>> The details of the abuse-complaint are as follows:
>>
>> 89.37.193.207: *2025-10-20 04:26*.*Categories:* Brute-Force,
>> SSH.
>> *Comment:* SSH brute force
>> *2025-10-17 14:13*.*Categories:* Brute-Force, SSH.
>> *Comment:* SG02-GC: SSH Brute Force from 89.37.193.207 at 2025-10-17
>> 19:43:44 IST
>> *2025-10-15 23:30*.*Categories:* Brute-Force, SSH.
>> *Comment:* SSH brute force
>> *2025-10-15 20:11*.*Categories:* Brute-Force.
>> *Comment:* list.rtbh.com.tr report: tcp/0
>> *2025-10-14 20:11*.*Categories:* Brute-Force.
>> *Comment:* list.rtbh.com.tr report: tcp/0
>> *2025-10-14 03:19*.*Categories:* Brute-Force, SSH.
>> *Comment:* 2025-10-14T05:17:47.020243+02:00 rico-j sshd[1483769]:
>> Connection from 89.37.193.207 port 32816 on 5.45.102.214 port 22 rdomain «»
>> 2025-10-14T05:17:47.347738+02:00 rico-j sshd[1483769]: Invalid user user14
>> from 89.37.193.207 port 32816 2025-10-14T05:19:00.602793+02:00 rico-j
>> sshd[1484910]: Connection from 89.37.193.207 port 36852 on 5.45.102.214
>> port 22 rdomain «» 2025-10-14T05:19:00.940340+02:00 rico-j sshd[1484910]:
>> Invalid user karthik from 89.37.193.207 port 36852 …
>> *2025-10-14 03:18*.*Categories:* Brute-Force, SSH.
>> *Comment:* (sshd) Failed SSH login from 89.37.193.207 (RU/Russia/-): 5
>> in the last 3600 secs; Ports: *; Direction: 1; Trigger: LF_SSHD; Logs: Oct
>> 13 22:14:51 14966 sshd[24656]: Invalid user tester from 89.37.193.207 port
>> 45690 Oct 13 22:14:53 14966 sshd[24656]: Failed password for invalid user
>> tester from 89.37.193.207 port 45690 ssh2 Oct 13 22:17:02 14966
>> sshd[25042]: Invalid user mgeweb from 89.37.193.207 port 53822 Oct 13
>> 22:17:04 14966 sshd[25042]: Failed password for invalid user mgeweb from
>> 89.37.193.207 port 53822 ssh2 Oct 13 22:18:18 14966 sshd[25252]: Invalid
>> user user14 from 89.37.193.207 port 40302
>> *2025-10-14 03:14*.*Categories:* Brute-Force, SSH.
>> *Comment:* Oct 14 16:12:57 mtl1 sshd-session[2797941]: Invalid user
>> tester from 89.37.193.207 port 38488
>> *2025-10-14 02:41*.*Categories:* Brute-Force, SSH.
>> *Comment:* Oct 14 04:34:24 vmi291233 sshd[2303293]: Invalid user
>> christine from 89.37.193.207 port 41740 Oct 14 04:35:38 vmi291233
>> sshd[2303313]: Invalid user scott from 89.37.193.207 port 56802 Oct 14
>> 04:39:10 vmi291233 sshd[2303427]: Invalid user sysadmin from 89.37.193.207
>> port 52862 Oct 14 04:40:23 vmi291233 sshd[2303438]: Invalid user r from
>> 89.37.193.207 port 43932 Oct 14 04:41:32 vmi291233 sshd[2303443]: Invalid
>> user zdy from 89.37.193.207 port 53182
>> *2025-10-14 02:40*.*Categories:* Brute-Force, SSH.
>> *Comment:* 2025-10-14T02:35:14.047265+00:00 Linux07 sshd[501608]:
>> pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh
>> ruser= rhost=89.37.193.207 2025-10-14T02:35:16.055126+00:00 Linux07
>> sshd[501608]: Failed password for invalid user scott from 89.37.193.207
>> port 33122 ssh2 2025-10-14T02:36:26.682396+00:00 Linux07 sshd[504847]:
>> pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh
>> ruser= rhost=89.37.193.207 user=root 2025-10-14T02:36:28.575212+00:00
>> Linux07 sshd[504847]: Failed password for root from 89.37.193.207 port
>> 51224 ssh2 2025-10-14T02:37:34.644031+00:00 Linux07 sshd[507849]:
>> pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh
>> ruser= rhost=89.37.193.207 user=root 2025-10-14T02:37:36.536188+00:00
>> Linux07 sshd[507849]: Failed password for root from 89.37.193.207 port
>> 33322 ssh2 2025-10-14T02:38:46.515908+00:00 Linux07 sshd[510609]: Invalid
>> user sysadmin from 89.37.193.207 port 57684
>> 2025-10-14T02:38:46.518036+00:00 Linux07 …
>> *2025-10-14 02:37*.*Categories:* Brute-Force, SSH.
>> *Comment:* Oct 14 02:35:21 antti-vps2 sshd[744054]: Invalid user scott
>> from 89.37.193.207 port 48554 Oct 14 02:36:33 antti-vps2 sshd[744227]:
>> Connection from 89.37.193.207 port 43438 on 10.0.0.124 port 22 rdomain «»
>> Oct 14 02:36:33 antti-vps2 sshd[744227]: User root from 89.37.193.207 not
>> allowed because none of user’s groups are listed in AllowGroups Oct 14
>> 02:37:42 antti-vps2 sshd[744429]: Connection from 89.37.193.207 port 58504
>> on 10.0.0.124 port 22 rdomain «» Oct 14 02:37:42 antti-vps2 sshd[744429]:
>> User root from 89.37.193.207 not allowed because none of user’s groups are
>> listed in AllowGroups …
>> *2025-10-14 02:35*.*Categories:* Brute-Force, SSH.
>> *Comment:* DE902-V6-FFM: SSH Brute Force from 89.37.193.207 at
>> 2025-10-14 08:05:46 IST
>> *2025-10-14 02:34*.*Categories:* SSH.
>> *Comment:* 89.37.193.207 banned on rtr — Threshold reached: 5 failures
>> *2025-10-14 02:31*.*Categories:* Brute-Force, SSH.
>> *Comment:* 89.37.193.207 (PL/Poland/-), 5 distributed sshd attacks on
>> account [root] in the last 3600 secs; Ports: *; Direction: 1; Trigger:
>> LF_DISTATTACK; Logs: Oct 13 21:31:16 15140 sshd[16333]:
>> pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh
>> ruser= rhost=209.74.66.170 user=root Oct 13 21:30:14 15140 sshd[16264]:
>> pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh
>> ruser= rhost=89.37.193.207 user=root Oct 13 21:30:16 15140 sshd[16264]:
>> Failed password for root from 89.37.193.207 port 38370 ssh2 Oct 13 21:24:40
>> 15140 sshd[15884]: pam_unix(sshd:auth): authentication failure; logname=
>> uid=0 euid=0 tty=ssh ruser= rhost=4.224.36.103 user=root Oct 13 21:24:42
>> 15140 sshd[15884]: Failed password for root from 4.224.36.103 port 46496
>> ssh2 IP Addresses Blocked: 209.74.66.170 (US/United States/
>> monarchianistic-embracery.vpsrdns.web-hosting.com)
>> *2025-10-14 01:54*.*Categories:* Brute-Force, SSH.
>> *Comment:* 2025-10-14T03:50:57.366308+02:00 axisverse
>> sshd-session[2328220]: Invalid user ftproot from 89.37.193.207 port 50050
>> 2025-10-14T03:53:21.997177+02:00 axisverse sshd-session[2332922]: Invalid
>> user ftpuser from 89.37.193.207 port 53654 2025-10-14T03:54:35.191506+02:00
>> axisverse sshd-session[2335276]: Invalid user lx from 89.37.193.207 port
>> 37946 …
>> *2025-10-14 01:51*.*Categories:* Brute-Force, SSH.
>> *Comment:* 2025-10-14T02:51:00.545830+01:00 omega.nodes.sillydev.co.uk
>> sshd[2769533]: Invalid user ftproot from 89.37.193.207 port 42084
>> 2025-10-14T02:51:00.556579+01:00 omega.nodes.sillydev.co.uk
>> sshd[2769533]: pam_unix(sshd:auth): authentication failure; logname= uid=0
>> euid=0 tty=ssh ruser= rhost=89.37.193.207 2025-10-14T02:51:01.882799+01:00
>> omega.nodes.sillydev.co.uk sshd[2769533]: Failed password for invalid
>> user ftproot from 89.37.193.207 port 42084 ssh2 …
>> *2025-10-14 01:50*.*Categories:* Brute-Force, SSH.
>> *Comment:* Oct 14 03:46:51 [redacted] sshd[1462276]: Failed password for
>> root from 89.37.193.207 port 37736 ssh2 Oct 14 03:50:19 [redacted]
>> sshd[1462317]: Invalid user ftproot from 89.37.193.207 port 48880 …
>> *2025-10-14 01:49*.*Categories:* Port Scan.
>> *Comment:* ID: 5730368201 | PORT: 57545 |
>> https://89-37-193-207.scanthe.net
>> *2025-10-14 01:48*.*Categories:* Brute-Force, SSH.
>> *Comment:* 89.37.193.207 (RU/Russia/-), 5 distributed sshd attacks on
>> account [root] in the last 3600 secs; Ports: *; Direction: 1; Trigger:
>> LF_DISTATTACK; Logs: Oct 13 19:49:48 15757 sshd[5720]: pam_unix(sshd:auth):
>> authentication failure; logname= uid=0 euid=0 tty=ssh ruser=
>> rhost=201.6.100.191 user=root Oct 13 19:49:50 15757 sshd[5720]: Failed
>> password for root from 201.6.100.191 port 57170 ssh2 Oct 13 20:47:58 15757
>> sshd[10488]: pam_unix(sshd:auth): authentication failure; logname= uid=0
>> euid=0 tty=ssh ruser= rhost=89.37.193.207 user=root Oct 13 20:48:00 15757
>> sshd[10488]: Failed password for root from 89.37.193.207 port 54106 ssh2
>> Oct 13 19:54:38 15757 sshd[6115]: pam_unix(sshd:auth): authentication
>> failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.17.148.221
>> user=root IP Addresses Blocked: 201.6.100.191 (BR/Brazil/
>> c90664bf.static.spo.virtua.com.br)
>> *2025-10-14 01:28*.*Categories:* Brute-Force, SSH.
>> *Comment:* Oct 14 03:21:37 Debian-1010-buster-64-minimal sshd[1018209]:
>> Invalid user ftpuser from 89.37.193.207 port 59294 Oct 14 03:25:10
>> Debian-1010-buster-64-minimal sshd[1105361]: Invalid user mary from
>> 89.37.193.207 port 35886 Oct 14 03:26:17 Debian-1010-buster-64-minimal
>> sshd[1130108]: Invalid user arif from 89.37.193.207 port 38794 Oct 14
>> 03:27:23 Debian-1010-buster-64-minimal sshd[1155934]: Invalid user qui from
>> 89.37.193.207 port 33008 Oct 14 03:28:33 Debian-1010-buster-64-minimal
>> sshd[1181854]: Invalid user gogs from 89.37.193.207 port 40512 …
>> *2025-10-14 01:11*.*Categories:* Brute-Force, SSH.
>> *Comment:* Oct 14 03:05:16 Debian-1010-buster-64-minimal sshd[628861]:
>> Invalid user term2 from 89.37.193.207 port 38598 Oct 14 03:07:31
>> Debian-1010-buster-64-minimal sshd[683953]: Invalid user finance from
>> 89.37.193.207 port 37448 Oct 14 03:08:43 Debian-1010-buster-64-minimal
>> sshd[712486]: Invalid user ssm from 89.37.193.207 port 36330 Oct 14
>> 03:09:54 Debian-1010-buster-64-minimal sshd[740375]: Invalid user ubuntu
>> from 89.37.193.207 port 46868 Oct 14 03:11:04 Debian-1010-buster-64-minimal
>> sshd[769679]: Invalid user demo from 89.37.193.207 port 36096 …
>> *2025-10-14 01:08*.*Categories:* Brute-Force, SSH.
>> *Comment:* (sshd) Failed SSH login from 89.37.193.207 (RU/Russia/-): 5
>> in the last 3600 secs; Ports: *; Direction: 1; Trigger: LF_SSHD; Logs: Oct
>> 13 20:04:40 16484 sshd[15186]: Invalid user term2 from 89.37.193.207 port
>> 41832 Oct 13 20:04:43 16484 sshd[15186]: Failed password for invalid user
>> term2 from 89.37.193.207 port 41832 ssh2 Oct 13 20:07:21 16484 sshd[15573]:
>> Invalid user finance from 89.37.193.207 port 49526 Oct 13 20:07:23 16484
>> sshd[15573]: Failed password for invalid user finance from 89.37.193.207
>> port 49526 ssh2 Oct 13 20:08:33 16484 sshd[15745]: Invalid user ssm from
>> 89.37.193.207 port 50130
>> *2025-10-14 01:07*.*Categories:* Brute-Force, SSH.
