#Fri Oct 16 23:25:01 UTC 2026 hecnet-us-east-gw.duckdns.org #9b7804d8f56f8b82cfaa0bee18793ad4 /tmp/f2bbl-temp 20.211.90.37 #lighttpd-scans|1791329230|172800|1|{"matches": [["", "Oct 6 23:27:07", " hecnet-us-east-gw lighttpd[1017]: 20.211.90.37 hecnet-us-east-gw.duckdns.org - [06/Oct/2026:23:27:07 +0000] \"GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1\" 404 341 \"-\" \"-\""], "Oct 6 23:27:07 hecnet-us-east-gw lighttpd[1017]: 20.211.90.37 hecnet-us-east-gw.duckdns.org - [06/Oct/2026:23:27:07 +0000] \"GET /this_is_a_new_hello_world.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 6 23:27:08 hecnet-us-east-gw lighttpd[1017]: 20.211.90.37 hecnet-us-east-gw.duckdns.org - [06/Oct/2026:23:27:08 +0000] \"GET /go.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 6 23:27:08 hecnet-us-east-gw lighttpd[1017]: 20.211.90.37 hecnet-us-east-gw.duckdns.org - [06/Oct/2026:23:27:08 +0000] \"GET /1ac.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 6 23:27:09 hecnet-us-east-gw lighttpd[1017]: 20.211.90.37 hecnet-us-east-gw.duckdns.org - [06/Oct/2026:23:27:09 +0000] \"GET /flm.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 6 23:27:09 hecnet-us-east-gw lighttpd[1017]: 20.211.90.37 hecnet-us-east-gw.duckdns.org - [06/Oct/2026:23:27:09 +0000] \"GET /40341.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 6 23:27:10 hecnet-us-east-gw lighttpd[1017]: 20.211.90.37 hecnet-us-east-gw.duckdns.org - [06/Oct/2026:23:27:10 +0000] \"GET /wp-log.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 6 23:27:10 hecnet-us-east-gw lighttpd[1017]: 20.211.90.37 hecnet-us-east-gw.duckdns.org - [06/Oct/2026:23:27:10 +0000] \"GET /wp-mails.php HTTP/1.1\" 404 341 \"-\" \"-\""], "failures": 8, "ip4": "20.211.90.37"} 34.38.201.69 #sshd|1791340862|172800|1|{"matches": ["Oct 7 02:40:57 hecnet-us-east-gw sshd[2336439]: Invalid user admin from 34.38.201.69 port 29162", "Oct 7 02:40:59 hecnet-us-east-gw sshd[2336439]: Failed none for invalid user admin from 34.38.201.69 port 29162 ssh2", "Oct 7 02:41:02 hecnet-us-east-gw sshd[2336439]: Failed password for invalid user admin from 34.38.201.69 port 29162 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2336439]: ", "ip4": "34.38.201.69", "users": "['admin']", "user": "admin"} 20.213.164.196 #lighttpd-scans|1791343917|172800|1|{"matches": [["", "Oct 7 03:31:49", " hecnet-us-east-gw lighttpd[1017]: 20.213.164.196 impvax.duckdns.org - [07/Oct/2026:03:31:48 +0000] \"GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1\" 404 341 \"-\" \"-\""], "Oct 7 03:31:49 hecnet-us-east-gw lighttpd[1017]: 20.213.164.196 impvax.duckdns.org - [07/Oct/2026:03:31:49 +0000] \"GET /this_is_a_new_hello_world.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 7 03:31:50 hecnet-us-east-gw lighttpd[1017]: 20.213.164.196 impvax.duckdns.org - [07/Oct/2026:03:31:50 +0000] \"GET /ops.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 7 03:31:51 hecnet-us-east-gw lighttpd[1017]: 20.213.164.196 impvax.duckdns.org - [07/Oct/2026:03:31:51 +0000] \"GET /mac.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 7 03:31:51 hecnet-us-east-gw lighttpd[1017]: 20.213.164.196 impvax.duckdns.org - [07/Oct/2026:03:31:51 +0000] \"GET /aboutt.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 7 03:31:52 hecnet-us-east-gw lighttpd[1017]: 20.213.164.196 impvax.duckdns.org - [07/Oct/2026:03:31:52 +0000] \"GET /tesla.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 7 03:31:54 hecnet-us-east-gw lighttpd[1017]: 20.213.164.196 impvax.duckdns.org - [07/Oct/2026:03:31:54 +0000] \"GET /zoo2.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 7 03:31:57 hecnet-us-east-gw lighttpd[1017]: 20.213.164.196 impvax.duckdns.org - [07/Oct/2026:03:31:57 +0000] \"GET /x2.php HTTP/1.1\" 404 341 \"-\" \"-\""], "failures": 8, "ip4": "20.213.164.196"} 13.70.107.184 #lighttpd-scans|1791345321|172800|1|{"matches": [["", "Oct 7 03:55:18", " hecnet-us-east-gw lighttpd[1017]: 13.70.107.184 hecnet-us-east-gw.duckdns.org - [07/Oct/2026:03:55:18 +0000] \"GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1\" 404 341 \"-\" \"-\""], "Oct 7 03:55:18 hecnet-us-east-gw lighttpd[1017]: 13.70.107.184 hecnet-us-east-gw.duckdns.org - [07/Oct/2026:03:55:18 +0000] \"GET /this_is_a_new_hello_world.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 7 03:55:19 hecnet-us-east-gw lighttpd[1017]: 13.70.107.184 hecnet-us-east-gw.duckdns.org - [07/Oct/2026:03:55:18 +0000] \"GET /dodo.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 7 03:55:19 hecnet-us-east-gw lighttpd[1017]: 13.70.107.184 hecnet-us-east-gw.duckdns.org - [07/Oct/2026:03:55:19 +0000] \"GET /x.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 7 03:55:19 hecnet-us-east-gw lighttpd[1017]: 13.70.107.184 hecnet-us-east-gw.duckdns.org - [07/Oct/2026:03:55:19 +0000] \"GET /go.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 7 03:55:20 hecnet-us-east-gw lighttpd[1017]: 13.70.107.184 hecnet-us-east-gw.duckdns.org - [07/Oct/2026:03:55:20 +0000] \"GET /wp-fgban13jx3.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 7 03:55:20 hecnet-us-east-gw lighttpd[1017]: 13.70.107.184 hecnet-us-east-gw.duckdns.org - [07/Oct/2026:03:55:20 +0000] \"GET /1ac.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 7 03:55:21 hecnet-us-east-gw lighttpd[1017]: 13.70.107.184 hecnet-us-east-gw.duckdns.org - [07/Oct/2026:03:55:20 +0000] \"GET /flm.php HTTP/1.1\" 404 341 \"-\" \"-\""], "failures": 8, "ip4": "13.70.107.184"} 175.6.146.164 #sshd|1791346114|172800|1|{"matches": ["Oct 7 04:08:28 hecnet-us-east-gw sshd[2337104]: User root from 175.6.146.164 not allowed because not listed in AllowUsers", "Oct 7 04:08:31 hecnet-us-east-gw sshd[2337104]: Failed none for invalid user root from 175.6.146.164 port 37276 ssh2", "Oct 7 04:08:34 hecnet-us-east-gw sshd[2337104]: Failed password for invalid user root from 175.6.146.164 port 37276 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2337104]: ", "ip4": "175.6.146.164", "users": "['root']", "user": "root"} 111.228.14.92 #sshd|1791347830|172800|1|{"matches": ["Oct 7 04:37:08 hecnet-us-east-gw sshd[2337387]: User root from 111.228.14.92 not allowed because not listed in AllowUsers", "Oct 7 04:37:09 hecnet-us-east-gw sshd[2337387]: Failed password for invalid user root from 111.228.14.92 port 51194 ssh2", "Oct 7 04:37:10 hecnet-us-east-gw sshd[2337387]: Disconnected from invalid user root 111.228.14.92 port 51194 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2337387]: ", "ip4": "111.228.14.92", "users": "['root']", "user": "root"} 43.156.229.76 #sshd|1791350405|172800|1|{"matches": ["Oct 7 05:19:58 hecnet-us-east-gw sshd[2337740]: Invalid user test from 43.156.229.76 port 45944", "Oct 7 05:20:01 hecnet-us-east-gw sshd[2337740]: Failed none for invalid user test from 43.156.229.76 port 45944 ssh2", "Oct 7 05:20:05 hecnet-us-east-gw sshd[2337740]: Failed password for invalid user test from 43.156.229.76 port 45944 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2337740]: ", "ip4": "43.156.229.76", "users": "['test']", "user": "test"} 77.239.124.71 #sshd|1791352553|172800|1|{"matches": ["Oct 7 05:55:50 hecnet-us-east-gw sshd[2337992]: Failed none for invalid user root from 77.239.124.71 port 33518 ssh2", "Oct 7 05:55:53 hecnet-us-east-gw sshd[2337992]: Failed password for invalid user root from 77.239.124.71 port 33518 ssh2", "Oct 7 05:55:53 hecnet-us-east-gw sshd[2337992]: Connection closed by invalid user root 77.239.124.71 port 33518 [preauth]"], "failures": 4, "mlfid": " hecnet-us-east-gw sshd[2337992]: ", "ip4": "77.239.124.71", "users": "['root']", "user": "root"} 195.178.110.26 #sshd|1791360166|172800|1|{"matches": ["Oct 7 08:02:40 hecnet-us-east-gw sshd[2339212]: Invalid user blockscout from 195.178.110.26 port 39320", "Oct 7 08:02:42 hecnet-us-east-gw sshd[2339212]: Failed none for invalid user blockscout from 195.178.110.26 port 39320 ssh2", "Oct 7 08:02:46 hecnet-us-east-gw sshd[2339212]: Failed password for invalid user blockscout from 195.178.110.26 port 39320 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2339212]: ", "ip4": "195.178.110.26", "users": "['blockscout']", "user": "blockscout"} 109.160.32.130 #sshd|1791364551|172800|1|{"matches": ["Oct 7 09:14:57 hecnet-us-east-gw sshd[2339722]: Failed none for invalid user from 109.160.32.130 port 35990 ssh2", "Oct 7 09:15:50 hecnet-us-east-gw sshd[2339764]: Connection from 109.160.32.130 port 51620 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 7 09:15:51 hecnet-us-east-gw sshd[2339764]: Invalid user bb from 109.160.32.130 port 51620"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2339722]: ", "ip4": "109.160.32.130", "user": ""} 20.239.176.5 #lighttpd-scans|1791365293|172800|1|{"matches": [["", "Oct 7 09:28:10", " hecnet-us-east-gw lighttpd[1017]: 20.239.176.5 impvax.duckdns.org - [07/Oct/2026:09:28:09 +0000] \"GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1\" 404 341 \"-\" \"-\""], "Oct 7 09:28:11 hecnet-us-east-gw lighttpd[1017]: 20.239.176.5 impvax.duckdns.org - [07/Oct/2026:09:28:11 +0000] \"GET /this_is_a_new_hello_world.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 7 09:28:11 hecnet-us-east-gw lighttpd[1017]: 20.239.176.5 impvax.duckdns.org - [07/Oct/2026:09:28:11 +0000] \"GET /3PJcpMFsD8B.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 7 09:28:11 hecnet-us-east-gw lighttpd[1017]: 20.239.176.5 impvax.duckdns.org - [07/Oct/2026:09:28:11 +0000] \"GET //aa.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 7 09:28:12 hecnet-us-east-gw lighttpd[1017]: 20.239.176.5 impvax.duckdns.org - [07/Oct/2026:09:28:12 +0000] \"GET /z70.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 7 09:28:12 hecnet-us-east-gw lighttpd[1017]: 20.239.176.5 impvax.duckdns.org - [07/Oct/2026:09:28:12 +0000] \"GET /adminfuns.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 7 09:28:13 hecnet-us-east-gw lighttpd[1017]: 20.239.176.5 impvax.duckdns.org - [07/Oct/2026:09:28:13 +0000] \"GET //av.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 7 09:28:13 hecnet-us-east-gw lighttpd[1017]: 20.239.176.5 impvax.duckdns.org - [07/Oct/2026:09:28:13 +0000] \"GET /chosen.php HTTP/1.1\" 404 341 \"-\" \"-\""], "failures": 8, "ip4": "20.239.176.5"} 77.239.124.147 #sshd|1791369174|172800|1|{"matches": ["Oct 7 10:31:45 hecnet-us-east-gw sshd[2340284]: Failed none for invalid user from 77.239.124.147 port 44150 ssh2", "Oct 7 10:32:54 hecnet-us-east-gw sshd[2340288]: Connection from 77.239.124.147 port 48170 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 7 10:32:54 hecnet-us-east-gw sshd[2340288]: User root from 77.239.124.147 not allowed because not listed in AllowUsers"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2340284]: ", "ip4": "77.239.124.147", "user": ""} 196.189.236.67 #sshd|1791369201|172800|1|{"matches": ["Oct 7 10:33:18 hecnet-us-east-gw sshd[2340315]: Invalid user admin from 196.189.236.67 port 35088", "Oct 7 10:33:21 hecnet-us-east-gw sshd[2340315]: Failed password for invalid user admin from 196.189.236.67 port 35088 ssh2", "Oct 7 10:33:21 hecnet-us-east-gw sshd[2340315]: Connection closed by invalid user admin 196.189.236.67 port 35088 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2340315]: ", "ip4": "196.189.236.67", "users": "['admin']", "user": "admin"} 177.104.140.2 #sshd|1791370045|172800|1|{"matches": ["Oct 7 10:47:19 hecnet-us-east-gw sshd[2340469]: User root from 177.104.140.2 not allowed because not listed in AllowUsers", "Oct 7 10:47:22 hecnet-us-east-gw sshd[2340469]: Failed none for invalid user root from 177.104.140.2 port 41204 ssh2", "Oct 7 10:47:25 hecnet-us-east-gw sshd[2340469]: Failed password for invalid user root from 177.104.140.2 port 41204 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2340469]: ", "ip4": "177.104.140.2", "users": "['root']", "user": "root"} 201.77.124.248 #sshd|1791370593|172800|1|{"matches": ["Oct 7 10:56:31 hecnet-us-east-gw sshd[2340538]: User root from 201.77.124.248 not allowed because not listed in AllowUsers", "Oct 7 10:56:32 hecnet-us-east-gw sshd[2340538]: Failed password for invalid user root from 201.77.124.248 port 43510 ssh2", "Oct 7 10:56:33 hecnet-us-east-gw sshd[2340538]: Disconnected from invalid user root 201.77.124.248 port 43510 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2340538]: ", "ip4": "201.77.124.248", "users": "['root']", "user": "root"} 218.148.17.70 #sshd|1791373368|172800|1|{"matches": ["Oct 7 11:42:39 hecnet-us-east-gw sshd[2341032]: Invalid user pi from 218.148.17.70 port 38962", "Oct 7 11:42:41 hecnet-us-east-gw sshd[2341032]: Failed password for invalid user pi from 218.148.17.70 port 38962 ssh2", "Oct 7 11:42:48 hecnet-us-east-gw sshd[2341032]: Failed password for invalid user pi from 218.148.17.70 port 38962 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2341032]: ", "ip4": "218.148.17.70", "users": "['pi']", "user": "pi"} 92.118.39.77 #sshd|1791383543|172800|1|{"matches": ["Oct 7 14:32:17 hecnet-us-east-gw sshd[2342162]: User root from 92.118.39.77 not allowed because not listed in AllowUsers", "Oct 7 14:32:20 hecnet-us-east-gw sshd[2342162]: Failed none for invalid user root from 92.118.39.77 port 34252 ssh2", "Oct 7 14:32:23 hecnet-us-east-gw sshd[2342162]: Failed password for invalid user root from 92.118.39.77 port 34252 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2342162]: ", "ip4": "92.118.39.77", "users": "['root']", "user": "root"} 109.160.32.35 #sshd|1791387700|172800|1|{"matches": ["Oct 7 15:40:29 hecnet-us-east-gw sshd[2342647]: Failed none for invalid user from 109.160.32.35 port 60202 ssh2", "Oct 7 15:41:40 hecnet-us-east-gw sshd[2342651]: Connection from 109.160.32.35 port 53112 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 7 15:41:40 hecnet-us-east-gw sshd[2342651]: Invalid user chris from 109.160.32.35 port 53112"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2342647]: ", "ip4": "109.160.32.35", "user": ""} 190.119.63.98 #sshd|1791389016|172800|1|{"matches": ["Oct 7 16:03:32 hecnet-us-east-gw sshd[2342824]: Invalid user nagios from 190.119.63.98 port 44407", "Oct 7 16:03:34 hecnet-us-east-gw sshd[2342824]: Failed password for invalid user nagios from 190.119.63.98 port 44407 ssh2", "Oct 7 16:03:36 hecnet-us-east-gw sshd[2342824]: Disconnected from invalid user nagios 190.119.63.98 port 44407 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2342824]: ", "ip4": "190.119.63.98", "users": "['nagios']", "user": "nagios"} 103.70.40.36 #sshd|1791389184|172800|1|{"matches": ["Oct 7 16:06:20 hecnet-us-east-gw sshd[2342905]: Invalid user ll from 103.70.40.36 port 44392", "Oct 7 16:06:22 hecnet-us-east-gw sshd[2342905]: Failed password for invalid user ll from 103.70.40.36 port 44392 ssh2", "Oct 7 16:06:24 hecnet-us-east-gw sshd[2342905]: Disconnected from invalid user ll 103.70.40.36 port 44392 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2342905]: ", "ip4": "103.70.40.36", "users": "['ll']", "user": "ll"} 74.94.234.151 #sshd|1791389522|172800|1|{"matches": ["Oct 7 16:11:59 hecnet-us-east-gw sshd[2342963]: User root from 74.94.234.151 not allowed because not listed in AllowUsers", "Oct 7 16:12:01 hecnet-us-east-gw sshd[2342963]: Failed password for invalid user root from 74.94.234.151 port 41590 ssh2", "Oct 7 16:12:02 hecnet-us-east-gw sshd[2342963]: Disconnected from invalid user root 74.94.234.151 port 41590 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2342963]: ", "ip4": "74.94.234.151", "users": "['root']", "user": "root"} 185.206.32.100 #sshd|1791389773|172800|1|{"matches": ["Oct 7 16:16:08 hecnet-us-east-gw sshd[2343054]: Invalid user ubuntu from 185.206.32.100 port 35156", "Oct 7 16:16:10 hecnet-us-east-gw sshd[2343054]: Failed password for invalid user ubuntu from 185.206.32.100 port 35156 ssh2", "Oct 7 16:16:13 hecnet-us-east-gw sshd[2343054]: Disconnected from invalid user ubuntu 185.206.32.100 port 35156 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2343054]: ", "ip4": "185.206.32.100", "users": "['ubuntu']", "user": "ubuntu"} 109.160.32.120 #sshd|1791394854|172800|1|{"matches": ["Oct 7 17:39:42 hecnet-us-east-gw sshd[2343576]: Failed none for invalid user from 109.160.32.120 port 51394 ssh2", "Oct 7 17:40:54 hecnet-us-east-gw sshd[2343608]: Connection from 109.160.32.120 port 34800 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 7 17:40:54 hecnet-us-east-gw sshd[2343608]: Invalid user kernpr from 109.160.32.120 port 34800"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2343576]: ", "ip4": "109.160.32.120", "user": ""} 188.166.173.109 #sshd|1791395420|172800|1|{"matches": ["Oct 7 17:50:16 hecnet-us-east-gw sshd[2343731]: Invalid user ira from 188.166.173.109 port 35126", "Oct 7 17:50:18 hecnet-us-east-gw sshd[2343731]: Failed none for invalid user ira from 188.166.173.109 port 35126 ssh2", "Oct 7 17:50:20 hecnet-us-east-gw sshd[2343731]: Failed password for invalid user ira from 188.166.173.109 port 35126 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2343731]: ", "ip4": "188.166.173.109", "users": "['ira']", "user": "ira"} 161.35.162.189 #sshd|1791395421|172800|1|{"matches": ["Oct 7 17:50:15 hecnet-us-east-gw sshd[2343729]: Invalid user ira from 161.35.162.189 port 33160", "Oct 7 17:50:17 hecnet-us-east-gw sshd[2343729]: Failed none for invalid user ira from 161.35.162.189 port 33160 ssh2", "Oct 7 17:50:21 hecnet-us-east-gw sshd[2343729]: Failed password for invalid user ira from 161.35.162.189 port 33160 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2343729]: ", "ip4": "161.35.162.189", "users": "['ira']", "user": "ira"} 138.68.180.19 #sshd|1791395488|172800|1|{"matches": ["Oct 7 17:51:22 hecnet-us-east-gw sshd[2343774]: Invalid user ira from 138.68.180.19 port 48306", "Oct 7 17:51:25 hecnet-us-east-gw sshd[2343774]: Failed none for invalid user ira from 138.68.180.19 port 48306 ssh2", "Oct 7 17:51:28 hecnet-us-east-gw sshd[2343774]: Failed password for invalid user ira from 138.68.180.19 port 48306 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2343774]: ", "ip4": "138.68.180.19", "users": "['ira']", "user": "ira"} 95.38.177.52 #sshd|1791395533|172800|1|{"matches": ["Oct 7 17:52:11 hecnet-us-east-gw sshd[2343796]: User root from 95.38.177.52 not allowed because not listed in AllowUsers", "Oct 7 17:52:12 hecnet-us-east-gw sshd[2343796]: Failed password for invalid user root from 95.38.177.52 port 37472 ssh2", "Oct 7 17:52:13 hecnet-us-east-gw sshd[2343796]: Disconnected from invalid user root 95.38.177.52 port 37472 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2343796]: ", "ip4": "95.38.177.52", "users": "['root']", "user": "root"} 125.88.225.11 #sshd|1791395598|172800|1|{"matches": ["Oct 7 17:53:15 hecnet-us-east-gw sshd[2343822]: Invalid user mysftp from 125.88.225.11 port 48884", "Oct 7 17:53:17 hecnet-us-east-gw sshd[2343822]: Failed password for invalid user mysftp from 125.88.225.11 port 48884 ssh2", "Oct 7 17:53:18 hecnet-us-east-gw sshd[2343822]: Disconnected from invalid user mysftp 125.88.225.11 port 48884 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2343822]: ", "ip4": "125.88.225.11", "users": "['mysftp']", "user": "mysftp"} 64.227.48.143 #sshd|1791395766|172800|1|{"matches": ["Oct 7 17:56:00 hecnet-us-east-gw sshd[2343852]: Invalid user ira from 64.227.48.143 port 38880", "Oct 7 17:56:02 hecnet-us-east-gw sshd[2343852]: Failed none for invalid user ira from 64.227.48.143 port 38880 ssh2", "Oct 7 17:56:06 hecnet-us-east-gw sshd[2343852]: Failed password for invalid user ira from 64.227.48.143 port 38880 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2343852]: ", "ip4": "64.227.48.143", "users": "['ira']", "user": "ira"} 167.99.173.225 #sshd|1791395780|172800|1|{"matches": ["Oct 7 17:56:16 hecnet-us-east-gw sshd[2343874]: Invalid user ira from 167.99.173.225 port 45344", "Oct 7 17:56:18 hecnet-us-east-gw sshd[2343874]: Failed none for invalid user ira from 167.99.173.225 port 45344 ssh2", "Oct 7 17:56:20 hecnet-us-east-gw sshd[2343874]: Failed password for invalid user ira from 167.99.173.225 port 45344 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2343874]: ", "ip4": "167.99.173.225", "users": "['ira']", "user": "ira"} 58.69.56.44 #sshd|1791397134|172800|1|{"matches": ["Oct 7 18:18:50 hecnet-us-east-gw sshd[2344057]: User root from 58.69.56.44 not allowed because not listed in AllowUsers", "Oct 7 18:18:52 hecnet-us-east-gw sshd[2344057]: Failed password for invalid user root from 58.69.56.44 port 48136 ssh2", "Oct 7 18:18:54 hecnet-us-east-gw sshd[2344057]: Disconnected from invalid user root 58.69.56.44 port 48136 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2344057]: ", "ip4": "58.69.56.44", "users": "['root']", "user": "root"} 161.35.152.250 #sshd|1791397808|172800|1|{"matches": ["Oct 7 18:30:02 hecnet-us-east-gw sshd[2344219]: User root from 161.35.152.250 not allowed because not listed in AllowUsers", "Oct 7 18:30:04 hecnet-us-east-gw sshd[2344219]: Failed none for invalid user root from 161.35.152.250 port 58906 ssh2", "Oct 7 18:30:08 hecnet-us-east-gw sshd[2344219]: Failed password for invalid user root from 161.35.152.250 port 58906 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2344219]: ", "ip4": "161.35.152.250", "users": "['root']", "user": "root"} 45.79.128.205 #sshd|1791399685|172800|1|{"matches": ["Oct 7 19:01:25 hecnet-us-east-gw sshd[2344439]: Unable to negotiate with 45.79.128.205 port 8558: no matching host key type found. Their offer: ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521 [preauth]", "Oct 7 19:01:25 hecnet-us-east-gw sshd[2344441]: Connection from 45.79.128.205 port 8564 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 7 19:01:25 hecnet-us-east-gw sshd[2344441]: Connection closed by 45.79.128.205 port 8564 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2344437]: ", "ip4": "45.79.128.205", "mlfforget": "Connection closed"} 171.244.201.80 #sshd|1791399932|172800|1|{"matches": ["Oct 7 19:05:27 hecnet-us-east-gw sshd[2344504]: User root from 171.244.201.80 not allowed because not listed in AllowUsers", "Oct 7 19:05:29 hecnet-us-east-gw sshd[2344504]: Failed password for invalid user root from 171.244.201.80 port 54958 ssh2", "Oct 7 19:05:32 hecnet-us-east-gw sshd[2344504]: Disconnected from invalid user root 171.244.201.80 port 54958 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2344504]: ", "ip4": "171.244.201.80", "users": "['root']", "user": "root"} 212.154.234.9 #sshd|1791403033|172800|1|{"matches": ["Oct 7 19:57:10 hecnet-us-east-gw sshd[2344848]: Invalid user mongouser from 212.154.234.9 port 12777", "Oct 7 19:57:12 hecnet-us-east-gw sshd[2344848]: Failed password for invalid user mongouser from 212.154.234.9 port 12777 ssh2", "Oct 7 19:57:13 hecnet-us-east-gw sshd[2344848]: Disconnected from invalid user mongouser 212.154.234.9 port 12777 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2344848]: ", "ip4": "212.154.234.9", "users": "['mongouser']", "user": "mongouser"} 139.59.208.225 #sshd|1791403075|172800|1|{"matches": ["Oct 7 19:57:52 hecnet-us-east-gw sshd[2344871]: Invalid user certbot from 139.59.208.225 port 56550", "Oct 7 19:57:54 hecnet-us-east-gw sshd[2344871]: Failed password for invalid user certbot from 139.59.208.225 port 56550 ssh2", "Oct 7 19:57:55 hecnet-us-east-gw sshd[2344871]: Disconnected from invalid user certbot 139.59.208.225 port 56550 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2344871]: ", "ip4": "139.59.208.225", "users": "['certbot']", "user": "certbot"} 43.129.193.109 #sshd|1791403215|172800|1|{"matches": ["Oct 7 20:00:11 hecnet-us-east-gw sshd[2344908]: Invalid user wesley from 43.129.193.109 port 49834", "Oct 7 20:00:13 hecnet-us-east-gw sshd[2344908]: Failed password for invalid user wesley from 43.129.193.109 port 49834 ssh2", "Oct 7 20:00:15 hecnet-us-east-gw sshd[2344908]: Disconnected from invalid user wesley 43.129.193.109 port 49834 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2344908]: ", "ip4": "43.129.193.109", "users": "['wesley']", "user": "wesley"} 121.163.62.9 #sshd|1791404179|172800|1|{"matches": ["Oct 7 20:16:15 hecnet-us-east-gw sshd[2345067]: Invalid user oracle from 121.163.62.9 port 44732", "Oct 7 20:16:17 hecnet-us-east-gw sshd[2345067]: Failed password for invalid user oracle from 121.163.62.9 port 44732 ssh2", "Oct 7 20:16:19 hecnet-us-east-gw sshd[2345067]: Failed password for invalid user oracle from 121.163.62.9 port 44732 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2345067]: ", "ip4": "121.163.62.9", "users": "['oracle']", "user": "oracle"} 51.254.130.161 #sshd|1791406012|172800|1|{"matches": ["Oct 7 20:46:48 hecnet-us-east-gw sshd[2345304]: User root from 51.254.130.161 not allowed because not listed in AllowUsers", "Oct 7 20:46:50 hecnet-us-east-gw sshd[2345304]: Failed password for invalid user root from 51.254.130.161 port 52458 ssh2", "Oct 7 20:46:52 hecnet-us-east-gw sshd[2345304]: Disconnected from invalid user root 51.254.130.161 port 52458 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2345304]: ", "ip4": "51.254.130.161", "users": "['root']", "user": "root"} 45.148.10.61 #sshd|1791406228|172800|1|{"matches": ["Oct 7 20:50:23 hecnet-us-east-gw sshd[2345338]: Invalid user user from 45.148.10.61 port 32964", "Oct 7 20:50:25 hecnet-us-east-gw sshd[2345338]: Failed none for invalid user user from 45.148.10.61 port 32964 ssh2", "Oct 7 20:50:28 hecnet-us-east-gw sshd[2345338]: Failed password for invalid user user from 45.148.10.61 port 32964 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2345338]: ", "ip4": "45.148.10.61", "users": "['user']", "user": "user"} 103.85.85.159 #sshd|1791406379|172800|1|{"matches": ["Oct 7 20:52:54 hecnet-us-east-gw sshd[2345368]: User root from 103.85.85.159 not allowed because not listed in AllowUsers", "Oct 7 20:52:56 hecnet-us-east-gw sshd[2345368]: Failed none for invalid user root from 103.85.85.159 port 37902 ssh2", "Oct 7 20:52:59 hecnet-us-east-gw sshd[2345368]: Failed password for invalid user root from 103.85.85.159 port 37902 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2345368]: ", "ip4": "103.85.85.159", "users": "['root']", "user": "root"} 77.239.124.43 #sshd|1791407182|172800|1|{"matches": ["Oct 7 21:06:18 hecnet-us-east-gw sshd[2345460]: User root from 77.239.124.43 not allowed because not listed in AllowUsers", "Oct 7 21:06:19 hecnet-us-east-gw sshd[2345460]: Failed none for invalid user root from 77.239.124.43 port 49472 ssh2", "Oct 7 21:06:22 hecnet-us-east-gw sshd[2345460]: Failed password for invalid user root from 77.239.124.43 port 49472 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2345460]: ", "ip4": "77.239.124.43", "users": "['root']", "user": "root"} 130.12.180.32 #sshd|1791407665|172800|1|{"matches": ["Oct 7 21:14:25 hecnet-us-east-gw sshd[2345526]: Invalid user rapport from 130.12.180.32 port 33294", "Oct 7 21:14:22 hecnet-us-east-gw sshd[2345523]: Connection from 130.12.180.32 port 33300 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 7 21:14:25 hecnet-us-east-gw sshd[2345523]: Invalid user guest from 130.12.180.32 port 33300"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2345522]: ", "ip4": "130.12.180.32", "users": "['support']", "user": "support"} 130.12.180.32 #pam-generic|1791407665|172800|1|{"matches": [["", "Oct 7 21:14:25", " hecnet-us-east-gw sshd[2345522]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=130.12.180.32 "], "Oct 7 21:14:25 hecnet-us-east-gw sshd[2345526]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=130.12.180.32 ", "Oct 7 21:14:25 hecnet-us-east-gw sshd[2345523]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=130.12.180.32 "], "failures": 3, "alt_user": "", "ip4": "130.12.180.32"} 195.239.97.254 #sshd|1791408256|172800|1|{"matches": ["Oct 7 21:24:12 hecnet-us-east-gw sshd[2345648]: Invalid user test from 195.239.97.254 port 36070", "Oct 7 21:24:14 hecnet-us-east-gw sshd[2345648]: Failed password for invalid user test from 195.239.97.254 port 36070 ssh2", "Oct 7 21:24:16 hecnet-us-east-gw sshd[2345648]: Disconnected from invalid user test 195.239.97.254 port 36070 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2345648]: ", "ip4": "195.239.97.254", "users": "['test']", "user": "test"} 76.79.213.69 #sshd|1791408540|172800|1|{"matches": ["Oct 7 21:28:57 hecnet-us-east-gw sshd[2345706]: Invalid user victor from 76.79.213.69 port 47260", "Oct 7 21:28:59 hecnet-us-east-gw sshd[2345706]: Failed password for invalid user victor from 76.79.213.69 port 47260 ssh2", "Oct 7 21:29:00 hecnet-us-east-gw sshd[2345706]: Disconnected from invalid user victor 76.79.213.69 port 47260 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2345706]: ", "ip4": "76.79.213.69", "users": "['victor']", "user": "victor"} 109.160.32.114 #sshd|1791411527|172800|1|{"matches": ["Oct 7 22:17:38 hecnet-us-east-gw sshd[2346073]: Failed none for invalid user from 109.160.32.114 port 34610 ssh2", "Oct 7 22:18:46 hecnet-us-east-gw sshd[2346081]: Connection from 109.160.32.114 port 44158 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 7 22:18:47 hecnet-us-east-gw sshd[2346081]: Invalid user claw from 109.160.32.114 port 44158"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2346073]: ", "ip4": "109.160.32.114", "user": ""} 179.57.170.71 #sshd|1791411731|172800|1|{"matches": ["Oct 7 22:22:07 hecnet-us-east-gw sshd[2346110]: User root from 179.57.170.71 not allowed because not listed in AllowUsers", "Oct 7 22:22:09 hecnet-us-east-gw sshd[2346110]: Failed password for invalid user root from 179.57.170.71 port 56120 ssh2", "Oct 7 22:22:11 hecnet-us-east-gw sshd[2346110]: Disconnected from invalid user root 179.57.170.71 port 56120 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2346110]: ", "ip4": "179.57.170.71", "users": "['root']", "user": "root"} 217.60.7.209 #sshd|1791412888|172800|1|{"matches": ["Oct 7 22:41:25 hecnet-us-east-gw sshd[2346263]: Invalid user admin from 217.60.7.209 port 32920", "Oct 7 22:41:27 hecnet-us-east-gw sshd[2346263]: Failed password for invalid user admin from 217.60.7.209 port 32920 ssh2", "Oct 7 22:41:28 hecnet-us-east-gw sshd[2346263]: Connection closed by invalid user admin 217.60.7.209 port 32920 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2346263]: ", "ip4": "217.60.7.209", "users": "['admin']", "user": "admin"} 93.62.72.229 #sshd|1791414186|172800|1|{"matches": ["Oct 7 23:03:02 hecnet-us-east-gw sshd[2346407]: User root from 93.62.72.229 not allowed because not listed in AllowUsers", "Oct 7 23:03:04 hecnet-us-east-gw sshd[2346407]: Failed password for invalid user root from 93.62.72.229 port 38974 ssh2", "Oct 7 23:03:06 hecnet-us-east-gw sshd[2346407]: Failed password for invalid user root from 93.62.72.229 port 38974 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2346407]: ", "ip4": "93.62.72.229", "users": "['root']", "user": "root"} 111.207.12.99 #sshd|1791414281|172800|1|{"matches": ["Oct 7 23:04:37 hecnet-us-east-gw sshd[2346434]: User root from 111.207.12.99 not allowed because not listed in AllowUsers", "Oct 7 23:04:39 hecnet-us-east-gw sshd[2346434]: Failed password for invalid user root from 111.207.12.99 port 49696 ssh2", "Oct 7 23:04:41 hecnet-us-east-gw sshd[2346434]: Disconnected from invalid user root 111.207.12.99 port 49696 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2346434]: ", "ip4": "111.207.12.99", "users": "['root']", "user": "root"} 150.136.214.177 #sshd|1791415936|172800|1|{"matches": ["Oct 7 23:32:14 hecnet-us-east-gw sshd[2346655]: Invalid user support from 150.136.214.177 port 23022", "Oct 7 23:32:15 hecnet-us-east-gw sshd[2346655]: Failed password for invalid user support from 150.136.214.177 port 23022 ssh2", "Oct 7 23:32:16 hecnet-us-east-gw sshd[2346655]: Disconnected from invalid user support 150.136.214.177 port 23022 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2346655]: ", "ip4": "150.136.214.177", "users": "['support']", "user": "support"} 43.156.115.178 #sshd|1791415979|172800|1|{"matches": ["Oct 7 23:32:57 hecnet-us-east-gw sshd[2346678]: User root from 43.156.115.178 not allowed because not listed in AllowUsers", "Oct 7 23:32:58 hecnet-us-east-gw sshd[2346678]: Failed password for invalid user root from 43.156.115.178 port 47980 ssh2", "Oct 7 23:32:59 hecnet-us-east-gw sshd[2346678]: Disconnected from invalid user root 43.156.115.178 port 47980 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2346678]: ", "ip4": "43.156.115.178", "users": "['root']", "user": "root"} 46.188.119.26 #sshd|1791416188|172800|1|{"matches": ["Oct 7 23:36:24 hecnet-us-east-gw sshd[2346738]: Invalid user user1 from 46.188.119.26 port 52678", "Oct 7 23:36:26 hecnet-us-east-gw sshd[2346738]: Failed password for invalid user user1 from 46.188.119.26 port 52678 ssh2", "Oct 7 23:36:28 hecnet-us-east-gw sshd[2346738]: Disconnected from invalid user user1 46.188.119.26 port 52678 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2346738]: ", "ip4": "46.188.119.26", "users": "['user1']", "user": "user1"} 20.127.185.37 #sshd|1791416420|172800|1|{"matches": ["Oct 7 23:40:16 hecnet-us-east-gw sshd[2346784]: Invalid user ethan from 20.127.185.37 port 37336", "Oct 7 23:40:18 hecnet-us-east-gw sshd[2346784]: Failed password for invalid user ethan from 20.127.185.37 port 37336 ssh2", "Oct 7 23:40:20 hecnet-us-east-gw sshd[2346784]: Disconnected from invalid user ethan 20.127.185.37 port 37336 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2346784]: ", "ip4": "20.127.185.37", "users": "['ethan']", "user": "ethan"} 175.203.57.19 #sshd|1791416425|172800|1|{"matches": ["Oct 7 23:40:21 hecnet-us-east-gw sshd[2346786]: User root from 175.203.57.19 not allowed because not listed in AllowUsers", "Oct 7 23:40:23 hecnet-us-east-gw sshd[2346786]: Failed password for invalid user root from 175.203.57.19 port 38610 ssh2", "Oct 7 23:40:25 hecnet-us-east-gw sshd[2346786]: Disconnected from invalid user root 175.203.57.19 port 38610 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2346786]: ", "ip4": "175.203.57.19", "users": "['root']", "user": "root"} 103.75.70.26 #sshd|1791418410|172800|1|{"matches": ["Oct 8 00:13:26 hecnet-us-east-gw sshd[2347058]: Invalid user admin from 103.75.70.26 port 48884", "Oct 8 00:13:27 hecnet-us-east-gw sshd[2347058]: Failed password for invalid user admin from 103.75.70.26 port 48884 ssh2", "Oct 8 00:13:30 hecnet-us-east-gw sshd[2347058]: Connection closed by invalid user admin 103.75.70.26 port 48884 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2347058]: ", "ip4": "103.75.70.26", "users": "['admin']", "user": "admin"} 27.112.78.223 #sshd|1791418938|172800|1|{"matches": ["Oct 8 00:22:16 hecnet-us-east-gw sshd[2347162]: Invalid user wwww from 27.112.78.223 port 44304", "Oct 8 00:22:18 hecnet-us-east-gw sshd[2347162]: Failed password for invalid user wwww from 27.112.78.223 port 44304 ssh2", "Oct 8 00:22:18 hecnet-us-east-gw sshd[2347162]: Disconnected from invalid user wwww 27.112.78.223 port 44304 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2347162]: ", "ip4": "27.112.78.223", "users": "['wwww']", "user": "wwww"} 172.105.128.11 #sshd|1791423773|172800|1|{"matches": ["Oct 8 01:42:53 hecnet-us-east-gw sshd[2347753]: Unable to negotiate with 172.105.128.11 port 38372: no matching host key type found. Their offer: ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521 [preauth]", "Oct 8 01:42:53 hecnet-us-east-gw sshd[2347755]: Connection from 172.105.128.11 port 38380 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 8 01:42:53 hecnet-us-east-gw sshd[2347755]: Connection closed by 172.105.128.11 port 38380 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2347751]: ", "ip4": "172.105.128.11", "mlfforget": "Connection closed"} 207.175.41.99 #sshd|1791426267|172800|1|{"matches": ["Oct 8 02:24:22 hecnet-us-east-gw sshd[2348070]: Invalid user admin from 207.175.41.99 port 14916", "Oct 8 02:24:24 hecnet-us-east-gw sshd[2348070]: Failed none for invalid user admin from 207.175.41.99 port 14916 ssh2", "Oct 8 02:24:27 hecnet-us-east-gw sshd[2348070]: Failed password for invalid user admin from 207.175.41.99 port 14916 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2348070]: ", "ip4": "207.175.41.99", "users": "['admin']", "user": "admin"} 104.208.73.227 #lighttpd-scans|1791426444|172800|1|{"matches": [["", "Oct 8 02:27:21", " hecnet-us-east-gw lighttpd[1017]: 104.208.73.227 impvax.duckdns.org - [08/Oct/2026:02:27:21 +0000] \"GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1\" 404 341 \"-\" \"-\""], "Oct 8 02:27:22 hecnet-us-east-gw lighttpd[1017]: 104.208.73.227 impvax.duckdns.org - [08/Oct/2026:02:27:21 +0000] \"GET /this_is_a_new_hello_world.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 8 02:27:22 hecnet-us-east-gw lighttpd[1017]: 104.208.73.227 impvax.duckdns.org - [08/Oct/2026:02:27:22 +0000] \"GET /dodo.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 8 02:27:22 hecnet-us-east-gw lighttpd[1017]: 104.208.73.227 impvax.duckdns.org - [08/Oct/2026:02:27:22 +0000] \"GET /wp-mails.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 8 02:27:23 hecnet-us-east-gw lighttpd[1017]: 104.208.73.227 impvax.duckdns.org - [08/Oct/2026:02:27:23 +0000] \"GET /go.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 8 02:27:23 hecnet-us-east-gw lighttpd[1017]: 104.208.73.227 impvax.duckdns.org - [08/Oct/2026:02:27:23 +0000] \"GET /wp-fgban13jx3.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 8 02:27:24 hecnet-us-east-gw lighttpd[1017]: 104.208.73.227 impvax.duckdns.org - [08/Oct/2026:02:27:24 +0000] \"GET /1ac.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 8 02:27:24 hecnet-us-east-gw lighttpd[1017]: 104.208.73.227 impvax.duckdns.org - [08/Oct/2026:02:27:24 +0000] \"GET /flm.php HTTP/1.1\" 404 341 \"-\" \"-\""], "failures": 8, "ip4": "104.208.73.227"} 34.156.220.56 #sshd|1791426507|172800|1|{"matches": ["Oct 8 02:28:25 hecnet-us-east-gw sshd[2348153]: Connection from 34.156.220.56 port 52438 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 8 02:28:25 hecnet-us-east-gw sshd[2348153]: Invalid user tohlg from 34.156.220.56 port 52438", "Oct 8 02:28:27 hecnet-us-east-gw sshd[2348153]: Failed none for invalid user tohlg from 34.156.220.56 port 52438 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2348151]: ", "ip4": "34.156.220.56"} 20.116.34.103 #sshd|1791426581|172800|1|{"matches": ["Oct 8 02:29:37 hecnet-us-east-gw sshd[2348175]: Invalid user zhangsan from 20.116.34.103 port 56080", "Oct 8 02:29:40 hecnet-us-east-gw sshd[2348175]: Failed password for invalid user zhangsan from 20.116.34.103 port 56080 ssh2", "Oct 8 02:29:41 hecnet-us-east-gw sshd[2348175]: Disconnected from invalid user zhangsan 20.116.34.103 port 56080 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2348175]: ", "ip4": "20.116.34.103", "users": "['zhangsan']", "user": "zhangsan"} 109.160.32.118 #sshd|1791427178|172800|1|{"matches": ["Oct 8 02:38:48 hecnet-us-east-gw sshd[2348261]: Failed none for invalid user from 109.160.32.118 port 39804 ssh2", "Oct 8 02:39:38 hecnet-us-east-gw sshd[2348264]: Connection from 109.160.32.118 port 35812 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 8 02:39:38 hecnet-us-east-gw sshd[2348264]: Invalid user synchpcuser from 109.160.32.118 port 35812"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2348261]: ", "ip4": "109.160.32.118", "user": ""} 209.99.185.184 #sshd|1791431527|172800|1|{"matches": ["Oct 8 03:52:01 hecnet-us-east-gw sshd[2348737]: Invalid user user from 209.99.185.184 port 42668", "Oct 8 03:52:04 hecnet-us-east-gw sshd[2348737]: Failed none for invalid user user from 209.99.185.184 port 42668 ssh2", "Oct 8 03:52:07 hecnet-us-east-gw sshd[2348737]: Failed password for invalid user user from 209.99.185.184 port 42668 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2348737]: ", "ip4": "209.99.185.184", "users": "['user']", "user": "user"} 52.141.2.20 #sshd|1791439896|172800|1|{"matches": ["Oct 8 06:11:33 hecnet-us-east-gw sshd[2349657]: Invalid user test from 52.141.2.20 port 55002", "Oct 8 06:11:35 hecnet-us-east-gw sshd[2349657]: Failed password for invalid user test from 52.141.2.20 port 55002 ssh2", "Oct 8 06:11:36 hecnet-us-east-gw sshd[2349657]: Disconnected from invalid user test 52.141.2.20 port 55002 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2349657]: ", "ip4": "52.141.2.20", "users": "['test']", "user": "test"} 43.130.173.171 #sshd|1791440134|172800|1|{"matches": ["Oct 8 06:15:32 hecnet-us-east-gw sshd[2349782]: Invalid user diego from 43.130.173.171 port 33892", "Oct 8 06:15:33 hecnet-us-east-gw sshd[2349782]: Failed password for invalid user diego from 43.130.173.171 port 33892 ssh2", "Oct 8 06:15:34 hecnet-us-east-gw sshd[2349782]: Disconnected from invalid user diego 43.130.173.171 port 33892 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2349782]: ", "ip4": "43.130.173.171", "users": "['diego']", "user": "diego"} 122.15.129.26 #sshd|1791440173|172800|1|{"matches": ["Oct 8 06:16:11 hecnet-us-east-gw sshd[2349819]: Invalid user user from 122.15.129.26 port 23085", "Oct 8 06:16:12 hecnet-us-east-gw sshd[2349819]: Failed password for invalid user user from 122.15.129.26 port 23085 ssh2", "Oct 8 06:16:13 hecnet-us-east-gw sshd[2349819]: Disconnected from invalid user user 122.15.129.26 port 23085 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2349819]: ", "ip4": "122.15.129.26", "users": "['user']", "user": "user"} 101.47.159.50 #sshd|1791444324|172800|1|{"matches": ["Oct 8 07:25:20 hecnet-us-east-gw sshd[2350401]: Invalid user mcserver from 101.47.159.50 port 46194", "Oct 8 07:25:22 hecnet-us-east-gw sshd[2350401]: Failed password for invalid user mcserver from 101.47.159.50 port 46194 ssh2", "Oct 8 07:25:24 hecnet-us-east-gw sshd[2350401]: Disconnected from invalid user mcserver 101.47.159.50 port 46194 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2350401]: ", "ip4": "101.47.159.50", "users": "['mcserver']", "user": "mcserver"} 187.251.123.104 #sshd|1791444549|172800|1|{"matches": ["Oct 8 07:29:06 hecnet-us-east-gw sshd[2350459]: Invalid user hadoop from 187.251.123.104 port 59535", "Oct 8 07:29:08 hecnet-us-east-gw sshd[2350459]: Failed password for invalid user hadoop from 187.251.123.104 port 59535 ssh2", "Oct 8 07:29:09 hecnet-us-east-gw sshd[2350459]: Disconnected from invalid user hadoop 187.251.123.104 port 59535 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2350459]: ", "ip4": "187.251.123.104", "users": "['hadoop']", "user": "hadoop"} 118.145.238.115 #sshd|1791444767|172800|1|{"matches": ["Oct 8 07:32:45 hecnet-us-east-gw sshd[2350502]: Invalid user superadmin from 118.145.238.115 port 51870", "Oct 8 07:32:47 hecnet-us-east-gw sshd[2350502]: Failed password for invalid user superadmin from 118.145.238.115 port 51870 ssh2", "Oct 8 07:32:47 hecnet-us-east-gw sshd[2350502]: Disconnected from invalid user superadmin 118.145.238.115 port 51870 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2350502]: ", "ip4": "118.145.238.115", "users": "['superadmin']", "user": "superadmin"} 85.198.19.217 #sshd|1791444960|172800|1|{"matches": ["Oct 8 07:35:55 hecnet-us-east-gw sshd[2350561]: Invalid user node from 85.198.19.217 port 35892", "Oct 8 07:35:58 hecnet-us-east-gw sshd[2350561]: Failed password for invalid user node from 85.198.19.217 port 35892 ssh2", "Oct 8 07:36:00 hecnet-us-east-gw sshd[2350561]: Disconnected from invalid user node 85.198.19.217 port 35892 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2350561]: ", "ip4": "85.198.19.217", "users": "['node']", "user": "node"} 108.84.235.97 #sshd|1791445057|172800|1|{"matches": ["Oct 8 07:37:34 hecnet-us-east-gw sshd[2350589]: Invalid user mine from 108.84.235.97 port 59604", "Oct 8 07:37:36 hecnet-us-east-gw sshd[2350589]: Failed password for invalid user mine from 108.84.235.97 port 59604 ssh2", "Oct 8 07:37:37 hecnet-us-east-gw sshd[2350589]: Disconnected from invalid user mine 108.84.235.97 port 59604 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2350589]: ", "ip4": "108.84.235.97", "users": "['mine']", "user": "mine"} 111.228.46.221 #sshd|1791445097|172800|1|{"matches": ["Oct 8 07:38:15 hecnet-us-east-gw sshd[2350613]: User root from 111.228.46.221 not allowed because not listed in AllowUsers", "Oct 8 07:38:16 hecnet-us-east-gw sshd[2350613]: Failed password for invalid user root from 111.228.46.221 port 60054 ssh2", "Oct 8 07:38:17 hecnet-us-east-gw sshd[2350613]: Disconnected from invalid user root 111.228.46.221 port 60054 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2350613]: ", "ip4": "111.228.46.221", "users": "['root']", "user": "root"} 20.92.239.62 #lighttpd-scans|1791449733|172800|1|{"matches": [["", "Oct 8 08:55:30", " hecnet-us-east-gw lighttpd[1017]: 20.92.239.62 impvax.duckdns.org - [08/Oct/2026:08:55:30 +0000] \"GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1\" 404 341 \"-\" \"-\""], "Oct 8 08:55:31 hecnet-us-east-gw lighttpd[1017]: 20.92.239.62 impvax.duckdns.org - [08/Oct/2026:08:55:30 +0000] \"GET /this_is_a_new_hello_world.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 8 08:55:31 hecnet-us-east-gw lighttpd[1017]: 20.92.239.62 impvax.duckdns.org - [08/Oct/2026:08:55:31 +0000] \"GET /3PJcpMFsD8B.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 8 08:55:31 hecnet-us-east-gw lighttpd[1017]: 20.92.239.62 impvax.duckdns.org - [08/Oct/2026:08:55:31 +0000] \"GET //aa.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 8 08:55:32 hecnet-us-east-gw lighttpd[1017]: 20.92.239.62 impvax.duckdns.org - [08/Oct/2026:08:55:32 +0000] \"GET /z70.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 8 08:55:32 hecnet-us-east-gw lighttpd[1017]: 20.92.239.62 impvax.duckdns.org - [08/Oct/2026:08:55:32 +0000] \"GET /adminfuns.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 8 08:55:33 hecnet-us-east-gw lighttpd[1017]: 20.92.239.62 impvax.duckdns.org - [08/Oct/2026:08:55:33 +0000] \"GET //av.