Oct 10 22:19:53 OPSO sshd\[5215\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.163.101.205  user=root
Oct 10 22:19:56 OPSO sshd\[5215\]: Failed password for root from 118.163.101.205 port 47858 ssh2
Oct 10 22:23:38 OPSO sshd\[6309\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.163.101.205  user=root
Oct 10 22:23:40 OPSO sshd\[6309\]: Failed password for root from 118.163.101.205 port 53732 ssh2
Oct 10 22:27:32 OPSO sshd\[7736\]: Invalid user test from 118.163.101.205 port 59612
Oct 10 22:27:32 OPSO sshd\[7736\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.163.101.205

Oct 10 08:53:02 vps46666688 sshd[17158]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.163.101.205
Oct 10 08:53:04 vps46666688 sshd[17158]: Failed password for invalid user tal from 118.163.101.205 port 56480 ssh2
...

Sep  1 07:49:11 ws26vmsma01 sshd[235173]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.163.101.205
Sep  1 07:49:13 ws26vmsma01 sshd[235173]: Failed password for invalid user tvm from 118.163.101.205 port 53368 ssh2
...

Aug 28 15:25:27 vps639187 sshd\[7769\]: Invalid user test from 118.163.101.205 port 50292
Aug 28 15:25:27 vps639187 sshd\[7769\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.163.101.205
Aug 28 15:25:29 vps639187 sshd\[7769\]: Failed password for invalid user test from 118.163.101.205 port 50292 ssh2
...

Aug  8 08:10:55 cosmoit sshd[19594]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.163.101.205

Aug  6 17:42:32 fhem-rasp sshd[23859]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.163.101.205  user=root
Aug  6 17:42:34 fhem-rasp sshd[23859]: Failed password for root from 118.163.101.205 port 37856 ssh2
...

Lines containing failures of 118.163.101.205
Aug  4 04:15:44 ntop sshd[8531]: User r.r from 118.163.101.205 not allowed because not listed in AllowUsers
Aug  4 04:15:44 ntop sshd[8531]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.163.101.205  user=r.r
Aug  4 04:15:46 ntop sshd[8531]: Failed password for invalid user r.r from 118.163.101.205 port 34906 ssh2
Aug  4 04:15:47 ntop sshd[8531]: Received disconnect from 118.163.101.205 port 34906:11: Bye Bye [preauth]
Aug  4 04:15:47 ntop sshd[8531]: Disconnected from invalid user r.r 118.163.101.205 port 34906 [preauth]
Aug  4 04:22:05 ntop sshd[11427]: User r.r from 118.163.101.205 not allowed because not listed in AllowUsers
Aug  4 04:22:05 ntop sshd[11427]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.163.101.205  user=r.r
Aug  4 04:22:07 ntop sshd[11427]: Failed password for invalid user r.r from 118.163.101.205 port 41704 ssh2
A........
------------------------------

Aug  5 14:07:23 vpn01 sshd[12103]: Failed password for root from 118.163.101.205 port 34108 ssh2
...

Sep 14 08:45:02 ws22vmsma01 sshd[193992]: Failed password for root from 118.163.101.207 port 57592 ssh2
...

Sep 14 08:37:52 ws22vmsma01 sshd[165807]: Failed password for root from 118.163.101.206 port 55272 ssh2
Sep 14 08:40:44 ws22vmsma01 sshd[177262]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.163.101.206
...

$f2bV_matches

Sep 14 13:14:22 localhost sshd[1381260]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.163.101.206  user=root
Sep 14 13:14:24 localhost sshd[1381260]: Failed password for root from 118.163.101.206 port 41182 ssh2
...

$f2bV_matches

Sep 13 18:59:34 mail sshd[12631]: Failed password for root from 118.163.101.206 port 51502 ssh2

2020-09-01T12:17:19.270853mail.standpoint.com.ua sshd[8027]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.163.101.206
2020-09-01T12:17:19.267145mail.standpoint.com.ua sshd[8027]: Invalid user applprod from 118.163.101.206 port 45214
2020-09-01T12:17:21.682056mail.standpoint.com.ua sshd[8027]: Failed password for invalid user applprod from 118.163.101.206 port 45214 ssh2
2020-09-01T12:21:14.932398mail.standpoint.com.ua sshd[8581]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.163.101.206  user=root
2020-09-01T12:21:16.601458mail.standpoint.com.ua sshd[8581]: Failed password for root from 118.163.101.206 port 52462 ssh2
...

"fail2ban match"

Aug 29 14:05:43 mail sshd[1990380]: Failed password for invalid user event from 118.163.101.207 port 45438 ssh2
Aug 29 14:07:17 mail sshd[1990439]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.163.101.207  user=root
Aug 29 14:07:19 mail sshd[1990439]: Failed password for root from 118.163.101.207 port 38038 ssh2
...