>> *Comment:* 2025-10-14T03:05:01.511829+02:00 terminator.powersource.cx
>> sshd-session[258941]: pam_unix(sshd:auth): authentication failure; logname=
>> uid=0 euid=0 tty=ssh ruser= rhost=89.37.193.207
>> 2025-10-14T03:05:04.122008+02:00 terminator.powersource.cx
>> sshd-session[258941]: Failed password for invalid user term2 from
>> 89.37.193.207 port 51312 ssh2 2025-10-14T03:07:26.454470+02:00
>> terminator.powersource.cx sshd-session[259155]: Invalid user finance
>> from 89.37.193.207 port 51650
>> *2025-10-14 01:04*.*Categories:* Brute-Force, SSH.
>> *Comment:* 2025-10-14T01:04:26.798566+00:00 wn-us sshd[2002539]: Invalid
>> user term2 from 89.37.193.207 port 34910 …
>> *2025-10-14 00:39*.*Categories:* Brute-Force, SSH.
>> *Comment:* 2025-10-14T01:24:02.539175+01:00 dasec-proxy-ssh
>> sshd[915313]: Invalid user helen from 89.37.193.207 port 57700
>> 2025-10-14T01:24:02.586317+01:00 dasec-proxy-ssh sshd[915313]: Disconnected
>> from invalid user helen 89.37.193.207 port 57700 [preauth]
>> 2025-10-14T01:25:44.989027+01:00 dasec-proxy-ssh sshd[915355]: Invalid user
>> ydy from 89.37.193.207 port 49302 2025-10-14T01:25:45.042787+01:00
>> dasec-proxy-ssh sshd[915355]: Disconnected from invalid user ydy
>> 89.37.193.207 port 49302 [preauth] 2025-10-14T01:27:01.374822+01:00
>> dasec-proxy-ssh sshd[915389]: Disconnected from authenticating user root
>> 89.37.193.207 port 51382 [preauth] 2025-10-14T01:28:12.697560+01:00
>> dasec-proxy-ssh sshd[915421]: Disconnected from authenticating user root
>> 89.37.193.207 port 37114 [preauth] 2025-10-14T01:29:20.182250+01:00
>> dasec-proxy-ssh sshd[915447]: Invalid user lee from 89.37.193.207 port
>> 55860 2025-10-14T01:29:20.228647+01:00 dasec-proxy-ssh sshd[915447]:
>> Disconnected from invalid user lee 89.37.193.207 port 5 …
>> *2025-10-14 00:33*.*Categories:* Brute-Force, SSH.
>> *Comment:* 2025-10-14T08:28:58.445389+08:00 *hostname*
>> sshd-session[1757303]: Invalid user lee from 89.37.193.207 port 60996
>> 2025-10-14T08:31:14.996136+08:00 *hostname* sshd-session[1757317]:
>> Connection from 89.37.193.207 port 54964 on 10.7.121.81 port 22 rdomain «»
>> 2025-10-14T08:31:15.987529+08:00 *hostname* sshd-session[1757317]: Invalid
>> user master from 89.37.193.207 port 54964 2025-10-14T08:33:34.747846+08:00
>> *hostname* sshd-session[1757335]: Connection from 89.37.193.207 port 37436
>> on 10.7.121.81 port 22 rdomain «» 2025-10-14T08:33:35.727147+08:00
>> *hostname* sshd-session[1757335]: Invalid user root/admin from
>> 89.37.193.207 port 37436
>> *2025-10-14 00:26*.*Categories:* Brute-Force, SSH.
>> *Comment:* (sshd) Failed SSH login from 89.37.193.207 (RU/Russia/-): 5
>> in the last 3600 secs; Ports: *; Direction: 1; Trigger: LF_SSHD; Logs: Oct
>> 14 00:21:06 23360 sshd[30151]: Invalid user helen from 89.37.193.207 port
>> 46978 Oct 14 00:21:08 23360 sshd[30151]: Failed password for invalid user
>> helen from 89.37.193.207 port 46978 ssh2 Oct 14 00:24:52 23360 sshd[30800]:
>> Invalid user ydy from 89.37.193.207 port 50042 Oct 14 00:24:55 23360
>> sshd[30800]: Failed password for invalid user ydy from 89.37.193.207 port
>> 50042 ssh2 Oct 14 00:26:09 23360 sshd[30982]: pam_unix(sshd:auth):
>> authentication failure; logname= uid=0 euid=0 tty=ssh ruser=
>> rhost=89.37.193.207 user=root
>> *2025-10-14 00:09*.*Categories:* Brute-Force.
>> *Comment:* list.rtbh.com.tr report: tcp/0
>> *2025-10-14 00:03*.*Categories:* Brute-Force, SSH.
>> *Comment:* 2025-10-14T01:01:24.927142+01:00 miku.zit.at sshd[1356788]:
>> Failed password for invalid user vpnuser1 from 89.37.193.207 port 47330
>> ssh2 2025-10-14T01:02:29.001717+01:00 miku.zit.at sshd[1356951]: Invalid
>> user admin from 89.37.193.207 port 52188 2025-10-14T01:02:29.010105+01:00
>> miku.zit.at sshd[1356951]: pam_unix(sshd:auth): authentication failure;
>> logname= uid=0 euid=0 tty=ssh ruser= rhost=89.37.193.207
>> 2025-10-14T01:02:31.155472+01:00 miku.zit.at sshd[1356951]: Failed
>> password for invalid user admin from 89.37.193.207 port 52188 ssh2
>> 2025-10-14T01:03:32.896194+01:00 miku.zit.at sshd[1357120]: Invalid user
>> ilaria from 89.37.193.207 port 38106 …
>> *2025-10-13 23:45*.*Categories:* Brute-Force, SSH.
>> *Comment:* 2025-10-14T00:43:34.553495+01:00 miku.zit.at sshd[1353750]:
>> Failed password for invalid user lucas from 89.37.193.207 port 41858 ssh2
>> 2025-10-14T00:44:49.104608+01:00 miku.zit.at sshd[1354044]: Invalid user
>> rootftp from 89.37.193.207 port 49114 2025-10-14T00:44:49.107864+01:00
>> miku.zit.at sshd[1354044]: pam_unix(sshd:auth): authentication failure;
>> logname= uid=0 euid=0 tty=ssh ruser= rhost=89.37.193.207
>> 2025-10-14T00:44:51.066765+01:00 miku.zit.at sshd[1354044]: Failed
>> password for invalid user rootftp from 89.37.193.207 port 49114 ssh2
>> 2025-10-14T00:45:55.942326+01:00 miku.zit.at sshd[1354241]: Invalid user
>> ubuntu from 89.37.193.207 port 35812 …
>> *2025-10-13 23:03*.*Categories:* SSH.
>> *Comment:* 2025-10-14T00:01:17.994741+01:00 hostvu2 sshd[3125502]:
>> Failed password for root from 89.37.193.207 port 42162 ssh2
>> 2025-10-14T00:02:29.847326+01:00 hostvu2 sshd[3125540]:
>> pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh
>> ruser= rhost=89.37.193.207 user=root 2025-10-14T00:02:31.777500+01:00
>> hostvu2 sshd[3125540]: Failed password for root from 89.37.193.207 port
>> 54076 ssh2 2025-10-14T00:03:45.147983+01:00 hostvu2 sshd[3127863]:
>> pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh
>> ruser= rhost=89.37.193.207 user=root 2025-10-14T00:03:47.851966+01:00
>> hostvu2 sshd[3127863]: Failed password for root from 89.37.193.207 port
>> 33766 ssh2 …
>> *2025-10-13 22:54*.*Categories:* Brute-Force, SSH.
>> *Comment:* Oct 13 22:50:18 raspberrypi sshd[14337]: Invalid user bodega
>> from 89.37.193.207 port 34100 Oct 13 22:51:29 raspberrypi sshd[14356]:
>> Invalid user Azure from 89.37.193.207 port 34028 Oct 13 22:52:41
>> raspberrypi sshd[14404]: Invalid user uftp from 89.37.193.207 port 43912
>> Oct 13 22:53:49 raspberrypi sshd[14454]: Invalid user regionalci from
>> 89.37.193.207 port 38190 Oct 13 22:54:58 raspberrypi sshd[14478]: Invalid
>> user anti from 89.37.193.207 port 39212 …
>> *2025-10-13 22:39*.*Categories:* Brute-Force, SSH.
>> *Comment:* Oct 13 22:35:10 raspberrypi sshd[13876]: Invalid user cy from
>> 89.37.193.207 port 43112 Oct 13 22:36:18 raspberrypi sshd[13907]: Invalid
>> user mohit from 89.37.193.207 port 54898 Oct 13 22:37:27 raspberrypi
>> sshd[13962]: Invalid user scott from 89.37.193.207 port 47960 Oct 13
>> 22:38:40 raspberrypi sshd[14001]: Invalid user david from 89.37.193.207
>> port 56820 Oct 13 22:39:50 raspberrypi sshd[14025]: Invalid user matin from
>> 89.37.193.207 port 39200 …
>> *2025-10-13 22:24*.*Categories:* Brute-Force, SSH.
>> *Comment:* Oct 13 22:16:30 raspberrypi sshd[13334]: Invalid user mpp
>> from 89.37.193.207 port 55076 Oct 13 22:20:02 raspberrypi sshd[13428]:
>> Invalid user newuser from 89.37.193.207 port 60068 Oct 13 22:22:20
>> raspberrypi sshd[13521]: Invalid user ftpuser from 89.37.193.207 port 41784
>> Oct 13 22:23:28 raspberrypi sshd[13566]: Invalid user super from
>> 89.37.193.207 port 51686 Oct 13 22:24:36 raspberrypi sshd[13616]: Invalid
>> user victor from 89.37.193.207 port 45488 …
>> *2025-10-13 22:22*.*Categories:* Brute-Force, SSH.
>> *Comment:* Fail2ban Triggered
>> *2025-10-13 22:18*.*Categories:* Brute-Force, SSH.
>> *Comment:* 2025-10-14T11:16:09.504177+13:00 dara sshd[2963963]:
>> Disconnected from invalid user mpp 89.37.193.207 port 40546 [preauth]
>> 2025-10-14T11:18:37.495269+13:00 dara sshd[2964206]: Connection from
>> 89.37.193.207 port 37962 on 135.181.182.173 port 22 rdomain «»
>> 2025-10-14T11:18:37.738642+13:00 dara sshd[2964206]: pam_unix(sshd:auth):
>> authentication failure; logname= uid=0 euid=0 tty=ssh ruser=
>> rhost=89.37.193.207 user=root 2025-10-14T11:18:39.671832+13:00 dara
>> sshd[2964206]: Failed password for root from 89.37.193.207 port 37962 ssh2
>> 2025-10-14T11:18:39.892794+13:00 dara sshd[2964206]: Disconnected from
>> authenticating user root 89.37.193.207 port 37962 [preauth] …
>> *2025-10-13 21:39*.*Categories:* Brute-Force, SSH.
>> *Comment:* SSH auth scanning — multiple failed logins
>> *2025-10-13 21:38*.*Categories:* Brute-Force, SSH.
>> *Comment:*
>> *2025-10-13 21:36*.*Categories:* Brute-Force, SSH.
>> *Comment:* 2025-10-14T03:33:55.782333+06:00 ubuntu sshd[186921]: Failed
>> password for root from 89.37.193.207 port 49848 ssh2
>> 2025-10-14T03:36:21.214638+06:00 ubuntu sshd[186956]: Invalid user ld from
>> 89.37.193.207 port 40478 …
>> *2025-10-13 21:35*.*Categories:* Brute-Force, SSH.
>> *Comment:* Oct 13 21:31:45 au-mirror sshd[1205907]: Failed password for
>> root from 89.37.193.207 port 46092 ssh2 Oct 13 21:35:43 au-mirror
>> sshd[1205948]: Invalid user ld from 89.37.193.207 port 53614 …
>> *2025-10-13 21:27*.*Categories:* Brute-Force, SSH.
>> *Comment:* 2025-10-13T21:21:52.723697+00:00 ingereck.net sshd[1385418]:
>> Invalid user nandan from 89.37.193.207 port 34336
>> 2025-10-13T21:23:20.479685+00:00 ingereck.net sshd[1385431]: Invalid
>> user sajjad from 89.37.193.207 port 44428 2025-10-13T21:24:44.159894+00:00
>> ingereck.net sshd[1385440]: Invalid user adu from 89.37.193.207 port
>> 35366 2025-10-13T21:26:07.555647+00:00 ingereck.net sshd[1385460]:
>> Invalid user hamza from 89.37.193.207 port 39186
>> 2025-10-13T21:27:34.980048+00:00 ingereck.net sshd[1385476]: Invalid
>> user ftpuser from 89.37.193.207 port 55532 …
>> *2025-10-13 21:15*.*Categories:* Brute-Force, SSH.
