Aug 14 14:46:33 XXX sshd[6479]: Invalid user aufbauorganisation from 104.248.147.113 port 52012

Aug 13 11:39:18 ns41 sshd[2516]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.147.113

Aug 12 18:11:33 pornomens sshd\[19987\]: Invalid user gh from 104.248.147.113 port 48840
Aug 12 18:11:33 pornomens sshd\[19987\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.147.113
Aug 12 18:11:35 pornomens sshd\[19987\]: Failed password for invalid user gh from 104.248.147.113 port 48840 ssh2
...

Jul 26 14:10:31 dallas01 sshd[2350]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.147.113
Jul 26 14:10:33 dallas01 sshd[2350]: Failed password for invalid user max from 104.248.147.113 port 60364 ssh2
Jul 26 14:15:41 dallas01 sshd[3393]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.147.113

Automatic report - Banned IP Access

2020-10-11T23:16:32.135807morrigan.ad5gb.com sshd[507974]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.147.78  user=root
2020-10-11T23:16:33.829282morrigan.ad5gb.com sshd[507974]: Failed password for root from 104.248.147.78 port 49334 ssh2

Oct 11 20:48:43 scw-tender-jepsen sshd[13544]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.147.78
Oct 11 20:48:45 scw-tender-jepsen sshd[13544]: Failed password for invalid user reno from 104.248.147.78 port 49718 ssh2

2020-10-11T07:22:50.363081mail.broermann.family sshd[18309]: Invalid user rene from 104.248.147.78 port 37094
2020-10-11T07:22:50.371345mail.broermann.family sshd[18309]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.147.78
2020-10-11T07:22:50.363081mail.broermann.family sshd[18309]: Invalid user rene from 104.248.147.78 port 37094
2020-10-11T07:22:52.626989mail.broermann.family sshd[18309]: Failed password for invalid user rene from 104.248.147.78 port 37094 ssh2
2020-10-11T07:23:37.777799mail.broermann.family sshd[18381]: Invalid user ftpuser1 from 104.248.147.78 port 45758
...

Bruteforce detected by fail2ban

Oct 11 00:09:13 cho sshd[395757]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.147.78 
Oct 11 00:09:13 cho sshd[395757]: Invalid user ghost3 from 104.248.147.78 port 60928
Oct 11 00:09:15 cho sshd[395757]: Failed password for invalid user ghost3 from 104.248.147.78 port 60928 ssh2
Oct 11 00:12:57 cho sshd[395891]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.147.78  user=root
Oct 11 00:12:59 cho sshd[395891]: Failed password for root from 104.248.147.78 port 38256 ssh2
...

Sep 28 17:18:16 server sshd[19603]: Failed password for invalid user new from 104.248.147.20 port 49194 ssh2
Sep 28 17:20:40 server sshd[20916]: Failed password for invalid user laravel from 104.248.147.20 port 50160 ssh2
Sep 28 17:22:43 server sshd[21989]: Failed password for invalid user mauro from 104.248.147.20 port 50066 ssh2

Sep 28 15:15:13 vpn01 sshd[7538]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.147.20
Sep 28 15:15:16 vpn01 sshd[7538]: Failed password for invalid user elemental from 104.248.147.20 port 42920 ssh2
...

SSH-BruteForce

Sep 27 17:51:39 vlre-nyc-1 sshd\[4032\]: Invalid user charlie from 104.248.147.78
Sep 27 17:51:39 vlre-nyc-1 sshd\[4032\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.147.78
Sep 27 17:51:41 vlre-nyc-1 sshd\[4032\]: Failed password for invalid user charlie from 104.248.147.78 port 39384 ssh2
Sep 27 17:55:00 vlre-nyc-1 sshd\[4090\]: Invalid user python from 104.248.147.78
Sep 27 17:55:00 vlre-nyc-1 sshd\[4090\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.147.78
...

Sep 27 02:28:05 marvibiene sshd[29577]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.147.78 
Sep 27 02:28:07 marvibiene sshd[29577]: Failed password for invalid user user2 from 104.248.147.78 port 57762 ssh2

Sep 27 02:28:05 marvibiene sshd[29577]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.147.78 
Sep 27 02:28:07 marvibiene sshd[29577]: Failed password for invalid user user2 from 104.248.147.78 port 57762 ssh2

(sshd) Failed SSH login from 104.248.147.20 (SG/Singapore/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Sep 26 18:16:06 elude sshd[4203]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.147.20  user=root
Sep 26 18:16:08 elude sshd[4203]: Failed password for root from 104.248.147.20 port 57384 ssh2
Sep 26 18:26:49 elude sshd[5748]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.147.20  user=root
Sep 26 18:26:50 elude sshd[5748]: Failed password for root from 104.248.147.20 port 41272 ssh2
Sep 26 18:31:17 elude sshd[6387]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.147.20  user=root

Sep 26 05:36:09 web8 sshd\[25565\]: Invalid user oscar from 104.248.147.20
Sep 26 05:36:09 web8 sshd\[25565\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.147.20
Sep 26 05:36:11 web8 sshd\[25565\]: Failed password for invalid user oscar from 104.248.147.20 port 36814 ssh2
Sep 26 05:40:33 web8 sshd\[27723\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.147.20  user=root
Sep 26 05:40:35 web8 sshd\[27723\]: Failed password for root from 104.248.147.20 port 45270 ssh2

invalid user hanms1017 from 104.248.147.78 port 47824 ssh2

SSH Brute-Force. Ports scanning.

