Jun 20 22:04:19 ns382633 sshd\[9932\]: Invalid user admin from 114.101.247.133 port 59941
Jun 20 22:04:19 ns382633 sshd\[9932\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.101.247.133
Jun 20 22:04:21 ns382633 sshd\[9932\]: Failed password for invalid user admin from 114.101.247.133 port 59941 ssh2
Jun 20 22:13:51 ns382633 sshd\[11694\]: Invalid user postgres from 114.101.247.133 port 47359
Jun 20 22:13:51 ns382633 sshd\[11694\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.101.247.133

SSH login attempts.

SSH login attempts.

Lines containing failures of 114.101.247.243
Oct  6 22:23:40 shared11 sshd[31877]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.101.247.243  user=r.r
Oct  6 22:23:42 shared11 sshd[31877]: Failed password for r.r from 114.101.247.243 port 56959 ssh2
Oct  6 22:23:43 shared11 sshd[31877]: Received disconnect from 114.101.247.243 port 56959:11: Bye Bye [preauth]
Oct  6 22:23:43 shared11 sshd[31877]: Disconnected from authenticating user r.r 114.101.247.243 port 56959 [preauth]
Oct  6 22:25:13 shared11 sshd[32271]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.101.247.243  user=r.r


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=114.101.247.243

Sep 30 20:41:09 marvibiene sshd[19214]: Invalid user admin1 from 114.101.247.45 port 58318
Sep 30 20:41:09 marvibiene sshd[19214]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.101.247.45
Sep 30 20:41:09 marvibiene sshd[19214]: Invalid user admin1 from 114.101.247.45 port 58318
Sep 30 20:41:11 marvibiene sshd[19214]: Failed password for invalid user admin1 from 114.101.247.45 port 58318 ssh2

Sep 30 20:41:09 marvibiene sshd[19214]: Invalid user admin1 from 114.101.247.45 port 58318
Sep 30 20:41:09 marvibiene sshd[19214]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.101.247.45
Sep 30 20:41:09 marvibiene sshd[19214]: Invalid user admin1 from 114.101.247.45 port 58318
Sep 30 20:41:11 marvibiene sshd[19214]: Failed password for invalid user admin1 from 114.101.247.45 port 58318 ssh2

Sep 30 20:41:09 marvibiene sshd[19214]: Invalid user admin1 from 114.101.247.45 port 58318
Sep 30 20:41:09 marvibiene sshd[19214]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.101.247.45
Sep 30 20:41:09 marvibiene sshd[19214]: Invalid user admin1 from 114.101.247.45 port 58318
Sep 30 20:41:11 marvibiene sshd[19214]: Failed password for invalid user admin1 from 114.101.247.45 port 58318 ssh2

Lines containing failures of 114.101.247.87
Aug  3 06:39:11 server-name sshd[6481]: User r.r from 114.101.247.87 not allowed because not listed in AllowUsers
Aug  3 06:39:11 server-name sshd[6481]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.101.247.87  user=r.r
Aug  3 06:39:13 server-name sshd[6481]: Failed password for invalid user r.r from 114.101.247.87 port 51209 ssh2
Aug  3 07:40:49 server-name sshd[9382]: User r.r from 114.101.247.87 not allowed because not listed in AllowUsers
Aug  3 07:40:49 server-name sshd[9382]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.101.247.87  user=r.r
Aug  3 07:40:51 server-name sshd[9382]: Failed password for invalid user r.r from 114.101.247.87 port 47404 ssh2
Aug  3 07:40:51 server-name sshd[9382]: Received disconnect from 114.101.247.87 port 47404:11: Bye Bye [preauth]
Aug  3 07:40:51 server-name sshd[9382]: Disconnected from invalid us........
------------------------------

Jul  9 17:55:47 vestacp sshd[30723]: Invalid user fjcn from 114.101.247.48 port 52989
Jul  9 17:55:47 vestacp sshd[30723]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.101.247.48 
Jul  9 17:55:50 vestacp sshd[30723]: Failed password for invalid user fjcn from 114.101.247.48 port 52989 ssh2
Jul  9 17:55:51 vestacp sshd[30723]: Received disconnect from 114.101.247.48 port 52989:11: Bye Bye [preauth]
Jul  9 17:55:51 vestacp sshd[30723]: Disconnected from invalid user fjcn 114.101.247.48 port 52989 [preauth]
Jul  9 17:57:48 vestacp sshd[30939]: Invalid user nieto from 114.101.247.48 port 33241
Jul  9 17:57:48 vestacp sshd[30939]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.101.247.48 
Jul  9 17:57:50 vestacp sshd[30939]: Failed password for invalid user nieto from 114.101.247.48 port 33241 ssh2
Jul  9 17:57:51 vestacp sshd[30939]: Received disconnect from 114.101.247.48 port 33241........
-------------------------------