>> *Comment:* Oct 13 23:14:05 portfolio-web sshd[1981429]:
>> pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh
>> ruser= rhost=89.37.193.207 user=root Oct 13 23:14:07 portfolio-web
>> sshd[1981429]: Failed password for root from 89.37.193.207 port 42336 ssh2
>> Oct 13 23:15:34 portfolio-web sshd[1981440]: Invalid user profe from
>> 89.37.193.207 port 51760 Oct 13 23:15:34 portfolio-web sshd[1981440]:
>> pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh
>> ruser= rhost=89.37.193.207 Oct 13 23:15:37 portfolio-web sshd[1981440]:
>> Failed password for invalid user profe from 89.37.193.207 port 51760 ssh2
>> …
>> *2025-10-13 21:11*.*Categories:* Brute-Force, SSH.
>> *Comment:* Oct 13 23:10:07 odin sshd[3777]: pam_unix(sshd:auth):
>> authentication failure; logname= uid=0 euid=0 tty=ssh ruser=
>> rhost=89.37.193.207 Oct 13 23:10:09 odin sshd[3777]: Failed password for
>> invalid user zhang from 89.37.193.207 port 40946 ssh2 Oct 13 23:11:33 odin
>> sshd[4332]: Failed password for root from 89.37.193.207 port 46218 ssh2
>> *2025-10-13 21:10*.*Categories:* Brute-Force, SSH.
>> *Comment:* 2025-10-13T21:04:46.985799+00:00 ingereck.net sshd[1385008]:
>> Invalid user gabby from 89.37.193.207 port 50564
>> 2025-10-13T21:06:07.183553+00:00 ingereck.net sshd[1385033]: Invalid
>> user rr from 89.37.193.207 port 55822 2025-10-13T21:07:32.012782+00:00
>> ingereck.net sshd[1385056]: Invalid user sean from 89.37.193.207 port
>> 44860 2025-10-13T21:08:59.833317+00:00 ingereck.net sshd[1385094]:
>> Invalid user sepehr from 89.37.193.207 port 46342
>> 2025-10-13T21:10:26.179617+00:00 ingereck.net sshd[1385203]: Invalid
>> user zhang from 89.37.193.207 port 35634 …
>> *2025-10-13 20:53*.*Categories:* Brute-Force, SSH.
>> *Comment:* 2025-10-13T20:42:54.124110+00:00 ingereck.net sshd[1384644]:
>> Invalid user zain from 89.37.193.207 port 51076
>> 2025-10-13T20:49:03.581891+00:00 ingereck.net sshd[1384707]: Invalid
>> user g from 89.37.193.207 port 34312 2025-10-13T20:50:30.112025+00:00
>> ingereck.net sshd[1384742]: Invalid user ftptest from 89.37.193.207 port
>> 53042 2025-10-13T20:51:53.410638+00:00 ingereck.net sshd[1384770]:
>> Invalid user chenhui from 89.37.193.207 port 58420
>> 2025-10-13T20:53:14.679462+00:00 ingereck.net sshd[1384791]: Invalid
>> user luciano from 89.37.193.207 port 42216 …
>> *2025-10-13 20:47*.*Categories:* Brute-Force, SSH.
>> *Comment:* Oct 13 22:44:35 portfolio-web sshd[1980958]:
>> pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh
>> ruser= rhost=89.37.193.207 user=root Oct 13 22:44:37 portfolio-web
>> sshd[1980958]: Failed password for root from 89.37.193.207 port 36128 ssh2
>> Oct 13 22:45:51 portfolio-web sshd[1980997]: pam_unix(sshd:auth):
>> authentication failure; logname= uid=0 euid=0 tty=ssh ruser=
>> rhost=89.37.193.207 user=root Oct 13 22:45:53 portfolio-web sshd[1980997]:
>> Failed password for root from 89.37.193.207 port 54166 ssh2 Oct 13 22:47:06
>> portfolio-web sshd[1981010]: Invalid user admin from 89.37.193.207 port
>> 39594 …
>> *2025-10-13 20:44*.*Categories:* Brute-Force, SSH.
>> *Comment:* Oct 13 22:42:00 odin sshd[28374]: pam_unix(sshd:auth):
>> authentication failure; logname= uid=0 euid=0 tty=ssh ruser=
>> rhost=89.37.193.207 Oct 13 22:42:01 odin sshd[28374]: Failed password for
>> invalid user zain from 89.37.193.207 port 37104 ssh2 Oct 13 22:44:51 odin
>> sshd[28673]: Failed password for root from 89.37.193.207 port 42654 ssh2
>> *2025-10-13 20:43*.*Categories:* Brute-Force, SSH.
>> *Comment:* 2025-10-13T22:43:03.650933+02:00 meet sshd-session[44495]:
>> Invalid user zain from 89.37.193.207 port 33708 …
>> *2025-10-13 20:10*.*Categories:* Brute-Force.
>> *Comment:* list.rtbh.com.tr report: tcp/0
>> *2025-10-13 19:56*.*Categories:* Brute-Force, SSH.
>> *Comment:* 2025-10-13T21:53:18.889098+02:00 fra-GW01 sshd[1548854]:
>> Failed password for invalid user sk from 89.37.193.207 port 45546 ssh2
>> 2025-10-13T21:56:49.841119+02:00 fra-GW01 sshd[1549002]:
>> pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh
>> ruser= rhost=89.37.193.207 user=root 2025-10-13T21:56:52.108571+02:00
>> fra-GW01 sshd[1549002]: Failed password for root from 89.37.193.207 port
>> 60274 ssh2 …
>> *2025-10-13 19:51*.*Categories:* Brute-Force, SSH.
>> *Comment:* 2025-10-13T20:49:34.108013+01:00 miku.zit.at sshd[1308998]:
>> Failed password for invalid user test01 from 89.37.193.207 port 34616 ssh2
>> 2025-10-13T20:50:42.444459+01:00 miku.zit.at sshd[1309268]: Invalid user
>> ubuntu from 89.37.193.207 port 36268 2025-10-13T20:50:42.451827+01:00
>> miku.zit.at sshd[1309268]: pam_unix(sshd:auth): authentication failure;
>> logname= uid=0 euid=0 tty=ssh ruser= rhost=89.37.193.207
>> 2025-10-13T20:50:44.001939+01:00 miku.zit.at sshd[1309268]: Failed
>> password for invalid user ubuntu from 89.37.193.207 port 36268 ssh2
>> 2025-10-13T20:51:55.164154+01:00 miku.zit.at sshd[1309468]: Invalid user
>> a from 89.37.193.207 port 49630 …
>> *2025-10-13 19:43*.*Categories:* Brute-Force, SSH.
>> *Comment:* Invalid user botuser from 89.37.193.207 port 38610
>> *2025-10-13 19:41*.*Categories:* Brute-Force, SSH.
>> *Comment:* Invalid user botuser from 89.37.193.207 port 43654
>> *2025-10-13 19:34*.*Categories:* Brute-Force, SSH.
>> *Comment:* 2025-10-13T20:31:58.469411+01:00 miku.zit.at sshd[1306099]:
>> Failed password for invalid user ubuntu from 89.37.193.207 port 34504 ssh2
>> 2025-10-13T20:33:07.226387+01:00 miku.zit.at sshd[1306272]: Invalid user
>> admin1 from 89.37.193.207 port 45574 2025-10-13T20:33:07.233832+01:00
>> miku.zit.at sshd[1306272]: pam_unix(sshd:auth): authentication failure;
>> logname= uid=0 euid=0 tty=ssh ruser= rhost=89.37.193.207
>> 2025-10-13T20:33:09.621530+01:00 miku.zit.at sshd[1306272]: Failed
>> password for invalid user admin1 from 89.37.193.207 port 45574 ssh2
>> 2025-10-13T20:34:17.752363+01:00 miku.zit.at sshd[1306445]: Invalid user
>> dev from 89.37.193.207 port 50586 …
>> *2025-10-13 19:16*.*Categories:* Brute-Force, SSH.
>> *Comment:* 2025-10-13T20:14:21.012027+01:00 miku.zit.at sshd[1302866]:
>> Failed password for invalid user sammy from 89.37.193.207 port 35894 ssh2
>> 2025-10-13T20:15:40.340252+01:00 miku.zit.at sshd[1303158]: Invalid user
>> dockeruser from 89.37.193.207 port 42818 2025-10-13T20:15:40.347792+01:00
>> miku.zit.at sshd[1303158]: pam_unix(sshd:auth): authentication failure;
>> logname= uid=0 euid=0 tty=ssh ruser= rhost=89.37.193.207
>> 2025-10-13T20:15:42.665646+01:00 miku.zit.at sshd[1303158]: Failed
>> password for invalid user dockeruser from 89.37.193.207 port 42818 ssh2
>> 2025-10-13T20:16:51.791041+01:00 miku.zit.at sshd[1303597]: Invalid user
>> steam from 89.37.193.207 port 39840 …
>> *2025-10-13 19:16*.*Categories:* Brute-Force, SSH.
>> *Comment:* Log Entry: 2025-10-13T19:12:23241 abuse sshd[1130709]:
>> Invalid user sammy from 89.37.193.207 port 40508 Log Entry:
>> 2025-10-13T19:15:06935 abuse sshd[1130931]: Invalid user dockeruser from
>> 89.37.193.207 port 49254 Log Entry: 2025-10-13T19:16:19149 abuse
>> sshd[1131010]: Invalid user steam from 89.37.193.207 port 45134 Log Entry:
>> …
>> *2025-10-13 19:15*.*Categories:* Brute-Force, Web App Attack,
>> SSH.
>> *Comment:* Default ban by fail2ban
>> *2025-10-13 19:12*.*Categories:* Brute-Force, SSH.
>> *Comment:* $f2bV_matches
>> *2025-10-13 19:10*.*Categories:* Port Scan, Hacking,
>> Brute-Force, Exploited Host, Web App Attack.
>> *Comment:* 2025-10-14T00:40:35.835038localhost sshd[1525019]: Invalid
>> user sammy from 89.37.193.207 port 33268 …
>> *2025-10-13 18:00*.*Categories:* Brute-Force, SSH.
>> *Comment:* SSH abuse or brute-force attack detected by Fail2Ban in ssh
>> jail
>> *2025-10-13 17:46*.*Categories:* Brute-Force, SSH.
>> *Comment:* (sshd) Failed SSH login from 89.37.193.207 (RU/Russia/-): 5
>> in the last 3600 secs; Ports: *; Direction: 1; Trigger: LF_SSHD; Logs: Oct
>> 13 12:41:23 15806 sshd[25820]: Invalid user ray from 89.37.193.207 port
>> 55818 Oct 13 12:41:25 15806 sshd[25820]: Failed password for invalid user
>> ray from 89.37.193.207 port 55818 ssh2 Oct 13 12:45:11 15806 sshd[26212]:
>> Invalid user work from 89.37.193.207 port 44804 Oct 13 12:45:13 15806
>> sshd[26212]: Failed password for invalid user work from 89.37.193.207 port
>> 44804 ssh2 Oct 13 12:46:31 15806 sshd[26321]: Invalid user alin from
>> 89.37.193.207 port 53842
>> *2025-10-13 17:46*.*Categories:* Brute-Force, SSH.
>> *Comment:* 2025-10-13T13:44:01.215982 tlgy-node1 sshd[2782300]:
>> pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh
>> ruser= rhost=89.37.193.207 2025-10-13T13:44:03.283761 tlgy-node1
>> sshd[2782300]: Failed password for invalid user ray from 89.37.193.207 port
>> 53986 ssh2 2025-10-13T13:46:03.500386 tlgy-node1 sshd[2782792]: Invalid
>> user work from 89.37.193.207 port 42524 …
>> *2025-10-13 17:45*.*Categories:* Brute-Force, SSH.
>> *Comment:* 2025-10-13T17:43:20.037810+00:00 edge-fra-2.senko.network
>> sshd[3886852]: Invalid user ray from 89.37.193.207 port 60708
>> 2025-10-13T17:45:46.129653+00:00 edge-fra-2.senko.network sshd[3886948]:
>> Invalid user work from 89.37.193.207 port 34444 …
>> *2025-10-13 16:54*.*Categories:* Brute-Force, SSH.
>> *Comment:* (sshd) Failed SSH login from 89.37.193.207 (RU/Russia/-): 5
>> in the last 3600 secs; Ports: *; Direction: 1; Trigger: LF_SSHD; Logs: Oct
>> 13 11:51:22 14153 sshd[26867]: Invalid user aria from 89.37.193.207 port
>> 60374 Oct 13 11:51:24 14153 sshd[26867]: Failed password for invalid user
>> aria from 89.37.193.207 port 60374 ssh2 Oct 13 11:53:24 14153 sshd[27029]:
>> Invalid user ftpuser from 89.37.193.207 port 46416 Oct 13 11:53:26 14153
>> sshd[27029]: Failed password for invalid user ftpuser from 89.37.193.207
>> port 46416 ssh2 Oct 13 11:54:46 14153 sshd[27121]: Invalid user testuser
>> from 89.37.193.207 port 52554
>> *2025-10-13 16:53*.*Categories:* Brute-Force, SSH.