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 8 08:55:33 hecnet-us-east-gw lighttpd[1017]: 20.92.239.62 impvax.duckdns.org - [08/Oct/2026:08:55:33 +0000] \"GET /chosen.php HTTP/1.1\" 404 341 \"-\" \"-\""], "failures": 8, "ip4": "20.92.239.62"} 154.51.59.118 #sshd|1791451433|172800|1|{"matches": ["Oct 8 09:23:50 hecnet-us-east-gw sshd[2351312]: Invalid user vncuser from 154.51.59.118 port 49276", "Oct 8 09:23:52 hecnet-us-east-gw sshd[2351312]: Failed password for invalid user vncuser from 154.51.59.118 port 49276 ssh2", "Oct 8 09:23:53 hecnet-us-east-gw sshd[2351312]: Disconnected from invalid user vncuser 154.51.59.118 port 49276 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2351312]: ", "ip4": "154.51.59.118", "users": "['vncuser']", "user": "vncuser"} 103.213.95.199 #sshd|1791453657|172800|1|{"matches": ["Oct 8 10:00:54 hecnet-us-east-gw sshd[2351568]: User root from 103.213.95.199 not allowed because not listed in AllowUsers", "Oct 8 10:00:56 hecnet-us-east-gw sshd[2351568]: Failed password for invalid user root from 103.213.95.199 port 36874 ssh2", "Oct 8 10:00:57 hecnet-us-east-gw sshd[2351568]: Disconnected from invalid user root 103.213.95.199 port 36874 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2351568]: ", "ip4": "103.213.95.199", "users": "['root']", "user": "root"} 111.228.12.237 #sshd|1791453754|172800|1|{"matches": ["Oct 8 09:35:54 hecnet-us-east-gw sshd[2351431]: Failed password for invalid user root from 111.228.12.237 port 41524 ssh2", "Oct 8 10:02:32 hecnet-us-east-gw sshd[2351592]: Connection from 111.228.12.237 port 42406 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 8 10:02:34 hecnet-us-east-gw sshd[2351592]: Invalid user staging from 111.228.12.237 port 42406"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2351431]: ", "ip4": "111.228.12.237", "users": "['root']", "user": "root"} 109.160.32.46 #sshd|1791455273|172800|1|{"matches": ["Oct 8 10:27:24 hecnet-us-east-gw sshd[2351805]: Failed none for invalid user from 109.160.32.46 port 60152 ssh2", "Oct 8 10:27:52 hecnet-us-east-gw sshd[2351807]: Connection from 109.160.32.46 port 59284 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 8 10:27:53 hecnet-us-east-gw sshd[2351807]: Invalid user tompaper_spa_usr from 109.160.32.46 port 59284"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2351805]: ", "ip4": "109.160.32.46", "user": ""} 83.235.16.111 #sshd|1791458293|172800|1|{"matches": ["Oct 8 11:18:09 hecnet-us-east-gw sshd[2352160]: Invalid user t128 from 83.235.16.111 port 54154", "Oct 8 11:18:11 hecnet-us-east-gw sshd[2352160]: Failed password for invalid user t128 from 83.235.16.111 port 54154 ssh2", "Oct 8 11:18:13 hecnet-us-east-gw sshd[2352160]: Disconnected from invalid user t128 83.235.16.111 port 54154 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2352160]: ", "ip4": "83.235.16.111", "users": "['t128']", "user": "t128"} 190.181.25.210 #sshd|1791460123|172800|1|{"matches": ["Oct 8 11:48:39 hecnet-us-east-gw sshd[2352412]: User root from 190.181.25.210 not allowed because not listed in AllowUsers", "Oct 8 11:48:41 hecnet-us-east-gw sshd[2352412]: Failed password for invalid user root from 190.181.25.210 port 45780 ssh2", "Oct 8 11:48:43 hecnet-us-east-gw sshd[2352412]: Disconnected from invalid user root 190.181.25.210 port 45780 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2352412]: ", "ip4": "190.181.25.210", "users": "['root']", "user": "root"} 103.117.145.130 #sshd|1791460404|172800|1|{"matches": ["Oct 8 11:53:22 hecnet-us-east-gw sshd[2352471]: Invalid user bot1 from 103.117.145.130 port 47486", "Oct 8 11:53:23 hecnet-us-east-gw sshd[2352471]: Failed password for invalid user bot1 from 103.117.145.130 port 47486 ssh2", "Oct 8 11:53:24 hecnet-us-east-gw sshd[2352471]: Disconnected from invalid user bot1 103.117.145.130 port 47486 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2352471]: ", "ip4": "103.117.145.130", "users": "['bot1']", "user": "bot1"} 203.57.238.39 #sshd|1791460496|172800|1|{"matches": ["Oct 8 11:54:42 hecnet-us-east-gw sshd[2352492]: Invalid user reloj from 203.57.238.39 port 55936", "Oct 8 11:54:44 hecnet-us-east-gw sshd[2352492]: Failed password for invalid user reloj from 203.57.238.39 port 55936 ssh2", "Oct 8 11:54:56 hecnet-us-east-gw sshd[2352492]: Disconnected from invalid user reloj 203.57.238.39 port 55936 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2352492]: ", "ip4": "203.57.238.39", "users": "['reloj']", "user": "reloj"} 36.66.16.233 #sshd|1791461104|172800|1|{"matches": ["Oct 8 12:05:01 hecnet-us-east-gw sshd[2352552]: User root from 36.66.16.233 not allowed because not listed in AllowUsers", "Oct 8 12:05:03 hecnet-us-east-gw sshd[2352552]: Failed password for invalid user root from 36.66.16.233 port 38384 ssh2", "Oct 8 12:05:04 hecnet-us-east-gw sshd[2352552]: Disconnected from invalid user root 36.66.16.233 port 38384 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2352552]: ", "ip4": "36.66.16.233", "users": "['root']", "user": "root"} 49.51.228.187 #sshd|1791461345|172800|1|{"matches": ["Oct 8 12:09:02 hecnet-us-east-gw sshd[2352618]: User root from 49.51.228.187 not allowed because not listed in AllowUsers", "Oct 8 12:09:04 hecnet-us-east-gw sshd[2352618]: Failed password for invalid user root from 49.51.228.187 port 41824 ssh2", "Oct 8 12:09:05 hecnet-us-east-gw sshd[2352618]: Disconnected from invalid user root 49.51.228.187 port 41824 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2352618]: ", "ip4": "49.51.228.187", "users": "['root']", "user": "root"} 36.163.100.194 #sshd|1791469151|172800|1|{"matches": ["Oct 8 14:19:07 hecnet-us-east-gw sshd[2353493]: User root from 36.163.100.194 not allowed because not listed in AllowUsers", "Oct 8 14:19:09 hecnet-us-east-gw sshd[2353493]: Failed password for invalid user root from 36.163.100.194 port 44846 ssh2", "Oct 8 14:19:11 hecnet-us-east-gw sshd[2353493]: Disconnected from invalid user root 36.163.100.194 port 44846 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2353493]: ", "ip4": "36.163.100.194", "users": "['root']", "user": "root"} 109.160.32.47 #sshd|1791469394|172800|1|{"matches": ["Oct 8 14:22:26 hecnet-us-east-gw sshd[2353523]: Failed none for invalid user from 109.160.32.47 port 43678 ssh2", "Oct 8 14:23:13 hecnet-us-east-gw sshd[2353580]: Connection from 109.160.32.47 port 57784 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 8 14:23:14 hecnet-us-east-gw sshd[2353580]: Invalid user kubernetes from 109.160.32.47 port 57784"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2353523]: ", "ip4": "109.160.32.47", "user": ""} 78.189.148.84 #sshd|1791472318|172800|1|{"matches": ["Oct 8 15:11:52 hecnet-us-east-gw sshd[2353916]: User root from 78.189.148.84 not allowed because not listed in AllowUsers", "Oct 8 15:11:55 hecnet-us-east-gw sshd[2353916]: Failed none for invalid user root from 78.189.148.84 port 49598 ssh2", "Oct 8 15:11:58 hecnet-us-east-gw sshd[2353916]: Failed password for invalid user root from 78.189.148.84 port 49598 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2353916]: ", "ip4": "78.189.148.84", "users": "['root']", "user": "root"} 61.76.136.25 #sshd|1791475661|172800|1|{"matches": ["Oct 8 16:07:39 hecnet-us-east-gw sshd[2354274]: User root from 61.76.136.25 not allowed because not listed in AllowUsers", "Oct 8 16:07:41 hecnet-us-east-gw sshd[2354274]: Failed password for invalid user root from 61.76.136.25 port 58144 ssh2", "Oct 8 16:07:41 hecnet-us-east-gw sshd[2354274]: Disconnected from invalid user root 61.76.136.25 port 58144 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2354274]: ", "ip4": "61.76.136.25", "users": "['root']", "user": "root"} 121.227.31.13 #sshd|1791475816|172800|1|{"matches": ["Oct 8 16:10:13 hecnet-us-east-gw sshd[2354319]: Invalid user test from 121.227.31.13 port 41896", "Oct 8 16:10:16 hecnet-us-east-gw sshd[2354319]: Failed password for invalid user test from 121.227.31.13 port 41896 ssh2", "Oct 8 16:10:16 hecnet-us-east-gw sshd[2354319]: Disconnected from invalid user test 121.227.31.13 port 41896 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2354319]: ", "ip4": "121.227.31.13", "users": "['test']", "user": "test"} 78.138.168.46 #sshd|1791475871|172800|1|{"matches": ["Oct 8 16:11:07 hecnet-us-east-gw sshd[2354344]: User root from 78.138.168.46 not allowed because not listed in AllowUsers", "Oct 8 16:11:09 hecnet-us-east-gw sshd[2354344]: Failed password for invalid user root from 78.138.168.46 port 53990 ssh2", "Oct 8 16:11:11 hecnet-us-east-gw sshd[2354344]: Disconnected from invalid user root 78.138.168.46 port 53990 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2354344]: ", "ip4": "78.138.168.46", "users": "['root']", "user": "root"} 103.189.234.27 #sshd|1791476002|172800|1|{"matches": ["Oct 8 16:13:19 hecnet-us-east-gw sshd[2354376]: Invalid user ts3 from 103.189.234.27 port 53528", "Oct 8 16:13:21 hecnet-us-east-gw sshd[2354376]: Failed password for invalid user ts3 from 103.189.234.27 port 53528 ssh2", "Oct 8 16:13:22 hecnet-us-east-gw sshd[2354376]: Disconnected from invalid user ts3 103.189.234.27 port 53528 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2354376]: ", "ip4": "103.189.234.27", "users": "['ts3']", "user": "ts3"} 129.204.9.248 #sshd|1791476611|172800|1|{"matches": ["Oct 8 16:10:11 hecnet-us-east-gw sshd[2354317]: Failed password for invalid user wpuser from 129.204.9.248 port 46938 ssh2", "Oct 8 16:23:28 hecnet-us-east-gw sshd[2354492]: Connection from 129.204.9.248 port 51694 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 8 16:23:31 hecnet-us-east-gw sshd[2354492]: Invalid user testuser from 129.204.9.248 port 51694"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2354317]: ", "ip4": "129.204.9.248", "users": "['wpuser']", "user": "wpuser"} 95.85.226.199 #sshd|1791477220|172800|1|{"matches": ["Oct 8 16:33:37 hecnet-us-east-gw sshd[2354584]: Invalid user admin from 95.85.226.199 port 42828", "Oct 8 16:33:39 hecnet-us-east-gw sshd[2354584]: Failed password for invalid user admin from 95.85.226.199 port 42828 ssh2", "Oct 8 16:33:40 hecnet-us-east-gw sshd[2354584]: Disconnected from invalid user admin 95.85.226.199 port 42828 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2354584]: ", "ip4": "95.85.226.199", "users": "['admin']", "user": "admin"} 41.93.28.23 #sshd|1791477594|172800|1|{"matches": ["Oct 8 16:39:52 hecnet-us-east-gw sshd[2354677]: User root from 41.93.28.23 not allowed because not listed in AllowUsers", "Oct 8 16:39:53 hecnet-us-east-gw sshd[2354677]: Failed password for invalid user root from 41.93.28.23 port 60714 ssh2", "Oct 8 16:39:54 hecnet-us-east-gw sshd[2354677]: Disconnected from invalid user root 41.93.28.23 port 60714 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2354677]: ", "ip4": "41.93.28.23", "users": "['root']", "user": "root"} 49.207.243.207 #sshd|1791478216|172800|1|{"matches": ["Oct 8 16:50:14 hecnet-us-east-gw sshd[2354776]: User root from 49.207.243.207 not allowed because not listed in AllowUsers", "Oct 8 16:50:16 hecnet-us-east-gw sshd[2354776]: Failed password for invalid user root from 49.207.243.207 port 23013 ssh2", "Oct 8 16:50:16 hecnet-us-east-gw sshd[2354776]: Disconnected from invalid user root 49.207.243.207 port 23013 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2354776]: ", "ip4": "49.207.243.207", "users": "['root']", "user": "root"} 43.153.45.39 #sshd|1791478473|172800|1|{"matches": ["Oct 8 16:54:29 hecnet-us-east-gw sshd[2354807]: User root from 43.153.45.39 not allowed because not listed in AllowUsers", "Oct 8 16:54:31 hecnet-us-east-gw sshd[2354807]: Failed password for invalid user root from 43.153.45.39 port 53686 ssh2", "Oct 8 16:54:33 hecnet-us-east-gw sshd[2354807]: Disconnected from invalid user root 43.153.45.39 port 53686 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2354807]: ", "ip4": "43.153.45.39", "users": "['root']", "user": "root"} 114.98.230.202 #sshd|1791478701|172800|1|{"matches": ["Oct 8 16:58:17 hecnet-us-east-gw sshd[2354839]: Invalid user azureuser from 114.98.230.202 port 54176", "Oct 8 16:58:19 hecnet-us-east-gw sshd[2354839]: Failed password for invalid user azureuser from 114.98.230.202 port 54176 ssh2", "Oct 8 16:58:21 hecnet-us-east-gw sshd[2354839]: Disconnected from invalid user azureuser 114.98.230.202 port 54176 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2354839]: ", "ip4": "114.98.230.202", "users": "['azureuser']", "user": "azureuser"} 170.106.72.136 #sshd|1791478932|172800|1|{"matches": ["Oct 8 17:02:09 hecnet-us-east-gw sshd[2354883]: Invalid user vivek from 170.106.72.136 port 38182", "Oct 8 17:02:11 hecnet-us-east-gw sshd[2354883]: Failed password for invalid user vivek from 170.106.72.136 port 38182 ssh2", "Oct 8 17:02:12 hecnet-us-east-gw sshd[2354883]: Disconnected from invalid user vivek 170.106.72.136 port 38182 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2354883]: ", "ip4": "170.106.72.136", "users": "['vivek']", "user": "vivek"} 20.92.77.159 #lighttpd-scans|1791479023|172800|1|{"matches": [["", "Oct 8 17:03:37", " hecnet-us-east-gw lighttpd[1017]: 20.92.77.159 impvax.duckdns.org - [08/Oct/2026:17:03:37 +0000] \"GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1\" 404 341 \"-\" \"-\""], "Oct 8 17:03:38 hecnet-us-east-gw lighttpd[1017]: 20.92.77.159 impvax.duckdns.org - [08/Oct/2026:17:03:38 +0000] \"GET /this_is_a_new_hello_world.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 8 17:03:38 hecnet-us-east-gw lighttpd[1017]: 20.92.77.159 impvax.duckdns.org - [08/Oct/2026:17:03:38 +0000] \"GET /admin.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 8 17:03:39 hecnet-us-east-gw lighttpd[1017]: 20.92.77.159 impvax.duckdns.org - [08/Oct/2026:17:03:39 +0000] \"GET /goods.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 8 17:03:40 hecnet-us-east-gw lighttpd[1017]: 20.92.77.159 impvax.duckdns.org - [08/Oct/2026:17:03:40 +0000] \"GET /file.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 8 17:03:41 hecnet-us-east-gw lighttpd[1017]: 20.92.77.159 impvax.duckdns.org - [08/Oct/2026:17:03:41 +0000] \"GET /adminfuns.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 8 17:03:42 hecnet-us-east-gw lighttpd[1017]: 20.92.77.159 impvax.duckdns.org - [08/Oct/2026:17:03:42 +0000] \"GET /404.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 8 17:03:43 hecnet-us-east-gw lighttpd[1017]: 20.92.77.159 impvax.duckdns.org - [08/Oct/2026:17:03:43 +0000] \"GET /wk/index.php HTTP/1.1\" 404 341 \"-\" \"-\""], "failures": 8, "ip4": "20.92.77.159"} 101.47.159.125 #sshd|1791479139|172800|1|{"matches": ["Oct 8 17:05:35 hecnet-us-east-gw sshd[2354964]: Invalid user ec2-user from 101.47.159.125 port 45124", "Oct 8 17:05:37 hecnet-us-east-gw sshd[2354964]: Failed password for invalid user ec2-user from 101.47.159.125 port 45124 ssh2", "Oct 8 17:05:39 hecnet-us-east-gw sshd[2354964]: Disconnected from invalid user ec2-user 101.47.159.125 port 45124 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2354964]: ", "ip4": "101.47.159.125", "users": "['ec2-user']", "user": "ec2-user"} 86.13.215.13 #sshd|1791479356|172800|1|{"matches": ["Oct 8 17:09:13 hecnet-us-east-gw sshd[2355018]: Invalid user claude from 86.13.215.13 port 33882", "Oct 8 17:09:15 hecnet-us-east-gw sshd[2355018]: Failed password for invalid user claude from 86.13.215.13 port 33882 ssh2", "Oct 8 17:09:16 hecnet-us-east-gw sshd[2355018]: Disconnected from invalid user claude 86.13.215.13 port 33882 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2355018]: ", "ip4": "86.13.215.13", "users": "['claude']", "user": "claude"} 42.51.41.252 #sshd|1791479854|172800|1|{"matches": ["Oct 8 17:06:12 hecnet-us-east-gw sshd[2355006]: Failed password for invalid user hk from 42.51.41.252 port 41434 ssh2", "Oct 8 17:17:33 hecnet-us-east-gw sshd[2355123]: Connection from 42.51.41.252 port 60170 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 8 17:17:34 hecnet-us-east-gw sshd[2355123]: Invalid user nima from 42.51.41.252 port 60170"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2355006]: ", "ip4": "42.51.41.252", "users": "['hk']", "user": "hk"} 42.249.228.42 #sshd|1791479879|172800|1|{"matches": ["Oct 8 17:17:55 hecnet-us-east-gw sshd[2355146]: User root from 42.249.228.42 not allowed because not listed in AllowUsers", "Oct 8 17:17:57 hecnet-us-east-gw sshd[2355146]: Failed password for invalid user root from 42.249.228.42 port 58892 ssh2", "Oct 8 17:17:59 hecnet-us-east-gw sshd[2355146]: Disconnected from invalid user root 42.249.228.42 port 58892 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2355146]: ", "ip4": "42.249.228.42", "users": "['root']", "user": "root"} 89.176.0.185 #sshd|1791480329|172800|1|{"matches": ["Oct 8 17:25:23 hecnet-us-east-gw sshd[2355205]: User root from 89.176.0.185 not allowed because not listed in AllowUsers", "Oct 8 17:25:25 hecnet-us-east-gw sshd[2355205]: Failed password for invalid user root from 89.176.0.185 port 56398 ssh2", "Oct 8 17:25:29 hecnet-us-east-gw sshd[2355205]: Failed password for invalid user root from 89.176.0.185 port 56398 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2355205]: ", "ip4": "89.176.0.185", "users": "['root']", "user": "root"} 111.22.5.101 #sshd|1791483802|172800|1|{"matches": ["Oct 8 18:23:18 hecnet-us-east-gw sshd[2355554]: User root from 111.22.5.101 not allowed because not listed in AllowUsers", "Oct 8 18:23:20 hecnet-us-east-gw sshd[2355554]: Failed password for invalid user root from 111.22.5.101 port 44260 ssh2", "Oct 8 18:23:22 hecnet-us-east-gw sshd[2355554]: Disconnected from invalid user root 111.22.5.101 port 44260 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2355554]: ", "ip4": "111.22.5.101", "users": "['root']", "user": "root"} 20.214.170.255 #lighttpd-scans|1791486637|172800|1|{"matches": [["", "Oct 8 19:10:33", " hecnet-us-east-gw lighttpd[1017]: 20.214.170.255 impvax.duckdns.org - [08/Oct/2026:19:10:32 +0000] \"GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1\" 404 341 \"-\" \"-\""], "Oct 8 19:10:33 hecnet-us-east-gw lighttpd[1017]: 20.214.170.255 impvax.duckdns.org - [08/Oct/2026:19:10:33 +0000] \"GET /this_is_a_new_hello_world.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 8 19:10:34 hecnet-us-east-gw lighttpd[1017]: 20.214.170.255 impvax.duckdns.org - [08/Oct/2026:19:10:34 +0000] \"GET /samll.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 8 19:10:34 hecnet-us-east-gw lighttpd[1017]: 20.214.170.255 impvax.duckdns.org - [08/Oct/2026:19:10:34 +0000] \"GET /lock.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 8 19:10:35 hecnet-us-east-gw lighttpd[1017]: 20.214.170.255 impvax.duckdns.org - [08/Oct/2026:19:10:35 +0000] \"GET /adminfuns.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 8 19:10:36 hecnet-us-east-gw lighttpd[1017]: 20.214.170.255 impvax.duckdns.org - [08/Oct/2026:19:10:36 +0000] \"GET /222.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 8 19:10:36 hecnet-us-east-gw lighttpd[1017]: 20.214.170.255 impvax.duckdns.org - [08/Oct/2026:19:10:36 +0000] \"GET /3PJcpMFsD8B.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 8 19:10:37 hecnet-us-east-gw lighttpd[1017]: 20.214.170.255 impvax.duckdns.org - [08/Oct/2026:19:10:36 +0000] \"GET /media.php HTTP/1.1\" 404 341 \"-\" \"-\""], "failures": 8, "ip4": "20.214.170.255"} 181.228.80.171 #sshd|1791487255|172800|1|{"matches": ["Oct 8 19:20:50 hecnet-us-east-gw sshd[2355956]: User root from 181.228.80.171 not allowed because not listed in AllowUsers", "Oct 8 19:20:53 hecnet-us-east-gw sshd[2355956]: Failed password for invalid user root from 181.228.80.171 port 53390 ssh2", "Oct 8 19:20:55 hecnet-us-east-gw sshd[2355956]: Disconnected from invalid user root 181.228.80.171 port 53390 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2355956]: ", "ip4": "181.228.80.171", "users": "['root']", "user": "root"} 106.251.244.178 #sshd|1791487530|172800|1|{"matches": ["Oct 8 19:25:27 hecnet-us-east-gw sshd[2356036]: User root from 106.251.244.178 not allowed because not listed in AllowUsers", "Oct 8 19:25:29 hecnet-us-east-gw sshd[2356036]: Failed password for invalid user root from 106.251.244.178 port 32828 ssh2", "Oct 8 19:25:30 hecnet-us-east-gw sshd[2356036]: Disconnected from invalid user root 106.251.244.178 port 32828 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2356036]: ", "ip4": "106.251.244.178", "users": "['root']", "user": "root"} 152.32.213.175 #sshd|1791488160|172800|1|{"matches": ["Oct 8 19:35:58 hecnet-us-east-gw sshd[2356131]: User root from 152.32.213.175 not allowed because not listed in AllowUsers", "Oct 8 19:35:59 hecnet-us-east-gw sshd[2356131]: Failed password for invalid user root from 152.32.213.175 port 43948 ssh2", "Oct 8 19:36:00 hecnet-us-east-gw sshd[2356131]: Disconnected from invalid user root 152.32.213.175 port 43948 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2356131]: ", "ip4": "152.32.213.175", "users": "['root']", "user": "root"} 136.228.161.66 #sshd|1791488183|172800|1|{"matches": ["Oct 8 19:36:21 hecnet-us-east-gw sshd[2356154]: Invalid user user1 from 136.228.161.66 port 47946", "Oct 8 19:36:22 hecnet-us-east-gw sshd[2356154]: Failed password for invalid user user1 from 136.228.161.66 port 47946 ssh2", "Oct 8 19:36:23 hecnet-us-east-gw sshd[2356154]: Disconnected from invalid user user1 136.228.161.66 port 47946 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2356154]: ", "ip4": "136.228.161.66", "users": "['user1']", "user": "user1"} 103.216.119.46 #sshd|1791490215|172800|1|{"matches": ["Oct 8 20:10:12 hecnet-us-east-gw sshd[2356402]: User root from 103.216.119.46 not allowed because not listed in AllowUsers", "Oct 8 20:10:14 hecnet-us-east-gw sshd[2356402]: Failed password for invalid user root from 103.216.119.46 port 49068 ssh2", "Oct 8 20:10:15 hecnet-us-east-gw sshd[2356402]: Disconnected from invalid user root 103.216.119.46 port 49068 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2356402]: ", "ip4": "103.216.119.46", "users": "['root']", "user": "root"} 210.183.21.53 #sshd|1791490253|172800|1|{"matches": ["Oct 8 20:10:49 hecnet-us-east-gw sshd[2356424]: Invalid user git from 210.183.21.53 port 47876", "Oct 8 20:10:51 hecnet-us-east-gw sshd[2356424]: Failed password for invalid user git from 210.183.21.53 port 47876 ssh2", "Oct 8 20:10:53 hecnet-us-east-gw sshd[2356424]: Disconnected from invalid user git 210.183.21.53 port 47876 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2356424]: ", "ip4": "210.183.21.53", "users": "['git']", "user": "git"} 171.237.176.209 #sshd|1791490295|172800|1|{"matches": ["Oct 8 20:11:31 hecnet-us-east-gw sshd[2356445]: User root from 171.237.176.209 not allowed because not listed in AllowUsers", "Oct 8 20:11:33 hecnet-us-east-gw sshd[2356445]: Failed password for invalid user root from 171.237.176.209 port 38244 ssh2", "Oct 8 20:11:35 hecnet-us-east-gw sshd[2356445]: Disconnected from invalid user root 171.237.176.209 port 38244 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2356445]: ", "ip4": "171.237.176.209", "users": "['root']", "user": "root"} 211.254.212.59 #sshd|1791490325|172800|1|{"matches": ["Oct 8 20:12:01 hecnet-us-east-gw sshd[2356474]: User root from 211.254.212.59 not allowed because not listed in AllowUsers", "Oct 8 20:12:03 hecnet-us-east-gw sshd[2356474]: Failed password for invalid user root from 211.254.212.59 port 42650 ssh2", "Oct 8 20:12:05 hecnet-us-east-gw sshd[2356474]: Disconnected from invalid user root 211.254.212.59 port 42650 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2356474]: ", "ip4": "211.254.212.59", "users": "['root']", "user": "root"} 114.12.17.98 #sshd|1791490335|172800|1|{"matches": ["Oct 8 20:12:11 hecnet-us-east-gw sshd[2356494]: User root from 114.12.17.98 not allowed because not listed in AllowUsers", "Oct 8 20:12:13 hecnet-us-east-gw sshd[2356494]: Failed password for invalid user root from 114.12.17.98 port 12330 ssh2", "Oct 8 20:12:15 hecnet-us-east-gw sshd[2356494]: Disconnected from invalid user root 114.12.17.98 port 12330 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2356494]: ", "ip4": "114.12.17.98", "users": "['root']", "user": "root"} 117.50.226.213 #sshd|1791496968|172800|1|{"matches": ["Oct 8 22:02:46 hecnet-us-east-gw sshd[2357244]: User root from 117.50.226.213 not allowed because not listed in AllowUsers", "Oct 8 22:02:47 hecnet-us-east-gw sshd[2357244]: Failed password for invalid user root from 117.50.226.213 port 60478 ssh2", "Oct 8 22:02:48 hecnet-us-east-gw sshd[2357244]: Disconnected from invalid user root 117.50.226.213 port 60478 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2357244]: ", "ip4": "117.50.226.213", "users": "['root']", "user": "root"} 14.103.118.140 #sshd|1791499122|172800|1|{"matches": ["Oct 8 22:38:40 hecnet-us-east-gw sshd[2357537]: User root from 14.103.118.140 not allowed because not listed in AllowUsers", "Oct 8 22:38:42 hecnet-us-east-gw sshd[2357537]: Failed password for invalid user root from 14.103.118.140 port 56342 ssh2", "Oct 8 22:38:42 hecnet-us-east-gw sshd[2357537]: Disconnected from invalid user root 14.103.118.140 port 56342 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2357537]: ", "ip4": "14.103.118.140", "users": "['root']", "user": "root"} 101.47.15.119 #sshd|1791501747|172800|1|{"matches": ["Oct 8 23:22:24 hecnet-us-east-gw sshd[2357825]: Invalid user camera from 101.47.15.119 port 49410", "Oct 8 23:22:27 hecnet-us-east-gw sshd[2357825]: Failed password for invalid user camera from 101.47.15.119 port 49410 ssh2", "Oct 8 23:22:27 hecnet-us-east-gw sshd[2357825]: Disconnected from invalid user camera 101.47.15.119 port 49410 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2357825]: ", "ip4": "101.47.15.119", "users": "['camera']", "user": "camera"} 45.120.216.232 #sshd|1791501773|172800|1|{"matches": ["Oct 8 23:22:48 hecnet-us-east-gw sshd[2357850]: Invalid user developer from 45.120.216.232 port 57720", "Oct 8 23:22:50 hecnet-us-east-gw sshd[2357850]: Failed password for invalid user developer from 45.120.216.232 port 57720 ssh2", "Oct 8 23:22:53 hecnet-us-east-gw sshd[2357850]: Disconnected from invalid user developer 45.120.216.232 port 57720 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2357850]: ", "ip4": "45.120.216.232", "users": "['developer']", "user": "developer"} 167.71.211.40 #sshd|1791501960|172800|1|{"matches": ["Oct 8 23:25:57 hecnet-us-east-gw sshd[2357903]: User root from 167.71.211.40 not allowed because not listed in AllowUsers", "Oct 8 23:25:59 hecnet-us-east-gw sshd[2357903]: Failed password for invalid user root from 167.71.211.40 port 47592 ssh2", "Oct 8 23:26:00 hecnet-us-east-gw sshd[2357903]: Disconnected from invalid user root 167.71.211.40 port 47592 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2357903]: ", "ip4": "167.71.211.40", "users": "['root']", "user": "root"} 124.45.31.57 #sshd|1791502449|172800|1|{"matches": ["Oct 8 23:34:06 hecnet-us-east-gw sshd[2357961]: Invalid user admin from 124.45.31.57 port 60551", "Oct 8 23:34:08 hecnet-us-east-gw sshd[2357961]: Failed password for invalid user admin from 124.45.31.57 port 60551 ssh2", "Oct 8 23:34:09 hecnet-us-east-gw sshd[2357961]: Disconnected from invalid user admin 124.45.31.57 port 60551 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2357961]: ", "ip4": "124.45.31.57", "users": "['admin']", "user": "admin"} 58.98.250.26 #sshd|1791506682|172800|1|{"matches": ["Oct 9 00:44:37 hecnet-us-east-gw sshd[2358549]: User root from 58.98.250.26 not allowed because not listed in AllowUsers", "Oct 9 00:44:39 hecnet-us-east-gw sshd[2358549]: Failed password for invalid user root from 58.98.250.26 port 56240 ssh2", "Oct 9 00:44:42 hecnet-us-east-gw sshd[2358549]: Disconnected from invalid user root 58.98.250.26 port 56240 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2358549]: ", "ip4": "58.98.250.26", "users": "['root']", "user": "root"} 193.24.211.218 #sshd|1791511085|172800|1|{"matches": ["Oct 9 01:58:01 hecnet-us-east-gw sshd[2359048]: Invalid user admin from 193.24.211.218 port 51611", "Oct 9 01:58:03 hecnet-us-east-gw sshd[2359048]: Failed none for invalid user admin from 193.24.211.218 port 51611 ssh2", "Oct 9 01:58:05 hecnet-us-east-gw sshd[2359048]: Failed password for invalid user admin from 193.24.211.218 port 51611 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2359048]: ", "ip4": "193.24.211.218", "users": "['admin']", "user": "admin"} 2.57.122.76 #sshd|1791516054|172800|1|{"matches": ["Oct 9 03:20:47 hecnet-us-east-gw sshd[2359645]: User root from 2.57.122.76 not allowed because not listed in AllowUsers", "Oct 9 03:20:49 hecnet-us-east-gw sshd[2359645]: Failed none for invalid user root from 2.57.122.76 port 56364 ssh2", "Oct 9 03:20:54 hecnet-us-east-gw sshd[2359645]: Failed password for invalid user root from 2.57.122.76 port 56364 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2359645]: ", "ip4": "2.57.122.76", "users": "['root']", "user": "root"} 125.212.222.148 #sshd|1791519927|172800|1|{"matches": ["Oct 9 04:25:25 hecnet-us-east-gw sshd[2360102]: User root from 125.212.222.148 not allowed because not listed in AllowUsers", "Oct 9 04:25:26 hecnet-us-east-gw sshd[2360102]: Failed password for invalid user root from 125.212.222.148 port 39420 ssh2", "Oct 9 04:25:27 hecnet-us-east-gw sshd[2360102]: Disconnected from invalid user root 125.212.222.148 port 39420 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2360102]: ", "ip4": "125.212.222.148", "users": "['root']", "user": "root"} 129.121.120.159 #sshd|1791520592|172800|1|{"matches": ["Oct 9 04:36:30 hecnet-us-east-gw sshd[2360198]: Invalid user test01 from 129.121.120.159 port 55718", "Oct 9 04:36:31 hecnet-us-east-gw sshd[2360198]: Failed password for invalid user test01 from 129.121.120.159 port 55718 ssh2", "Oct 9 04:36:32 hecnet-us-east-gw sshd[2360198]: Disconnected from invalid user test01 129.121.120.159 port 55718 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2360198]: ", "ip4": "129.121.120.159", "users": "['test01']", "user": "test01"} 124.156.119.92 #sshd|1791520718|172800|1|{"matches": ["Oct 9 04:38:36 hecnet-us-east-gw sshd[2360230]: User root from 124.156.119.92 not allowed because not listed in AllowUsers", "Oct 9 04:38:37 hecnet-us-east-gw sshd[2360230]: Failed password for invalid user root from 124.156.119.92 port 36394 ssh2", "Oct 9 04:38:38 hecnet-us-east-gw sshd[2360230]: Disconnected from invalid user root 124.156.119.92 port 36394 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2360230]: ", "ip4": "124.156.119.92", "users": "['root']", "user": "root"} 50.114.236.21 #sshd|1791522119|172800|1|{"matches": ["Oct 9 05:01:57 hecnet-us-east-gw sshd[2360381]: Invalid user rahul from 50.114.236.21 port 60516", "Oct 9 05:01:59 hecnet-us-east-gw sshd[2360381]: Failed password for invalid user rahul from 50.114.236.21 port 60516 ssh2", "Oct 9 05:01:59 hecnet-us-east-gw sshd[2360381]: Disconnected from invalid user rahul 50.114.236.21 port 60516 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2360381]: ", "ip4": "50.114.236.21", "users": "['rahul']", "user": "rahul"} 117.72.152.142 #sshd|1791524561|172800|1|{"matches": ["Oct 9 05:42:39 hecnet-us-east-gw sshd[2360727]: User root from 117.72.152.142 not allowed because not listed in AllowUsers", "Oct 9 05:42:41 hecnet-us-east-gw sshd[2360727]: Failed password for invalid user root from 117.72.152.142 port 37878 ssh2", "Oct 9 05:42:41 hecnet-us-east-gw sshd[2360727]: Disconnected from invalid user root 117.72.152.142 port 37878 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2360727]: ", "ip4": "117.72.152.142", "users": "['root']", "user": "root"} 20.197.26.46 #lighttpd-scans|1791525578|172800|1|{"matches": [["", "Oct 9 05:59:26", " hecnet-us-east-gw lighttpd[1017]: 20.197.26.46 hecnet-us-east-gw.duckdns.org - [09/Oct/2026:05:59:25 +0000] \"GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1\" 404 341 \"-\" \"-\""], "Oct 9 05:59:28 hecnet-us-east-gw lighttpd[1017]: 20.197.26.46 hecnet-us-east-gw.duckdns.org - [09/Oct/2026:05:59:27 +0000] \"GET /this_is_a_new_hello_world.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 9 05:59:31 hecnet-us-east-gw lighttpd[1017]: 20.197.26.46 hecnet-us-east-gw.duckdns.org - [09/Oct/2026:05:59:31 +0000] \"GET /admin.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 9 05:59:33 hecnet-us-east-gw lighttpd[1017]: 20.197.26.46 hecnet-us-east-gw.duckdns.org - [09/Oct/2026:05:59:33 +0000] \"GET /goods.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 9 05:59:35 hecnet-us-east-gw lighttpd[1017]: 20.197.26.46 hecnet-us-east-gw.duckdns.org - [09/Oct/2026:05:59:34 +0000] \"GET /file.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 9 05:59:36 hecnet-us-east-gw lighttpd[1017]: 20.197.26.46 hecnet-us-east-gw.duckdns.org - [09/Oct/2026:05:59:36 +0000] \"GET /adminfuns.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 9 05:59:37 hecnet-us-east-gw lighttpd[1017]: 20.197.26.46 hecnet-us-east-gw.duckdns.org - [09/Oct/2026:05:59:37 +0000] \"GET /404.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 9 05:59:38 hecnet-us-east-gw lighttpd[1017]: 20.197.26.46 hecnet-us-east-gw.duckdns.org - [09/Oct/2026:05:59:38 +0000] \"GET /wk/index.php HTTP/1.1\" 404 341 \"-\" \"-\""], "failures": 8, "ip4": "20.197.26.46"} 104.155.17.130 #sshd|1791526641|172800|1|{"matches": ["Oct 9 06:17:17 hecnet-us-east-gw sshd[2361086]: Invalid user admin from 104.155.17.130 port 35036", "Oct 9 06:17:19 hecnet-us-east-gw sshd[2361086]: Failed none for invalid user admin from 104.155.17.130 port 35036 ssh2", "Oct 9 06:17:21 hecnet-us-east-gw sshd[2361086]: Failed password for invalid user admin from 104.155.17.130 port 35036 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2361086]: ", "ip4": "104.155.17.130", "users": "['admin']", "user": "admin"} 207.175.217.99 #sshd|1791526680|172800|1|{"matches": ["Oct 9 06:17:58 hecnet-us-east-gw sshd[2361113]: Connection from 207.175.217.99 port 8184 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 9 06:17:58 hecnet-us-east-gw sshd[2361113]: Invalid user hmkgb from 207.175.217.99 port 8184", "Oct 9 06:18:00 hecnet-us-east-gw sshd[2361113]: Failed none for invalid user hmkgb from 207.175.217.99 port 8184 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2361110]: ", "ip4": "207.175.217.99"} 109.160.32.178 #sshd|1791531018|172800|1|{"matches": ["Oct 9 07:29:37 hecnet-us-east-gw sshd[2361735]: Failed none for invalid user from 109.160.32.178 port 34270 ssh2", "Oct 9 07:30:17 hecnet-us-east-gw sshd[2361753]: Connection from 109.160.32.178 port 37226 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 9 07:30:18 hecnet-us-east-gw sshd[2361753]: User proxy from 109.160.32.178 not allowed because not listed in AllowUsers"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2361735]: ", "ip4": "109.160.32.178", "user": ""} 105.28.108.165 #sshd|1791531637|172800|1|{"matches": ["Oct 9 07:40:34 hecnet-us-east-gw sshd[2361842]: User root from 105.28.108.165 not allowed because not listed in AllowUsers", "Oct 9 07:40:36 hecnet-us-east-gw sshd[2361842]: Failed password for invalid user root from 105.28.108.165 port 53694 ssh2", "Oct 9 07:40:37 hecnet-us-east-gw sshd[2361842]: Disconnected from invalid user root 105.28.108.165 port 53694 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2361842]: ", "ip4": "105.28.108.165", "users": "['root']", "user": "root"} 202.51.214.98 #sshd|1791531683|172800|1|{"matches": ["Oct 9 07:41:18 hecnet-us-east-gw sshd[2361867]: User root from 202.51.214.98 not allowed because not listed in AllowUsers", "Oct 9 07:41:21 hecnet-us-east-gw sshd[2361867]: Failed password for invalid user root from 202.51.214.98 port 50040 ssh2", "Oct 9 07:41:23 hecnet-us-east-gw sshd[2361867]: Disconnected from invalid user root 202.51.214.98 port 50040 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2361867]: ", "ip4": "202.51.214.98", "users": "['root']", "user": "root"} 114.220.238.224 #sshd|1791531736|172800|1|{"matches": ["Oct 9 07:42:14 hecnet-us-east-gw sshd[2361894]: Invalid user foundry from 114.220.238.224 port 55891", "Oct 9 07:42:15 hecnet-us-east-gw sshd[2361894]: Failed password for invalid user foundry from 114.220.238.224 port 55891 ssh2", "Oct 9 07:42:16 hecnet-us-east-gw sshd[2361894]: Disconnected from invalid user foundry 114.220.238.224 port 55891 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2361894]: ", "ip4": "114.220.238.224", "users": "['foundry']", "user": "foundry"} 129.121.123.80 #sshd|1791531994|172800|1|{"matches": ["Oct 9 07:46:31 hecnet-us-east-gw sshd[2361965]: Invalid user ray from 129.121.123.80 port 59850", "Oct 9 07:46:33 hecnet-us-east-gw sshd[2361965]: Failed password for invalid user ray from 129.121.123.80 port 59850 ssh2", "Oct 9 07:46:34 hecnet-us-east-gw sshd[2361965]: Disconnected from invalid user ray 129.121.123.80 port 59850 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2361965]: ", "ip4": "129.121.123.80", "users": "['ray']", "user": "ray"} 189.204.230.91 #sshd|1791532028|172800|1|{"matches": ["Oct 9 07:47:05 hecnet-us-east-gw sshd[2361988]: Invalid user ubuntu from 189.204.230.91 port 45877", "Oct 9 07:47:07 hecnet-us-east-gw sshd[2361988]: Failed password for invalid user ubuntu from 189.204.230.91 port 45877 ssh2", "Oct 9 07:47:08 hecnet-us-east-gw sshd[2361988]: Disconnected from invalid user ubuntu 189.204.230.91 port 45877 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2361988]: ", "ip4": "189.204.230.91", "users": "['ubuntu']", "user": "ubuntu"} 218.90.33.83 #sshd|1791532306|172800|1|{"matches": ["Oct 9 07:48:36 hecnet-us-east-gw sshd[2362010]: Failed password for invalid user unaih from 218.90.33.83 port 59104 ssh2", "Oct 9 07:51:44 hecnet-us-east-gw sshd[2362020]: Connection from 218.90.33.83 port 43448 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 9 07:51:46 hecnet-us-east-gw sshd[2362020]: User root from 218.90.33.83 not allowed because not listed in AllowUsers"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2362010]: ", "ip4": "218.90.33.83", "users": "['unaih']", "user": "unaih"} 165.154.147.69 #sshd|1791537035|172800|1|{"matches": ["Oct 9 09:10:32 hecnet-us-east-gw sshd[2362581]: Invalid user vm from 165.154.147.69 port 38318", "Oct 9 09:10:34 hecnet-us-east-gw sshd[2362581]: Failed password for invalid user vm from 165.154.147.69 port 38318 ssh2", "Oct 9 09:10:35 hecnet-us-east-gw sshd[2362581]: Disconnected from invalid user vm 165.154.147.69 port 38318 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2362581]: ", "ip4": "165.154.147.69", "users": "['vm']", "user": "vm"} 41.216.178.119 #sshd|1791537258|172800|1|{"matches": ["Oct 9 09:14:16 hecnet-us-east-gw sshd[2362645]: User root from 41.216.178.119 not allowed because not listed in AllowUsers", "Oct 9 09:14:18 hecnet-us-east-gw sshd[2362645]: Failed password for invalid user root from 41.216.178.119 port 38424 ssh2", "Oct 9 09:14:18 hecnet-us-east-gw sshd[2362645]: Disconnected from invalid user root 41.216.178.119 port 38424 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2362645]: ", "ip4": "41.216.178.119", "users": "['root']", "user": "root"} 157.230.218.106 #sshd|1791537289|172800|1|{"matches": ["Oct 9 09:14:47 hecnet-us-east-gw sshd[2362666]: User root from 157.230.218.106 not allowed because not listed in AllowUsers", "Oct 9 09:14:48 hecnet-us-east-gw sshd[2362666]: Failed password for invalid user root from 157.230.218.106 port 48424 ssh2", "Oct 9 09:14:49 hecnet-us-east-gw sshd[2362666]: Disconnected from invalid user root 157.230.218.106 port 48424 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2362666]: ", "ip4": "157.230.218.106", "users": "['root']", "user": "root"} 2.57.122.53 #sshd|1791539773|172800|1|{"matches": ["Oct 9 09:55:50 hecnet-us-east-gw sshd[2362984]: Connection reset by 2.57.122.53 port 37202 [preauth]", "Oct 9 09:56:07 hecnet-us-east-gw sshd[2362987]: Connection from 2.57.122.53 port 54962 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 9 09:56:13 hecnet-us-east-gw sshd[2362987]: Connection reset by 2.57.122.53 port 54962 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2362982]: ", "ip4": "2.57.122.53", "mlfforget": "reset"} 154.83.16.14 #sshd|1791541721|172800|1|{"matches": ["Oct 9 10:28:39 hecnet-us-east-gw sshd[2363232]: User root from 154.83.16.14 not allowed because not listed in AllowUsers", "Oct 9 10:28:40 hecnet-us-east-gw sshd[2363232]: Failed password for invalid user root from 154.83.16.14 port 55614 ssh2", "Oct 9 10:28:41 hecnet-us-east-gw sshd[2363232]: Disconnected from invalid user root 154.83.16.14 port 55614 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2363232]: ", "ip4": "154.83.16.14", "users": "['root']", "user": "root"} 106.13.95.198 #sshd|1791541779|172800|1|{"matches": ["Oct 9 10:29:36 hecnet-us-east-gw sshd[2363257]: Invalid user yoo from 106.13.95.198 port 42046", "Oct 9 10:29:38 hecnet-us-east-gw sshd[2363257]: Failed password for invalid user yoo from 106.13.95.198 port 42046 ssh2", "Oct 9 10:29:39 hecnet-us-east-gw sshd[2363257]: Disconnected from invalid user yoo 106.13.95.198 port 42046 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2363257]: ", "ip4": "106.13.95.198", "users": "['yoo']", "user": "yoo"} 106.12.181.132 #sshd|1791542742|172800|1|{"matches": ["Oct 9 10:45:40 hecnet-us-east-gw sshd[2363433]: User root from 106.12.181.132 not allowed because not listed in AllowUsers", "Oct 9 10:45:41 hecnet-us-east-gw sshd[2363433]: Failed password for invalid user root from 106.12.181.132 port 60024 ssh2", "Oct 9 10:45:42 hecnet-us-east-gw sshd[2363433]: Disconnected from invalid user root 106.12.181.132 port 60024 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2363433]: ", "ip4": "106.12.181.132", "users": "['root']", "user": "root"} 115.190.192.114 #sshd|1791543043|172800|1|{"matches": ["Oct 9 10:34:23 hecnet-us-east-gw sshd[2363312]: Failed password for invalid user root from 115.190.192.114 port 38114 ssh2", "Oct 9 10:50:41 hecnet-us-east-gw sshd[2363481]: Connection from 115.190.192.114 port 59176 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 9 10:50:43 hecnet-us-east-gw sshd[2363481]: Invalid user teste from 115.190.192.114 port 59176"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2363312]: ", "ip4": "115.190.192.114", "users": "['root']", "user": "root"} 116.255.227.108 #sshd|1791543247|172800|1|{"matches": ["Oct 9 10:33:53 hecnet-us-east-gw sshd[2363310]: Failed password for invalid user terraria from 116.255.227.108 port 59892 ssh2", "Oct 9 10:54:00 hecnet-us-east-gw sshd[2363517]: Connection from 116.255.227.108 port 35248 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 9 10:54:07 hecnet-us-east-gw sshd[2363517]: Connection closed by 116.255.227.108 port 35248 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2363310]: ", "ip4": "116.255.227.108", "users": "['terraria']", "user": "terraria"} 103.159.54.61 #sshd|1791543618|172800|1|{"matches": ["Oct 9 11:00:15 hecnet-us-east-gw sshd[2363583]: User root from 103.159.54.61 not allowed because not listed in AllowUsers", "Oct 9 11:00:17 hecnet-us-east-gw sshd[2363583]: Failed password for invalid user root from 103.159.54.61 port 34219 ssh2", "Oct 9 11:00:18 hecnet-us-east-gw sshd[2363583]: Disconnected from invalid user root 103.159.54.61 port 34219 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2363583]: ", "ip4": "103.159.54.61", "users": "['root']", "user": "root"} 103.187.165.26 #sshd|1791544115|172800|1|{"matches": ["Oct 9 11:08:33 hecnet-us-east-gw sshd[2363652]: User root from 103.187.165.26 not allowed because not listed in AllowUsers", "Oct 9 11:08:34 hecnet-us-east-gw sshd[2363652]: Failed password for invalid user root from 103.187.165.26 port 39168 ssh2", "Oct 9 11:08:35 hecnet-us-east-gw sshd[2363652]: Disconnected from invalid user root 103.187.165.26 port 39168 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2363652]: ", "ip4": "103.187.165.26", "users": "['root']", "user": "root"} 210.245.20.230 #sshd|1791545679|172800|1|{"matches": ["Oct 9 11:34:35 hecnet-us-east-gw sshd[2363868]: User root from 210.245.20.230 not allowed because not listed in AllowUsers", "Oct 9 11:34:37 hecnet-us-east-gw sshd[2363868]: Failed password for invalid user root from 210.245.20.230 port 38388 ssh2", "Oct 9 11:34:39 hecnet-us-east-gw sshd[2363868]: Disconnected from invalid user root 210.245.20.230 port 38388 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2363868]: ", "ip4": "210.245.20.230", "users": "['root']", "user": "root"} 50.6.249.246 #sshd|1791546013|172800|1|{"matches": ["Oct 9 11:40:10 hecnet-us-east-gw sshd[2363954]: Invalid user ftpuser from 50.6.249.246 port 47518", "Oct 9 11:40:12 hecnet-us-east-gw sshd[2363954]: Failed password for invalid user ftpuser from 50.6.249.246 port 47518 ssh2", "Oct 9 11:40:13 hecnet-us-east-gw sshd[2363954]: Disconnected from invalid user ftpuser 50.6.249.246 port 47518 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2363954]: ", "ip4": "50.6.249.246", "users": "['ftpuser']", "user": "ftpuser"} 20.210.186.186 #lighttpd-scans|1791547015|172800|1|{"matches": [["", "Oct 9 11:56:53", " hecnet-us-east-gw lighttpd[1017]: 20.210.186.186 impvax.duckdns.org - [09/Oct/2026:11:56:53 +0000] \"GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1\" 404 341 \"-\" \"-\""], "Oct 9 11:56:53 hecnet-us-east-gw lighttpd[1017]: 20.210.186.186 impvax.duckdns.org - [09/Oct/2026:11:56:53 +0000] \"GET /this_is_a_new_hello_world.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 9 11:56:54 hecnet-us-east-gw lighttpd[1017]: 20.210.186.186 impvax.duckdns.org - [09/Oct/2026:11:56:54 +0000] \"GET /log-in.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 9 11:56:54 hecnet-us-east-gw lighttpd[1017]: 20.210.186.186 impvax.duckdns.org - [09/Oct/2026:11:56:54 +0000] \"GET /wss.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 9 11:56:54 hecnet-us-east-gw lighttpd[1017]: 20.210.186.186 impvax.duckdns.org - [09/Oct/2026:11:56:54 +0000] \"GET /c4.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 9 11:56:55 hecnet-us-east-gw lighttpd[1017]: 20.210.186.186 impvax.duckdns.org - [09/Oct/2026:11:56:55 +0000] \"GET /wp-trbacks.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 9 11:56:55 hecnet-us-east-gw lighttpd[1017]: 20.210.186.186 impvax.duckdns.org - [09/Oct/2026:11:56:55 +0000] \"GET /dodo.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 9 11:56:55 hecnet-us-east-gw lighttpd[1017]: 20.210.186.186 impvax.duckdns.org - [09/Oct/2026:11:56:55 +0000] \"GET /mails.php HTTP/1.1\" 404 341 \"-\" \"-\""], "failures": 8, "ip4": "20.210.186.186"} 183.71.242.250 #sshd|1791549173|172800|1|{"matches": ["Oct 9 12:31:24 hecnet-us-east-gw sshd[2364360]: Failed none for invalid user root from 183.71.242.250 port 23183 ssh2", "Oct 9 12:32:51 hecnet-us-east-gw sshd[2364364]: Connection from 183.71.242.250 port 29216 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 9 12:32:53 hecnet-us-east-gw sshd[2364364]: User root from 183.71.242.250 not allowed because not listed in AllowUsers"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2364360]: ", "ip4": "183.71.242.250", "users": "['root']", "user": "root"} 109.160.32.129 #sshd|1791549372|172800|1|{"matches": ["Oct 9 12:35:35 hecnet-us-east-gw sshd[2364426]: Failed none for invalid user from 109.160.32.129 port 52864 ssh2", "Oct 9 12:36:12 hecnet-us-east-gw sshd[2364429]: Connection from 109.160.32.129 port 35988 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 9 12:36:12 hecnet-us-east-gw sshd[2364429]: Invalid user desktop from 109.160.32.129 port 35988"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2364426]: ", "ip4": "109.160.32.129", "user": ""} 52.141.3.247 #lighttpd-scans|1791549856|172800|1|{"matches": [["", "Oct 9 12:44:13", " hecnet-us-east-gw lighttpd[1017]: 52.141.3.247 impvax.duckdns.org - [09/Oct/2026:12:44:13 +0000] \"GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1\" 404 341 \"-\" \"-\""], "Oct 9 12:44:13 hecnet-us-east-gw lighttpd[1017]: 52.141.3.247 impvax.duckdns.org - [09/Oct/2026:12:44:13 +0000] \"GET /this_is_a_new_hello_world.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 9 12:44:14 hecnet-us-east-gw lighttpd[1017]: 52.141.3.247 impvax.duckdns.org - [09/Oct/2026:12:44:14 +0000] \"GET /wsd.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 9 12:44:14 hecnet-us-east-gw lighttpd[1017]: 52.141.3.247 impvax.duckdns.org - [09/Oct/2026:12:44:14 +0000] \"GET /go.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 9 12:44:15 hecnet-us-east-gw lighttpd[1017]: 52.141.3.247 impvax.duckdns.org - [09/Oct/2026:12:44:15 +0000] \"GET /3PJcpMFsD8B.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 9 12:44:15 hecnet-us-east-gw lighttpd[1017]: 52.141.3.247 impvax.duckdns.org - [09/Oct/2026:12:44:15 +0000] \"GET /b8.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 9 12:44:16 hecnet-us-east-gw lighttpd[1017]: 52.141.3.247 impvax.duckdns.org - [09/Oct/2026:12:44:16 +0000] \"GET /765.