Dec 24 10:01:26 eola postfix/smtpd[5396]: connect from unknown[104.248.162.68]
Dec 24 10:01:26 eola postfix/smtpd[5396]: lost connection after AUTH from unknown[104.248.162.68]
Dec 24 10:01:26 eola postfix/smtpd[5396]: disconnect from unknown[104.248.162.68] ehlo=1 auth=0/1 commands=1/2
Dec 24 10:01:26 eola postfix/smtpd[5396]: connect from unknown[104.248.162.68]
Dec 24 10:01:27 eola postfix/smtpd[5396]: lost connection after AUTH from unknown[104.248.162.68]
Dec 24 10:01:27 eola postfix/smtpd[5396]: disconnect from unknown[104.248.162.68] ehlo=1 auth=0/1 commands=1/2
Dec 24 10:01:27 eola postfix/smtpd[5396]: connect from unknown[104.248.162.68]
Dec 24 10:01:27 eola postfix/smtpd[5396]: lost connection after AUTH from unknown[104.248.162.68]
Dec 24 10:01:27 eola postfix/smtpd[5396]: disconnect from unknown[104.248.162.68] ehlo=1 auth=0/1 commands=1/2
Dec 24 10:01:27 eola postfix/smtpd[5396]: connect from unknown[104.248.162.68]
Dec 24 10:01:28 eola postfix/smtpd[5396]:........
-------------------------------

2019-09-23T08:11:28.824954abusebot-2.cloudsearch.cf sshd\[3387\]: Invalid user webserver from 104.248.162.218 port 50254

Invalid user admin from 104.248.162.218 port 60698

2019-09-14T11:05:54.575645abusebot-8.cloudsearch.cf sshd\[18042\]: Invalid user tester from 104.248.162.218 port 41300

F2B jail: sshd. Time: 2019-09-12 10:59:35, Reported by: VKReport

Sep 10 10:41:52 kapalua sshd\[11368\]: Invalid user gmodserver from 104.248.162.218
Sep 10 10:41:52 kapalua sshd\[11368\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.162.218
Sep 10 10:41:53 kapalua sshd\[11368\]: Failed password for invalid user gmodserver from 104.248.162.218 port 52486 ssh2
Sep 10 10:47:45 kapalua sshd\[11902\]: Invalid user servers from 104.248.162.218
Sep 10 10:47:45 kapalua sshd\[11902\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.162.218

Sep  7 18:52:36 markkoudstaal sshd[13953]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.162.218
Sep  7 18:52:38 markkoudstaal sshd[13953]: Failed password for invalid user 123456 from 104.248.162.218 port 39470 ssh2
Sep  7 18:57:10 markkoudstaal sshd[14381]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.162.218

Sep  7 07:46:26 webhost01 sshd[21012]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.162.218
Sep  7 07:46:28 webhost01 sshd[21012]: Failed password for invalid user jenkins from 104.248.162.218 port 44964 ssh2
...

Sep  6 04:14:41 www_kotimaassa_fi sshd[7244]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.162.218
Sep  6 04:14:43 www_kotimaassa_fi sshd[7244]: Failed password for invalid user vnc from 104.248.162.218 port 38156 ssh2
...

2019-08-30T23:14:31.976614stark.klein-stark.info sshd\[11381\]: Invalid user timemachine from 104.248.162.218 port 33358
2019-08-30T23:14:31.980632stark.klein-stark.info sshd\[11381\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.162.218
2019-08-30T23:14:34.409199stark.klein-stark.info sshd\[11381\]: Failed password for invalid user timemachine from 104.248.162.218 port 33358 ssh2
...