>> *Comment:* 2025-10-13T18:51:46.186028+02:00 fra-GW01 sshd[1537946]:
>> pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh
>> ruser= rhost=89.37.193.207 2025-10-13T18:51:47.536668+02:00 fra-GW01
>> sshd[1537946]: Failed password for invalid user aria from 89.37.193.207
>> port 46728 ssh2 2025-10-13T18:53:34.406193+02:00 fra-GW01 sshd[1538132]:
>> Invalid user ftpuser from 89.37.193.207 port 37544 …
>> *2025-10-13 16:53*.*Categories:* Brute-Force, SSH.
>> *Comment:* 2025-10-13T11:50:13.148302-05:00 ip-172-31-76-241
>> sshd[983557]: Invalid user aria from 89.37.193.207 port 37084
>> 2025-10-13T11:50:13.288730-05:00 ip-172-31-76-241 sshd[983557]:
>> Disconnected from invalid user aria 89.37.193.207 port 37084 [preauth]
>> 2025-10-13T11:52:59.900891-05:00 ip-172-31-76-241 sshd[1023332]: Invalid
>> user ftpuser from 89.37.193.207 port 48958 …
>> *2025-10-13 16:10*.*Categories:* Brute-Force, SSH.
>> *Comment:* Oct 13 17:06:01 ipmi sshd[40953]: Disconnected from
>> authenticating user root 89.37.193.207 port 34670 [preauth] Oct 13 17:09:08
>> ipmi sshd[41150]: pam_unix(sshd:auth): authentication failure; logname=
>> uid=0 euid=0 tty=ssh ruser= rhost=89.37.193.207 user=root Oct 13 17:09:10
>> ipmi sshd[41150]: Failed password for root from 89.37.193.207 port 36750
>> ssh2 Oct 13 17:09:10 ipmi sshd[41150]: Disconnected from authenticating
>> user root 89.37.193.207 port 36750 [preauth] Oct 13 17:10:27 ipmi
>> sshd[41256]: Invalid user botuser from 89.37.193.207 port 60782 …
>> *2025-10-13 16:05*.*Categories:* Brute-Force, SSH.
>> *Comment:* 89.37.193.207 (RU/Russia/-), 5 distributed sshd attacks on
>> account [root] in the last 3600 secs; Ports: *; Direction: 1; Trigger:
>> LF_DISTATTACK; Logs: Oct 13 11:05:48 12389 sshd[28715]:
>> pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh
>> ruser= rhost=89.37.193.207 user=root Oct 13 10:31:48 12389 sshd[26052]:
>> pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh
>> ruser= rhost=119.255.245.44 user=root Oct 13 10:31:50 12389 sshd[26052]:
>> Failed password for root from 119.255.245.44 port 46722 ssh2 Oct 13
>> 11:05:08 12389 sshd[28692]: pam_unix(sshd:auth): authentication failure;
>> logname= uid=0 euid=0 tty=ssh ruser= rhost=212.19.117.204 user=root Oct 13
>> 11:05:10 12389 sshd[28692]: Failed password for root from 212.19.117.204
>> port 41447 ssh2 IP Addresses Blocked:
>> *2025-10-13 15:59*.*Categories:* Brute-Force, SSH.
>> *Comment:* Oct 13 18:58:19 www sshd\[18514\]: Invalid user devops from
>> 89.37.193.207Oct 13 18:58:21 www sshd\[18514\]: Failed password for invalid
>> user devops from 89.37.193.207 port 42728 ssh2Oct 13 18:59:30 www
>> sshd\[18538\]: Invalid user becky from 89.37.193.207 …
>> *2025-10-13 15:55*.*Categories:* Brute-Force, SSH.
>> *Comment:* Oct 13 17:52:57 m2048 sshd[3963318]: Invalid user sonarr from
>> 89.37.193.207 port 60364 Oct 13 17:52:59 m2048 sshd[3963318]: Failed
>> password for invalid user sonarr from 89.37.193.207 port 60364 ssh2 Oct 13
>> 17:54:12 m2048 sshd[3963423]: pam_unix(sshd:auth): authentication failure;
>> logname= uid=0 euid=0 tty=ssh ruser= rhost=89.37.193.207 user=root Oct 13
>> 17:54:14 m2048 sshd[3963423]: Failed password for root from 89.37.193.207
>> port 57376 ssh2 Oct 13 17:55:26 m2048 sshd[3963545]: Invalid user rana from
>> 89.37.193.207 port 45944 …
>> *2025-10-13 15:42*.*Categories:* Brute-Force, SSH.
>> *Comment:* Oct 13 18:41:15 www sshd\[18163\]: Invalid user adnan from
>> 89.37.193.207Oct 13 18:41:18 www sshd\[18163\]: Failed password for invalid
>> user adnan from 89.37.193.207 port 33416 ssh2Oct 13 18:42:26 www
>> sshd\[18186\]: Invalid user summer from 89.37.193.207 …
>> *2025-10-13 15:29*.*Categories:* Brute-Force, SSH.
>> *Comment:* 2025-10-13T17:26:04.364860+02:00 ns402 sshd[1629988]: Failed
>> password for invalid user backend from 89.37.193.207 port 36972 ssh2
>> 2025-10-13T17:26:04.496363+02:00 ns402 sshd[1629988]: Disconnected from
>> invalid user backend 89.37.193.207 port 36972 [preauth]
>> 2025-10-13T17:27:20.957910+02:00 ns402 sshd[1630266]: Invalid user sean
>> from 89.37.193.207 port 56424 2025-10-13T17:27:20.972437+02:00 ns402
>> sshd[1630266]: pam_unix(sshd:auth): authentication failure; logname= uid=0
>> euid=0 tty=ssh ruser= rhost=89.37.193.207 2025-10-13T17:27:22.851067+02:00
>> ns402 sshd[1630266]: Failed password for invalid user sean from
>> 89.37.193.207 port 56424 ssh2 2025-10-13T17:27:22.921966+02:00 ns402
>> sshd[1630266]: Disconnected from invalid user sean 89.37.193.207 port 56424
>> [preauth] 2025-10-13T17:28:34.034136+02:00 ns402 sshd[1630506]:
>> pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh
>> ruser= rhost=89.37.193.207 user=root 2025-10-13T17:28:35.602252+02:00 ns402
>> sshd[1630506]: Failed pas …
>> *2025-10-13 15:27*.*Categories:* Brute-Force, SSH.
>> *Comment:* Oct 13 17:26:11 m2048 sshd[3962079]: Failed password for
>> invalid user backend from 89.37.193.207 port 56022 ssh2 Oct 13 17:27:27
>> m2048 sshd[3962096]: Invalid user sean from 89.37.193.207 port 53662 Oct 13
>> 17:27:27 m2048 sshd[3962096]: pam_unix(sshd:auth): authentication failure;
>> logname= uid=0 euid=0 tty=ssh ruser= rhost=89.37.193.207 Oct 13 17:27:27
>> m2048 sshd[3962096]: Invalid user sean from 89.37.193.207 port 53662 Oct 13
>> 17:27:29 m2048 sshd[3962096]: Failed password for invalid user sean from
>> 89.37.193.207 port 53662 ssh2 …
>> *2025-10-13 15:25*.*Categories:* Brute-Force, SSH.
>> *Comment:* Oct 13 18:20:25 www sshd\[17740\]: Failed password for root
>> from 89.37.193.207 port 40482 ssh2Oct 13 18:25:18 www sshd\[17843\]:
>> Invalid user backend from 89.37.193.207Oct 13 18:25:20 www sshd\[17843\]:
>> Failed password for invalid user backend from 89.37.193.207 port 51508 ssh2
>> …
>> *2025-10-13 15:25*.*Categories:* SSH.
>> *Comment:* Oct 13 16:25:02 l03 sshd[3278]: Invalid user backend from
>> 89.37.193.207 port 36152 …
>> *2025-10-13 15:19*.*Categories:* Brute-Force, SSH.
>> *Comment:* 89.37.193.207 (RU/Russia/-), 5 distributed sshd attacks on
>> account [root] in the last 3600 secs; Ports: *; Direction: 1; Trigger:
>> LF_DISTATTACK; Logs: Oct 13 10:06:31 14106 sshd[14192]:
>> pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh
>> ruser= rhost=78.89.154.59 user=root Oct 13 10:06:33 14106 sshd[14192]:
>> Failed password for root from 78.89.154.59 port 34944 ssh2 Oct 13 10:02:43
>> 14106 sshd[13828]: pam_unix(sshd:auth): authentication failure; logname=
>> uid=0 euid=0 tty=ssh ruser= rhost=79.116.71.204 user=root Oct 13 10:19:45
>> 14106 sshd[15215]: pam_unix(sshd:auth): authentication failure; logname=
>> uid=0 euid=0 tty=ssh ruser= rhost=89.37.193.207 user=root Oct 13 10:19:46
>> 14106 sshd[15215]: Failed password for root from 89.37.193.207 port 33682
>> ssh2 IP Addresses Blocked: 78.89.154.59 (KW/Kuwait/-) 79.116.71.204
>> (ES/Spain/79-116-71-204.digimobil.es)
>> *2025-10-13 14:37*.*Categories:* Brute-Force, SSH.
>> *Comment:* 89.37.193.207 (RU/Russia/-), 5 distributed sshd attacks on
>> account [root] in the last 3600 secs; Ports: *; Direction: 1; Trigger:
>> LF_DISTATTACK; Logs: Oct 13 09:35:52 16988 sshd[23185]:
>> pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh
>> ruser= rhost=162.144.85.107 user=root Oct 13 09:35:53 16988 sshd[23185]:
>> Failed password for root from 162.144.85.107 port 54846 ssh2 Oct 13
>> 09:15:51 16988 sshd[21679]: pam_unix(sshd:auth): authentication failure;
>> logname= uid=0 euid=0 tty=ssh ruser= rhost=103.136.106.74 user=root Oct 13
>> 09:15:53 16988 sshd[21679]: Failed password for root from 103.136.106.74
>> port 49814 ssh2 Oct 13 09:37:06 16988 sshd[23324]: pam_unix(sshd:auth):
>> authentication failure; logname= uid=0 euid=0 tty=ssh ruser=
>> rhost=89.37.193.207 user=root IP Addresses Blocked: 162.144.85.107
>> (US/United States/162-144-85-107.unifiedlayer.com) 103.136.106.74
>> (BD/Bangladesh/-)
>> *2025-10-13 14:36*.*Categories:* Port Scan.
>> *Comment:* ports, 22/24H:1/7D:1
>> *2025-10-13 13:57*.*Categories:* Brute-Force, SSH.
>> *Comment:* Oct 13 13:54:33 ubuntu sshd[1495434]: Failed password for
>> root from 89.37.193.207 port 46814 ssh2 Oct 13 13:55:51 ubuntu
>> sshd[1495479]: pam_unix(sshd:auth): authentication failure; logname= uid=0
>> euid=0 tty=ssh ruser= rhost=89.37.193.207 user=root Oct 13 13:55:54 ubuntu
>> sshd[1495479]: Failed password for root from 89.37.193.207 port 45450 ssh2
>> Oct 13 13:57:12 ubuntu sshd[1495481]: pam_unix(sshd:auth): authentication
>> failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=89.37.193.207 user=root
>> Oct 13 13:57:14 ubuntu sshd[1495481]: Failed password for root from
>> 89.37.193.207 port 36318 ssh2 …
>> *2025-10-13 13:53*.*Categories:* Brute-Force, SSH.
>> *Comment:* (sshd) Failed SSH login from 89.37.193.207 (RU/Russia/-): 5
>> in the last 3600 secs; Ports: *; Direction: 1; Trigger: LF_SSHD; Logs: Oct
>> 13 08:48:15 18800 sshd[5177]: pam_unix(sshd:auth): authentication failure;
>> logname= uid=0 euid=0 tty=ssh ruser= rhost=89.37.193.207 user=root Oct 13
>> 08:48:17 18800 sshd[5177]: Failed password for root from 89.37.193.207 port
>> 59244 ssh2 Oct 13 08:52:11 18800 sshd[5483]: pam_unix(sshd:auth):
>> authentication failure; logname= uid=0 euid=0 tty=ssh ruser=
>> rhost=89.37.193.207 user=root Oct 13 08:52:13 18800 sshd[5483]: Failed
>> password for root from 89.37.193.207 port 37308 ssh2 Oct 13 08:53:36 18800
>> sshd[5563]: pam_unix(sshd:auth): authentication failure; logname= uid=0
>> euid=0 tty=ssh ruser= rhost=89.37.193.207 user=root
>> *2025-10-13 13:50*.*Categories:* Port Scan, Brute-Force, SSH.
>> *Comment:* Port probe to tcp/22 (ssh) [srv124]
>> *2025-10-13 12:37*.*Categories:* Brute-Force.
>> *Comment:* $f2bV_matches
>> *2025-10-13 12:31*.*Categories:* Brute-Force, Web App Attack,
>> SSH.
>> *Comment:* Automatic Reporting — Brute Force Attempts
>> *2025-10-13 12:27*.*Categories:* Brute-Force, SSH.
