pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.195.84  user=root
Failed password for root from 106.13.195.84 port 42656 ssh2
Invalid user anonymous from 106.13.195.84 port 40688
pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.195.84
Failed password for invalid user anonymous from 106.13.195.84 port 40688 ssh2

2020-1-31 9:04:24 AM: failed ssh attempt

2020-1-31 6:59:52 AM: failed ssh attempt

SSH bruteforce (Triggered fail2ban)

$f2bV_matches

Dec  8 21:54:02 ns382633 sshd\[7754\]: Invalid user mangione from 106.13.195.84 port 56912
Dec  8 21:54:02 ns382633 sshd\[7754\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.195.84
Dec  8 21:54:05 ns382633 sshd\[7754\]: Failed password for invalid user mangione from 106.13.195.84 port 56912 ssh2
Dec  8 22:03:12 ns382633 sshd\[9478\]: Invalid user ivancevic from 106.13.195.84 port 34964
Dec  8 22:03:12 ns382633 sshd\[9478\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.195.84

frenzy

Nov  5 23:38:59 vps01 sshd[24532]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.195.84
Nov  5 23:39:01 vps01 sshd[24532]: Failed password for invalid user Bonjour123 from 106.13.195.84 port 60578 ssh2

Nov  3 15:24:02 h2812830 sshd[18734]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.195.84  user=mysql
Nov  3 15:24:04 h2812830 sshd[18734]: Failed password for mysql from 106.13.195.84 port 56130 ssh2
Nov  3 15:33:40 h2812830 sshd[19095]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.195.84  user=root
Nov  3 15:33:42 h2812830 sshd[19095]: Failed password for root from 106.13.195.84 port 55894 ssh2
Nov  3 15:39:13 h2812830 sshd[19324]: Invalid user annonciation from 106.13.195.84 port 36482
...

Oct 27 21:58:25 meumeu sshd[11272]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.195.84 
Oct 27 21:58:27 meumeu sshd[11272]: Failed password for invalid user Qwert1!@ from 106.13.195.84 port 45132 ssh2
Oct 27 22:02:35 meumeu sshd[12084]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.195.84 
...

2019-10-24T03:41:06.9729821495-001 sshd\[53168\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.195.84  user=root
2019-10-24T03:41:08.4944701495-001 sshd\[53168\]: Failed password for root from 106.13.195.84 port 58684 ssh2
2019-10-24T03:46:35.6534341495-001 sshd\[53361\]: Invalid user gmodserver from 106.13.195.84 port 43088
2019-10-24T03:46:35.6563571495-001 sshd\[53361\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.195.84
2019-10-24T03:46:38.0102761495-001 sshd\[53361\]: Failed password for invalid user gmodserver from 106.13.195.84 port 43088 ssh2
2019-10-24T03:51:53.4573061495-001 sshd\[53567\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.195.84  user=root
2019-10-24T03:51:55.8014431495-001 sshd\[53567\]: Failed password for root from 106.13.195.84 port 54282 ssh2
...

Oct 22 18:22:08 SilenceServices sshd[17534]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.195.84
Oct 22 18:22:10 SilenceServices sshd[17534]: Failed password for invalid user czj!@# from 106.13.195.84 port 60738 ssh2
Oct 22 18:28:04 SilenceServices sshd[19058]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.195.84

2020-10-09T09:13:10.965976kitsunetech sshd[23928]: Invalid user sync from 106.13.195.32 port 43334

SSH login attempts.

" "

$f2bV_matches

Invalid user postgres from 106.13.195.156 port 52590

Coordinated SSH brute-force attack from different IPs. pam_unix(sshd:auth): user=root

Aug 30 07:09:18 askasleikir sshd[31079]: Failed password for invalid user oracle from 106.13.195.32 port 57826 ssh2
Aug 30 07:11:56 askasleikir sshd[31103]: Failed password for invalid user xy from 106.13.195.32 port 35060 ssh2
Aug 30 07:14:40 askasleikir sshd[31116]: Failed password for invalid user lxc from 106.13.195.32 port 40528 ssh2

Aug 29 05:54:34 PorscheCustomer sshd[19181]: Failed password for root from 106.13.195.32 port 46216 ssh2
Aug 29 05:57:47 PorscheCustomer sshd[19272]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.195.32
Aug 29 05:57:50 PorscheCustomer sshd[19272]: Failed password for invalid user bryan from 106.13.195.32 port 58992 ssh2
...

