Mar 20 05:42:12 silence02 sshd[18196]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.6.84.60
Mar 20 05:42:14 silence02 sshd[18196]: Failed password for invalid user lishuoguo from 116.6.84.60 port 44478 ssh2
Mar 20 05:45:13 silence02 sshd[18341]: Failed password for root from 116.6.84.60 port 44274 ssh2

Mar 14 03:52:15 ip-172-31-62-245 sshd\[4243\]: Invalid user user from 116.6.84.60\
Mar 14 03:52:17 ip-172-31-62-245 sshd\[4243\]: Failed password for invalid user user from 116.6.84.60 port 35106 ssh2\
Mar 14 03:54:08 ip-172-31-62-245 sshd\[4252\]: Invalid user admin from 116.6.84.60\
Mar 14 03:54:10 ip-172-31-62-245 sshd\[4252\]: Failed password for invalid user admin from 116.6.84.60 port 37356 ssh2\
Mar 14 03:56:03 ip-172-31-62-245 sshd\[4281\]: Failed password for root from 116.6.84.60 port 39660 ssh2\

Mar 11 13:36:57 eventyay sshd[30191]: Failed password for root from 116.6.84.60 port 54706 ssh2
Mar 11 13:39:45 eventyay sshd[30230]: Failed password for root from 116.6.84.60 port 45338 ssh2
...

Mar 10 06:04:34 jane sshd[25273]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.6.84.60 
Mar 10 06:04:36 jane sshd[25273]: Failed password for invalid user git from 116.6.84.60 port 55640 ssh2
...

$f2bV_matches

suspicious action Tue, 25 Feb 2020 13:37:38 -0300

Jan 27 12:53:24 serwer sshd\[2969\]: Invalid user sk from 116.6.84.60 port 34892
Jan 27 12:53:24 serwer sshd\[2969\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.6.84.60
Jan 27 12:53:26 serwer sshd\[2969\]: Failed password for invalid user sk from 116.6.84.60 port 34892 ssh2
Jan 27 13:07:32 serwer sshd\[4971\]: Invalid user ankesh from 116.6.84.60 port 33524
Jan 27 13:07:32 serwer sshd\[4971\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.6.84.60
Jan 27 13:07:34 serwer sshd\[4971\]: Failed password for invalid user ankesh from 116.6.84.60 port 33524 ssh2
Jan 27 13:11:10 serwer sshd\[5537\]: Invalid user guest from 116.6.84.60 port 46980
Jan 27 13:11:10 serwer sshd\[5537\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.6.84.60
Jan 27 13:11:12 serwer sshd\[5537\]: Failed password for invalid user guest from 116.6.84.60 port 46980 ssh2
Jan 2
...

Unauthorized connection attempt detected from IP address 116.6.84.60 to port 2220 [J]

Jan 23 07:50:15 game-panel sshd[15894]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.6.84.60
Jan 23 07:50:18 game-panel sshd[15894]: Failed password for invalid user user0 from 116.6.84.60 port 33318 ssh2
Jan 23 07:52:58 game-panel sshd[16021]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.6.84.60

Unauthorized connection attempt detected from IP address 116.6.84.60 to port 2220 [J]

Nov  9 10:05:17 hpm sshd\[17745\]: Invalid user wichita from 116.6.84.60
Nov  9 10:05:17 hpm sshd\[17745\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.6.84.60
Nov  9 10:05:19 hpm sshd\[17745\]: Failed password for invalid user wichita from 116.6.84.60 port 48222 ssh2
Nov  9 10:09:51 hpm sshd\[18204\]: Invalid user hadoop1234 from 116.6.84.60
Nov  9 10:09:51 hpm sshd\[18204\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.6.84.60

"Fail2Ban detected SSH brute force attempt"

Nov  9 07:48:57 *** sshd[18573]: User root from 116.6.84.60 not allowed because not listed in AllowUsers

Oct 25 10:57:33 sshgateway sshd\[14328\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.6.84.60  user=root
Oct 25 10:57:35 sshgateway sshd\[14328\]: Failed password for root from 116.6.84.60 port 37204 ssh2
Oct 25 11:02:36 sshgateway sshd\[14334\]: Invalid user user from 116.6.84.60

Invalid user nx from 116.6.84.60 port 48983

Oct 23 10:35:28 odroid64 sshd\[5010\]: User root from 116.6.84.60 not allowed because not listed in AllowUsers
Oct 23 10:35:28 odroid64 sshd\[5010\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.6.84.60  user=root
Oct 23 10:35:30 odroid64 sshd\[5010\]: Failed password for invalid user root from 116.6.84.60 port 34374 ssh2
...

Sep 12 10:52:06 root sshd[32329]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.6.84.34 
Sep 12 10:52:08 root sshd[32329]: Failed password for invalid user admin from 116.6.84.34 port 19799 ssh2
...

(sshd) Failed SSH login from 116.6.84.34 (CN/China/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Sep 11 16:08:47 optimus sshd[10764]: Invalid user family from 116.6.84.34
Sep 11 16:08:47 optimus sshd[10764]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.6.84.34 
Sep 11 16:08:50 optimus sshd[10764]: Failed password for invalid user family from 116.6.84.34 port 24806 ssh2
Sep 11 16:15:15 optimus sshd[12738]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.6.84.34  user=root
Sep 11 16:15:17 optimus sshd[12738]: Failed password for root from 116.6.84.34 port 15425 ssh2

