 54646 ssh2
  Oct 2 16:11:00 unifi sshd[741746]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 16:11:02 unifi sshd[741746]: Failed password for root from 183.81.169.238 port 33004 ssh2
  Oct 2 16:11:05 unifi sshd[741751]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 16:11:07 unifi sshd[741751]: Failed password for root from 183.81.169.238 port 49206 ssh2
  ...

• 2024-10-02T17:10:10.674113+03:00 mummo sshd[1884263]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T17:10:12.684523+03:00 mummo sshd[1884263]: Failed password for root from 183.81.169.238 port 55198 ssh2
  ...

• Oct 2 16:10:02 odin sshd[28010]: Failed password for root from 183.81.169.238 port 39842 ssh2
  Oct 2 16:10:06 odin sshd[28170]: Failed password for root from 183.81.169.238 port 39854 ssh2

• 2024-10-02T16:08:44.492736+02:00 mail sshd[472691]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-02T16:08:46.780426+02:00 mail sshd[472693]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-02T16:08:49.348621+02:00 mail sshd[472695]: User root from 183.81.169.238 not allowed because not listed in AllowUsers

• Unauthorized attempt on (TCP on port 22).
  Source port: 46874
  TTL: 247
  Packet length: 40
  Timestamp: 2024-10-02 16:08:32

• Oct 2 17:07:51 www sshd\[53716\]: Failed password for root from 183.81.169.238 port 47702 ssh2Oct 2 17:07:55 www sshd\[53718\]: Failed password for root from 183.81.169.238 port 47708 ssh2Oct 2 17:08:00 www sshd\[53720\]: Failed password for root from 183.81.169.238 port 57330 ssh2
  ...

• Oct 2 16:07:16 hosting09 sshd[318960]: Failed password for root from 183.81.169.238 port 43672 ssh2
  Oct 2 16:07:18 hosting09 sshd[318998]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 16:07:20 hosting09 sshd[318998]: Failed password for root from 183.81.169.238 port 36374 ssh2
  ...

• Oct 2 16:06:02 m2369 sshd[644842]: Failed password for root from 183.81.169.238 port 58486 ssh2
  Oct 2 16:06:05 m2369 sshd[644878]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 16:06:07 m2369 sshd[644878]: Failed password for root from 183.81.169.238 port 58506 ssh2
  Oct 2 16:06:09 m2369 sshd[644880]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 16:06:11 m2369 sshd[644880]: Failed password for root from 183.81.169.238 port 57682 ssh2
  ...

• 2024-10-02T22:04:19.854148+08:00 raindance sshd[254063]: Failed password for root from 183.81.169.238 port 60034 ssh2
  2024-10-02T22:04:23.274704+08:00 raindance sshd[254065]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T22:04:25.652308+08:00 raindance sshd[254065]: Failed password for root from 183.81.169.238 port 60066 ssh2
  2024-10-02T22:04:30.614193+08:00 raindance sshd[254068]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T22:04:32.284437+08:00 raindance sshd[254068]: Failed password for root from 183.81.169.238 port 46360 ssh2
  ...

• Oct 2 16:04:00 endernation sshd[2896421]: Failed password for root from 183.81.169.238 port 45834 ssh2
  Oct 2 16:04:04 endernation sshd[2896592]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 16:04:06 endernation sshd[2896592]: Failed password for root from 183.81.169.238 port 45872 ssh2
  ...

• Oct 2 14:03:45 edge-ora-lhr01 sshd[1120633]: Invalid user Antminer from 183.81.169.238 port 50918
  Oct 2 14:03:47 edge-ora-lhr01 sshd[1120635]: Invalid user Antminer from 183.81.169.238 port 50946
  Oct 2 14:03:58 edge-ora-lhr01 sshd[1120647]: Invalid user admin from 183.81.169.238 port 51496
  ...

• tcp/22 (23 or more attempts)

• SSH Authentication Brute Force Attempt

• Oct 2 16:01:00 vps643776 sshd[1271913]: Failed password for root from 183.81.169.238 port 52822 ssh2
  Oct 2 16:01:02 vps643776 sshd[1271915]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 16:01:04 vps643776 sshd[1271915]: Failed password for root from 183.81.169.238 port 52850 ssh2
  Oct 2 16:01:09 vps643776 sshd[1271917]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 16:01:11 vps643776 sshd[1271917]: Failed password for root from 183.81.169.238 port 37242 ssh2
  ...

