Oct  7 12:45:07 friendsofhawaii sshd\[3124\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.238.236.78  user=root
Oct  7 12:45:09 friendsofhawaii sshd\[3124\]: Failed password for root from 115.238.236.78 port 49938 ssh2
Oct  7 12:49:17 friendsofhawaii sshd\[3442\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.238.236.78  user=root
Oct  7 12:49:19 friendsofhawaii sshd\[3442\]: Failed password for root from 115.238.236.78 port 56982 ssh2
Oct  7 12:53:26 friendsofhawaii sshd\[3745\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.238.236.78  user=root

Oct  4 14:19:53 ns37 sshd[4061]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.238.236.78

2019-09-29T10:38:31.3279981495-001 sshd\[16079\]: Failed password for invalid user student from 115.238.236.78 port 34056 ssh2
2019-09-29T10:50:14.1567761495-001 sshd\[17029\]: Invalid user ts3bot3 from 115.238.236.78 port 57042
2019-09-29T10:50:14.1640711495-001 sshd\[17029\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.238.236.78
2019-09-29T10:50:16.0575341495-001 sshd\[17029\]: Failed password for invalid user ts3bot3 from 115.238.236.78 port 57042 ssh2
2019-09-29T10:56:04.1874621495-001 sshd\[17512\]: Invalid user t from 115.238.236.78 port 40308
2019-09-29T10:56:04.1943051495-001 sshd\[17512\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.238.236.78
...

Sep 28 14:11:31 mail sshd[13889]: Invalid user uv from 115.238.236.78
Sep 28 14:11:31 mail sshd[13889]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.238.236.78
Sep 28 14:11:31 mail sshd[13889]: Invalid user uv from 115.238.236.78
Sep 28 14:11:33 mail sshd[13889]: Failed password for invalid user uv from 115.238.236.78 port 39226 ssh2
Sep 28 14:29:40 mail sshd[9570]: Invalid user vagrant from 115.238.236.78
...

Nov  3 16:38:15 debian sshd\[9582\]: Invalid user Sporting2016 from 115.238.236.74 port 20349
Nov  3 16:38:15 debian sshd\[9582\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.238.236.74
Nov  3 16:38:17 debian sshd\[9582\]: Failed password for invalid user Sporting2016 from 115.238.236.74 port 20349 ssh2
...

Oct 31 18:38:11 MK-Soft-VM4 sshd[21332]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.238.236.74 
Oct 31 18:38:13 MK-Soft-VM4 sshd[21332]: Failed password for invalid user 321 from 115.238.236.74 port 34131 ssh2
...

Invalid user samplee from 115.238.236.74 port 27997

2019-10-28T14:51:27.156761tmaserv sshd\[32627\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.238.236.74  user=root
2019-10-28T14:51:29.209637tmaserv sshd\[32627\]: Failed password for root from 115.238.236.74 port 51729 ssh2
2019-10-28T14:56:29.989941tmaserv sshd\[386\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.238.236.74  user=root
2019-10-28T14:56:32.504643tmaserv sshd\[386\]: Failed password for root from 115.238.236.74 port 5135 ssh2
2019-10-28T15:07:10.197662tmaserv sshd\[860\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.238.236.74  user=root
2019-10-28T15:07:11.708957tmaserv sshd\[860\]: Failed password for root from 115.238.236.74 port 61608 ssh2
...

Oct 28 07:47:56 vps691689 sshd[20999]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.238.236.74
Oct 28 07:47:58 vps691689 sshd[20999]: Failed password for invalid user ipko from 115.238.236.74 port 18605 ssh2
...

Oct 28 01:50:50 hosting sshd[1201]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.238.236.74  user=root
Oct 28 01:50:52 hosting sshd[1201]: Failed password for root from 115.238.236.74 port 18769 ssh2
Oct 28 02:04:02 hosting sshd[2116]: Invalid user openfire from 115.238.236.74 port 7068
Oct 28 02:04:02 hosting sshd[2116]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.238.236.74
Oct 28 02:04:02 hosting sshd[2116]: Invalid user openfire from 115.238.236.74 port 7068
Oct 28 02:04:04 hosting sshd[2116]: Failed password for invalid user openfire from 115.238.236.74 port 7068 ssh2
...

Oct 27 06:55:22 vpn01 sshd[2549]: Failed password for root from 115.238.236.74 port 10600 ssh2
...

Oct 26 16:54:11 plusreed sshd[4007]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.238.236.74  user=root
Oct 26 16:54:13 plusreed sshd[4007]: Failed password for root from 115.238.236.74 port 10087 ssh2
...

Oct 26 15:49:58 * sshd[19998]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.238.236.74
Oct 26 15:49:59 * sshd[19998]: Failed password for invalid user backups from 115.238.236.74 port 37809 ssh2

Oct 26 11:32:36 meumeu sshd[13822]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.238.236.74 
Oct 26 11:32:37 meumeu sshd[13822]: Failed password for invalid user sdtdserver from 115.238.236.74 port 35112 ssh2
Oct 26 11:38:03 meumeu sshd[14352]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.238.236.74 
...

web-1 [ssh_2] SSH Attack

Oct 24 20:36:57 MK-Soft-VM6 sshd[7292]: Failed password for root from 115.238.236.74 port 37310 ssh2
...

