Jun  9 08:54:41 NPSTNNYC01T sshd[4879]: Failed password for root from 109.194.175.27 port 34970 ssh2
Jun  9 08:58:01 NPSTNNYC01T sshd[5088]: Failed password for root from 109.194.175.27 port 32904 ssh2
...

Jun  9 06:37:15 NPSTNNYC01T sshd[25723]: Failed password for root from 109.194.175.27 port 44144 ssh2
Jun  9 06:44:45 NPSTNNYC01T sshd[26305]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=109.194.175.27
Jun  9 06:44:47 NPSTNNYC01T sshd[26305]: Failed password for invalid user ddd from 109.194.175.27 port 58418 ssh2
...

May 25 08:54:58 v2202003116398111542 sshd[3670]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=109.194.175.27  user=root

Apr 20 19:14:26 wbs sshd\[26740\]: Invalid user f from 109.194.175.27
Apr 20 19:14:26 wbs sshd\[26740\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=109.194.175.27
Apr 20 19:14:28 wbs sshd\[26740\]: Failed password for invalid user f from 109.194.175.27 port 39492 ssh2
Apr 20 19:18:52 wbs sshd\[27054\]: Invalid user dp from 109.194.175.27
Apr 20 19:18:52 wbs sshd\[27054\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=109.194.175.27

2020-04-12T03:44:13.723828abusebot-5.cloudsearch.cf sshd[13426]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=109.194.175.27  user=root
2020-04-12T03:44:15.513460abusebot-5.cloudsearch.cf sshd[13426]: Failed password for root from 109.194.175.27 port 48742 ssh2
2020-04-12T03:47:59.175187abusebot-5.cloudsearch.cf sshd[13438]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=109.194.175.27  user=root
2020-04-12T03:48:00.990063abusebot-5.cloudsearch.cf sshd[13438]: Failed password for root from 109.194.175.27 port 56762 ssh2
2020-04-12T03:51:46.171088abusebot-5.cloudsearch.cf sshd[13606]: Invalid user temp from 109.194.175.27 port 36552
2020-04-12T03:51:46.178646abusebot-5.cloudsearch.cf sshd[13606]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=109.194.175.27
2020-04-12T03:51:46.171088abusebot-5.cloudsearch.cf sshd[13606]: Invalid user temp from 109.194.175.27 port 
...

2020-03-29T11:29:50.706117ns386461 sshd\[28493\]: Invalid user esl from 109.194.175.27 port 38106
2020-03-29T11:29:50.708870ns386461 sshd\[28493\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=109.194.175.27
2020-03-29T11:29:52.313031ns386461 sshd\[28493\]: Failed password for invalid user esl from 109.194.175.27 port 38106 ssh2
2020-03-29T11:32:15.122430ns386461 sshd\[30660\]: Invalid user mwd from 109.194.175.27 port 40338
2020-03-29T11:32:15.127510ns386461 sshd\[30660\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=109.194.175.27
...

Invalid user rock from 109.194.175.27 port 57052

2020-03-18T06:45:59.691095randservbullet-proofcloud-66.localdomain sshd[9370]: Invalid user alesiashavel from 109.194.175.27 port 54748
2020-03-18T06:45:59.696177randservbullet-proofcloud-66.localdomain sshd[9370]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=109.194.175.27
2020-03-18T06:45:59.691095randservbullet-proofcloud-66.localdomain sshd[9370]: Invalid user alesiashavel from 109.194.175.27 port 54748
2020-03-18T06:46:01.643548randservbullet-proofcloud-66.localdomain sshd[9370]: Failed password for invalid user alesiashavel from 109.194.175.27 port 54748 ssh2
...

Invalid user jdw from 109.194.175.27 port 33028

Feb 17 15:19:08 ks10 sshd[936101]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=109.194.175.27 
Feb 17 15:19:10 ks10 sshd[936101]: Failed password for invalid user ftpuser from 109.194.175.27 port 45826 ssh2
...

Feb 16 14:51:06 plex sshd[29144]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=109.194.175.27  user=root
Feb 16 14:51:08 plex sshd[29144]: Failed password for root from 109.194.175.27 port 55392 ssh2

Feb  9 05:47:05 ovpn sshd\[26318\]: Invalid user fjx from 109.194.175.27
Feb  9 05:47:05 ovpn sshd\[26318\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=109.194.175.27
Feb  9 05:47:07 ovpn sshd\[26318\]: Failed password for invalid user fjx from 109.194.175.27 port 50444 ssh2
Feb  9 05:57:10 ovpn sshd\[28935\]: Invalid user wzv from 109.194.175.27
Feb  9 05:57:10 ovpn sshd\[28935\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=109.194.175.27

SSH Brute-Forcing (server2)

SSH invalid-user multiple login try

$f2bV_matches

Invalid user smmsp from 109.194.175.27 port 49062

Nov 30 20:24:03 php1 sshd\[32474\]: Invalid user pswd from 109.194.175.27
Nov 30 20:24:03 php1 sshd\[32474\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=109.194.175.27
Nov 30 20:24:04 php1 sshd\[32474\]: Failed password for invalid user pswd from 109.194.175.27 port 60934 ssh2
Nov 30 20:27:52 php1 sshd\[712\]: Invalid user guolei1983 from 109.194.175.27
Nov 30 20:27:52 php1 sshd\[712\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=109.194.175.27

Nov 30 20:09:03 php1 sshd\[30746\]: Invalid user mostovac from 109.194.175.27
Nov 30 20:09:03 php1 sshd\[30746\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=109.194.175.27
Nov 30 20:09:04 php1 sshd\[30746\]: Failed password for invalid user mostovac from 109.194.175.27 port 37436 ssh2
Nov 30 20:12:47 php1 sshd\[31182\]: Invalid user arkel from 109.194.175.27
Nov 30 20:12:47 php1 sshd\[31182\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=109.194.175.27