• Ports: 22

• FW-PortScan: Traffic Blocked srcport=48708 dstport=22

• Inteceptor Intrusion Detector: failed_password on sshd module PID: (1362645)

• Oct 2 17:00:10 server2 sshd\[18973\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 17:00:12 server2 sshd\[18975\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 17:00:14 server2 sshd\[18977\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 17:00:15 server2 sshd\[18984\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 17:00:17 server2 sshd\[18986\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 17:00:18 server2 sshd\[18990\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers

• Oct 2 15:59:57 AbuseCatcher sshd[4094581]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 15:59:59 AbuseCatcher sshd[4094581]: Failed password for root from 183.81.169.238 port 58372 ssh2
  ...

• Oct 2 15:59:38 athena sshd[803035]: Failed password for root from 183.81.169.238 port 45422 ssh2
  Oct 2 15:59:42 athena sshd[803037]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 15:59:44 athena sshd[803037]: Failed password for root from 183.81.169.238 port 56960 ssh2
  Oct 2 15:59:46 athena sshd[803039]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 15:59:48 athena sshd[803039]: Failed password for root from 183.81.169.238 port 49402 ssh2
  ...

• 2024-10-02T15:59:19.034221+02:00 srv1 sshd[2261788]: Failed password for root from 183.81.169.238 port 46182 ssh2
  2024-10-02T15:59:23.665075+02:00 srv1 sshd[2261889]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T15:59:26.188037+02:00 srv1 sshd[2261889]: Failed password for root from 183.81.169.238 port 46196 ssh2
  2024-10-02T15:59:30.669274+02:00 srv1 sshd[2261893]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T15:59:32.820762+02:00 srv1 sshd[2261893]: Failed password for root from 183.81.169.238 port 43052 ssh2
  ...

• Oct 2 17:29:26 Digitalogic sshd[1147934]: Connection closed by authenticating user root 183.81.169.238 port 41350 [preauth]
  Oct 2 17:29:29 Digitalogic sshd[1147961]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 17:29:31 Digitalogic sshd[1147961]: Failed password for root from 183.81.169.238 port 57158 ssh2
  ...

• Oct 2 15:59:24 C1D543E sshd[761682]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 15:59:24 C1D543E sshd[761682]: Failed password for invalid user root from 183.81.169.238 port 37978 ssh2
  Oct 2 15:59:26 C1D543E sshd[761684]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 15:59:26 C1D543E sshd[761684]: Failed password for invalid user root from 183.81.169.238 port 46050 ssh2
  Oct 2 15:59:28 C1D543E sshd[761686]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  ...

• Oct 2 07:57:43 mortgagebase sshd[6111]: Failed password for root from 183.81.169.238 port 49648 ssh2
  Oct 2 07:57:47 mortgagebase sshd[6113]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 07:57:49 mortgagebase sshd[6113]: Failed password for root from 183.81.169.238 port 35690 ssh2
  Oct 2 07:57:54 mortgagebase sshd[6115]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 07:57:55 mortgagebase sshd[6115]: Failed password for root from 183.81.169.238 port 35744 ssh2
  ...

• 2024-10-02T15:57:31.229470+02:00 srv2 sshd[1562820]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T15:57:33.044377+02:00 srv2 sshd[1562820]: Failed password for root from 183.81.169.238 port 57590 ssh2
  ...

• 2024-10-02T15:57:19.216825 frenzy sshd[12720]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T15:57:20.716673 frenzy sshd[12720]: Failed password for root from 183.81.169.238 port 37676 ssh2
  2024-10-02T15:57:24.424912 frenzy sshd[12723]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T15:57:26.280662 frenzy sshd[12723]: Failed password for root from 183.81.169.238 port 37698 ssh2
  ...

• Oct 2 15:54:19 MedellinCityRPS1 sshd[1860153]: Failed password for root from 183.81.169.238 port 34788 ssh2
  Oct 2 15:54:22 MedellinCityRPS1 sshd[1860158]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 15:54:24 MedellinCityRPS1 sshd[1860158]: Failed password for root from 183.81.169.238 port 52670 ssh2
  Oct 2 15:54:27 MedellinCityRPS1 sshd[1860164]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 15:54:29 MedellinCityRPS1 sshd[1860164]: Failed password for root from 183.81.169.238 port 52684 ssh2
  Oct 2 15:54:32 MedellinCityRPS1 sshd[1860169]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 15:54:34 MedellinCityRPS1 sshd[1860169]: Failed password for root from 183.81.169.238 port 53484 ssh2
  ...