>> *Comment:* (sshd) Failed SSH login from 89.37.193.207 (RU/Russia/-): 5
>> in the last 3600 secs; Ports: *; Direction: 1; Trigger: LF_SSHD; Logs: Oct
>> 13 07:24:25 14113 sshd[19528]: Invalid user www from 89.37.193.207 port
>> 41110 Oct 13 07:24:26 14113 sshd[19528]: Failed password for invalid user
>> www from 89.37.193.207 port 41110 ssh2 Oct 13 07:26:15 14113 sshd[19819]:
>> Invalid user zenith from 89.37.193.207 port 41454 Oct 13 07:26:17 14113
>> sshd[19819]: Failed password for invalid user zenith from 89.37.193.207
>> port 41454 ssh2 Oct 13 07:27:43 14113 sshd[20015]: Invalid user pippo from
>> 89.37.193.207 port 39566
>> *2025-10-13 12:27*.*Categories:* Brute-Force, SSH.
>> *Comment:* 2025-10-13T05:23:56.977096-07:00 dmit-vm-pro-plamspring-lax
>> sshd[764308]: Invalid user www from 89.37.193.207 port 35832
>> 2025-10-13T05:26:04.546496-07:00 dmit-vm-pro-plamspring-lax sshd[764331]:
>> Invalid user zenith from 89.37.193.207 port 50244
>> 2025-10-13T05:27:33.163463-07:00 dmit-vm-pro-plamspring-lax sshd[764360]:
>> Invalid user pippo from 89.37.193.207 port 55012 …
>> *2025-10-13 12:21*.*Categories:* Brute-Force, SSH.
>> *Comment:* Oct 13 12:21:35 Sildom2 sshd[1229482]: pam_unix(sshd:auth):
>> authentication failure; logname= uid=0 euid=0 tty=ssh ruser=
>> rhost=89.37.193.207 Oct 13 12:21:37 Sildom2 sshd[1229482]: Failed password
>> for invalid user www from 89.37.193.207 port 40774 ssh2 …
>> *2025-10-13 11:43*.*Categories:* Hacking, Brute-Force, SSH.
>> *Comment:* Oct 13 11:40:42 lewisgillcom sshd[3459673]: Failed password
>> for invalid user nominatim from 89.37.193.207 port 57956 ssh2 Oct 13
>> 11:42:07 lewisgillcom sshd[3460070]: Invalid user admin1 from 89.37.193.207
>> port 52242 Oct 13 11:42:07 lewisgillcom sshd[3460070]: pam_unix(sshd:auth):
>> authentication failure; logname= uid=0 euid=0 tty=ssh ruser=
>> rhost=89.37.193.207 Oct 13 11:42:09 lewisgillcom sshd[3460070]: Failed
>> password for invalid user admin1 from 89.37.193.207 port 52242 ssh2 Oct 13
>> 11:43:27 lewisgillcom sshd[3460272]: Invalid user csgoserver from
>> 89.37.193.207 port 42234 …
>> *2025-10-13 11:43*.*Categories:* Brute-Force, SSH.
>> *Comment:* (sshd) Failed SSH login from 89.37.193.207 (RU/Russia/-): 5
>> in the last 3600 secs; Ports: *; Direction: 1; Trigger: LF_SSHD; Logs: Oct
>> 13 06:39:32 16144 sshd[17009]: Invalid user nominatim from 89.37.193.207
>> port 54152 Oct 13 06:39:34 16144 sshd[17009]: Failed password for invalid
>> user nominatim from 89.37.193.207 port 54152 ssh2 Oct 13 06:41:46 16144
>> sshd[17161]: Invalid user admin1 from 89.37.193.207 port 36398 Oct 13
>> 06:41:48 16144 sshd[17161]: Failed password for invalid user admin1 from
>> 89.37.193.207 port 36398 ssh2 Oct 13 06:43:07 16144 sshd[17285]: Invalid
>> user csgoserver from 89.37.193.207 port 55238
>> *2025-10-13 11:42*.*Categories:* Brute-Force, SSH.
>> *Comment:* Oct 13 13:38:39 main1 sshd[1259360]: Invalid user nominatim
>> from 89.37.193.207 port 40834 Oct 13 13:41:28 main1 sshd[1259795]: Invalid
>> user admin1 from 89.37.193.207 port 57314 Oct 13 13:42:49 main1
>> sshd[1260121]: Invalid user csgoserver from 89.37.193.207 port 37792 …
>> *2025-10-13 11:42*.*Categories:* Brute-Force, SSH.
>> *Comment:* Oct 13 13:37:51 bonsai sshd[13617]: Invalid user nominatim
>> from 89.37.193.207 Oct 13 13:41:12 bonsai sshd[24278]: Invalid user admin1
>> from 89.37.193.207 Oct 13 13:42:32 bonsai sshd[24462]: Invalid user
>> csgoserver from 89.37.193.207 …
>> *2025-10-13 11:41*.*Categories:* Brute-Force, SSH.
>> *Comment:* 2025-10-13T11:39:11.931093+00:00 nextcloud sshd[1631196]:
>> Failed password for invalid user nominatim from 89.37.193.207 port 49502
>> ssh2 2025-10-13T11:41:38.303284+00:00 nextcloud sshd[1631425]: Invalid user
>> admin1 from 89.37.193.207 port 52414 2025-10-13T11:41:38.310137+00:00
>> nextcloud sshd[1631425]: pam_unix(sshd:auth): authentication failure;
>> logname= uid=0 euid=0 tty=ssh ruser= rhost=89.37.193.207
>> 2025-10-13T11:41:40.109331+00:00 nextcloud sshd[1631425]: Failed password
>> for invalid user admin1 from 89.37.193.207 port 52414 ssh2 …
>> *2025-10-13 11:41*.*Categories:* Brute-Force, SSH.
>> *Comment:* 2025-10-13T11:39:08.746220+00:00 polaris sshd[1089930]:
>> pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh
>> ruser= rhost=89.37.193.207 2025-10-13T11:39:10.274378+00:00 polaris
>> sshd[1089930]: Failed password for invalid user nominatim from
>> 89.37.193.207 port 60026 ssh2 2025-10-13T11:41:38.011958+00:00 polaris
>> sshd[1090216]: Invalid user admin1 from 89.37.193.207 port 46032 …
>> *2025-10-13 10:53*.*Categories:* Brute-Force, SSH.
>> *Comment:* (sshd) Failed SSH login from 89.37.193.207 (RU/Russia/-): 5
>> in the last 3600 secs; Ports: *; Direction: 1; Trigger: LF_SSHD; Logs: Oct
>> 13 05:49:26 15423 sshd[16111]: Invalid user huawei from 89.37.193.207 port
>> 49750 Oct 13 05:49:28 15423 sshd[16111]: Failed password for invalid user
>> huawei from 89.37.193.207 port 49750 ssh2 Oct 13 05:51:40 15423
>> sshd[16269]: Invalid user ark from 89.37.193.207 port 54154 Oct 13 05:51:42
>> 15423 sshd[16269]: Failed password for invalid user ark from 89.37.193.207
>> port 54154 ssh2 Oct 13 05:53:00 15423 sshd[16352]: Invalid user ahsan from
>> 89.37.193.207 port 37726
>> *2025-10-13 10:50*.*Categories:* Brute-Force, SSH.
>> *Comment:* 2025-10-13T12:50:36.548121+02:00 main sshd[520550]: Invalid
>> user huawei from 89.37.193.207 port 57578 …
>> *2025-10-13 10:27*.*Categories:* Brute-Force, SSH.
>> *Comment:* Oct 13 12:26:21 pegasus sshd[2728847]: pam_unix(sshd:auth):
>> authentication failure; logname= uid=0 euid=0 tty=ssh ruser=
>> rhost=89.37.193.207 user=root Oct 13 12:26:23 pegasus sshd[2728847]: Failed
>> password for root from 89.37.193.207 port 42138 ssh2 Oct 13 12:27:38
>> pegasus sshd[2729057]: Invalid user geek from 89.37.193.207 port 49092 Oct
>> 13 12:27:38 pegasus sshd[2729057]: pam_unix(sshd:auth): authentication
>> failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=89.37.193.207 Oct 13
>> 12:27:39 pegasus sshd[2729057]: Failed password for invalid user geek from
>> 89.37.193.207 port 49092 ssh2
>> *2025-10-13 10:05*.*Categories:* Brute-Force, SSH.
>> *Comment:* CrowdSec engine detected malicious behavior. Scenario
>> ‘crowdsecurity/ssh-slow-bf’ triggered with 17 events.
>> *2025-10-13 10:03*.*Categories:* Brute-Force, SSH.
>> *Comment:* (sshd) Failed SSH login from 89.37.193.207 (RU/Russia/-): 5
>> in the last 3600 secs; Ports: *; Direction: 1; Trigger: LF_SSHD; Logs: Oct
>> 13 04:59:23 15486 sshd[23741]: pam_unix(sshd:auth): authentication failure;
>> logname= uid=0 euid=0 tty=ssh ruser= rhost=89.37.193.207 user=nginx Oct 13
>> 04:59:25 15486 sshd[23741]: Failed password for nginx from 89.37.193.207
>> port 53238 ssh2 Oct 13 05:02:11 15486 sshd[24004]: Invalid user runner from
>> 89.37.193.207 port 38870 Oct 13 05:02:13 15486 sshd[24004]: Failed password
>> for invalid user runner from 89.37.193.207 port 38870 ssh2 Oct 13 05:03:31
>> 15486 sshd[24113]: Invalid user exx from 89.37.193.207 port 36638
>> *2025-10-13 10:03*.*Categories:* Brute-Force, SSH.
>> *Comment:* Oct 13 12:02:32 pegasus sshd[2721607]: Invalid user runner
>> from 89.37.193.207 port 58836 Oct 13 12:02:32 pegasus sshd[2721607]:
>> pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh
>> ruser= rhost=89.37.193.207 Oct 13 12:02:34 pegasus sshd[2721607]: Failed
>> password for invalid user runner from 89.37.193.207 port 58836 ssh2 Oct 13
>> 12:03:51 pegasus sshd[2722217]: Invalid user exx from 89.37.193.207 port
>> 33604
>> *2025-10-13 09:15*.*Categories:* Brute-Force, SSH.
>> *Comment:* $f2bV_matches
>> *2025-10-13 08:53*.*Categories:* Brute-Force, SSH.
>> *Comment:* Oct 13 10:44:53 hydrogen sshd[3917746]: Invalid user zzl from
>> 89.37.193.207 port 40866 Oct 13 10:46:02 hydrogen sshd[3918398]: Invalid
>> user penis from 89.37.193.207 port 58346 Oct 13 10:47:15 hydrogen
>> sshd[3918911]: Invalid user chris from 89.37.193.207 port 56308 Oct 13
>> 10:48:21 hydrogen sshd[3919456]: Invalid user ftpuser from 89.37.193.207
>> port 35466 Oct 13 10:53:09 hydrogen sshd[3921790]: Invalid user fabian from
>> 89.37.193.207 port 55464 …
>> *2025-10-13 08:34*.*Categories:* Brute-Force, SSH.
>> *Comment:* Oct 13 10:25:12 hydrogen sshd[3908060]: Invalid user seven
>> from 89.37.193.207 port 58806 Oct 13 10:28:22 hydrogen sshd[3909542]:
>> Invalid user school from 89.37.193.207 port 41100 Oct 13 10:30:39 hydrogen
>> sshd[3910692]: Invalid user iptv from 89.37.193.207 port 51236 Oct 13
>> 10:33:06 hydrogen sshd[3911856]: Invalid user daniel from 89.37.193.207
>> port 58760 Oct 13 10:34:18 hydrogen sshd[3912382]: Invalid user holu from
>> 89.37.193.207 port 39830 …
>> *2025-10-13 08:27*.*Categories:* Brute-Force, SSH.
>> *Comment:* 2025-10-13T10:25:54.538753+02:00 rpi4 sshd[5049]: Invalid
>> user seven from 89.37.193.207 port 42920 2025-10-13T10:25:54.561594+02:00
>> rpi4 sshd[5049]: pam_unix(sshd:auth): authentication failure; logname=
>> uid=0 euid=0 tty=ssh ruser= rhost=89.37.193.207
>> 2025-10-13T10:25:56.111919+02:00 rpi4 sshd[5049]: Failed password for
>> invalid user seven from 89.37.193.207 port 42920 ssh2
>> 2025-10-13T10:27:07.966792+02:00 rpi4 sshd[5068]: pam_unix(sshd:auth):
>> authentication failure; logname= uid=0 euid=0 tty=ssh ruser=
>> rhost=89.37.193.207 user=root 2025-10-13T10:27:09.205746+02:00 rpi4
>> sshd[5068]: Failed password for root from 89.37.193.207 port 53692 ssh2 …
>> *2025-10-13 08:24*.*Categories:* Brute-Force.