2020-08-28T22:03:28.517976shield sshd\[3728\]: Invalid user librenms from 106.13.195.32 port 54604
2020-08-28T22:03:28.539789shield sshd\[3728\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.195.32
2020-08-28T22:03:30.832448shield sshd\[3728\]: Failed password for invalid user librenms from 106.13.195.32 port 54604 ssh2
2020-08-28T22:05:25.141384shield sshd\[4022\]: Invalid user wubin from 106.13.195.32 port 57528
2020-08-28T22:05:25.170863shield sshd\[4022\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.195.32

Time:     Sun Aug 23 13:45:21 2020 +0000
IP:       106.13.195.32 (CN/China/-)
Failures: 5 (sshd)
Interval: 3600 seconds
Blocked:  Permanent Block [LF_SSHD]

Log entries:

Aug 23 13:41:52 vps1 sshd[27181]: Invalid user nancy from 106.13.195.32 port 51376
Aug 23 13:41:54 vps1 sshd[27181]: Failed password for invalid user nancy from 106.13.195.32 port 51376 ssh2
Aug 23 13:44:27 vps1 sshd[27335]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.195.32  user=root
Aug 23 13:44:30 vps1 sshd[27335]: Failed password for root from 106.13.195.32 port 46828 ssh2
Aug 23 13:45:20 vps1 sshd[27377]: Invalid user srinivas from 106.13.195.32 port 55370

Aug 18 06:28:34 eventyay sshd[23629]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.195.32
Aug 18 06:28:36 eventyay sshd[23629]: Failed password for invalid user admin from 106.13.195.32 port 47566 ssh2
Aug 18 06:32:50 eventyay sshd[23745]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.195.32
...

2020-08-17T14:01:04.267766vps773228.ovh.net sshd[563]: Failed password for root from 106.13.195.32 port 36012 ssh2
2020-08-17T14:05:25.919101vps773228.ovh.net sshd[583]: Invalid user kara from 106.13.195.32 port 57656
2020-08-17T14:05:25.932451vps773228.ovh.net sshd[583]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.195.32
2020-08-17T14:05:25.919101vps773228.ovh.net sshd[583]: Invalid user kara from 106.13.195.32 port 57656
2020-08-17T14:05:28.415796vps773228.ovh.net sshd[583]: Failed password for invalid user kara from 106.13.195.32 port 57656 ssh2
...

Jul 24 06:29:15 lvps5-35-247-183 sshd[15952]: Invalid user dimas from 106.13.195.32
Jul 24 06:29:15 lvps5-35-247-183 sshd[15952]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.195.32 
Jul 24 06:29:17 lvps5-35-247-183 sshd[15952]: Failed password for invalid user dimas from 106.13.195.32 port 51082 ssh2
Jul 24 06:29:17 lvps5-35-247-183 sshd[15952]: Received disconnect from 106.13.195.32: 11: Bye Bye [preauth]
Jul 24 06:39:04 lvps5-35-247-183 sshd[16474]: Invalid user nathan from 106.13.195.32
Jul 24 06:39:04 lvps5-35-247-183 sshd[16474]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.195.32 
Jul 24 06:39:06 lvps5-35-247-183 sshd[16474]: Failed password for invalid user nathan from 106.13.195.32 port 32864 ssh2
Jul 24 06:39:07 lvps5-35-247-183 sshd[16474]: Received disconnect from 106.13.195.32: 11: Bye Bye [preauth]


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=

Apr 26 18:56:26 h2829583 sshd[25152]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.195.172
Apr 26 18:56:28 h2829583 sshd[25152]: Failed password for invalid user ann from 106.13.195.172 port 33588 ssh2

Apr 19 12:43:14 srv01 sshd[12001]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.195.172  user=root
Apr 19 12:43:15 srv01 sshd[12001]: Failed password for root from 106.13.195.172 port 34252 ssh2
Apr 19 12:48:30 srv01 sshd[12521]: Invalid user gituser from 106.13.195.172 port 41678
Apr 19 12:48:30 srv01 sshd[12521]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.195.172
Apr 19 12:48:30 srv01 sshd[12521]: Invalid user gituser from 106.13.195.172 port 41678
Apr 19 12:48:31 srv01 sshd[12521]: Failed password for invalid user gituser from 106.13.195.172 port 41678 ssh2
...

