Oct  7 11:05:49 ws22vmsma01 sshd[54278]: Failed password for root from 113.200.60.74 port 58765 ssh2
...

2020-10-07T02:46:21.466743yoshi.linuxbox.ninja sshd[1677507]: Failed password for root from 113.200.60.74 port 40281 ssh2
2020-10-07T02:48:15.998602yoshi.linuxbox.ninja sshd[1678925]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.200.60.74  user=root
2020-10-07T02:48:18.184886yoshi.linuxbox.ninja sshd[1678925]: Failed password for root from 113.200.60.74 port 51645 ssh2
...

2020-10-03T23:18:52.453158amanda2.illicoweb.com sshd\[38906\]: Invalid user comercial from 113.200.60.74 port 53094
2020-10-03T23:18:52.458577amanda2.illicoweb.com sshd\[38906\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.200.60.74
2020-10-03T23:18:54.794983amanda2.illicoweb.com sshd\[38906\]: Failed password for invalid user comercial from 113.200.60.74 port 53094 ssh2
2020-10-03T23:28:05.630705amanda2.illicoweb.com sshd\[39484\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.200.60.74  user=root
2020-10-03T23:28:07.888046amanda2.illicoweb.com sshd\[39484\]: Failed password for root from 113.200.60.74 port 41537 ssh2
...

2020-10-03T10:05:16.610158linuxbox-skyline sshd[259932]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.200.60.74  user=root
2020-10-03T10:05:18.843099linuxbox-skyline sshd[259932]: Failed password for root from 113.200.60.74 port 53064 ssh2
...

Invalid user jobs from 113.200.60.74 port 48828

113.200.60.74 (CN/China/-), 6 distributed sshd attacks on account [root] in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_DISTATTACK; Logs: Sep 18 11:07:43 server5 sshd[20042]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.241.218.40  user=root
Sep 18 11:07:46 server5 sshd[20042]: Failed password for root from 192.241.218.40 port 37298 ssh2
Sep 18 11:07:05 server5 sshd[19649]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.166.54.199  user=root
Sep 18 11:08:33 server5 sshd[20243]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.200.60.74  user=root
Sep 18 11:07:35 server5 sshd[20002]: Failed password for root from 54.37.162.36 port 49652 ssh2
Sep 18 11:07:08 server5 sshd[19649]: Failed password for root from 188.166.54.199 port 47140 ssh2

IP Addresses Blocked:

192.241.218.40 (US/United States/-)
188.166.54.199 (NL/Netherlands/-)

Sep 18 08:06:05 marvibiene sshd[23272]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.200.60.74  user=root
Sep 18 08:06:07 marvibiene sshd[23272]: Failed password for root from 113.200.60.74 port 45987 ssh2
Sep 18 08:09:44 marvibiene sshd[61341]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.200.60.74  user=root
Sep 18 08:09:47 marvibiene sshd[61341]: Failed password for root from 113.200.60.74 port 58184 ssh2

Sep 17 23:39:03 lunarastro sshd[25487]: Failed password for root from 113.200.60.74 port 50225 ssh2

2020-09-16T11:04:30.099252abusebot-5.cloudsearch.cf sshd[10904]: Invalid user admin from 113.200.60.74 port 60046
2020-09-16T11:04:30.106876abusebot-5.cloudsearch.cf sshd[10904]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.200.60.74
2020-09-16T11:04:30.099252abusebot-5.cloudsearch.cf sshd[10904]: Invalid user admin from 113.200.60.74 port 60046
2020-09-16T11:04:31.942108abusebot-5.cloudsearch.cf sshd[10904]: Failed password for invalid user admin from 113.200.60.74 port 60046 ssh2
2020-09-16T11:08:28.266995abusebot-5.cloudsearch.cf sshd[10910]: Invalid user lfy from 113.200.60.74 port 58909
2020-09-16T11:08:28.273259abusebot-5.cloudsearch.cf sshd[10910]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.200.60.74
2020-09-16T11:08:28.266995abusebot-5.cloudsearch.cf sshd[10910]: Invalid user lfy from 113.200.60.74 port 58909
2020-09-16T11:08:29.782190abusebot-5.cloudsearch.cf sshd[10910]: Failed pas
...