Jun 12 11:51:12 HOST sshd[3752]: Failed password for invalid user koes from 114.101.247.92 port 41824 ssh2
Jun 12 11:51:14 HOST sshd[3752]: Received disconnect from 114.101.247.92: 11: Bye Bye [preauth]
Jun 12 11:53:47 HOST sshd[3855]: Failed password for invalid user ubnt from 114.101.247.92 port 54473 ssh2
Jun 12 11:53:47 HOST sshd[3855]: Received disconnect from 114.101.247.92: 11: Bye Bye [preauth]
Jun 12 11:56:06 HOST sshd[3926]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.101.247.92  user=r.r
Jun 12 11:56:09 HOST sshd[3926]: Failed password for r.r from 114.101.247.92 port 38890 ssh2
Jun 12 11:56:09 HOST sshd[3926]: Received disconnect from 114.101.247.92: 11: Bye Bye [preauth]
Jun 12 12:03:13 HOST sshd[4138]: Failed password for invalid user admin from 114.101.247.92 port 48598 ssh2
Jun 12 12:03:14 HOST sshd[4138]: Received disconnect from 114.101.247.92: 11: Bye Bye [preauth]
Jun 12 12:05:36 HOST sshd[4221]: Receiv........
-------------------------------

Jun 12 06:06:51 h2779839 sshd[19519]: Invalid user ddj from 114.101.247.147 port 51005
Jun 12 06:06:51 h2779839 sshd[19519]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.101.247.147
Jun 12 06:06:51 h2779839 sshd[19519]: Invalid user ddj from 114.101.247.147 port 51005
Jun 12 06:06:53 h2779839 sshd[19519]: Failed password for invalid user ddj from 114.101.247.147 port 51005 ssh2
Jun 12 06:10:47 h2779839 sshd[19606]: Invalid user gituser from 114.101.247.147 port 44120
Jun 12 06:10:47 h2779839 sshd[19606]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.101.247.147
Jun 12 06:10:47 h2779839 sshd[19606]: Invalid user gituser from 114.101.247.147 port 44120
Jun 12 06:10:50 h2779839 sshd[19606]: Failed password for invalid user gituser from 114.101.247.147 port 44120 ssh2
Jun 12 06:15:05 h2779839 sshd[19672]: Invalid user nagios from 114.101.247.147 port 37239
Jun 12 06:15:05 h2779839 sshd[19672]: pam_
...

Unauthorized connection attempt detected from IP address 114.101.247.168 to port 6656 [T]

Unauthorized connection attempt detected from IP address 114.101.247.151 to port 6656 [T]

Unauthorized connection attempt detected from IP address 114.101.247.137 to port 6656 [T]

Oct  6 13:49:46 MK-Soft-VM5 sshd[12319]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.62.234.122 
Oct  6 13:49:48 MK-Soft-VM5 sshd[12319]: Failed password for invalid user 12345@QWERT from 178.62.234.122 port 57972 ssh2
...

WordPress login Brute force / Web App Attack on client site.

2019-10-06T14:10:35.9062811240 sshd\[30722\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.180.17  user=root
2019-10-06T14:10:38.6095371240 sshd\[30722\]: Failed password for root from 222.186.180.17 port 20852 ssh2
2019-10-06T14:10:43.0123861240 sshd\[30722\]: Failed password for root from 222.186.180.17 port 20852 ssh2
...

Oct  6 13:06:53 vpn01 sshd[17610]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=158.69.217.87
Oct  6 13:06:55 vpn01 sshd[17610]: Failed password for invalid user aerodynamik from 158.69.217.87 port 57476 ssh2
...