Jun 17 19:28:20 hanapaa sshd\[18729\]: Invalid user openproject from 51.38.238.205
Jun 17 19:28:20 hanapaa sshd\[18729\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=205.ip-51-38-238.eu
Jun 17 19:28:22 hanapaa sshd\[18729\]: Failed password for invalid user openproject from 51.38.238.205 port 58862 ssh2
Jun 17 19:31:42 hanapaa sshd\[19014\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=205.ip-51-38-238.eu  user=root
Jun 17 19:31:44 hanapaa sshd\[19014\]: Failed password for root from 51.38.238.205 port 58361 ssh2

Jun 18 10:39:24 srv01 postfix/smtpd\[12322\]: warning: unknown\[185.143.72.23\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jun 18 10:39:31 srv01 postfix/smtpd\[12919\]: warning: unknown\[185.143.72.23\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jun 18 10:39:35 srv01 postfix/smtpd\[14637\]: warning: unknown\[185.143.72.23\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jun 18 10:39:54 srv01 postfix/smtpd\[14885\]: warning: unknown\[185.143.72.23\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jun 18 10:40:18 srv01 postfix/smtpd\[12919\]: warning: unknown\[185.143.72.23\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
...

20 attempts against mh-misbehave-ban on twig

Dovecot Invalid User Login Attempt.

Lines containing failures of 35.198.2.115
Jun 18 05:44:28 kmh-mb-001 sshd[6413]: Invalid user test from 35.198.2.115 port 38936
Jun 18 05:44:28 kmh-mb-001 sshd[6413]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=35.198.2.115 
Jun 18 05:44:30 kmh-mb-001 sshd[6413]: Failed password for invalid user test from 35.198.2.115 port 38936 ssh2
Jun 18 05:44:31 kmh-mb-001 sshd[6413]: Received disconnect from 35.198.2.115 port 38936:11: Bye Bye [preauth]
Jun 18 05:44:31 kmh-mb-001 sshd[6413]: Disconnected from invalid user test 35.198.2.115 port 38936 [preauth]
Jun 18 06:07:55 kmh-mb-001 sshd[7922]: Invalid user vdr from 35.198.2.115 port 55998
Jun 18 06:07:55 kmh-mb-001 sshd[7922]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=35.198.2.115 
Jun 18 06:07:57 kmh-mb-001 sshd[7922]: Failed password for invalid user vdr from 35.198.2.115 port 55998 ssh2
Jun 18 06:07:59 kmh-mb-001 sshd[7922]: Received di........
------------------------------

Automatic report - XMLRPC Attack

Automatic report - Port Scan Attack

Jun 18 05:25:42 mail.srvfarm.net postfix/smtpd[1341597]: NOQUEUE: reject: RCPT from unknown[217.112.142.216]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Jun 18 05:25:46 mail.srvfarm.net postfix/smtpd[1341305]: NOQUEUE: reject: RCPT from unknown[217.112.142.216]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Jun 18 05:26:45 mail.srvfarm.net postfix/smtpd[1339650]: NOQUEUE: reject: RCPT from unknown[217.112.142.216]: 554 5.7.1 Service unavailable; Client host [217.112.142.216] blocked using bl.spamcop.net; Blocked - see https://www.spamcop.net/bl.shtml?217.112.142.216; from= to= proto=ESMTP helo=
Jun 18 05:35:18 mail.srvfarm.ne