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 9 12:44:16 hecnet-us-east-gw lighttpd[1017]: 52.141.3.247 impvax.duckdns.org - [09/Oct/2026:12:44:16 +0000] \"GET /wp_blog_footer.php HTTP/1.1\" 404 341 \"-\" \"-\""], "failures": 8, "ip4": "52.141.3.247"} 88.217.185.21 #sshd|1791550829|172800|1|{"matches": ["Oct 9 13:00:26 hecnet-us-east-gw sshd[2364637]: Invalid user smbuser from 88.217.185.21 port 40371", "Oct 9 13:00:28 hecnet-us-east-gw sshd[2364637]: Failed password for invalid user smbuser from 88.217.185.21 port 40371 ssh2", "Oct 9 13:00:29 hecnet-us-east-gw sshd[2364637]: Disconnected from invalid user smbuser 88.217.185.21 port 40371 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2364637]: ", "ip4": "88.217.185.21", "users": "['smbuser']", "user": "smbuser"} 103.143.10.140 #sshd|1791551094|172800|1|{"matches": ["Oct 9 13:04:50 hecnet-us-east-gw sshd[2364665]: User root from 103.143.10.140 not allowed because not listed in AllowUsers", "Oct 9 13:04:52 hecnet-us-east-gw sshd[2364665]: Failed password for invalid user root from 103.143.10.140 port 32916 ssh2", "Oct 9 13:04:54 hecnet-us-east-gw sshd[2364665]: Disconnected from invalid user root 103.143.10.140 port 32916 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2364665]: ", "ip4": "103.143.10.140", "users": "['root']", "user": "root"} 103.98.176.164 #sshd|1791551476|172800|1|{"matches": ["Oct 9 13:11:14 hecnet-us-east-gw sshd[2364761]: User root from 103.98.176.164 not allowed because not listed in AllowUsers", "Oct 9 13:11:16 hecnet-us-east-gw sshd[2364761]: Failed password for invalid user root from 103.98.176.164 port 37722 ssh2", "Oct 9 13:11:16 hecnet-us-east-gw sshd[2364761]: Disconnected from invalid user root 103.98.176.164 port 37722 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2364761]: ", "ip4": "103.98.176.164", "users": "['root']", "user": "root"} 4.206.92.183 #sshd|1791551809|172800|1|{"matches": ["Oct 9 13:16:44 hecnet-us-east-gw sshd[2364865]: Invalid user ubuntu from 4.206.92.183 port 45056", "Oct 9 13:16:46 hecnet-us-east-gw sshd[2364865]: Failed password for invalid user ubuntu from 4.206.92.183 port 45056 ssh2", "Oct 9 13:16:49 hecnet-us-east-gw sshd[2364865]: Disconnected from invalid user ubuntu 4.206.92.183 port 45056 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2364865]: ", "ip4": "4.206.92.183", "users": "['ubuntu']", "user": "ubuntu"} 14.29.170.54 #sshd|1791551927|172800|1|{"matches": ["Oct 9 13:18:45 hecnet-us-east-gw sshd[2364893]: Invalid user nils from 14.29.170.54 port 38102", "Oct 9 13:18:46 hecnet-us-east-gw sshd[2364893]: Failed password for invalid user nils from 14.29.170.54 port 38102 ssh2", "Oct 9 13:18:47 hecnet-us-east-gw sshd[2364893]: Disconnected from invalid user nils 14.29.170.54 port 38102 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2364893]: ", "ip4": "14.29.170.54", "users": "['nils']", "user": "nils"} 180.76.97.104 #sshd|1791552276|172800|1|{"matches": ["Oct 9 13:21:27 hecnet-us-east-gw sshd[2364922]: Failed password for invalid user root from 180.76.97.104 port 49264 ssh2", "Oct 9 13:24:34 hecnet-us-east-gw sshd[2364927]: Connection from 180.76.97.104 port 35452 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 9 13:24:36 hecnet-us-east-gw sshd[2364927]: Invalid user role1 from 180.76.97.104 port 35452"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2364922]: ", "ip4": "180.76.97.104", "users": "['root']", "user": "root"} 4.150.201.26 #sshd|1791552326|172800|1|{"matches": ["Oct 9 13:25:24 hecnet-us-east-gw sshd[2364980]: Invalid user family from 4.150.201.26 port 34356", "Oct 9 13:25:25 hecnet-us-east-gw sshd[2364980]: Failed password for invalid user family from 4.150.201.26 port 34356 ssh2", "Oct 9 13:25:26 hecnet-us-east-gw sshd[2364980]: Disconnected from invalid user family 4.150.201.26 port 34356 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2364980]: ", "ip4": "4.150.201.26", "users": "['family']", "user": "family"} 103.26.136.173 #sshd|1791552465|172800|1|{"matches": ["Oct 9 13:27:43 hecnet-us-east-gw sshd[2365006]: User root from 103.26.136.173 not allowed because not listed in AllowUsers", "Oct 9 13:27:45 hecnet-us-east-gw sshd[2365006]: Failed password for invalid user root from 103.26.136.173 port 48286 ssh2", "Oct 9 13:27:45 hecnet-us-east-gw sshd[2365006]: Disconnected from invalid user root 103.26.136.173 port 48286 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2365006]: ", "ip4": "103.26.136.173", "users": "['root']", "user": "root"} 74.162.106.25 #sshd|1791552499|172800|1|{"matches": ["Oct 9 13:28:17 hecnet-us-east-gw sshd[2365029]: User root from 74.162.106.25 not allowed because not listed in AllowUsers", "Oct 9 13:28:19 hecnet-us-east-gw sshd[2365029]: Failed password for invalid user root from 74.162.106.25 port 57800 ssh2", "Oct 9 13:28:19 hecnet-us-east-gw sshd[2365029]: Disconnected from invalid user root 74.162.106.25 port 57800 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2365029]: ", "ip4": "74.162.106.25", "users": "['root']", "user": "root"} 220.247.224.226 #sshd|1791552801|172800|1|{"matches": ["Oct 9 13:33:19 hecnet-us-east-gw sshd[2365074]: Invalid user cts from 220.247.224.226 port 31769", "Oct 9 13:33:20 hecnet-us-east-gw sshd[2365074]: Failed password for invalid user cts from 220.247.224.226 port 31769 ssh2", "Oct 9 13:33:21 hecnet-us-east-gw sshd[2365074]: Disconnected from invalid user cts 220.247.224.226 port 31769 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2365074]: ", "ip4": "220.247.224.226", "users": "['cts']", "user": "cts"} 51.178.84.57 #sshd|1791552970|172800|1|{"matches": ["Oct 9 13:36:07 hecnet-us-east-gw sshd[2365149]: Invalid user newuser from 51.178.84.57 port 59122", "Oct 9 13:36:09 hecnet-us-east-gw sshd[2365149]: Failed password for invalid user newuser from 51.178.84.57 port 59122 ssh2", "Oct 9 13:36:10 hecnet-us-east-gw sshd[2365149]: Disconnected from invalid user newuser 51.178.84.57 port 59122 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2365149]: ", "ip4": "51.178.84.57", "users": "['newuser']", "user": "newuser"} 141.95.162.162 #sshd|1791553019|172800|1|{"matches": ["Oct 9 13:36:57 hecnet-us-east-gw sshd[2365174]: User root from 141.95.162.162 not allowed because not listed in AllowUsers", "Oct 9 13:36:59 hecnet-us-east-gw sshd[2365174]: Failed password for invalid user root from 141.95.162.162 port 46818 ssh2", "Oct 9 13:36:59 hecnet-us-east-gw sshd[2365174]: Disconnected from invalid user root 141.95.162.162 port 46818 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2365174]: ", "ip4": "141.95.162.162", "users": "['root']", "user": "root"} 106.12.38.73 #sshd|1791553883|172800|1|{"matches": ["Oct 9 13:51:19 hecnet-us-east-gw sshd[2365284]: User root from 106.12.38.73 not allowed because not listed in AllowUsers", "Oct 9 13:51:21 hecnet-us-east-gw sshd[2365284]: Failed password for invalid user root from 106.12.38.73 port 49812 ssh2", "Oct 9 13:51:23 hecnet-us-east-gw sshd[2365284]: Disconnected from invalid user root 106.12.38.73 port 49812 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2365284]: ", "ip4": "106.12.38.73", "users": "['root']", "user": "root"} 114.112.96.82 #sshd|1791554244|172800|1|{"matches": ["Oct 9 13:52:40 hecnet-us-east-gw sshd[2365309]: Failed password for invalid user developer from 114.112.96.82 port 43571 ssh2", "Oct 9 13:57:22 hecnet-us-east-gw sshd[2365318]: Connection from 114.112.96.82 port 34629 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 9 13:57:24 hecnet-us-east-gw sshd[2365318]: Invalid user luka from 114.112.96.82 port 34629"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2365309]: ", "ip4": "114.112.96.82", "users": "['developer']", "user": "developer"} 109.160.32.152 #sshd|1791554528|172800|1|{"matches": ["Oct 9 14:01:00 hecnet-us-east-gw sshd[2365362]: Failed none for invalid user from 109.160.32.152 port 41610 ssh2", "Oct 9 14:02:08 hecnet-us-east-gw sshd[2365368]: Connection from 109.160.32.152 port 59986 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 9 14:02:08 hecnet-us-east-gw sshd[2365368]: Invalid user gl05 from 109.160.32.152 port 59986"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2365362]: ", "ip4": "109.160.32.152", "user": ""} 142.154.115.108 #sshd|1791556197|172800|1|{"matches": ["Oct 9 14:29:54 hecnet-us-east-gw sshd[2365965]: Connection from 142.154.115.108 port 54686 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 9 14:29:55 hecnet-us-east-gw sshd[2365965]: Invalid user pi from 142.154.115.108 port 54686", "Oct 9 14:29:57 hecnet-us-east-gw sshd[2365965]: Failed none for invalid user pi from 142.154.115.108 port 54686 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2365965]: ", "ip4": "142.154.115.108", "users": "['pi']", "user": "pi"} 171.104.143.176 #sshd|1791560275|172800|1|{"matches": ["Oct 9 15:37:52 hecnet-us-east-gw sshd[2366408]: Invalid user tecnica from 171.104.143.176 port 50044", "Oct 9 15:37:54 hecnet-us-east-gw sshd[2366408]: Failed password for invalid user tecnica from 171.104.143.176 port 50044 ssh2", "Oct 9 15:37:55 hecnet-us-east-gw sshd[2366408]: Disconnected from invalid user tecnica 171.104.143.176 port 50044 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2366408]: ", "ip4": "171.104.143.176", "users": "['tecnica']", "user": "tecnica"} 50.84.211.204 #sshd|1791560511|172800|1|{"matches": ["Oct 9 15:41:49 hecnet-us-east-gw sshd[2366466]: Invalid user abc from 50.84.211.204 port 55824", "Oct 9 15:41:51 hecnet-us-east-gw sshd[2366466]: Failed password for invalid user abc from 50.84.211.204 port 55824 ssh2", "Oct 9 15:41:51 hecnet-us-east-gw sshd[2366466]: Disconnected from invalid user abc 50.84.211.204 port 55824 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2366466]: ", "ip4": "50.84.211.204", "users": "['abc']", "user": "abc"} 180.76.57.94 #sshd|1791561748|172800|1|{"matches": ["Oct 9 16:02:24 hecnet-us-east-gw sshd[2366584]: Invalid user natali from 180.76.57.94 port 59288", "Oct 9 16:02:26 hecnet-us-east-gw sshd[2366584]: Failed password for invalid user natali from 180.76.57.94 port 59288 ssh2", "Oct 9 16:02:28 hecnet-us-east-gw sshd[2366584]: Disconnected from invalid user natali 180.76.57.94 port 59288 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2366584]: ", "ip4": "180.76.57.94", "users": "['natali']", "user": "natali"} 43.173.110.79 #sshd|1791562009|172800|1|{"matches": ["Oct 9 16:06:45 hecnet-us-east-gw sshd[2366665]: User root from 43.173.110.79 not allowed because not listed in AllowUsers", "Oct 9 16:06:47 hecnet-us-east-gw sshd[2366665]: Failed password for invalid user root from 43.173.110.79 port 49764 ssh2", "Oct 9 16:06:49 hecnet-us-east-gw sshd[2366665]: Disconnected from invalid user root 43.173.110.79 port 49764 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2366665]: ", "ip4": "43.173.110.79", "users": "['root']", "user": "root"} 180.76.243.197 #sshd|1791562250|172800|1|{"matches": ["Oct 9 16:06:46 hecnet-us-east-gw sshd[2366663]: Failed password for invalid user root from 180.76.243.197 port 13031 ssh2", "Oct 9 16:10:48 hecnet-us-east-gw sshd[2366710]: Connection from 180.76.243.197 port 2776 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 9 16:10:50 hecnet-us-east-gw sshd[2366710]: User root from 180.76.243.197 not allowed because not listed in AllowUsers"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2366663]: ", "ip4": "180.76.243.197", "users": "['root']", "user": "root"} 121.224.5.228 #sshd|1791562536|172800|1|{"matches": ["Oct 9 16:15:31 hecnet-us-east-gw sshd[2366785]: User root from 121.224.5.228 not allowed because not listed in AllowUsers", "Oct 9 16:15:33 hecnet-us-east-gw sshd[2366785]: Failed none for invalid user root from 121.224.5.228 port 53828 ssh2", "Oct 9 16:15:36 hecnet-us-east-gw sshd[2366785]: Failed password for invalid user root from 121.224.5.228 port 53828 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2366785]: ", "ip4": "121.224.5.228", "users": "['root']", "user": "root"} 103.59.94.117 #sshd|1791562841|172800|1|{"matches": ["Oct 9 16:20:38 hecnet-us-east-gw sshd[2366840]: Invalid user auditor from 103.59.94.117 port 56168", "Oct 9 16:20:40 hecnet-us-east-gw sshd[2366840]: Failed password for invalid user auditor from 103.59.94.117 port 56168 ssh2", "Oct 9 16:20:41 hecnet-us-east-gw sshd[2366840]: Disconnected from invalid user auditor 103.59.94.117 port 56168 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2366840]: ", "ip4": "103.59.94.117", "users": "['auditor']", "user": "auditor"} 176.168.228.223 #sshd|1791562894|172800|1|{"matches": ["Oct 9 16:21:32 hecnet-us-east-gw sshd[2366863]: Invalid user arun from 176.168.228.223 port 39592", "Oct 9 16:21:34 hecnet-us-east-gw sshd[2366863]: Failed password for invalid user arun from 176.168.228.223 port 39592 ssh2", "Oct 9 16:21:34 hecnet-us-east-gw sshd[2366863]: Disconnected from invalid user arun 176.168.228.223 port 39592 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2366863]: ", "ip4": "176.168.228.223", "users": "['arun']", "user": "arun"} 191.97.12.90 #sshd|1791563252|172800|1|{"matches": ["Oct 9 16:27:28 hecnet-us-east-gw sshd[2366921]: Invalid user auditor from 191.97.12.90 port 36430", "Oct 9 16:27:30 hecnet-us-east-gw sshd[2366921]: Failed password for invalid user auditor from 191.97.12.90 port 36430 ssh2", "Oct 9 16:27:32 hecnet-us-east-gw sshd[2366921]: Disconnected from invalid user auditor 191.97.12.90 port 36430 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2366921]: ", "ip4": "191.97.12.90", "users": "['auditor']", "user": "auditor"} 195.178.110.228 #sshd|1791564055|172800|1|{"matches": ["Oct 9 16:40:48 hecnet-us-east-gw sshd[2367030]: User root from 195.178.110.228 not allowed because not listed in AllowUsers", "Oct 9 16:40:50 hecnet-us-east-gw sshd[2367030]: Failed none for invalid user root from 195.178.110.228 port 44348 ssh2", "Oct 9 16:40:55 hecnet-us-east-gw sshd[2367030]: Failed password for invalid user root from 195.178.110.228 port 44348 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2367030]: ", "ip4": "195.178.110.228", "users": "['root']", "user": "root"} 49.72.212.22 #sshd|1791566658|172800|1|{"matches": ["Oct 9 17:24:13 hecnet-us-east-gw sshd[2367286]: User root from 49.72.212.22 not allowed because not listed in AllowUsers", "Oct 9 17:24:16 hecnet-us-east-gw sshd[2367286]: Failed password for invalid user root from 49.72.212.22 port 53242 ssh2", "Oct 9 17:24:18 hecnet-us-east-gw sshd[2367286]: Disconnected from invalid user root 49.72.212.22 port 53242 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2367286]: ", "ip4": "49.72.212.22", "users": "['root']", "user": "root"} 43.173.33.166 #sshd|1791566882|172800|1|{"matches": ["Oct 9 17:28:00 hecnet-us-east-gw sshd[2367344]: Invalid user socks from 43.173.33.166 port 51024", "Oct 9 17:28:01 hecnet-us-east-gw sshd[2367344]: Failed password for invalid user socks from 43.173.33.166 port 51024 ssh2", "Oct 9 17:28:02 hecnet-us-east-gw sshd[2367344]: Disconnected from invalid user socks 43.173.33.166 port 51024 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2367344]: ", "ip4": "43.173.33.166", "users": "['socks']", "user": "socks"} 117.50.51.198 #sshd|1791566953|172800|1|{"matches": ["Oct 9 17:29:11 hecnet-us-east-gw sshd[2367370]: Invalid user toor from 117.50.51.198 port 37368", "Oct 9 17:29:13 hecnet-us-east-gw sshd[2367370]: Failed password for invalid user toor from 117.50.51.198 port 37368 ssh2", "Oct 9 17:29:13 hecnet-us-east-gw sshd[2367370]: Disconnected from invalid user toor 117.50.51.198 port 37368 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2367370]: ", "ip4": "117.50.51.198", "users": "['toor']", "user": "toor"} 185.177.72.64 #lighttpd-scans|1791568715|172800|1|{"matches": [["", "Oct 9 17:58:01", " hecnet-us-east-gw lighttpd[1017]: 185.177.72.64 150.136.5.129 - [09/Oct/2026:17:58:01 +0000] \"GET /phpinfo.php HTTP/1.1\" 404 341 \"-\" \"Mozilla/5.0 (Linux; Android 6.0.1; SM-S327VL Build/MMB29M) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Mobile Safari/537.36\""], "Oct 9 17:58:02 hecnet-us-east-gw lighttpd[1017]: 185.177.72.64 150.136.5.129 - [09/Oct/2026:17:58:02 +0000] \"GET /wp-config.php HTTP/1.1\" 404 341 \"-\" \"Mozilla/5.0 (Linux; Android 6.0.1; SM-S327VL Build/MMB29M) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Mobile Safari/537.36\"", "Oct 9 17:58:07 hecnet-us-east-gw lighttpd[1017]: 185.177.72.64 150.136.5.129 - [09/Oct/2026:17:58:07 +0000] \"GET /test.php HTTP/1.1\" 404 341 \"-\" \"Mozilla/5.0 (Linux; Android 6.0.1; SM-S327VL Build/MMB29M) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Mobile Safari/537.36\"", "Oct 9 17:58:13 hecnet-us-east-gw lighttpd[1017]: 185.177.72.64 150.136.5.129 - [09/Oct/2026:17:58:13 +0000] \"GET /info.php HTTP/1.1\" 404 341 \"-\" \"Mozilla/5.0 (Linux; Android 6.0.1; SM-S327VL Build/MMB29M) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Mobile Safari/537.36\"", "Oct 9 17:58:25 hecnet-us-east-gw lighttpd[1017]: 185.177.72.64 150.136.5.129 - [09/Oct/2026:17:58:25 +0000] \"GET /.env.php HTTP/1.1\" 404 341 \"-\" \"Mozilla/5.0 (Linux; Android 6.0.1; SM-S327VL Build/MMB29M) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Mobile Safari/537.36\"", "Oct 9 17:58:27 hecnet-us-east-gw lighttpd[1017]: 185.177.72.64 150.136.5.129 - [09/Oct/2026:17:58:27 +0000] \"GET /config/.env.php HTTP/1.1\" 404 341 \"-\" \"Mozilla/5.0 (Linux; Android 6.0.1; SM-S327VL Build/MMB29M) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Mobile Safari/537.36\"", "Oct 9 17:58:34 hecnet-us-east-gw lighttpd[1017]: 185.177.72.64 150.136.5.129 - [09/Oct/2026:17:58:34 +0000] \"GET /.env.sample.php HTTP/1.1\" 404 341 \"-\" \"Mozilla/5.0 (Linux; Android 6.0.1; SM-S327VL Build/MMB29M) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Mobile Safari/537.36\"", "Oct 9 17:58:35 hecnet-us-east-gw lighttpd[1017]: 185.177.72.64 150.136.5.129 - [09/Oct/2026:17:58:34 +0000] \"GET /.env.local.php HTTP/1.1\" 404 341 \"-\" \"Mozilla/5.0 (Linux; Android 6.0.1; SM-S327VL Build/MMB29M) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Mobile Safari/537.36\""], "failures": 8, "ip4": "185.177.72.64"} 88.147.30.59 #sshd|1791571219|172800|1|{"matches": ["Oct 9 18:40:15 hecnet-us-east-gw sshd[2367951]: User root from 88.147.30.59 not allowed because not listed in AllowUsers", "Oct 9 18:40:17 hecnet-us-east-gw sshd[2367951]: Failed password for invalid user root from 88.147.30.59 port 50193 ssh2", "Oct 9 18:40:19 hecnet-us-east-gw sshd[2367951]: Disconnected from invalid user root 88.147.30.59 port 50193 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2367951]: ", "ip4": "88.147.30.59", "users": "['root']", "user": "root"} 172.190.24.225 #sshd|1791575478|172800|1|{"matches": ["Oct 9 19:51:14 hecnet-us-east-gw sshd[2368402]: User root from 172.190.24.225 not allowed because not listed in AllowUsers", "Oct 9 19:51:16 hecnet-us-east-gw sshd[2368402]: Failed password for invalid user root from 172.190.24.225 port 36270 ssh2", "Oct 9 19:51:18 hecnet-us-east-gw sshd[2368402]: Disconnected from invalid user root 172.190.24.225 port 36270 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2368402]: ", "ip4": "172.190.24.225", "users": "['root']", "user": "root"} 5.253.38.54 #sshd|1791576921|172800|1|{"matches": ["Oct 9 20:15:19 hecnet-us-east-gw sshd[2368598]: User root from 5.253.38.54 not allowed because not listed in AllowUsers", "Oct 9 20:15:21 hecnet-us-east-gw sshd[2368598]: Failed password for invalid user root from 5.253.38.54 port 60346 ssh2", "Oct 9 20:15:21 hecnet-us-east-gw sshd[2368598]: Disconnected from invalid user root 5.253.38.54 port 60346 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2368598]: ", "ip4": "5.253.38.54", "users": "['root']", "user": "root"} 209.99.190.110 #sshd|1791578782|172800|1|{"matches": ["Oct 9 20:46:18 hecnet-us-east-gw sshd[2368850]: User root from 209.99.190.110 not allowed because not listed in AllowUsers", "Oct 9 20:46:20 hecnet-us-east-gw sshd[2368850]: Failed none for invalid user root from 209.99.190.110 port 57944 ssh2", "Oct 9 20:46:22 hecnet-us-east-gw sshd[2368850]: Connection closed by invalid user root 209.99.190.110 port 57944 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2368850]: ", "ip4": "209.99.190.110", "users": "['root']", "user": "root"} 2.26.26.145 #sshd|1791580816|172800|1|{"matches": ["Oct 9 21:20:13 hecnet-us-east-gw sshd[2369073]: Invalid user admin from 2.26.26.145 port 43616", "Oct 9 21:20:15 hecnet-us-east-gw sshd[2369073]: Failed password for invalid user admin from 2.26.26.145 port 43616 ssh2", "Oct 9 21:20:16 hecnet-us-east-gw sshd[2369073]: Connection closed by invalid user admin 2.26.26.145 port 43616 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2369073]: ", "ip4": "2.26.26.145", "users": "['admin']", "user": "admin"} 152.32.174.171 #sshd|1791585375|172800|1|{"matches": ["Oct 9 22:36:11 hecnet-us-east-gw sshd[2369610]: Invalid user user from 152.32.174.171 port 59410", "Oct 9 22:36:14 hecnet-us-east-gw sshd[2369610]: Failed password for invalid user user from 152.32.174.171 port 59410 ssh2", "Oct 9 22:36:15 hecnet-us-east-gw sshd[2369610]: Disconnected from invalid user user 152.32.174.171 port 59410 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2369610]: ", "ip4": "152.32.174.171", "users": "['user']", "user": "user"} 103.97.135.244 #sshd|1791588088|172800|1|{"matches": ["Oct 9 23:21:25 hecnet-us-east-gw sshd[2369924]: Invalid user admin1234 from 103.97.135.244 port 38896", "Oct 9 23:21:27 hecnet-us-east-gw sshd[2369924]: Failed password for invalid user admin1234 from 103.97.135.244 port 38896 ssh2", "Oct 9 23:21:28 hecnet-us-east-gw sshd[2369924]: Disconnected from invalid user admin1234 103.97.135.244 port 38896 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2369924]: ", "ip4": "103.97.135.244", "users": "['admin1234']", "user": "admin1234"} 40.121.200.75 #sshd|1791588174|172800|1|{"matches": ["Oct 9 23:22:50 hecnet-us-east-gw sshd[2369949]: Invalid user jahan from 40.121.200.75 port 44347", "Oct 9 23:22:52 hecnet-us-east-gw sshd[2369949]: Failed password for invalid user jahan from 40.121.200.75 port 44347 ssh2", "Oct 9 23:22:54 hecnet-us-east-gw sshd[2369949]: Disconnected from invalid user jahan 40.121.200.75 port 44347 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2369949]: ", "ip4": "40.121.200.75", "users": "['jahan']", "user": "jahan"} 203.189.221.17 #sshd|1791588290|172800|1|{"matches": ["Oct 9 23:24:48 hecnet-us-east-gw sshd[2369973]: User root from 203.189.221.17 not allowed because not listed in AllowUsers", "Oct 9 23:24:50 hecnet-us-east-gw sshd[2369973]: Failed password for invalid user root from 203.189.221.17 port 48226 ssh2", "Oct 9 23:24:50 hecnet-us-east-gw sshd[2369973]: Disconnected from invalid user root 203.189.221.17 port 48226 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2369973]: ", "ip4": "203.189.221.17", "users": "['root']", "user": "root"} 185.143.197.45 #sshd|1791588357|172800|1|{"matches": ["Oct 9 23:25:53 hecnet-us-east-gw sshd[2370026]: Invalid user radio from 185.143.197.45 port 61482", "Oct 9 23:25:55 hecnet-us-east-gw sshd[2370026]: Failed password for invalid user radio from 185.143.197.45 port 61482 ssh2", "Oct 9 23:25:57 hecnet-us-east-gw sshd[2370026]: Disconnected from invalid user radio 185.143.197.45 port 61482 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2370026]: ", "ip4": "185.143.197.45", "users": "['radio']", "user": "radio"} 58.49.26.202 #sshd|1791588804|172800|1|{"matches": ["Oct 9 23:29:18 hecnet-us-east-gw sshd[2370053]: Failed password for invalid user june from 58.49.26.202 port 50028 ssh2", "Oct 9 23:33:23 hecnet-us-east-gw sshd[2370086]: Connection from 58.49.26.202 port 54402 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 9 23:33:24 hecnet-us-east-gw sshd[2370086]: User root from 58.49.26.202 not allowed because not listed in AllowUsers"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2370053]: ", "ip4": "58.49.26.202", "users": "['june']", "user": "june"} 154.92.19.226 #sshd|1791589452|172800|1|{"matches": ["Oct 9 23:44:10 hecnet-us-east-gw sshd[2370201]: User root from 154.92.19.226 not allowed because not listed in AllowUsers", "Oct 9 23:44:12 hecnet-us-east-gw sshd[2370201]: Failed password for invalid user root from 154.92.19.226 port 35408 ssh2", "Oct 9 23:44:12 hecnet-us-east-gw sshd[2370201]: Disconnected from invalid user root 154.92.19.226 port 35408 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2370201]: ", "ip4": "154.92.19.226", "users": "['root']", "user": "root"} 120.48.175.69 #sshd|1791590166|172800|1|{"matches": ["Oct 9 23:47:26 hecnet-us-east-gw sshd[2370269]: Failed password for invalid user ars from 120.48.175.69 port 37122 ssh2", "Oct 9 23:56:04 hecnet-us-east-gw sshd[2370287]: Connection from 120.48.175.69 port 42194 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 9 23:56:06 hecnet-us-east-gw sshd[2370287]: Invalid user steam from 120.48.175.69 port 42194"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2370269]: ", "ip4": "120.48.175.69", "users": "['ars']", "user": "ars"} 20.196.88.195 #lighttpd-scans|1791593478|172800|1|{"matches": [["", "Oct 10 00:51:15", " hecnet-us-east-gw lighttpd[1017]: 20.196.88.195 hecnet-us-east-gw.duckdns.org - [10/Oct/2026:00:51:15 +0000] \"GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1\" 404 341 \"-\" \"-\""], "Oct 10 00:51:16 hecnet-us-east-gw lighttpd[1017]: 20.196.88.195 hecnet-us-east-gw.duckdns.org - [10/Oct/2026:00:51:16 +0000] \"GET /this_is_a_new_hello_world.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 10 00:51:16 hecnet-us-east-gw lighttpd[1017]: 20.196.88.195 hecnet-us-east-gw.duckdns.org - [10/Oct/2026:00:51:16 +0000] \"GET /ccc.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 10 00:51:17 hecnet-us-east-gw lighttpd[1017]: 20.196.88.195 hecnet-us-east-gw.duckdns.org - [10/Oct/2026:00:51:17 +0000] \"GET /r.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 10 00:51:17 hecnet-us-east-gw lighttpd[1017]: 20.196.88.195 hecnet-us-east-gw.duckdns.org - [10/Oct/2026:00:51:17 +0000] \"GET /radio.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 10 00:51:17 hecnet-us-east-gw lighttpd[1017]: 20.196.88.195 hecnet-us-east-gw.duckdns.org - [10/Oct/2026:00:51:17 +0000] \"GET /adminfuns.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 10 00:51:18 hecnet-us-east-gw lighttpd[1017]: 20.196.88.195 hecnet-us-east-gw.duckdns.org - [10/Oct/2026:00:51:18 +0000] \"GET /wp-blink.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 10 00:51:18 hecnet-us-east-gw lighttpd[1017]: 20.196.88.195 hecnet-us-east-gw.duckdns.org - [10/Oct/2026:00:51:18 +0000] \"GET /BDKR28WP.php HTTP/1.1\" 404 341 \"-\" \"-\""], "failures": 8, "ip4": "20.196.88.195"} 49.75.185.71 #sshd|1791593488|172800|1|{"matches": ["Oct 10 00:51:23 hecnet-us-east-gw sshd[2370794]: Invalid user myuser1 from 49.75.185.71 port 47220", "Oct 10 00:51:26 hecnet-us-east-gw sshd[2370794]: Failed password for invalid user myuser1 from 49.75.185.71 port 47220 ssh2", "Oct 10 00:51:28 hecnet-us-east-gw sshd[2370794]: Disconnected from invalid user myuser1 49.75.185.71 port 47220 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2370794]: ", "ip4": "49.75.185.71", "users": "['myuser1']", "user": "myuser1"} 2.229.200.226 #sshd|1791593857|172800|1|{"matches": ["Oct 10 00:57:33 hecnet-us-east-gw sshd[2370826]: User root from 2.229.200.226 not allowed because not listed in AllowUsers", "Oct 10 00:57:35 hecnet-us-east-gw sshd[2370826]: Failed password for invalid user root from 2.229.200.226 port 50378 ssh2", "Oct 10 00:57:37 hecnet-us-east-gw sshd[2370826]: Disconnected from invalid user root 2.229.200.226 port 50378 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2370826]: ", "ip4": "2.229.200.226", "users": "['root']", "user": "root"} 109.160.32.115 #sshd|1791593858|172800|1|{"matches": ["Oct 10 00:56:28 hecnet-us-east-gw sshd[2370822]: Failed none for invalid user from 109.160.32.115 port 51124 ssh2", "Oct 10 00:57:37 hecnet-us-east-gw sshd[2370828]: Connection from 109.160.32.115 port 38398 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 10 00:57:38 hecnet-us-east-gw sshd[2370828]: Invalid user outuser2c from 109.160.32.115 port 38398"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2370822]: ", "ip4": "109.160.32.115", "user": ""} 77.239.124.154 #sshd|1791593987|172800|1|{"matches": ["Oct 10 00:59:22 hecnet-us-east-gw sshd[2370872]: Failed none for invalid user from 77.239.124.154 port 42782 ssh2", "Oct 10 00:59:46 hecnet-us-east-gw sshd[2370875]: Connection from 77.239.124.154 port 41614 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 10 00:59:47 hecnet-us-east-gw sshd[2370875]: Invalid user ec2-user from 77.239.124.154 port 41614"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2370872]: ", "ip4": "77.239.124.154", "user": ""} 118.145.246.43 #sshd|1791598376|172800|1|{"matches": ["Oct 10 02:12:49 hecnet-us-east-gw sshd[2371370]: User root from 118.145.246.43 not allowed because not listed in AllowUsers", "Oct 10 02:12:51 hecnet-us-east-gw sshd[2371370]: Failed none for invalid user root from 118.145.246.43 port 50106 ssh2", "Oct 10 02:12:56 hecnet-us-east-gw sshd[2371370]: Failed password for invalid user root from 118.145.246.43 port 50106 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2371370]: ", "ip4": "118.145.246.43", "users": "['root']", "user": "root"} 104.143.39.108 #sshd|1791604932|172800|1|{"matches": ["Oct 10 04:02:08 hecnet-us-east-gw sshd[2372087]: User root from 104.143.39.108 not allowed because not listed in AllowUsers", "Oct 10 04:02:10 hecnet-us-east-gw sshd[2372087]: Failed password for invalid user root from 104.143.39.108 port 56144 ssh2", "Oct 10 04:02:12 hecnet-us-east-gw sshd[2372087]: Disconnected from invalid user root 104.143.39.108 port 56144 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2372087]: ", "ip4": "104.143.39.108", "users": "['root']", "user": "root"} 40.112.183.29 #sshd|1791604975|172800|1|{"matches": ["Oct 10 04:02:52 hecnet-us-east-gw sshd[2372111]: Invalid user turtle from 40.112.183.29 port 40896", "Oct 10 04:02:54 hecnet-us-east-gw sshd[2372111]: Failed password for invalid user turtle from 40.112.183.29 port 40896 ssh2", "Oct 10 04:02:55 hecnet-us-east-gw sshd[2372111]: Disconnected from invalid user turtle 40.112.183.29 port 40896 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2372111]: ", "ip4": "40.112.183.29", "users": "['turtle']", "user": "turtle"} 35.233.88.19 #sshd|1791605586|172800|1|{"matches": ["Oct 10 04:13:00 hecnet-us-east-gw sshd[2372217]: Invalid user admin from 35.233.88.19 port 41682", "Oct 10 04:13:03 hecnet-us-east-gw sshd[2372217]: Failed none for invalid user admin from 35.233.88.19 port 41682 ssh2", "Oct 10 04:13:06 hecnet-us-east-gw sshd[2372217]: Failed password for invalid user admin from 35.233.88.19 port 41682 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2372217]: ", "ip4": "35.233.88.19", "users": "['admin']", "user": "admin"} 34.79.75.31 #sshd|1791605610|172800|1|{"matches": ["Oct 10 04:13:26 hecnet-us-east-gw sshd[2372242]: Invalid user sxugi from 34.79.75.31 port 16996", "Oct 10 04:13:29 hecnet-us-east-gw sshd[2372242]: Failed none for invalid user sxugi from 34.79.75.31 port 16996 ssh2", "Oct 10 04:13:30 hecnet-us-east-gw sshd[2372242]: Connection closed by invalid user sxugi 34.79.75.31 port 16996 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2372242]: ", "ip4": "34.79.75.31", "users": "['sxugi']", "user": "sxugi"} 20.210.166.54 #lighttpd-scans|1791607951|172800|1|{"matches": [["", "Oct 10 04:52:29", " hecnet-us-east-gw lighttpd[1017]: 20.210.166.54 impvax.duckdns.org - [10/Oct/2026:04:52:29 +0000] \"GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1\" 404 341 \"-\" \"-\""], "Oct 10 04:52:29 hecnet-us-east-gw lighttpd[1017]: 20.210.166.54 impvax.duckdns.org - [10/Oct/2026:04:52:29 +0000] \"GET /this_is_a_new_hello_world.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 10 04:52:29 hecnet-us-east-gw lighttpd[1017]: 20.210.166.54 impvax.duckdns.org - [10/Oct/2026:04:52:29 +0000] \"GET /f5.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 10 04:52:30 hecnet-us-east-gw lighttpd[1017]: 20.210.166.54 impvax.duckdns.org - [10/Oct/2026:04:52:30 +0000] \"GET /3PJcpMFsD8B.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 10 04:52:30 hecnet-us-east-gw lighttpd[1017]: 20.210.166.54 impvax.duckdns.org - [10/Oct/2026:04:52:30 +0000] \"GET /z70.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 10 04:52:30 hecnet-us-east-gw lighttpd[1017]: 20.210.166.54 impvax.duckdns.org - [10/Oct/2026:04:52:30 +0000] \"GET /chosen.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 10 04:52:31 hecnet-us-east-gw lighttpd[1017]: 20.210.166.54 impvax.duckdns.org - [10/Oct/2026:04:52:31 +0000] \"GET /radio.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 10 04:52:31 hecnet-us-east-gw lighttpd[1017]: 20.210.166.54 impvax.duckdns.org - [10/Oct/2026:04:52:31 +0000] \"GET /wp_blog_footer.php HTTP/1.1\" 404 341 \"-\" \"-\""], "failures": 8, "ip4": "20.210.166.54"} 218.157.163.203 #sshd|1791611455|172800|1|{"matches": ["Oct 10 05:50:52 hecnet-us-east-gw sshd[2372949]: Connection from 218.157.163.203 port 59560 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 10 05:50:53 hecnet-us-east-gw sshd[2372949]: Invalid user pi from 218.157.163.203 port 59560", "Oct 10 05:50:55 hecnet-us-east-gw sshd[2372949]: Failed none for invalid user pi from 218.157.163.203 port 59560 ssh2"], "failures": 4, "mlfid": " hecnet-us-east-gw sshd[2372947]: ", "ip4": "218.157.163.203", "users": "['pi']", "user": "pi"} 49.115.217.143 #sshd|1791611518|172800|1|{"matches": ["Oct 10 05:51:54 hecnet-us-east-gw sshd[2372974]: User root from 49.115.217.143 not allowed because not listed in AllowUsers", "Oct 10 05:51:56 hecnet-us-east-gw sshd[2372974]: Failed none for invalid user root from 49.115.217.143 port 37522 ssh2", "Oct 10 05:51:58 hecnet-us-east-gw sshd[2372974]: Failed password for invalid user root from 49.115.217.143 port 37522 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2372974]: ", "ip4": "49.115.217.143", "users": "['root']", "user": "root"} 14.103.83.214 #sshd|1791613916|172800|1|{"matches": ["Oct 10 06:27:46 hecnet-us-east-gw sshd[2373332]: User root from 14.103.83.214 not allowed because not listed in AllowUsers", "Oct 10 06:27:48 hecnet-us-east-gw sshd[2373332]: Failed password for invalid user root from 14.103.83.214 port 43074 ssh2", "Oct 10 06:31:56 hecnet-us-east-gw sshd[2373355]: Disconnected from 14.103.83.214 port 45910 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2373332]: ", "ip4": "14.103.83.214", "users": "['root']", "user": "root"} 101.96.195.17 #sshd|1791617589|172800|1|{"matches": ["Oct 10 07:25:50 hecnet-us-east-gw sshd[2373774]: Failed password for invalid user root from 101.96.195.17 port 56148 ssh2", "Oct 10 07:33:08 hecnet-us-east-gw sshd[2373815]: Connection from 101.96.195.17 port 53010 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 10 07:33:09 hecnet-us-east-gw sshd[2373815]: Connection closed by 101.96.195.17 port 53010 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2373774]: ", "ip4": "101.96.195.17", "users": "['root']", "user": "root"} 111.61.229.78 #sshd|1791618523|172800|1|{"matches": ["Oct 10 07:48:41 hecnet-us-east-gw sshd[2373989]: User root from 111.61.229.78 not allowed because not listed in AllowUsers", "Oct 10 07:48:43 hecnet-us-east-gw sshd[2373989]: Failed password for invalid user root from 111.61.229.78 port 4027 ssh2", "Oct 10 07:48:43 hecnet-us-east-gw sshd[2373989]: Disconnected from invalid user root 111.61.229.78 port 4027 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2373989]: ", "ip4": "111.61.229.78", "users": "['root']", "user": "root"} 93.123.109.226 #lighttpd-scans|1791619517|172800|1|{"matches": [["", "Oct 10 08:04:37", " hecnet-us-east-gw lighttpd[1017]: 93.123.109.226 150.136.5.129 - [10/Oct/2026:08:04:37 +0000] \"GET /.env.php HTTP/1.1\" 404 341 \"-\" \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36\""], "Oct 10 08:04:47 hecnet-us-east-gw lighttpd[1017]: 93.123.109.226 150.136.5.129 - [10/Oct/2026:08:04:47 +0000] \"GET /.env.sample.php HTTP/1.1\" 404 341 \"-\" \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36\"", "Oct 10 08:05:06 hecnet-us-east-gw lighttpd[1017]: 93.123.109.226 150.136.5.129 - [10/Oct/2026:08:05:06 +0000] \"GET /backup/info.php HTTP/1.1\" 404 341 \"-\" \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36\"", "Oct 10 08:05:06 hecnet-us-east-gw lighttpd[1017]: 93.123.109.226 150.136.5.129 - [10/Oct/2026:08:05:06 +0000] \"GET /~cats/php/info.php HTTP/1.1\" 404 341 \"-\" \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36\"", "Oct 10 08:05:17 hecnet-us-east-gw lighttpd[1017]: 93.123.109.226 150.136.5.129 - [10/Oct/2026:08:05:17 +0000] \"GET /debug/default/view?panel=config/frontend_dev.php HTTP/1.1\" 404 341 \"-\" \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36\"", "Oct 10 08:05:17 hecnet-us-east-gw lighttpd[1017]: 93.123.109.226 150.136.5.129 - [10/Oct/2026:08:05:17 +0000] \"GET /admin/dashboard/info.php HTTP/1.1\" 404 341 \"-\" \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36\"", "Oct 10 08:05:17 hecnet-us-east-gw lighttpd[1017]: 93.123.109.226 150.136.5.129 - [10/Oct/2026:08:05:17 +0000] \"GET /admin/info.php HTTP/1.1\" 404 341 \"-\" \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36\"", "Oct 10 08:05:17 hecnet-us-east-gw lighttpd[1017]: 93.123.109.226 150.136.5.129 - [10/Oct/2026:08:05:17 +0000] \"GET /admin/infophp.php HTTP/1.1\" 404 341 \"-\" \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36\""], "failures": 8, "ip4": "93.123.109.226"} 107.155.15.218 #sshd|1791619758|172800|1|{"matches": ["Oct 10 08:09:15 hecnet-us-east-gw sshd[2374142]: Invalid user admin from 107.155.15.218 port 42792", "Oct 10 08:09:17 hecnet-us-east-gw sshd[2374142]: Failed password for invalid user admin from 107.155.15.218 port 42792 ssh2", "Oct 10 08:09:18 hecnet-us-east-gw sshd[2374142]: Disconnected from invalid user admin 107.155.15.218 port 42792 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2374142]: ", "ip4": "107.155.15.218", "users": "['admin']", "user": "admin"} 193.148.56.90 #sshd|1791621106|172800|1|{"matches": ["Oct 10 08:31:43 hecnet-us-east-gw sshd[2374306]: Invalid user admin from 193.148.56.90 port 43420", "Oct 10 08:31:45 hecnet-us-east-gw sshd[2374306]: Failed password for invalid user admin from 193.148.56.90 port 43420 ssh2", "Oct 10 08:31:46 hecnet-us-east-gw sshd[2374306]: Connection closed by invalid user admin 193.148.56.90 port 43420 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2374306]: ", "ip4": "193.148.56.90", "users": "['admin']", "user": "admin"} 40.74.77.37 #lighttpd-scans|1791621255|172800|1|{"matches": [["", "Oct 10 08:34:13", " hecnet-us-east-gw lighttpd[1017]: 40.74.77.37 hecnet-us-east-gw.duckdns.org - [10/Oct/2026:08:34:12 +0000] \"GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1\" 404 341 \"-\" \"-\""], "Oct 10 08:34:13 hecnet-us-east-gw lighttpd[1017]: 40.74.77.37 hecnet-us-east-gw.duckdns.org - [10/Oct/2026:08:34:13 +0000] \"GET /this_is_a_new_hello_world.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 10 08:34:13 hecnet-us-east-gw lighttpd[1017]: 40.74.77.37 hecnet-us-east-gw.duckdns.org - [10/Oct/2026:08:34:13 +0000] \"GET /photo.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 10 08:34:14 hecnet-us-east-gw lighttpd[1017]: 40.74.77.37 hecnet-us-east-gw.duckdns.org - [10/Oct/2026:08:34:14 +0000] \"GET /choco.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 10 08:34:14 hecnet-us-east-gw lighttpd[1017]: 40.74.77.37 hecnet-us-east-gw.duckdns.org - [10/Oct/2026:08:34:14 +0000] \"GET /unaut.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 10 08:34:14 hecnet-us-east-gw lighttpd[1017]: 40.74.77.37 hecnet-us-east-gw.duckdns.org - [10/Oct/2026:08:34:14 +0000] \"GET /bro.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 10 08:34:15 hecnet-us-east-gw lighttpd[1017]: 40.74.77.37 hecnet-us-east-gw.duckdns.org - [10/Oct/2026:08:34:15 +0000] \"GET /go.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 10 08:34:15 hecnet-us-east-gw lighttpd[1017]: 40.74.77.37 hecnet-us-east-gw.duckdns.org - [10/Oct/2026:08:34:15 +0000] \"GET /bisan.php HTTP/1.1\" 404 341 \"-\" \"-\""], "failures": 8, "ip4": "40.74.77.37"} 94.159.112.98 #sshd|1791625990|172800|1|{"matches": ["Oct 10 09:53:04 hecnet-us-east-gw sshd[2374866]: User root from 94.159.112.98 not allowed because not listed in AllowUsers", "Oct 10 09:53:07 hecnet-us-east-gw sshd[2374866]: Failed none for invalid user root from 94.159.112.98 port 49948 ssh2", "Oct 10 09:53:10 hecnet-us-east-gw sshd[2374866]: Failed password for invalid user root from 94.159.112.98 port 49948 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2374866]: ", "ip4": "94.159.112.98", "users": "['root']", "user": "root"} 14.103.118.106 #sshd|1791632735|172800|1|{"matches": ["Oct 10 11:45:32 hecnet-us-east-gw sshd[2375604]: Invalid user nodeuser from 14.103.118.106 port 50826", "Oct 10 11:45:34 hecnet-us-east-gw sshd[2375604]: Failed password for invalid user nodeuser from 14.103.118.106 port 50826 ssh2", "Oct 10 11:45:35 hecnet-us-east-gw sshd[2375604]: Disconnected from invalid user nodeuser 14.103.118.106 port 50826 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2375604]: ", "ip4": "14.103.118.106", "users": "['nodeuser']", "user": "nodeuser"} 186.139.251.57 #sshd|1791632885|172800|1|{"matches": ["Oct 10 11:48:03 hecnet-us-east-gw sshd[2375647]: Invalid user user1 from 186.139.251.57 port 53822", "Oct 10 11:48:04 hecnet-us-east-gw sshd[2375647]: Failed password for invalid user user1 from 186.139.251.57 port 53822 ssh2", "Oct 10 11:48:05 hecnet-us-east-gw sshd[2375647]: Disconnected from invalid user user1 186.139.251.57 port 53822 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2375647]: ", "ip4": "186.139.251.57", "users": "['user1']", "user": "user1"} 52.176.211.73 #sshd|1791633819|172800|1|{"matches": ["Oct 10 12:03:34 hecnet-us-east-gw sshd[2375762]: Invalid user threedsystem from 52.176.211.73 port 59482", "Oct 10 12:03:37 hecnet-us-east-gw sshd[2375762]: Failed password for invalid user threedsystem from 52.176.211.73 port 59482 ssh2", "Oct 10 12:03:39 hecnet-us-east-gw sshd[2375762]: Disconnected from invalid user threedsystem 52.176.211.73 port 59482 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2375762]: ", "ip4": "52.176.211.73", "users": "['threedsystem']", "user": "threedsystem"} 101.47.156.21 #sshd|1791637842|172800|1|{"matches": ["Oct 10 13:10:39 hecnet-us-east-gw sshd[2376339]: User root from 101.47.156.21 not allowed because not listed in AllowUsers", "Oct 10 13:10:41 hecnet-us-east-gw sshd[2376339]: Failed password for invalid user root from 101.47.156.21 port 58884 ssh2", "Oct 10 13:10:42 hecnet-us-east-gw sshd[2376339]: Disconnected from invalid user root 101.47.156.21 port 58884 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2376339]: ", "ip4": "101.47.156.21", "users": "['root']", "user": "root"} 180.184.178.165 #sshd|1791638231|172800|1|{"matches": ["Oct 10 13:17:06 hecnet-us-east-gw sshd[2376421]: Invalid user user1 from 180.184.178.165 port 33436", "Oct 10 13:17:08 hecnet-us-east-gw sshd[2376421]: Failed password for invalid user user1 from 180.184.178.165 port 33436 ssh2", "Oct 10 13:17:11 hecnet-us-east-gw sshd[2376421]: Disconnected from invalid user user1 180.184.178.165 port 33436 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2376421]: ", "ip4": "180.184.178.165", "users": "['user1']", "user": "user1"} 109.160.32.34 #sshd|1791638305|172800|1|{"matches": ["Oct 10 13:17:14 hecnet-us-east-gw sshd[2376448]: Failed none for invalid user from 109.160.32.34 port 56898 ssh2", "Oct 10 13:18:25 hecnet-us-east-gw sshd[2376454]: Connection from 109.160.32.34 port 33088 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 10 13:18:25 hecnet-us-east-gw sshd[2376454]: Invalid user gregordowz from 109.160.32.34 port 33088"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2376448]: ", "ip4": "109.160.32.34", "user": ""} 129.121.75.215 #sshd|1791640842|172800|1|{"matches": ["Oct 10 14:00:40 hecnet-us-east-gw sshd[2376754]: Invalid user king from 129.121.75.215 port 59096", "Oct 10 14:00:42 hecnet-us-east-gw sshd[2376754]: Failed password for invalid user king from 129.121.75.215 port 59096 ssh2", "Oct 10 14:00:42 hecnet-us-east-gw sshd[2376754]: Disconnected from invalid user king 129.121.75.215 port 59096 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2376754]: ", "ip4": "129.121.75.215", "users": "['king']", "user": "king"} 163.7.4.169 #sshd|1791640945|172800|1|{"matches": ["Oct 10 14:02:22 hecnet-us-east-gw sshd[2376779]: Invalid user ahmed from 163.7.4.169 port 39802", "Oct 10 14:02:24 hecnet-us-east-gw sshd[2376779]: Failed password for invalid user ahmed from 163.7.4.169 port 39802 ssh2", "Oct 10 14:02:25 hecnet-us-east-gw sshd[2376779]: Disconnected from invalid user ahmed 163.7.4.169 port 39802 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2376779]: ", "ip4": "163.7.4.169", "users": "['ahmed']", "user": "ahmed"} 43.159.135.11 #sshd|1791641353|172800|1|{"matches": ["Oct 10 14:09:11 hecnet-us-east-gw sshd[2376846]: Invalid user andrew from 43.159.135.11 port 47154", "Oct 10 14:09:13 hecnet-us-east-gw sshd[2376846]: Failed password for invalid user andrew from 43.159.135.11 port 47154 ssh2", "Oct 10 14:09:13 hecnet-us-east-gw sshd[2376846]: Disconnected from invalid user andrew 43.159.135.11 port 47154 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2376846]: ", "ip4": "43.159.135.11", "users": "['andrew']", "user": "andrew"} 59.97.21.114 #sshd|1791646481|172800|1|{"matches": ["Oct 10 15:34:37 hecnet-us-east-gw sshd[2377435]: Invalid user postgres from 59.97.21.114 port 57073", "Oct 10 15:34:39 hecnet-us-east-gw sshd[2377435]: Failed password for invalid user postgres from 59.97.21.114 port 57073 ssh2", "Oct 10 15:34:41 hecnet-us-east-gw sshd[2377435]: Disconnected from invalid user postgres 59.97.21.114 port 57073 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2377435]: ", "ip4": "59.97.21.114", "users": "['postgres']", "user": "postgres"} 109.160.32.134 #sshd|1791647691|172800|1|{"matches": ["Oct 10 15:54:05 hecnet-us-east-gw sshd[2377588]: Failed none for invalid user from 109.160.32.134 port 45978 ssh2", "Oct 10 15:54:51 hecnet-us-east-gw sshd[2377591]: Connection from 109.160.32.134 port 39710 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 10 15:54:51 hecnet-us-east-gw sshd[2377591]: Invalid user mamat from 109.160.32.134 port 39710"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2377588]: ", "ip4": "109.160.32.134", "user": ""} 185.227.152.135 #sshd|1791654983|172800|1|{"matches": ["Oct 10 17:56:20 hecnet-us-east-gw sshd[2378472]: Invalid user caprover from 185.227.152.135 port 48176", "Oct 10 17:56:23 hecnet-us-east-gw sshd[2378472]: Failed password for invalid user caprover from 185.227.152.135 port 48176 ssh2", "Oct 10 17:56:23 hecnet-us-east-gw sshd[2378472]: Disconnected from invalid user caprover 185.227.152.135 port 48176 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2378472]: ", "ip4": "185.227.152.135", "users": "['caprover']", "user": "caprover"} 103.172.20.218 #sshd|1791657919|172800|1|{"matches": ["Oct 10 18:45:17 hecnet-us-east-gw sshd[2378816]: Invalid user muse from 103.172.20.218 port 39902", "Oct 10 18:45:19 hecnet-us-east-gw sshd[2378816]: Failed password for invalid user muse from 103.172.20.218 port 39902 ssh2", "Oct 10 18:45:19 hecnet-us-east-gw sshd[2378816]: Disconnected from invalid user muse 103.172.20.218 port 39902 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2378816]: ", "ip4": "103.172.20.218", "users": "['muse']", "user": "muse"} 14.103.90.3 #sshd|1791657935|172800|1|{"matches": ["Oct 10 18:45:33 hecnet-us-east-gw sshd[2378845]: Invalid user sol from 14.103.90.3 port 49958", "Oct 10 18:45:35 hecnet-us-east-gw sshd[2378845]: Failed password for invalid user sol from 14.103.90.3 port 49958 ssh2", "Oct 10 18:45:35 hecnet-us-east-gw sshd[2378845]: Disconnected from invalid user sol 14.103.90.3 port 49958 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2378845]: ", "ip4": "14.103.90.3", "users": "['sol']", "user": "sol"} 20.115.209.228 #sshd|1791658001|172800|1|{"matches": ["Oct 10 18:46:37 hecnet-us-east-gw sshd[2378878]: Invalid user arif from 20.115.209.228 port 37536", "Oct 10 18:46:39 hecnet-us-east-gw sshd[2378878]: Failed password for invalid user arif from 20.115.209.228 port 37536 ssh2", "Oct 10 18:46:41 hecnet-us-east-gw sshd[2378878]: Disconnected from invalid user arif 20.115.209.228 port 37536 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2378878]: ", "ip4": "20.115.209.228", "users": "['arif']", "user": "arif"} 170.106.140.35 #sshd|1791658382|172800|1|{"matches": ["Oct 10 18:52:59 hecnet-us-east-gw sshd[2378921]: Invalid user minecraft from 170.106.140.35 port 33006", "Oct 10 18:53:01 hecnet-us-east-gw sshd[2378921]: Failed password for invalid user minecraft from 170.106.140.35 port 33006 ssh2", "Oct 10 18:53:02 hecnet-us-east-gw sshd[2378921]: Disconnected from invalid user minecraft 170.106.140.35 port 33006 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2378921]: ", "ip4": "170.106.140.35", "users": "['minecraft']", "user": "minecraft"} 106.13.95.77 #sshd|1791658677|172800|1|{"matches": ["Oct 10 18:50:42 hecnet-us-east-gw sshd[2378913]: Failed password for invalid user prod from 106.13.95.77 port 54598 ssh2", "Oct 10 18:57:56 hecnet-us-east-gw sshd[2378952]: Connection from 106.13.95.77 port 57122 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 10 18:57:57 hecnet-us-east-gw sshd[2378952]: User root from 106.13.95.77 not allowed because not listed in AllowUsers"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2378913]: ", "ip4": "106.13.95.77", "users": "['prod']", "user": "prod"} 39.170.108.144 #sshd|1791663218|172800|1|{"matches": ["Oct 10 20:13:34 hecnet-us-east-gw sshd[2379490]: User root from 39.170.108.144 not allowed because not listed in AllowUsers", "Oct 10 20:13:36 hecnet-us-east-gw sshd[2379490]: Failed password for invalid user root from 39.170.108.144 port 2048 ssh2", "Oct 10 20:13:38 hecnet-us-east-gw sshd[2379490]: Disconnected from invalid user root 39.170.108.144 port 2048 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2379490]: ", "ip4": "39.170.108.144", "users": "['root']", "user": "root"} 43.133.61.254 #sshd|1791663271|172800|1|{"matches": ["Oct 10 20:14:27 hecnet-us-east-gw sshd[2379516]: Invalid user tob from 43.133.61.254 port 54112", "Oct 10 20:14:30 hecnet-us-east-gw sshd[2379516]: Failed password for invalid user tob from 43.133.61.254 port 54112 ssh2", "Oct 10 20:14:31 hecnet-us-east-gw sshd[2379516]: Disconnected from invalid user tob 43.133.61.254 port 54112 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2379516]: ", "ip4": "43.133.61.254", "users": "['tob']", "user": "tob"} 76.79.213.70 #sshd|1791663486|172800|1|{"matches": ["Oct 10 20:18:02 hecnet-us-east-gw sshd[2379585]: Invalid user admin from 76.79.213.70 port 43034", "Oct 10 20:18:04 hecnet-us-east-gw sshd[2379585]: Failed password for invalid user admin from 76.79.213.70 port 43034 ssh2", "Oct 10 20:18:06 hecnet-us-east-gw sshd[2379585]: Disconnected from invalid user admin 76.79.213.70 port 43034 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2379585]: ", "ip4": "76.79.213.70", "users": "['admin']", "user": "admin"} 160.251.202.248 #sshd|1791663512|172800|1|{"matches": ["Oct 10 20:18:28 hecnet-us-east-gw sshd[2379609]: User root from 160.251.202.248 not allowed because not listed in AllowUsers", "Oct 10 20:18:31 hecnet-us-east-gw sshd[2379609]: Failed password for invalid user root from 160.251.202.248 port 35414 ssh2", "Oct 10 20:18:32 hecnet-us-east-gw sshd[2379609]: Disconnected from invalid user root 160.251.202.248 port 35414 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2379609]: ", "ip4": "160.251.202.248", "users": "['root']", "user": "root"} 187.154.98.53 #sshd|1791663562|172800|1|{"matches": ["Oct 10 20:19:19 hecnet-us-east-gw sshd[2379651]: Invalid user user from 187.154.98.53 port 58520", "Oct 10 20:19:21 hecnet-us-east-gw sshd[2379651]: Failed password for invalid user user from 187.154.98.53 port 58520 ssh2", "Oct 10 20:19:22 hecnet-us-east-gw sshd[2379651]: Disconnected from invalid user user 187.154.98.53 port 58520 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2379651]: ", "ip4": "187.154.98.53", "users": "['user']", "user": "user"} 5.223.68.170 #sshd|1791663601|172800|1|{"matches": ["Oct 10 20:19:57 hecnet-us-east-gw sshd[2379672]: User root from 5.223.68.170 not allowed because not listed in AllowUsers", "Oct 10 20:19:59 hecnet-us-east-gw sshd[2379672]: Failed password for invalid user root from 5.223.68.170 port 53978 ssh2", "Oct 10 20:20:01 hecnet-us-east-gw sshd[2379672]: Disconnected from invalid user root 5.223.68.170 port 53978 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2379672]: ", "ip4": "5.223.68.170", "users": "['root']", "user": "root"} 154.201.89.198 #sshd|1791663653|172800|1|{"matches": ["Oct 10 20:20:49 hecnet-us-east-gw sshd[2379695]: Invalid user u1 from 154.201.89.198 port 36418", "Oct 10 20:20:51 hecnet-us-east-gw sshd[2379695]: Failed password for invalid user u1 from 154.201.89.198 port 36418 ssh2", "Oct 10 20:20:53 hecnet-us-east-gw sshd[2379695]: Disconnected from invalid user u1 154.201.89.198 port 36418 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2379695]: ", "ip4": "154.201.89.198", "users": "['u1']", "user": "u1"} 72.167.227.34 #sshd|1791669930|172800|1|{"matches": ["Oct 10 22:05:28 hecnet-us-east-gw sshd[2380383]: Invalid user cnc from 72.167.227.34 port 48014", "Oct 10 22:05:30 hecnet-us-east-gw sshd[2380383]: Failed password for invalid user cnc from 72.167.227.34 port 48014 ssh2", "Oct 10 22:05:30 hecnet-us-east-gw sshd[2380383]: Disconnected from invalid user cnc 72.167.227.34 port 48014 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2380383]: ", "ip4": "72.167.227.34", "users": "['cnc']", "user": "cnc"} 20.40.44.6 #sshd|1791670074|172800|1|{"matches": ["Oct 10 22:07:50 hecnet-us-east-gw sshd[2380411]: User root from 20.40.44.6 not allowed because not listed in AllowUsers", "Oct 10 22:07:52 hecnet-us-east-gw sshd[2380411]: Failed password for invalid user root from 20.40.44.6 port 42366 ssh2", "Oct 10 22:07:54 hecnet-us-east-gw sshd[2380411]: Disconnected from invalid user root 20.40.44.6 port 42366 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2380411]: ", "ip4": "20.40.44.6", "users": "['root']", "user": "root"} 61.171.65.219 #sshd|1791670479|172800|1|{"matches": ["Oct 10 22:10:54 hecnet-us-east-gw sshd[2380456]: Failed password for invalid user cnc from 61.171.65.219 port 60360 ssh2", "Oct 10 22:14:38 hecnet-us-east-gw sshd[2380473]: Connection from 61.171.65.219 port 57076 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 10 22:14:39 hecnet-us-east-gw sshd[2380473]: User root from 61.171.65.219 not allowed because not listed in AllowUsers"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2380456]: ", "ip4": "61.171.65.219", "users": "['cnc']", "user": "cnc"} 23.100.83.23 #lighttpd-scans|1791675098|172800|1|{"matches": [["", "Oct 10 23:31:38", " hecnet-us-east-gw lighttpd[1017]: 23.100.83.23 impvax.duckdns.org - [10/Oct/2026:23:31:38 +0000] \"GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1\" 404 341 \"-\" \"-\""], "Oct 10 23:31:38 hecnet-us-east-gw lighttpd[1017]: 23.100.83.23 impvax.duckdns.org - [10/Oct/2026:23:31:38 +0000] \"GET /this_is_a_new_hello_world.