Wordpress malicious attack:[sshd]

Unauthorised connection attempt detected at AUO NODE 4. System is sshd. Protected by AUO Stack Web Application Firewall (WAF)

Aug 27 23:50:49 [host] sshd[19930]: pam_unix(sshd:
Aug 27 23:50:51 [host] sshd[19930]: Failed passwor
Aug 27 23:53:22 [host] sshd[19985]: Invalid user d

Aug 22 00:09:20 ip106 sshd[4109]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.200.60.74 
Aug 22 00:09:21 ip106 sshd[4109]: Failed password for invalid user sdtd from 113.200.60.74 port 52148 ssh2
...

Aug 20 20:13:34 vps1 sshd[15482]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.200.60.74 
Aug 20 20:13:35 vps1 sshd[15482]: Failed password for invalid user webuser from 113.200.60.74 port 51414 ssh2
Aug 20 20:17:29 vps1 sshd[15557]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.200.60.74 
Aug 20 20:17:31 vps1 sshd[15557]: Failed password for invalid user fi from 113.200.60.74 port 44636 ssh2
Aug 20 20:19:59 vps1 sshd[15596]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.200.60.74 
Aug 20 20:20:02 vps1 sshd[15596]: Failed password for invalid user jonny from 113.200.60.74 port 60234 ssh2
...

Aug 16 06:09:05 game-panel sshd[19895]: Failed password for root from 113.200.60.74 port 55714 ssh2
Aug 16 06:11:38 game-panel sshd[20166]: Failed password for root from 113.200.60.74 port 42081 ssh2

Dec  9 17:33:28 nextcloud sshd\[24527\]: Invalid user janardhan from 189.181.198.255
Dec  9 17:33:28 nextcloud sshd\[24527\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.181.198.255
Dec  9 17:33:30 nextcloud sshd\[24527\]: Failed password for invalid user janardhan from 189.181.198.255 port 60425 ssh2
...

Dec  9 17:44:02 * sshd[24290]: Failed password for root from 187.163.116.92 port 46474 ssh2
Dec  9 17:51:14 * sshd[25219]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.163.116.92

Lines containing failures of 168.232.130.102
Dec  9 15:55:07 shared03 sshd[5112]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=168.232.130.102  user=r.r
Dec  9 15:55:10 shared03 sshd[5112]: Failed password for r.r from 168.232.130.102 port 37605 ssh2
Dec  9 15:55:12 shared03 sshd[5112]: Failed password for r.r from 168.232.130.102 port 37605 ssh2
Dec  9 15:55:14 shared03 sshd[5112]: Failed password for r.r from 168.232.130.102 port 37605 ssh2


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=168.232.130.102

Dec  9 08:49:52 home sshd[14094]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.89.111.136  user=root
Dec  9 08:49:53 home sshd[14094]: Failed password for root from 159.89.111.136 port 50282 ssh2
Dec  9 08:57:30 home sshd[14155]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.89.111.136  user=root
Dec  9 08:57:32 home sshd[14155]: Failed password for root from 159.89.111.136 port 59334 ssh2
Dec  9 09:02:38 home sshd[14207]: Invalid user jungle from 159.89.111.136 port 39148
Dec  9 09:02:38 home sshd[14207]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.89.111.136
Dec  9 09:02:38 home sshd[14207]: Invalid user jungle from 159.89.111.136 port 39148
Dec  9 09:02:40 home sshd[14207]: Failed password for invalid user jungle from 159.89.111.136 port 39148 ssh2
Dec  9 09:07:47 home sshd[14245]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost

SSH authentication failure x 6 reported by Fail2Ban
...