• [13:55] Attempted SSH login on port 22 with credentials root:0

• Oct 2 06:54:44 LU-VPS01 sshd[1836]: Failed password for root from 183.81.169.238 port 37812 ssh2
  Oct 2 06:54:49 LU-VPS01 sshd[1842]: Failed password for root from 183.81.169.238 port 39666 ssh2
  ...

• PBK Oct 2 15:54:17 websrv01 sshd[1196728]: Failed password for root from 183.81.169.238 port 47346 ssh2
  Oct 2 15:54:20 websrv01 sshd[1196730]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 15:54:22 websrv01 sshd[1196730]: Failed password for root from 183.81.169.238 port 47368 ssh2
  Oct 2 15:54:26 websrv01 sshd[1196732]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 15:54:28 websrv01 sshd[1196732]: Failed password for root from 183.81.169.238 port 54962 ssh2

• Oct 2 13:53:44 vps-9 sshd[889169]: Failed password for root from 183.81.169.238 port 40382 ssh2
  Oct 2 13:53:47 vps-9 sshd[889171]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 13:53:49 vps-9 sshd[889171]: Failed password for root from 183.81.169.238 port 48620 ssh2
  ...

• (sshd) Failed SSH login from 183.81.169.238 (MN/Mongolia/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Oct 2 09:52:31 server5 sshd[21972]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 09:52:33 server5 sshd[21972]: Failed password for root from 183.81.169.238 port 59618 ssh2
  Oct 2 09:52:36 server5 sshd[21985]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 09:52:38 server5 sshd[21985]: Failed password for root from 183.81.169.238 port 42650 ssh2
  Oct 2 09:52:41 server5 sshd[21991]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root

• Oct 2 15:52:06 root1896 sshd[1881460]: Failed password for root from 183.81.169.238 port 43730 ssh2
  Oct 2 15:52:09 root1896 sshd[1881495]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 15:52:11 root1896 sshd[1881495]: Failed password for root from 183.81.169.238 port 50588 ssh2
  Oct 2 15:52:13 root1896 sshd[1881524]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 15:52:15 root1896 sshd[1881524]: Failed password for root from 183.81.169.238 port 50602 ssh2
  ...

• 2024-10-02T14:52:02.891552+01:00 jane sshd[3129259]: Failed password for root from 183.81.169.238 port 55048 ssh2
  2024-10-02T14:52:05.129441+01:00 jane sshd[3129422]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T14:52:07.190638+01:00 jane sshd[3129422]: Failed password for root from 183.81.169.238 port 55076 ssh2
  ...

• [rede-168-134] 10/02/2024-10:51:42.806629, 183.81.169.238, Protocol: 6, ET COMPROMISED Known Compromised or Hostile Host Traffic group 13

• Oct 2 09:48:54 fremontnet-scca-01 sshd[12488]: Failed password for root from 183.81.169.238 port 43778 ssh2
  Oct 2 09:48:59 fremontnet-scca-01 sshd[12490]: Failed password for root from 183.81.169.238 port 57698 ssh2

• Oct 2 15:48:19 javastart sshd[3908342]: Failed password for root from 183.81.169.238 port 32924 ssh2
  Oct 2 15:48:22 javastart sshd[3908344]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 15:48:24 javastart sshd[3908344]: Failed password for root from 183.81.169.238 port 32938 ssh2
  Oct 2 15:48:28 javastart sshd[3908362]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 15:48:30 javastart sshd[3908362]: Failed password for root from 183.81.169.238 port 33496 ssh2
  ...

• 2024-10-02T13:47:46.879552+00:00 minio-fra-01.pdx.net.uk sshd[149536]: Invalid user Antminer from 183.81.169.238 port 36814
  2024-10-02T13:47:48.767275+00:00 minio-fra-01.pdx.net.uk sshd[149538]: Invalid user Antminer from 183.81.169.238 port 36828
  2024-10-02T13:47:59.267412+00:00 minio-fra-01.pdx.net.uk sshd[149550]: Invalid user admin from 183.81.169.238 port 47100
  ...

