2020-08-28T20:30:11.223441hostname sshd[10537]: Failed password for invalid user prince from 106.12.190.177 port 38496 ssh2
2020-08-28T20:35:39.774304hostname sshd[12624]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.190.177  user=root
2020-08-28T20:35:41.209907hostname sshd[12624]: Failed password for root from 106.12.190.177 port 39704 ssh2
...

Aug 17 22:20:59 myvps sshd[26983]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.190.177 
Aug 17 22:21:01 myvps sshd[26983]: Failed password for invalid user user from 106.12.190.177 port 50746 ssh2
Aug 17 22:31:08 myvps sshd[1094]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.190.177 
...

Jul 31 07:10:51 plg sshd[32016]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.190.177  user=root
Jul 31 07:10:53 plg sshd[32016]: Failed password for invalid user root from 106.12.190.177 port 39320 ssh2
Jul 31 07:14:15 plg sshd[32073]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.190.177  user=root
Jul 31 07:14:16 plg sshd[32073]: Failed password for invalid user root from 106.12.190.177 port 46768 ssh2
Jul 31 07:17:18 plg sshd[32146]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.190.177  user=root
Jul 31 07:17:20 plg sshd[32146]: Failed password for invalid user root from 106.12.190.177 port 54206 ssh2
...

Jul  4 14:38:11 inter-technics sshd[6242]: Invalid user 3 from 106.12.190.177 port 57190
Jul  4 14:38:11 inter-technics sshd[6242]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.190.177
Jul  4 14:38:11 inter-technics sshd[6242]: Invalid user 3 from 106.12.190.177 port 57190
Jul  4 14:38:13 inter-technics sshd[6242]: Failed password for invalid user 3 from 106.12.190.177 port 57190 ssh2
Jul  4 14:42:06 inter-technics sshd[6586]: Invalid user noc from 106.12.190.177 port 48122
...

2020-06-11T19:16:18.7817451495-001 sshd[2415]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.190.177  user=root
2020-06-11T19:16:20.8799291495-001 sshd[2415]: Failed password for root from 106.12.190.177 port 57132 ssh2
2020-06-11T19:19:13.9310301495-001 sshd[2532]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.190.177  user=root
2020-06-11T19:19:16.0551401495-001 sshd[2532]: Failed password for root from 106.12.190.177 port 41546 ssh2
2020-06-11T19:22:10.6775421495-001 sshd[2708]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.190.177  user=root
2020-06-11T19:22:12.7665801495-001 sshd[2708]: Failed password for root from 106.12.190.177 port 54186 ssh2
...

Invalid user roi from 106.12.190.177 port 58080

prod6
...

Apr 27 18:09:37 gw1 sshd[17220]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.190.177
Apr 27 18:09:39 gw1 sshd[17220]: Failed password for invalid user isobe from 106.12.190.177 port 37096 ssh2
...

Apr 24 12:23:35 vserver sshd\[22339\]: Invalid user adrianna from 106.12.190.177Apr 24 12:23:36 vserver sshd\[22339\]: Failed password for invalid user adrianna from 106.12.190.177 port 52972 ssh2Apr 24 12:29:10 vserver sshd\[22372\]: Invalid user support from 106.12.190.177Apr 24 12:29:12 vserver sshd\[22372\]: Failed password for invalid user support from 106.12.190.177 port 56064 ssh2
...

ET CINS Active Threat Intelligence Poor Reputation IP group 98 - port: 32539 proto: tcp cat: Misc Attackbytes: 60

Found on   CINS badguys     / proto=6  .  srcport=43870  .  dstport=28616  .     (2057)

 TCP (SYN) 106.12.190.254:43870 -> port 28616, len 44

Aug 25 08:59:35 gw1 sshd[4158]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.190.254
Aug 25 08:59:37 gw1 sshd[4158]: Failed password for invalid user testuser from 106.12.190.254 port 52944 ssh2
...

Aug 14 12:11:35 PorscheCustomer sshd[9998]: Failed password for root from 106.12.190.19 port 37220 ssh2
Aug 14 12:14:44 PorscheCustomer sshd[10086]: Failed password for root from 106.12.190.19 port 44288 ssh2
...

Aug  7 05:53:14 vmd36147 sshd[1023]: Failed password for root from 106.12.190.19 port 59274 ssh2
Aug  7 05:58:37 vmd36147 sshd[14112]: Failed password for root from 106.12.190.19 port 60052 ssh2
...

reported through recidive - multiple failed attempts(SSH)

Jul  3 16:15:29 vps687878 sshd\[2305\]: Failed password for root from 106.12.190.104 port 43488 ssh2
Jul  3 16:19:40 vps687878 sshd\[2746\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.190.104  user=mysql
Jul  3 16:19:42 vps687878 sshd\[2746\]: Failed password for mysql from 106.12.190.104 port 34988 ssh2
Jul  3 16:23:58 vps687878 sshd\[3159\]: Invalid user clemens from 106.12.190.104 port 54754
Jul  3 16:23:58 vps687878 sshd\[3159\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.190.104
...

Jun 10 09:49:09 localhost sshd\[7157\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.190.19  user=root
Jun 10 09:49:11 localhost sshd\[7157\]: Failed password for root from 106.12.190.19 port 44394 ssh2
Jun 10 09:52:53 localhost sshd\[7431\]: Invalid user maira from 106.12.190.19
Jun 10 09:52:53 localhost sshd\[7431\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.190.19
Jun 10 09:52:55 localhost sshd\[7431\]: Failed password for invalid user maira from 106.12.190.19 port 37788 ssh2
...

