2020-08-09T22:20:18.683490v22018076590370373 sshd[25953]: Failed password for root from 103.95.41.9 port 35143 ssh2
2020-08-09T22:23:24.425658v22018076590370373 sshd[22715]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.95.41.9  user=root
2020-08-09T22:23:26.720079v22018076590370373 sshd[22715]: Failed password for root from 103.95.41.9 port 58995 ssh2
2020-08-09T22:26:23.561677v22018076590370373 sshd[16197]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.95.41.9  user=root
2020-08-09T22:26:25.429691v22018076590370373 sshd[16197]: Failed password for root from 103.95.41.9 port 54615 ssh2
...

Aug  6 11:12:04 rancher-0 sshd[839125]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.95.41.9  user=root
Aug  6 11:12:06 rancher-0 sshd[839125]: Failed password for root from 103.95.41.9 port 53307 ssh2
...

Failed password for invalid user chethan from 103.95.41.9 port 40907 ssh2

Jul 23 19:20:00 rotator sshd\[11494\]: Invalid user jmu from 103.95.41.9Jul 23 19:20:02 rotator sshd\[11494\]: Failed password for invalid user jmu from 103.95.41.9 port 34543 ssh2Jul 23 19:24:07 rotator sshd\[12287\]: Invalid user dbseller from 103.95.41.9Jul 23 19:24:10 rotator sshd\[12287\]: Failed password for invalid user dbseller from 103.95.41.9 port 33703 ssh2Jul 23 19:27:21 rotator sshd\[13075\]: Invalid user lxl from 103.95.41.9Jul 23 19:27:23 rotator sshd\[13075\]: Failed password for invalid user lxl from 103.95.41.9 port 54131 ssh2
...

Jul  3 02:06:53 *** sshd[27532]: Invalid user ubuntu from 103.95.41.9

Jun  6 04:13:37 ovpn sshd\[19399\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.95.41.9  user=root
Jun  6 04:13:39 ovpn sshd\[19399\]: Failed password for root from 103.95.41.9 port 51142 ssh2
Jun  6 04:24:07 ovpn sshd\[6442\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.95.41.9  user=root
Jun  6 04:24:08 ovpn sshd\[6442\]: Failed password for root from 103.95.41.9 port 56946 ssh2
Jun  6 04:28:05 ovpn sshd\[7418\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.95.41.9  user=root

Jun  4 22:30:10 eventyay sshd[7472]: Failed password for root from 103.95.41.9 port 34270 ssh2
Jun  4 22:34:08 eventyay sshd[7561]: Failed password for root from 103.95.41.9 port 35839 ssh2
...

Jun  1 16:05:24 electroncash sshd[17463]: Failed password for root from 103.95.41.9 port 53794 ssh2
Jun  1 16:07:48 electroncash sshd[18090]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.95.41.9  user=root
Jun  1 16:07:50 electroncash sshd[18090]: Failed password for root from 103.95.41.9 port 42158 ssh2
Jun  1 16:10:19 electroncash sshd[18719]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.95.41.9  user=root
Jun  1 16:10:20 electroncash sshd[18719]: Failed password for root from 103.95.41.9 port 58764 ssh2
...

2020-05-15T10:35:35.462395vps773228.ovh.net sshd[23479]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.95.41.9
2020-05-15T10:35:35.441402vps773228.ovh.net sshd[23479]: Invalid user santiago from 103.95.41.9 port 44602
2020-05-15T10:35:37.327109vps773228.ovh.net sshd[23479]: Failed password for invalid user santiago from 103.95.41.9 port 44602 ssh2
2020-05-15T10:40:10.899373vps773228.ovh.net sshd[23540]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.95.41.9  user=root
2020-05-15T10:40:13.185247vps773228.ovh.net sshd[23540]: Failed password for root from 103.95.41.9 port 48424 ssh2
...

Invalid user deploy from 103.95.41.9 port 39721

5x Failed Password

Apr  3 14:51:27 pornomens sshd\[26277\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.95.41.9  user=root
Apr  3 14:51:29 pornomens sshd\[26277\]: Failed password for root from 103.95.41.9 port 49262 ssh2
Apr  3 14:59:23 pornomens sshd\[26352\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.95.41.9  user=root
...

Ssh brute force

Mar 26 05:32:28 home sshd[999]: Invalid user kt from 103.95.41.9 port 36422
Mar 26 05:32:28 home sshd[999]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.95.41.9
Mar 26 05:32:28 home sshd[999]: Invalid user kt from 103.95.41.9 port 36422
Mar 26 05:32:30 home sshd[999]: Failed password for invalid user kt from 103.95.41.9 port 36422 ssh2
Mar 26 05:39:55 home sshd[1191]: Invalid user carol from 103.95.41.9 port 38137
Mar 26 05:39:55 home sshd[1191]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.95.41.9
Mar 26 05:39:55 home sshd[1191]: Invalid user carol from 103.95.41.9 port 38137
Mar 26 05:39:57 home sshd[1191]: Failed password for invalid user carol from 103.95.41.9 port 38137 ssh2
Mar 26 05:44:04 home sshd[1320]: Invalid user of from 103.95.41.9 port 44879
Mar 26 05:44:04 home sshd[1320]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.95.41.9
Mar 26 05:44:04 home sshd[1320]