Sep 30 10:50:57 vtv3 sshd\[29608\]: Invalid user fedora from 115.238.236.74 port 56978
Sep 30 10:50:57 vtv3 sshd\[29608\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.238.236.74
Sep 30 10:50:59 vtv3 sshd\[29608\]: Failed password for invalid user fedora from 115.238.236.74 port 56978 ssh2
Sep 30 10:57:01 vtv3 sshd\[430\]: Invalid user prueba from 115.238.236.74 port 1062
Sep 30 10:57:01 vtv3 sshd\[430\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.238.236.74
Sep 30 11:10:13 vtv3 sshd\[7453\]: Invalid user temp from 115.238.236.74 port 27190
Sep 30 11:10:13 vtv3 sshd\[7453\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.238.236.74
Sep 30 11:10:15 vtv3 sshd\[7453\]: Failed password for invalid user temp from 115.238.236.74 port 27190 ssh2
Sep 30 11:14:34 vtv3 sshd\[9450\]: Invalid user guest from 115.238.236.74 port 37710
Sep 30 11:14:34 vtv3 sshd\[9450\]: pam_u

Oct 22 19:48:07 vmanager6029 sshd\[19269\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.238.236.74  user=root
Oct 22 19:48:09 vmanager6029 sshd\[19269\]: Failed password for root from 115.238.236.74 port 27917 ssh2
Oct 22 19:52:27 vmanager6029 sshd\[19354\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.238.236.74  user=root

Oct 22 08:10:00 icinga sshd[18987]: Failed password for root from 115.238.236.74 port 5667 ssh2
...

1598702807 - 08/29/2020 14:06:47 Host: 91.103.110.54/91.103.110.54 Port: 445 TCP Blocked

Aug 29 13:09:14 ip-172-31-16-56 sshd\[22213\]: Invalid user rohan from 83.103.59.192\
Aug 29 13:09:16 ip-172-31-16-56 sshd\[22213\]: Failed password for invalid user rohan from 83.103.59.192 port 45312 ssh2\
Aug 29 13:12:49 ip-172-31-16-56 sshd\[22238\]: Invalid user webmaster from 83.103.59.192\
Aug 29 13:12:51 ip-172-31-16-56 sshd\[22238\]: Failed password for invalid user webmaster from 83.103.59.192 port 51486 ssh2\
Aug 29 13:16:17 ip-172-31-16-56 sshd\[22278\]: Invalid user mes from 83.103.59.192\

3389BruteforceStormFW21

Aug 29 18:37:55 marvibiene sshd[11812]: Failed password for root from 222.186.169.194 port 20206 ssh2
Aug 29 18:37:59 marvibiene sshd[11812]: Failed password for root from 222.186.169.194 port 20206 ssh2

(sshd) Failed SSH login from 139.186.67.94 (CN/China/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Aug 29 13:59:06 elude sshd[21414]: Invalid user david from 139.186.67.94 port 39938
Aug 29 13:59:08 elude sshd[21414]: Failed password for invalid user david from 139.186.67.94 port 39938 ssh2
Aug 29 14:02:54 elude sshd[22063]: Invalid user plasma from 139.186.67.94 port 59594
Aug 29 14:02:56 elude sshd[22063]: Failed password for invalid user plasma from 139.186.67.94 port 59594 ssh2
Aug 29 14:06:49 elude sshd[22707]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.186.67.94  user=root

51.38.211.30 - - [29/Aug/2020:17:25:18 +0100] "POST /wp/wp-login.php HTTP/1.1" 200 1867 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
51.38.211.30 - - [29/Aug/2020:17:25:19 +0100] "POST /wp/wp-login.php HTTP/1.1" 200 1848 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
51.38.211.30 - - [29/Aug/2020:17:25:19 +0100] "POST /wp/xmlrpc.php HTTP/1.1" 200 247 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
...

$f2bV_matches

Aug 29 16:39:23 django-0 sshd[20026]: Invalid user dj from 210.12.49.162
...

Aug 29 12:07:15 XXXXXX sshd[60512]: Invalid user j from 140.143.3.130 port 49326

2020-08-29T14:06:31.323358+02:00  sshd[19905]: Failed password for invalid user manfred from 129.204.177.32 port 37372 ssh2

Aug 29 17:16:50 jumpserver sshd[88393]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.85.42.238  user=root
Aug 29 17:16:51 jumpserver sshd[88393]: Failed password for root from 112.85.42.238 port 47544 ssh2
Aug 29 17:16:54 jumpserver sshd[88393]: Failed password for root from 112.85.42.238 port 47544 ssh2
...

1598702847 - 08/29/2020 14:07:27 Host: 117.5.217.2/117.5.217.2 Port: 445 TCP Blocked

2020-08-29 07:17:17.736195-0500  localhost smtpd[51227]: NOQUEUE: reject: RCPT from unknown[173.44.175.182]: 554 5.7.1 Service unavailable; Client host [173.44.175.182] blocked using zen.spamhaus.org; shCSS; from= to= proto=ESMTP helo=

Aug 29 16:15:32 pkdns2 sshd\[37886\]: Address 190.210.62.45 maps to customer-static-210-62-45.iplannetworks.net, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!Aug 29 16:15:34 pkdns2 sshd\[37886\]: Failed password for root from 190.210.62.45 port 36078 ssh2Aug 29 16:19:56 pkdns2 sshd\[38047\]: Address 190.210.62.45 maps to customer-static-210-62-45.iplannetworks.net, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!Aug 29 16:19:56 pkdns2 sshd\[38047\]: Invalid user marilena from 190.210.62.45Aug 29 16:19:58 pkdns2 sshd\[38047\]: Failed password for invalid user marilena from 190.210.62.45 port 43832 ssh2Aug 29 16:24:11 pkdns2 sshd\[38286\]: Address 190.210.62.45 maps to customer-static-210-62-45.iplannetworks.net, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!Aug 29 16:24:11 pkdns2 sshd\[38286\]: Invalid user zzy from 190.210.62.45Aug 29 16:24:12 pkdns2 sshd\[38286\]: Failed password for invalid user zzy from 190.210.6
...

Fail2Ban Ban Triggered