Aug 27 14:05:11 hcbbdb sshd\[1592\]: Invalid user multitrode from 104.248.162.218
Aug 27 14:05:11 hcbbdb sshd\[1592\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.162.218
Aug 27 14:05:13 hcbbdb sshd\[1592\]: Failed password for invalid user multitrode from 104.248.162.218 port 48588 ssh2
Aug 27 14:09:23 hcbbdb sshd\[2123\]: Invalid user ftpuser from 104.248.162.218
Aug 27 14:09:23 hcbbdb sshd\[2123\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.162.218

Aug 25 14:41:33 server sshd\[21673\]: Invalid user windows from 104.248.162.218 port 59192
Aug 25 14:41:33 server sshd\[21673\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.162.218
Aug 25 14:41:35 server sshd\[21673\]: Failed password for invalid user windows from 104.248.162.218 port 59192 ssh2
Aug 25 14:45:35 server sshd\[9778\]: Invalid user test from 104.248.162.218 port 32878
Aug 25 14:45:35 server sshd\[9778\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.162.218

Aug 24 16:43:18 nextcloud sshd\[23658\]: Invalid user hpcadmin from 104.248.162.218
Aug 24 16:43:18 nextcloud sshd\[23658\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.162.218
Aug 24 16:43:20 nextcloud sshd\[23658\]: Failed password for invalid user hpcadmin from 104.248.162.218 port 55694 ssh2
...

web-1 [ssh] SSH Attack

Aug 18 03:18:28 meumeu sshd[18296]: Failed password for invalid user kapil from 104.248.162.218 port 53080 ssh2
Aug 18 03:22:27 meumeu sshd[18754]: Failed password for invalid user mysql from 104.248.162.218 port 53294 ssh2
Aug 18 03:26:27 meumeu sshd[19225]: Failed password for invalid user purple from 104.248.162.218 port 54156 ssh2
...

[portscan] Port scan

79.172.196.179 (HU/Hungary/lab-ap.uif.hu), 5 distributed smtpauth attacks on account [ichelle.bradleym] in the last 3600 secs

Jun  7 22:37:04 vps647732 sshd[1123]: Failed password for root from 167.172.119.104 port 33344 ssh2
...

2020-06-08T01:28:57.712244vps751288.ovh.net sshd\[23665\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.30.35  user=root
2020-06-08T01:28:59.814027vps751288.ovh.net sshd\[23665\]: Failed password for root from 222.186.30.35 port 53906 ssh2
2020-06-08T01:29:02.211170vps751288.ovh.net sshd\[23665\]: Failed password for root from 222.186.30.35 port 53906 ssh2
2020-06-08T01:29:04.216208vps751288.ovh.net sshd\[23665\]: Failed password for root from 222.186.30.35 port 53906 ssh2
2020-06-08T01:29:21.466874vps751288.ovh.net sshd\[23668\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.30.35  user=root

20 attempts against mh-ssh on echoip

Jun  8 02:55:38 debian kernel: [476696.815910] [UFW BLOCK] IN=eth0 OUT= MAC=52:54:00:be:e4:65:08:e8:4f:6e:48:0c:08:00 SRC=185.39.11.55 DST=89.252.131.35 LEN=40 TOS=0x00 PREC=0x00 TTL=245 ID=26377 PROTO=TCP SPT=52827 DPT=20129 WINDOW=1024 RES=0x00 SYN URGP=0

Jun  8 00:56:46 ns382633 sshd\[27713\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.111.181.248  user=root
Jun  8 00:56:49 ns382633 sshd\[27713\]: Failed password for root from 36.111.181.248 port 40374 ssh2
Jun  8 01:11:12 ns382633 sshd\[30284\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.111.181.248  user=root
Jun  8 01:11:14 ns382633 sshd\[30284\]: Failed password for root from 36.111.181.248 port 59068 ssh2
Jun  8 01:22:37 ns382633 sshd\[31983\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.111.181.248  user=root

Jun  8 01:24:46 vps687878 sshd\[19929\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.86.239.251  user=root
Jun  8 01:24:47 vps687878 sshd\[19929\]: Failed password for root from 203.86.239.251 port 59972 ssh2
Jun  8 01:28:14 vps687878 sshd\[20554\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.86.239.251  user=root
Jun  8 01:28:15 vps687878 sshd\[20554\]: Failed password for root from 203.86.239.251 port 33914 ssh2
Jun  8 01:31:41 vps687878 sshd\[21119\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.86.239.251  user=root
...