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 10 23:31:38 hecnet-us-east-gw lighttpd[1017]: 23.100.83.23 impvax.duckdns.org - [10/Oct/2026:23:31:38 +0000] \"GET /f5.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 10 23:31:38 hecnet-us-east-gw lighttpd[1017]: 23.100.83.23 impvax.duckdns.org - [10/Oct/2026:23:31:38 +0000] \"GET /3PJcpMFsD8B.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 10 23:31:38 hecnet-us-east-gw lighttpd[1017]: 23.100.83.23 impvax.duckdns.org - [10/Oct/2026:23:31:38 +0000] \"GET /z70.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 10 23:31:38 hecnet-us-east-gw lighttpd[1017]: 23.100.83.23 impvax.duckdns.org - [10/Oct/2026:23:31:38 +0000] \"GET /chosen.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 10 23:31:38 hecnet-us-east-gw lighttpd[1017]: 23.100.83.23 impvax.duckdns.org - [10/Oct/2026:23:31:38 +0000] \"GET /radio.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 10 23:31:38 hecnet-us-east-gw lighttpd[1017]: 23.100.83.23 impvax.duckdns.org - [10/Oct/2026:23:31:38 +0000] \"GET /wp_blog_footer.php HTTP/1.1\" 404 341 \"-\" \"-\""], "failures": 8, "ip4": "23.100.83.23"} 109.160.32.150 #sshd|1791676292|172800|1|{"matches": ["Oct 10 23:50:32 hecnet-us-east-gw sshd[2381148]: Failed none for invalid user from 109.160.32.150 port 40412 ssh2", "Oct 10 23:51:31 hecnet-us-east-gw sshd[2381152]: Connection from 109.160.32.150 port 40536 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 10 23:51:32 hecnet-us-east-gw sshd[2381152]: Invalid user wacos from 109.160.32.150 port 40536"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2381148]: ", "ip4": "109.160.32.150", "user": ""} 222.223.177.118 #sshd|1791679516|172800|1|{"matches": ["Oct 11 00:45:10 hecnet-us-east-gw sshd[2381528]: User root from 222.223.177.118 not allowed because not listed in AllowUsers", "Oct 11 00:45:12 hecnet-us-east-gw sshd[2381528]: Failed none for invalid user root from 222.223.177.118 port 32924 ssh2", "Oct 11 00:45:16 hecnet-us-east-gw sshd[2381528]: Failed password for invalid user root from 222.223.177.118 port 32924 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2381528]: ", "ip4": "222.223.177.118", "users": "['root']", "user": "root"} 109.160.32.132 #sshd|1791679570|172800|1|{"matches": ["Oct 11 00:45:05 hecnet-us-east-gw sshd[2381523]: Failed none for invalid user from 109.160.32.132 port 47998 ssh2", "Oct 11 00:46:09 hecnet-us-east-gw sshd[2381572]: Connection from 109.160.32.132 port 48056 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 11 00:46:10 hecnet-us-east-gw sshd[2381572]: Invalid user a1fleur from 109.160.32.132 port 48056"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2381523]: ", "ip4": "109.160.32.132", "user": ""} 14.103.117.84 #sshd|1791680145|172800|1|{"matches": ["Oct 11 00:55:43 hecnet-us-east-gw sshd[2381609]: User root from 14.103.117.84 not allowed because not listed in AllowUsers", "Oct 11 00:55:45 hecnet-us-east-gw sshd[2381609]: Failed password for invalid user root from 14.103.117.84 port 49122 ssh2", "Oct 11 00:55:45 hecnet-us-east-gw sshd[2381609]: Disconnected from invalid user root 14.103.117.84 port 49122 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2381609]: ", "ip4": "14.103.117.84", "users": "['root']", "user": "root"} 172.211.56.214 #sshd|1791680448|172800|1|{"matches": ["Oct 11 01:00:44 hecnet-us-east-gw sshd[2381655]: User root from 172.211.56.214 not allowed because not listed in AllowUsers", "Oct 11 01:00:46 hecnet-us-east-gw sshd[2381655]: Failed password for invalid user root from 172.211.56.214 port 49242 ssh2", "Oct 11 01:00:48 hecnet-us-east-gw sshd[2381655]: Disconnected from invalid user root 172.211.56.214 port 49242 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2381655]: ", "ip4": "172.211.56.214", "users": "['root']", "user": "root"} 14.103.111.13 #sshd|1791680905|172800|1|{"matches": ["Oct 11 01:05:02 hecnet-us-east-gw sshd[2381686]: Failed password for invalid user root from 14.103.111.13 port 41930 ssh2", "Oct 11 01:08:22 hecnet-us-east-gw sshd[2381726]: Connection from 14.103.111.13 port 50822 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 11 01:08:25 hecnet-us-east-gw sshd[2381726]: User root from 14.103.111.13 not allowed because not listed in AllowUsers"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2381686]: ", "ip4": "14.103.111.13", "users": "['root']", "user": "root"} 195.178.110.232 #sshd|1791681636|172800|1|{"matches": ["Oct 11 01:20:31 hecnet-us-east-gw sshd[2381848]: User root from 195.178.110.232 not allowed because not listed in AllowUsers", "Oct 11 01:20:33 hecnet-us-east-gw sshd[2381848]: Failed none for invalid user root from 195.178.110.232 port 60274 ssh2", "Oct 11 01:20:36 hecnet-us-east-gw sshd[2381848]: Failed password for invalid user root from 195.178.110.232 port 60274 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2381848]: ", "ip4": "195.178.110.232", "users": "['root']", "user": "root"} 104.155.92.149 #sshd|1791685475|172800|1|{"matches": ["Oct 11 02:24:29 hecnet-us-east-gw sshd[2382278]: Invalid user admin from 104.155.92.149 port 24806", "Oct 11 02:24:31 hecnet-us-east-gw sshd[2382278]: Failed none for invalid user admin from 104.155.92.149 port 24806 ssh2", "Oct 11 02:24:35 hecnet-us-east-gw sshd[2382278]: Failed password for invalid user admin from 104.155.92.149 port 24806 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2382278]: ", "ip4": "104.155.92.149", "users": "['admin']", "user": "admin"} 150.5.148.103 #sshd|1791687221|172800|1|{"matches": ["Oct 11 02:53:37 hecnet-us-east-gw sshd[2382562]: User root from 150.5.148.103 not allowed because not listed in AllowUsers", "Oct 11 02:53:39 hecnet-us-east-gw sshd[2382562]: Failed password for invalid user root from 150.5.148.103 port 55532 ssh2", "Oct 11 02:53:41 hecnet-us-east-gw sshd[2382562]: Disconnected from invalid user root 150.5.148.103 port 55532 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2382562]: ", "ip4": "150.5.148.103", "users": "['root']", "user": "root"} 92.27.101.99 #sshd|1791687344|172800|1|{"matches": ["Oct 11 02:55:42 hecnet-us-east-gw sshd[2382588]: User root from 92.27.101.99 not allowed because not listed in AllowUsers", "Oct 11 02:55:44 hecnet-us-east-gw sshd[2382588]: Failed password for invalid user root from 92.27.101.99 port 60674 ssh2", "Oct 11 02:55:44 hecnet-us-east-gw sshd[2382588]: Disconnected from invalid user root 92.27.101.99 port 60674 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2382588]: ", "ip4": "92.27.101.99", "users": "['root']", "user": "root"} 66.116.252.157 #sshd|1791687367|172800|1|{"matches": ["Oct 11 02:56:03 hecnet-us-east-gw sshd[2382611]: User root from 66.116.252.157 not allowed because not listed in AllowUsers", "Oct 11 02:56:05 hecnet-us-east-gw sshd[2382611]: Failed password for invalid user root from 66.116.252.157 port 54746 ssh2", "Oct 11 02:56:07 hecnet-us-east-gw sshd[2382611]: Disconnected from invalid user root 66.116.252.157 port 54746 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2382611]: ", "ip4": "66.116.252.157", "users": "['root']", "user": "root"} 193.32.162.84 #sshd|1791688851|172800|1|{"matches": ["Oct 11 03:20:45 hecnet-us-east-gw sshd[2382797]: User root from 193.32.162.84 not allowed because not listed in AllowUsers", "Oct 11 03:20:47 hecnet-us-east-gw sshd[2382797]: Failed none for invalid user root from 193.32.162.84 port 47380 ssh2", "Oct 11 03:20:51 hecnet-us-east-gw sshd[2382797]: Failed password for invalid user root from 193.32.162.84 port 47380 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2382797]: ", "ip4": "193.32.162.84", "users": "['root']", "user": "root"} 110.90.112.121 #sshd|1791689045|172800|1|{"matches": ["Oct 11 03:24:01 hecnet-us-east-gw sshd[2382832]: User root from 110.90.112.121 not allowed because not listed in AllowUsers", "Oct 11 03:24:03 hecnet-us-east-gw sshd[2382832]: Failed password for invalid user root from 110.90.112.121 port 41146 ssh2", "Oct 11 03:24:05 hecnet-us-east-gw sshd[2382832]: Connection closed by invalid user root 110.90.112.121 port 41146 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2382832]: ", "ip4": "110.90.112.121", "users": "['root']", "user": "root"} 36.133.214.135 #sshd|1791691885|172800|1|{"matches": ["Oct 11 04:01:03 hecnet-us-east-gw sshd[2383086]: Failed password for invalid user root from 36.133.214.135 port 52418 ssh2", "Oct 11 04:11:24 hecnet-us-east-gw sshd[2383160]: Connection from 36.133.214.135 port 46304 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 11 04:11:25 hecnet-us-east-gw sshd[2383160]: Invalid user jb from 36.133.214.135 port 46304"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2383086]: ", "ip4": "36.133.214.135", "users": "['root']", "user": "root"} 20.157.117.15 #sshd|1791694055|172800|1|{"matches": ["Oct 11 04:47:33 hecnet-us-east-gw sshd[2383513]: User root from 20.157.117.15 not allowed because not listed in AllowUsers", "Oct 11 04:47:34 hecnet-us-east-gw sshd[2383513]: Failed password for invalid user root from 20.157.117.15 port 46208 ssh2", "Oct 11 04:47:35 hecnet-us-east-gw sshd[2383513]: Disconnected from invalid user root 20.157.117.15 port 46208 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2383513]: ", "ip4": "20.157.117.15", "users": "['root']", "user": "root"} 113.177.27.200 #sshd|1791695489|172800|1|{"matches": ["Oct 11 05:11:25 hecnet-us-east-gw sshd[2383653]: Invalid user mc from 113.177.27.200 port 55748", "Oct 11 05:11:27 hecnet-us-east-gw sshd[2383653]: Failed password for invalid user mc from 113.177.27.200 port 55748 ssh2", "Oct 11 05:11:29 hecnet-us-east-gw sshd[2383653]: Disconnected from invalid user mc 113.177.27.200 port 55748 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2383653]: ", "ip4": "113.177.27.200", "users": "['mc']", "user": "mc"} 222.124.177.148 #sshd|1791696089|172800|1|{"matches": ["Oct 11 05:21:25 hecnet-us-east-gw sshd[2383749]: User root from 222.124.177.148 not allowed because not listed in AllowUsers", "Oct 11 05:21:28 hecnet-us-east-gw sshd[2383749]: Failed password for invalid user root from 222.124.177.148 port 44482 ssh2", "Oct 11 05:21:29 hecnet-us-east-gw sshd[2383749]: Disconnected from invalid user root 222.124.177.148 port 44482 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2383749]: ", "ip4": "222.124.177.148", "users": "['root']", "user": "root"} 190.60.242.28 #sshd|1791696135|172800|1|{"matches": ["Oct 11 05:22:11 hecnet-us-east-gw sshd[2383773]: User root from 190.60.242.28 not allowed because not listed in AllowUsers", "Oct 11 05:22:13 hecnet-us-east-gw sshd[2383773]: Failed password for invalid user root from 190.60.242.28 port 49064 ssh2", "Oct 11 05:22:15 hecnet-us-east-gw sshd[2383773]: Disconnected from invalid user root 190.60.242.28 port 49064 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2383773]: ", "ip4": "190.60.242.28", "users": "['root']", "user": "root"} 5.182.44.168 #sshd|1791704162|172800|1|{"matches": ["Oct 11 07:35:57 hecnet-us-east-gw sshd[2384999]: Invalid user es from 5.182.44.168 port 48230", "Oct 11 07:35:59 hecnet-us-east-gw sshd[2384999]: Failed none for invalid user es from 5.182.44.168 port 48230 ssh2", "Oct 11 07:36:02 hecnet-us-east-gw sshd[2384999]: Failed password for invalid user es from 5.182.44.168 port 48230 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2384999]: ", "ip4": "5.182.44.168", "users": "['es']", "user": "es"} 213.230.127.104 #sshd|1791706560|172800|1|{"matches": ["Oct 11 08:15:57 hecnet-us-east-gw sshd[2385307]: Invalid user mohan from 213.230.127.104 port 59964", "Oct 11 08:15:59 hecnet-us-east-gw sshd[2385307]: Failed password for invalid user mohan from 213.230.127.104 port 59964 ssh2", "Oct 11 08:16:00 hecnet-us-east-gw sshd[2385307]: Disconnected from invalid user mohan 213.230.127.104 port 59964 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2385307]: ", "ip4": "213.230.127.104", "users": "['mohan']", "user": "mohan"} 52.140.76.154 #sshd|1791706887|172800|1|{"matches": ["Oct 11 08:21:22 hecnet-us-east-gw sshd[2385352]: Invalid user test from 52.140.76.154 port 41972", "Oct 11 08:21:25 hecnet-us-east-gw sshd[2385352]: Failed password for invalid user test from 52.140.76.154 port 41972 ssh2", "Oct 11 08:21:27 hecnet-us-east-gw sshd[2385352]: Disconnected from invalid user test 52.140.76.154 port 41972 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2385352]: ", "ip4": "52.140.76.154", "users": "['test']", "user": "test"} 182.244.0.100 #sshd|1791706899|172800|1|{"matches": ["Oct 11 08:21:34 hecnet-us-east-gw sshd[2385375]: User root from 182.244.0.100 not allowed because not listed in AllowUsers", "Oct 11 08:21:36 hecnet-us-east-gw sshd[2385375]: Failed password for invalid user root from 182.244.0.100 port 33675 ssh2", "Oct 11 08:21:39 hecnet-us-east-gw sshd[2385375]: Disconnected from invalid user root 182.244.0.100 port 33675 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2385375]: ", "ip4": "182.244.0.100", "users": "['root']", "user": "root"} 222.88.225.195 #sshd|1791707627|172800|1|{"matches": ["Oct 11 08:33:43 hecnet-us-east-gw sshd[2385531]: User root from 222.88.225.195 not allowed because not listed in AllowUsers", "Oct 11 08:33:45 hecnet-us-east-gw sshd[2385531]: Failed password for invalid user root from 222.88.225.195 port 36100 ssh2", "Oct 11 08:33:47 hecnet-us-east-gw sshd[2385531]: Disconnected from invalid user root 222.88.225.195 port 36100 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2385531]: ", "ip4": "222.88.225.195", "users": "['root']", "user": "root"} 109.160.32.168 #sshd|1791707708|172800|1|{"matches": ["Oct 11 08:34:33 hecnet-us-east-gw sshd[2385554]: Failed none for invalid user from 109.160.32.168 port 35314 ssh2", "Oct 11 08:35:06 hecnet-us-east-gw sshd[2385590]: Connection from 109.160.32.168 port 51854 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 11 08:35:08 hecnet-us-east-gw sshd[2385590]: Invalid user padmav from 109.160.32.168 port 51854"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2385554]: ", "ip4": "109.160.32.168", "user": ""} 103.200.23.107 #sshd|1791710430|172800|1|{"matches": ["Oct 11 09:20:27 hecnet-us-east-gw sshd[2385889]: Invalid user apt from 103.200.23.107 port 43966", "Oct 11 09:20:29 hecnet-us-east-gw sshd[2385889]: Failed password for invalid user apt from 103.200.23.107 port 43966 ssh2", "Oct 11 09:20:30 hecnet-us-east-gw sshd[2385889]: Disconnected from invalid user apt 103.200.23.107 port 43966 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2385889]: ", "ip4": "103.200.23.107", "users": "['apt']", "user": "apt"} 123.58.220.223 #sshd|1791710791|172800|1|{"matches": ["Oct 11 09:26:29 hecnet-us-east-gw sshd[2385952]: User root from 123.58.220.223 not allowed because not listed in AllowUsers", "Oct 11 09:26:30 hecnet-us-east-gw sshd[2385952]: Failed password for invalid user root from 123.58.220.223 port 55212 ssh2", "Oct 11 09:26:31 hecnet-us-east-gw sshd[2385952]: Disconnected from invalid user root 123.58.220.223 port 55212 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2385952]: ", "ip4": "123.58.220.223", "users": "['root']", "user": "root"} 180.76.60.83 #sshd|1791711296|172800|1|{"matches": ["Oct 11 09:22:39 hecnet-us-east-gw sshd[2385916]: Failed password for invalid user sql from 180.76.60.83 port 47726 ssh2", "Oct 11 09:34:53 hecnet-us-east-gw sshd[2386007]: Connection from 180.76.60.83 port 59996 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 11 09:34:56 hecnet-us-east-gw sshd[2386007]: User root from 180.76.60.83 not allowed because not listed in AllowUsers"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2385916]: ", "ip4": "180.76.60.83", "users": "['sql']", "user": "sql"} 103.94.129.14 #sshd|1791711386|172800|1|{"matches": ["Oct 11 09:36:21 hecnet-us-east-gw sshd[2386067]: Invalid user test from 103.94.129.14 port 55166", "Oct 11 09:36:23 hecnet-us-east-gw sshd[2386067]: Failed password for invalid user test from 103.94.129.14 port 55166 ssh2", "Oct 11 09:36:26 hecnet-us-east-gw sshd[2386067]: Disconnected from invalid user test 103.94.129.14 port 55166 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2386067]: ", "ip4": "103.94.129.14", "users": "['test']", "user": "test"} 103.94.129.6 #sshd|1791711997|172800|1|{"matches": ["Oct 11 09:46:33 hecnet-us-east-gw sshd[2386170]: Invalid user rodrigo from 103.94.129.6 port 43042", "Oct 11 09:46:35 hecnet-us-east-gw sshd[2386170]: Failed password for invalid user rodrigo from 103.94.129.6 port 43042 ssh2", "Oct 11 09:46:37 hecnet-us-east-gw sshd[2386170]: Disconnected from invalid user rodrigo 103.94.129.6 port 43042 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2386170]: ", "ip4": "103.94.129.6", "users": "['rodrigo']", "user": "rodrigo"} 103.94.129.4 #sshd|1791712197|172800|1|{"matches": ["Oct 11 09:49:54 hecnet-us-east-gw sshd[2386202]: Invalid user inssserver from 103.94.129.4 port 57964", "Oct 11 09:49:56 hecnet-us-east-gw sshd[2386202]: Failed password for invalid user inssserver from 103.94.129.4 port 57964 ssh2", "Oct 11 09:49:57 hecnet-us-east-gw sshd[2386202]: Disconnected from invalid user inssserver 103.94.129.4 port 57964 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2386202]: ", "ip4": "103.94.129.4", "users": "['inssserver']", "user": "inssserver"} 158.23.18.109 #lighttpd-scans|1791712872|172800|1|{"matches": [["", "Oct 11 10:01:11", " hecnet-us-east-gw lighttpd[1017]: 158.23.18.109 impvax.duckdns.org - [11/Oct/2026:10:01:11 +0000] \"GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1\" 404 341 \"-\" \"-\""], "Oct 11 10:01:11 hecnet-us-east-gw lighttpd[1017]: 158.23.18.109 impvax.duckdns.org - [11/Oct/2026:10:01:11 +0000] \"GET /this_is_a_new_hello_world.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 11 10:01:12 hecnet-us-east-gw lighttpd[1017]: 158.23.18.109 impvax.duckdns.org - [11/Oct/2026:10:01:12 +0000] \"GET /ws.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 11 10:01:12 hecnet-us-east-gw lighttpd[1017]: 158.23.18.109 impvax.duckdns.org - [11/Oct/2026:10:01:12 +0000] \"GET /xivoefjr.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 11 10:01:12 hecnet-us-east-gw lighttpd[1017]: 158.23.18.109 impvax.duckdns.org - [11/Oct/2026:10:01:12 +0000] \"GET /bnmtp.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 11 10:01:12 hecnet-us-east-gw lighttpd[1017]: 158.23.18.109 impvax.duckdns.org - [11/Oct/2026:10:01:12 +0000] \"GET /or.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 11 10:01:12 hecnet-us-east-gw lighttpd[1017]: 158.23.18.109 impvax.duckdns.org - [11/Oct/2026:10:01:12 +0000] \"GET /date1.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 11 10:01:12 hecnet-us-east-gw lighttpd[1017]: 158.23.18.109 impvax.duckdns.org - [11/Oct/2026:10:01:12 +0000] \"GET /opsh.php HTTP/1.1\" 404 341 \"-\" \"-\""], "failures": 8, "ip4": "158.23.18.109"} 118.145.111.55 #sshd|1791713491|172800|1|{"matches": ["Oct 11 09:44:58 hecnet-us-east-gw sshd[2386127]: Failed password for invalid user adminroot from 118.145.111.55 port 58686 ssh2", "Oct 11 10:11:28 hecnet-us-east-gw sshd[2386365]: Connection from 118.145.111.55 port 37150 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 11 10:11:31 hecnet-us-east-gw sshd[2386365]: Invalid user dashuai from 118.145.111.55 port 37150"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2386127]: ", "ip4": "118.145.111.55", "users": "['adminroot']", "user": "adminroot"} 136.0.39.68 #sshd|1791719137|172800|1|{"matches": ["Oct 11 11:45:35 hecnet-us-east-gw sshd[2387103]: Invalid user gitlab-runner from 136.0.39.68 port 33176", "Oct 11 11:45:37 hecnet-us-east-gw sshd[2387103]: Failed password for invalid user gitlab-runner from 136.0.39.68 port 33176 ssh2", "Oct 11 11:45:37 hecnet-us-east-gw sshd[2387103]: Disconnected from invalid user gitlab-runner 136.0.39.68 port 33176 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2387103]: ", "ip4": "136.0.39.68", "users": "['gitlab-runner']", "user": "gitlab-runner"} 109.160.32.139 #sshd|1791719143|172800|1|{"matches": ["Oct 11 11:44:31 hecnet-us-east-gw sshd[2387071]: Failed none for invalid user from 109.160.32.139 port 41752 ssh2", "Oct 11 11:45:42 hecnet-us-east-gw sshd[2387128]: Connection from 109.160.32.139 port 49682 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 11 11:45:43 hecnet-us-east-gw sshd[2387128]: Invalid user mobile from 109.160.32.139 port 49682"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2387071]: ", "ip4": "109.160.32.139", "user": ""} 182.237.13.208 #sshd|1791719173|172800|1|{"matches": ["Oct 11 11:46:11 hecnet-us-east-gw sshd[2387159]: User root from 182.237.13.208 not allowed because not listed in AllowUsers", "Oct 11 11:46:12 hecnet-us-east-gw sshd[2387159]: Failed password for invalid user root from 182.237.13.208 port 38790 ssh2", "Oct 11 11:46:13 hecnet-us-east-gw sshd[2387159]: Disconnected from invalid user root 182.237.13.208 port 38790 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2387159]: ", "ip4": "182.237.13.208", "users": "['root']", "user": "root"} 45.148.10.240 #sshd|1791721989|172800|1|{"matches": ["Oct 11 12:33:05 hecnet-us-east-gw sshd[2387457]: Invalid user ubuntu from 45.148.10.240 port 44806", "Oct 11 12:33:07 hecnet-us-east-gw sshd[2387457]: Failed none for invalid user ubuntu from 45.148.10.240 port 44806 ssh2", "Oct 11 12:33:09 hecnet-us-east-gw sshd[2387457]: Failed password for invalid user ubuntu from 45.148.10.240 port 44806 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2387457]: ", "ip4": "45.148.10.240", "users": "['ubuntu']", "user": "ubuntu"} 109.160.32.103 #sshd|1791723579|172800|1|{"matches": ["Oct 11 12:58:53 hecnet-us-east-gw sshd[2387643]: Failed none for invalid user from 109.160.32.103 port 45698 ssh2", "Oct 11 12:59:37 hecnet-us-east-gw sshd[2387646]: Connection from 109.160.32.103 port 42992 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 11 12:59:39 hecnet-us-east-gw sshd[2387646]: Invalid user sonarqube from 109.160.32.103 port 42992"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2387643]: ", "ip4": "109.160.32.103", "user": ""} 109.160.32.32 #sshd|1791724515|172800|1|{"matches": ["Oct 11 13:14:36 hecnet-us-east-gw sshd[2387785]: Failed none for invalid user from 109.160.32.32 port 49722 ssh2", "Oct 11 13:15:13 hecnet-us-east-gw sshd[2387808]: Connection from 109.160.32.32 port 53648 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 11 13:15:15 hecnet-us-east-gw sshd[2387808]: Invalid user wqx from 109.160.32.32 port 53648"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2387785]: ", "ip4": "109.160.32.32", "user": ""} 93.130.164.237 #sshd|1791725260|172800|1|{"matches": ["Oct 11 13:27:37 hecnet-us-east-gw sshd[2387944]: Connection from 93.130.164.237 port 64728 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 11 13:27:38 hecnet-us-east-gw sshd[2387944]: Invalid user pi from 93.130.164.237 port 64728", "Oct 11 13:27:40 hecnet-us-east-gw sshd[2387944]: Failed none for invalid user pi from 93.130.164.237 port 64728 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2387944]: ", "ip4": "93.130.164.237", "users": "['pi']", "user": "pi"} 103.48.84.200 #sshd|1791727684|172800|1|{"matches": ["Oct 11 14:08:00 hecnet-us-east-gw sshd[2388288]: User root from 103.48.84.200 not allowed because not listed in AllowUsers", "Oct 11 14:08:02 hecnet-us-east-gw sshd[2388288]: Failed password for invalid user root from 103.48.84.200 port 55480 ssh2", "Oct 11 14:08:04 hecnet-us-east-gw sshd[2388288]: Disconnected from invalid user root 103.48.84.200 port 55480 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2388288]: ", "ip4": "103.48.84.200", "users": "['root']", "user": "root"} 77.239.124.73 #sshd|1791727800|172800|1|{"matches": ["Oct 11 14:09:53 hecnet-us-east-gw sshd[2388316]: User root from 77.239.124.73 not allowed because not listed in AllowUsers", "Oct 11 14:09:56 hecnet-us-east-gw sshd[2388316]: Failed none for invalid user root from 77.239.124.73 port 49346 ssh2", "Oct 11 14:10:00 hecnet-us-east-gw sshd[2388316]: Failed password for invalid user root from 77.239.124.73 port 49346 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2388316]: ", "ip4": "77.239.124.73", "users": "['root']", "user": "root"} 74.118.81.174 #sshd|1791728135|172800|1|{"matches": ["Oct 11 14:15:32 hecnet-us-east-gw sshd[2388441]: Invalid user backupuser from 74.118.81.174 port 48610", "Oct 11 14:15:34 hecnet-us-east-gw sshd[2388441]: Failed password for invalid user backupuser from 74.118.81.174 port 48610 ssh2", "Oct 11 14:15:35 hecnet-us-east-gw sshd[2388441]: Disconnected from invalid user backupuser 74.118.81.174 port 48610 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2388441]: ", "ip4": "74.118.81.174", "users": "['backupuser']", "user": "backupuser"} 109.160.32.166 #sshd|1791728507|172800|1|{"matches": ["Oct 11 14:20:32 hecnet-us-east-gw sshd[2388487]: Failed none for invalid user from 109.160.32.166 port 45774 ssh2", "Oct 11 14:21:47 hecnet-us-east-gw sshd[2388493]: Connection from 109.160.32.166 port 50152 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 11 14:21:47 hecnet-us-east-gw sshd[2388493]: Invalid user beaver from 109.160.32.166 port 50152"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2388487]: ", "ip4": "109.160.32.166", "user": ""} 180.108.46.6 #sshd|1791731350|172800|1|{"matches": ["Oct 11 15:09:06 hecnet-us-east-gw sshd[2388863]: User root from 180.108.46.6 not allowed because not listed in AllowUsers", "Oct 11 15:09:07 hecnet-us-east-gw sshd[2388863]: Failed none for invalid user root from 180.108.46.6 port 34204 ssh2", "Oct 11 15:09:10 hecnet-us-east-gw sshd[2388863]: Failed password for invalid user root from 180.108.46.6 port 34204 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2388863]: ", "ip4": "180.108.46.6", "users": "['root']", "user": "root"} 170.106.75.254 #sshd|1791733814|172800|1|{"matches": ["Oct 11 15:50:10 hecnet-us-east-gw sshd[2389173]: User root from 170.106.75.254 not allowed because not listed in AllowUsers", "Oct 11 15:50:12 hecnet-us-east-gw sshd[2389173]: Failed password for invalid user root from 170.106.75.254 port 59694 ssh2", "Oct 11 15:50:14 hecnet-us-east-gw sshd[2389173]: Disconnected from invalid user root 170.106.75.254 port 59694 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2389173]: ", "ip4": "170.106.75.254", "users": "['root']", "user": "root"} 177.130.250.31 #sshd|1791734353|172800|1|{"matches": ["Oct 11 15:59:10 hecnet-us-east-gw sshd[2389215]: Invalid user front from 177.130.250.31 port 51985", "Oct 11 15:59:13 hecnet-us-east-gw sshd[2389215]: Failed password for invalid user front from 177.130.250.31 port 51985 ssh2", "Oct 11 15:59:13 hecnet-us-east-gw sshd[2389215]: Disconnected from invalid user front 177.130.250.31 port 51985 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2389215]: ", "ip4": "177.130.250.31", "users": "['front']", "user": "front"} 158.23.176.177 #lighttpd-scans|1791734872|172800|1|{"matches": [["", "Oct 11 16:07:50", " hecnet-us-east-gw lighttpd[1017]: 158.23.176.177 impvax.duckdns.org - [11/Oct/2026:16:07:50 +0000] \"GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1\" 404 341 \"-\" \"-\""], "Oct 11 16:07:51 hecnet-us-east-gw lighttpd[1017]: 158.23.176.177 impvax.duckdns.org - [11/Oct/2026:16:07:50 +0000] \"GET /this_is_a_new_hello_world.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 11 16:07:51 hecnet-us-east-gw lighttpd[1017]: 158.23.176.177 impvax.duckdns.org - [11/Oct/2026:16:07:51 +0000] \"GET /f5.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 11 16:07:51 hecnet-us-east-gw lighttpd[1017]: 158.23.176.177 impvax.duckdns.org - [11/Oct/2026:16:07:51 +0000] \"GET /3PJcpMFsD8B.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 11 16:07:51 hecnet-us-east-gw lighttpd[1017]: 158.23.176.177 impvax.duckdns.org - [11/Oct/2026:16:07:51 +0000] \"GET /z70.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 11 16:07:51 hecnet-us-east-gw lighttpd[1017]: 158.23.176.177 impvax.duckdns.org - [11/Oct/2026:16:07:51 +0000] \"GET /chosen.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 11 16:07:52 hecnet-us-east-gw lighttpd[1017]: 158.23.176.177 impvax.duckdns.org - [11/Oct/2026:16:07:52 +0000] \"GET /radio.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 11 16:07:52 hecnet-us-east-gw lighttpd[1017]: 158.23.176.177 impvax.duckdns.org - [11/Oct/2026:16:07:52 +0000] \"GET /wp_blog_footer.php HTTP/1.1\" 404 341 \"-\" \"-\""], "failures": 8, "ip4": "158.23.176.177"} 141.94.245.19 #sshd|1791740582|172800|1|{"matches": ["Oct 11 17:43:00 hecnet-us-east-gw sshd[2389999]: Invalid user logviewer from 141.94.245.19 port 55782", "Oct 11 17:43:02 hecnet-us-east-gw sshd[2389999]: Failed password for invalid user logviewer from 141.94.245.19 port 55782 ssh2", "Oct 11 17:43:02 hecnet-us-east-gw sshd[2389999]: Disconnected from invalid user logviewer 141.94.245.19 port 55782 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2389999]: ", "ip4": "141.94.245.19", "users": "['logviewer']", "user": "logviewer"} 103.143.72.165 #sshd|1791741396|172800|1|{"matches": ["Oct 11 17:56:34 hecnet-us-east-gw sshd[2390088]: Invalid user andrew from 103.143.72.165 port 47788", "Oct 11 17:56:36 hecnet-us-east-gw sshd[2390088]: Failed password for invalid user andrew from 103.143.72.165 port 47788 ssh2", "Oct 11 17:56:36 hecnet-us-east-gw sshd[2390088]: Disconnected from invalid user andrew 103.143.72.165 port 47788 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2390088]: ", "ip4": "103.143.72.165", "users": "['andrew']", "user": "andrew"} 152.32.254.222 #sshd|1791741487|172800|1|{"matches": ["Oct 11 17:58:04 hecnet-us-east-gw sshd[2390115]: User root from 152.32.254.222 not allowed because not listed in AllowUsers", "Oct 11 17:58:06 hecnet-us-east-gw sshd[2390115]: Failed password for invalid user root from 152.32.254.222 port 45146 ssh2", "Oct 11 17:58:07 hecnet-us-east-gw sshd[2390115]: Disconnected from invalid user root 152.32.254.222 port 45146 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2390115]: ", "ip4": "152.32.254.222", "users": "['root']", "user": "root"} 113.141.171.139 #sshd|1791741904|172800|1|{"matches": ["Oct 11 18:05:02 hecnet-us-east-gw sshd[2390170]: Invalid user va from 113.141.171.139 port 54332", "Oct 11 18:05:04 hecnet-us-east-gw sshd[2390170]: Failed password for invalid user va from 113.141.171.139 port 54332 ssh2", "Oct 11 18:05:04 hecnet-us-east-gw sshd[2390170]: Disconnected from invalid user va 113.141.171.139 port 54332 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2390170]: ", "ip4": "113.141.171.139", "users": "['va']", "user": "va"} 20.219.160.77 #lighttpd-scans|1791744237|172800|1|{"matches": [["", "Oct 11 18:43:37", " hecnet-us-east-gw lighttpd[1017]: 20.219.160.77 hecnet-us-east-gw.duckdns.org - [11/Oct/2026:18:43:36 +0000] \"GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1\" 404 341 \"-\" \"-\""], "Oct 11 18:43:40 hecnet-us-east-gw lighttpd[1017]: 20.219.160.77 hecnet-us-east-gw.duckdns.org - [11/Oct/2026:18:43:39 +0000] \"GET /this_is_a_new_hello_world.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 11 18:43:44 hecnet-us-east-gw lighttpd[1017]: 20.219.160.77 hecnet-us-east-gw.duckdns.org - [11/Oct/2026:18:43:43 +0000] \"GET /wmore1.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 11 18:43:48 hecnet-us-east-gw lighttpd[1017]: 20.219.160.77 hecnet-us-east-gw.duckdns.org - [11/Oct/2026:18:43:47 +0000] \"GET /wp_blog_footer.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 11 18:43:50 hecnet-us-east-gw lighttpd[1017]: 20.219.160.77 hecnet-us-east-gw.duckdns.org - [11/Oct/2026:18:43:50 +0000] \"GET /xie.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 11 18:43:52 hecnet-us-east-gw lighttpd[1017]: 20.219.160.77 hecnet-us-east-gw.duckdns.org - [11/Oct/2026:18:43:52 +0000] \"GET /css.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 11 18:43:55 hecnet-us-east-gw lighttpd[1017]: 20.219.160.77 hecnet-us-east-gw.duckdns.org - [11/Oct/2026:18:43:54 +0000] \"GET /radio.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 11 18:43:57 hecnet-us-east-gw lighttpd[1017]: 20.219.160.77 hecnet-us-east-gw.duckdns.org - [11/Oct/2026:18:43:57 +0000] \"GET /robot.php HTTP/1.1\" 404 341 \"-\" \"-\""], "failures": 8, "ip4": "20.219.160.77"} 47.151.88.243 #sshd|1791746160|172800|1|{"matches": ["Oct 11 19:15:57 hecnet-us-east-gw sshd[2390716]: Invalid user admin from 47.151.88.243 port 48804", "Oct 11 19:15:59 hecnet-us-east-gw sshd[2390716]: Failed password for invalid user admin from 47.151.88.243 port 48804 ssh2", "Oct 11 19:16:00 hecnet-us-east-gw sshd[2390716]: Connection closed by invalid user admin 47.151.88.243 port 48804 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2390716]: ", "ip4": "47.151.88.243", "users": "['admin']", "user": "admin"} 165.154.1.144 #sshd|1791746400|172800|1|{"matches": ["Oct 11 19:19:57 hecnet-us-east-gw sshd[2390747]: Invalid user admin from 165.154.1.144 port 11918", "Oct 11 19:19:59 hecnet-us-east-gw sshd[2390747]: Failed password for invalid user admin from 165.154.1.144 port 11918 ssh2", "Oct 11 19:20:00 hecnet-us-east-gw sshd[2390747]: Connection closed by invalid user admin 165.154.1.144 port 11918 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2390747]: ", "ip4": "165.154.1.144", "users": "['admin']", "user": "admin"} 138.68.162.22 #sshd|1791748252|172800|1|{"matches": ["Oct 11 19:50:48 hecnet-us-east-gw sshd[2390954]: User root from 138.68.162.22 not allowed because not listed in AllowUsers", "Oct 11 19:50:50 hecnet-us-east-gw sshd[2390954]: Failed none for invalid user root from 138.68.162.22 port 36578 ssh2", "Oct 11 19:50:52 hecnet-us-east-gw sshd[2390954]: Failed password for invalid user root from 138.68.162.22 port 36578 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2390954]: ", "ip4": "138.68.162.22", "users": "['root']", "user": "root"} 201.79.12.53 #sshd|1791749294|172800|1|{"matches": ["Oct 11 20:08:08 hecnet-us-east-gw sshd[2391066]: Invalid user ira from 201.79.12.53 port 43760", "Oct 11 20:08:10 hecnet-us-east-gw sshd[2391066]: Failed none for invalid user ira from 201.79.12.53 port 43760 ssh2", "Oct 11 20:08:14 hecnet-us-east-gw sshd[2391066]: Failed password for invalid user ira from 201.79.12.53 port 43760 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2391066]: ", "ip4": "201.79.12.53", "users": "['ira']", "user": "ira"} 109.160.32.142 #sshd|1791749911|172800|1|{"matches": ["Oct 11 20:17:35 hecnet-us-east-gw sshd[2391179]: Failed none for invalid user from 109.160.32.142 port 59000 ssh2", "Oct 11 20:18:29 hecnet-us-east-gw sshd[2391182]: Connection from 109.160.32.142 port 43222 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 11 20:18:31 hecnet-us-east-gw sshd[2391182]: Invalid user a1koskey from 109.160.32.142 port 43222"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2391179]: ", "ip4": "109.160.32.142", "user": ""} 58.229.253.119 #sshd|1791750643|172800|1|{"matches": ["Oct 11 20:30:41 hecnet-us-east-gw sshd[2391320]: User root from 58.229.253.119 not allowed because not listed in AllowUsers", "Oct 11 20:30:42 hecnet-us-east-gw sshd[2391320]: Failed password for invalid user root from 58.229.253.119 port 38740 ssh2", "Oct 11 20:30:43 hecnet-us-east-gw sshd[2391320]: Disconnected from invalid user root 58.229.253.119 port 38740 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2391320]: ", "ip4": "58.229.253.119", "users": "['root']", "user": "root"} 204.48.23.122 #sshd|1791751808|172800|1|{"matches": ["Oct 11 20:50:02 hecnet-us-east-gw sshd[2391487]: Invalid user hummingbot from 204.48.23.122 port 43420", "Oct 11 20:50:05 hecnet-us-east-gw sshd[2391487]: Failed none for invalid user hummingbot from 204.48.23.122 port 43420 ssh2", "Oct 11 20:50:08 hecnet-us-east-gw sshd[2391487]: Failed password for invalid user hummingbot from 204.48.23.122 port 43420 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2391487]: ", "ip4": "204.48.23.122", "users": "['hummingbot']", "user": "hummingbot"} 103.216.145.2 #sshd|1791753878|172800|1|{"matches": ["Oct 11 21:24:34 hecnet-us-east-gw sshd[2391683]: User root from 103.216.145.2 not allowed because not listed in AllowUsers", "Oct 11 21:24:36 hecnet-us-east-gw sshd[2391683]: Failed password for invalid user root from 103.216.145.2 port 40630 ssh2", "Oct 11 21:24:38 hecnet-us-east-gw sshd[2391683]: Disconnected from invalid user root 103.216.145.2 port 40630 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2391683]: ", "ip4": "103.216.145.2", "users": "['root']", "user": "root"} 181.49.8.57 #sshd|1791753916|172800|1|{"matches": ["Oct 11 21:25:12 hecnet-us-east-gw sshd[2391732]: Invalid user ftpuser from 181.49.8.57 port 38884", "Oct 11 21:25:14 hecnet-us-east-gw sshd[2391732]: Failed password for invalid user ftpuser from 181.49.8.57 port 38884 ssh2", "Oct 11 21:25:16 hecnet-us-east-gw sshd[2391732]: Disconnected from invalid user ftpuser 181.49.8.57 port 38884 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2391732]: ", "ip4": "181.49.8.57", "users": "['ftpuser']", "user": "ftpuser"} 101.96.225.252 #sshd|1791753974|172800|1|{"matches": ["Oct 11 21:26:11 hecnet-us-east-gw sshd[2391754]: User root from 101.96.225.252 not allowed because not listed in AllowUsers", "Oct 11 21:26:13 hecnet-us-east-gw sshd[2391754]: Failed password for invalid user root from 101.96.225.252 port 43744 ssh2", "Oct 11 21:26:14 hecnet-us-east-gw sshd[2391754]: Disconnected from invalid user root 101.96.225.252 port 43744 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2391754]: ", "ip4": "101.96.225.252", "users": "['root']", "user": "root"} 103.131.61.136 #sshd|1791753986|172800|1|{"matches": ["Oct 11 21:26:23 hecnet-us-east-gw sshd[2391774]: User root from 103.131.61.136 not allowed because not listed in AllowUsers", "Oct 11 21:26:25 hecnet-us-east-gw sshd[2391774]: Failed password for invalid user root from 103.131.61.136 port 49256 ssh2", "Oct 11 21:26:26 hecnet-us-east-gw sshd[2391774]: Disconnected from invalid user root 103.131.61.136 port 49256 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2391774]: ", "ip4": "103.131.61.136", "users": "['root']", "user": "root"} 51.75.253.68 #sshd|1791769760|172800|1|{"matches": ["Oct 12 01:49:18 hecnet-us-east-gw sshd[2393530]: User root from 51.75.253.68 not allowed because not listed in AllowUsers", "Oct 12 01:49:19 hecnet-us-east-gw sshd[2393530]: Failed password for invalid user root from 51.75.253.68 port 42178 ssh2", "Oct 12 01:49:20 hecnet-us-east-gw sshd[2393530]: Disconnected from invalid user root 51.75.253.68 port 42178 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2393530]: ", "ip4": "51.75.253.68", "users": "['root']", "user": "root"} 113.160.150.99 #sshd|1791770224|172800|1|{"matches": ["Oct 12 01:57:02 hecnet-us-east-gw sshd[2393574]: Invalid user tom from 113.160.150.99 port 36702", "Oct 12 01:57:04 hecnet-us-east-gw sshd[2393574]: Failed password for invalid user tom from 113.160.150.99 port 36702 ssh2", "Oct 12 01:57:04 hecnet-us-east-gw sshd[2393574]: Disconnected from invalid user tom 113.160.150.99 port 36702 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2393574]: ", "ip4": "113.160.150.99", "users": "['tom']", "user": "tom"} 109.160.32.162 #sshd|1791773540|172800|1|{"matches": ["Oct 12 02:51:14 hecnet-us-east-gw sshd[2393969]: Failed none for invalid user from 109.160.32.162 port 42256 ssh2", "Oct 12 02:52:19 hecnet-us-east-gw sshd[2393973]: Connection from 109.160.32.162 port 36296 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 12 02:52:20 hecnet-us-east-gw sshd[2393973]: Invalid user asterisk from 109.160.32.162 port 36296"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2393969]: ", "ip4": "109.160.32.162", "user": ""} 191.96.196.114 #sshd|1791774193|172800|1|{"matches": ["Oct 12 03:03:09 hecnet-us-east-gw sshd[2394027]: User root from 191.96.196.114 not allowed because not listed in AllowUsers", "Oct 12 03:03:11 hecnet-us-east-gw sshd[2394027]: Failed password for invalid user root from 191.96.196.114 port 52950 ssh2", "Oct 12 03:03:13 hecnet-us-east-gw sshd[2394027]: Disconnected from invalid user root 191.96.196.114 port 52950 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2394027]: ", "ip4": "191.96.196.114", "users": "['root']", "user": "root"} 129.121.78.234 #sshd|1791774357|172800|1|{"matches": ["Oct 12 03:05:53 hecnet-us-east-gw sshd[2394091]: User root from 129.121.78.234 not allowed because not listed in AllowUsers", "Oct 12 03:05:55 hecnet-us-east-gw sshd[2394091]: Failed password for invalid user root from 129.121.78.234 port 43046 ssh2", "Oct 12 03:05:57 hecnet-us-east-gw sshd[2394091]: Disconnected from invalid user root 129.121.78.234 port 43046 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2394091]: ", "ip4": "129.121.78.234", "users": "['root']", "user": "root"} 2.57.122.74 #sshd|1791775852|172800|1|{"matches": ["Oct 12 03:30:47 hecnet-us-east-gw sshd[2394274]: User root from 2.57.122.74 not allowed because not listed in AllowUsers", "Oct 12 03:30:49 hecnet-us-east-gw sshd[2394274]: Failed none for invalid user root from 2.57.122.74 port 50844 ssh2", "Oct 12 03:30:52 hecnet-us-east-gw sshd[2394274]: Failed password for invalid user root from 2.57.122.74 port 50844 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2394274]: ", "ip4": "2.57.122.74", "users": "['root']", "user": "root"} 104.199.86.173 #sshd|1791779385|172800|1|{"matches": ["Oct 12 04:29:40 hecnet-us-east-gw sshd[2394688]: Invalid user admin from 104.199.86.173 port 54562", "Oct 12 04:29:42 hecnet-us-east-gw sshd[2394688]: Failed none for invalid user admin from 104.199.86.173 port 54562 ssh2", "Oct 12 04:29:45 hecnet-us-east-gw sshd[2394688]: Failed password for invalid user admin from 104.199.86.173 port 54562 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2394688]: ", "ip4": "104.199.86.173", "users": "['admin']", "user": "admin"} 35.205.235.226 #sshd|1791779440|172800|1|{"matches": ["Oct 12 04:30:40 hecnet-us-east-gw sshd[2394730]: Connection closed by 35.205.235.226 port 37240 [preauth]", "Oct 12 04:30:40 hecnet-us-east-gw sshd[2394732]: Connection from 35.205.235.226 port 37248 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 12 04:30:40 hecnet-us-east-gw sshd[2394732]: Unable to negotiate with 35.205.235.226 port 37248: no matching host key type found. Their offer: ecdsa-sha2-nistp256 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2394728]: ", "ip4": "35.205.235.226"} 109.160.32.200 #sshd|1791782297|172800|1|{"matches": ["Oct 12 05:17:32 hecnet-us-east-gw sshd[2395051]: Failed none for invalid user from 109.160.32.200 port 33528 ssh2", "Oct 12 05:18:16 hecnet-us-east-gw sshd[2395054]: Connection from 109.160.32.200 port 38330 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 12 05:18:17 hecnet-us-east-gw sshd[2395054]: Invalid user student_04_b756bd0db022 from 109.160.32.200 port 38330"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2395051]: ", "ip4": "109.160.32.200", "user": ""} 5.88.119.21 #sshd|1791782803|172800|1|{"matches": ["Oct 12 05:26:41 hecnet-us-east-gw sshd[2395120]: Invalid user ubuntu from 5.88.119.21 port 59920", "Oct 12 05:26:43 hecnet-us-east-gw sshd[2395120]: Failed password for invalid user ubuntu from 5.88.119.21 port 59920 ssh2", "Oct 12 05:26:43 hecnet-us-east-gw sshd[2395120]: Disconnected from invalid user ubuntu 5.88.119.21 port 59920 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2395120]: ", "ip4": "5.88.119.21", "users": "['ubuntu']", "user": "ubuntu"} 222.220.102.32 #sshd|1791783051|172800|1|{"matches": ["Oct 12 05:22:03 hecnet-us-east-gw sshd[2395084]: Failed password for invalid user root from 222.220.102.32 port 57228 ssh2", "Oct 12 05:30:50 hecnet-us-east-gw sshd[2395165]: Connection from 222.220.102.32 port 60524 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 12 05:30:51 hecnet-us-east-gw sshd[2395165]: Invalid user 1111 from 222.220.102.32 port 60524"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2395084]: ", "ip4": "222.220.102.32", "users": "['root']", "user": "root"} 187.212.59.26 #sshd|1791786159|172800|1|{"matches": ["Oct 12 06:22:35 hecnet-us-east-gw sshd[2395514]: User root from 187.212.59.26 not allowed because not listed in AllowUsers", "Oct 12 06:22:38 hecnet-us-east-gw sshd[2395514]: Failed password for invalid user root from 187.212.59.26 port 43934 ssh2", "Oct 12 06:22:39 hecnet-us-east-gw sshd[2395514]: Disconnected from invalid user root 187.212.59.26 port 43934 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2395514]: ", "ip4": "187.212.59.26", "users": "['root']", "user": "root"} 174.138.12.72 #sshd|1791787436|172800|1|{"matches": ["Oct 12 06:43:53 hecnet-us-east-gw sshd[2395841]: Invalid user owner from 174.138.12.72 port 46260", "Oct 12 06:43:55 hecnet-us-east-gw sshd[2395841]: Failed password for invalid user owner from 174.138.12.72 port 46260 ssh2", "Oct 12 06:43:56 hecnet-us-east-gw sshd[2395841]: Disconnected from invalid user owner 174.138.12.72 port 46260 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2395841]: ", "ip4": "174.138.12.72", "users": "['owner']", "user": "owner"} 203.83.231.93 #sshd|1791787607|172800|1|{"matches": ["Oct 12 06:46:44 hecnet-us-east-gw sshd[2395925]: Invalid user demo from 203.83.231.93 port 46066", "Oct 12 06:46:45 hecnet-us-east-gw sshd[2395925]: Failed password for invalid user demo from 203.83.231.93 port 46066 ssh2", "Oct 12 06:46:47 hecnet-us-east-gw sshd[2395925]: Disconnected from invalid user demo 203.83.231.93 port 46066 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2395925]: ", "ip4": "203.83.231.93", "users": "['demo']", "user": "demo"} 85.240.193.104 #sshd|1791787648|172800|1|{"matches": ["Oct 12 06:47:24 hecnet-us-east-gw sshd[2395950]: Invalid user erp from 85.240.193.104 port 54414", "Oct 12 06:47:27 hecnet-us-east-gw sshd[2395950]: Failed password for invalid user erp from 85.240.193.104 port 54414 ssh2", "Oct 12 06:47:28 hecnet-us-east-gw sshd[2395950]: Disconnected from invalid user erp 85.240.193.104 port 54414 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2395950]: ", "ip4": "85.240.193.104", "users": "['erp']", "user": "erp"} 129.121.141.3 #sshd|1791788604|172800|1|{"matches": ["Oct 12 07:03:20 hecnet-us-east-gw sshd[2396117]: User root from 129.121.141.3 not allowed because not listed in AllowUsers", "Oct 12 07:03:23 hecnet-us-east-gw sshd[2396117]: Failed password for invalid user root from 129.121.141.3 port 44396 ssh2", "Oct 12 07:03:24 hecnet-us-east-gw sshd[2396117]: Disconnected from invalid user root 129.121.141.3 port 44396 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2396117]: ", "ip4": "129.121.141.3", "users": "['root']", "user": "root"} 45.184.48.247 #sshd|1791790000|172800|1|{"matches": ["Oct 12 07:26:34 hecnet-us-east-gw sshd[2396359]: User root from 45.184.48.247 not allowed because not listed in AllowUsers", "Oct 12 07:26:37 hecnet-us-east-gw sshd[2396359]: Failed none for invalid user root from 45.184.48.247 port 47717 ssh2", "Oct 12 07:26:40 hecnet-us-east-gw sshd[2396359]: Failed password for invalid user root from 45.184.48.247 port 47717 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2396359]: ", "ip4": "45.184.48.247", "users": "['root']", "user": "root"} 60.170.197.78 #sshd|1791791028|172800|1|{"matches": ["Oct 12 07:43:42 hecnet-us-east-gw sshd[2396514]: User root from 60.170.197.78 not allowed because not listed in AllowUsers", "Oct 12 07:43:44 hecnet-us-east-gw sshd[2396514]: Failed none for invalid user root from 60.170.197.78 port 55350 ssh2", "Oct 12 07:43:48 hecnet-us-east-gw sshd[2396514]: Failed password for invalid user root from 60.170.197.78 port 55350 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2396514]: ", "ip4": "60.170.197.78", "users": "['root']", "user": "root"} 45.43.60.98 #sshd|1791796044|172800|1|{"matches": ["Oct 12 09:07:21 hecnet-us-east-gw sshd[2397133]: Invalid user admin from 45.43.60.98 port 37936", "Oct 12 09:07:23 hecnet-us-east-gw sshd[2397133]: Failed password for invalid user admin from 45.43.60.98 port 37936 ssh2", "Oct 12 09:07:24 hecnet-us-east-gw sshd[2397133]: Connection closed by invalid user admin 45.43.60.98 port 37936 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2397133]: ", "ip4": "45.43.60.98", "users": "['admin']", "user": "admin"} 77.90.185.20 #sshd|1791796250|172800|1|{"matches": ["Oct 12 09:10:43 hecnet-us-east-gw sshd[2397179]: User root from 77.90.185.20 not allowed because not listed in AllowUsers", "Oct 12 09:10:45 hecnet-us-east-gw sshd[2397179]: Failed none for invalid user root from 77.90.185.20 port 59556 ssh2", "Oct 12 09:10:50 hecnet-us-east-gw sshd[2397179]: Failed password for invalid user root from 77.90.185.20 port 59556 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2397179]: ", "ip4": "77.90.185.20", "users": "['root']", "user": "root"} 4.224.122.112 #lighttpd-scans|1791798559|172800|1|{"matches": [["", "Oct 12 09:49:16", " hecnet-us-east-gw lighttpd[1017]: 4.224.122.112 impvax.duckdns.org - [12/Oct/2026:09:49:15 +0000] \"GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1\" 404 341 \"-\" \"-\""], "Oct 12 09:49:16 hecnet-us-east-gw lighttpd[1017]: 4.224.122.112 impvax.duckdns.org - [12/Oct/2026:09:49:16 +0000] \"GET /this_is_a_new_hello_world.