Oct  6 14:57:43 pkdns2 sshd\[34831\]: Failed password for root from 222.186.175.183 port 32852 ssh2Oct  6 14:57:48 pkdns2 sshd\[34831\]: Failed password for root from 222.186.175.183 port 32852 ssh2Oct  6 14:57:52 pkdns2 sshd\[34831\]: Failed password for root from 222.186.175.183 port 32852 ssh2Oct  6 14:57:57 pkdns2 sshd\[34831\]: Failed password for root from 222.186.175.183 port 32852 ssh2Oct  6 14:58:00 pkdns2 sshd\[34831\]: Failed password for root from 222.186.175.183 port 32852 ssh2Oct  6 14:58:12 pkdns2 sshd\[34867\]: Failed password for root from 222.186.175.183 port 48046 ssh2
...

" "

Oct  6 14:59:55 server2 sshd\[30753\]: User root from 222.186.52.89 not allowed because not listed in AllowUsers
Oct  6 15:04:55 server2 sshd\[31166\]: User root from 222.186.52.89 not allowed because not listed in AllowUsers
Oct  6 15:04:56 server2 sshd\[31172\]: User root from 222.186.52.89 not allowed because not listed in AllowUsers
Oct  6 15:04:56 server2 sshd\[31170\]: User root from 222.186.52.89 not allowed because not listed in AllowUsers
Oct  6 15:04:57 server2 sshd\[31174\]: User root from 222.186.52.89 not allowed because not listed in AllowUsers
Oct  6 15:04:57 server2 sshd\[31176\]: User root from 222.186.52.89 not allowed because not listed in AllowUsers

2019-10-06T13:40:08.077938lon01.zurich-datacenter.net sshd\[29605\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=171.244.18.14  user=root
2019-10-06T13:40:10.298396lon01.zurich-datacenter.net sshd\[29605\]: Failed password for root from 171.244.18.14 port 49838 ssh2
2019-10-06T13:44:57.413956lon01.zurich-datacenter.net sshd\[29683\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=171.244.18.14  user=root
2019-10-06T13:44:59.309589lon01.zurich-datacenter.net sshd\[29683\]: Failed password for root from 171.244.18.14 port 60918 ssh2
2019-10-06T13:49:50.232065lon01.zurich-datacenter.net sshd\[29785\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=171.244.18.14  user=root
...

Oct  6 10:33:54 vpn01 sshd[12456]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.129.64.182
Oct  6 10:33:56 vpn01 sshd[12456]: Failed password for invalid user admin from 23.129.64.182 port 62144 ssh2
...

Oct  6 13:49:59 MK-Soft-VM3 sshd[30772]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.213.63.120 
Oct  6 13:50:01 MK-Soft-VM3 sshd[30772]: Failed password for invalid user Step@2017 from 129.213.63.120 port 36366 ssh2
...

" "

Oct  6 13:42:03 SilenceServices sshd[18789]: Failed password for root from 5.196.225.45 port 46568 ssh2
Oct  6 13:45:55 SilenceServices sshd[19889]: Failed password for root from 5.196.225.45 port 58084 ssh2

Oct  5 **REMOVED** dovecot: imap-login: Disconnected \(auth failed, 1 attempts in 7 secs\): user=\, method=PLAIN, rip=221.199.41.218, lip=**REMOVED**, TLS: Disconnected, session=\
Oct  6 **REMOVED** dovecot: imap-login: Disconnected \(auth failed, 1 attempts in 6 secs\): user=\, method=PLAIN, rip=221.199.41.218, lip=**REMOVED**, TLS, session=\
Oct  6 **REMOVED** dovecot: imap-login: Disconnected \(auth failed, 1 attempts in 8 secs\): user=\, method=PLAIN, rip=221.199.41.218, lip=**REMOVED**, TLS, session=\

Oct  6 07:49:41 localhost kernel: [4100400.740219] iptables_INPUT_denied: IN=eth0 OUT= MAC=f2:3c:91:84:83:95:84:78:ac:57:a8:41:08:00 SRC=201.149.12.249 DST=[mungedIP2] LEN=40 TOS=0x00 PREC=0x00 TTL=242 ID=27914 PROTO=TCP SPT=46810 DPT=445 WINDOW=1024 RES=0x00 SYN URGP=0 
Oct  6 07:49:41 localhost kernel: [4100400.740254] iptables_INPUT_denied: IN=eth0 OUT= MAC=f2:3c:91:84:83:95:84:78:ac:57:a8:41:08:00 SRC=201.149.12.249 DST=[mungedIP2] LEN=40 TOS=0x00 PREC=0x00 TTL=242 ID=27914 PROTO=TCP SPT=46810 DPT=445 SEQ=2518224073 ACK=0 WINDOW=1024 RES=0x00 SYN URGP=0

$f2bV_matches