2020-06-07T20:50:22.701855shield sshd\[6076\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.18.206.15  user=root
2020-06-07T20:50:24.558561shield sshd\[6076\]: Failed password for root from 123.18.206.15 port 33018 ssh2
2020-06-07T20:52:17.205447shield sshd\[6691\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.18.206.15  user=root
2020-06-07T20:52:19.518392shield sshd\[6691\]: Failed password for root from 123.18.206.15 port 47227 ssh2
2020-06-07T20:54:19.426255shield sshd\[7077\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.18.206.15  user=root

Jun  8 05:47:31 webhost01 sshd[20381]: Failed password for root from 159.203.124.234 port 42828 ssh2
...

2020-06-07T23:26:31.087519shield sshd\[17006\]: Invalid user chenqi from 193.70.7.73 port 39762
2020-06-07T23:26:31.092379shield sshd\[17006\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ns3061299.ip-193-70-7.eu
2020-06-07T23:26:33.151599shield sshd\[17006\]: Failed password for invalid user chenqi from 193.70.7.73 port 39762 ssh2
2020-06-07T23:26:40.148935shield sshd\[17070\]: Invalid user flysenven from 193.70.7.73 port 35602
2020-06-07T23:26:40.152686shield sshd\[17070\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ns3061299.ip-193-70-7.eu

Jun  7 20:05:36 nbi-636 sshd[29629]: User r.r from 123.58.38.143 not allowed because not listed in AllowUsers
Jun  7 20:05:36 nbi-636 sshd[29629]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.58.38.143  user=r.r
Jun  7 20:05:38 nbi-636 sshd[29629]: Failed password for invalid user r.r from 123.58.38.143 port 35494 ssh2
Jun  7 20:05:40 nbi-636 sshd[29629]: Received disconnect from 123.58.38.143 port 35494:11: Bye Bye [preauth]
Jun  7 20:05:40 nbi-636 sshd[29629]: Disconnected from invalid user r.r 123.58.38.143 port 35494 [preauth]
Jun  7 20:28:59 nbi-636 sshd[2806]: User r.r from 123.58.38.143 not allowed because not listed in AllowUsers
Jun  7 20:28:59 nbi-636 sshd[2806]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.58.38.143  user=r.r
Jun  7 20:29:00 nbi-636 sshd[2806]: Failed password for invalid user r.r from 123.58.38.143 port 36498 ssh2
Jun  7 20:29:01 nbi-636 sshd[2806]:........
-------------------------------

Jun  7 19:46:25 nbi-636 sshd[24429]: User r.r from 13.82.49.222 not allowed because not listed in AllowUsers
Jun  7 19:46:25 nbi-636 sshd[24429]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=13.82.49.222  user=r.r
Jun  7 19:46:27 nbi-636 sshd[24429]: Failed password for invalid user r.r from 13.82.49.222 port 49810 ssh2
Jun  7 19:46:29 nbi-636 sshd[24429]: Received disconnect from 13.82.49.222 port 49810:11: Bye Bye [preauth]
Jun  7 19:46:29 nbi-636 sshd[24429]: Disconnected from invalid user r.r 13.82.49.222 port 49810 [preauth]
Jun  7 19:54:47 nbi-636 sshd[26359]: User r.r from 13.82.49.222 not allowed because not listed in AllowUsers
Jun  7 19:54:47 nbi-636 sshd[26359]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=13.82.49.222  user=r.r
Jun  7 19:54:49 nbi-636 sshd[26359]: Failed password for invalid user r.r from 13.82.49.222 port 56344 ssh2
Jun  7 19:54:51 nbi-636 sshd[26359]: Rec........
-------------------------------

mue-0 : Trying access unauthorized files=>/images/jdownloads/screenshots/update.php()

$f2bV_matches