>> *Comment:* Oct 13 08:24:55 hecnet-us-east-gw sshd[98568]: Invalid user
>> cloud from 89.37.193.207 port 46084 Oct 13 08:24:57 hecnet-us-east-gw
>> sshd[98568]: Failed password for invalid user cloud from 89.37.193.207 port
>> 46084 ssh2 Oct 13 08:24:57 hecnet-us-east-gw sshd[98568]: Disconnected from
>> invalid user cloud 89.37.193.207 port 46084 [preauth] …
>> *2025-10-13 08:15*.*Categories:* Brute-Force, SSH.
>> *Comment:* 89.37.193.207 (RU/Russia/-), 5 distributed sshd attacks on
>> account [root] in the last 3600 secs; Ports: *; Direction: 1; Trigger:
>> LF_DISTATTACK; Logs: Oct 13 02:27:46 13144 sshd[12807]:
>> pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh
>> ruser= rhost=23.94.182.3 user=root Oct 13 02:27:49 13144 sshd[12807]:
>> Failed password for root from 23.94.182.3 port 56948 ssh2 Oct 13 03:14:59
>> 13144 sshd[17220]: pam_unix(sshd:auth): authentication failure; logname=
>> uid=0 euid=0 tty=ssh ruser= rhost=89.37.193.207 user=root Oct 13 03:15:01
>> 13144 sshd[17220]: Failed password for root from 89.37.193.207 port 34724
>> ssh2 Oct 13 02:28:26 13144 sshd[12878]: pam_unix(sshd:auth): authentication
>> failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.94.182.3 user=root
>> IP Addresses Blocked: 23.94.182.3 (US/United States/
>> 23-94-182-3-host.colocrossing.com)
>> *2025-10-13 08:14*.*Categories:* Brute-Force, SSH.
>> *Comment:* 2025-10-13T10:14:59.181747+02:00 psifactor
>> sshd-session[3471263]: Disconnected from authenticating user root
>> 89.37.193.207 port 56660 [preauth] … (mode: instant ban, root access or
>> sth similar)
>> *2025-10-13 08:11*.*Categories:* Brute-Force, SSH.
>> *Comment:* Oct 13 05:11:59 vidsell sshd[3316863]: Invalid user deploy
>> from 89.37.193.207 port 50940 Oct 13 05:11:59 vidsell sshd[3316863]:
>> Disconnected from invalid user deploy 89.37.193.207 port 50940 [preauth] …
>> *2025-10-13 07:51*.*Categories:* Brute-Force, SSH.
>> *Comment:* 2025-10-13T07:44:31.505422+00:00 scw-871879 sshd[1465195]:
>> Invalid user admin1234 from 89.37.193.207 port 49058
>> 2025-10-13T07:48:03.347868+00:00 scw-871879 sshd[1465551]: Invalid user
>> user from 89.37.193.207 port 48088 2025-10-13T07:49:12.616964+00:00
>> scw-871879 sshd[1465745]: Invalid user user14 from 89.37.193.207 port 53252
>> 2025-10-13T07:50:19.916176+00:00 scw-871879 sshd[1465784]: Invalid user
>> mark from 89.37.193.207 port 53178 2025-10-13T07:51:30.580945+00:00
>> scw-871879 sshd[1465885]: Invalid user dps from 89.37.193.207 port 38542 …
>> *2025-10-13 07:33*.*Categories:* Brute-Force, SSH.
>> *Comment:* 2025-10-13T07:23:51.487923+00:00 scw-871879 sshd[1463467]:
>> Invalid user denes from 89.37.193.207 port 51822
>> 2025-10-13T07:26:59.994943+00:00 scw-871879 sshd[1463604]: Invalid user
>> helen from 89.37.193.207 port 34988 2025-10-13T07:29:33.468343+00:00
>> scw-871879 sshd[1463718]: Invalid user kariman from 89.37.193.207 port
>> 55148 2025-10-13T07:30:42.140898+00:00 scw-871879 sshd[1463762]: Invalid
>> user deploy from 89.37.193.207 port 44838 2025-10-13T07:33:52.031023+00:00
>> scw-871879 sshd[1464046]: Invalid user holu from 89.37.193.207 port 45688
>> …
>> *2025-10-13 07:30*.*Categories:* Brute-Force, SSH.
>> *Comment:* 2025-10-13T09:24:07.169925+02:00 axisverse
>> sshd-session[3564307]: Invalid user denes from 89.37.193.207 port 34326
>> 2025-10-13T09:27:04.054740+02:00 axisverse sshd-session[3572021]: Invalid
>> user helen from 89.37.193.207 port 55078 2025-10-13T09:30:45.684764+02:00
>> axisverse sshd-session[3579520]: Invalid user deploy from 89.37.193.207
>> port 55294 …
>> *2025-10-13 07:30*.*Categories:* SSH.
>> *Comment:* SSH brute-force attempt detected by Fail2Ban
>> *2025-10-13 07:28*.*Categories:* Brute-Force, SSH.
>> *Comment:* (sshd) Failed SSH login from 89.37.193.207 (RU/Russia/-): 5
>> in the last 3600 secs; Ports: *; Direction: 1; Trigger: LF_SSHD; Logs: Oct
>> 13 02:24:23 9759 sshd[26791]: Invalid user denes from 89.37.193.207 port
>> 58012 Oct 13 02:24:25 9759 sshd[26791]: Failed password for invalid user
>> denes from 89.37.193.207 port 58012 ssh2 Oct 13 02:27:09 9759 sshd[27185]:
>> Invalid user helen from 89.37.193.207 port 53186 Oct 13 02:27:11 9759
>> sshd[27185]: Failed password for invalid user helen from 89.37.193.207 port
>> 53186 ssh2 Oct 13 02:28:27 9759 sshd[27282]: pam_unix(sshd:auth):
>> authentication failure; logname= uid=0 euid=0 tty=ssh ruser=
>> rhost=89.37.193.207 user=root
>> *2025-10-13 07:14*.*Categories:* Brute-Force, SSH.
>> *Comment:* SSH abuse or brute-force attack detected by Fail2Ban in ssh
>> jail
>> *2025-10-13 07:13*.*Categories:* Brute-Force, SSH.
>> *Comment:* 2025-10-13T07:08:41.819592+00:00 de-fsn1-sbc1 sshd[4054492]:
>> Invalid user arkserver from 89.37.193.207 port 50230
>> 2025-10-13T07:11:20.735865+00:00 de-fsn1-sbc1 sshd[4054509]: Invalid user
>> ftpuser from 89.37.193.207 port 48370 2025-10-13T07:13:56.776703+00:00
>> de-fsn1-sbc1 sshd[4054551]: Invalid user seafile from 89.37.193.207 port
>> 43776 …
>> *2025-10-13 07:12*.*Categories:* Brute-Force, SSH.
>> *Comment:* Oct 13 08:11:24 nervous-edison8 sshd[3729837]: Invalid user
>> ftpuser from 89.37.193.207 port 53928 Oct 13 08:11:24 nervous-edison8
>> sshd[3729837]: pam_unix(sshd:auth): authentication failure; logname= uid=0
>> euid=0 tty=ssh ruser= rhost=89.37.193.207 Oct 13 08:11:25 nervous-edison8
>> sshd[3729837]: Failed password for invalid user ftpuser from 89.37.193.207
>> port 53928 ssh2 Oct 13 08:12:43 nervous-edison8 sshd[3730403]:
>> pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh
>> ruser= rhost=89.37.193.207 user=root Oct 13 08:12:45 nervous-edison8
>> sshd[3730403]: Failed password for root from 89.37.193.207 port 38352 ssh2
>> …
>> *2025-10-13 07:12*.*Categories:* Brute-Force, SSH.
>> *Comment:* SG02-GC: SSH Brute Force from 89.37.193.207 at 2025-10-13
>> 12:42:20 IST
>> *2025-10-13 07:11*.*Categories:* Brute-Force, SSH.
>> *Comment:* $f2bV_matches
>> *2025-10-13 07:08*.*Categories:* SSH.
>> *Comment:* Fail2Ban SSH login block from 89.37.193.207
>> *2025-10-13 07:04*.*Categories:* DDoS Attack Participating, Ping
>> of Death, Web Spam, Email Spam, Brute-Force, Bad Web Bot, SSH.
>> *Comment:* Oct 13 09:00:43 v2202301167543214332 sshd[1313515]: Failed
>> password for invalid user botuser from 89.37.193.207 port 33280 ssh2 Oct 13
>> 09:02:22 v2202301167543214332 sshd[1313534]: pam_unix(sshd:auth):
>> authentication failure; logname= uid=0 euid=0 tty=ssh ruser=
>> rhost=89.37.193.207 user=root Oct 13 09:02:24 v2202301167543214332
>> sshd[1313534]: Failed password for root from 89.37.193.207 port 58908 ssh2
>> Oct 13 09:04:03 v2202301167543214332 sshd[1313541]: pam_unix(sshd:auth):
>> authentication failure; logname= uid=0 euid=0 tty=ssh ruser=
>> rhost=89.37.193.207 user=root Oct 13 09:04:05 v2202301167543214332
>> sshd[1313541]: Failed password for root from 89.37.193.207 port 54548 ssh2
>> …
>> *2025-10-13 06:47*.*Categories:* DDoS Attack Participating, Ping
>> of Death, Web Spam, Email Spam, Brute-Force, Bad Web Bot, SSH.
>> *Comment:* Oct 13 08:46:12 v2202301167543214332 sshd[1313318]: Invalid
>> user frappe from 89.37.193.207 port 47288 Oct 13 08:46:12
>> v2202301167543214332 sshd[1313318]: pam_unix(sshd:auth): authentication
>> failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=89.37.193.207 Oct 13
>> 08:46:12 v2202301167543214332 sshd[1313318]: Invalid user frappe from
>> 89.37.193.207 port 47288 Oct 13 08:46:14 v2202301167543214332
>> sshd[1313318]: Failed password for invalid user frappe from 89.37.193.207
>> port 47288 ssh2 Oct 13 08:47:49 v2202301167543214332 sshd[1313338]: Invalid
>> user vpn from 89.37.193.207 port 46024 …
>> *2025-10-13 06:31*.*Categories:* DDoS Attack Participating, Ping
>> of Death, Web Spam, Email Spam, Brute-Force, Bad Web Bot, SSH.
>> *Comment:* Oct 13 08:28:22 v2202301167543214332 sshd[1312971]: Failed
>> password for root from 89.37.193.207 port 58986 ssh2 Oct 13 08:29:58
>> v2202301167543214332 sshd[1312978]: pam_unix(sshd:auth): authentication
>> failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=89.37.193.207 user=root
>> Oct 13 08:30:00 v2202301167543214332 sshd[1312978]: Failed password for
>> root from 89.37.193.207 port 45548 ssh2 Oct 13 08:31:38
>> v2202301167543214332 sshd[1313005]: pam_unix(sshd:auth): authentication
>> failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=89.37.193.207 user=root
>> Oct 13 08:31:40 v2202301167543214332 sshd[1313005]: Failed password for
>> root from 89.37.193.207 port 39816 ssh2 …
>> *2025-10-13 06:20*.*Categories:* Brute-Force.
>> *Comment:* Oct 13 06:19:00 bud01-01-vpn sshd[183862]: Failed password
>> for root from 89.37.193.207 port 36208 ssh2 Oct 13 06:20:33 bud01-01-vpn
>> sshd[183919]: pam_unix(sshd:auth): authentication failure; logname= uid=0
>> euid=0 tty=ssh ruser= rhost=89.37.193.207 user=root Oct 13 06:20:35
>> bud01-01-vpn sshd[183919]: Failed password for root from 89.37.193.207 port
>> 40940 ssh2 …
>> *2025-10-13 06:14*.*Categories:* DDoS Attack Participating, Ping
>> of Death, Web Spam, Email Spam, Brute-Force, Bad Web Bot, SSH.
>> *Comment:* Oct 13 08:11:12 v2202301167543214332 sshd[1312798]: Failed
>> password for root from 89.37.193.207 port 45456 ssh2 Oct 13 08:12:38
>> v2202301167543214332 sshd[1312817]: pam_unix(sshd:auth): authentication
>> failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=89.37.193.207 user=root
>> Oct 13 08:12:40 v2202301167543214332 sshd[1312817]: Failed password for
>> root from 89.37.193.207 port 43508 ssh2 Oct 13 08:14:02
>> v2202301167543214332 sshd[1312821]: pam_unix(sshd:auth): authentication
>> failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=89.37.193.207 user=root
>> Oct 13 08:14:04 v2202301167543214332 sshd[1312821]: Failed password for
>> root from 89.37.193.207 port 51420 ssh2 …
>> *2025-10-13 06:13*.*Categories:* Brute-Force, SSH.
>> *Comment:* (sshd) Failed SSH login from 89.37.193.207 (RU/Russia/-): 10
>> in the last 3600 secs
>> *2025-10-13 06:13*.*Categories:* Brute-Force.
>> *Comment:* [sshd] (D1_AjieDevAIO-IP-126) Fail2Ban Jail: sshd auto-report
>> *2025-10-13 06:10*.*Categories:* Brute-Force, SSH.