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 12 09:49:16 hecnet-us-east-gw lighttpd[1017]: 4.224.122.112 impvax.duckdns.org - [12/Oct/2026:09:49:16 +0000] \"GET /f5.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 12 09:49:17 hecnet-us-east-gw lighttpd[1017]: 4.224.122.112 impvax.duckdns.org - [12/Oct/2026:09:49:17 +0000] \"GET /3PJcpMFsD8B.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 12 09:49:17 hecnet-us-east-gw lighttpd[1017]: 4.224.122.112 impvax.duckdns.org - [12/Oct/2026:09:49:17 +0000] \"GET /z70.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 12 09:49:17 hecnet-us-east-gw lighttpd[1017]: 4.224.122.112 impvax.duckdns.org - [12/Oct/2026:09:49:17 +0000] \"GET /chosen.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 12 09:49:18 hecnet-us-east-gw lighttpd[1017]: 4.224.122.112 impvax.duckdns.org - [12/Oct/2026:09:49:18 +0000] \"GET /radio.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 12 09:49:19 hecnet-us-east-gw lighttpd[1017]: 4.224.122.112 impvax.duckdns.org - [12/Oct/2026:09:49:18 +0000] \"GET /wp_blog_footer.php HTTP/1.1\" 404 341 \"-\" \"-\""], "failures": 8, "ip4": "4.224.122.112"} 138.84.41.73 #sshd|1791802531|172800|1|{"matches": ["Oct 12 10:55:28 hecnet-us-east-gw sshd[2397921]: Invalid user newuser from 138.84.41.73 port 13756", "Oct 12 10:55:30 hecnet-us-east-gw sshd[2397921]: Failed password for invalid user newuser from 138.84.41.73 port 13756 ssh2", "Oct 12 10:55:31 hecnet-us-east-gw sshd[2397921]: Disconnected from invalid user newuser 138.84.41.73 port 13756 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2397921]: ", "ip4": "138.84.41.73", "users": "['newuser']", "user": "newuser"} 107.180.88.176 #sshd|1791802546|172800|1|{"matches": ["Oct 12 10:55:42 hecnet-us-east-gw sshd[2397947]: User root from 107.180.88.176 not allowed because not listed in AllowUsers", "Oct 12 10:55:45 hecnet-us-east-gw sshd[2397947]: Failed password for invalid user root from 107.180.88.176 port 43310 ssh2", "Oct 12 10:55:46 hecnet-us-east-gw sshd[2397947]: Disconnected from invalid user root 107.180.88.176 port 43310 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2397947]: ", "ip4": "107.180.88.176", "users": "['root']", "user": "root"} 41.93.82.201 #sshd|1791804412|172800|1|{"matches": ["Oct 12 11:26:50 hecnet-us-east-gw sshd[2398181]: User root from 41.93.82.201 not allowed because not listed in AllowUsers", "Oct 12 11:26:52 hecnet-us-east-gw sshd[2398181]: Failed password for invalid user root from 41.93.82.201 port 59630 ssh2", "Oct 12 11:26:52 hecnet-us-east-gw sshd[2398181]: Disconnected from invalid user root 41.93.82.201 port 59630 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2398181]: ", "ip4": "41.93.82.201", "users": "['root']", "user": "root"} 69.5.20.133 #sshd|1791806238|172800|1|{"matches": ["Oct 12 11:57:15 hecnet-us-east-gw sshd[2398387]: Invalid user newuser from 69.5.20.133 port 33158", "Oct 12 11:57:16 hecnet-us-east-gw sshd[2398387]: Failed password for invalid user newuser from 69.5.20.133 port 33158 ssh2", "Oct 12 11:57:18 hecnet-us-east-gw sshd[2398387]: Disconnected from invalid user newuser 69.5.20.133 port 33158 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2398387]: ", "ip4": "69.5.20.133", "users": "['newuser']", "user": "newuser"} 177.173.47.109 #sshd|1791806317|172800|1|{"matches": ["Oct 12 11:58:34 hecnet-us-east-gw sshd[2398412]: Invalid user zimblyeat from 177.173.47.109 port 19738", "Oct 12 11:58:36 hecnet-us-east-gw sshd[2398412]: Failed password for invalid user zimblyeat from 177.173.47.109 port 19738 ssh2", "Oct 12 11:58:37 hecnet-us-east-gw sshd[2398412]: Disconnected from invalid user zimblyeat 177.173.47.109 port 19738 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2398412]: ", "ip4": "177.173.47.109", "users": "['zimblyeat']", "user": "zimblyeat"} 71.27.86.44 #sshd|1791809106|172800|1|{"matches": ["Oct 12 12:45:03 hecnet-us-east-gw sshd[2398798]: Invalid user balu from 71.27.86.44 port 45709", "Oct 12 12:45:05 hecnet-us-east-gw sshd[2398798]: Failed password for invalid user balu from 71.27.86.44 port 45709 ssh2", "Oct 12 12:45:06 hecnet-us-east-gw sshd[2398798]: Disconnected from invalid user balu 71.27.86.44 port 45709 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2398798]: ", "ip4": "71.27.86.44", "users": "['balu']", "user": "balu"} 125.31.2.160 #sshd|1791809316|172800|1|{"matches": ["Oct 12 12:48:32 hecnet-us-east-gw sshd[2398853]: User root from 125.31.2.160 not allowed because not listed in AllowUsers", "Oct 12 12:48:34 hecnet-us-east-gw sshd[2398853]: Failed password for invalid user root from 125.31.2.160 port 36024 ssh2", "Oct 12 12:48:36 hecnet-us-east-gw sshd[2398853]: Disconnected from invalid user root 125.31.2.160 port 36024 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2398853]: ", "ip4": "125.31.2.160", "users": "['root']", "user": "root"} 103.123.53.88 #sshd|1791809683|172800|1|{"matches": ["Oct 12 12:54:41 hecnet-us-east-gw sshd[2398890]: Invalid user ubuntu from 103.123.53.88 port 44892", "Oct 12 12:54:43 hecnet-us-east-gw sshd[2398890]: Failed password for invalid user ubuntu from 103.123.53.88 port 44892 ssh2", "Oct 12 12:54:43 hecnet-us-east-gw sshd[2398890]: Disconnected from invalid user ubuntu 103.123.53.88 port 44892 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2398890]: ", "ip4": "103.123.53.88", "users": "['ubuntu']", "user": "ubuntu"} 40.83.95.41 #lighttpd-scans|1791810745|172800|1|{"matches": [["", "Oct 12 13:12:22", " hecnet-us-east-gw lighttpd[1017]: 40.83.95.41 impvax.duckdns.org - [12/Oct/2026:13:12:22 +0000] \"GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1\" 404 341 \"-\" \"-\""], "Oct 12 13:12:22 hecnet-us-east-gw lighttpd[1017]: 40.83.95.41 impvax.duckdns.org - [12/Oct/2026:13:12:22 +0000] \"GET /this_is_a_new_hello_world.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 12 13:12:23 hecnet-us-east-gw lighttpd[1017]: 40.83.95.41 impvax.duckdns.org - [12/Oct/2026:13:12:23 +0000] \"GET /gtc.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 12 13:12:23 hecnet-us-east-gw lighttpd[1017]: 40.83.95.41 impvax.duckdns.org - [12/Oct/2026:13:12:23 +0000] \"GET /simple.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 12 13:12:24 hecnet-us-east-gw lighttpd[1017]: 40.83.95.41 impvax.duckdns.org - [12/Oct/2026:13:12:24 +0000] \"GET /dairg.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 12 13:12:24 hecnet-us-east-gw lighttpd[1017]: 40.83.95.41 impvax.duckdns.org - [12/Oct/2026:13:12:24 +0000] \"GET /go.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 12 13:12:25 hecnet-us-east-gw lighttpd[1017]: 40.83.95.41 impvax.duckdns.org - [12/Oct/2026:13:12:25 +0000] \"GET /f35.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 12 13:12:25 hecnet-us-east-gw lighttpd[1017]: 40.83.95.41 impvax.duckdns.org - [12/Oct/2026:13:12:25 +0000] \"GET /ws.php HTTP/1.1\" 404 341 \"-\" \"-\""], "failures": 8, "ip4": "40.83.95.41"} 118.145.246.44 #sshd|1791818138|172800|1|{"matches": ["Oct 12 15:14:23 hecnet-us-east-gw sshd[2399935]: Failed password for invalid user root from 118.145.246.44 port 59052 ssh2", "Oct 12 15:15:36 hecnet-us-east-gw sshd[2399970]: Connection from 118.145.246.44 port 41038 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 12 15:15:38 hecnet-us-east-gw sshd[2399970]: Invalid user dong from 118.145.246.44 port 41038"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2399935]: ", "ip4": "118.145.246.44", "users": "['root']", "user": "root"} 192.9.228.120 #sshd|1791818253|172800|1|{"matches": ["Oct 12 15:17:30 hecnet-us-east-gw sshd[2400015]: Invalid user admin from 192.9.228.120 port 51798", "Oct 12 15:17:32 hecnet-us-east-gw sshd[2400015]: Failed password for invalid user admin from 192.9.228.120 port 51798 ssh2", "Oct 12 15:17:33 hecnet-us-east-gw sshd[2400015]: Disconnected from invalid user admin 192.9.228.120 port 51798 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2400015]: ", "ip4": "192.9.228.120", "users": "['admin']", "user": "admin"} 118.145.239.129 #sshd|1791818592|172800|1|{"matches": ["Oct 12 14:53:53 hecnet-us-east-gw sshd[2399799]: Failed password for invalid user aeropuerto from 118.145.239.129 port 49260 ssh2", "Oct 12 15:23:11 hecnet-us-east-gw sshd[2400053]: Connection from 118.145.239.129 port 40540 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 12 15:23:12 hecnet-us-east-gw sshd[2400053]: Invalid user subversion from 118.145.239.129 port 40540"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2399799]: ", "ip4": "118.145.239.129", "users": "['aeropuerto']", "user": "aeropuerto"} 187.103.105.17 #sshd|1791819237|172800|1|{"matches": ["Oct 12 15:33:54 hecnet-us-east-gw sshd[2400140]: Invalid user minecraft from 187.103.105.17 port 47144", "Oct 12 15:33:56 hecnet-us-east-gw sshd[2400140]: Failed password for invalid user minecraft from 187.103.105.17 port 47144 ssh2", "Oct 12 15:33:57 hecnet-us-east-gw sshd[2400140]: Disconnected from invalid user minecraft 187.103.105.17 port 47144 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2400140]: ", "ip4": "187.103.105.17", "users": "['minecraft']", "user": "minecraft"} 146.190.74.52 #sshd|1791820064|172800|1|{"matches": ["Oct 12 15:47:41 hecnet-us-east-gw sshd[2400301]: Invalid user admin from 146.190.74.52 port 38124", "Oct 12 15:47:43 hecnet-us-east-gw sshd[2400301]: Failed password for invalid user admin from 146.190.74.52 port 38124 ssh2", "Oct 12 15:47:44 hecnet-us-east-gw sshd[2400301]: Disconnected from invalid user admin 146.190.74.52 port 38124 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2400301]: ", "ip4": "146.190.74.52", "users": "['admin']", "user": "admin"} 117.50.70.169 #sshd|1791820225|172800|1|{"matches": ["Oct 12 15:27:09 hecnet-us-east-gw sshd[2400112]: Failed password for invalid user root from 117.50.70.169 port 13334 ssh2", "Oct 12 15:50:23 hecnet-us-east-gw sshd[2400331]: Connection from 117.50.70.169 port 18630 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 12 15:50:25 hecnet-us-east-gw sshd[2400331]: User root from 117.50.70.169 not allowed because not listed in AllowUsers"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2400112]: ", "ip4": "117.50.70.169", "users": "['root']", "user": "root"} 109.160.32.140 #sshd|1791825113|172800|1|{"matches": ["Oct 12 17:11:11 hecnet-us-east-gw sshd[2400885]: Failed none for invalid user from 109.160.32.140 port 54456 ssh2", "Oct 12 17:11:52 hecnet-us-east-gw sshd[2400897]: Connection from 109.160.32.140 port 33028 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 12 17:11:53 hecnet-us-east-gw sshd[2400897]: Invalid user r-config-06 from 109.160.32.140 port 33028"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2400885]: ", "ip4": "109.160.32.140", "user": ""} 62.60.130.242 #sshd|1791825539|172800|1|{"matches": ["Oct 12 17:18:55 hecnet-us-east-gw sshd[2400978]: User root from 62.60.130.242 not allowed because not listed in AllowUsers", "Oct 12 17:18:57 hecnet-us-east-gw sshd[2400978]: Failed none for invalid user root from 62.60.130.242 port 34464 ssh2", "Oct 12 17:18:59 hecnet-us-east-gw sshd[2400978]: Failed password for invalid user root from 62.60.130.242 port 34464 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2400978]: ", "ip4": "62.60.130.242", "users": "['root']", "user": "root"} 123.56.8.132 #sshd|1791827693|172800|1|{"matches": ["Oct 12 17:54:50 hecnet-us-east-gw sshd[2401221]: Failed none for invalid user root from 123.56.8.132 port 41462 ssh2", "Oct 12 17:54:53 hecnet-us-east-gw sshd[2401221]: Failed password for invalid user root from 123.56.8.132 port 41462 ssh2", "Oct 12 17:54:53 hecnet-us-east-gw sshd[2401221]: Connection closed by invalid user root 123.56.8.132 port 41462 [preauth]"], "failures": 4, "mlfid": " hecnet-us-east-gw sshd[2401221]: ", "ip4": "123.56.8.132", "users": "['root']", "user": "root"} 171.254.93.44 #sshd|1791830660|172800|1|{"matches": ["Oct 12 18:44:18 hecnet-us-east-gw sshd[2401566]: Invalid user tezos from 171.254.93.44 port 58586", "Oct 12 18:44:20 hecnet-us-east-gw sshd[2401566]: Failed password for invalid user tezos from 171.254.93.44 port 58586 ssh2", "Oct 12 18:44:20 hecnet-us-east-gw sshd[2401566]: Disconnected from invalid user tezos 171.254.93.44 port 58586 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2401566]: ", "ip4": "171.254.93.44", "users": "['tezos']", "user": "tezos"} 45.94.3.182 #sshd|1791834735|172800|1|{"matches": ["Oct 12 19:52:09 hecnet-us-east-gw sshd[2402056]: User root from 45.94.3.182 not allowed because not listed in AllowUsers", "Oct 12 19:52:11 hecnet-us-east-gw sshd[2402056]: Failed none for invalid user root from 45.94.3.182 port 27466 ssh2", "Oct 12 19:52:15 hecnet-us-east-gw sshd[2402056]: Failed password for invalid user root from 45.94.3.182 port 27466 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2402056]: ", "ip4": "45.94.3.182", "users": "['root']", "user": "root"} 78.44.192.210 #sshd|1791837177|172800|1|{"matches": ["Oct 12 20:32:55 hecnet-us-east-gw sshd[2402412]: Invalid user ubuntu from 78.44.192.210 port 50708", "Oct 12 20:32:57 hecnet-us-east-gw sshd[2402412]: Failed password for invalid user ubuntu from 78.44.192.210 port 50708 ssh2", "Oct 12 20:32:57 hecnet-us-east-gw sshd[2402412]: Disconnected from invalid user ubuntu 78.44.192.210 port 50708 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2402412]: ", "ip4": "78.44.192.210", "users": "['ubuntu']", "user": "ubuntu"} 117.50.44.85 #sshd|1791837321|172800|1|{"matches": ["Oct 12 20:30:20 hecnet-us-east-gw sshd[2402364]: Failed password for invalid user costel from 117.50.44.85 port 49634 ssh2", "Oct 12 20:35:20 hecnet-us-east-gw sshd[2402477]: Connection from 117.50.44.85 port 58462 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 12 20:35:21 hecnet-us-east-gw sshd[2402477]: Invalid user strapi from 117.50.44.85 port 58462"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2402364]: ", "ip4": "117.50.44.85", "users": "['costel']", "user": "costel"} 106.13.234.209 #sshd|1791837492|172800|1|{"matches": ["Oct 12 20:38:10 hecnet-us-east-gw sshd[2402506]: Invalid user buser from 106.13.234.209 port 51216", "Oct 12 20:38:12 hecnet-us-east-gw sshd[2402506]: Failed password for invalid user buser from 106.13.234.209 port 51216 ssh2", "Oct 12 20:38:12 hecnet-us-east-gw sshd[2402506]: Disconnected from invalid user buser 106.13.234.209 port 51216 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2402506]: ", "ip4": "106.13.234.209", "users": "['buser']", "user": "buser"} 195.178.110.227 #sshd|1791842949|172800|1|{"matches": ["Oct 12 22:09:05 hecnet-us-east-gw sshd[2403117]: User root from 195.178.110.227 not allowed because not listed in AllowUsers", "Oct 12 22:09:07 hecnet-us-east-gw sshd[2403117]: Failed none for invalid user root from 195.178.110.227 port 40402 ssh2", "Oct 12 22:09:09 hecnet-us-east-gw sshd[2403117]: Failed password for invalid user root from 195.178.110.227 port 40402 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2403117]: ", "ip4": "195.178.110.227", "users": "['root']", "user": "root"} 185.231.33.82 #sshd|1791844673|172800|1|{"matches": ["Oct 12 22:37:52 hecnet-us-east-gw sshd[2403374]: Unable to negotiate with 185.231.33.82 port 57246: no matching host key type found. Their offer: ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521 [preauth]", "Oct 12 22:37:52 hecnet-us-east-gw sshd[2403372]: Connection from 185.231.33.82 port 57250 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 12 22:37:53 hecnet-us-east-gw sshd[2403372]: Connection closed by 185.231.33.82 port 57250 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2403373]: ", "ip4": "185.231.33.82", "mlfforget": "Connection closed"} 20.197.26.190 #lighttpd-scans|1791844957|172800|1|{"matches": [["", "Oct 12 22:42:34", " hecnet-us-east-gw lighttpd[1017]: 20.197.26.190 impvax.duckdns.org - [12/Oct/2026:22:42:34 +0000] \"GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1\" 404 341 \"-\" \"-\""], "Oct 12 22:42:34 hecnet-us-east-gw lighttpd[1017]: 20.197.26.190 impvax.duckdns.org - [12/Oct/2026:22:42:34 +0000] \"GET /this_is_a_new_hello_world.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 12 22:42:35 hecnet-us-east-gw lighttpd[1017]: 20.197.26.190 impvax.duckdns.org - [12/Oct/2026:22:42:35 +0000] \"GET /init-notica.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 12 22:42:35 hecnet-us-east-gw lighttpd[1017]: 20.197.26.190 impvax.duckdns.org - [12/Oct/2026:22:42:35 +0000] \"GET /api.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 12 22:42:36 hecnet-us-east-gw lighttpd[1017]: 20.197.26.190 impvax.duckdns.org - [12/Oct/2026:22:42:36 +0000] \"GET /xex.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 12 22:42:36 hecnet-us-east-gw lighttpd[1017]: 20.197.26.190 impvax.duckdns.org - [12/Oct/2026:22:42:36 +0000] \"GET /fpwch.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 12 22:42:36 hecnet-us-east-gw lighttpd[1017]: 20.197.26.190 impvax.duckdns.org - [12/Oct/2026:22:42:36 +0000] \"GET /wp-filemannger4h.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 12 22:42:37 hecnet-us-east-gw lighttpd[1017]: 20.197.26.190 impvax.duckdns.org - [12/Oct/2026:22:42:37 +0000] \"GET /atomlib.php HTTP/1.1\" 404 341 \"-\" \"-\""], "failures": 8, "ip4": "20.197.26.190"} 211.251.245.88 #sshd|1791845087|172800|1|{"matches": ["Oct 12 22:44:42 hecnet-us-east-gw sshd[2403455]: Invalid user test from 211.251.245.88 port 34122", "Oct 12 22:44:45 hecnet-us-east-gw sshd[2403455]: Failed password for invalid user test from 211.251.245.88 port 34122 ssh2", "Oct 12 22:44:47 hecnet-us-east-gw sshd[2403455]: Disconnected from invalid user test 211.251.245.88 port 34122 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2403455]: ", "ip4": "211.251.245.88", "users": "['test']", "user": "test"} 123.58.215.196 #sshd|1791845273|172800|1|{"matches": ["Oct 12 22:47:50 hecnet-us-east-gw sshd[2403525]: Invalid user user1 from 123.58.215.196 port 24730", "Oct 12 22:47:52 hecnet-us-east-gw sshd[2403525]: Failed password for invalid user user1 from 123.58.215.196 port 24730 ssh2", "Oct 12 22:47:53 hecnet-us-east-gw sshd[2403525]: Disconnected from invalid user user1 123.58.215.196 port 24730 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2403525]: ", "ip4": "123.58.215.196", "users": "['user1']", "user": "user1"} 165.154.72.118 #sshd|1791845509|172800|1|{"matches": ["Oct 12 22:51:32 hecnet-us-east-gw sshd[2403556]: Failed none for invalid user from 165.154.72.118 port 53630 ssh2", "Oct 12 22:51:48 hecnet-us-east-gw sshd[2403559]: Connection from 165.154.72.118 port 16034 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 12 22:51:49 hecnet-us-east-gw sshd[2403559]: Invalid user from 165.154.72.118 port 16034"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2403556]: ", "ip4": "165.154.72.118", "user": ""} 31.56.21.230 #sshd|1791850321|172800|1|{"matches": ["Oct 13 00:11:57 hecnet-us-east-gw sshd[2404161]: User root from 31.56.21.230 not allowed because not listed in AllowUsers", "Oct 13 00:11:59 hecnet-us-east-gw sshd[2404161]: Failed none for invalid user root from 31.56.21.230 port 52404 ssh2", "Oct 13 00:12:01 hecnet-us-east-gw sshd[2404161]: Failed password for invalid user root from 31.56.21.230 port 52404 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2404161]: ", "ip4": "31.56.21.230", "users": "['root']", "user": "root"} 35.222.117.243 #sshd|1791850970|172800|1|{"matches": ["Oct 13 00:22:47 hecnet-us-east-gw sshd[2404248]: Invalid user alina from 35.222.117.243 port 36508", "Oct 13 00:22:48 hecnet-us-east-gw sshd[2404248]: Failed password for invalid user alina from 35.222.117.243 port 36508 ssh2", "Oct 13 00:22:50 hecnet-us-east-gw sshd[2404248]: Disconnected from invalid user alina 35.222.117.243 port 36508 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2404248]: ", "ip4": "35.222.117.243", "users": "['alina']", "user": "alina"} 156.236.66.15 #sshd|1791851048|172800|1|{"matches": ["Oct 13 00:24:04 hecnet-us-east-gw sshd[2404276]: User root from 156.236.66.15 not allowed because not listed in AllowUsers", "Oct 13 00:24:07 hecnet-us-east-gw sshd[2404276]: Failed password for invalid user root from 156.236.66.15 port 32954 ssh2", "Oct 13 00:24:08 hecnet-us-east-gw sshd[2404276]: Disconnected from invalid user root 156.236.66.15 port 32954 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2404276]: ", "ip4": "156.236.66.15", "users": "['root']", "user": "root"} 166.62.41.190 #sshd|1791853402|172800|1|{"matches": ["Oct 13 01:03:20 hecnet-us-east-gw sshd[2404564]: Invalid user mars from 166.62.41.190 port 44928", "Oct 13 01:03:22 hecnet-us-east-gw sshd[2404564]: Failed password for invalid user mars from 166.62.41.190 port 44928 ssh2", "Oct 13 01:03:22 hecnet-us-east-gw sshd[2404564]: Disconnected from invalid user mars 166.62.41.190 port 44928 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2404564]: ", "ip4": "166.62.41.190", "users": "['mars']", "user": "mars"} 172.105.128.12 #sshd|1791855599|172800|1|{"matches": ["Oct 13 01:39:58 hecnet-us-east-gw sshd[2404890]: Unable to negotiate with 172.105.128.12 port 44414: no matching host key type found. Their offer: ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521 [preauth]", "Oct 13 01:39:59 hecnet-us-east-gw sshd[2404892]: Connection from 172.105.128.12 port 44426 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 13 01:39:59 hecnet-us-east-gw sshd[2404892]: Connection closed by 172.105.128.12 port 44426 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2404888]: ", "ip4": "172.105.128.12", "mlfforget": "Connection closed"} 62.60.130.201 #sshd|1791856613|172800|1|{"matches": ["Oct 13 01:56:49 hecnet-us-east-gw sshd[2405012]: User root from 62.60.130.201 not allowed because not listed in AllowUsers", "Oct 13 01:56:51 hecnet-us-east-gw sshd[2405012]: Failed none for invalid user root from 62.60.130.201 port 5914 ssh2", "Oct 13 01:56:53 hecnet-us-east-gw sshd[2405012]: Failed password for invalid user root from 62.60.130.201 port 5914 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2405012]: ", "ip4": "62.60.130.201", "users": "['root']", "user": "root"} 190.129.122.185 #sshd|1791858516|172800|1|{"matches": ["Oct 13 02:28:34 hecnet-us-east-gw sshd[2405258]: Invalid user ming from 190.129.122.185 port 46272", "Oct 13 02:28:36 hecnet-us-east-gw sshd[2405258]: Failed password for invalid user ming from 190.129.122.185 port 46272 ssh2", "Oct 13 02:28:36 hecnet-us-east-gw sshd[2405258]: Disconnected from invalid user ming 190.129.122.185 port 46272 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2405258]: ", "ip4": "190.129.122.185", "users": "['ming']", "user": "ming"} 51.75.27.218 #sshd|1791858516|172800|1|{"matches": ["Oct 13 02:28:34 hecnet-us-east-gw sshd[2405260]: User root from 51.75.27.218 not allowed because not listed in AllowUsers", "Oct 13 02:28:36 hecnet-us-east-gw sshd[2405260]: Failed password for invalid user root from 51.75.27.218 port 51458 ssh2", "Oct 13 02:28:36 hecnet-us-east-gw sshd[2405260]: Disconnected from invalid user root 51.75.27.218 port 51458 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2405260]: ", "ip4": "51.75.27.218", "users": "['root']", "user": "root"} 172.191.132.202 #sshd|1791858648|172800|1|{"matches": ["Oct 13 02:30:44 hecnet-us-east-gw sshd[2405322]: Invalid user ts3 from 172.191.132.202 port 40890", "Oct 13 02:30:46 hecnet-us-east-gw sshd[2405322]: Failed password for invalid user ts3 from 172.191.132.202 port 40890 ssh2", "Oct 13 02:30:48 hecnet-us-east-gw sshd[2405322]: Disconnected from invalid user ts3 172.191.132.202 port 40890 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2405322]: ", "ip4": "172.191.132.202", "users": "['ts3']", "user": "ts3"} 51.195.40.26 #sshd|1791858719|172800|1|{"matches": ["Oct 13 02:31:57 hecnet-us-east-gw sshd[2405346]: User root from 51.195.40.26 not allowed because not listed in AllowUsers", "Oct 13 02:31:59 hecnet-us-east-gw sshd[2405346]: Failed password for invalid user root from 51.195.40.26 port 41042 ssh2", "Oct 13 02:31:59 hecnet-us-east-gw sshd[2405346]: Disconnected from invalid user root 51.195.40.26 port 41042 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2405346]: ", "ip4": "51.195.40.26", "users": "['root']", "user": "root"} 203.121.40.210 #sshd|1791858793|172800|1|{"matches": ["Oct 13 02:33:10 hecnet-us-east-gw sshd[2405370]: Invalid user test1 from 203.121.40.210 port 54023", "Oct 13 02:33:12 hecnet-us-east-gw sshd[2405370]: Failed password for invalid user test1 from 203.121.40.210 port 54023 ssh2", "Oct 13 02:33:13 hecnet-us-east-gw sshd[2405370]: Disconnected from invalid user test1 203.121.40.210 port 54023 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2405370]: ", "ip4": "203.121.40.210", "users": "['test1']", "user": "test1"} 120.48.41.163 #sshd|1791866396|172800|1|{"matches": ["Oct 13 04:36:34 hecnet-us-east-gw sshd[2406293]: Failed password for invalid user danish from 120.48.41.163 port 52806 ssh2", "Oct 13 04:39:54 hecnet-us-east-gw sshd[2406304]: Connection from 120.48.41.163 port 55128 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 13 04:39:56 hecnet-us-east-gw sshd[2406304]: Invalid user jinseok from 120.48.41.163 port 55128"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2406293]: ", "ip4": "120.48.41.163", "users": "['danish']", "user": "danish"} 35.187.98.144 #sshd|1791866858|172800|1|{"matches": ["Oct 13 04:47:33 hecnet-us-east-gw sshd[2406412]: Invalid user admin from 35.187.98.144 port 46400", "Oct 13 04:47:35 hecnet-us-east-gw sshd[2406412]: Failed none for invalid user admin from 35.187.98.144 port 46400 ssh2", "Oct 13 04:47:38 hecnet-us-east-gw sshd[2406412]: Failed password for invalid user admin from 35.187.98.144 port 46400 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2406412]: ", "ip4": "35.187.98.144", "users": "['admin']", "user": "admin"} 2.56.116.116 #sshd|1791867819|172800|1|{"matches": ["Oct 13 05:03:35 hecnet-us-east-gw sshd[2406493]: User root from 2.56.116.116 not allowed because not listed in AllowUsers", "Oct 13 05:03:37 hecnet-us-east-gw sshd[2406493]: Failed none for invalid user root from 2.56.116.116 port 49858 ssh2", "Oct 13 05:03:39 hecnet-us-east-gw sshd[2406493]: Failed password for invalid user root from 2.56.116.116 port 49858 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2406493]: ", "ip4": "2.56.116.116", "users": "['root']", "user": "root"} 36.213.97.117 #sshd|1791868346|172800|1|{"matches": ["Oct 13 05:12:20 hecnet-us-east-gw sshd[2406596]: User root from 36.213.97.117 not allowed because not listed in AllowUsers", "Oct 13 05:12:22 hecnet-us-east-gw sshd[2406596]: Failed none for invalid user root from 36.213.97.117 port 45304 ssh2", "Oct 13 05:12:26 hecnet-us-east-gw sshd[2406596]: Failed password for invalid user root from 36.213.97.117 port 45304 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2406596]: ", "ip4": "36.213.97.117", "users": "['root']", "user": "root"} 218.56.160.82 #sshd|1791868661|172800|1|{"matches": ["Oct 13 05:17:38 hecnet-us-east-gw sshd[2406672]: Invalid user olive from 218.56.160.82 port 42513", "Oct 13 05:17:40 hecnet-us-east-gw sshd[2406672]: Failed password for invalid user olive from 218.56.160.82 port 42513 ssh2", "Oct 13 05:17:41 hecnet-us-east-gw sshd[2406672]: Disconnected from invalid user olive 218.56.160.82 port 42513 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2406672]: ", "ip4": "218.56.160.82", "users": "['olive']", "user": "olive"} 111.30.42.43 #sshd|1791870152|172800|1|{"matches": ["Oct 13 05:38:49 hecnet-us-east-gw sshd[2406834]: Failed none for invalid user root from 111.30.42.43 port 54084 ssh2", "Oct 13 05:42:30 hecnet-us-east-gw sshd[2406869]: Connection from 111.30.42.43 port 44922 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 13 05:42:32 hecnet-us-east-gw sshd[2406869]: Invalid user ec2-user from 111.30.42.43 port 44922"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2406834]: ", "ip4": "111.30.42.43", "users": "['root']", "user": "root"} 109.160.32.136 #sshd|1791871648|172800|1|{"matches": ["Oct 13 06:06:45 hecnet-us-east-gw sshd[2407048]: Failed none for invalid user from 109.160.32.136 port 46202 ssh2", "Oct 13 06:07:26 hecnet-us-east-gw sshd[2407052]: Connection from 109.160.32.136 port 55940 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 13 06:07:28 hecnet-us-east-gw sshd[2407052]: Invalid user RB from 109.160.32.136 port 55940"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2407048]: ", "ip4": "109.160.32.136", "user": ""} 45.166.232.206 #sshd|1791873343|172800|1|{"matches": ["Oct 13 06:35:36 hecnet-us-east-gw sshd[2407449]: User root from 45.166.232.206 not allowed because not listed in AllowUsers", "Oct 13 06:35:39 hecnet-us-east-gw sshd[2407449]: Failed none for invalid user root from 45.166.232.206 port 54618 ssh2", "Oct 13 06:35:43 hecnet-us-east-gw sshd[2407449]: Failed password for invalid user root from 45.166.232.206 port 54618 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2407449]: ", "ip4": "45.166.232.206", "users": "['root']", "user": "root"} 1.238.106.229 #sshd|1791874672|172800|1|{"matches": ["Oct 13 06:57:48 hecnet-us-east-gw sshd[2407588]: Invalid user frontend from 1.238.106.229 port 55628", "Oct 13 06:57:50 hecnet-us-east-gw sshd[2407588]: Failed password for invalid user frontend from 1.238.106.229 port 55628 ssh2", "Oct 13 06:57:52 hecnet-us-east-gw sshd[2407588]: Disconnected from invalid user frontend 1.238.106.229 port 55628 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2407588]: ", "ip4": "1.238.106.229", "users": "['frontend']", "user": "frontend"} 202.165.25.206 #sshd|1791874786|172800|1|{"matches": ["Oct 13 06:59:41 hecnet-us-east-gw sshd[2407616]: Invalid user username from 202.165.25.206 port 59400", "Oct 13 06:59:44 hecnet-us-east-gw sshd[2407616]: Failed password for invalid user username from 202.165.25.206 port 59400 ssh2", "Oct 13 06:59:46 hecnet-us-east-gw sshd[2407616]: Disconnected from invalid user username 202.165.25.206 port 59400 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2407616]: ", "ip4": "202.165.25.206", "users": "['username']", "user": "username"} 181.234.162.177 #sshd|1791874964|172800|1|{"matches": ["Oct 13 07:02:42 hecnet-us-east-gw sshd[2407659]: Invalid user sysadmin from 181.234.162.177 port 53664", "Oct 13 07:02:44 hecnet-us-east-gw sshd[2407659]: Failed password for invalid user sysadmin from 181.234.162.177 port 53664 ssh2", "Oct 13 07:02:44 hecnet-us-east-gw sshd[2407659]: Disconnected from invalid user sysadmin 181.234.162.177 port 53664 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2407659]: ", "ip4": "181.234.162.177", "users": "['sysadmin']", "user": "sysadmin"} 223.233.81.43 #sshd|1791877382|172800|1|{"matches": ["Oct 13 07:42:58 hecnet-us-east-gw sshd[2408045]: Invalid user raj from 223.233.81.43 port 5725", "Oct 13 07:43:00 hecnet-us-east-gw sshd[2408045]: Failed password for invalid user raj from 223.233.81.43 port 5725 ssh2", "Oct 13 07:43:02 hecnet-us-east-gw sshd[2408045]: Disconnected from invalid user raj 223.233.81.43 port 5725 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2408045]: ", "ip4": "223.233.81.43", "users": "['raj']", "user": "raj"} 177.229.197.38 #sshd|1791879536|172800|1|{"matches": ["Oct 13 08:18:52 hecnet-us-east-gw sshd[2408356]: User root from 177.229.197.38 not allowed because not listed in AllowUsers", "Oct 13 08:18:54 hecnet-us-east-gw sshd[2408356]: Failed password for invalid user root from 177.229.197.38 port 37610 ssh2", "Oct 13 08:18:56 hecnet-us-east-gw sshd[2408356]: Disconnected from invalid user root 177.229.197.38 port 37610 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2408356]: ", "ip4": "177.229.197.38", "users": "['root']", "user": "root"} 121.14.34.219 #sshd|1791881940|172800|1|{"matches": ["Oct 13 08:58:58 hecnet-us-east-gw sshd[2408796]: User root from 121.14.34.219 not allowed because not listed in AllowUsers", "Oct 13 08:58:59 hecnet-us-east-gw sshd[2408796]: Failed password for invalid user root from 121.14.34.219 port 47648 ssh2", "Oct 13 08:59:00 hecnet-us-east-gw sshd[2408796]: Disconnected from invalid user root 121.14.34.219 port 47648 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2408796]: ", "ip4": "121.14.34.219", "users": "['root']", "user": "root"} 69.6.222.101 #sshd|1791882024|172800|1|{"matches": ["Oct 13 09:00:21 hecnet-us-east-gw sshd[2408834]: Invalid user admin from 69.6.222.101 port 55640", "Oct 13 09:00:23 hecnet-us-east-gw sshd[2408834]: Failed password for invalid user admin from 69.6.222.101 port 55640 ssh2", "Oct 13 09:00:24 hecnet-us-east-gw sshd[2408834]: Disconnected from invalid user admin 69.6.222.101 port 55640 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2408834]: ", "ip4": "69.6.222.101", "users": "['admin']", "user": "admin"} 109.160.32.123 #sshd|1791883411|172800|1|{"matches": ["Oct 13 09:22:03 hecnet-us-east-gw sshd[2409011]: Failed none for invalid user from 109.160.32.123 port 43982 ssh2", "Oct 13 09:23:29 hecnet-us-east-gw sshd[2409017]: Connection from 109.160.32.123 port 47446 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 13 09:23:31 hecnet-us-east-gw sshd[2409017]: Invalid user sachin from 109.160.32.123 port 47446"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2409011]: ", "ip4": "109.160.32.123", "user": ""} 20.194.96.223 #lighttpd-scans|1791884125|172800|1|{"matches": [["", "Oct 13 09:35:22", " hecnet-us-east-gw lighttpd[1017]: 20.194.96.223 hecnet-us-east-gw.duckdns.org - [13/Oct/2026:09:35:22 +0000] \"GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1\" 404 341 \"-\" \"-\""], "Oct 13 09:35:22 hecnet-us-east-gw lighttpd[1017]: 20.194.96.223 hecnet-us-east-gw.duckdns.org - [13/Oct/2026:09:35:22 +0000] \"GET /this_is_a_new_hello_world.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 13 09:35:23 hecnet-us-east-gw lighttpd[1017]: 20.194.96.223 hecnet-us-east-gw.duckdns.org - [13/Oct/2026:09:35:23 +0000] \"GET /init-notica.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 13 09:35:23 hecnet-us-east-gw lighttpd[1017]: 20.194.96.223 hecnet-us-east-gw.duckdns.org - [13/Oct/2026:09:35:23 +0000] \"GET /api.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 13 09:35:24 hecnet-us-east-gw lighttpd[1017]: 20.194.96.223 hecnet-us-east-gw.duckdns.org - [13/Oct/2026:09:35:24 +0000] \"GET /xex.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 13 09:35:24 hecnet-us-east-gw lighttpd[1017]: 20.194.96.223 hecnet-us-east-gw.duckdns.org - [13/Oct/2026:09:35:24 +0000] \"GET /tpg-contato.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 13 09:35:25 hecnet-us-east-gw lighttpd[1017]: 20.194.96.223 hecnet-us-east-gw.duckdns.org - [13/Oct/2026:09:35:25 +0000] \"GET /fpwch.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 13 09:35:25 hecnet-us-east-gw lighttpd[1017]: 20.194.96.223 hecnet-us-east-gw.duckdns.org - [13/Oct/2026:09:35:25 +0000] \"GET /wp-filemannger4h.php HTTP/1.1\" 404 341 \"-\" \"-\""], "failures": 8, "ip4": "20.194.96.223"} 92.118.39.49 #sshd|1791885810|172800|1|{"matches": ["Oct 13 10:03:26 hecnet-us-east-gw sshd[2409329]: User root from 92.118.39.49 not allowed because not listed in AllowUsers", "Oct 13 10:03:28 hecnet-us-east-gw sshd[2409329]: Failed none for invalid user root from 92.118.39.49 port 54200 ssh2", "Oct 13 10:03:30 hecnet-us-east-gw sshd[2409329]: Failed password for invalid user root from 92.118.39.49 port 54200 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2409329]: ", "ip4": "92.118.39.49", "users": "['root']", "user": "root"} 23.227.147.163 #sshd|1791888837|172800|1|{"matches": ["Oct 13 10:53:53 hecnet-us-east-gw sshd[2409718]: User root from 23.227.147.163 not allowed because not listed in AllowUsers", "Oct 13 10:53:55 hecnet-us-east-gw sshd[2409718]: Failed password for invalid user root from 23.227.147.163 port 36600 ssh2", "Oct 13 10:53:57 hecnet-us-east-gw sshd[2409718]: Disconnected from invalid user root 23.227.147.163 port 36600 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2409718]: ", "ip4": "23.227.147.163", "users": "['root']", "user": "root"} 129.121.115.10 #sshd|1791889146|172800|1|{"matches": ["Oct 13 10:59:02 hecnet-us-east-gw sshd[2409757]: Invalid user supplier from 129.121.115.10 port 37614", "Oct 13 10:59:04 hecnet-us-east-gw sshd[2409757]: Failed password for invalid user supplier from 129.121.115.10 port 37614 ssh2", "Oct 13 10:59:06 hecnet-us-east-gw sshd[2409757]: Disconnected from invalid user supplier 129.121.115.10 port 37614 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2409757]: ", "ip4": "129.121.115.10", "users": "['supplier']", "user": "supplier"} 181.214.147.38 #sshd|1791889833|172800|1|{"matches": ["Oct 13 11:10:29 hecnet-us-east-gw sshd[2409870]: User root from 181.214.147.38 not allowed because not listed in AllowUsers", "Oct 13 11:10:31 hecnet-us-east-gw sshd[2409870]: Failed none for invalid user root from 181.214.147.38 port 40396 ssh2", "Oct 13 11:10:33 hecnet-us-east-gw sshd[2409870]: Failed password for invalid user root from 181.214.147.38 port 40396 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2409870]: ", "ip4": "181.214.147.38", "users": "['root']", "user": "root"} 109.160.32.133 #sshd|1791890034|172800|1|{"matches": ["Oct 13 11:12:44 hecnet-us-east-gw sshd[2409904]: Failed none for invalid user from 109.160.32.133 port 34674 ssh2", "Oct 13 11:13:53 hecnet-us-east-gw sshd[2409912]: Connection from 109.160.32.133 port 41856 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 13 11:13:54 hecnet-us-east-gw sshd[2409912]: Invalid user nico from 109.160.32.133 port 41856"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2409904]: ", "ip4": "109.160.32.133", "user": ""} 187.212.33.78 #sshd|1791891622|172800|1|{"matches": ["Oct 13 11:40:18 hecnet-us-east-gw sshd[2410137]: User root from 187.212.33.78 not allowed because not listed in AllowUsers", "Oct 13 11:40:20 hecnet-us-east-gw sshd[2410137]: Failed password for invalid user root from 187.212.33.78 port 40336 ssh2", "Oct 13 11:40:22 hecnet-us-east-gw sshd[2410137]: Disconnected from invalid user root 187.212.33.78 port 40336 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2410137]: ", "ip4": "187.212.33.78", "users": "['root']", "user": "root"} 109.160.32.36 #sshd|1791892293|172800|1|{"matches": ["Oct 13 11:50:21 hecnet-us-east-gw sshd[2410268]: Failed none for invalid user from 109.160.32.36 port 41806 ssh2", "Oct 13 11:51:32 hecnet-us-east-gw sshd[2410274]: Connection from 109.160.32.36 port 58988 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 13 11:51:33 hecnet-us-east-gw sshd[2410274]: Invalid user uploader from 109.160.32.36 port 58988"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2410268]: ", "ip4": "109.160.32.36", "user": ""} 20.211.97.120 #lighttpd-scans|1791896724|172800|1|{"matches": [["", "Oct 13 13:05:22", " hecnet-us-east-gw lighttpd[1017]: 20.211.97.120 impvax.duckdns.org - [13/Oct/2026:13:05:22 +0000] \"GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1\" 404 341 \"-\" \"-\""], "Oct 13 13:05:22 hecnet-us-east-gw lighttpd[1017]: 20.211.97.120 impvax.duckdns.org - [13/Oct/2026:13:05:22 +0000] \"GET /this_is_a_new_hello_world.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 13 13:05:22 hecnet-us-east-gw lighttpd[1017]: 20.211.97.120 impvax.duckdns.org - [13/Oct/2026:13:05:22 +0000] \"GET /index/function.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 13 13:05:23 hecnet-us-east-gw lighttpd[1017]: 20.211.97.120 impvax.duckdns.org - [13/Oct/2026:13:05:23 +0000] \"GET /wp-trbacks.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 13 13:05:23 hecnet-us-east-gw lighttpd[1017]: 20.211.97.120 impvax.duckdns.org - [13/Oct/2026:13:05:23 +0000] \"GET /go.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 13 13:05:24 hecnet-us-east-gw lighttpd[1017]: 20.211.97.120 impvax.duckdns.org - [13/Oct/2026:13:05:23 +0000] \"GET /wp-fgban13jx3.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 13 13:05:24 hecnet-us-east-gw lighttpd[1017]: 20.211.97.120 impvax.duckdns.org - [13/Oct/2026:13:05:24 +0000] \"GET /1ac.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 13 13:05:24 hecnet-us-east-gw lighttpd[1017]: 20.211.97.120 impvax.duckdns.org - [13/Oct/2026:13:05:24 +0000] \"GET /flm.php HTTP/1.1\" 404 341 \"-\" \"-\""], "failures": 8, "ip4": "20.211.97.120"} 109.160.32.119 #sshd|1791897551|172800|1|{"matches": ["Oct 13 13:18:13 hecnet-us-east-gw sshd[2410960]: Failed none for invalid user from 109.160.32.119 port 50770 ssh2", "Oct 13 13:19:11 hecnet-us-east-gw sshd[2410965]: Connection from 109.160.32.119 port 53222 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 13 13:19:11 hecnet-us-east-gw sshd[2410965]: Invalid user webapp from 109.160.32.119 port 53222"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2410960]: ", "ip4": "109.160.32.119", "user": ""} 109.160.32.113 #sshd|1791902410|172800|1|{"matches": ["Oct 13 14:38:54 hecnet-us-east-gw sshd[2411576]: Failed none for invalid user from 109.160.32.113 port 55802 ssh2", "Oct 13 14:40:09 hecnet-us-east-gw sshd[2411596]: Connection from 109.160.32.113 port 42898 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 13 14:40:10 hecnet-us-east-gw sshd[2411596]: Invalid user riya from 109.160.32.113 port 42898"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2411576]: ", "ip4": "109.160.32.113", "user": ""} 124.116.23.182 #sshd|1791904015|172800|1|{"matches": ["Oct 13 15:06:53 hecnet-us-east-gw sshd[2411770]: User root from 124.116.23.182 not allowed because not listed in AllowUsers", "Oct 13 15:06:54 hecnet-us-east-gw sshd[2411770]: Failed password for invalid user root from 124.116.23.182 port 50878 ssh2", "Oct 13 15:06:55 hecnet-us-east-gw sshd[2411770]: Disconnected from invalid user root 124.116.23.182 port 50878 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2411770]: ", "ip4": "124.116.23.182", "users": "['root']", "user": "root"} 5.89.75.194 #sshd|1791905845|172800|1|{"matches": ["Oct 13 15:37:23 hecnet-us-east-gw sshd[2412009]: Invalid user Test from 5.89.75.194 port 50882", "Oct 13 15:37:24 hecnet-us-east-gw sshd[2412009]: Failed password for invalid user Test from 5.89.75.194 port 50882 ssh2", "Oct 13 15:37:25 hecnet-us-east-gw sshd[2412009]: Disconnected from invalid user Test 5.89.75.194 port 50882 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2412009]: ", "ip4": "5.89.75.194", "users": "['Test']", "user": "Test"} 109.160.32.175 #sshd|1791907025|172800|1|{"matches": ["Oct 13 15:56:08 hecnet-us-east-gw sshd[2412138]: Failed none for invalid user from 109.160.32.175 port 39586 ssh2", "Oct 13 15:57:03 hecnet-us-east-gw sshd[2412142]: Connection from 109.160.32.175 port 52602 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 13 15:57:05 hecnet-us-east-gw sshd[2412142]: Invalid user tony from 109.160.32.175 port 52602"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2412138]: ", "ip4": "109.160.32.175", "user": ""} 92.118.39.71 #sshd|1791907036|172800|1|{"matches": ["Oct 13 15:57:11 hecnet-us-east-gw sshd[2412166]: User root from 92.118.39.71 not allowed because not listed in AllowUsers", "Oct 13 15:57:13 hecnet-us-east-gw sshd[2412166]: Failed none for invalid user root from 92.118.39.71 port 48760 ssh2", "Oct 13 15:57:16 hecnet-us-east-gw sshd[2412166]: Failed password for invalid user root from 92.118.39.71 port 48760 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2412166]: ", "ip4": "92.118.39.71", "users": "['root']", "user": "root"} 54.38.52.18 #sshd|1791910836|172800|1|{"matches": ["Oct 13 17:00:34 hecnet-us-east-gw sshd[2412629]: User root from 54.38.52.18 not allowed because not listed in AllowUsers", "Oct 13 17:00:36 hecnet-us-east-gw sshd[2412629]: Failed password for invalid user root from 54.38.52.18 port 41982 ssh2", "Oct 13 17:00:36 hecnet-us-east-gw sshd[2412629]: Disconnected from invalid user root 54.38.52.18 port 41982 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2412629]: ", "ip4": "54.38.52.18", "users": "['root']", "user": "root"} 13.70.110.189 #lighttpd-scans|1791911808|172800|1|{"matches": [["", "Oct 13 17:16:45", " hecnet-us-east-gw lighttpd[1017]: 13.70.110.189 hecnet-us-east-gw.duckdns.org - [13/Oct/2026:17:16:45 +0000] \"GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1\" 404 341 \"-\" \"-\""], "Oct 13 17:16:46 hecnet-us-east-gw lighttpd[1017]: 13.70.110.189 hecnet-us-east-gw.duckdns.org - [13/Oct/2026:17:16:46 +0000] \"GET /this_is_a_new_hello_world.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 13 17:16:46 hecnet-us-east-gw lighttpd[1017]: 13.70.110.189 hecnet-us-east-gw.duckdns.org - [13/Oct/2026:17:16:46 +0000] \"GET /nakrip.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 13 17:16:47 hecnet-us-east-gw lighttpd[1017]: 13.70.110.189 hecnet-us-east-gw.duckdns.org - [13/Oct/2026:17:16:46 +0000] \"GET /gmo.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 13 17:16:47 hecnet-us-east-gw lighttpd[1017]: 13.70.110.189 hecnet-us-east-gw.duckdns.org - [13/Oct/2026:17:16:47 +0000] \"GET /c.