$f2bV_matches

Dec  9 06:36:22 hpm sshd\[19677\]: Invalid user bluesk from 54.38.160.4
Dec  9 06:36:22 hpm sshd\[19677\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ip4.ip-54-38-160.eu
Dec  9 06:36:24 hpm sshd\[19677\]: Failed password for invalid user bluesk from 54.38.160.4 port 33512 ssh2
Dec  9 06:42:11 hpm sshd\[20381\]: Invalid user joaquim from 54.38.160.4
Dec  9 06:42:11 hpm sshd\[20381\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ip4.ip-54-38-160.eu

SSH bruteforce

Dec  9 19:39:19 debian-2gb-vpn-nbg1-1 kernel: [287947.148173] [UFW BLOCK] IN=eth0 OUT= MAC=96:00:00:38:96:44:d2:74:7f:6e:37:e3:08:00 SRC=80.82.70.239 DST=78.46.192.101 LEN=40 TOS=0x00 PREC=0x00 TTL=247 ID=32181 PROTO=TCP SPT=51994 DPT=5631 WINDOW=1024 RES=0x00 SYN URGP=0

Dec  9 11:24:53 linuxvps sshd\[10996\]: Invalid user lexluthe from 203.160.62.115
Dec  9 11:24:53 linuxvps sshd\[10996\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.160.62.115
Dec  9 11:24:55 linuxvps sshd\[10996\]: Failed password for invalid user lexluthe from 203.160.62.115 port 40782 ssh2
Dec  9 11:31:19 linuxvps sshd\[15283\]: Invalid user mike from 203.160.62.115
Dec  9 11:31:19 linuxvps sshd\[15283\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.160.62.115

2019-12-09T17:10:09.406499  sshd[11806]: Invalid user zvolanek from 200.116.173.38 port 37192
2019-12-09T17:10:09.422299  sshd[11806]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.116.173.38
2019-12-09T17:10:09.406499  sshd[11806]: Invalid user zvolanek from 200.116.173.38 port 37192
2019-12-09T17:10:11.200072  sshd[11806]: Failed password for invalid user zvolanek from 200.116.173.38 port 37192 ssh2
2019-12-09T17:16:45.194292  sshd[11923]: Invalid user slote from 200.116.173.38 port 46686
...

Dec  9 06:23:26 tdfoods sshd\[8896\]: Invalid user walkins from 158.69.196.76
Dec  9 06:23:26 tdfoods sshd\[8896\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=76.ip-158-69-196.net
Dec  9 06:23:28 tdfoods sshd\[8896\]: Failed password for invalid user walkins from 158.69.196.76 port 54414 ssh2
Dec  9 06:29:08 tdfoods sshd\[10199\]: Invalid user hhhhhhhhhh from 158.69.196.76
Dec  9 06:29:08 tdfoods sshd\[10199\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=76.ip-158-69-196.net

Dec  9 16:33:34 ns382633 sshd\[14306\]: Invalid user pioneer from 13.75.69.108 port 42766
Dec  9 16:33:34 ns382633 sshd\[14306\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=13.75.69.108
Dec  9 16:33:36 ns382633 sshd\[14306\]: Failed password for invalid user pioneer from 13.75.69.108 port 42766 ssh2
Dec  9 16:41:58 ns382633 sshd\[15893\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=13.75.69.108  user=root
Dec  9 16:42:00 ns382633 sshd\[15893\]: Failed password for root from 13.75.69.108 port 38448 ssh2

Dec  9 11:18:24 ny01 sshd[20214]: Failed password for root from 180.101.125.226 port 49212 ssh2
Dec  9 11:26:34 ny01 sshd[21426]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.101.125.226
Dec  9 11:26:36 ny01 sshd[21426]: Failed password for invalid user kinnebergbraaten from 180.101.125.226 port 45592 ssh2

Dec  9 18:38:39 server sshd\[6378\]: Invalid user saitoh from 159.89.115.126
Dec  9 18:38:39 server sshd\[6378\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.89.115.126 
Dec  9 18:38:41 server sshd\[6378\]: Failed password for invalid user saitoh from 159.89.115.126 port 53218 ssh2
Dec  9 18:48:13 server sshd\[9221\]: Invalid user http from 159.89.115.126
Dec  9 18:48:13 server sshd\[9221\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.89.115.126 
...