• 2024-10-02T13:30:11.519032+00:00 Linux02 sshd[2326653]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T13:30:13.524770+00:00 Linux02 sshd[2326653]: Failed password for root from 183.81.169.238 port 43504 ssh2
  2024-10-02T13:30:17.029502+00:00 Linux02 sshd[2326897]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T13:30:19.190741+00:00 Linux02 sshd[2326897]: Failed password for root from 183.81.169.238 port 36648 ssh2
  2024-10-02T13:30:22.513873+00:00 Linux02 sshd[2327174]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T13:30:24.694908+00:00 Linux02 sshd[2327174]: Failed password for root from 183.81.169.238 port 36700 ssh2
  2024-10-02T13:30:27.342229+00:00 Linux02 sshd[2327518]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= r
  ...

• Oct 2 13:43:48 webserver sshd[737027]: Failed password for root from 183.81.169.238 port 58752 ssh2
  Oct 2 13:43:50 webserver sshd[737029]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 13:43:52 webserver sshd[737029]: Failed password for root from 183.81.169.238 port 58774 ssh2
  Oct 2 13:43:56 webserver sshd[737031]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 13:43:58 webserver sshd[737031]: Failed password for root from 183.81.169.238 port 45226 ssh2
  ...

• Oct 2 15:43:38 markkoudstaal sshd[2681241]: Failed password for root from 183.81.169.238 port 53992 ssh2
  Oct 2 15:43:41 markkoudstaal sshd[2681245]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 15:43:43 markkoudstaal sshd[2681245]: Failed password for root from 183.81.169.238 port 54002 ssh2
  ...

• 2024-10-02 08:43:29,844 fail2ban.actions [974]: NOTICE [sshd] Ban 183.81.169.238

• 2024-10-02T09:43:08.963692-04:00 nova3 sshd[1416665]: Failed password for root from 183.81.169.238 port 40372 ssh2
  2024-10-02T09:43:12.533877-04:00 nova3 sshd[1416722]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T09:43:14.755417-04:00 nova3 sshd[1416722]: Failed password for root from 183.81.169.238 port 40408 ssh2
  2024-10-02T09:43:17.254764-04:00 nova3 sshd[1416782]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T09:43:19.165234-04:00 nova3 sshd[1416782]: Failed password for root from 183.81.169.238 port 40400 ssh2
  ...

• 2024-10-02T09:40:43.520881-04:00 collabhost.computernewb.com sshd-session[3648113]: Invalid user Antminer from 183.81.169.238 port 56308
  2024-10-02T09:40:45.046976-04:00 collabhost.computernewb.com sshd-session[3648116]: Invalid user Antminer from 183.81.169.238 port 40632
  2024-10-02T09:40:57.109665-04:00 collabhost.computernewb.com sshd-session[3648141]: Invalid user admin from 183.81.169.238 port 60646
  ...

• Oct 2 15:40:15 ts-24 sshd[358392]: Failed password for root from 183.81.169.238 port 54046 ssh2
  Oct 2 15:40:19 ts-24 sshd[358395]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 15:40:20 ts-24 sshd[358395]: Failed password for root from 183.81.169.238 port 53198 ssh2
  Oct 2 15:40:24 ts-24 sshd[358397]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 15:40:26 ts-24 sshd[358397]: Failed password for root from 183.81.169.238 port 53218 ssh2
  ...

• Oct 2 13:39:36 lavalink sshd[3135720]: Invalid user Antminer from 183.81.169.238 port 40430
  Oct 2 13:39:38 lavalink sshd[3135728]: Invalid user Antminer from 183.81.169.238 port 40446
  Oct 2 13:39:50 lavalink sshd[3135789]: Invalid user admin from 183.81.169.238 port 36414
  ...

• Oct 2 16:39:16 community sshd[1451611]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 16:39:17 community sshd[1451611]: Failed password for root from 183.81.169.238 port 57264 ssh2
  ...

• Oct 2 15:36:57 hiena sshd[2734101]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 15:36:59 hiena sshd[2734101]: Failed password for root from 183.81.169.238 port 51806 ssh2
  Oct 2 15:37:02 hiena sshd[2734103]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 15:37:04 hiena sshd[2734103]: Failed password for root from 183.81.169.238 port 51868 ssh2
  ...

• 2024-10-02T06:37:49.624789-07:00 panduhstudios sshd[2781020]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T06:37:51.168846-07:00 panduhstudios sshd[2781020]: Failed password for root from 183.81.169.238 port 43802 ssh2
  2024-10-02T06:37:54.813052-07:00 panduhstudios sshd[2781026]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T06:37:57.380847-07:00 panduhstudios sshd[2781026]: Failed password for root from 183.81.169.238 port 43808 ssh2
  ...