Jun  8 14:02:02 PorscheCustomer sshd[21936]: Failed password for root from 106.12.190.254 port 58070 ssh2
Jun  8 14:05:51 PorscheCustomer sshd[22045]: Failed password for root from 106.12.190.254 port 46262 ssh2
...

firewall-block, port(s): 2301/tcp

2020-06-02T21:19:28.123349vps751288.ovh.net sshd\[20034\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.190.254  user=root
2020-06-02T21:19:30.500350vps751288.ovh.net sshd\[20034\]: Failed password for root from 106.12.190.254 port 43834 ssh2
2020-06-02T21:21:51.588893vps751288.ovh.net sshd\[20070\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.190.254  user=root
2020-06-02T21:21:53.263323vps751288.ovh.net sshd\[20070\]: Failed password for root from 106.12.190.254 port 48562 ssh2
2020-06-02T21:24:06.990047vps751288.ovh.net sshd\[20106\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.190.254  user=root

Jun  2 06:51:34 minden010 sshd[21521]: Failed password for root from 106.12.190.254 port 39026 ssh2
Jun  2 06:55:41 minden010 sshd[23558]: Failed password for root from 106.12.190.254 port 39282 ssh2
...

May 31 03:56:31 serwer sshd\[29482\]: User mysql from 106.12.190.254 not allowed because not listed in AllowUsers
May 31 03:56:31 serwer sshd\[29482\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.190.254  user=mysql
May 31 03:56:33 serwer sshd\[29482\]: Failed password for invalid user mysql from 106.12.190.254 port 36990 ssh2
May 31 03:59:07 serwer sshd\[29669\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.190.254  user=root
May 31 03:59:10 serwer sshd\[29669\]: Failed password for root from 106.12.190.254 port 36422 ssh2
May 31 04:01:21 serwer sshd\[29965\]: User sshd from 106.12.190.254 not allowed because not listed in AllowUsers
May 31 04:01:21 serwer sshd\[29965\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.190.254  user=sshd
May 31 04:01:23 serwer sshd\[29965\]: Failed password for invalid user sshd from 106.12.190.254
...

May 28 07:49:07 vmd48417 sshd[24733]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.190.254

Attempted to establish connection to non opened port 3492

Aug  6 23:42:09 Ubuntu-1404-trusty-64-minimal sshd\[18010\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.213.134  user=root
Aug  6 23:42:10 Ubuntu-1404-trusty-64-minimal sshd\[18010\]: Failed password for root from 138.197.213.134 port 57988 ssh2
Aug  6 23:48:41 Ubuntu-1404-trusty-64-minimal sshd\[22651\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.213.134  user=root
Aug  6 23:48:42 Ubuntu-1404-trusty-64-minimal sshd\[22651\]: Failed password for root from 138.197.213.134 port 35502 ssh2
Aug  6 23:53:28 Ubuntu-1404-trusty-64-minimal sshd\[27751\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.213.134  user=root

k+ssh-bruteforce

ET CINS Active Threat Intelligence Poor Reputation IP group 77 - port: 389 proto: udp cat: Misc Attackbytes: 94

Aug  7 01:03:23 srv3 sshd\[14204\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.77.135.89  user=sshd
Aug  7 01:03:25 srv3 sshd\[14204\]: Failed password for sshd from 51.77.135.89 port 50970 ssh2
Aug  7 01:03:26 srv3 sshd\[14204\]: Failed password for sshd from 51.77.135.89 port 50970 ssh2
Aug  7 01:03:28 srv3 sshd\[14204\]: Failed password for sshd from 51.77.135.89 port 50970 ssh2
Aug  7 01:03:30 srv3 sshd\[14204\]: Failed password for sshd from 51.77.135.89 port 50970 ssh2
...

Failed password for root from 193.112.93.2 port 49634 ssh2

Aug  6 22:24:29 game-panel sshd[29716]: Failed password for root from 107.170.254.146 port 34258 ssh2
Aug  6 22:28:20 game-panel sshd[29853]: Failed password for root from 107.170.254.146 port 44506 ssh2

08/06/2020-19:44:55.793248 92.118.160.37 Protocol: 17 GPL DNS named version attempt

$f2bV_matches

Fail2Ban Ban Triggered

2020-08-07T01:31:51.472370amanda2.illicoweb.com sshd\[35657\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.78.213.143  user=root
2020-08-07T01:31:53.374622amanda2.illicoweb.com sshd\[35657\]: Failed password for root from 218.78.213.143 port 17009 ssh2
2020-08-07T01:33:48.073356amanda2.illicoweb.com sshd\[35991\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.78.213.143  user=root
2020-08-07T01:33:50.035947amanda2.illicoweb.com sshd\[35991\]: Failed password for root from 218.78.213.143 port 37254 ssh2
2020-08-07T01:35:37.461496amanda2.illicoweb.com sshd\[36254\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.78.213.143  user=root
...

Aug  7 00:56:38 jane sshd[30273]: Failed password for root from 103.139.219.20 port 44166 ssh2
...

Automatic report - Banned IP Access

Aug  6 23:44:02 lnxweb61 sshd[4797]: Failed password for root from 54.38.53.251 port 59892 ssh2
Aug  6 23:48:40 lnxweb61 sshd[10108]: Failed password for root from 54.38.53.251 port 44054 ssh2

Inbound attacks across multiple port addresses.