>> *Comment:* 2025-10-13T06:09:02.631165+00:00 edge-con-sao01.int.pdx.net.uk
>> sshd[1525991]: Failed password for root from 89.37.193.207 port 57724 ssh2
>> 2025-10-13T06:10:25.253561+00:00 edge-con-sao01.int.pdx.net.uk
>> sshd[1526413]: pam_unix(sshd:auth): authentication failure; logname= uid=0
>> euid=0 tty=ssh ruser= rhost=89.37.193.207 user=root
>> 2025-10-13T06:10:27.031197+00:00 edge-con-sao01.int.pdx.net.uk
>> sshd[1526413]: Failed password for root from 89.37.193.207 port 35438 ssh2
>> …
>> *2025-10-13 06:10*.*Categories:* Brute-Force, SSH.
>> *Comment:* 2025-10-13T06:06:14.169430+00:00 eu-north-sto1 sshd[1074416]:
>> Disconnected from authenticating user root 89.37.193.207 port 45108
>> [preauth] 2025-10-13T06:09:00.478611+00:00 eu-north-sto1 sshd[1083926]:
>> Disconnected from authenticating user root 89.37.193.207 port 44486
>> [preauth] 2025-10-13T06:10:24.901949+00:00 eu-north-sto1 sshd[1089088]:
>> Disconnected from authenticating user root 89.37.193.207 port 49004
>> [preauth] …
>> *2025-10-13 06:08*.*Categories:* Brute-Force, SSH.
>> *Comment:* 89.37.193.207 (RU/Russia/-), 5 distributed sshd attacks on
>> account [root] in the last 3600 secs; Ports: *; Direction: 1; Trigger:
>> LF_DISTATTACK; Logs: Oct 13 00:57:51 14499 sshd[12114]:
>> pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh
>> ruser= rhost=152.32.163.183 user=root Oct 13 00:57:54 14499 sshd[12114]:
>> Failed password for root from 152.32.163.183 port 53050 ssh2 Oct 13
>> 01:07:50 14499 sshd[13056]: pam_unix(sshd:auth): authentication failure;
>> logname= uid=0 euid=0 tty=ssh ruser= rhost=89.37.193.207 user=root Oct 13
>> 01:05:33 14499 sshd[12888]: pam_unix(sshd:auth): authentication failure;
>> logname= uid=0 euid=0 tty=ssh ruser= rhost=119.96.191.166 user=root Oct 13
>> 01:05:35 14499 sshd[12888]: Failed password for root from 119.96.191.166
>> port 59978 ssh2 IP Addresses Blocked: 152.32.163.183 (VN/Vietnam/-)
>> *2025-10-13 05:51*.*Categories:* Brute-Force, SSH.
>> *Comment:* Oct 13 05:48:46 webundsoshit sshd[3550224]:
>> pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh
>> ruser= rhost=89.37.193.207 user=root Oct 13 05:48:47 webundsoshit
>> sshd[3550224]: Failed password for root from 89.37.193.207 port 38486 ssh2
>> Oct 13 05:49:57 webundsoshit sshd[3550430]: pam_unix(sshd:auth):
>> authentication failure; logname= uid=0 euid=0 tty=ssh ruser=
>> rhost=89.37.193.207 user=root Oct 13 05:49:59 webundsoshit sshd[3550430]:
>> Failed password for root from 89.37.193.207 port 51360 ssh2 Oct 13 05:51:11
>> webundsoshit sshd[3550744]: Invalid user deploy from 89.37.193.207 port
>> 40280 …
>> *2025-10-13 05:23*.*Categories:* Brute-Force, SSH.
>> *Comment:* Oct 13 05:21:58 webundsoshit sshd[3544787]:
>> pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh
>> ruser= rhost=89.37.193.207 Oct 13 05:22:00 webundsoshit sshd[3544787]:
>> Failed password for invalid user bigdata from 89.37.193.207 port 40826 ssh2
>> Oct 13 05:23:14 webundsoshit sshd[3545107]: Invalid user newuser1 from
>> 89.37.193.207 port 35244 Oct 13 05:23:14 webundsoshit sshd[3545107]:
>> pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh
>> ruser= rhost=89.37.193.207 Oct 13 05:23:16 webundsoshit sshd[3545107]:
>> Failed password for invalid user newuser1 from 89.37.193.207 port 35244
>> ssh2 …
>> *2025-10-13 05:22*.*Categories:* Brute-Force, SSH.
>> *Comment:* (sshd) Failed SSH login from 89.37.193.207 (RU/Russia/-): 5
>> in the last 3600 secs; Ports: *; Direction: 1; Trigger: LF_SSHD; Logs: Oct
>> 13 00:18:49 21567 sshd[31938]: pam_unix(sshd:auth): authentication failure;
>> logname= uid=0 euid=0 tty=ssh ruser= rhost=89.37.193.207 user=root Oct 13
>> 00:18:51 21567 sshd[31938]: Failed password for root from 89.37.193.207
>> port 50966 ssh2 Oct 13 00:21:27 21567 sshd[32160]: Invalid user bigdata
>> from 89.37.193.207 port 53226 Oct 13 00:21:29 21567 sshd[32160]: Failed
>> password for invalid user bigdata from 89.37.193.207 port 53226 ssh2 Oct 13
>> 00:22:46 21567 sshd[32593]: Invalid user newuser1 from 89.37.193.207 port
>> 51166
>> *2025-10-13 05:21*.*Categories:* Brute-Force, SSH.
>> *Comment:* Oct 12 23:21:51 b146-17 sshd[1443617]: Invalid user bigdata
>> from 89.37.193.207 port 33630 Oct 12 23:21:51 b146-17 sshd[1443617]:
>> pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh
>> ruser= rhost=89.37.193.207 Oct 12 23:21:53 b146-17 sshd[1443617]: Failed
>> password for invalid user bigdata from 89.37.193.207 port 33630 ssh2 …
>> *2025-10-13 04:36*.*Categories:* Brute-Force, SSH.
>> *Comment:* (sshd) Failed SSH login from 89.37.193.207 (AE/United Arab
>> Emirates/-)
>> *2025-10-13 04:32*.*Categories:* Brute-Force, SSH.
>> *Comment:* (sshd) Failed SSH login from 89.37.193.207 (RU/Russia/-): 5
>> in the last 3600 secs; Ports: *; Direction: 1; Trigger: LF_SSHD; Logs: Oct
>> 12 23:29:09 17911 sshd[11923]: Invalid user eliot from 89.37.193.207 port
>> 59440 Oct 12 23:29:10 17911 sshd[11923]: Failed password for invalid user
>> eliot from 89.37.193.207 port 59440 ssh2 Oct 12 23:30:54 17911 sshd[12120]:
>> pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh
>> ruser= rhost=89.37.193.207 user=root Oct 12 23:30:57 17911 sshd[12120]:
>> Failed password for root from 89.37.193.207 port 46058 ssh2 Oct 12 23:32:09
>> 17911 sshd[12326]: pam_unix(sshd:auth): authentication failure; logname=
>> uid=0 euid=0 tty=ssh ruser= rhost=89.37.193.207 user=root
>> *2025-10-13 04:30*.*Categories:* Brute-Force, SSH.
>> *Comment:* 2025-10-13T06:28:30.638277+02:00 games.mrejata.eu
>> sshd[545772]: Failed password for invalid user eliot from 89.37.193.207
>> port 56124 ssh2 2025-10-13T06:30:42.373214+02:00 games.mrejata.eu
>> sshd[545780]: pam_unix(sshd:auth): authentication failure; logname= uid=0
>> euid=0 tty=ssh ruser= rhost=89.37.193.207 user=root
>> 2025-10-13T06:30:44.592754+02:00 games.mrejata.eu sshd[545780]: Failed
>> password for root from 89.37.193.207 port 34870 ssh2 …
>> *2025-10-13 04:30*.*Categories:* Brute-Force, SSH.
>> *Comment:* Fail2Ban: activité malveillante détectée (jail: sshd)
>> *2025-10-13 04:01*.*Categories:* Brute-Force, SSH.
>> *Comment:* 2025-10-12T22:54:56.304496-05:00 instance-20240522-152753
>> sshd[1174946]: Invalid user zs from 89.37.193.207 port 56480
>> 2025-10-12T22:57:28.731436-05:00 instance-20240522-152753 sshd[1175038]:
>> Invalid user adminuser from 89.37.193.207 port 39926
>> 2025-10-12T22:58:45.512430-05:00 instance-20240522-152753 sshd[1175062]:
>> Invalid user abe from 89.37.193.207 port 34202
>> 2025-10-12T23:01:13.439381-05:00 instance-20240522-152753 sshd[1175622]:
>> Invalid user dat from 89.37.193.207 port 36582 …
>> *2025-10-13 03:50*.*Categories:* Brute-Force, SSH.
>> *Comment:* 2025-10-13T03:51:19.757629+00:00 prod-westeu sshd[2607551]:
>> Invalid user spike from 89.37.193.207 port 36332
>> 2025-10-13T03:51:19.761747+00:00 prod-westeu sshd[2607551]:
>> pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh
>> ruser= rhost=89.37.193.207 2025-10-13T03:51:21.916076+00:00 prod-westeu
>> sshd[2607551]: Failed password for invalid user spike from 89.37.193.207
>> port 36332 ssh2 …
>> *2025-10-13 03:45*.*Categories:* SSH.
>> *Comment:* Attempts to access SSH server with wrong credentials
>> *2025-10-13 03:44*.*Categories:* Brute-Force, SSH.
>> *Comment:* 2025-10-12T22:39:25.215494-05:00 instance-20240522-152753
>> sshd[1174004]: Invalid user add from 89.37.193.207 port 36906
>> 2025-10-12T22:41:34.369775-05:00 instance-20240522-152753 sshd[1174099]:
>> Invalid user casino from 89.37.193.207 port 60258
>> 2025-10-12T22:42:51.042074-05:00 instance-20240522-152753 sshd[1174128]:
>> Invalid user ram from 89.37.193.207 port 41632
>> 2025-10-12T22:44:07.258418-05:00 instance-20240522-152753 sshd[1174177]:
>> Invalid user spring from 89.37.193.207 port 58056 …
>> *2025-10-13 03:42*.*Categories:* Brute-Force, SSH.
>> *Comment:* (sshd) Failed SSH login from 89.37.193.207 (RU/Russia/-): 5
>> in the last 3600 secs; Ports: *; Direction: 1; Trigger: LF_SSHD; Logs: Oct
>> 12 22:37:54 14020 sshd[17779]: Invalid user add from 89.37.193.207 port
>> 60594 Oct 12 22:37:56 14020 sshd[17779]: Failed password for invalid user
>> add from 89.37.193.207 port 60594 ssh2 Oct 12 22:41:05 14020 sshd[18131]:
>> Invalid user casino from 89.37.193.207 port 51232 Oct 12 22:41:07 14020
>> sshd[18131]: Failed password for invalid user casino from 89.37.193.207
>> port 51232 ssh2 Oct 12 22:42:21 14020 sshd[18223]: Invalid user ram from
>> 89.37.193.207 port 51670
>> *2025-10-13 03:27*.*Categories:* Brute-Force, SSH.
>> *Comment:* Oct 13 06:26:03 www7 sshd[2936448]: Invalid user yoga from
>> 89.37.193.207 port 40622 Oct 13 06:26:06 www7 sshd[2936448]: Failed
>> password for invalid user yoga from 89.37.193.207 port 40622 ssh2 Oct 13
>> 06:27:15 www7 sshd[2936515]: Invalid user loc from 89.37.193.207 port 45646
>> …
>> *2025-10-13 03:20*.*Categories:* Brute-Force, SSH.
>> *Comment:* SSH Brute force: 55 attempts were recorded from 89.37.193.207
>> 2025-10-13T03:52:41+02:00 Invalid user vpn from 89.37.193.207 port 51274
>> 2025-10-13T03:56:00+02:00 Invalid user lu from 89.37.193.207 port 57956
>> 2025-10-13T03:57:29+02:00 Invalid user ubuntu from 89.37.193.207 port 33686
>> 2025-10-13T03:59:02+02:00 Invalid user readonly from 89.37.193.207 port
>> 47532 2025-10-13T04:00:30+02:00 Invalid user ubuntu from 89.37.193.207 port
>> 36710 2025-10-13T04:01:59+02:00 Invalid user scpuser from 89.37.193.207
>> port 47022 2025-10-13T04:03:30+02:00 Disconnected from authenticating user
>> root 89.37.193.207 port 35386 [preauth] 2025-10-13T04:05:01+02:00 Invalid
>> user penis from 89.37.193.207 port 56820 2025-10-13T04:06:28+02:00
>> Disconnected from authenticating user root 89.37.193.207 port 33826
>> [preauth] 2025-10-13T04:07:53+02:00 Invalid user vaibhav from 89.37.193.207
>> port 54540 2025-10-13T04:09:25+02:00
>> *2025-10-13 03:10*.*Categories:* Brute-Force, SSH.