Jun  9 05:45:26 roki-contabo sshd\[21609\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.64.140  user=root
Jun  9 05:45:28 roki-contabo sshd\[21609\]: Failed password for root from 157.245.64.140 port 48222 ssh2
Jun  9 05:54:21 roki-contabo sshd\[21713\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.64.140  user=root
Jun  9 05:54:22 roki-contabo sshd\[21713\]: Failed password for root from 157.245.64.140 port 34022 ssh2
Jun  9 05:57:30 roki-contabo sshd\[21733\]: Invalid user test123 from 157.245.64.140
Jun  9 05:57:30 roki-contabo sshd\[21733\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.64.140
...

Automatic report - Port Scan

(sshd) Failed SSH login from 182.61.138.203 (CN/China/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Jun  9 05:51:42 amsweb01 sshd[783]: Invalid user gd from 182.61.138.203 port 50304
Jun  9 05:51:44 amsweb01 sshd[783]: Failed password for invalid user gd from 182.61.138.203 port 50304 ssh2
Jun  9 06:19:05 amsweb01 sshd[4968]: Invalid user adlkish from 182.61.138.203 port 53466
Jun  9 06:19:08 amsweb01 sshd[4968]: Failed password for invalid user adlkish from 182.61.138.203 port 53466 ssh2
Jun  9 06:21:32 amsweb01 sshd[5348]: Invalid user monitor from 182.61.138.203 port 58638

06/09/2020-00:45:13.879619 94.102.51.28 Protocol: 6 ET SCAN NMAP -sS window 1024

Jun  9 06:29:33 piServer sshd[27101]: Failed password for root from 175.119.224.64 port 51304 ssh2
Jun  9 06:34:03 piServer sshd[27415]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.119.224.64 
Jun  9 06:34:04 piServer sshd[27415]: Failed password for invalid user anne from 175.119.224.64 port 52820 ssh2
...

2020-06-09T05:47:35.086448rocketchat.forhosting.nl sshd[2243]: Invalid user oka from 223.85.222.14 port 58295
2020-06-09T05:47:37.091869rocketchat.forhosting.nl sshd[2243]: Failed password for invalid user oka from 223.85.222.14 port 58295 ssh2
2020-06-09T05:57:38.173018rocketchat.forhosting.nl sshd[2372]: Invalid user webmaster from 223.85.222.14 port 40990
...

Jun  9 05:50:33 DAAP sshd[6224]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.54.14.42  user=root
Jun  9 05:50:35 DAAP sshd[6224]: Failed password for root from 106.54.14.42 port 39964 ssh2
Jun  9 05:54:03 DAAP sshd[6252]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.54.14.42  user=root
Jun  9 05:54:04 DAAP sshd[6252]: Failed password for root from 106.54.14.42 port 53570 ssh2
Jun  9 05:57:24 DAAP sshd[6278]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.54.14.42  user=root
Jun  9 05:57:26 DAAP sshd[6278]: Failed password for root from 106.54.14.42 port 38932 ssh2
...

Automatic report - Port Scan Attack

Jun  9 05:56:53 lnxmail61 sshd[13827]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.126.90.89

Jun  9 04:28:58 localhost sshd[1303]: Invalid user honey from 144.172.79.8 port 45990
Jun  9 04:28:58 localhost sshd[1303]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=144.172.79.8
Jun  9 04:28:58 localhost sshd[1303]: Invalid user honey from 144.172.79.8 port 45990
Jun  9 04:29:01 localhost sshd[1303]: Failed password for invalid user honey from 144.172.79.8 port 45990 ssh2
Jun  9 04:29:02 localhost sshd[1309]: Invalid user admin from 144.172.79.8 port 49788
...

Jun  9 05:53:03 eventyay sshd[565]: Failed password for root from 140.143.248.32 port 32862 ssh2
Jun  9 05:55:25 eventyay sshd[653]: Failed password for postgres from 140.143.248.32 port 56948 ssh2
...

/portal/redlion

2020-06-09T04:33:59.015806shield sshd\[22315\]: Invalid user monitor from 82.65.35.189 port 33438
2020-06-09T04:33:59.019476shield sshd\[22315\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=82-65-35-189.subs.proxad.net
2020-06-09T04:34:00.889119shield sshd\[22315\]: Failed password for invalid user monitor from 82.65.35.189 port 33438 ssh2
2020-06-09T04:36:05.898458shield sshd\[23062\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=82-65-35-189.subs.proxad.net  user=root
2020-06-09T04:36:07.727871shield sshd\[23062\]: Failed password for root from 82.65.35.189 port 41182 ssh2

Jun  9 05:56:58 icecube postfix/smtpd[79723]: NOQUEUE: reject: RCPT from mail-a.webstudioninetytwo.com[50.2.209.6]: 554 5.7.1 Service unavailable; Client host [50.2.209.6] blocked using zen.spamhaus.org; https://www.spamhaus.org/sbl/query/SBLCSS; from= to= proto=ESMTP helo=