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 13 17:16:47 hecnet-us-east-gw lighttpd[1017]: 13.70.110.189 hecnet-us-east-gw.duckdns.org - [13/Oct/2026:17:16:47 +0000] \"GET /file.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 13 17:16:48 hecnet-us-east-gw lighttpd[1017]: 13.70.110.189 hecnet-us-east-gw.duckdns.org - [13/Oct/2026:17:16:48 +0000] \"GET /wp-file.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 13 17:16:48 hecnet-us-east-gw lighttpd[1017]: 13.70.110.189 hecnet-us-east-gw.duckdns.org - [13/Oct/2026:17:16:48 +0000] \"GET /post.php HTTP/1.1\" 404 341 \"-\" \"-\""], "failures": 8, "ip4": "13.70.110.189"} 68.183.92.206 #sshd|1791913923|172800|1|{"matches": ["Oct 13 17:52:01 hecnet-us-east-gw sshd[2413027]: User root from 68.183.92.206 not allowed because not listed in AllowUsers", "Oct 13 17:52:02 hecnet-us-east-gw sshd[2413027]: Failed password for invalid user root from 68.183.92.206 port 40396 ssh2", "Oct 13 17:52:03 hecnet-us-east-gw sshd[2413027]: Disconnected from invalid user root 68.183.92.206 port 40396 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2413027]: ", "ip4": "68.183.92.206", "users": "['root']", "user": "root"} 95.220.218.204 #sshd|1791920613|172800|1|{"matches": ["Oct 13 19:43:28 hecnet-us-east-gw sshd[2413800]: Invalid user test2 from 95.220.218.204 port 44164", "Oct 13 19:43:30 hecnet-us-east-gw sshd[2413800]: Failed password for invalid user test2 from 95.220.218.204 port 44164 ssh2", "Oct 13 19:43:33 hecnet-us-east-gw sshd[2413800]: Failed password for invalid user test2 from 95.220.218.204 port 44164 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2413800]: ", "ip4": "95.220.218.204", "users": "['test2']", "user": "test2"} 172.236.228.202 #sshd|1791921438|172800|1|{"matches": ["Oct 13 19:57:17 hecnet-us-east-gw sshd[2413905]: Unable to negotiate with 172.236.228.202 port 10048: no matching host key type found. Their offer: ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521 [preauth]", "Oct 13 19:57:17 hecnet-us-east-gw sshd[2413907]: Connection from 172.236.228.202 port 10050 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 13 19:57:18 hecnet-us-east-gw sshd[2413907]: Connection closed by 172.236.228.202 port 10050 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2413903]: ", "ip4": "172.236.228.202", "mlfforget": "Connection closed"} 104.208.108.166 #sshd|1791928815|172800|1|{"matches": ["Oct 13 22:00:12 hecnet-us-east-gw sshd[2414848]: Invalid user alumno from 104.208.108.166 port 15986", "Oct 13 22:00:14 hecnet-us-east-gw sshd[2414848]: Failed password for invalid user alumno from 104.208.108.166 port 15986 ssh2", "Oct 13 22:00:15 hecnet-us-east-gw sshd[2414848]: Disconnected from invalid user alumno 104.208.108.166 port 15986 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2414848]: ", "ip4": "104.208.108.166", "users": "['alumno']", "user": "alumno"} 115.187.63.161 #sshd|1791930414|172800|1|{"matches": ["Oct 13 22:26:49 hecnet-us-east-gw sshd[2415086]: User root from 115.187.63.161 not allowed because not listed in AllowUsers", "Oct 13 22:26:51 hecnet-us-east-gw sshd[2415086]: Failed none for invalid user root from 115.187.63.161 port 63128 ssh2", "Oct 13 22:26:54 hecnet-us-east-gw sshd[2415086]: Failed password for invalid user root from 115.187.63.161 port 63128 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2415086]: ", "ip4": "115.187.63.161", "users": "['root']", "user": "root"} 117.250.95.43 #sshd|1791930431|172800|1|{"matches": ["Oct 13 22:27:04 hecnet-us-east-gw sshd[2415109]: User root from 117.250.95.43 not allowed because not listed in AllowUsers", "Oct 13 22:27:06 hecnet-us-east-gw sshd[2415109]: Failed none for invalid user root from 117.250.95.43 port 56087 ssh2", "Oct 13 22:27:11 hecnet-us-east-gw sshd[2415109]: Failed password for invalid user root from 117.250.95.43 port 56087 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2415109]: ", "ip4": "117.250.95.43", "users": "['root']", "user": "root"} 109.160.32.108 #sshd|1791930632|172800|1|{"matches": ["Oct 13 22:29:56 hecnet-us-east-gw sshd[2415140]: Failed none for invalid user from 109.160.32.108 port 48330 ssh2", "Oct 13 22:30:30 hecnet-us-east-gw sshd[2415157]: Connection from 109.160.32.108 port 37818 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 13 22:30:32 hecnet-us-east-gw sshd[2415157]: Invalid user boba_fett from 109.160.32.108 port 37818"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2415140]: ", "ip4": "109.160.32.108", "user": ""} 180.76.237.118 #sshd|1791931787|172800|1|{"matches": ["Oct 13 22:49:41 hecnet-us-east-gw sshd[2415326]: User root from 180.76.237.118 not allowed because not listed in AllowUsers", "Oct 13 22:49:43 hecnet-us-east-gw sshd[2415326]: Failed none for invalid user root from 180.76.237.118 port 39506 ssh2", "Oct 13 22:49:47 hecnet-us-east-gw sshd[2415326]: Failed password for invalid user root from 180.76.237.118 port 39506 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2415326]: ", "ip4": "180.76.237.118", "users": "['root']", "user": "root"} 119.96.131.8 #sshd|1791932568|172800|1|{"matches": ["Oct 13 23:02:44 hecnet-us-east-gw sshd[2415395]: User root from 119.96.131.8 not allowed because not listed in AllowUsers", "Oct 13 23:02:46 hecnet-us-east-gw sshd[2415395]: Failed password for invalid user root from 119.96.131.8 port 50504 ssh2", "Oct 13 23:02:48 hecnet-us-east-gw sshd[2415395]: Disconnected from invalid user root 119.96.131.8 port 50504 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2415395]: ", "ip4": "119.96.131.8", "users": "['root']", "user": "root"} 109.160.32.137 #sshd|1791933203|172800|1|{"matches": ["Oct 13 23:12:14 hecnet-us-east-gw sshd[2415521]: Failed none for invalid user from 109.160.32.137 port 49604 ssh2", "Oct 13 23:13:23 hecnet-us-east-gw sshd[2415529]: Connection from 109.160.32.137 port 44716 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 13 23:13:23 hecnet-us-east-gw sshd[2415529]: Invalid user candominds from 109.160.32.137 port 44716"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2415521]: ", "ip4": "109.160.32.137", "user": ""} 192.169.232.223 #sshd|1791937699|172800|1|{"matches": ["Oct 14 00:28:15 hecnet-us-east-gw sshd[2416050]: Invalid user developers from 192.169.232.223 port 48646", "Oct 14 00:28:18 hecnet-us-east-gw sshd[2416050]: Failed password for invalid user developers from 192.169.232.223 port 48646 ssh2", "Oct 14 00:28:19 hecnet-us-east-gw sshd[2416050]: Disconnected from invalid user developers 192.169.232.223 port 48646 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2416050]: ", "ip4": "192.169.232.223", "users": "['developers']", "user": "developers"} 103.168.135.187 #sshd|1791937721|172800|1|{"matches": ["Oct 14 00:28:38 hecnet-us-east-gw sshd[2416073]: Invalid user adminuser from 103.168.135.187 port 44050", "Oct 14 00:28:40 hecnet-us-east-gw sshd[2416073]: Failed password for invalid user adminuser from 103.168.135.187 port 44050 ssh2", "Oct 14 00:28:41 hecnet-us-east-gw sshd[2416073]: Disconnected from invalid user adminuser 103.168.135.187 port 44050 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2416073]: ", "ip4": "103.168.135.187", "users": "['adminuser']", "user": "adminuser"} 94.154.43.223 #sshd|1791942520|172800|1|{"matches": ["Oct 14 01:48:40 hecnet-us-east-gw sshd[2416655]: Invalid user admin from 94.154.43.223 port 33068", "Oct 14 01:48:39 hecnet-us-east-gw sshd[2416656]: Connection from 94.154.43.223 port 33044 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 14 01:48:40 hecnet-us-east-gw sshd[2416656]: User root from 94.154.43.223 not allowed because not listed in AllowUsers"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2416654]: ", "ip4": "94.154.43.223", "users": "['root']", "user": "root"} 94.154.43.223 #pam-generic|1791942520|172800|1|{"matches": [["", "Oct 14 01:48:40", " hecnet-us-east-gw sshd[2416654]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.154.43.223 user=root"], "Oct 14 01:48:40 hecnet-us-east-gw sshd[2416655]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.154.43.223 ", "Oct 14 01:48:40 hecnet-us-east-gw sshd[2416656]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.154.43.223 user=root"], "failures": 3, "alt_user": "", "ip4": "94.154.43.223", "user": "root"} 113.240.110.0 #sshd|1791943456|172800|1|{"matches": ["Oct 14 02:04:10 hecnet-us-east-gw sshd[2416764]: User root from 113.240.110.0 not allowed because not listed in AllowUsers", "Oct 14 02:04:12 hecnet-us-east-gw sshd[2416764]: Failed none for invalid user root from 113.240.110.0 port 56978 ssh2", "Oct 14 02:04:16 hecnet-us-east-gw sshd[2416764]: Failed password for invalid user root from 113.240.110.0 port 56978 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2416764]: ", "ip4": "113.240.110.0", "users": "['root']", "user": "root"} 201.17.133.138 #sshd|1791945101|172800|1|{"matches": ["Oct 14 02:31:39 hecnet-us-east-gw sshd[2416991]: Invalid user walter from 201.17.133.138 port 53674", "Oct 14 02:31:41 hecnet-us-east-gw sshd[2416991]: Failed password for invalid user walter from 201.17.133.138 port 53674 ssh2", "Oct 14 02:31:41 hecnet-us-east-gw sshd[2416991]: Disconnected from invalid user walter 201.17.133.138 port 53674 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2416991]: ", "ip4": "201.17.133.138", "users": "['walter']", "user": "walter"} 101.89.76.249 #sshd|1791945109|172800|1|{"matches": ["Oct 14 02:31:46 hecnet-us-east-gw sshd[2417014]: Invalid user jhernandez from 101.89.76.249 port 35896", "Oct 14 02:31:49 hecnet-us-east-gw sshd[2417014]: Failed password for invalid user jhernandez from 101.89.76.249 port 35896 ssh2", "Oct 14 02:31:49 hecnet-us-east-gw sshd[2417014]: Disconnected from invalid user jhernandez 101.89.76.249 port 35896 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2417014]: ", "ip4": "101.89.76.249", "users": "['jhernandez']", "user": "jhernandez"} 1.214.214.114 #sshd|1791945191|172800|1|{"matches": ["Oct 14 02:33:08 hecnet-us-east-gw sshd[2417041]: Invalid user yz from 1.214.214.114 port 58382", "Oct 14 02:33:10 hecnet-us-east-gw sshd[2417041]: Failed password for invalid user yz from 1.214.214.114 port 58382 ssh2", "Oct 14 02:33:11 hecnet-us-east-gw sshd[2417041]: Disconnected from invalid user yz 1.214.214.114 port 58382 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2417041]: ", "ip4": "1.214.214.114", "users": "['yz']", "user": "yz"} 43.156.33.17 #sshd|1791945410|172800|1|{"matches": ["Oct 14 02:36:47 hecnet-us-east-gw sshd[2417100]: Invalid user alex from 43.156.33.17 port 37756", "Oct 14 02:36:49 hecnet-us-east-gw sshd[2417100]: Failed password for invalid user alex from 43.156.33.17 port 37756 ssh2", "Oct 14 02:36:50 hecnet-us-east-gw sshd[2417100]: Disconnected from invalid user alex 43.156.33.17 port 37756 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2417100]: ", "ip4": "43.156.33.17", "users": "['alex']", "user": "alex"} 172.252.13.101 #sshd|1791948446|172800|1|{"matches": ["Oct 14 03:27:24 hecnet-us-east-gw sshd[2417456]: Invalid user esbuser from 172.252.13.101 port 47162", "Oct 14 03:27:26 hecnet-us-east-gw sshd[2417456]: Failed password for invalid user esbuser from 172.252.13.101 port 47162 ssh2", "Oct 14 03:27:26 hecnet-us-east-gw sshd[2417456]: Disconnected from invalid user esbuser 172.252.13.101 port 47162 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2417456]: ", "ip4": "172.252.13.101", "users": "['esbuser']", "user": "esbuser"} 34.77.18.172 #sshd|1791949201|172800|1|{"matches": ["Oct 14 03:39:56 hecnet-us-east-gw sshd[2417568]: Invalid user admin from 34.77.18.172 port 46970", "Oct 14 03:39:58 hecnet-us-east-gw sshd[2417568]: Failed none for invalid user admin from 34.77.18.172 port 46970 ssh2", "Oct 14 03:40:01 hecnet-us-east-gw sshd[2417568]: Failed password for invalid user admin from 34.77.18.172 port 46970 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2417568]: ", "ip4": "34.77.18.172", "users": "['admin']", "user": "admin"} 34.77.111.16 #sshd|1791949219|172800|1|{"matches": ["Oct 14 03:40:19 hecnet-us-east-gw sshd[2417612]: Connection closed by 34.77.111.16 port 47936 [preauth]", "Oct 14 03:40:19 hecnet-us-east-gw sshd[2417614]: Connection from 34.77.111.16 port 47944 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 14 03:40:19 hecnet-us-east-gw sshd[2417614]: Unable to negotiate with 34.77.111.16 port 47944: no matching host key type found. Their offer: ecdsa-sha2-nistp256 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2417610]: ", "ip4": "34.77.111.16"} 43.155.21.198 #sshd|1791951057|172800|1|{"matches": ["Oct 14 04:10:53 hecnet-us-east-gw sshd[2417829]: Invalid user gonzalo from 43.155.21.198 port 57484", "Oct 14 04:10:55 hecnet-us-east-gw sshd[2417829]: Failed password for invalid user gonzalo from 43.155.21.198 port 57484 ssh2", "Oct 14 04:10:57 hecnet-us-east-gw sshd[2417829]: Disconnected from invalid user gonzalo 43.155.21.198 port 57484 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2417829]: ", "ip4": "43.155.21.198", "users": "['gonzalo']", "user": "gonzalo"} 220.250.52.94 #sshd|1791952192|172800|1|{"matches": ["Oct 14 04:17:30 hecnet-us-east-gw sshd[2417940]: Failed password for invalid user root from 220.250.52.94 port 51616 ssh2", "Oct 14 04:29:45 hecnet-us-east-gw sshd[2418033]: Connection from 220.250.52.94 port 36810 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 14 04:29:52 hecnet-us-east-gw sshd[2418033]: Invalid user gitlab from 220.250.52.94 port 36810"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2417940]: ", "ip4": "220.250.52.94", "users": "['root']", "user": "root"} 129.226.202.180 #sshd|1791952939|172800|1|{"matches": ["Oct 14 04:42:14 hecnet-us-east-gw sshd[2418156]: User root from 129.226.202.180 not allowed because not listed in AllowUsers", "Oct 14 04:42:16 hecnet-us-east-gw sshd[2418156]: Failed password for invalid user root from 129.226.202.180 port 52168 ssh2", "Oct 14 04:42:19 hecnet-us-east-gw sshd[2418156]: Disconnected from invalid user root 129.226.202.180 port 52168 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2418156]: ", "ip4": "129.226.202.180", "users": "['root']", "user": "root"} 57.128.239.181 #sshd|1791953281|172800|1|{"matches": ["Oct 14 04:47:57 hecnet-us-east-gw sshd[2418230]: User root from 57.128.239.181 not allowed because not listed in AllowUsers", "Oct 14 04:47:59 hecnet-us-east-gw sshd[2418230]: Failed password for invalid user root from 57.128.239.181 port 58874 ssh2", "Oct 14 04:48:01 hecnet-us-east-gw sshd[2418230]: Disconnected from invalid user root 57.128.239.181 port 58874 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2418230]: ", "ip4": "57.128.239.181", "users": "['root']", "user": "root"} 147.50.231.135 #sshd|1791954962|172800|1|{"matches": ["Oct 14 05:15:59 hecnet-us-east-gw sshd[2418425]: Invalid user gbasedbt from 147.50.231.135 port 52462", "Oct 14 05:16:01 hecnet-us-east-gw sshd[2418425]: Failed password for invalid user gbasedbt from 147.50.231.135 port 52462 ssh2", "Oct 14 05:16:02 hecnet-us-east-gw sshd[2418425]: Disconnected from invalid user gbasedbt 147.50.231.135 port 52462 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2418425]: ", "ip4": "147.50.231.135", "users": "['gbasedbt']", "user": "gbasedbt"} 20.17.98.5 #sshd|1791955031|172800|1|{"matches": ["Oct 14 05:17:07 hecnet-us-east-gw sshd[2418452]: Invalid user college from 20.17.98.5 port 45638", "Oct 14 05:17:09 hecnet-us-east-gw sshd[2418452]: Failed password for invalid user college from 20.17.98.5 port 45638 ssh2", "Oct 14 05:17:11 hecnet-us-east-gw sshd[2418452]: Disconnected from invalid user college 20.17.98.5 port 45638 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2418452]: ", "ip4": "20.17.98.5", "users": "['college']", "user": "college"} 23.29.118.81 #sshd|1791955046|172800|1|{"matches": ["Oct 14 05:17:22 hecnet-us-east-gw sshd[2418474]: Invalid user docker from 23.29.118.81 port 38596", "Oct 14 05:17:25 hecnet-us-east-gw sshd[2418474]: Failed password for invalid user docker from 23.29.118.81 port 38596 ssh2", "Oct 14 05:17:26 hecnet-us-east-gw sshd[2418474]: Disconnected from invalid user docker 23.29.118.81 port 38596 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2418474]: ", "ip4": "23.29.118.81", "users": "['docker']", "user": "docker"} 49.204.74.149 #sshd|1791955055|172800|1|{"matches": ["Oct 14 05:17:31 hecnet-us-east-gw sshd[2418494]: Invalid user guest from 49.204.74.149 port 51668", "Oct 14 05:17:33 hecnet-us-east-gw sshd[2418494]: Failed password for invalid user guest from 49.204.74.149 port 51668 ssh2", "Oct 14 05:17:35 hecnet-us-east-gw sshd[2418494]: Disconnected from invalid user guest 49.204.74.149 port 51668 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2418494]: ", "ip4": "49.204.74.149", "users": "['guest']", "user": "guest"} 20.213.164.192 #lighttpd-scans|1791958212|172800|1|{"matches": [["", "Oct 14 06:10:03", " hecnet-us-east-gw lighttpd[1017]: 20.213.164.192 impvax.duckdns.org - [14/Oct/2026:06:10:03 +0000] \"GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1\" 404 341 \"-\" \"-\""], "Oct 14 06:10:04 hecnet-us-east-gw lighttpd[1017]: 20.213.164.192 impvax.duckdns.org - [14/Oct/2026:06:10:04 +0000] \"GET /this_is_a_new_hello_world.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 14 06:10:06 hecnet-us-east-gw lighttpd[1017]: 20.213.164.192 impvax.duckdns.org - [14/Oct/2026:06:10:06 +0000] \"GET /img.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 14 06:10:07 hecnet-us-east-gw lighttpd[1017]: 20.213.164.192 impvax.duckdns.org - [14/Oct/2026:06:10:07 +0000] \"GET /ioxi-o.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 14 06:10:09 hecnet-us-east-gw lighttpd[1017]: 20.213.164.192 impvax.duckdns.org - [14/Oct/2026:06:10:09 +0000] \"GET /xie.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 14 06:10:09 hecnet-us-east-gw lighttpd[1017]: 20.213.164.192 impvax.duckdns.org - [14/Oct/2026:06:10:09 +0000] \"GET /xty.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 14 06:10:10 hecnet-us-east-gw lighttpd[1017]: 20.213.164.192 impvax.duckdns.org - [14/Oct/2026:06:10:10 +0000] \"GET /kerang.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 14 06:10:12 hecnet-us-east-gw lighttpd[1017]: 20.213.164.192 impvax.duckdns.org - [14/Oct/2026:06:10:12 +0000] \"GET /srontol.php HTTP/1.1\" 404 341 \"-\" \"-\""], "failures": 8, "ip4": "20.213.164.192"} 118.99.103.66 #sshd|1791959317|172800|1|{"matches": ["Oct 14 06:28:35 hecnet-us-east-gw sshd[2419164]: User root from 118.99.103.66 not allowed because not listed in AllowUsers", "Oct 14 06:28:36 hecnet-us-east-gw sshd[2419164]: Failed password for invalid user root from 118.99.103.66 port 52888 ssh2", "Oct 14 06:28:37 hecnet-us-east-gw sshd[2419164]: Disconnected from invalid user root 118.99.103.66 port 52888 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2419164]: ", "ip4": "118.99.103.66", "users": "['root']", "user": "root"} 109.160.32.49 #sshd|1791961058|172800|1|{"matches": ["Oct 14 06:56:39 hecnet-us-east-gw sshd[2419415]: Failed none for invalid user from 109.160.32.49 port 36354 ssh2", "Oct 14 06:57:36 hecnet-us-east-gw sshd[2419420]: Connection from 109.160.32.49 port 44266 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 14 06:57:38 hecnet-us-east-gw sshd[2419420]: Invalid user Marton from 109.160.32.49 port 44266"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2419415]: ", "ip4": "109.160.32.49", "user": ""} 42.4.61.223 #sshd|1791962828|172800|1|{"matches": ["Oct 14 07:27:02 hecnet-us-east-gw sshd[2419658]: User root from 42.4.61.223 not allowed because not listed in AllowUsers", "Oct 14 07:27:04 hecnet-us-east-gw sshd[2419658]: Failed none for invalid user root from 42.4.61.223 port 55268 ssh2", "Oct 14 07:27:08 hecnet-us-east-gw sshd[2419658]: Failed password for invalid user root from 42.4.61.223 port 55268 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2419658]: ", "ip4": "42.4.61.223", "users": "['root']", "user": "root"} 125.16.27.190 #sshd|1791962840|172800|1|{"matches": ["Oct 14 07:27:17 hecnet-us-east-gw sshd[2419684]: Invalid user ido from 125.16.27.190 port 44058", "Oct 14 07:27:19 hecnet-us-east-gw sshd[2419684]: Failed password for invalid user ido from 125.16.27.190 port 44058 ssh2", "Oct 14 07:27:20 hecnet-us-east-gw sshd[2419684]: Disconnected from invalid user ido 125.16.27.190 port 44058 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2419684]: ", "ip4": "125.16.27.190", "users": "['ido']", "user": "ido"} 115.178.75.242 #sshd|1791965392|172800|1|{"matches": ["Oct 14 08:09:49 hecnet-us-east-gw sshd[2419954]: Invalid user sprixin from 115.178.75.242 port 41554", "Oct 14 08:09:52 hecnet-us-east-gw sshd[2419954]: Failed password for invalid user sprixin from 115.178.75.242 port 41554 ssh2", "Oct 14 08:09:52 hecnet-us-east-gw sshd[2419954]: Disconnected from invalid user sprixin 115.178.75.242 port 41554 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2419954]: ", "ip4": "115.178.75.242", "users": "['sprixin']", "user": "sprixin"} 197.248.207.139 #sshd|1791965570|172800|1|{"matches": ["Oct 14 08:12:48 hecnet-us-east-gw sshd[2420005]: Invalid user sprixin from 197.248.207.139 port 32762", "Oct 14 08:12:50 hecnet-us-east-gw sshd[2420005]: Failed password for invalid user sprixin from 197.248.207.139 port 32762 ssh2", "Oct 14 08:12:50 hecnet-us-east-gw sshd[2420005]: Disconnected from invalid user sprixin 197.248.207.139 port 32762 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2420005]: ", "ip4": "197.248.207.139", "users": "['sprixin']", "user": "sprixin"} 192.255.193.146 #sshd|1791965584|172800|1|{"matches": ["Oct 14 08:13:01 hecnet-us-east-gw sshd[2420030]: Invalid user ramesh from 192.255.193.146 port 35654", "Oct 14 08:13:02 hecnet-us-east-gw sshd[2420030]: Failed password for invalid user ramesh from 192.255.193.146 port 35654 ssh2", "Oct 14 08:13:04 hecnet-us-east-gw sshd[2420030]: Disconnected from invalid user ramesh 192.255.193.146 port 35654 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2420030]: ", "ip4": "192.255.193.146", "users": "['ramesh']", "user": "ramesh"} 180.93.172.213 #sshd|1791965657|172800|1|{"matches": ["Oct 14 08:14:13 hecnet-us-east-gw sshd[2420053]: User root from 180.93.172.213 not allowed because not listed in AllowUsers", "Oct 14 08:14:15 hecnet-us-east-gw sshd[2420053]: Failed password for invalid user root from 180.93.172.213 port 48420 ssh2", "Oct 14 08:14:17 hecnet-us-east-gw sshd[2420053]: Disconnected from invalid user root 180.93.172.213 port 48420 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2420053]: ", "ip4": "180.93.172.213", "users": "['root']", "user": "root"} 147.90.234.19 #sshd|1791967681|172800|1|{"matches": ["Oct 14 08:47:59 hecnet-us-east-gw sshd[2420329]: User root from 147.90.234.19 not allowed because not listed in AllowUsers", "Oct 14 08:48:01 hecnet-us-east-gw sshd[2420329]: Failed password for invalid user root from 147.90.234.19 port 39516 ssh2", "Oct 14 08:48:01 hecnet-us-east-gw sshd[2420329]: Disconnected from invalid user root 147.90.234.19 port 39516 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2420329]: ", "ip4": "147.90.234.19", "users": "['root']", "user": "root"} 121.229.25.10 #sshd|1791968305|172800|1|{"matches": ["Oct 14 08:58:19 hecnet-us-east-gw sshd[2420381]: Invalid user ryan from 121.229.25.10 port 57288", "Oct 14 08:58:21 hecnet-us-east-gw sshd[2420381]: Failed password for invalid user ryan from 121.229.25.10 port 57288 ssh2", "Oct 14 08:58:25 hecnet-us-east-gw sshd[2420381]: Disconnected from invalid user ryan 121.229.25.10 port 57288 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2420381]: ", "ip4": "121.229.25.10", "users": "['ryan']", "user": "ryan"} 164.30.17.82 #sshd|1791970294|172800|1|{"matches": ["Oct 14 09:31:29 hecnet-us-east-gw sshd[2420642]: Invalid user from 164.30.17.82 port 45036", "Oct 14 09:31:31 hecnet-us-east-gw sshd[2420642]: Failed none for invalid user from 164.30.17.82 port 45036 ssh2", "Oct 14 09:31:34 hecnet-us-east-gw sshd[2420642]: Failed password for invalid user from 164.30.17.82 port 45036 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2420642]: ", "ip4": "164.30.17.82", "user": ""} 220.168.118.133 #sshd|1791973022|172800|1|{"matches": ["Oct 14 10:16:58 hecnet-us-east-gw sshd[2420988]: User root from 220.168.118.133 not allowed because not listed in AllowUsers", "Oct 14 10:17:00 hecnet-us-east-gw sshd[2420988]: Failed none for invalid user root from 220.168.118.133 port 52388 ssh2", "Oct 14 10:17:02 hecnet-us-east-gw sshd[2420988]: Failed password for invalid user root from 220.168.118.133 port 52388 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2420988]: ", "ip4": "220.168.118.133", "users": "['root']", "user": "root"} 60.199.224.2 #sshd|1791974340|172800|1|{"matches": ["Oct 14 10:38:56 hecnet-us-east-gw sshd[2421141]: Invalid user postgres from 60.199.224.2 port 49038", "Oct 14 10:38:58 hecnet-us-east-gw sshd[2421141]: Failed password for invalid user postgres from 60.199.224.2 port 49038 ssh2", "Oct 14 10:39:00 hecnet-us-east-gw sshd[2421141]: Disconnected from invalid user postgres 60.199.224.2 port 49038 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2421141]: ", "ip4": "60.199.224.2", "users": "['postgres']", "user": "postgres"} 68.155.153.75 #lighttpd-scans|1791976363|172800|1|{"matches": [["", "Oct 14 11:12:43", " hecnet-us-east-gw lighttpd[1017]: 68.155.153.75 hecnet-us-east-gw.duckdns.org - [14/Oct/2026:11:12:42 +0000] \"GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1\" 404 341 \"-\" \"-\""], "Oct 14 11:12:43 hecnet-us-east-gw lighttpd[1017]: 68.155.153.75 hecnet-us-east-gw.duckdns.org - [14/Oct/2026:11:12:43 +0000] \"GET /this_is_a_new_hello_world.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 14 11:12:43 hecnet-us-east-gw lighttpd[1017]: 68.155.153.75 hecnet-us-east-gw.duckdns.org - [14/Oct/2026:11:12:43 +0000] \"GET /ws.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 14 11:12:43 hecnet-us-east-gw lighttpd[1017]: 68.155.153.75 hecnet-us-east-gw.duckdns.org - [14/Oct/2026:11:12:43 +0000] \"GET /bnmtp.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 14 11:12:43 hecnet-us-east-gw lighttpd[1017]: 68.155.153.75 hecnet-us-east-gw.duckdns.org - [14/Oct/2026:11:12:43 +0000] \"GET /date1.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 14 11:12:43 hecnet-us-east-gw lighttpd[1017]: 68.155.153.75 hecnet-us-east-gw.duckdns.org - [14/Oct/2026:11:12:43 +0000] \"GET /opsh.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 14 11:12:43 hecnet-us-east-gw lighttpd[1017]: 68.155.153.75 hecnet-us-east-gw.duckdns.org - [14/Oct/2026:11:12:43 +0000] \"GET /kgb.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 14 11:12:43 hecnet-us-east-gw lighttpd[1017]: 68.155.153.75 hecnet-us-east-gw.duckdns.org - [14/Oct/2026:11:12:43 +0000] \"GET /lu.php HTTP/1.1\" 404 341 \"-\" \"-\""], "failures": 8, "ip4": "68.155.153.75"} 70.54.182.130 #sshd|1791976954|172800|1|{"matches": ["Oct 14 11:22:31 hecnet-us-east-gw sshd[2421494]: Invalid user omni from 70.54.182.130 port 35910", "Oct 14 11:22:33 hecnet-us-east-gw sshd[2421494]: Failed password for invalid user omni from 70.54.182.130 port 35910 ssh2", "Oct 14 11:22:34 hecnet-us-east-gw sshd[2421494]: Disconnected from invalid user omni 70.54.182.130 port 35910 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2421494]: ", "ip4": "70.54.182.130", "users": "['omni']", "user": "omni"} 107.150.105.116 #sshd|1791976980|172800|1|{"matches": ["Oct 14 11:22:58 hecnet-us-east-gw sshd[2421518]: User root from 107.150.105.116 not allowed because not listed in AllowUsers", "Oct 14 11:22:59 hecnet-us-east-gw sshd[2421518]: Failed password for invalid user root from 107.150.105.116 port 58698 ssh2", "Oct 14 11:23:00 hecnet-us-east-gw sshd[2421518]: Disconnected from invalid user root 107.150.105.116 port 58698 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2421518]: ", "ip4": "107.150.105.116", "users": "['root']", "user": "root"} 69.6.234.27 #sshd|1791977029|172800|1|{"matches": ["Oct 14 11:23:47 hecnet-us-east-gw sshd[2421540]: User root from 69.6.234.27 not allowed because not listed in AllowUsers", "Oct 14 11:23:49 hecnet-us-east-gw sshd[2421540]: Failed password for invalid user root from 69.6.234.27 port 36356 ssh2", "Oct 14 11:23:49 hecnet-us-east-gw sshd[2421540]: Disconnected from invalid user root 69.6.234.27 port 36356 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2421540]: ", "ip4": "69.6.234.27", "users": "['root']", "user": "root"} 140.249.189.35 #sshd|1791977144|172800|1|{"matches": ["Oct 14 11:25:40 hecnet-us-east-gw sshd[2421589]: User root from 140.249.189.35 not allowed because not listed in AllowUsers", "Oct 14 11:25:42 hecnet-us-east-gw sshd[2421589]: Failed password for invalid user root from 140.249.189.35 port 48198 ssh2", "Oct 14 11:25:44 hecnet-us-east-gw sshd[2421589]: Disconnected from invalid user root 140.249.189.35 port 48198 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2421589]: ", "ip4": "140.249.189.35", "users": "['root']", "user": "root"} 119.96.174.235 #sshd|1791977219|172800|1|{"matches": ["Oct 14 11:26:54 hecnet-us-east-gw sshd[2421617]: User root from 119.96.174.235 not allowed because not listed in AllowUsers", "Oct 14 11:26:57 hecnet-us-east-gw sshd[2421617]: Failed password for invalid user root from 119.96.174.235 port 38186 ssh2", "Oct 14 11:26:59 hecnet-us-east-gw sshd[2421617]: Disconnected from invalid user root 119.96.174.235 port 38186 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2421617]: ", "ip4": "119.96.174.235", "users": "['root']", "user": "root"} 129.121.142.45 #sshd|1791977343|172800|1|{"matches": ["Oct 14 11:29:01 hecnet-us-east-gw sshd[2421647]: Invalid user test from 129.121.142.45 port 40376", "Oct 14 11:29:03 hecnet-us-east-gw sshd[2421647]: Failed password for invalid user test from 129.121.142.45 port 40376 ssh2", "Oct 14 11:29:03 hecnet-us-east-gw sshd[2421647]: Disconnected from invalid user test 129.121.142.45 port 40376 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2421647]: ", "ip4": "129.121.142.45", "users": "['test']", "user": "test"} 43.134.85.158 #sshd|1791977414|172800|1|{"matches": ["Oct 14 11:30:09 hecnet-us-east-gw sshd[2421686]: User root from 43.134.85.158 not allowed because not listed in AllowUsers", "Oct 14 11:30:11 hecnet-us-east-gw sshd[2421686]: Failed password for invalid user root from 43.134.85.158 port 41658 ssh2", "Oct 14 11:30:14 hecnet-us-east-gw sshd[2421686]: Disconnected from invalid user root 43.134.85.158 port 41658 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2421686]: ", "ip4": "43.134.85.158", "users": "['root']", "user": "root"} 42.51.40.180 #sshd|1791977493|172800|1|{"matches": ["Oct 14 11:31:30 hecnet-us-east-gw sshd[2421711]: Invalid user pierre from 42.51.40.180 port 54270", "Oct 14 11:31:32 hecnet-us-east-gw sshd[2421711]: Failed password for invalid user pierre from 42.51.40.180 port 54270 ssh2", "Oct 14 11:31:33 hecnet-us-east-gw sshd[2421711]: Disconnected from invalid user pierre 42.51.40.180 port 54270 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2421711]: ", "ip4": "42.51.40.180", "users": "['pierre']", "user": "pierre"} 182.253.79.194 #sshd|1791977518|172800|1|{"matches": ["Oct 14 11:31:54 hecnet-us-east-gw sshd[2421733]: Invalid user dns from 182.253.79.194 port 46459", "Oct 14 11:31:56 hecnet-us-east-gw sshd[2421733]: Failed password for invalid user dns from 182.253.79.194 port 46459 ssh2", "Oct 14 11:31:58 hecnet-us-east-gw sshd[2421733]: Disconnected from invalid user dns 182.253.79.194 port 46459 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2421733]: ", "ip4": "182.253.79.194", "users": "['dns']", "user": "dns"} 20.193.232.54 #lighttpd-scans|1791983107|172800|1|{"matches": [["", "Oct 14 13:05:04", " hecnet-us-east-gw lighttpd[1017]: 20.193.232.54 impvax.duckdns.org - [14/Oct/2026:13:05:03 +0000] \"GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1\" 404 341 \"-\" \"-\""], "Oct 14 13:05:04 hecnet-us-east-gw lighttpd[1017]: 20.193.232.54 impvax.duckdns.org - [14/Oct/2026:13:05:04 +0000] \"GET /this_is_a_new_hello_world.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 14 13:05:04 hecnet-us-east-gw lighttpd[1017]: 20.193.232.54 impvax.duckdns.org - [14/Oct/2026:13:05:04 +0000] \"GET /index/function.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 14 13:05:05 hecnet-us-east-gw lighttpd[1017]: 20.193.232.54 impvax.duckdns.org - [14/Oct/2026:13:05:05 +0000] \"GET /wp-trbacks.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 14 13:05:05 hecnet-us-east-gw lighttpd[1017]: 20.193.232.54 impvax.duckdns.org - [14/Oct/2026:13:05:05 +0000] \"GET /go.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 14 13:05:06 hecnet-us-east-gw lighttpd[1017]: 20.193.232.54 impvax.duckdns.org - [14/Oct/2026:13:05:06 +0000] \"GET /wp-fgban13jx3.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 14 13:05:07 hecnet-us-east-gw lighttpd[1017]: 20.193.232.54 impvax.duckdns.org - [14/Oct/2026:13:05:07 +0000] \"GET /1ac.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 14 13:05:07 hecnet-us-east-gw lighttpd[1017]: 20.193.232.54 impvax.duckdns.org - [14/Oct/2026:13:05:07 +0000] \"GET /wp-sanita.php HTTP/1.1\" 404 341 \"-\" \"-\""], "failures": 8, "ip4": "20.193.232.54"} 109.160.32.154 #sshd|1791983623|172800|1|{"matches": ["Oct 14 13:12:31 hecnet-us-east-gw sshd[2422493]: Failed none for invalid user from 109.160.32.154 port 40836 ssh2", "Oct 14 13:13:42 hecnet-us-east-gw sshd[2422499]: Connection from 109.160.32.154 port 57204 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 14 13:13:43 hecnet-us-east-gw sshd[2422499]: Invalid user gl15 from 109.160.32.154 port 57204"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2422493]: ", "ip4": "109.160.32.154", "user": ""} 107.180.212.169 #sshd|1791984124|172800|1|{"matches": ["Oct 14 13:22:02 hecnet-us-east-gw sshd[2422578]: User root from 107.180.212.169 not allowed because not listed in AllowUsers", "Oct 14 13:22:04 hecnet-us-east-gw sshd[2422578]: Failed password for invalid user root from 107.180.212.169 port 13345 ssh2", "Oct 14 13:22:04 hecnet-us-east-gw sshd[2422578]: Disconnected from invalid user root 107.180.212.169 port 13345 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2422578]: ", "ip4": "107.180.212.169", "users": "['root']", "user": "root"} 109.160.32.179 #sshd|1791987700|172800|1|{"matches": ["Oct 14 14:21:03 hecnet-us-east-gw sshd[2423014]: Failed none for invalid user from 109.160.32.179 port 45810 ssh2", "Oct 14 14:21:39 hecnet-us-east-gw sshd[2423018]: Connection from 109.160.32.179 port 33344 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 14 14:21:40 hecnet-us-east-gw sshd[2423018]: Invalid user kevindeg from 109.160.32.179 port 33344"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2423014]: ", "ip4": "109.160.32.179", "user": ""} 87.120.104.29 #lighttpd-scans|1791988486|172800|1|{"matches": [["", "Oct 14 14:34:45", " hecnet-us-east-gw lighttpd[1017]: 87.120.104.29 150.136.5.129 - [14/Oct/2026:14:34:45 +0000] \"GET /settings.php HTTP/1.1\" 404 341 \"-\" \"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\""], "Oct 14 14:34:45 hecnet-us-east-gw lighttpd[1017]: 87.120.104.29 150.136.5.129 - [14/Oct/2026:14:34:45 +0000] \"GET /config.php HTTP/1.1\" 404 341 \"-\" \"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\"", "Oct 14 14:34:45 hecnet-us-east-gw lighttpd[1017]: 87.120.104.29 150.136.5.129 - [14/Oct/2026:14:34:45 +0000] \"GET /configuration.php HTTP/1.1\" 404 341 \"-\" \"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\"", "Oct 14 14:34:45 hecnet-us-east-gw lighttpd[1017]: 87.120.104.29 150.136.5.129 - [14/Oct/2026:14:34:45 +0000] \"GET /config/app.php HTTP/1.1\" 404 341 \"-\" \"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\"", "Oct 14 14:34:45 hecnet-us-east-gw lighttpd[1017]: 87.120.104.29 150.136.5.129 - [14/Oct/2026:14:34:45 +0000] \"GET /config/database.php HTTP/1.1\" 404 341 \"-\" \"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\"", "Oct 14 14:34:45 hecnet-us-east-gw lighttpd[1017]: 87.120.104.29 150.136.5.129 - [14/Oct/2026:14:34:45 +0000] \"GET /wp-config.php HTTP/1.1\" 404 341 \"-\" \"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\"", "Oct 14 14:34:46 hecnet-us-east-gw lighttpd[1017]: 87.120.104.29 150.136.5.129 - [14/Oct/2026:14:34:46 +0000] \"GET /phpinfo.php HTTP/1.1\" 404 341 \"-\" \"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\"", "Oct 14 14:34:46 hecnet-us-east-gw lighttpd[1017]: 87.120.104.29 150.136.5.129 - [14/Oct/2026:14:34:46 +0000] \"GET /test.php HTTP/1.1\" 404 341 \"-\" \"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\""], "failures": 8, "ip4": "87.120.104.29"} 111.228.14.125 #sshd|1791988887|172800|1|{"matches": ["Oct 14 14:41:25 hecnet-us-east-gw sshd[2423219]: User root from 111.228.14.125 not allowed because not listed in AllowUsers", "Oct 14 14:41:27 hecnet-us-east-gw sshd[2423219]: Failed password for invalid user root from 111.228.14.125 port 60556 ssh2", "Oct 14 14:41:27 hecnet-us-east-gw sshd[2423219]: Disconnected from invalid user root 111.228.14.125 port 60556 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2423219]: ", "ip4": "111.228.14.125", "users": "['root']", "user": "root"} 80.94.92.179 #sshd|1791989137|172800|1|{"matches": ["Oct 14 14:45:32 hecnet-us-east-gw sshd[2423283]: User root from 80.94.92.179 not allowed because not listed in AllowUsers", "Oct 14 14:45:34 hecnet-us-east-gw sshd[2423283]: Failed none for invalid user root from 80.94.92.179 port 52500 ssh2", "Oct 14 14:45:37 hecnet-us-east-gw sshd[2423283]: Failed password for invalid user root from 80.94.92.179 port 52500 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2423283]: ", "ip4": "80.94.92.179", "users": "['root']", "user": "root"} 77.239.124.79 #sshd|1791990631|172800|1|{"matches": ["Oct 14 15:10:27 hecnet-us-east-gw sshd[2423438]: User root from 77.239.124.79 not allowed because not listed in AllowUsers", "Oct 14 15:10:28 hecnet-us-east-gw sshd[2423438]: Failed none for invalid user root from 77.239.124.79 port 26054 ssh2", "Oct 14 15:10:31 hecnet-us-east-gw sshd[2423438]: Failed password for invalid user root from 77.239.124.79 port 26054 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2423438]: ", "ip4": "77.239.124.79", "users": "['root']", "user": "root"} 41.128.181.199 #sshd|1791993181|172800|1|{"matches": ["Oct 14 15:52:57 hecnet-us-east-gw sshd[2423778]: Invalid user vnc from 41.128.181.199 port 33442", "Oct 14 15:53:00 hecnet-us-east-gw sshd[2423778]: Failed password for invalid user vnc from 41.128.181.199 port 33442 ssh2", "Oct 14 15:53:01 hecnet-us-east-gw sshd[2423778]: Disconnected from invalid user vnc 41.128.181.199 port 33442 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2423778]: ", "ip4": "41.128.181.199", "users": "['vnc']", "user": "vnc"} 103.132.243.250 #sshd|1791993549|172800|1|{"matches": ["Oct 14 15:59:06 hecnet-us-east-gw sshd[2423815]: Invalid user aramos from 103.132.243.250 port 51028", "Oct 14 15:59:08 hecnet-us-east-gw sshd[2423815]: Failed password for invalid user aramos from 103.132.243.250 port 51028 ssh2", "Oct 14 15:59:09 hecnet-us-east-gw sshd[2423815]: Disconnected from invalid user aramos 103.132.243.250 port 51028 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2423815]: ", "ip4": "103.132.243.250", "users": "['aramos']", "user": "aramos"} 109.160.32.116 #sshd|1791996055|172800|1|{"matches": ["Oct 14 16:40:07 hecnet-us-east-gw sshd[2424137]: Failed none for invalid user from 109.160.32.116 port 42858 ssh2", "Oct 14 16:40:53 hecnet-us-east-gw sshd[2424142]: Connection from 109.160.32.116 port 55130 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 14 16:40:55 hecnet-us-east-gw sshd[2424142]: Invalid user greedo from 109.160.32.116 port 55130"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2424137]: ", "ip4": "109.160.32.116", "user": ""} 144.22.238.238 #sshd|1791996101|172800|1|{"matches": ["Oct 14 16:41:37 hecnet-us-east-gw sshd[2424167]: User root from 144.22.238.238 not allowed because not listed in AllowUsers", "Oct 14 16:41:39 hecnet-us-east-gw sshd[2424167]: Failed password for invalid user root from 144.22.238.238 port 49164 ssh2", "Oct 14 16:41:41 hecnet-us-east-gw sshd[2424167]: Connection closed by invalid user root 144.22.238.238 port 49164 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2424167]: ", "ip4": "144.22.238.238", "users": "['root']", "user": "root"} 2.57.122.209 #sshd|1791997809|172800|1|{"matches": ["Oct 14 17:09:56 hecnet-us-east-gw sshd[2424357]: User root from 2.57.122.209 not allowed because not listed in AllowUsers", "Oct 14 17:09:58 hecnet-us-east-gw sshd[2424357]: Failed none for invalid user root from 2.57.122.209 port 36858 ssh2", "Oct 14 17:10:09 hecnet-us-east-gw sshd[2424357]: Failed password for invalid user root from 2.57.122.209 port 36858 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2424357]: ", "ip4": "2.57.122.209", "users": "['root']", "user": "root"} 154.92.17.128 #sshd|1791998299|172800|1|{"matches": ["Oct 14 17:18:16 hecnet-us-east-gw sshd[2424467]: Invalid user oracle from 154.92.17.128 port 45614", "Oct 14 17:18:18 hecnet-us-east-gw sshd[2424467]: Failed password for invalid user oracle from 154.92.17.128 port 45614 ssh2", "Oct 14 17:18:19 hecnet-us-east-gw sshd[2424467]: Disconnected from invalid user oracle 154.92.17.128 port 45614 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2424467]: ", "ip4": "154.92.17.128", "users": "['oracle']", "user": "oracle"} 203.6.227.164 #sshd|1791998417|172800|1|{"matches": ["Oct 14 17:20:14 hecnet-us-east-gw sshd[2424501]: Invalid user sdadmin from 203.6.227.164 port 35150", "Oct 14 17:20:16 hecnet-us-east-gw sshd[2424501]: Failed password for invalid user sdadmin from 203.6.227.164 port 35150 ssh2", "Oct 14 17:20:17 hecnet-us-east-gw sshd[2424501]: Disconnected from invalid user sdadmin 203.6.227.164 port 35150 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2424501]: ", "ip4": "203.6.227.164", "users": "['sdadmin']", "user": "sdadmin"} 217.156.122.137 #sshd|1791998520|172800|1|{"matches": ["Oct 14 17:21:55 hecnet-us-east-gw sshd[2424529]: User root from 217.156.122.137 not allowed because not listed in AllowUsers", "Oct 14 17:21:58 hecnet-us-east-gw sshd[2424529]: Failed password for invalid user root from 217.156.122.137 port 45410 ssh2", "Oct 14 17:22:00 hecnet-us-east-gw sshd[2424529]: Disconnected from invalid user root 217.156.122.137 port 45410 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2424529]: ", "ip4": "217.156.122.137", "users": "['root']", "user": "root"} 140.246.137.102 #sshd|1791998642|172800|1|{"matches": ["Oct 14 17:20:13 hecnet-us-east-gw sshd[2424499]: Failed password for invalid user root from 140.246.137.102 port 37814 ssh2", "Oct 14 17:24:01 hecnet-us-east-gw sshd[2424560]: Connection from 140.246.137.102 port 36830 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 14 17:24:02 hecnet-us-east-gw sshd[2424560]: User root from 140.246.137.102 not allowed because not listed in AllowUsers"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2424499]: ", "ip4": "140.246.137.102", "users": "['root']", "user": "root"} 45.140.192.23 #sshd|1792006497|172800|1|{"matches": ["Oct 14 19:34:54 hecnet-us-east-gw sshd[2425407]: Invalid user bitrix from 45.140.192.23 port 38762", "Oct 14 19:34:56 hecnet-us-east-gw sshd[2425407]: Failed password for invalid user bitrix from 45.140.192.23 port 38762 ssh2", "Oct 14 19:34:57 hecnet-us-east-gw sshd[2425407]: Disconnected from invalid user bitrix 45.140.192.23 port 38762 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2425407]: ", "ip4": "45.140.192.23", "users": "['bitrix']", "user": "bitrix"} 156.245.246.50 #sshd|1792006720|172800|1|{"matches": ["Oct 14 19:38:38 hecnet-us-east-gw sshd[2425471]: User root from 156.245.246.50 not allowed because not listed in AllowUsers", "Oct 14 19:38:40 hecnet-us-east-gw sshd[2425471]: Failed password for invalid user root from 156.245.246.50 port 51742 ssh2", "Oct 14 19:38:40 hecnet-us-east-gw sshd[2425471]: Disconnected from invalid user root 156.245.246.50 port 51742 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2425471]: ", "ip4": "156.245.246.50", "users": "['root']", "user": "root"} 27.0.135.6 #sshd|1792007109|172800|1|{"matches": ["Oct 14 19:44:51 hecnet-us-east-gw sshd[2425530]: Failed none for invalid user root from 27.0.135.6 port 36792 ssh2", "Oct 14 19:45:09 hecnet-us-east-gw sshd[2425553]: Connection from 27.0.135.6 port 55242 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 14 19:45:09 hecnet-us-east-gw sshd[2425553]: User root from 27.0.135.6 not allowed because not listed in AllowUsers"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2425530]: ", "ip4": "27.0.135.6", "users": "['root']", "user": "root"} 179.111.150.75 #sshd|1792007849|172800|1|{"matches": ["Oct 14 19:57:25 hecnet-us-east-gw sshd[2425626]: Invalid user teamspeak from 179.111.150.75 port 47372", "Oct 14 19:57:27 hecnet-us-east-gw sshd[2425626]: Failed password for invalid user teamspeak from 179.111.150.75 port 47372 ssh2", "Oct 14 19:57:29 hecnet-us-east-gw sshd[2425626]: Disconnected from invalid user teamspeak 179.111.150.75 port 47372 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2425626]: ", "ip4": "179.111.150.75", "users": "['teamspeak']", "user": "teamspeak"} 129.121.111.123 #sshd|1792010853|172800|1|{"matches": ["Oct 14 20:47:31 hecnet-us-east-gw sshd[2426034]: Invalid user umar from 129.121.111.123 port 43198", "Oct 14 20:47:32 hecnet-us-east-gw sshd[2426034]: Failed password for invalid user umar from 129.121.111.123 port 43198 ssh2", "Oct 14 20:47:33 hecnet-us-east-gw sshd[2426034]: Disconnected from invalid user umar 129.121.111.123 port 43198 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2426034]: ", "ip4": "129.121.111.123", "users": "['umar']", "user": "umar"} 109.160.32.151 #sshd|1792010894|172800|1|{"matches": ["Oct 14 20:47:14 hecnet-us-east-gw sshd[2426032]: Failed none for invalid user from 109.160.32.151 port 42698 ssh2", "Oct 14 20:48:13 hecnet-us-east-gw sshd[2426058]: Connection from 109.160.32.151 port 48236 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 14 20:48:14 hecnet-us-east-gw sshd[2426058]: Invalid user s10vincen from 109.160.32.151 port 48236"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2426032]: ", "ip4": "109.160.32.151", "user": ""} 180.184.182.87 #sshd|1792010966|172800|1|{"matches": ["Oct 14 20:49:23 hecnet-us-east-gw sshd[2426080]: Invalid user hao from 180.184.182.87 port 17186", "Oct 14 20:49:25 hecnet-us-east-gw sshd[2426080]: Failed password for invalid user hao from 180.184.182.87 port 17186 ssh2", "Oct 14 20:49:26 hecnet-us-east-gw sshd[2426080]: Disconnected from invalid user hao 180.184.182.87 port 17186 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2426080]: ", "ip4": "180.184.182.87", "users": "['hao']", "user": "hao"} 152.32.150.26 #sshd|1792010981|172800|1|{"matches": ["Oct 14 20:49:38 hecnet-us-east-gw sshd[2426103]: Invalid user mj from 152.32.150.26 port 57264", "Oct 14 20:49:40 hecnet-us-east-gw sshd[2426103]: Failed password for invalid user mj from 152.32.150.26 port 57264 ssh2", "Oct 14 20:49:41 hecnet-us-east-gw sshd[2426103]: Disconnected from invalid user mj 152.32.150.26 port 57264 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2426103]: ", "ip4": "152.32.150.26", "users": "['mj']", "user": "mj"} 182.48.80.240 #sshd|1792011022|172800|1|{"matches": ["Oct 14 20:50:18 hecnet-us-east-gw sshd[2426124]: User root from 182.48.80.240 not allowed because not listed in AllowUsers", "Oct 14 20:50:20 hecnet-us-east-gw sshd[2426124]: Failed password for invalid user root from 182.48.80.240 port 34082 ssh2", "Oct 14 20:50:22 hecnet-us-east-gw sshd[2426124]: Disconnected from invalid user root 182.48.80.240 port 34082 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2426124]: ", "ip4": "182.48.80.240", "users": "['root']", "user": "root"} 110.53.0.118 #sshd|1792011694|172800|1|{"matches": ["Oct 14 21:01:32 hecnet-us-east-gw sshd[2426185]: User root from 110.53.0.118 not allowed because not listed in AllowUsers", "Oct 14 21:01:33 hecnet-us-east-gw sshd[2426185]: Failed password for invalid user root from 110.53.0.118 port 22731 ssh2", "Oct 14 21:01:34 hecnet-us-east-gw sshd[2426185]: Disconnected from invalid user root 110.53.0.118 port 22731 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2426185]: ", "ip4": "110.53.0.118", "users": "['root']", "user": "root"} 121.242.232.147 #sshd|1792012156|172800|1|{"matches": ["Oct 14 21:09:14 hecnet-us-east-gw sshd[2426259]: User root from 121.242.232.147 not allowed because not listed in AllowUsers", "Oct 14 21:09:16 hecnet-us-east-gw sshd[2426259]: Failed password for invalid user root from 121.242.232.147 port 44122 ssh2", "Oct 14 21:09:16 hecnet-us-east-gw sshd[2426259]: Disconnected from invalid user root 121.242.232.147 port 44122 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2426259]: ", "ip4": "121.242.232.147", "users": "['root']", "user": "root"} 173.212.247.154 #sshd|1792012243|172800|1|{"matches": ["Oct 14 21:10:41 hecnet-us-east-gw sshd[2426301]: Invalid user syncuser from 173.212.247.154 port 57404", "Oct 14 21:10:43 hecnet-us-east-gw sshd[2426301]: Failed password for invalid user syncuser from 173.212.247.154 port 57404 ssh2", "Oct 14 21:10:43 hecnet-us-east-gw sshd[2426301]: Disconnected from invalid user syncuser 173.212.247.154 port 57404 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2426301]: ", "ip4": "173.212.247.154", "users": "['syncuser']", "user": "syncuser"} 20.200.211.114 #lighttpd-scans|1792013141|172800|1|{"matches": [["", "Oct 14 21:25:38", " hecnet-us-east-gw lighttpd[1017]: 20.200.211.114 impvax.duckdns.org - [14/Oct/2026:21:25:38 +0000] \"GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1\" 404 341 \"-\" \"-\""], "Oct 14 21:25:39 hecnet-us-east-gw lighttpd[1017]: 20.200.211.114 impvax.duckdns.org - [14/Oct/2026:21:25:39 +0000] \"GET /this_is_a_new_hello_world.