• Oct 2 13:37:16 proxy sshd[1578926]: Invalid user Antminer from 183.81.169.238 port 35604
  ...

• 2024-10-02T13:36:44.879657+00:00 mapir-proxmox sshd[991281]: Failed password for root from 183.81.169.238 port 38504 ssh2
  2024-10-02T13:36:49.240446+00:00 mapir-proxmox sshd[992049]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T13:36:50.549195+00:00 mapir-proxmox sshd[992049]: Failed password for root from 183.81.169.238 port 48564 ssh2
  ...

• I1002 15:36:32.623528 1 client.go:99] CLOSE host=183.81.169.238 port=34924 time=102.253104685 bytes=282
  ...

• Oct 2 12:40:25 alertalicitacao sshd[4138193]: Invalid user baikal from 183.81.169.238 port 55628
  Oct 2 13:35:59 alertalicitacao sshd[4148805]: Invalid user Antminer from 183.81.169.238 port 43432
  Oct 2 13:36:02 alertalicitacao sshd[4148815]: Invalid user Antminer from 183.81.169.238 port 43440
  Oct 2 13:36:16 alertalicitacao sshd[4148911]: Invalid user admin from 183.81.169.238 port 42044
  Oct 2 13:36:19 alertalicitacao sshd[4148927]: Invalid user baikal from 183.81.169.238 port 42076
  ...

• Oct 2 09:35:35 us-mfl-02 sshd[3876975]: Invalid user Antminer from 183.81.169.238 port 43088
  ...

• Oct 2 20:35:24 honeypot sshd[28640]: Failed password for root from 183.81.169.238 port 47934 ssh2
  ...

• Hacker syslog review 1727876063

• 2024-10-02T13:33:30.703042+00:00 localhost sshd[2161537]: Connection closed by authenticating user root 183.81.169.238 port 35106 [preauth]
  2024-10-02T13:33:32.783322+00:00 localhost sshd[2161560]: Connection closed by authenticating user root 183.81.169.238 port 35130 [preauth]
  2024-10-02T13:33:35.106249+00:00 localhost sshd[2161562]: Connection closed by authenticating user root 183.81.169.238 port 35142 [preauth]
  2024-10-02T13:33:37.163649+00:00 localhost sshd[2161565]: Connection closed by authenticating user root 183.81.169.238 port 45090 [preauth]
  2024-10-02T13:33:39.073431+00:00 localhost sshd[2161568]: Connection closed by authenticating user root 183.81.169.238 port 45114 [preauth]
  ...

• Oct 2 15:32:53 ifog sshd[78267]: Invalid user Antminer from 183.81.169.238 port 42424
  Oct 2 15:32:54 ifog sshd[78269]: Invalid user Antminer from 183.81.169.238 port 55304
  Oct 2 15:33:03 ifog sshd[78281]: Invalid user admin from 183.81.169.238 port 55422
  ...

• FW-PortScan: Traffic Blocked srcport=36560 dstport=22

• Oct 2 15:31:21 vmi147057 sshd[725076]: Failed password for root from 183.81.169.238 port 56102 ssh2
  Oct 2 15:31:25 vmi147057 sshd[725097]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 15:31:27 vmi147057 sshd[725097]: Failed password for root from 183.81.169.238 port 56118 ssh2
  Oct 2 15:31:29 vmi147057 sshd[725117]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 15:31:31 vmi147057 sshd[725117]: Failed password for root from 183.81.169.238 port 39288 ssh2
  ...

• 183.81.169.238 (183.81.169.238) - SSH Brute force:
  Oct 2 16:30:44 XWEB sshd[4501]: Failed password for root from 183.81.169.238 port 36586 ssh2
  Oct 2 16:30:47 XWEB sshd[4503]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 16:30:49 XWEB sshd[4503]: Failed password for root from 183.81.169.238 port 45016 ssh2
  ...

• Oct 2 13:30:25 s158416 sshd[2310282]: Failed password for root from 183.81.169.238 port 45684 ssh2
  Oct 2 13:30:29 s158416 sshd[2310312]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 13:30:31 s158416 sshd[2310312]: Failed password for root from 183.81.169.238 port 49534 ssh2
  Oct 2 13:30:34 s158416 sshd[2310314]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 13:30:36 s158416 sshd[2310314]: Failed password for root from 183.81.169.238 port 49554 ssh2
  ...