(sshd) Failed SSH login from 116.6.84.34 (CN/China/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Sep 11 16:08:47 optimus sshd[10764]: Invalid user family from 116.6.84.34
Sep 11 16:08:47 optimus sshd[10764]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.6.84.34 
Sep 11 16:08:50 optimus sshd[10764]: Failed password for invalid user family from 116.6.84.34 port 24806 ssh2
Sep 11 16:15:15 optimus sshd[12738]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.6.84.34  user=root
Sep 11 16:15:17 optimus sshd[12738]: Failed password for root from 116.6.84.34 port 15425 ssh2

Sep  1 01:14:18 server sshd[1537]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.6.84.34 
Sep  1 01:14:18 server sshd[1537]: Invalid user yxu from 116.6.84.34 port 10080
Sep  1 01:14:20 server sshd[1537]: Failed password for invalid user yxu from 116.6.84.34 port 10080 ssh2
Sep  1 01:25:15 server sshd[1479]: Invalid user admin from 116.6.84.34 port 32373
Sep  1 01:25:15 server sshd[1479]: Invalid user admin from 116.6.84.34 port 32373
...

Aug 30 19:28:22 gw1 sshd[31626]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.6.84.34
Aug 30 19:28:24 gw1 sshd[31626]: Failed password for invalid user mob from 116.6.84.34 port 28289 ssh2
...

2020-08-28T07:25:11.703223mail.standpoint.com.ua sshd[10399]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.6.84.34
2020-08-28T07:25:11.700574mail.standpoint.com.ua sshd[10399]: Invalid user view from 116.6.84.34 port 31278
2020-08-28T07:25:13.631429mail.standpoint.com.ua sshd[10399]: Failed password for invalid user view from 116.6.84.34 port 31278 ssh2
2020-08-28T07:28:44.415593mail.standpoint.com.ua sshd[10902]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.6.84.34  user=root
2020-08-28T07:28:46.585080mail.standpoint.com.ua sshd[10902]: Failed password for root from 116.6.84.34 port 8908 ssh2
...

Cowrie Honeypot: 3 unauthorised SSH/Telnet login attempts between 2020-08-17T16:15:22Z and 2020-08-17T16:23:21Z

Mar 21 19:45:09 ws26vmsma01 sshd[217651]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=70.231.19.203
Mar 21 19:45:11 ws26vmsma01 sshd[217651]: Failed password for invalid user marisela from 70.231.19.203 port 47334 ssh2
...

2020-03-21 11:58:12,317 fail2ban.actions        [22360]: NOTICE  [sshd] Ban 89.223.90.250
2020-03-21 12:38:15,898 fail2ban.actions        [22360]: NOTICE  [sshd] Ban 89.223.90.250
2020-03-21 13:17:50,803 fail2ban.actions        [22360]: NOTICE  [sshd] Ban 89.223.90.250
2020-03-21 13:56:45,208 fail2ban.actions        [22360]: NOTICE  [sshd] Ban 89.223.90.250
2020-03-21 14:35:38,461 fail2ban.actions        [22360]: NOTICE  [sshd] Ban 89.223.90.250
...

Invalid user wding from 82.26.251.48 port 33642

Mar 21 15:11:56 server1 sshd\[5739\]: Invalid user pc from 51.75.32.141
Mar 21 15:11:56 server1 sshd\[5739\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.32.141 
Mar 21 15:11:58 server1 sshd\[5739\]: Failed password for invalid user pc from 51.75.32.141 port 40676 ssh2
Mar 21 15:18:14 server1 sshd\[7558\]: Invalid user sbin from 51.75.32.141
Mar 21 15:18:14 server1 sshd\[7558\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.32.141 
...

89.248.160.150 was recorded 18 times by 10 hosts attempting to connect to the following ports: 40879,40882,40893. Incident counter (4h, 24h, all-time): 18, 123, 8485

Mar 21 20:33:28 vpn01 sshd[16985]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.181.181.120
Mar 21 20:33:31 vpn01 sshd[16985]: Failed password for invalid user bow from 94.181.181.120 port 37826 ssh2
...

IP blocked

k+ssh-bruteforce

Mar 21 22:11:00 v22018086721571380 sshd[27559]: Failed password for root from 218.92.0.168 port 4670 ssh2
Mar 21 22:11:01 v22018086721571380 sshd[27559]: Failed password for root from 218.92.0.168 port 4670 ssh2

detected by Fail2Ban

SSH login attempts @ 2020-03-19 04:57:20

Invalid user tu from 58.71.15.10 port 49863

Mar 21 22:05:02 relay dovecot: imap-login: Disconnected: Inactivity \(auth failed, 1 attempts in 180 secs\): user=\, method=PLAIN, rip=185.22.142.132, lip=176.9.177.164, session=\
Mar 21 22:05:04 relay dovecot: imap-login: Disconnected: Inactivity \(auth failed, 1 attempts in 180 secs\): user=\, method=PLAIN, rip=185.22.142.132, lip=176.9.177.164, session=\
Mar 21 22:05:27 relay dovecot: imap-login: Disconnected: Inactivity \(auth failed, 1 attempts in 180 secs\): user=\, method=PLAIN, rip=185.22.142.132, lip=176.9.177.164, session=\
Mar 21 22:10:37 relay dovecot: imap-login: Disconnected: Inactivity \(auth failed, 1 attempts in 180 secs\): user=\, method=PLAIN, rip=185.22.142.132, lip=176.9.177.164, session=\
Mar 21 22:10:39 relay dovecot: imap-login: Disconnected: Inactivity \(auth failed, 1 attempts in 180
...

Mar 21 22:04:37 meumeu sshd[19476]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.14.148.95 
Mar 21 22:04:39 meumeu sshd[19476]: Failed password for invalid user oracle from 45.14.148.95 port 49872 ssh2
Mar 21 22:09:13 meumeu sshd[20286]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.14.148.95 
...

Invalid user av from 51.77.220.183 port 33994