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 14 21:25:39 hecnet-us-east-gw lighttpd[1017]: 20.200.211.114 impvax.duckdns.org - [14/Oct/2026:21:25:39 +0000] \"GET /3PJcpMFsD8B.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 14 21:25:39 hecnet-us-east-gw lighttpd[1017]: 20.200.211.114 impvax.duckdns.org - [14/Oct/2026:21:25:39 +0000] \"GET /z70.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 14 21:25:40 hecnet-us-east-gw lighttpd[1017]: 20.200.211.114 impvax.duckdns.org - [14/Oct/2026:21:25:40 +0000] \"GET /chosen.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 14 21:25:41 hecnet-us-east-gw lighttpd[1017]: 20.200.211.114 impvax.duckdns.org - [14/Oct/2026:21:25:40 +0000] \"GET /radio.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 14 21:25:41 hecnet-us-east-gw lighttpd[1017]: 20.200.211.114 impvax.duckdns.org - [14/Oct/2026:21:25:41 +0000] \"GET /wp_blog_footer.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 14 21:25:41 hecnet-us-east-gw lighttpd[1017]: 20.200.211.114 impvax.duckdns.org - [14/Oct/2026:21:25:41 +0000] \"GET /b8.php HTTP/1.1\" 404 341 \"-\" \"-\""], "failures": 8, "ip4": "20.200.211.114"} 45.148.10.152 #sshd|1792016888|172800|1|{"matches": ["Oct 14 22:28:04 hecnet-us-east-gw sshd[2426859]: User root from 45.148.10.152 not allowed because not listed in AllowUsers", "Oct 14 22:28:06 hecnet-us-east-gw sshd[2426859]: Failed none for invalid user root from 45.148.10.152 port 33112 ssh2", "Oct 14 22:28:08 hecnet-us-east-gw sshd[2426859]: Failed password for invalid user root from 45.148.10.152 port 33112 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2426859]: ", "ip4": "45.148.10.152", "users": "['root']", "user": "root"} 20.193.50.139 #lighttpd-scans|1792020281|172800|1|{"matches": [["", "Oct 14 23:24:37", " hecnet-us-east-gw lighttpd[1017]: 20.193.50.139 impvax.duckdns.org - [14/Oct/2026:23:24:37 +0000] \"GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1\" 404 341 \"-\" \"-\""], "Oct 14 23:24:38 hecnet-us-east-gw lighttpd[1017]: 20.193.50.139 impvax.duckdns.org - [14/Oct/2026:23:24:38 +0000] \"GET /this_is_a_new_hello_world.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 14 23:24:38 hecnet-us-east-gw lighttpd[1017]: 20.193.50.139 impvax.duckdns.org - [14/Oct/2026:23:24:38 +0000] \"GET /init-notica.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 14 23:24:39 hecnet-us-east-gw lighttpd[1017]: 20.193.50.139 impvax.duckdns.org - [14/Oct/2026:23:24:39 +0000] \"GET /api.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 14 23:24:39 hecnet-us-east-gw lighttpd[1017]: 20.193.50.139 impvax.duckdns.org - [14/Oct/2026:23:24:39 +0000] \"GET /xex.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 14 23:24:40 hecnet-us-east-gw lighttpd[1017]: 20.193.50.139 impvax.duckdns.org - [14/Oct/2026:23:24:40 +0000] \"GET /tpg-contato.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 14 23:24:40 hecnet-us-east-gw lighttpd[1017]: 20.193.50.139 impvax.duckdns.org - [14/Oct/2026:23:24:40 +0000] \"GET /fpwch.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 14 23:24:41 hecnet-us-east-gw lighttpd[1017]: 20.193.50.139 impvax.duckdns.org - [14/Oct/2026:23:24:41 +0000] \"GET /wp-filemannger4h.php HTTP/1.1\" 404 341 \"-\" \"-\""], "failures": 8, "ip4": "20.193.50.139"} 2.57.122.150 #sshd|1792022840|172800|1|{"matches": ["Oct 15 00:07:15 hecnet-us-east-gw sshd[2427573]: User root from 2.57.122.150 not allowed because not listed in AllowUsers", "Oct 15 00:07:17 hecnet-us-east-gw sshd[2427573]: Failed none for invalid user root from 2.57.122.150 port 59436 ssh2", "Oct 15 00:07:20 hecnet-us-east-gw sshd[2427573]: Failed password for invalid user root from 2.57.122.150 port 59436 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2427573]: ", "ip4": "2.57.122.150", "users": "['root']", "user": "root"} 123.25.97.130 #sshd|1792023464|172800|1|{"matches": ["Oct 15 00:17:42 hecnet-us-east-gw sshd[2427691]: User root from 123.25.97.130 not allowed because not listed in AllowUsers", "Oct 15 00:17:43 hecnet-us-east-gw sshd[2427691]: Failed password for invalid user root from 123.25.97.130 port 47666 ssh2", "Oct 15 00:17:44 hecnet-us-east-gw sshd[2427691]: Disconnected from invalid user root 123.25.97.130 port 47666 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2427691]: ", "ip4": "123.25.97.130", "users": "['root']", "user": "root"} 189.222.81.236 #sshd|1792024270|172800|1|{"matches": ["Oct 15 00:31:04 hecnet-us-east-gw sshd[2427803]: User root from 189.222.81.236 not allowed because not listed in AllowUsers", "Oct 15 00:31:07 hecnet-us-east-gw sshd[2427803]: Failed password for invalid user root from 189.222.81.236 port 39346 ssh2", "Oct 15 00:31:10 hecnet-us-east-gw sshd[2427803]: Failed password for invalid user root from 189.222.81.236 port 39346 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2427803]: ", "ip4": "189.222.81.236", "users": "['root']", "user": "root"} 20.194.17.163 #lighttpd-scans|1792024475|172800|1|{"matches": [["", "Oct 15 00:34:32", " hecnet-us-east-gw lighttpd[1017]: 20.194.17.163 impvax.duckdns.org - [15/Oct/2026:00:34:32 +0000] \"GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1\" 404 341 \"-\" \"-\""], "Oct 15 00:34:33 hecnet-us-east-gw lighttpd[1017]: 20.194.17.163 impvax.duckdns.org - [15/Oct/2026:00:34:33 +0000] \"GET /this_is_a_new_hello_world.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 15 00:34:33 hecnet-us-east-gw lighttpd[1017]: 20.194.17.163 impvax.duckdns.org - [15/Oct/2026:00:34:33 +0000] \"GET /index/function.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 15 00:34:33 hecnet-us-east-gw lighttpd[1017]: 20.194.17.163 impvax.duckdns.org - [15/Oct/2026:00:34:33 +0000] \"GET /wp-trbacks.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 15 00:34:34 hecnet-us-east-gw lighttpd[1017]: 20.194.17.163 impvax.duckdns.org - [15/Oct/2026:00:34:34 +0000] \"GET /go.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 15 00:34:34 hecnet-us-east-gw lighttpd[1017]: 20.194.17.163 impvax.duckdns.org - [15/Oct/2026:00:34:34 +0000] \"GET /wp-fgban13jx3.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 15 00:34:35 hecnet-us-east-gw lighttpd[1017]: 20.194.17.163 impvax.duckdns.org - [15/Oct/2026:00:34:34 +0000] \"GET /1ac.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 15 00:34:35 hecnet-us-east-gw lighttpd[1017]: 20.194.17.163 impvax.duckdns.org - [15/Oct/2026:00:34:35 +0000] \"GET /wp-sanita.php HTTP/1.1\" 404 341 \"-\" \"-\""], "failures": 8, "ip4": "20.194.17.163"} 3.101.142.10 #sshd|1792025182|172800|1|{"matches": ["Oct 15 00:46:21 hecnet-us-east-gw sshd[2427984]: Unable to negotiate with 3.101.142.10 port 48646: no matching host key type found. Their offer: ecdsa-sha2-nistp256,ecdsa-sha2-nistp256-cert-v01@openssh.com [preauth]", "Oct 15 00:46:21 hecnet-us-east-gw sshd[2427986]: Connection from 3.101.142.10 port 48652 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 15 00:46:22 hecnet-us-east-gw sshd[2427986]: Unable to negotiate with 3.101.142.10 port 48652: no matching host key type found. Their offer: ecdsa-sha2-nistp384,ecdsa-sha2-nistp384-cert-v01@openssh.com [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2427982]: ", "ip4": "3.101.142.10", "mlfforget": "Connection closed"} 66.175.208.166 #sshd|1792029290|172800|1|{"matches": ["Oct 15 01:54:50 hecnet-us-east-gw sshd[2428461]: Invalid user rigef from 66.175.208.166 port 12122", "Oct 15 01:54:50 hecnet-us-east-gw sshd[2428467]: Connection from 66.175.208.166 port 12190 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 15 01:54:50 hecnet-us-east-gw sshd[2428467]: Unable to negotiate with 66.175.208.166 port 12190: no matching host key type found. Their offer: ssh-dss [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2428462]: ", "ip4": "66.175.208.166"} 41.216.167.226 #sshd|1792031647|172800|1|{"matches": ["Oct 15 02:34:05 hecnet-us-east-gw sshd[2428796]: User root from 41.216.167.226 not allowed because not listed in AllowUsers", "Oct 15 02:34:06 hecnet-us-east-gw sshd[2428796]: Failed password for invalid user root from 41.216.167.226 port 58994 ssh2", "Oct 15 02:34:07 hecnet-us-east-gw sshd[2428796]: Disconnected from invalid user root 41.216.167.226 port 58994 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2428796]: ", "ip4": "41.216.167.226", "users": "['root']", "user": "root"} 121.184.65.150 #sshd|1792031807|172800|1|{"matches": ["Oct 15 02:36:43 hecnet-us-east-gw sshd[2428860]: Invalid user usuario from 121.184.65.150 port 45236", "Oct 15 02:36:45 hecnet-us-east-gw sshd[2428860]: Failed password for invalid user usuario from 121.184.65.150 port 45236 ssh2", "Oct 15 02:36:47 hecnet-us-east-gw sshd[2428860]: Failed password for invalid user usuario from 121.184.65.150 port 45236 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2428860]: ", "ip4": "121.184.65.150", "users": "['usuario']", "user": "usuario"} 149.34.48.31 #sshd|1792031940|172800|1|{"matches": ["Oct 15 02:38:58 hecnet-us-east-gw sshd[2428888]: Invalid user jhall from 149.34.48.31 port 55900", "Oct 15 02:39:00 hecnet-us-east-gw sshd[2428888]: Failed password for invalid user jhall from 149.34.48.31 port 55900 ssh2", "Oct 15 02:39:00 hecnet-us-east-gw sshd[2428888]: Disconnected from invalid user jhall 149.34.48.31 port 55900 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2428888]: ", "ip4": "149.34.48.31", "users": "['jhall']", "user": "jhall"} 34.52.244.24 #sshd|1792032050|172800|1|{"matches": ["Oct 15 02:40:45 hecnet-us-east-gw sshd[2428932]: Invalid user admin from 34.52.244.24 port 35058", "Oct 15 02:40:48 hecnet-us-east-gw sshd[2428932]: Failed none for invalid user admin from 34.52.244.24 port 35058 ssh2", "Oct 15 02:40:50 hecnet-us-east-gw sshd[2428932]: Failed password for invalid user admin from 34.52.244.24 port 35058 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2428932]: ", "ip4": "34.52.244.24", "users": "['admin']", "user": "admin"} 64.202.191.109 #sshd|1792032196|172800|1|{"matches": ["Oct 15 02:43:13 hecnet-us-east-gw sshd[2428967]: Invalid user fac from 64.202.191.109 port 45328", "Oct 15 02:43:15 hecnet-us-east-gw sshd[2428967]: Failed password for invalid user fac from 64.202.191.109 port 45328 ssh2", "Oct 15 02:43:16 hecnet-us-east-gw sshd[2428967]: Disconnected from invalid user fac 64.202.191.109 port 45328 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2428967]: ", "ip4": "64.202.191.109", "users": "['fac']", "user": "fac"} 34.156.207.13 #sshd|1792032266|172800|1|{"matches": ["Oct 15 02:44:24 hecnet-us-east-gw sshd[2428994]: Invalid user bhtch from 34.156.207.13 port 21428", "Oct 15 02:44:26 hecnet-us-east-gw sshd[2428994]: Failed none for invalid user bhtch from 34.156.207.13 port 21428 ssh2", "Oct 15 02:44:26 hecnet-us-east-gw sshd[2428994]: Connection closed by invalid user bhtch 34.156.207.13 port 21428 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2428994]: ", "ip4": "34.156.207.13", "users": "['bhtch']", "user": "bhtch"} 221.156.126.1 #sshd|1792034769|172800|1|{"matches": ["Oct 15 03:26:07 hecnet-us-east-gw sshd[2429290]: Invalid user user8 from 221.156.126.1 port 49620", "Oct 15 03:26:09 hecnet-us-east-gw sshd[2429290]: Failed password for invalid user user8 from 221.156.126.1 port 49620 ssh2", "Oct 15 03:26:09 hecnet-us-east-gw sshd[2429290]: Disconnected from invalid user user8 221.156.126.1 port 49620 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2429290]: ", "ip4": "221.156.126.1", "users": "['user8']", "user": "user8"} 129.121.103.78 #sshd|1792034949|172800|1|{"matches": ["Oct 15 03:29:05 hecnet-us-east-gw sshd[2429319]: User root from 129.121.103.78 not allowed because not listed in AllowUsers", "Oct 15 03:29:07 hecnet-us-east-gw sshd[2429319]: Failed password for invalid user root from 129.121.103.78 port 43630 ssh2", "Oct 15 03:29:09 hecnet-us-east-gw sshd[2429319]: Disconnected from invalid user root 129.121.103.78 port 43630 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2429319]: ", "ip4": "129.121.103.78", "users": "['root']", "user": "root"} 43.143.225.178 #sshd|1792035099|172800|1|{"matches": ["Oct 15 03:31:35 hecnet-us-east-gw sshd[2429419]: Invalid user ansadmin from 43.143.225.178 port 58272", "Oct 15 03:31:37 hecnet-us-east-gw sshd[2429419]: Failed none for invalid user ansadmin from 43.143.225.178 port 58272 ssh2", "Oct 15 03:31:39 hecnet-us-east-gw sshd[2429419]: Failed password for invalid user ansadmin from 43.143.225.178 port 58272 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2429419]: ", "ip4": "43.143.225.178", "users": "['ansadmin']", "user": "ansadmin"} 221.229.218.50 #sshd|1792035743|172800|1|{"matches": ["Oct 15 03:34:43 hecnet-us-east-gw sshd[2429450]: Failed password for invalid user system from 221.229.218.50 port 58575 ssh2", "Oct 15 03:42:22 hecnet-us-east-gw sshd[2429530]: Connection from 221.229.218.50 port 54634 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 15 03:42:23 hecnet-us-east-gw sshd[2429530]: User root from 221.229.218.50 not allowed because not listed in AllowUsers"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2429450]: ", "ip4": "221.229.218.50", "users": "['system']", "user": "system"} 223.15.242.225 #sshd|1792036087|172800|1|{"matches": ["Oct 15 03:48:03 hecnet-us-east-gw sshd[2429607]: User root from 223.15.242.225 not allowed because not listed in AllowUsers", "Oct 15 03:48:05 hecnet-us-east-gw sshd[2429607]: Failed password for invalid user root from 223.15.242.225 port 59952 ssh2", "Oct 15 03:48:07 hecnet-us-east-gw sshd[2429607]: Disconnected from invalid user root 223.15.242.225 port 59952 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2429607]: ", "ip4": "223.15.242.225", "users": "['root']", "user": "root"} 45.43.37.254 #sshd|1792040663|172800|1|{"matches": ["Oct 15 05:04:21 hecnet-us-east-gw sshd[2430100]: Invalid user admin from 45.43.37.254 port 61630", "Oct 15 05:04:22 hecnet-us-east-gw sshd[2430100]: Failed password for invalid user admin from 45.43.37.254 port 61630 ssh2", "Oct 15 05:04:23 hecnet-us-east-gw sshd[2430100]: Connection closed by invalid user admin 45.43.37.254 port 61630 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2430100]: ", "ip4": "45.43.37.254", "users": "['admin']", "user": "admin"} 45.148.10.151 #sshd|1792042705|172800|1|{"matches": ["Oct 15 05:38:20 hecnet-us-east-gw sshd[2430379]: User root from 45.148.10.151 not allowed because not listed in AllowUsers", "Oct 15 05:38:22 hecnet-us-east-gw sshd[2430379]: Failed none for invalid user root from 45.148.10.151 port 3134 ssh2", "Oct 15 05:38:25 hecnet-us-east-gw sshd[2430379]: Failed password for invalid user root from 45.148.10.151 port 3134 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2430379]: ", "ip4": "45.148.10.151", "users": "['root']", "user": "root"} 109.160.32.102 #sshd|1792043544|172800|1|{"matches": ["Oct 15 05:51:44 hecnet-us-east-gw sshd[2430496]: Failed none for invalid user from 109.160.32.102 port 40152 ssh2", "Oct 15 05:52:23 hecnet-us-east-gw sshd[2430499]: Connection from 109.160.32.102 port 53168 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 15 05:52:24 hecnet-us-east-gw sshd[2430499]: Invalid user test6 from 109.160.32.102 port 53168"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2430496]: ", "ip4": "109.160.32.102", "user": ""} 14.46.87.209 #sshd|1792043595|172800|1|{"matches": ["Oct 15 05:53:10 hecnet-us-east-gw sshd[2430525]: Invalid user ubuntu from 14.46.87.209 port 43020", "Oct 15 05:53:13 hecnet-us-east-gw sshd[2430525]: Failed password for invalid user ubuntu from 14.46.87.209 port 43020 ssh2", "Oct 15 05:53:15 hecnet-us-east-gw sshd[2430525]: Disconnected from invalid user ubuntu 14.46.87.209 port 43020 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2430525]: ", "ip4": "14.46.87.209", "users": "['ubuntu']", "user": "ubuntu"} 172.191.239.155 #sshd|1792043617|172800|1|{"matches": ["Oct 15 05:53:35 hecnet-us-east-gw sshd[2430545]: Invalid user sammy from 172.191.239.155 port 53812", "Oct 15 05:53:37 hecnet-us-east-gw sshd[2430545]: Failed password for invalid user sammy from 172.191.239.155 port 53812 ssh2", "Oct 15 05:53:37 hecnet-us-east-gw sshd[2430545]: Disconnected from invalid user sammy 172.191.239.155 port 53812 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2430545]: ", "ip4": "172.191.239.155", "users": "['sammy']", "user": "sammy"} 157.245.244.221 #sshd|1792043737|172800|1|{"matches": ["Oct 15 05:55:34 hecnet-us-east-gw sshd[2430571]: Invalid user sshuser from 157.245.244.221 port 41132", "Oct 15 05:55:37 hecnet-us-east-gw sshd[2430571]: Failed password for invalid user sshuser from 157.245.244.221 port 41132 ssh2", "Oct 15 05:55:37 hecnet-us-east-gw sshd[2430571]: Disconnected from invalid user sshuser 157.245.244.221 port 41132 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2430571]: ", "ip4": "157.245.244.221", "users": "['sshuser']", "user": "sshuser"} 221.162.218.85 #sshd|1792043801|172800|1|{"matches": ["Oct 15 05:56:37 hecnet-us-east-gw sshd[2430596]: User root from 221.162.218.85 not allowed because not listed in AllowUsers", "Oct 15 05:56:39 hecnet-us-east-gw sshd[2430596]: Failed password for invalid user root from 221.162.218.85 port 39068 ssh2", "Oct 15 05:56:41 hecnet-us-east-gw sshd[2430596]: Disconnected from invalid user root 221.162.218.85 port 39068 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2430596]: ", "ip4": "221.162.218.85", "users": "['root']", "user": "root"} 91.231.218.149 #sshd|1792044014|172800|1|{"matches": ["Oct 15 06:00:10 hecnet-us-east-gw sshd[2430639]: Invalid user info from 91.231.218.149 port 45699", "Oct 15 06:00:12 hecnet-us-east-gw sshd[2430639]: Failed password for invalid user info from 91.231.218.149 port 45699 ssh2", "Oct 15 06:00:14 hecnet-us-east-gw sshd[2430639]: Disconnected from invalid user info 91.231.218.149 port 45699 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2430639]: ", "ip4": "91.231.218.149", "users": "['info']", "user": "info"} 103.42.57.146 #sshd|1792046701|172800|1|{"matches": ["Oct 15 06:44:57 hecnet-us-east-gw sshd[2431139]: User root from 103.42.57.146 not allowed because not listed in AllowUsers", "Oct 15 06:44:59 hecnet-us-east-gw sshd[2431139]: Failed password for invalid user root from 103.42.57.146 port 34962 ssh2", "Oct 15 06:45:01 hecnet-us-east-gw sshd[2431139]: Disconnected from invalid user root 103.42.57.146 port 34962 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2431139]: ", "ip4": "103.42.57.146", "users": "['root']", "user": "root"} 165.154.162.74 #sshd|1792048856|172800|1|{"matches": ["Oct 15 07:20:54 hecnet-us-east-gw sshd[2431422]: User root from 165.154.162.74 not allowed because not listed in AllowUsers", "Oct 15 07:20:55 hecnet-us-east-gw sshd[2431422]: Failed password for invalid user root from 165.154.162.74 port 34890 ssh2", "Oct 15 07:20:56 hecnet-us-east-gw sshd[2431422]: Disconnected from invalid user root 165.154.162.74 port 34890 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2431422]: ", "ip4": "165.154.162.74", "users": "['root']", "user": "root"} 102.88.137.80 #sshd|1792049030|172800|1|{"matches": ["Oct 15 07:23:48 hecnet-us-east-gw sshd[2431452]: Invalid user cat from 102.88.137.80 port 1311", "Oct 15 07:23:49 hecnet-us-east-gw sshd[2431452]: Failed password for invalid user cat from 102.88.137.80 port 1311 ssh2", "Oct 15 07:23:50 hecnet-us-east-gw sshd[2431452]: Disconnected from invalid user cat 102.88.137.80 port 1311 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2431452]: ", "ip4": "102.88.137.80", "users": "['cat']", "user": "cat"} 179.51.153.37 #sshd|1792049264|172800|1|{"matches": ["Oct 15 07:27:41 hecnet-us-east-gw sshd[2431510]: Invalid user respaldo from 179.51.153.37 port 53484", "Oct 15 07:27:44 hecnet-us-east-gw sshd[2431510]: Failed password for invalid user respaldo from 179.51.153.37 port 53484 ssh2", "Oct 15 07:27:44 hecnet-us-east-gw sshd[2431510]: Disconnected from invalid user respaldo 179.51.153.37 port 53484 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2431510]: ", "ip4": "179.51.153.37", "users": "['respaldo']", "user": "respaldo"} 45.148.10.141 #sshd|1792049290|172800|1|{"matches": ["Oct 15 07:28:04 hecnet-us-east-gw sshd[2431533]: User root from 45.148.10.141 not allowed because not listed in AllowUsers", "Oct 15 07:28:06 hecnet-us-east-gw sshd[2431533]: Failed none for invalid user root from 45.148.10.141 port 22770 ssh2", "Oct 15 07:28:10 hecnet-us-east-gw sshd[2431533]: Failed password for invalid user root from 45.148.10.141 port 22770 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2431533]: ", "ip4": "45.148.10.141", "users": "['root']", "user": "root"} 106.75.77.231 #sshd|1792049584|172800|1|{"matches": ["Oct 15 07:28:53 hecnet-us-east-gw sshd[2431556]: Failed password for invalid user root from 106.75.77.231 port 39196 ssh2", "Oct 15 07:33:03 hecnet-us-east-gw sshd[2431588]: Connection from 106.75.77.231 port 51790 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 15 07:33:04 hecnet-us-east-gw sshd[2431588]: Invalid user usertest from 106.75.77.231 port 51790"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2431556]: ", "ip4": "106.75.77.231", "users": "['root']", "user": "root"} 177.10.203.106 #sshd|1792049661|172800|1|{"matches": ["Oct 15 07:34:19 hecnet-us-east-gw sshd[2431613]: User root from 177.10.203.106 not allowed because not listed in AllowUsers", "Oct 15 07:34:20 hecnet-us-east-gw sshd[2431613]: Failed password for invalid user root from 177.10.203.106 port 15541 ssh2", "Oct 15 07:34:21 hecnet-us-east-gw sshd[2431613]: Disconnected from invalid user root 177.10.203.106 port 15541 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2431613]: ", "ip4": "177.10.203.106", "users": "['root']", "user": "root"} 61.76.38.54 #sshd|1792050898|172800|1|{"matches": ["Oct 15 07:54:54 hecnet-us-east-gw sshd[2431785]: User root from 61.76.38.54 not allowed because not listed in AllowUsers", "Oct 15 07:54:56 hecnet-us-east-gw sshd[2431785]: Failed password for invalid user root from 61.76.38.54 port 58118 ssh2", "Oct 15 07:54:58 hecnet-us-east-gw sshd[2431785]: Disconnected from invalid user root 61.76.38.54 port 58118 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2431785]: ", "ip4": "61.76.38.54", "users": "['root']", "user": "root"} 20.207.202.183 #lighttpd-scans|1792051341|172800|1|{"matches": [["", "Oct 15 08:02:12", " hecnet-us-east-gw lighttpd[1017]: 20.207.202.183 hecnet-us-east-gw.duckdns.org - [15/Oct/2026:08:02:12 +0000] \"GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1\" 404 341 \"-\" \"-\""], "Oct 15 08:02:13 hecnet-us-east-gw lighttpd[1017]: 20.207.202.183 hecnet-us-east-gw.duckdns.org - [15/Oct/2026:08:02:13 +0000] \"GET /this_is_a_new_hello_world.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 15 08:02:14 hecnet-us-east-gw lighttpd[1017]: 20.207.202.183 hecnet-us-east-gw.duckdns.org - [15/Oct/2026:08:02:14 +0000] \"GET /403.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 15 08:02:16 hecnet-us-east-gw lighttpd[1017]: 20.207.202.183 hecnet-us-east-gw.duckdns.org - [15/Oct/2026:08:02:16 +0000] \"GET /samll.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 15 08:02:17 hecnet-us-east-gw lighttpd[1017]: 20.207.202.183 hecnet-us-east-gw.duckdns.org - [15/Oct/2026:08:02:17 +0000] \"GET /mac.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 15 08:02:18 hecnet-us-east-gw lighttpd[1017]: 20.207.202.183 hecnet-us-east-gw.duckdns.org - [15/Oct/2026:08:02:18 +0000] \"GET /k.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 15 08:02:19 hecnet-us-east-gw lighttpd[1017]: 20.207.202.183 hecnet-us-east-gw.duckdns.org - [15/Oct/2026:08:02:19 +0000] \"GET /radio.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 15 08:02:21 hecnet-us-east-gw lighttpd[1017]: 20.207.202.183 hecnet-us-east-gw.duckdns.org - [15/Oct/2026:08:02:21 +0000] \"GET /1.php HTTP/1.1\" 404 341 \"-\" \"-\""], "failures": 8, "ip4": "20.207.202.183"} 58.208.84.103 #sshd|1792053971|172800|1|{"matches": ["Oct 15 08:42:18 hecnet-us-east-gw sshd[2432150]: Failed password for invalid user admin from 58.208.84.103 port 46788 ssh2", "Oct 15 08:46:10 hecnet-us-east-gw sshd[2432200]: Connection from 58.208.84.103 port 46280 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 15 08:46:11 hecnet-us-east-gw sshd[2432200]: Invalid user spam from 58.208.84.103 port 46280"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2432150]: ", "ip4": "58.208.84.103", "users": "['admin']", "user": "admin"} 45.148.10.157 #sshd|1792057101|172800|1|{"matches": ["Oct 15 09:38:17 hecnet-us-east-gw sshd[2432543]: User root from 45.148.10.157 not allowed because not listed in AllowUsers", "Oct 15 09:38:19 hecnet-us-east-gw sshd[2432543]: Failed none for invalid user root from 45.148.10.157 port 17598 ssh2", "Oct 15 09:38:21 hecnet-us-east-gw sshd[2432543]: Failed password for invalid user root from 45.148.10.157 port 17598 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2432543]: ", "ip4": "45.148.10.157", "users": "['root']", "user": "root"} 109.160.32.128 #sshd|1792060600|172800|1|{"matches": ["Oct 15 10:35:23 hecnet-us-east-gw sshd[2432964]: Failed none for invalid user from 109.160.32.128 port 50716 ssh2", "Oct 15 10:36:40 hecnet-us-east-gw sshd[2432966]: Connection from 109.160.32.128 port 33698 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 15 10:36:40 hecnet-us-east-gw sshd[2432966]: Invalid user infra from 109.160.32.128 port 33698"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2432964]: ", "ip4": "109.160.32.128", "user": ""} 168.76.131.178 #sshd|1792060992|172800|1|{"matches": ["Oct 15 10:43:10 hecnet-us-east-gw sshd[2433027]: Invalid user ts from 168.76.131.178 port 37144", "Oct 15 10:43:12 hecnet-us-east-gw sshd[2433027]: Failed password for invalid user ts from 168.76.131.178 port 37144 ssh2", "Oct 15 10:43:12 hecnet-us-east-gw sshd[2433027]: Disconnected from invalid user ts 168.76.131.178 port 37144 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2433027]: ", "ip4": "168.76.131.178", "users": "['ts']", "user": "ts"} 14.22.23.243 #sshd|1792061160|172800|1|{"matches": ["Oct 15 10:45:55 hecnet-us-east-gw sshd[2433093]: User root from 14.22.23.243 not allowed because not listed in AllowUsers", "Oct 15 10:45:57 hecnet-us-east-gw sshd[2433093]: Failed password for invalid user root from 14.22.23.243 port 48129 ssh2", "Oct 15 10:46:00 hecnet-us-east-gw sshd[2433093]: Disconnected from invalid user root 14.22.23.243 port 48129 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2433093]: ", "ip4": "14.22.23.243", "users": "['root']", "user": "root"} 46.100.248.130 #sshd|1792061354|172800|1|{"matches": ["Oct 15 10:49:09 hecnet-us-east-gw sshd[2433124]: User root from 46.100.248.130 not allowed because not listed in AllowUsers", "Oct 15 10:49:11 hecnet-us-east-gw sshd[2433124]: Failed password for invalid user root from 46.100.248.130 port 37890 ssh2", "Oct 15 10:49:14 hecnet-us-east-gw sshd[2433124]: Disconnected from invalid user root 46.100.248.130 port 37890 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2433124]: ", "ip4": "46.100.248.130", "users": "['root']", "user": "root"} 134.122.93.100 #sshd|1792061595|172800|1|{"matches": ["Oct 15 10:53:13 hecnet-us-east-gw sshd[2433160]: User root from 134.122.93.100 not allowed because not listed in AllowUsers", "Oct 15 10:53:14 hecnet-us-east-gw sshd[2433160]: Failed password for invalid user root from 134.122.93.100 port 44528 ssh2", "Oct 15 10:53:15 hecnet-us-east-gw sshd[2433160]: Disconnected from invalid user root 134.122.93.100 port 44528 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2433160]: ", "ip4": "134.122.93.100", "users": "['root']", "user": "root"} 201.63.223.141 #sshd|1792061600|172800|1|{"matches": ["Oct 15 10:53:17 hecnet-us-east-gw sshd[2433183]: Invalid user admin from 201.63.223.141 port 47384", "Oct 15 10:53:20 hecnet-us-east-gw sshd[2433183]: Failed password for invalid user admin from 201.63.223.141 port 47384 ssh2", "Oct 15 10:53:20 hecnet-us-east-gw sshd[2433183]: Disconnected from invalid user admin 201.63.223.141 port 47384 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2433183]: ", "ip4": "201.63.223.141", "users": "['admin']", "user": "admin"} 106.75.25.139 #sshd|1792061668|172800|1|{"matches": ["Oct 15 10:49:51 hecnet-us-east-gw sshd[2433148]: Failed password for invalid user nexus from 106.75.25.139 port 40652 ssh2", "Oct 15 10:54:26 hecnet-us-east-gw sshd[2433210]: Connection from 106.75.25.139 port 60034 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 15 10:54:28 hecnet-us-east-gw sshd[2433210]: Invalid user deploy from 106.75.25.139 port 60034"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2433148]: ", "ip4": "106.75.25.139", "users": "['nexus']", "user": "nexus"} 14.103.218.183 #sshd|1792061710|172800|1|{"matches": ["Oct 15 10:50:55 hecnet-us-east-gw sshd[2433152]: Failed password for invalid user db from 14.103.218.183 port 52642 ssh2", "Oct 15 10:55:09 hecnet-us-east-gw sshd[2433231]: Connection from 14.103.218.183 port 43324 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 15 10:55:10 hecnet-us-east-gw sshd[2433231]: User root from 14.103.218.183 not allowed because not listed in AllowUsers"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2433152]: ", "ip4": "14.103.218.183", "users": "['db']", "user": "db"} 91.134.133.184 #sshd|1792061779|172800|1|{"matches": ["Oct 15 10:56:16 hecnet-us-east-gw sshd[2433253]: Invalid user user01 from 91.134.133.184 port 55332", "Oct 15 10:56:18 hecnet-us-east-gw sshd[2433253]: Failed password for invalid user user01 from 91.134.133.184 port 55332 ssh2", "Oct 15 10:56:19 hecnet-us-east-gw sshd[2433253]: Disconnected from invalid user user01 91.134.133.184 port 55332 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2433253]: ", "ip4": "91.134.133.184", "users": "['user01']", "user": "user01"} 129.121.136.201 #sshd|1792061788|172800|1|{"matches": ["Oct 15 10:56:23 hecnet-us-east-gw sshd[2433274]: Invalid user mama from 129.121.136.201 port 41422", "Oct 15 10:56:26 hecnet-us-east-gw sshd[2433274]: Failed password for invalid user mama from 129.121.136.201 port 41422 ssh2", "Oct 15 10:56:28 hecnet-us-east-gw sshd[2433274]: Disconnected from invalid user mama 129.121.136.201 port 41422 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2433274]: ", "ip4": "129.121.136.201", "users": "['mama']", "user": "mama"} 186.122.177.140 #sshd|1792062035|172800|1|{"matches": ["Oct 15 11:00:32 hecnet-us-east-gw sshd[2433325]: Invalid user jamshid from 186.122.177.140 port 9113", "Oct 15 11:00:34 hecnet-us-east-gw sshd[2433325]: Failed password for invalid user jamshid from 186.122.177.140 port 9113 ssh2", "Oct 15 11:00:35 hecnet-us-east-gw sshd[2433325]: Disconnected from invalid user jamshid 186.122.177.140 port 9113 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2433325]: ", "ip4": "186.122.177.140", "users": "['jamshid']", "user": "jamshid"} 177.30.68.132 #sshd|1792064545|172800|1|{"matches": ["Oct 15 11:42:21 hecnet-us-east-gw sshd[2433644]: Invalid user bot from 177.30.68.132 port 37393", "Oct 15 11:42:23 hecnet-us-east-gw sshd[2433644]: Failed password for invalid user bot from 177.30.68.132 port 37393 ssh2", "Oct 15 11:42:25 hecnet-us-east-gw sshd[2433644]: Disconnected from invalid user bot 177.30.68.132 port 37393 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2433644]: ", "ip4": "177.30.68.132", "users": "['bot']", "user": "bot"} 152.32.188.136 #sshd|1792064549|172800|1|{"matches": ["Oct 15 11:42:25 hecnet-us-east-gw sshd[2433646]: User root from 152.32.188.136 not allowed because not listed in AllowUsers", "Oct 15 11:42:27 hecnet-us-east-gw sshd[2433646]: Failed password for invalid user root from 152.32.188.136 port 46434 ssh2", "Oct 15 11:42:29 hecnet-us-east-gw sshd[2433646]: Disconnected from invalid user root 152.32.188.136 port 46434 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2433646]: ", "ip4": "152.32.188.136", "users": "['root']", "user": "root"} 62.60.130.253 #sshd|1792070816|172800|1|{"matches": ["Oct 15 13:26:50 hecnet-us-east-gw sshd[2434360]: User root from 62.60.130.253 not allowed because not listed in AllowUsers", "Oct 15 13:26:52 hecnet-us-east-gw sshd[2434360]: Failed none for invalid user root from 62.60.130.253 port 22812 ssh2", "Oct 15 13:26:56 hecnet-us-east-gw sshd[2434360]: Failed password for invalid user root from 62.60.130.253 port 22812 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2434360]: ", "ip4": "62.60.130.253", "users": "['root']", "user": "root"} 77.74.202.226 #sshd|1792070995|172800|1|{"matches": ["Oct 15 13:29:52 hecnet-us-east-gw sshd[2434389]: Invalid user admin from 77.74.202.226 port 54866", "Oct 15 13:29:53 hecnet-us-east-gw sshd[2434389]: Failed password for invalid user admin from 77.74.202.226 port 54866 ssh2", "Oct 15 13:29:55 hecnet-us-east-gw sshd[2434389]: Connection closed by invalid user admin 77.74.202.226 port 54866 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2434389]: ", "ip4": "77.74.202.226", "users": "['admin']", "user": "admin"} 14.103.107.214 #sshd|1792072655|172800|1|{"matches": ["Oct 15 13:57:33 hecnet-us-east-gw sshd[2434644]: Invalid user pmf from 14.103.107.214 port 39820", "Oct 15 13:57:34 hecnet-us-east-gw sshd[2434644]: Failed password for invalid user pmf from 14.103.107.214 port 39820 ssh2", "Oct 15 13:57:35 hecnet-us-east-gw sshd[2434644]: Disconnected from invalid user pmf 14.103.107.214 port 39820 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2434644]: ", "ip4": "14.103.107.214", "users": "['pmf']", "user": "pmf"} 223.93.164.218 #sshd|1792073424|172800|1|{"matches": ["Oct 15 14:06:54 hecnet-us-east-gw sshd[2434734]: Failed password for invalid user user1 from 223.93.164.218 port 43768 ssh2", "Oct 15 14:10:22 hecnet-us-east-gw sshd[2434759]: Connection from 223.93.164.218 port 59398 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 15 14:10:24 hecnet-us-east-gw sshd[2434759]: User root from 223.93.164.218 not allowed because not listed in AllowUsers"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2434734]: ", "ip4": "223.93.164.218", "users": "['user1']", "user": "user1"} 152.32.218.149 #sshd|1792075270|172800|1|{"matches": ["Oct 15 14:41:06 hecnet-us-east-gw sshd[2434997]: Invalid user osm from 152.32.218.149 port 46222", "Oct 15 14:41:08 hecnet-us-east-gw sshd[2434997]: Failed password for invalid user osm from 152.32.218.149 port 46222 ssh2", "Oct 15 14:41:10 hecnet-us-east-gw sshd[2434997]: Disconnected from invalid user osm 152.32.218.149 port 46222 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2434997]: ", "ip4": "152.32.218.149", "users": "['osm']", "user": "osm"} 136.232.11.10 #sshd|1792075393|172800|1|{"matches": ["Oct 15 14:43:11 hecnet-us-east-gw sshd[2435033]: Invalid user calvin from 136.232.11.10 port 4061", "Oct 15 14:43:12 hecnet-us-east-gw sshd[2435033]: Failed password for invalid user calvin from 136.232.11.10 port 4061 ssh2", "Oct 15 14:43:13 hecnet-us-east-gw sshd[2435033]: Disconnected from invalid user calvin 136.232.11.10 port 4061 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2435033]: ", "ip4": "136.232.11.10", "users": "['calvin']", "user": "calvin"} 144.225.187.68 #sshd|1792075580|172800|1|{"matches": ["Oct 15 14:46:18 hecnet-us-east-gw sshd[2435105]: User root from 144.225.187.68 not allowed because not listed in AllowUsers", "Oct 15 14:46:19 hecnet-us-east-gw sshd[2435105]: Failed password for invalid user root from 144.225.187.68 port 34982 ssh2", "Oct 15 14:46:20 hecnet-us-east-gw sshd[2435105]: Disconnected from invalid user root 144.225.187.68 port 34982 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2435105]: ", "ip4": "144.225.187.68", "users": "['root']", "user": "root"} 101.36.128.39 #sshd|1792076653|172800|1|{"matches": ["Oct 15 15:04:08 hecnet-us-east-gw sshd[2435180]: User root from 101.36.128.39 not allowed because not listed in AllowUsers", "Oct 15 15:04:10 hecnet-us-east-gw sshd[2435180]: Failed password for invalid user root from 101.36.128.39 port 37052 ssh2", "Oct 15 15:04:13 hecnet-us-east-gw sshd[2435180]: Disconnected from invalid user root 101.36.128.39 port 37052 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2435180]: ", "ip4": "101.36.128.39", "users": "['root']", "user": "root"} 109.160.32.144 #sshd|1792078001|172800|1|{"matches": ["Oct 15 15:25:31 hecnet-us-east-gw sshd[2435390]: Failed none for invalid user from 109.160.32.144 port 49322 ssh2", "Oct 15 15:26:41 hecnet-us-east-gw sshd[2435395]: Connection from 109.160.32.144 port 59342 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 15 15:26:41 hecnet-us-east-gw sshd[2435395]: Invalid user cs229 from 109.160.32.144 port 59342"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2435390]: ", "ip4": "109.160.32.144", "user": ""} 187.216.224.85 #sshd|1792078376|172800|1|{"matches": ["Oct 15 15:32:54 hecnet-us-east-gw sshd[2435447]: User root from 187.216.224.85 not allowed because not listed in AllowUsers", "Oct 15 15:32:56 hecnet-us-east-gw sshd[2435447]: Failed password for invalid user root from 187.216.224.85 port 33588 ssh2", "Oct 15 15:32:56 hecnet-us-east-gw sshd[2435447]: Disconnected from invalid user root 187.216.224.85 port 33588 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2435447]: ", "ip4": "187.216.224.85", "users": "['root']", "user": "root"} 193.47.62.69 #sshd|1792080883|172800|1|{"matches": ["Oct 15 16:14:37 hecnet-us-east-gw sshd[2435741]: User root from 193.47.62.69 not allowed because not listed in AllowUsers", "Oct 15 16:14:39 hecnet-us-east-gw sshd[2435741]: Failed none for invalid user root from 193.47.62.69 port 18890 ssh2", "Oct 15 16:14:43 hecnet-us-east-gw sshd[2435741]: Failed password for invalid user root from 193.47.62.69 port 18890 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2435741]: ", "ip4": "193.47.62.69", "users": "['root']", "user": "root"} 62.16.41.154 #sshd|1792083841|172800|1|{"matches": ["Oct 15 17:03:59 hecnet-us-east-gw sshd[2436073]: Invalid user aa from 62.16.41.154 port 53636", "Oct 15 17:04:01 hecnet-us-east-gw sshd[2436073]: Failed password for invalid user aa from 62.16.41.154 port 53636 ssh2", "Oct 15 17:04:01 hecnet-us-east-gw sshd[2436073]: Disconnected from invalid user aa 62.16.41.154 port 53636 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2436073]: ", "ip4": "62.16.41.154", "users": "['aa']", "user": "aa"} 92.118.39.50 #sshd|1792084678|172800|1|{"matches": ["Oct 15 17:17:51 hecnet-us-east-gw sshd[2436228]: User root from 92.118.39.50 not allowed because not listed in AllowUsers", "Oct 15 17:17:53 hecnet-us-east-gw sshd[2436228]: Failed none for invalid user root from 92.118.39.50 port 52766 ssh2", "Oct 15 17:17:58 hecnet-us-east-gw sshd[2436228]: Failed password for invalid user root from 92.118.39.50 port 52766 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2436228]: ", "ip4": "92.118.39.50", "users": "['root']", "user": "root"} 109.160.32.146 #sshd|1792085350|172800|1|{"matches": ["Oct 15 17:28:06 hecnet-us-east-gw sshd[2436297]: Failed none for invalid user from 109.160.32.146 port 60034 ssh2", "Oct 15 17:29:08 hecnet-us-east-gw sshd[2436302]: Connection from 109.160.32.146 port 47132 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 15 17:29:10 hecnet-us-east-gw sshd[2436302]: Invalid user jtbsdba from 109.160.32.146 port 47132"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2436297]: ", "ip4": "109.160.32.146", "user": ""} 101.168.13.172 #sshd|1792088474|172800|1|{"matches": ["Oct 15 18:21:08 hecnet-us-east-gw sshd[2436682]: User root from 101.168.13.172 not allowed because not listed in AllowUsers", "Oct 15 18:21:10 hecnet-us-east-gw sshd[2436682]: Failed none for invalid user root from 101.168.13.172 port 54294 ssh2", "Oct 15 18:21:14 hecnet-us-east-gw sshd[2436682]: Failed password for invalid user root from 101.168.13.172 port 54294 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2436682]: ", "ip4": "101.168.13.172", "users": "['root']", "user": "root"} 20.207.203.178 #lighttpd-scans|1792093362|172800|1|{"matches": [["", "Oct 15 19:42:26", " hecnet-us-east-gw lighttpd[1017]: 20.207.203.178 hecnet-us-east-gw.duckdns.org - [15/Oct/2026:19:42:25 +0000] \"GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1\" 404 341 \"-\" \"-\""], "Oct 15 19:42:27 hecnet-us-east-gw lighttpd[1017]: 20.207.203.178 hecnet-us-east-gw.duckdns.org - [15/Oct/2026:19:42:27 +0000] \"GET /this_is_a_new_hello_world.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 15 19:42:28 hecnet-us-east-gw lighttpd[1017]: 20.207.203.178 hecnet-us-east-gw.duckdns.org - [15/Oct/2026:19:42:28 +0000] \"GET /img.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 15 19:42:31 hecnet-us-east-gw lighttpd[1017]: 20.207.203.178 hecnet-us-east-gw.duckdns.org - [15/Oct/2026:19:42:31 +0000] \"GET /ioxi-o.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 15 19:42:32 hecnet-us-east-gw lighttpd[1017]: 20.207.203.178 hecnet-us-east-gw.duckdns.org - [15/Oct/2026:19:42:32 +0000] \"GET /aboutt.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 15 19:42:34 hecnet-us-east-gw lighttpd[1017]: 20.207.203.178 hecnet-us-east-gw.duckdns.org - [15/Oct/2026:19:42:34 +0000] \"GET /ssh3ll.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 15 19:42:40 hecnet-us-east-gw lighttpd[1017]: 20.207.203.178 hecnet-us-east-gw.duckdns.org - [15/Oct/2026:19:42:40 +0000] \"GET /xie.