• Oct 2 14:29:27 s1-jellyfish sshd[447134]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 14:29:29 s1-jellyfish sshd[447134]: Failed password for root from 183.81.169.238 port 41432 ssh2
  ...

• Oct 2 13:28:27 ice1 sshd[3539907]: Invalid user Antminer from 183.81.169.238 port 34816
  Oct 2 13:28:29 ice1 sshd[3539909]: Invalid user Antminer from 183.81.169.238 port 34830
  ...

• Unauthorized connection attempt detected from IP address 183.81.169.238 to port 22 (ger-03) [j]

• Oct 2 13:24:37 alpha sshd[2037155]: Failed password for root from 183.81.169.238 port 44640 ssh2
  Oct 2 13:24:38 alpha sshd[2037214]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 13:24:40 alpha sshd[2037214]: Failed password for root from 183.81.169.238 port 44832 ssh2
  Oct 2 13:24:42 alpha sshd[2037232]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 13:24:44 alpha sshd[2037232]: Failed password for root from 183.81.169.238 port 44876 ssh2
  ...

• Oct 2 12:55:18 mk-bgp sshd[2576527]: Invalid user Antminer from 183.81.169.238 port 37520
  Oct 2 12:55:20 mk-bgp sshd[2576529]: Invalid user Antminer from 183.81.169.238 port 37554
  Oct 2 13:24:31 mk-bgp sshd[2576598]: Invalid user Antminer from 183.81.169.238 port 47590
  Oct 2 13:24:32 mk-bgp sshd[2576600]: Invalid user Antminer from 183.81.169.238 port 47604
  Oct 2 13:24:39 mk-bgp sshd[2576612]: Invalid user admin from 183.81.169.238 port 42672
  ...

• Oct 2 15:21:12 LuxCars sshd[1215194]: Failed password for root from 183.81.169.238 port 54994 ssh2
  Oct 2 15:21:13 LuxCars sshd[1215196]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 15:21:15 LuxCars sshd[1215196]: Failed password for root from 183.81.169.238 port 43506 ssh2
  Oct 2 15:21:18 LuxCars sshd[1215198]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 15:21:20 LuxCars sshd[1215198]: Failed password for root from 183.81.169.238 port 43520 ssh2
  Oct 2 15:21:22 LuxCars sshd[1215200]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 15:21:24 LuxCars sshd[1215200]: Failed password for root from 183.81.169.238 port 58818 ssh2
  ...

• 2024-10-02T15:20:06.467469 prodgateway sshd[57539]: Failed password for root from 183.81.169.238 port 33014 ssh2
  2024-10-02T15:20:09.255209 prodgateway sshd[57543]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T15:20:11.282208 prodgateway sshd[57543]: Failed password for root from 183.81.169.238 port 60156 ssh2
  ...

• Failed password for root from 183.81.169.238 port 45442 ssh2
  pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Failed password for root from 183.81.169.238 port 45460 ssh2
  pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Failed password for root from 183.81.169.238 port 45472 ssh2

• 2024-10-02T15:19:25.636606online4.bobelweb.eu sshd[9514]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-02T15:19:26.278213online4.bobelweb.eu sshd[9516]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-02T15:19:27.343615online4.bobelweb.eu sshd[9518]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-02T15:19:27.994353online4.bobelweb.eu sshd[9520]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  2024-10-02T15:19:28.576099online4.bobelweb.eu sshd[9522]: User root from 183.81.169.238 not allowed because not listed in AllowUsers

• Oct 2 21:15:34 pve-hkg1 sshd[205922]: Failed password for root from 183.81.169.238 port 37560 ssh2
  Oct 2 21:15:38 pve-hkg1 sshd[206025]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 21:15:40 pve-hkg1 sshd[206025]: Failed password for root from 183.81.169.238 port 41682 ssh2
  Oct 2 21:15:44 pve-hkg1 sshd[206160]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 21:15:46 pve-hkg1 sshd[206160]: Failed password for root from 183.81.169.238 port 41692 ssh2
  ...

• Oct 2 13:15:04 ovh sshd[2929387]: Failed password for root from 183.81.169.238 port 58570 ssh2
  Oct 2 13:15:05 ovh sshd[2929412]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 13:15:06 ovh sshd[2929412]: Failed password for root from 183.81.169.238 port 44334 ssh2
  Oct 2 13:15:08 ovh sshd[2929435]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 13:15:10 ovh sshd[2929435]: Failed password for root from 183.81.169.238 port 44350 ssh2
  ...