>> *Comment:* Oct 13 06:09:39 www7 sshd[2935471]: Invalid user tester from
>> 89.37.193.207 port 57780 Oct 13 06:09:41 www7 sshd[2935471]: Failed
>> password for invalid user tester from 89.37.193.207 port 57780 ssh2 Oct 13
>> 06:10:47 www7 sshd[2935577]: Invalid user braga from 89.37.193.207 port
>> 42086 …
>> *2025-10-13 02:59*.*Categories:* Brute-Force, SSH.
>> *Comment:* 2025-10-13T02:55:53.081765+00:00 Linux04 sshd[3202249]:
>> Invalid user gavin from 89.37.193.207 port 45046
>> 2025-10-13T02:55:53.086273+00:00 Linux04 sshd[3202249]:
>> pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh
>> ruser= rhost=89.37.193.207 2025-10-13T02:55:55.305639+00:00 Linux04
>> sshd[3202249]: Failed password for invalid user gavin from 89.37.193.207
>> port 45046 ssh2 2025-10-13T02:57:02.352056+00:00 Linux04 sshd[3205697]:
>> Invalid user ftpuser from 89.37.193.207 port 39812
>> 2025-10-13T02:57:02.353949+00:00 Linux04 sshd[3205697]:
>> pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh
>> ruser= rhost=89.37.193.207 2025-10-13T02:57:04.045635+00:00 Linux04
>> sshd[3205697]: Failed password for invalid user ftpuser from 89.37.193.207
>> port 39812 ssh2 2025-10-13T02:58:10.885953+00:00 Linux04 sshd[3208817]:
>> Invalid user fox from 89.37.193.207 port 45592
>> 2025-10-13T02:58:10.887771+00:00 Linux04 sshd[3208817]:
>> pam_unix(sshd:auth): authentication failure; logn …
>> *2025-10-13 02:57*.*Categories:* Brute-Force, SSH.
>> *Comment:* [Fail2Ban:sshd-spray] …
>> *2025-10-13 02:55*.*Categories:* Brute-Force, SSH.
>> *Comment:* Oct 13 03:54:35 server sshd[3243695]: Failed password for
>> root from 89.37.193.207 port 39662 ssh2 Oct 13 03:55:49 server
>> sshd[3243851]: Invalid user gavin from 89.37.193.207 port 41888 Oct 13
>> 03:55:49 server sshd[3243851]: pam_unix(sshd:auth): authentication failure;
>> logname= uid=0 euid=0 tty=ssh ruser= rhost=89.37.193.207 Oct 13 03:55:49
>> server sshd[3243851]: Invalid user gavin from 89.37.193.207 port 41888 Oct
>> 13 03:55:52 server sshd[3243851]: Failed password for invalid user gavin
>> from 89.37.193.207 port 41888 ssh2 …
>> *2025-10-13 02:55*.*Categories:* Brute-Force, SSH.
>> *Comment:* (sshd) Failed SSH login from 89.37.193.207 (RU/Russia/-): 5
>> in the last 3600 secs; Ports: *; Direction: 1; Trigger: LF_SSHD; Logs: Oct
>> 13 02:51:04 23953 sshd[14586]: Invalid user gits from 89.37.193.207 port
>> 46974 Oct 13 02:51:06 23953 sshd[14586]: Failed password for invalid user
>> gits from 89.37.193.207 port 46974 ssh2 Oct 13 02:54:04 23953 sshd[14825]:
>> pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh
>> ruser= rhost=89.37.193.207 user=root Oct 13 02:54:06 23953 sshd[14825]:
>> Failed password for root from 89.37.193.207 port 56406 ssh2 Oct 13 02:55:22
>> 23953 sshd[14919]: Invalid user gavin from 89.37.193.207 port 41504
>> *2025-10-13 02:54*.*Categories:* Brute-Force, SSH.
>> *Comment:* Oct 13 05:51:22 www7 sshd[2933953]: Failed password for
>> invalid user gits from 89.37.193.207 port 47604 ssh2 Oct 13 05:54:09 www7
>> sshd[2934051]: pam_unix(sshd:auth): authentication failure; logname= uid=0
>> euid=0 tty=ssh ruser= rhost=89.37.193.207 user=root Oct 13 05:54:11 www7
>> sshd[2934051]: Failed password for root from 89.37.193.207 port 57198 ssh2
>> …
>> *2025-10-13 02:53*.*Categories:* SSH.
>> *Comment:* SSH bruteforce
>> *2025-10-13 01:56*.*Categories:* Brute-Force, SSH.
>> *Comment:* Brute-force SSH server detected by Fail2ban
>> *2025-10-13 01:56*.*Categories:* Brute-Force, SSH.
>> *Comment:* 2025-10-13T01:53:38.581194+00:00
>> backup-309171561-ubuntu-4gb-fsn1-1 sshd[1745537]: pam_unix(sshd:auth):
>> authentication failure; logname= uid=0 euid=0 tty=ssh ruser=
>> rhost=89.37.193.207 2025-10-13T01:53:40.716151+00:00
>> backup-309171561-ubuntu-4gb-fsn1-1 sshd[1745537]: Failed password for
>> invalid user vpn from 89.37.193.207 port 50922 ssh2
>> 2025-10-13T01:56:22.373962+00:00 backup-309171561-ubuntu-4gb-fsn1-1
>> sshd[1745588]: Invalid user lu from 89.37.193.207 port 34704 …
>> *2025-10-13 01:52*.*Categories:* Brute-Force, SSH.
>> *Comment:* 2025-10-13T09:52:48.622280+08:00 pbs sshd[3823865]:
>> pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh
>> ruser= rhost=89.37.193.207 2025-10-13T09:52:50.225618+08:00 pbs
>> sshd[3823865]: Failed password for invalid user vpn from 89.37.193.207 port
>> 45778 ssh2 …
>> *2025-10-13 01:25*.*Categories:* Brute-Force.
>> *Comment:* Brute force attempt — 3 login attempts (3 failed)
>> *2025-10-13 01:20*.*Categories:* Port Scan, Brute-Force, SSH.
>> *Comment:* Unauthorized connection attempt detected, SSH Brute-Force
>> *2025-10-13 01:07*.*Categories:* Brute-Force, SSH.
>> *Comment:* 2025-10-13T02:58:21.699546+02:00 misaka-vm-s3n-2c4g-ber
>> sshd[2832483]: Invalid user deploy from 89.37.193.207 port 49578
>> 2025-10-13T03:03:19.835692+02:00 misaka-vm-s3n-2c4g-ber sshd[2832534]:
>> Invalid user vpn from 89.37.193.207 port 48866
>> 2025-10-13T03:07:31.491050+02:00 misaka-vm-s3n-2c4g-ber sshd[2832550]:
>> Invalid user hadi from 89.37.193.207 port 45386 …
>> *2025-10-13 01:04*.*Categories:* Brute-Force, SSH.
>> *Comment:* (sshd) Failed SSH login from 89.37.193.207 (RU/Russia/-): 5
>> in the last 3600 secs; Ports: *; Direction: 1; Trigger: LF_SSHD; Logs: Oct
>> 12 20:01:37 13593 sshd[28991]: Invalid user deploy from 89.37.193.207 port
>> 36494 Oct 12 20:01:40 13593 sshd[28991]: Failed password for invalid user
>> deploy from 89.37.193.207 port 36494 ssh2 Oct 12 20:03:07 13593
>> sshd[29134]: pam_unix(sshd:auth): authentication failure; logname= uid=0
>> euid=0 tty=ssh ruser= rhost=89.37.193.207 user=root Oct 12 20:03:09 13593
>> sshd[29134]: Failed password for root from 89.37.193.207 port 33058 ssh2
>> Oct 12 20:04:24 13593 sshd[29211]: Invalid user vpn from 89.37.193.207 port
>> 42844
>> *2025-10-13 01:04*.*Categories:* Brute-Force, SSH.
>> *Comment:* 2025-10-13T01:03:04.879144+00:00 my-vps sshd[1452850]:
>> pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh
>> ruser= rhost=89.37.193.207 user=root 2025-10-13T01:03:06.498186+00:00
>> my-vps sshd[1452850]: Failed password for root from 89.37.193.207 port
>> 37404 ssh2 2025-10-13T01:04:22.604149+00:00 my-vps sshd[1452854]: Invalid
>> user vpn from 89.37.193.207 port 49358 2025-10-13T01:04:22.606953+00:00
>> my-vps sshd[1452854]: pam_unix(sshd:auth): authentication failure; logname=
>> uid=0 euid=0 tty=ssh ruser= rhost=89.37.193.207
>> 2025-10-13T01:04:24.265715+00:00 my-vps sshd[1452854]: Failed password for
>> invalid user vpn from 89.37.193.207 port 49358 ssh2 …
>> *2025-10-13 01:03*.*Categories:* Brute-Force, SSH.
>> *Comment:* 2025-10-13T03:02:40.728838+02:00 marvibiene sshd[695287]:
>> pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh
>> ruser= rhost=89.37.193.207 user=root 2025-10-13T03:02:42.387200+02:00
>> marvibiene sshd[695287]: Failed password for root from 89.37.193.207 port
>> 58972 ssh2 2025-10-13T03:03:56.785226+02:00 marvibiene sshd[695746]:
>> Invalid user vpn from 89.37.193.207 port 50224
>> 2025-10-13T03:03:56.787163+02:00 marvibiene sshd[695746]:
>> pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh
>> ruser= rhost=89.37.193.207 2025-10-13T03:03:58.546137+02:00 marvibiene
>> sshd[695746]: Failed password for invalid user vpn from 89.37.193.207 port
>> 50224 ssh2
>> *2025-10-13 01:03*.*Categories:* Brute-Force, SSH.
>> *Comment:* SSH Brute Force Attack from 89.37.193.207 Threat Details: —
>> Type: SSH Brute Force Attack — Target Service: sshd-aggressive — Target
>> Server: insightvm — Detection Time: 2025-10-13 03:03:04 — Source Country:
>> United Arab Emirates — Source ISP: ABCVG — Reverse DNS: Description:
>> Automated SSH login attempts detected from this IP address
>> *2025-10-13 01:02*.*Categories:* Brute-Force, SSH.
>> *Comment:* Oct 13 00:59:03 v4bgp sshd[602510]: Failed password for
>> invalid user deploy from 89.37.193.207 port 42460 ssh2 Oct 13 01:02:17
>> v4bgp sshd[602617]: pam_unix(sshd:auth): authentication failure; logname=
>> uid=0 euid=0 tty=ssh ruser= rhost=89.37.193.207 user=root Oct 13 01:02:19
>> v4bgp sshd[602617]: Failed password for root from 89.37.193.207 port 47170
>> ssh2 …
>> *2025-10-13 00:09*.*Categories:* Brute-Force, SSH.
>> *Comment:* 2025-10-13T00:03:28.245250+00:00 edge-con-sjc01.int.pdx.net.uk
>> sshd[2269718]: pam_unix(sshd:auth): authentication failure; logname= uid=0
>> euid=0 tty=ssh ruser= rhost=89.37.193.207 2025-10-13T00:03:30.611667+00:00
>> edge-con-sjc01.int.pdx.net.uk sshd[2269718]: Failed password for invalid
>> user debian from 89.37.193.207 port 59238 ssh2
>> 2025-10-13T00:09:08.136277+00:00 edge-con-sjc01.int.pdx.net.uk
>> sshd[2272840]: Invalid user user3 from 89.37.193.207 port 42708 …
>> *2025-10-13 00:06*.*Categories:* Brute-Force, SSH.
>> *Comment:* SSH brute force
>> *2025-10-13 00:05*.*Categories:* Brute-Force.
>> *Comment:* SSH brute force attack detected: 5 failed attempts
>> *2025-10-13 00:03*.*Categories:* Brute-Force, SSH.
>> *Comment:* 89.37.193.207 (RU/Russia/-), 5 distributed sshd attacks on
>> account [debian] in the last 3600 secs; Ports: *; Direction: 1; Trigger:
>> LF_DISTATTACK; Logs: Oct 12 19:03:28 13301 sshd[6558]: Invalid user debian
>> from 202.148.55.168 port 36244 Oct 12 19:02:53 13301 sshd[6370]: Invalid
>> user debian from 78.47.144.126 port 38616 Oct 12 19:02:01 13301 sshd[6128]:
>> Invalid user debian from 89.37.193.207 port 52298 Oct 12 19:02:02 13301
>> sshd[6128]: Failed password for invalid user debian from 89.37.193.207 port
>> 52298 ssh2 Oct 12 19:02:56 13301 sshd[6370]: Failed password for invalid
>> user debian from 78.47.144.126 port 38616 ssh2 IP Addresses Blocked:
>> 202.148.55.168 (NL/The Netherlands/-) 78.47.144.126 (DE/Germany/
>> static.126.144.47.78.clients.your-server.de)
>> Please go to the InterLIR Portal Abuses page
>>
>> for more information and *confirm* resolving the abuse.
>> *Note:* if the abuse complaint is old and the problem has already been
>> resolved, please *confirm* this in the dashboard.
>> Have any question so far? Visit InterLIR Support
>>
>> or contact us
>> .
>>
>> Thanks,
>> InterLIR
>> InterLIR GmbH, Berlin
>>
>