$f2bV_matches

Attempt to attack host OS, exploiting network vulnerabilities, on 08-01-2020 04:55:08.

smtp probe/invalid login attempt

Unauthorized connection attempt detected from IP address 182.61.104.171 to port 2220 [J]

Lines containing failures of 118.100.49.236
Jan  7 06:39:27 jarvis sshd[8580]: Invalid user cdh from 118.100.49.236 port 60690
Jan  7 06:39:27 jarvis sshd[8580]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.100.49.236 
Jan  7 06:39:29 jarvis sshd[8580]: Failed password for invalid user cdh from 118.100.49.236 port 60690 ssh2
Jan  7 06:39:30 jarvis sshd[8580]: Received disconnect from 118.100.49.236 port 60690:11: Bye Bye [preauth]
Jan  7 06:39:30 jarvis sshd[8580]: Disconnected from invalid user cdh 118.100.49.236 port 60690 [preauth]
Jan  7 07:06:27 jarvis sshd[11358]: Invalid user bbz from 118.100.49.236 port 42892
Jan  7 07:06:27 jarvis sshd[11358]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.100.49.236 
Jan  7 07:06:30 jarvis sshd[11358]: Failed password for invalid user bbz from 118.100.49.236 port 42892 ssh2
Jan  7 07:06:32 jarvis sshd[11358]: Received disconnect from 118........
------------------------------

Jan  8 06:53:46 legacy sshd[30829]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.98.32.5
Jan  8 06:53:48 legacy sshd[30829]: Failed password for invalid user odroid from 183.98.32.5 port 52656 ssh2
Jan  8 06:57:48 legacy sshd[31058]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.98.32.5
...

Jan  7 20:46:49 debian sshd[20375]: Unable to negotiate with 222.186.175.202 port 37636: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1 [preauth]
Jan  8 01:25:01 debian sshd[1096]: Unable to negotiate with 222.186.175.202 port 34332: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1 [preauth]
...

Jan  7 19:39:12 eddieflores sshd\[31513\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.37.136.213  user=root
Jan  7 19:39:13 eddieflores sshd\[31513\]: Failed password for root from 54.37.136.213 port 59624 ssh2
Jan  7 19:43:09 eddieflores sshd\[31924\]: Invalid user redmine from 54.37.136.213
Jan  7 19:43:09 eddieflores sshd\[31924\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.37.136.213
Jan  7 19:43:10 eddieflores sshd\[31924\]: Failed password for invalid user redmine from 54.37.136.213 port 33736 ssh2

(sshd) Failed SSH login from 36.108.170.176 (CN/China/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Jan  8 07:09:29 blur sshd[26478]: Invalid user tapestry from 36.108.170.176 port 37333
Jan  8 07:09:30 blur sshd[26478]: Failed password for invalid user tapestry from 36.108.170.176 port 37333 ssh2
Jan  8 07:17:24 blur sshd[27924]: Invalid user training from 36.108.170.176 port 55858
Jan  8 07:17:26 blur sshd[27924]: Failed password for invalid user training from 36.108.170.176 port 55858 ssh2
Jan  8 07:25:02 blur sshd[29316]: Invalid user jcu from 36.108.170.176 port 52573

unauthorized connection attempt

2020-01-08T05:25:06.205845abusebot-2.cloudsearch.cf sshd[18733]: Invalid user testuser from 51.68.230.54 port 58692
2020-01-08T05:25:06.214709abusebot-2.cloudsearch.cf sshd[18733]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.ip-51-68-230.eu
2020-01-08T05:25:06.205845abusebot-2.cloudsearch.cf sshd[18733]: Invalid user testuser from 51.68.230.54 port 58692
2020-01-08T05:25:08.200458abusebot-2.cloudsearch.cf sshd[18733]: Failed password for invalid user testuser from 51.68.230.54 port 58692 ssh2
2020-01-08T05:26:49.159886abusebot-2.cloudsearch.cf sshd[18821]: Invalid user zimbra from 51.68.230.54 port 50456
2020-01-08T05:26:49.166285abusebot-2.cloudsearch.cf sshd[18821]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.ip-51-68-230.eu
2020-01-08T05:26:49.159886abusebot-2.cloudsearch.cf sshd[18821]: Invalid user zimbra from 51.68.230.54 port 50456
2020-01-08T05:26:50.959844abusebot-2.cloudsearch.cf ssh
...

Jan  8 05:43:21 zx01vmsma01 sshd[171793]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.163.249.18
Jan  8 05:43:23 zx01vmsma01 sshd[171793]: Failed password for invalid user mvd from 188.163.249.18 port 41958 ssh2
...

smtp probe/invalid login attempt

Jan  8 06:37:42 debian-2gb-nbg1-2 kernel: \[721178.603997\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=193.150.6.222 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=244 ID=16435 PROTO=TCP SPT=41011 DPT=2311 WINDOW=1024 RES=0x00 SYN URGP=0

Jan  8 04:55:35 ws26vmsma01 sshd[49561]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=24.35.83.170
Jan  8 04:55:37 ws26vmsma01 sshd[49561]: Failed password for invalid user artemio from 24.35.83.170 port 41070 ssh2
...

Jan  8 06:55:23 ns381471 sshd[3438]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.80.212.113
Jan  8 06:55:25 ns381471 sshd[3438]: Failed password for invalid user web2 from 117.80.212.113 port 35439 ssh2