• Oct 2 11:20:18 ubuntu sshd[752939]: Invalid user Antminer from 183.81.169.238 port 52854
  Oct 2 13:14:26 ubuntu sshd[819128]: Invalid user Antminer from 183.81.169.238 port 49192
  Oct 2 13:14:27 ubuntu sshd[819144]: Invalid user Antminer from 183.81.169.238 port 49212
  ...

• FW-PortScan: Traffic Blocked srcport=35526 dstport=22

• Oct 2 13:12:17 fedi sshd[3632637]: Invalid user Antminer from 183.81.169.238 port 54842
  Oct 2 13:12:17 fedi sshd[3632639]: Invalid user Antminer from 183.81.169.238 port 54856
  ...

• Oct 2 09:12:06 us-mfl-01 sshd[3345813]: Invalid user Antminer from 183.81.169.238 port 54532
  ...

• Oct 2 15:09:24 monitor sshd[3772886]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 15:09:28 monitor sshd[3772888]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 15:09:32 monitor sshd[3772890]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 15:09:36 monitor sshd[3772892]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 15:09:38 monitor sshd[3772894]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  ...

• Oct 2 16:08:36 server2 sshd\[14128\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 16:08:36 server2 sshd\[14130\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 16:08:36 server2 sshd\[14132\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 16:08:36 server2 sshd\[14134\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 16:08:36 server2 sshd\[14136\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers
  Oct 2 16:08:36 server2 sshd\[14138\]: User root from 183.81.169.238 not allowed because not listed in AllowUsers

• Inteceptor Intrusion Detector: failed_password on sshd module PID: (939706)

• unauthorized connection with user "root" and password "0" at 2024-10-02T13:08:01Z

• Oct 2 15:07:51 ns sshd[18277]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 15:07:53 ns sshd[18277]: Failed password for root from 183.81.169.238 port 57686 ssh2
  ...

• Oct 2 15:07:46 AbuseCatcher sshd[4088984]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 15:07:48 AbuseCatcher sshd[4088984]: Failed password for root from 183.81.169.238 port 37640 ssh2
  ...

• 2024-10-02T13:07:29.460580us1.starnode.us sshd[1054791]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T13:07:31.484965us1.starnode.us sshd[1054791]: Failed password for root from 183.81.169.238 port 56542 ssh2
  ...

• Oct 2 04:07:07 alpha-ef21b5050c sshd[1013114]: Invalid user Antminer from 183.81.169.238 port 44584
  ...

• Oct 2 13:05:21 mysql sshd[219443]: Failed password for root from 183.81.169.238 port 46654 ssh2
  Oct 2 13:05:22 mysql sshd[219445]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 13:05:25 mysql sshd[219445]: Failed password for root from 183.81.169.238 port 46666 ssh2
  Oct 2 13:05:26 mysql sshd[219447]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 13:05:28 mysql sshd[219447]: Failed password for root from 183.81.169.238 port 55588 ssh2
  ...

• Oct 2 15:04:58 Ina sshd[1780417]: Failed password for root from 183.81.169.238 port 53160 ssh2
  Oct 2 15:05:00 Ina sshd[1780419]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 15:05:02 Ina sshd[1780419]: Failed password for root from 183.81.169.238 port 53168 ssh2
  Oct 2 15:05:05 Ina sshd[1780443]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 15:05:06 Ina sshd[1780443]: Failed password for root from 183.81.169.238 port 54460 ssh2
  ...

• Oct 2 14:04:59 dev sshd[59713]: Failed password for root from 183.81.169.238 port 51568 ssh2
  Oct 2 14:05:00 dev sshd[59717]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 14:05:01 dev sshd[59717]: Failed password for root from 183.81.169.238 port 51570 ssh2
  Oct 2 14:05:02 dev sshd[59719]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 14:05:04 dev sshd[59719]: Failed password for root from 183.81.169.238 port 51598 ssh2
  ...

• 2024-10-02T09:04:25.371868-04:00 srv-UXQS4A.incognet.io sshd[929]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T09:04:27.804875-04:00 srv-UXQS4A.incognet.io sshd[929]: Failed password for invalid user root from 183.81.169.238 port 40634 ssh2
  ...