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 15 19:42:42 hecnet-us-east-gw lighttpd[1017]: 20.207.203.178 hecnet-us-east-gw.duckdns.org - [15/Oct/2026:19:42:41 +0000] \"GET /xty.php HTTP/1.1\" 404 341 \"-\" \"-\""], "failures": 8, "ip4": "20.207.203.178"} 36.137.169.74 #sshd|1792093478|172800|1|{"matches": ["Oct 15 19:44:36 hecnet-us-east-gw sshd[2437263]: User root from 36.137.169.74 not allowed because not listed in AllowUsers", "Oct 15 19:44:38 hecnet-us-east-gw sshd[2437263]: Failed password for invalid user root from 36.137.169.74 port 38880 ssh2", "Oct 15 19:44:38 hecnet-us-east-gw sshd[2437263]: Disconnected from invalid user root 36.137.169.74 port 38880 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2437263]: ", "ip4": "36.137.169.74", "users": "['root']", "user": "root"} 163.7.8.178 #sshd|1792096253|172800|1|{"matches": ["Oct 15 20:30:51 hecnet-us-east-gw sshd[2437591]: User root from 163.7.8.178 not allowed because not listed in AllowUsers", "Oct 15 20:30:53 hecnet-us-east-gw sshd[2437591]: Failed password for invalid user root from 163.7.8.178 port 42884 ssh2", "Oct 15 20:30:53 hecnet-us-east-gw sshd[2437591]: Disconnected from invalid user root 163.7.8.178 port 42884 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2437591]: ", "ip4": "163.7.8.178", "users": "['root']", "user": "root"} 117.236.124.166 #sshd|1792098399|172800|1|{"matches": ["Oct 15 21:06:35 hecnet-us-east-gw sshd[2437835]: User root from 117.236.124.166 not allowed because not listed in AllowUsers", "Oct 15 21:06:37 hecnet-us-east-gw sshd[2437835]: Failed password for invalid user root from 117.236.124.166 port 43424 ssh2", "Oct 15 21:06:39 hecnet-us-east-gw sshd[2437835]: Disconnected from invalid user root 117.236.124.166 port 43424 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2437835]: ", "ip4": "117.236.124.166", "users": "['root']", "user": "root"} 103.248.120.6 #sshd|1792098864|172800|1|{"matches": ["Oct 15 21:14:21 hecnet-us-east-gw sshd[2437896]: Invalid user didi from 103.248.120.6 port 40940", "Oct 15 21:14:23 hecnet-us-east-gw sshd[2437896]: Failed password for invalid user didi from 103.248.120.6 port 40940 ssh2", "Oct 15 21:14:24 hecnet-us-east-gw sshd[2437896]: Disconnected from invalid user didi 103.248.120.6 port 40940 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2437896]: ", "ip4": "103.248.120.6", "users": "['didi']", "user": "didi"} 36.213.69.67 #sshd|1792101092|172800|1|{"matches": ["Oct 15 21:51:28 hecnet-us-east-gw sshd[2438174]: User root from 36.213.69.67 not allowed because not listed in AllowUsers", "Oct 15 21:51:30 hecnet-us-east-gw sshd[2438174]: Failed password for invalid user root from 36.213.69.67 port 52660 ssh2", "Oct 15 21:51:32 hecnet-us-east-gw sshd[2438174]: Disconnected from invalid user root 36.213.69.67 port 52660 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2438174]: ", "ip4": "36.213.69.67", "users": "['root']", "user": "root"} 172.203.149.63 #sshd|1792105904|172800|1|{"matches": ["Oct 15 23:11:40 hecnet-us-east-gw sshd[2438720]: Invalid user developer from 172.203.149.63 port 36986", "Oct 15 23:11:43 hecnet-us-east-gw sshd[2438720]: Failed password for invalid user developer from 172.203.149.63 port 36986 ssh2", "Oct 15 23:11:44 hecnet-us-east-gw sshd[2438720]: Disconnected from invalid user developer 172.203.149.63 port 36986 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2438720]: ", "ip4": "172.203.149.63", "users": "['developer']", "user": "developer"} 165.1.75.106 #sshd|1792107244|172800|1|{"matches": ["Oct 15 23:34:00 hecnet-us-east-gw sshd[2438889]: User root from 165.1.75.106 not allowed because not listed in AllowUsers", "Oct 15 23:34:02 hecnet-us-east-gw sshd[2438889]: Failed password for invalid user root from 165.1.75.106 port 15896 ssh2", "Oct 15 23:34:04 hecnet-us-east-gw sshd[2438889]: Connection closed by invalid user root 165.1.75.106 port 15896 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2438889]: ", "ip4": "165.1.75.106", "users": "['root']", "user": "root"} 94.204.5.49 #sshd|1792107772|172800|1|{"matches": ["Oct 15 23:42:47 hecnet-us-east-gw sshd[2438988]: User root from 94.204.5.49 not allowed because not listed in AllowUsers", "Oct 15 23:42:48 hecnet-us-east-gw sshd[2438988]: Failed none for invalid user root from 94.204.5.49 port 39120 ssh2", "Oct 15 23:42:52 hecnet-us-east-gw sshd[2438988]: Failed password for invalid user root from 94.204.5.49 port 39120 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2438988]: ", "ip4": "94.204.5.49", "users": "['root']", "user": "root"} 36.140.151.122 #sshd|1792109183|172800|1|{"matches": ["Oct 16 00:06:18 hecnet-us-east-gw sshd[2439166]: Invalid user ts3user from 36.140.151.122 port 57958", "Oct 16 00:06:20 hecnet-us-east-gw sshd[2439166]: Failed password for invalid user ts3user from 36.140.151.122 port 57958 ssh2", "Oct 16 00:06:23 hecnet-us-east-gw sshd[2439166]: Disconnected from invalid user ts3user 36.140.151.122 port 57958 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2439166]: ", "ip4": "36.140.151.122", "users": "['ts3user']", "user": "ts3user"} 68.221.29.70 #sshd|1792109201|172800|1|{"matches": ["Oct 16 00:06:37 hecnet-us-east-gw sshd[2439191]: User root from 68.221.29.70 not allowed because not listed in AllowUsers", "Oct 16 00:06:40 hecnet-us-east-gw sshd[2439191]: Failed password for invalid user root from 68.221.29.70 port 34304 ssh2", "Oct 16 00:06:41 hecnet-us-east-gw sshd[2439191]: Disconnected from invalid user root 68.221.29.70 port 34304 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2439191]: ", "ip4": "68.221.29.70", "users": "['root']", "user": "root"} 129.121.103.53 #sshd|1792109429|172800|1|{"matches": ["Oct 16 00:10:25 hecnet-us-east-gw sshd[2439240]: User root from 129.121.103.53 not allowed because not listed in AllowUsers", "Oct 16 00:10:27 hecnet-us-east-gw sshd[2439240]: Failed password for invalid user root from 129.121.103.53 port 57278 ssh2", "Oct 16 00:10:29 hecnet-us-east-gw sshd[2439240]: Disconnected from invalid user root 129.121.103.53 port 57278 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2439240]: ", "ip4": "129.121.103.53", "users": "['root']", "user": "root"} 119.96.159.237 #sshd|1792109660|172800|1|{"matches": ["Oct 16 00:06:26 hecnet-us-east-gw sshd[2439168]: Failed password for invalid user root from 119.96.159.237 port 58738 ssh2", "Oct 16 00:14:18 hecnet-us-east-gw sshd[2439280]: Connection from 119.96.159.237 port 57494 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 16 00:14:20 hecnet-us-east-gw sshd[2439280]: User root from 119.96.159.237 not allowed because not listed in AllowUsers"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2439168]: ", "ip4": "119.96.159.237", "users": "['root']", "user": "root"} 80.94.92.55 #sshd|1792110176|172800|1|{"matches": ["Oct 16 00:22:51 hecnet-us-east-gw sshd[2439363]: User root from 80.94.92.55 not allowed because not listed in AllowUsers", "Oct 16 00:22:53 hecnet-us-east-gw sshd[2439363]: Failed none for invalid user root from 80.94.92.55 port 36832 ssh2", "Oct 16 00:22:56 hecnet-us-east-gw sshd[2439363]: Failed password for invalid user root from 80.94.92.55 port 36832 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2439363]: ", "ip4": "80.94.92.55", "users": "['root']", "user": "root"} 157.119.40.233 #sshd|1792110978|172800|1|{"matches": ["Oct 16 00:36:16 hecnet-us-east-gw sshd[2439499]: User root from 157.119.40.233 not allowed because not listed in AllowUsers", "Oct 16 00:36:17 hecnet-us-east-gw sshd[2439499]: Failed password for invalid user root from 157.119.40.233 port 45560 ssh2", "Oct 16 00:36:18 hecnet-us-east-gw sshd[2439499]: Disconnected from invalid user root 157.119.40.233 port 45560 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2439499]: ", "ip4": "157.119.40.233", "users": "['root']", "user": "root"} 123.122.38.100 #sshd|1792113827|172800|1|{"matches": ["Oct 16 01:20:27 hecnet-us-east-gw sshd[2439800]: Failed password for invalid user git from 123.122.38.100 port 41165 ssh2", "Oct 16 01:23:45 hecnet-us-east-gw sshd[2439809]: Connection from 123.122.38.100 port 60903 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 16 01:23:47 hecnet-us-east-gw sshd[2439809]: User root from 123.122.38.100 not allowed because not listed in AllowUsers"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2439800]: ", "ip4": "123.122.38.100", "users": "['git']", "user": "git"} 212.56.213.212 #sshd|1792115491|172800|1|{"matches": ["Oct 16 01:51:29 hecnet-us-east-gw sshd[2440048]: User root from 212.56.213.212 not allowed because not listed in AllowUsers", "Oct 16 01:51:30 hecnet-us-east-gw sshd[2440048]: Failed password for invalid user root from 212.56.213.212 port 46710 ssh2", "Oct 16 01:51:31 hecnet-us-east-gw sshd[2440048]: Disconnected from invalid user root 212.56.213.212 port 46710 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2440048]: ", "ip4": "212.56.213.212", "users": "['root']", "user": "root"} 43.159.62.8 #sshd|1792115501|172800|1|{"matches": ["Oct 16 01:51:37 hecnet-us-east-gw sshd[2440061]: Invalid user mcserver from 43.159.62.8 port 44807", "Oct 16 01:51:39 hecnet-us-east-gw sshd[2440061]: Failed password for invalid user mcserver from 43.159.62.8 port 44807 ssh2", "Oct 16 01:51:41 hecnet-us-east-gw sshd[2440061]: Disconnected from invalid user mcserver 43.159.62.8 port 44807 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2440061]: ", "ip4": "43.159.62.8", "users": "['mcserver']", "user": "mcserver"} 109.160.32.43 #sshd|1792115731|172800|1|{"matches": ["Oct 16 01:54:54 hecnet-us-east-gw sshd[2440097]: Failed none for invalid user from 109.160.32.43 port 34470 ssh2", "Oct 16 01:55:30 hecnet-us-east-gw sshd[2440104]: Connection from 109.160.32.43 port 51100 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 16 01:55:31 hecnet-us-east-gw sshd[2440104]: Invalid user chen from 109.160.32.43 port 51100"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2440097]: ", "ip4": "109.160.32.43", "user": ""} 152.32.225.117 #sshd|1792116790|172800|1|{"matches": ["Oct 16 02:13:07 hecnet-us-east-gw sshd[2440245]: Invalid user admin from 152.32.225.117 port 10104", "Oct 16 02:13:09 hecnet-us-east-gw sshd[2440245]: Failed password for invalid user admin from 152.32.225.117 port 10104 ssh2", "Oct 16 02:13:10 hecnet-us-east-gw sshd[2440245]: Connection closed by invalid user admin 152.32.225.117 port 10104 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2440245]: ", "ip4": "152.32.225.117", "users": "['admin']", "user": "admin"} 163.223.210.138 #sshd|1792116906|172800|1|{"matches": ["Oct 16 02:15:03 hecnet-us-east-gw sshd[2440289]: Invalid user server from 163.223.210.138 port 49282", "Oct 16 02:15:05 hecnet-us-east-gw sshd[2440289]: Failed password for invalid user server from 163.223.210.138 port 49282 ssh2", "Oct 16 02:15:06 hecnet-us-east-gw sshd[2440289]: Disconnected from invalid user server 163.223.210.138 port 49282 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2440289]: ", "ip4": "163.223.210.138", "users": "['server']", "user": "server"} 110.139.20.34 #sshd|1792117218|172800|1|{"matches": ["Oct 16 02:20:16 hecnet-us-east-gw sshd[2440361]: Invalid user postgres from 110.139.20.34 port 58760", "Oct 16 02:20:18 hecnet-us-east-gw sshd[2440361]: Failed password for invalid user postgres from 110.139.20.34 port 58760 ssh2", "Oct 16 02:20:18 hecnet-us-east-gw sshd[2440361]: Disconnected from invalid user postgres 110.139.20.34 port 58760 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2440361]: ", "ip4": "110.139.20.34", "users": "['postgres']", "user": "postgres"} 51.124.186.154 #sshd|1792117929|172800|1|{"matches": ["Oct 16 02:32:07 hecnet-us-east-gw sshd[2440461]: User root from 51.124.186.154 not allowed because not listed in AllowUsers", "Oct 16 02:32:09 hecnet-us-east-gw sshd[2440461]: Failed password for invalid user root from 51.124.186.154 port 32916 ssh2", "Oct 16 02:32:09 hecnet-us-east-gw sshd[2440461]: Disconnected from invalid user root 51.124.186.154 port 32916 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2440461]: ", "ip4": "51.124.186.154", "users": "['root']", "user": "root"} 20.160.86.7 #sshd|1792118026|172800|1|{"matches": ["Oct 16 02:33:43 hecnet-us-east-gw sshd[2440491]: Invalid user admin from 20.160.86.7 port 52406", "Oct 16 02:33:46 hecnet-us-east-gw sshd[2440491]: Failed password for invalid user admin from 20.160.86.7 port 52406 ssh2", "Oct 16 02:33:46 hecnet-us-east-gw sshd[2440491]: Disconnected from invalid user admin 20.160.86.7 port 52406 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2440491]: ", "ip4": "20.160.86.7", "users": "['admin']", "user": "admin"} 129.121.94.183 #sshd|1792119301|172800|1|{"matches": ["Oct 16 02:54:57 hecnet-us-east-gw sshd[2440675]: Invalid user nikhil from 129.121.94.183 port 59284", "Oct 16 02:54:59 hecnet-us-east-gw sshd[2440675]: Failed password for invalid user nikhil from 129.121.94.183 port 59284 ssh2", "Oct 16 02:55:01 hecnet-us-east-gw sshd[2440675]: Disconnected from invalid user nikhil 129.121.94.183 port 59284 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2440675]: ", "ip4": "129.121.94.183", "users": "['nikhil']", "user": "nikhil"} 189.203.163.10 #sshd|1792119329|172800|1|{"matches": ["Oct 16 02:55:27 hecnet-us-east-gw sshd[2440699]: Invalid user guest from 189.203.163.10 port 33056", "Oct 16 02:55:29 hecnet-us-east-gw sshd[2440699]: Failed password for invalid user guest from 189.203.163.10 port 33056 ssh2", "Oct 16 02:55:29 hecnet-us-east-gw sshd[2440699]: Disconnected from invalid user guest 189.203.163.10 port 33056 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2440699]: ", "ip4": "189.203.163.10", "users": "['guest']", "user": "guest"} 85.216.81.75 #sshd|1792119331|172800|1|{"matches": ["Oct 16 02:55:29 hecnet-us-east-gw sshd[2440701]: User root from 85.216.81.75 not allowed because not listed in AllowUsers", "Oct 16 02:55:31 hecnet-us-east-gw sshd[2440701]: Failed password for invalid user root from 85.216.81.75 port 56962 ssh2", "Oct 16 02:55:31 hecnet-us-east-gw sshd[2440701]: Disconnected from invalid user root 85.216.81.75 port 56962 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2440701]: ", "ip4": "85.216.81.75", "users": "['root']", "user": "root"} 115.68.208.117 #sshd|1792119423|172800|1|{"matches": ["Oct 16 02:56:59 hecnet-us-east-gw sshd[2440745]: User root from 115.68.208.117 not allowed because not listed in AllowUsers", "Oct 16 02:57:01 hecnet-us-east-gw sshd[2440745]: Failed password for invalid user root from 115.68.208.117 port 6231 ssh2", "Oct 16 02:57:03 hecnet-us-east-gw sshd[2440745]: Disconnected from invalid user root 115.68.208.117 port 6231 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2440745]: ", "ip4": "115.68.208.117", "users": "['root']", "user": "root"} 154.18.197.35 #sshd|1792119619|172800|1|{"matches": ["Oct 16 03:00:15 hecnet-us-east-gw sshd[2440787]: User root from 154.18.197.35 not allowed because not listed in AllowUsers", "Oct 16 03:00:17 hecnet-us-east-gw sshd[2440787]: Failed password for invalid user root from 154.18.197.35 port 45568 ssh2", "Oct 16 03:00:19 hecnet-us-east-gw sshd[2440787]: Disconnected from invalid user root 154.18.197.35 port 45568 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2440787]: ", "ip4": "154.18.197.35", "users": "['root']", "user": "root"} 80.94.92.234 #sshd|1792120204|172800|1|{"matches": ["Oct 16 03:09:57 hecnet-us-east-gw sshd[2440887]: User root from 80.94.92.234 not allowed because not listed in AllowUsers", "Oct 16 03:10:00 hecnet-us-east-gw sshd[2440887]: Failed none for invalid user root from 80.94.92.234 port 54990 ssh2", "Oct 16 03:10:04 hecnet-us-east-gw sshd[2440887]: Failed password for invalid user root from 80.94.92.234 port 54990 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2440887]: ", "ip4": "80.94.92.234", "users": "['root']", "user": "root"} 60.214.154.254 #sshd|1792121150|172800|1|{"matches": ["Oct 16 03:25:48 hecnet-us-east-gw sshd[2441041]: User root from 60.214.154.254 not allowed because not listed in AllowUsers", "Oct 16 03:25:49 hecnet-us-east-gw sshd[2441041]: Failed password for invalid user root from 60.214.154.254 port 34022 ssh2", "Oct 16 03:25:50 hecnet-us-east-gw sshd[2441041]: Disconnected from invalid user root 60.214.154.254 port 34022 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2441041]: ", "ip4": "60.214.154.254", "users": "['root']", "user": "root"} 189.50.142.82 #sshd|1792121926|172800|1|{"matches": ["Oct 16 03:38:43 hecnet-us-east-gw sshd[2441145]: Invalid user chatbot from 189.50.142.82 port 35161", "Oct 16 03:38:45 hecnet-us-east-gw sshd[2441145]: Failed password for invalid user chatbot from 189.50.142.82 port 35161 ssh2", "Oct 16 03:38:46 hecnet-us-east-gw sshd[2441145]: Disconnected from invalid user chatbot 189.50.142.82 port 35161 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2441145]: ", "ip4": "189.50.142.82", "users": "['chatbot']", "user": "chatbot"} 96.78.175.36 #sshd|1792126146|172800|1|{"matches": ["Oct 16 04:49:04 hecnet-us-east-gw sshd[2441745]: User root from 96.78.175.36 not allowed because not listed in AllowUsers", "Oct 16 04:49:05 hecnet-us-east-gw sshd[2441745]: Failed password for invalid user root from 96.78.175.36 port 45882 ssh2", "Oct 16 04:49:06 hecnet-us-east-gw sshd[2441745]: Disconnected from invalid user root 96.78.175.36 port 45882 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2441745]: ", "ip4": "96.78.175.36", "users": "['root']", "user": "root"} 114.141.59.193 #sshd|1792126184|172800|1|{"matches": ["Oct 16 04:49:40 hecnet-us-east-gw sshd[2441769]: Invalid user debian from 114.141.59.193 port 57788", "Oct 16 04:49:42 hecnet-us-east-gw sshd[2441769]: Failed password for invalid user debian from 114.141.59.193 port 57788 ssh2", "Oct 16 04:49:44 hecnet-us-east-gw sshd[2441769]: Disconnected from invalid user debian 114.141.59.193 port 57788 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2441769]: ", "ip4": "114.141.59.193", "users": "['debian']", "user": "debian"} 43.135.148.189 #sshd|1792126260|172800|1|{"matches": ["Oct 16 04:50:58 hecnet-us-east-gw sshd[2441790]: Invalid user node from 43.135.148.189 port 55374", "Oct 16 04:51:00 hecnet-us-east-gw sshd[2441790]: Failed password for invalid user node from 43.135.148.189 port 55374 ssh2", "Oct 16 04:51:00 hecnet-us-east-gw sshd[2441790]: Disconnected from invalid user node 43.135.148.189 port 55374 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2441790]: ", "ip4": "43.135.148.189", "users": "['node']", "user": "node"} 114.141.59.195 #sshd|1792126448|172800|1|{"matches": ["Oct 16 04:54:04 hecnet-us-east-gw sshd[2441824]: Invalid user helen from 114.141.59.195 port 39446", "Oct 16 04:54:06 hecnet-us-east-gw sshd[2441824]: Failed password for invalid user helen from 114.141.59.195 port 39446 ssh2", "Oct 16 04:54:08 hecnet-us-east-gw sshd[2441824]: Disconnected from invalid user helen 114.141.59.195 port 39446 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2441824]: ", "ip4": "114.141.59.195", "users": "['helen']", "user": "helen"} 114.141.59.196 #sshd|1792126540|172800|1|{"matches": ["Oct 16 04:55:37 hecnet-us-east-gw sshd[2441850]: Invalid user useradmin from 114.141.59.196 port 34982", "Oct 16 04:55:40 hecnet-us-east-gw sshd[2441850]: Failed password for invalid user useradmin from 114.141.59.196 port 34982 ssh2", "Oct 16 04:55:40 hecnet-us-east-gw sshd[2441850]: Disconnected from invalid user useradmin 114.141.59.196 port 34982 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2441850]: ", "ip4": "114.141.59.196", "users": "['useradmin']", "user": "useradmin"} 34.156.220.173 #sshd|1792127556|172800|1|{"matches": ["Oct 16 05:12:31 hecnet-us-east-gw sshd[2441991]: Invalid user admin from 34.156.220.173 port 11316", "Oct 16 05:12:33 hecnet-us-east-gw sshd[2441991]: Failed none for invalid user admin from 34.156.220.173 port 11316 ssh2", "Oct 16 05:12:36 hecnet-us-east-gw sshd[2441991]: Failed password for invalid user admin from 34.156.220.173 port 11316 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2441991]: ", "ip4": "34.156.220.173", "users": "['admin']", "user": "admin"} 106.12.179.53 #sshd|1792127954|172800|1|{"matches": ["Oct 16 05:19:10 hecnet-us-east-gw sshd[2442093]: Invalid user android from 106.12.179.53 port 51534", "Oct 16 05:19:12 hecnet-us-east-gw sshd[2442093]: Failed password for invalid user android from 106.12.179.53 port 51534 ssh2", "Oct 16 05:19:14 hecnet-us-east-gw sshd[2442093]: Disconnected from invalid user android 106.12.179.53 port 51534 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2442093]: ", "ip4": "106.12.179.53", "users": "['android']", "user": "android"} 114.141.59.194 #sshd|1792128090|172800|1|{"matches": ["Oct 16 05:21:27 hecnet-us-east-gw sshd[2442119]: Invalid user runner from 114.141.59.194 port 33184", "Oct 16 05:21:29 hecnet-us-east-gw sshd[2442119]: Failed password for invalid user runner from 114.141.59.194 port 33184 ssh2", "Oct 16 05:21:30 hecnet-us-east-gw sshd[2442119]: Disconnected from invalid user runner 114.141.59.194 port 33184 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2442119]: ", "ip4": "114.141.59.194", "users": "['runner']", "user": "runner"} 101.33.78.144 #sshd|1792128895|172800|1|{"matches": ["Oct 16 05:34:50 hecnet-us-east-gw sshd[2442211]: Invalid user orangepi from 101.33.78.144 port 53940", "Oct 16 05:34:52 hecnet-us-east-gw sshd[2442211]: Failed none for invalid user orangepi from 101.33.78.144 port 53940 ssh2", "Oct 16 05:34:55 hecnet-us-east-gw sshd[2442211]: Failed password for invalid user orangepi from 101.33.78.144 port 53940 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2442211]: ", "ip4": "101.33.78.144", "users": "['orangepi']", "user": "orangepi"} 195.178.110.217 #sshd|1792132863|172800|1|{"matches": ["Oct 16 06:41:01 hecnet-us-east-gw sshd[2442875]: Failed none for invalid user root from 195.178.110.217 port 44314 ssh2", "Oct 16 06:41:03 hecnet-us-east-gw sshd[2442875]: Failed password for invalid user root from 195.178.110.217 port 44314 ssh2", "Oct 16 06:41:03 hecnet-us-east-gw sshd[2442875]: Connection closed by invalid user root 195.178.110.217 port 44314 [preauth]"], "failures": 4, "mlfid": " hecnet-us-east-gw sshd[2442875]: ", "ip4": "195.178.110.217", "users": "['root']", "user": "root"} 36.253.9.128 #sshd|1792136523|172800|1|{"matches": ["Oct 16 07:42:01 hecnet-us-east-gw sshd[2443322]: User root from 36.253.9.128 not allowed because not listed in AllowUsers", "Oct 16 07:42:03 hecnet-us-east-gw sshd[2443322]: Failed password for invalid user root from 36.253.9.128 port 34974 ssh2", "Oct 16 07:42:03 hecnet-us-east-gw sshd[2443322]: Disconnected from invalid user root 36.253.9.128 port 34974 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2443322]: ", "ip4": "36.253.9.128", "users": "['root']", "user": "root"} 193.24.211.219 #sshd|1792138280|172800|1|{"matches": ["Oct 16 08:11:14 hecnet-us-east-gw sshd[2443520]: Invalid user samurai from 193.24.211.219 port 2547", "Oct 16 08:11:17 hecnet-us-east-gw sshd[2443520]: Failed none for invalid user samurai from 193.24.211.219 port 2547 ssh2", "Oct 16 08:11:20 hecnet-us-east-gw sshd[2443520]: Failed password for invalid user samurai from 193.24.211.219 port 2547 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2443520]: ", "ip4": "193.24.211.219", "users": "['samurai']", "user": "samurai"} 184.168.21.211 #sshd|1792139091|172800|1|{"matches": ["Oct 16 08:24:49 hecnet-us-east-gw sshd[2443636]: Invalid user milad from 184.168.21.211 port 51832", "Oct 16 08:24:51 hecnet-us-east-gw sshd[2443636]: Failed password for invalid user milad from 184.168.21.211 port 51832 ssh2", "Oct 16 08:24:51 hecnet-us-east-gw sshd[2443636]: Disconnected from invalid user milad 184.168.21.211 port 51832 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2443636]: ", "ip4": "184.168.21.211", "users": "['milad']", "user": "milad"} 120.76.158.232 #sshd|1792139179|172800|1|{"matches": ["Oct 16 08:26:14 hecnet-us-east-gw sshd[2443688]: Invalid user minecraft from 120.76.158.232 port 38880", "Oct 16 08:26:17 hecnet-us-east-gw sshd[2443688]: Failed none for invalid user minecraft from 120.76.158.232 port 38880 ssh2", "Oct 16 08:26:19 hecnet-us-east-gw sshd[2443688]: Failed password for invalid user minecraft from 120.76.158.232 port 38880 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2443688]: ", "ip4": "120.76.158.232", "users": "['minecraft']", "user": "minecraft"} 66.116.224.33 #sshd|1792139565|172800|1|{"matches": ["Oct 16 08:32:40 hecnet-us-east-gw sshd[2443739]: Invalid user iqbal from 66.116.224.33 port 57138", "Oct 16 08:32:43 hecnet-us-east-gw sshd[2443739]: Failed password for invalid user iqbal from 66.116.224.33 port 57138 ssh2", "Oct 16 08:32:45 hecnet-us-east-gw sshd[2443739]: Disconnected from invalid user iqbal 66.116.224.33 port 57138 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2443739]: ", "ip4": "66.116.224.33", "users": "['iqbal']", "user": "iqbal"} 203.83.238.175 #sshd|1792141269|172800|1|{"matches": ["Oct 16 09:01:05 hecnet-us-east-gw sshd[2443941]: User root from 203.83.238.175 not allowed because not listed in AllowUsers", "Oct 16 09:01:07 hecnet-us-east-gw sshd[2443941]: Failed password for invalid user root from 203.83.238.175 port 60438 ssh2", "Oct 16 09:01:09 hecnet-us-east-gw sshd[2443941]: Disconnected from invalid user root 203.83.238.175 port 60438 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2443941]: ", "ip4": "203.83.238.175", "users": "['root']", "user": "root"} 59.126.224.134 #sshd|1792141913|172800|1|{"matches": ["Oct 16 09:11:49 hecnet-us-east-gw sshd[2444042]: Invalid user lol from 59.126.224.134 port 32778", "Oct 16 09:11:51 hecnet-us-east-gw sshd[2444042]: Failed password for invalid user lol from 59.126.224.134 port 32778 ssh2", "Oct 16 09:11:53 hecnet-us-east-gw sshd[2444042]: Disconnected from invalid user lol 59.126.224.134 port 32778 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2444042]: ", "ip4": "59.126.224.134", "users": "['lol']", "user": "lol"} 4.196.200.15 #lighttpd-scans|1792144202|172800|1|{"matches": [["", "Oct 16 09:49:59", " hecnet-us-east-gw lighttpd[1017]: 4.196.200.15 impvax.duckdns.org - [16/Oct/2026:09:49:58 +0000] \"GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1\" 404 341 \"-\" \"-\""], "Oct 16 09:50:00 hecnet-us-east-gw lighttpd[1017]: 4.196.200.15 impvax.duckdns.org - [16/Oct/2026:09:49:59 +0000] \"GET /this_is_a_new_hello_world.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 16 09:50:00 hecnet-us-east-gw lighttpd[1017]: 4.196.200.15 impvax.duckdns.org - [16/Oct/2026:09:50:00 +0000] \"GET /app.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 16 09:50:00 hecnet-us-east-gw lighttpd[1017]: 4.196.200.15 impvax.duckdns.org - [16/Oct/2026:09:50:00 +0000] \"GET /bootstrap.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 16 09:50:01 hecnet-us-east-gw lighttpd[1017]: 4.196.200.15 impvax.duckdns.org - [16/Oct/2026:09:50:01 +0000] \"GET /core.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 16 09:50:01 hecnet-us-east-gw lighttpd[1017]: 4.196.200.15 impvax.duckdns.org - [16/Oct/2026:09:50:01 +0000] \"GET /footer.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 16 09:50:02 hecnet-us-east-gw lighttpd[1017]: 4.196.200.15 impvax.duckdns.org - [16/Oct/2026:09:50:02 +0000] \"GET /global.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 16 09:50:02 hecnet-us-east-gw lighttpd[1017]: 4.196.200.15 impvax.duckdns.org - [16/Oct/2026:09:50:02 +0000] \"GET /header.php HTTP/1.1\" 404 341 \"-\" \"-\""], "failures": 8, "ip4": "4.196.200.15"} 185.233.3.95 #sshd|1792145745|172800|1|{"matches": ["Oct 16 10:15:43 hecnet-us-east-gw sshd[2444507]: Invalid user vadim from 185.233.3.95 port 60270", "Oct 16 10:15:45 hecnet-us-east-gw sshd[2444507]: Failed password for invalid user vadim from 185.233.3.95 port 60270 ssh2", "Oct 16 10:15:45 hecnet-us-east-gw sshd[2444507]: Disconnected from invalid user vadim 185.233.3.95 port 60270 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2444507]: ", "ip4": "185.233.3.95", "users": "['vadim']", "user": "vadim"} 92.118.39.14 #sshd|1792146161|172800|1|{"matches": ["Oct 16 10:22:34 hecnet-us-east-gw sshd[2444559]: User root from 92.118.39.14 not allowed because not listed in AllowUsers", "Oct 16 10:22:37 hecnet-us-east-gw sshd[2444559]: Failed none for invalid user root from 92.118.39.14 port 50204 ssh2", "Oct 16 10:22:41 hecnet-us-east-gw sshd[2444559]: Failed password for invalid user root from 92.118.39.14 port 50204 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2444559]: ", "ip4": "92.118.39.14", "users": "['root']", "user": "root"} 85.198.19.251 #sshd|1792146533|172800|1|{"matches": ["Oct 16 10:28:50 hecnet-us-east-gw sshd[2444626]: Invalid user ahmed from 85.198.19.251 port 22934", "Oct 16 10:28:52 hecnet-us-east-gw sshd[2444626]: Failed password for invalid user ahmed from 85.198.19.251 port 22934 ssh2", "Oct 16 10:28:53 hecnet-us-east-gw sshd[2444626]: Disconnected from invalid user ahmed 85.198.19.251 port 22934 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2444626]: ", "ip4": "85.198.19.251", "users": "['ahmed']", "user": "ahmed"} 35.187.231.181 #sshd|1792146626|172800|1|{"matches": ["Oct 16 10:30:20 hecnet-us-east-gw sshd[2444666]: User root from 35.187.231.181 not allowed because not listed in AllowUsers", "Oct 16 10:30:22 hecnet-us-east-gw sshd[2444666]: Failed none for invalid user root from 35.187.231.181 port 39156 ssh2", "Oct 16 10:30:26 hecnet-us-east-gw sshd[2444666]: Failed password for invalid user root from 35.187.231.181 port 39156 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2444666]: ", "ip4": "35.187.231.181", "users": "['root']", "user": "root"} 103.172.236.15 #sshd|1792146650|172800|1|{"matches": ["Oct 16 10:30:47 hecnet-us-east-gw sshd[2444690]: Invalid user admin from 103.172.236.15 port 40848", "Oct 16 10:30:48 hecnet-us-east-gw sshd[2444690]: Failed password for invalid user admin from 103.172.236.15 port 40848 ssh2", "Oct 16 10:30:50 hecnet-us-east-gw sshd[2444690]: Disconnected from invalid user admin 103.172.236.15 port 40848 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2444690]: ", "ip4": "103.172.236.15", "users": "['admin']", "user": "admin"} 83.168.110.192 #sshd|1792146842|172800|1|{"matches": ["Oct 16 10:34:00 hecnet-us-east-gw sshd[2444719]: Invalid user db-user from 83.168.110.192 port 50798", "Oct 16 10:34:02 hecnet-us-east-gw sshd[2444719]: Failed password for invalid user db-user from 83.168.110.192 port 50798 ssh2", "Oct 16 10:34:02 hecnet-us-east-gw sshd[2444719]: Disconnected from invalid user db-user 83.168.110.192 port 50798 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2444719]: ", "ip4": "83.168.110.192", "users": "['db-user']", "user": "db-user"} 120.28.109.188 #sshd|1792146929|172800|1|{"matches": ["Oct 16 10:35:25 hecnet-us-east-gw sshd[2444778]: Invalid user jason from 120.28.109.188 port 37916", "Oct 16 10:35:27 hecnet-us-east-gw sshd[2444778]: Failed password for invalid user jason from 120.28.109.188 port 37916 ssh2", "Oct 16 10:35:29 hecnet-us-east-gw sshd[2444778]: Disconnected from invalid user jason 120.28.109.188 port 37916 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2444778]: ", "ip4": "120.28.109.188", "users": "['jason']", "user": "jason"} 189.146.113.120 #sshd|1792147004|172800|1|{"matches": ["Oct 16 10:36:42 hecnet-us-east-gw sshd[2444801]: Invalid user test from 189.146.113.120 port 43866", "Oct 16 10:36:44 hecnet-us-east-gw sshd[2444801]: Failed password for invalid user test from 189.146.113.120 port 43866 ssh2", "Oct 16 10:36:44 hecnet-us-east-gw sshd[2444801]: Disconnected from invalid user test 189.146.113.120 port 43866 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2444801]: ", "ip4": "189.146.113.120", "users": "['test']", "user": "test"} 74.225.203.7 #lighttpd-scans|1792147836|172800|1|{"matches": [["", "Oct 16 10:50:34", " hecnet-us-east-gw lighttpd[1017]: 74.225.203.7 impvax.duckdns.org - [16/Oct/2026:10:50:34 +0000] \"GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1\" 404 341 \"-\" \"-\""], "Oct 16 10:50:34 hecnet-us-east-gw lighttpd[1017]: 74.225.203.7 impvax.duckdns.org - [16/Oct/2026:10:50:34 +0000] \"GET /this_is_a_new_hello_world.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 16 10:50:34 hecnet-us-east-gw lighttpd[1017]: 74.225.203.7 impvax.duckdns.org - [16/Oct/2026:10:50:34 +0000] \"GET /init-notica.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 16 10:50:35 hecnet-us-east-gw lighttpd[1017]: 74.225.203.7 impvax.duckdns.org - [16/Oct/2026:10:50:35 +0000] \"GET /index/function.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 16 10:50:35 hecnet-us-east-gw lighttpd[1017]: 74.225.203.7 impvax.duckdns.org - [16/Oct/2026:10:50:35 +0000] \"GET /wp-trbacks.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 16 10:50:36 hecnet-us-east-gw lighttpd[1017]: 74.225.203.7 impvax.duckdns.org - [16/Oct/2026:10:50:36 +0000] \"GET /go.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 16 10:50:36 hecnet-us-east-gw lighttpd[1017]: 74.225.203.7 impvax.duckdns.org - [16/Oct/2026:10:50:36 +0000] \"GET /1ac.php HTTP/1.1\" 404 341 \"-\" \"-\"", "Oct 16 10:50:36 hecnet-us-east-gw lighttpd[1017]: 74.225.203.7 impvax.duckdns.org - [16/Oct/2026:10:50:36 +0000] \"GET /40341.php HTTP/1.1\" 404 341 \"-\" \"-\""], "failures": 8, "ip4": "74.225.203.7"} 180.167.207.234 #sshd|1792149053|172800|1|{"matches": ["Oct 16 10:54:46 hecnet-us-east-gw sshd[2444952]: Failed password for invalid user proxyuser from 180.167.207.234 port 37014 ssh2", "Oct 16 11:10:51 hecnet-us-east-gw sshd[2445070]: Connection from 180.167.207.234 port 40599 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 16 11:10:53 hecnet-us-east-gw sshd[2445070]: Invalid user master from 180.167.207.234 port 40599"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2444952]: ", "ip4": "180.167.207.234", "users": "['proxyuser']", "user": "proxyuser"} 80.94.95.109 #sshd|1792149893|172800|1|{"matches": ["Oct 16 11:24:47 hecnet-us-east-gw sshd[2445194]: User root from 80.94.95.109 not allowed because not listed in AllowUsers", "Oct 16 11:24:49 hecnet-us-east-gw sshd[2445194]: Failed none for invalid user root from 80.94.95.109 port 36824 ssh2", "Oct 16 11:24:53 hecnet-us-east-gw sshd[2445194]: Failed password for invalid user root from 80.94.95.109 port 36824 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2445194]: ", "ip4": "80.94.95.109", "users": "['root']", "user": "root"} 220.179.81.109 #sshd|1792150228|172800|1|{"matches": ["Oct 16 11:08:44 hecnet-us-east-gw sshd[2445040]: Failed password for invalid user ubuntu from 220.179.81.109 port 50322 ssh2", "Oct 16 11:30:27 hecnet-us-east-gw sshd[2445291]: Connection from 220.179.81.109 port 49884 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 16 11:30:28 hecnet-us-east-gw sshd[2445291]: Invalid user ubuntu from 220.179.81.109 port 49884"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2445040]: ", "ip4": "220.179.81.109", "users": "['ubuntu']", "user": "ubuntu"} 109.160.32.177 #sshd|1792152595|172800|1|{"matches": ["Oct 16 12:08:39 hecnet-us-east-gw sshd[2445565]: Failed none for invalid user from 109.160.32.177 port 53306 ssh2", "Oct 16 12:09:55 hecnet-us-east-gw sshd[2445570]: Connection from 109.160.32.177 port 40466 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 16 12:09:55 hecnet-us-east-gw sshd[2445570]: Invalid user s10olamide from 109.160.32.177 port 40466"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2445565]: ", "ip4": "109.160.32.177", "user": ""} 103.159.2.113 #sshd|1792158989|172800|1|{"matches": ["Oct 16 13:56:24 hecnet-us-east-gw sshd[2446295]: Invalid user oneadmin from 103.159.2.113 port 59022", "Oct 16 13:56:26 hecnet-us-east-gw sshd[2446295]: Failed none for invalid user oneadmin from 103.159.2.113 port 59022 ssh2", "Oct 16 13:56:29 hecnet-us-east-gw sshd[2446295]: Failed password for invalid user oneadmin from 103.159.2.113 port 59022 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2446295]: ", "ip4": "103.159.2.113", "users": "['oneadmin']", "user": "oneadmin"} 109.160.32.45 #sshd|1792159066|172800|1|{"matches": ["Oct 16 13:56:29 hecnet-us-east-gw sshd[2446297]: Failed none for invalid user from 109.160.32.45 port 37850 ssh2", "Oct 16 13:57:43 hecnet-us-east-gw sshd[2446324]: Connection from 109.160.32.45 port 59826 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 16 13:57:46 hecnet-us-east-gw sshd[2446324]: Invalid user sybase from 109.160.32.45 port 59826"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2446297]: ", "ip4": "109.160.32.45", "user": ""} 109.160.32.38 #sshd|1792159815|172800|1|{"matches": ["Oct 16 14:09:17 hecnet-us-east-gw sshd[2446420]: Failed none for invalid user from 109.160.32.38 port 35316 ssh2", "Oct 16 14:10:15 hecnet-us-east-gw sshd[2446440]: Connection from 109.160.32.38 port 34258 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 16 14:10:15 hecnet-us-east-gw sshd[2446440]: Invalid user hyx from 109.160.32.38 port 34258"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2446420]: ", "ip4": "109.160.32.38", "user": ""} 62.11.129.215 #sshd|1792162332|172800|1|{"matches": ["Oct 16 14:52:10 hecnet-us-east-gw sshd[2446759]: Invalid user user123 from 62.11.129.215 port 53582", "Oct 16 14:52:12 hecnet-us-east-gw sshd[2446759]: Failed password for invalid user user123 from 62.11.129.215 port 53582 ssh2", "Oct 16 14:52:12 hecnet-us-east-gw sshd[2446759]: Disconnected from invalid user user123 62.11.129.215 port 53582 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2446759]: ", "ip4": "62.11.129.215", "users": "['user123']", "user": "user123"} 103.237.144.204 #sshd|1792162779|172800|1|{"matches": ["Oct 16 14:59:37 hecnet-us-east-gw sshd[2446799]: Invalid user postgres from 103.237.144.204 port 36556", "Oct 16 14:59:39 hecnet-us-east-gw sshd[2446799]: Failed password for invalid user postgres from 103.237.144.204 port 36556 ssh2", "Oct 16 14:59:39 hecnet-us-east-gw sshd[2446799]: Disconnected from invalid user postgres 103.237.144.204 port 36556 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2446799]: ", "ip4": "103.237.144.204", "users": "['postgres']", "user": "postgres"} 202.103.157.115 #sshd|1792168165|172800|1|{"matches": ["Oct 16 16:29:23 hecnet-us-east-gw sshd[2447502]: Invalid user mumble from 202.103.157.115 port 33052", "Oct 16 16:29:24 hecnet-us-east-gw sshd[2447502]: Failed password for invalid user mumble from 202.103.157.115 port 33052 ssh2", "Oct 16 16:29:25 hecnet-us-east-gw sshd[2447502]: Disconnected from invalid user mumble 202.103.157.115 port 33052 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2447502]: ", "ip4": "202.103.157.115", "users": "['mumble']", "user": "mumble"} 103.217.245.28 #sshd|1792168192|172800|1|{"matches": ["Oct 16 16:29:49 hecnet-us-east-gw sshd[2447526]: User root from 103.217.245.28 not allowed because not listed in AllowUsers", "Oct 16 16:29:51 hecnet-us-east-gw sshd[2447526]: Failed password for invalid user root from 103.217.245.28 port 53486 ssh2", "Oct 16 16:29:52 hecnet-us-east-gw sshd[2447526]: Disconnected from invalid user root 103.217.245.28 port 53486 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2447526]: ", "ip4": "103.217.245.28", "users": "['root']", "user": "root"} 194.226.49.237 #sshd|1792168366|172800|1|{"matches": ["Oct 16 16:32:42 hecnet-us-east-gw sshd[2447566]: User root from 194.226.49.237 not allowed because not listed in AllowUsers", "Oct 16 16:32:44 hecnet-us-east-gw sshd[2447566]: Failed password for invalid user root from 194.226.49.237 port 33642 ssh2", "Oct 16 16:32:46 hecnet-us-east-gw sshd[2447566]: Disconnected from invalid user root 194.226.49.237 port 33642 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2447566]: ", "ip4": "194.226.49.237", "users": "['root']", "user": "root"} 200.175.149.58 #sshd|1792170196|172800|1|{"matches": ["Oct 16 17:03:12 hecnet-us-east-gw sshd[2447781]: User root from 200.175.149.58 not allowed because not listed in AllowUsers", "Oct 16 17:03:14 hecnet-us-east-gw sshd[2447781]: Failed password for invalid user root from 200.175.149.58 port 42712 ssh2", "Oct 16 17:03:16 hecnet-us-east-gw sshd[2447781]: Disconnected from invalid user root 200.175.149.58 port 42712 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2447781]: ", "ip4": "200.175.149.58", "users": "['root']", "user": "root"} 58.186.20.101 #sshd|1792170251|172800|1|{"matches": ["Oct 16 17:04:07 hecnet-us-east-gw sshd[2447804]: User root from 58.186.20.101 not allowed because not listed in AllowUsers", "Oct 16 17:04:10 hecnet-us-east-gw sshd[2447804]: Failed password for invalid user root from 58.186.20.101 port 35574 ssh2", "Oct 16 17:04:11 hecnet-us-east-gw sshd[2447804]: Disconnected from invalid user root 58.186.20.101 port 35574 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2447804]: ", "ip4": "58.186.20.101", "users": "['root']", "user": "root"} 162.241.29.37 #sshd|1792170333|172800|1|{"matches": ["Oct 16 17:05:29 hecnet-us-east-gw sshd[2447864]: Invalid user speedtest from 162.241.29.37 port 56653", "Oct 16 17:05:31 hecnet-us-east-gw sshd[2447864]: Failed password for invalid user speedtest from 162.241.29.37 port 56653 ssh2", "Oct 16 17:05:33 hecnet-us-east-gw sshd[2447864]: Disconnected from invalid user speedtest 162.241.29.37 port 56653 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2447864]: ", "ip4": "162.241.29.37", "users": "['speedtest']", "user": "speedtest"} 182.93.50.90 #sshd|1792170399|172800|1|{"matches": ["Oct 16 17:06:35 hecnet-us-east-gw sshd[2447886]: Invalid user mahesh from 182.93.50.90 port 37896", "Oct 16 17:06:37 hecnet-us-east-gw sshd[2447886]: Failed password for invalid user mahesh from 182.93.50.90 port 37896 ssh2", "Oct 16 17:06:39 hecnet-us-east-gw sshd[2447886]: Disconnected from invalid user mahesh 182.93.50.90 port 37896 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2447886]: ", "ip4": "182.93.50.90", "users": "['mahesh']", "user": "mahesh"} 201.16.238.49 #sshd|1792170399|172800|1|{"matches": ["Oct 16 17:06:35 hecnet-us-east-gw sshd[2447888]: User root from 201.16.238.49 not allowed because not listed in AllowUsers", "Oct 16 17:06:37 hecnet-us-east-gw sshd[2447888]: Failed password for invalid user root from 201.16.238.49 port 44278 ssh2", "Oct 16 17:06:39 hecnet-us-east-gw sshd[2447888]: Disconnected from invalid user root 201.16.238.49 port 44278 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2447888]: ", "ip4": "201.16.238.49", "users": "['root']", "user": "root"} 115.191.30.208 #sshd|1792171272|172800|1|{"matches": ["Oct 16 17:21:10 hecnet-us-east-gw sshd[2448042]: User root from 115.191.30.208 not allowed because not listed in AllowUsers", "Oct 16 17:21:12 hecnet-us-east-gw sshd[2448042]: Failed password for invalid user root from 115.191.30.208 port 46908 ssh2", "Oct 16 17:21:12 hecnet-us-east-gw sshd[2448042]: Disconnected from invalid user root 115.191.30.208 port 46908 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2448042]: ", "ip4": "115.191.30.208", "users": "['root']", "user": "root"} 181.188.237.211 #sshd|1792174217|172800|1|{"matches": ["Oct 16 18:10:14 hecnet-us-east-gw sshd[2448381]: Invalid user caja01 from 181.188.237.211 port 60600", "Oct 16 18:10:16 hecnet-us-east-gw sshd[2448381]: Failed password for invalid user caja01 from 181.188.237.211 port 60600 ssh2", "Oct 16 18:10:17 hecnet-us-east-gw sshd[2448381]: Disconnected from invalid user caja01 181.188.237.211 port 60600 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2448381]: ", "ip4": "181.188.237.211", "users": "['caja01']", "user": "caja01"} 97.93.43.157 #sshd|1792174752|172800|1|{"matches": ["Oct 16 18:19:09 hecnet-us-east-gw sshd[2448477]: Invalid user www from 97.93.43.157 port 35172", "Oct 16 18:19:11 hecnet-us-east-gw sshd[2448477]: Failed password for invalid user www from 97.93.43.157 port 35172 ssh2", "Oct 16 18:19:12 hecnet-us-east-gw sshd[2448477]: Disconnected from invalid user www 97.93.43.157 port 35172 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2448477]: ", "ip4": "97.93.43.157", "users": "['www']", "user": "www"} 70.120.203.193 #sshd|1792174862|172800|1|{"matches": ["Oct 16 18:20:58 hecnet-us-east-gw sshd[2448505]: Invalid user user1 from 70.120.203.193 port 50346", "Oct 16 18:21:00 hecnet-us-east-gw sshd[2448505]: Failed password for invalid user user1 from 70.120.203.193 port 50346 ssh2", "Oct 16 18:21:02 hecnet-us-east-gw sshd[2448505]: Disconnected from invalid user user1 70.120.203.193 port 50346 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2448505]: ", "ip4": "70.120.203.193", "users": "['user1']", "user": "user1"} 2.57.122.168 #sshd|1792175928|172800|1|{"matches": ["Oct 16 18:38:41 hecnet-us-east-gw sshd[2448643]: User root from 2.57.122.168 not allowed because not listed in AllowUsers", "Oct 16 18:38:43 hecnet-us-east-gw sshd[2448643]: Failed none for invalid user root from 2.57.122.168 port 37352 ssh2", "Oct 16 18:38:48 hecnet-us-east-gw sshd[2448643]: Failed password for invalid user root from 2.57.122.168 port 37352 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2448643]: ", "ip4": "2.57.122.168", "users": "['root']", "user": "root"} 2.57.122.238 #sshd|1792176398|172800|1|{"matches": ["Oct 16 18:46:33 hecnet-us-east-gw sshd[2448749]: Invalid user sol from 2.57.122.238 port 57932", "Oct 16 18:46:35 hecnet-us-east-gw sshd[2448749]: Failed none for invalid user sol from 2.57.122.238 port 57932 ssh2", "Oct 16 18:46:38 hecnet-us-east-gw sshd[2448749]: Failed password for invalid user sol from 2.57.122.238 port 57932 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2448749]: ", "ip4": "2.57.122.238", "users": "['sol']", "user": "sol"} 109.160.32.148 #sshd|1792182497|172800|1|{"matches": ["Oct 16 20:27:32 hecnet-us-east-gw sshd[2449842]: Failed none for invalid user from 109.160.32.148 port 49464 ssh2", "Oct 16 20:28:17 hecnet-us-east-gw sshd[2449848]: Connection from 109.160.32.148 port 46656 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 16 20:28:17 hecnet-us-east-gw sshd[2449848]: Invalid user rezvani from 109.160.32.148 port 46656"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2449842]: ", "ip4": "109.160.32.148", "user": ""} 148.222.199.195 #sshd|1792183201|172800|1|{"matches": ["Oct 16 20:39:59 hecnet-us-east-gw sshd[2449944]: Invalid user gis from 148.222.199.195 port 35145", "Oct 16 20:40:01 hecnet-us-east-gw sshd[2449944]: Failed password for invalid user gis from 148.222.199.195 port 35145 ssh2", "Oct 16 20:40:01 hecnet-us-east-gw sshd[2449944]: Disconnected from invalid user gis 148.222.199.195 port 35145 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2449944]: ", "ip4": "148.222.199.195", "users": "['gis']", "user": "gis"} 209.141.47.217 #sshd|1792183372|172800|1|{"matches": ["Oct 16 20:42:48 hecnet-us-east-gw sshd[2449994]: Invalid user saad from 209.141.47.217 port 56554", "Oct 16 20:42:50 hecnet-us-east-gw sshd[2449994]: Failed password for invalid user saad from 209.141.47.217 port 56554 ssh2", "Oct 16 20:42:52 hecnet-us-east-gw sshd[2449994]: Disconnected from invalid user saad 209.141.47.217 port 56554 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2449994]: ", "ip4": "209.141.47.217", "users": "['saad']", "user": "saad"} 167.172.51.139 #sshd|1792187126|172800|1|{"matches": ["Oct 16 21:45:21 hecnet-us-east-gw sshd[2450477]: Invalid user sol from 167.172.51.139 port 50326", "Oct 16 21:45:23 hecnet-us-east-gw sshd[2450477]: Failed none for invalid user sol from 167.172.51.139 port 50326 ssh2", "Oct 16 21:45:26 hecnet-us-east-gw sshd[2450477]: Failed password for invalid user sol from 167.172.51.139 port 50326 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2450477]: ", "ip4": "167.172.51.139", "users": "['sol']", "user": "sol"} 157.245.39.77 #sshd|1792187299|172800|1|{"matches": ["Oct 16 21:48:14 hecnet-us-east-gw sshd[2450524]: Invalid user james from 157.245.39.77 port 51816", "Oct 16 21:48:15 hecnet-us-east-gw sshd[2450524]: Failed none for invalid user james from 157.245.39.77 port 51816 ssh2", "Oct 16 21:48:19 hecnet-us-east-gw sshd[2450524]: Failed password for invalid user james from 157.245.39.77 port 51816 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2450524]: ", "ip4": "157.245.39.77", "users": "['james']", "user": "james"} 115.190.215.101 #sshd|1792187668|172800|1|{"matches": ["Oct 16 21:54:26 hecnet-us-east-gw sshd[2450562]: User root from 115.190.215.101 not allowed because not listed in AllowUsers", "Oct 16 21:54:27 hecnet-us-east-gw sshd[2450562]: Failed password for invalid user root from 115.190.215.101 port 55930 ssh2", "Oct 16 21:54:28 hecnet-us-east-gw sshd[2450562]: Disconnected from invalid user root 115.190.215.101 port 55930 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2450562]: ", "ip4": "115.190.215.101", "users": "['root']", "user": "root"} 64.227.39.106 #sshd|1792187681|172800|1|{"matches": ["Oct 16 21:54:36 hecnet-us-east-gw sshd[2450587]: Invalid user user from 64.227.39.106 port 60894", "Oct 16 21:54:38 hecnet-us-east-gw sshd[2450587]: Failed none for invalid user user from 64.227.39.106 port 60894 ssh2", "Oct 16 21:54:41 hecnet-us-east-gw sshd[2450587]: Failed password for invalid user user from 64.227.39.106 port 60894 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2450587]: ", "ip4": "64.227.39.106", "users": "['user']", "user": "user"} 165.232.35.59 #sshd|1792188168|172800|1|{"matches": ["Oct 16 22:02:45 hecnet-us-east-gw sshd[2450640]: Failed none for invalid user user from 165.232.35.59 port 53362 ssh2", "Oct 16 22:02:48 hecnet-us-east-gw sshd[2450640]: Failed password for invalid user user from 165.232.35.59 port 53362 ssh2", "Oct 16 22:02:48 hecnet-us-east-gw sshd[2450640]: Connection closed by invalid user user 165.232.35.59 port 53362 [preauth]"], "failures": 4, "mlfid": " hecnet-us-east-gw sshd[2450640]: ", "ip4": "165.232.35.59", "users": "['user']", "user": "user"} 159.65.82.105 #sshd|1792188220|172800|1|{"matches": ["Oct 16 22:03:35 hecnet-us-east-gw sshd[2450665]: Invalid user ubuntu from 159.65.82.105 port 47632", "Oct 16 22:03:37 hecnet-us-east-gw sshd[2450665]: Failed none for invalid user ubuntu from 159.65.82.105 port 47632 ssh2", "Oct 16 22:03:40 hecnet-us-east-gw sshd[2450665]: Failed password for invalid user ubuntu from 159.65.82.105 port 47632 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2450665]: ", "ip4": "159.65.82.105", "users": "['ubuntu']", "user": "ubuntu"} 161.35.42.116 #sshd|1792188418|172800|1|{"matches": ["Oct 16 22:06:53 hecnet-us-east-gw sshd[2450730]: Invalid user admin from 161.35.42.116 port 38050", "Oct 16 22:06:54 hecnet-us-east-gw sshd[2450730]: Failed none for invalid user admin from 161.35.42.116 port 38050 ssh2", "Oct 16 22:06:58 hecnet-us-east-gw sshd[2450730]: Failed password for invalid user admin from 161.35.42.116 port 38050 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2450730]: ", "ip4": "161.35.42.116", "users": "['admin']", "user": "admin"} 201.92.186.12 #sshd|1792188594|172800|1|{"matches": ["Oct 16 22:09:52 hecnet-us-east-gw sshd[2450760]: User root from 201.92.186.12 not allowed because not listed in AllowUsers", "Oct 16 22:09:53 hecnet-us-east-gw sshd[2450760]: Failed password for invalid user root from 201.92.186.12 port 39768 ssh2", "Oct 16 22:09:54 hecnet-us-east-gw sshd[2450760]: Disconnected from invalid user root 201.92.186.12 port 39768 [preauth]"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2450760]: ", "ip4": "201.92.186.12", "users": "['root']", "user": "root"} 46.101.39.48 #sshd|1792188913|172800|1|{"matches": ["Oct 16 22:15:07 hecnet-us-east-gw sshd[2450836]: Invalid user user from 46.101.39.48 port 53870", "Oct 16 22:15:09 hecnet-us-east-gw sshd[2450836]: Failed none for invalid user user from 46.101.39.48 port 53870 ssh2", "Oct 16 22:15:13 hecnet-us-east-gw sshd[2450836]: Failed password for invalid user user from 46.101.39.48 port 53870 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2450836]: ", "ip4": "46.101.39.48", "users": "['user']", "user": "user"} 209.97.131.74 #sshd|1792190620|172800|1|{"matches": ["Oct 16 22:43:35 hecnet-us-east-gw sshd[2451048]: Invalid user user from 209.97.131.74 port 41234", "Oct 16 22:43:37 hecnet-us-east-gw sshd[2451048]: Failed none for invalid user user from 209.97.131.74 port 41234 ssh2", "Oct 16 22:43:40 hecnet-us-east-gw sshd[2451048]: Failed password for invalid user user from 209.97.131.74 port 41234 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2451048]: ", "ip4": "209.97.131.74", "users": "['user']", "user": "user"} 138.68.157.35 #sshd|1792190624|172800|1|{"matches": ["Oct 16 22:43:39 hecnet-us-east-gw sshd[2451050]: Invalid user user from 138.68.157.35 port 40292", "Oct 16 22:43:40 hecnet-us-east-gw sshd[2451050]: Failed none for invalid user user from 138.68.157.35 port 40292 ssh2", "Oct 16 22:43:44 hecnet-us-east-gw sshd[2451050]: Failed password for invalid user user from 138.68.157.35 port 40292 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2451050]: ", "ip4": "138.68.157.35", "users": "['user']", "user": "user"} 77.239.124.61 #sshd|1792190696|172800|1|{"matches": ["Oct 16 22:44:50 hecnet-us-east-gw sshd[2451096]: User root from 77.239.124.61 not allowed because not listed in AllowUsers", "Oct 16 22:44:52 hecnet-us-east-gw sshd[2451096]: Failed none for invalid user root from 77.239.124.61 port 61960 ssh2", "Oct 16 22:44:56 hecnet-us-east-gw sshd[2451096]: Failed password for invalid user root from 77.239.124.61 port 61960 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2451096]: ", "ip4": "77.239.124.61", "users": "['root']", "user": "root"} 159.65.60.217 #sshd|1792191041|172800|1|{"matches": ["Oct 16 22:50:37 hecnet-us-east-gw sshd[2451170]: Invalid user polymarket from 159.65.60.217 port 58682", "Oct 16 22:50:39 hecnet-us-east-gw sshd[2451170]: Failed none for invalid user polymarket from 159.65.60.217 port 58682 ssh2", "Oct 16 22:50:41 hecnet-us-east-gw sshd[2451170]: Failed password for invalid user polymarket from 159.65.60.217 port 58682 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2451170]: ", "ip4": "159.65.60.217", "users": "['polymarket']", "user": "polymarket"} 109.160.32.39 #sshd|1792191851|172800|1|{"matches": ["Oct 16 23:03:06 hecnet-us-east-gw sshd[2451233]: Failed none for invalid user from 109.160.32.39 port 46206 ssh2", "Oct 16 23:04:10 hecnet-us-east-gw sshd[2451237]: Connection from 109.160.32.39 port 58240 on hecnet-us-east-gw.duckdns.org port 22 rdomain \"\"", "Oct 16 23:04:11 hecnet-us-east-gw sshd[2451237]: Invalid user openvpn from 109.160.32.39 port 58240"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2451233]: ", "ip4": "109.160.32.39", "user": ""} 104.248.161.244 #sshd|1792192661|172800|1|{"matches": ["Oct 16 23:17:36 hecnet-us-east-gw sshd[2451388]: Invalid user user from 104.248.161.244 port 42868", "Oct 16 23:17:38 hecnet-us-east-gw sshd[2451388]: Failed none for invalid user user from 104.248.161.244 port 42868 ssh2", "Oct 16 23:17:41 hecnet-us-east-gw sshd[2451388]: Failed password for invalid user user from 104.248.161.244 port 42868 ssh2"], "failures": 3, "mlfid": " hecnet-us-east-gw sshd[2451388]: ", "ip4": "104.248.161.244", "users": "['user']", "user": "user"}