Nov 20 04:12:06 ny01 sshd[31222]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=109.194.175.27
Nov 20 04:12:08 ny01 sshd[31222]: Failed password for invalid user caddy from 109.194.175.27 port 51584 ssh2
Nov 20 04:16:02 ny01 sshd[31608]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=109.194.175.27

Nov 19 17:23:19 server sshd\[5176\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=109.194.175.27  user=root
Nov 19 17:23:20 server sshd\[5176\]: Failed password for root from 109.194.175.27 port 59668 ssh2
Nov 19 17:46:22 server sshd\[11621\]: Invalid user naric from 109.194.175.27
Nov 19 17:46:22 server sshd\[11621\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=109.194.175.27 
Nov 19 17:46:24 server sshd\[11621\]: Failed password for invalid user naric from 109.194.175.27 port 51392 ssh2
...

Automatic report - Banned IP Access

2019-11-12T10:54:17.582499suse-nuc sshd[21906]: Invalid user scheurer from 109.194.175.27 port 55698
...

Nov 10 07:23:04 minden010 sshd[20239]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=109.194.175.27
Nov 10 07:23:06 minden010 sshd[20239]: Failed password for invalid user 2003 from 109.194.175.27 port 58084 ssh2
Nov 10 07:27:11 minden010 sshd[21623]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=109.194.175.27
...

Nov  9 23:57:08 cp sshd[17781]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=109.194.175.27
Nov  9 23:57:08 cp sshd[17781]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=109.194.175.27

2019-10-23T10:26:59.704031mizuno.rwx.ovh sshd[3160394]: Connection from 109.194.175.27 port 40372 on 78.46.61.178 port 22 rdomain ""
2019-10-23T10:27:00.157676mizuno.rwx.ovh sshd[3160394]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=109.194.175.27  user=root
2019-10-23T10:27:02.960889mizuno.rwx.ovh sshd[3160394]: Failed password for root from 109.194.175.27 port 40372 ssh2
2019-10-23T10:41:52.385213mizuno.rwx.ovh sshd[3163010]: Connection from 109.194.175.27 port 50436 on 78.46.61.178 port 22 rdomain ""
2019-10-23T10:41:52.988075mizuno.rwx.ovh sshd[3163010]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=109.194.175.27  user=root
2019-10-23T10:41:54.577096mizuno.rwx.ovh sshd[3163010]: Failed password for root from 109.194.175.27 port 50436 ssh2
...

spam

email spam

email spam

proto=tcp  .  spt=47359  .  dpt=25  .     (listed on     Github Combined on 3 lists )     (505)

Aug  6 12:40:54 inter-technics sshd[4873]: Invalid user admin from 141.98.10.197 port 45637
Aug  6 12:40:54 inter-technics sshd[4873]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=141.98.10.197
Aug  6 12:40:54 inter-technics sshd[4873]: Invalid user admin from 141.98.10.197 port 45637
Aug  6 12:40:56 inter-technics sshd[4873]: Failed password for invalid user admin from 141.98.10.197 port 45637 ssh2
Aug  6 12:41:27 inter-technics sshd[4938]: Invalid user Admin from 141.98.10.197 port 44877
...

1596691197 - 08/06/2020 07:19:57 Host: 42.114.36.21/42.114.36.21 Port: 445 TCP Blocked

Unauthorized connection attempt from IP address 14.161.49.29 on port 993

Aug  6 12:31:39 debian-2gb-nbg1-2 kernel: \[18968356.318021\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=46.101.40.21 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=243 ID=63738 PROTO=TCP SPT=44832 DPT=8054 WINDOW=1024 RES=0x00 SYN URGP=0

Cowrie Honeypot: 3 unauthorised SSH/Telnet login attempts between 2020-08-06T10:36:14Z and 2020-08-06T10:44:02Z

Aug  6 12:41:03 inter-technics sshd[4878]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=141.98.10.199  user=root
Aug  6 12:41:06 inter-technics sshd[4878]: Failed password for root from 141.98.10.199 port 44861 ssh2
Aug  6 12:41:38 inter-technics sshd[4973]: Invalid user admin from 141.98.10.199 port 33785
Aug  6 12:41:38 inter-technics sshd[4973]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=141.98.10.199
Aug  6 12:41:38 inter-technics sshd[4973]: Invalid user admin from 141.98.10.199 port 33785
Aug  6 12:41:41 inter-technics sshd[4973]: Failed password for invalid user admin from 141.98.10.199 port 33785 ssh2
...

 TCP (SYN) 103.89.89.60:57616 -> port 3389, len 40

SSH brute-force attempt

Aug  6 01:14:09 ws19vmsma01 sshd[206344]: Failed password for root from 106.13.139.79 port 58482 ssh2
Aug  6 02:19:09 ws19vmsma01 sshd[148540]: Failed password for root from 106.13.139.79 port 39362 ssh2
...

TCP ports : 3389 / 3883 / 3965 / 5031 / 5043 / 33636 / 33994

Aug  6 07:15:50 xeon postfix/smtpd[20655]: warning: WGPON-39191-18.wateen.net[110.39.191.18]: SASL LOGIN authentication failed: authentication failure

 TCP (SYN) 106.75.74.225:58914 -> port 110, len 44

Failed password for root from 47.98.103.85 port 45902 ssh2

Port Scan
...

 TCP (SYN) 164.52.24.164:47131 -> port 22, len 44