• 2024-10-02T09:03:42.133840-04:00 prod-1 sshd[3342344]: Connection closed by authenticating user root 183.81.169.238 port 58300 [preauth]
  2024-10-02T09:03:42.807048-04:00 prod-1 sshd[3342346]: Connection closed by authenticating user root 183.81.169.238 port 58314 [preauth]
  2024-10-02T09:03:43.320119-04:00 prod-1 sshd[3342348]: Connection closed by authenticating user root 183.81.169.238 port 58326 [preauth]
  2024-10-02T09:03:43.992849-04:00 prod-1 sshd[3342357]: Connection closed by authenticating user root 183.81.169.238 port 58344 [preauth]
  2024-10-02T09:03:44.632092-04:00 prod-1 sshd[3342359]: Connection closed by authenticating user root 183.81.169.238 port 47836 [preauth]
  ...

• tcp/22 (30 or more attempts)

• Detected 6 distributed attacks from 183.81.169.238. LF_DISTATTACK; Logs: 2024-10-02T14:38:27.901770+02:00 insightVM sshd[3253307]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root 2024-10-02T14:38:30.114283+02:00 insightVM sshd[3253307]: Failed password for root from 183.81.169.238 port 43096 ssh2 2024-10-02T14:38:23.537299+02:00 insightVM sshd[3253289]: Failed password for root from 183.81.169.238 port 60054 ssh2 2024-10-02T14:38:32.000069+02:00 insightVM sshd[3253324]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root 2024-10-02T14:38:21.150186+02:00 insightVM sshd[3253289]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root 183.81.169.238 (NL/The Netherlands/North Holland/Amsterdam/-/[AS206264 Amarutu Technology Ltd])

• Oct 2 15:02:26 ns41 sshd[6140]: Failed password for root from 183.81.169.238 port 60954 ssh2
  Oct 2 15:02:30 ns41 sshd[6146]: Failed password for root from 183.81.169.238 port 60984 ssh2
  ...

• 10493 attempts since 14.07.2024 04:18:57 UTC - last one: 2024-10-02T13:54:40.736613+02:00 alpha sshd[2334887]: Connection closed by invalid user baikal 183.81.169.238 port 57532 [preauth]

• Unsolicited connection attempt(s), port:22.

• Oct 2 14:59:23 vmi174663 sshd[1618893]: Failed password for root from 183.81.169.238 port 48474 ssh2
  Oct 2 14:59:26 vmi174663 sshd[1618928]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 14:59:28 vmi174663 sshd[1618928]: Failed password for root from 183.81.169.238 port 46992 ssh2
  Oct 2 14:59:31 vmi174663 sshd[1618959]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 14:59:33 vmi174663 sshd[1618959]: Failed password for root from 183.81.169.238 port 46994 ssh2
  ...

• Oct 2 14:59:27 vmd80284 sshd[972567]: Invalid user Antminer from 183.81.169.238 port 42882
  ...

• Invalid user Antminer from 183.81.169.238 port 41434

• Invalid user Antminer from 183.81.169.238 port 37252

• 2024-10-02T12:57:40.705109+00:00 BAW-C01 sshd-session[382741]: Failed password for root from 183.81.169.238 port 44014 ssh2
  2024-10-02T12:57:44.643411+00:00 BAW-C01 sshd-session[382767]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T12:57:46.425160+00:00 BAW-C01 sshd-session[382767]: Failed password for root from 183.81.169.238 port 44046 ssh2
  2024-10-02T12:57:50.063305+00:00 BAW-C01 sshd-session[382770]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  2024-10-02T12:57:52.402710+00:00 BAW-C01 sshd-session[382770]: Failed password for root from 183.81.169.238 port 60100 ssh2
  ...

• Oct 2 12:57:39 localhost sshd[2295027]: Failed password for root from 183.81.169.238 port 41660 ssh2
  Oct 2 12:57:44 localhost sshd[2295031]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 12:57:45 localhost sshd[2295031]: Failed password for root from 183.81.169.238 port 41726 ssh2
  Oct 2 12:57:50 localhost sshd[2295033]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 12:57:52 localhost sshd[2295033]: Failed password for root from 183.81.169.238 port 40186 ssh2
  ...

• Oct 2 14:57:43 v4940 sshd[3858456]: Failed password for root from 183.81.169.238 port 60212 ssh2
  Oct 2 14:57:46 v4940 sshd[3858476]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.81.169.238 user=root
  Oct 2 14:57:48 v4940 sshd[3858476]: Failed password for root from 183.81.169.238 port 49120 ssh2
  ...