2020-06-18T10:08:46.871107vps751288.ovh.net sshd\[21287\]: Invalid user trial from 190.111.100.67 port 45386
2020-06-18T10:08:46.880585vps751288.ovh.net sshd\[21287\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.111.100.67
2020-06-18T10:08:49.173354vps751288.ovh.net sshd\[21287\]: Failed password for invalid user trial from 190.111.100.67 port 45386 ssh2
2020-06-18T10:13:03.328801vps751288.ovh.net sshd\[21331\]: Invalid user password123 from 190.111.100.67 port 45432
2020-06-18T10:13:03.335028vps751288.ovh.net sshd\[21331\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.111.100.67

Jun 18 02:00:36 NPSTNNYC01T sshd[25993]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=132.232.230.220
Jun 18 02:00:38 NPSTNNYC01T sshd[25993]: Failed password for invalid user kshitiz from 132.232.230.220 port 55149 ssh2
Jun 18 02:05:15 NPSTNNYC01T sshd[26833]: Failed password for root from 132.232.230.220 port 52339 ssh2
...

Jun 18 05:08:28 mail.srvfarm.net postfix/smtps/smtpd[1338900]: warning: unknown[202.52.253.91]: SASL PLAIN authentication failed: 
Jun 18 05:08:29 mail.srvfarm.net postfix/smtps/smtpd[1338900]: lost connection after AUTH from unknown[202.52.253.91]
Jun 18 05:14:17 mail.srvfarm.net postfix/smtps/smtpd[1338906]: warning: unknown[202.52.253.91]: SASL PLAIN authentication failed: 
Jun 18 05:14:18 mail.srvfarm.net postfix/smtps/smtpd[1338906]: lost connection after AUTH from unknown[202.52.253.91]
Jun 18 05:15:42 mail.srvfarm.net postfix/smtps/smtpd[1338906]: warning: unknown[202.52.253.91]: SASL PLAIN authentication failed:

Jun 18 05:07:55 mail.srvfarm.net postfix/smtps/smtpd[1338644]: warning: unknown[109.207.34.236]: SASL PLAIN authentication failed: 
Jun 18 05:07:55 mail.srvfarm.net postfix/smtps/smtpd[1338644]: lost connection after AUTH from unknown[109.207.34.236]
Jun 18 05:14:30 mail.srvfarm.net postfix/smtps/smtpd[1338644]: warning: unknown[109.207.34.236]: SASL PLAIN authentication failed: 
Jun 18 05:14:31 mail.srvfarm.net postfix/smtps/smtpd[1338644]: lost connection after AUTH from unknown[109.207.34.236]
Jun 18 05:14:57 mail.srvfarm.net postfix/smtps/smtpd[1340853]: warning: unknown[109.207.34.236]: SASL PLAIN authentication failed:

Jun 18 05:06:13 mail.srvfarm.net postfix/smtps/smtpd[1338905]: warning: unknown[186.236.18.117]: SASL PLAIN authentication failed: 
Jun 18 05:06:13 mail.srvfarm.net postfix/smtps/smtpd[1338905]: lost connection after AUTH from unknown[186.236.18.117]
Jun 18 05:14:15 mail.srvfarm.net postfix/smtps/smtpd[1338971]: warning: unknown[186.236.18.117]: SASL PLAIN authentication failed: 
Jun 18 05:14:16 mail.srvfarm.net postfix/smtps/smtpd[1338971]: lost connection after AUTH from unknown[186.236.18.117]
Jun 18 05:16:03 mail.srvfarm.net postfix/smtps/smtpd[1337852]: warning: unknown[186.236.18.117]: SASL PLAIN authentication failed:

Time:     Thu Jun 18 04:44:52 2020 -0300
IP:       104.129.4.186 (US/United States/104.129.4.186.static.quadranet.com)
Failures: 30 (smtpauth)
Interval: 3600 seconds
Blocked:  Permanent Block

Jun 18 10:06:39 mail postfix/smtpd\[1906\]: warning: unknown\[46.38.150.142\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6\
Jun 18 10:07:25 mail postfix/smtpd\[3277\]: warning: unknown\[46.38.150.142\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6\
Jun 18 10:08:12 mail postfix/smtpd\[3164\]: warning: unknown\[46.38.150.142\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6\
Jun 18 10:38:39 mail postfix/smtpd\[4884\]: warning: unknown\[46.38.150.142\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6\