2020-08-25T14:50:46.942660vps751288.ovh.net sshd\[27691\]: Invalid user titan from 118.163.101.206 port 54914
2020-08-25T14:50:46.952478vps751288.ovh.net sshd\[27691\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.163.101.206
2020-08-25T14:50:49.034833vps751288.ovh.net sshd\[27691\]: Failed password for invalid user titan from 118.163.101.206 port 54914 ssh2
2020-08-25T14:55:00.735446vps751288.ovh.net sshd\[27709\]: Invalid user michael01 from 118.163.101.206 port 34406
2020-08-25T14:55:00.745439vps751288.ovh.net sshd\[27709\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.163.101.206

SSH brute force attempt

Aug 16 05:49:24 db sshd[20727]: User root from 118.163.101.207 not allowed because none of user's groups are listed in AllowGroups
...

(sshd) Failed SSH login from 118.163.101.207 (TW/Taiwan/mail3.lydsec.com): 5 in the last 3600 secs

Aug 5 22:59:32 *hidden* sshd[7707]: Failed password for *hidden* from 118.163.101.207 port 39998 ssh2 Aug 5 23:39:48 *hidden* sshd[13948]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.163.101.207 user=root Aug 5 23:39:50 *hidden* sshd[13948]: Failed password for *hidden* from 118.163.101.207 port 40364 ssh2

SSH invalid-user multiple login try

26/tcp 9000/tcp 23/tcp...
[2019-11-23/12-07]4pkt,3pt.(tcp)

Automatic report - Port Scan Attack

ssh failed login

2019-12-07T09:13:41.053732shield sshd\[18985\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.88.112.55  user=root
2019-12-07T09:13:43.648678shield sshd\[18985\]: Failed password for root from 49.88.112.55 port 25099 ssh2
2019-12-07T09:13:46.890884shield sshd\[18985\]: Failed password for root from 49.88.112.55 port 25099 ssh2
2019-12-07T09:13:51.158723shield sshd\[18985\]: Failed password for root from 49.88.112.55 port 25099 ssh2
2019-12-07T09:13:54.496437shield sshd\[18985\]: Failed password for root from 49.88.112.55 port 25099 ssh2

Attempted spam UTC Dec 7 06:23:07 from=

Dec  7 10:38:12 vps666546 sshd\[22958\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.169.194  user=root
Dec  7 10:38:14 vps666546 sshd\[22958\]: Failed password for root from 222.186.169.194 port 27834 ssh2
Dec  7 10:38:18 vps666546 sshd\[22958\]: Failed password for root from 222.186.169.194 port 27834 ssh2
Dec  7 10:38:21 vps666546 sshd\[22958\]: Failed password for root from 222.186.169.194 port 27834 ssh2
Dec  7 10:38:25 vps666546 sshd\[22958\]: Failed password for root from 222.186.169.194 port 27834 ssh2
...

Nov 12 13:33:20 microserver sshd[51232]: Invalid user azizi from 200.41.86.59 port 47870
Nov 12 13:33:20 microserver sshd[51232]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.41.86.59
Nov 12 13:33:22 microserver sshd[51232]: Failed password for invalid user azizi from 200.41.86.59 port 47870 ssh2
Nov 12 13:37:43 microserver sshd[51854]: Invalid user vlad from 200.41.86.59 port 56876
Nov 12 13:37:43 microserver sshd[51854]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.41.86.59
Dec  7 09:45:44 microserver sshd[13856]: Invalid user slyteris from 200.41.86.59 port 50170
Dec  7 09:45:44 microserver sshd[13856]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.41.86.59
Dec  7 09:45:46 microserver sshd[13856]: Failed password for invalid user slyteris from 200.41.86.59 port 50170 ssh2
Dec  7 09:53:43 microserver sshd[14812]: Invalid user purohit from 200.41.86.59 port 60706
Dec  7

Dec  6 22:54:27 km20725 sshd[14273]: Invalid user marlen from 122.51.99.14
Dec  6 22:54:27 km20725 sshd[14273]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.99.14
Dec  6 22:54:29 km20725 sshd[14273]: Failed password for invalid user marlen from 122.51.99.14 port 54904 ssh2
Dec  6 22:54:29 km20725 sshd[14273]: Received disconnect from 122.51.99.14: 11: Bye Bye [preauth]
Dec  6 23:06:07 km20725 sshd[14789]: Invalid user moncure from 122.51.99.14
Dec  6 23:06:07 km20725 sshd[14789]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.99.14
Dec  6 23:06:09 km20725 sshd[14789]: Failed password for invalid user moncure from 122.51.99.14 port 58772 ssh2
Dec  6 23:06:10 km20725 sshd[14789]: Received disconnect from 122.51.99.14: 11: Bye Bye [preauth]
Dec  6 23:13:18 km20725 sshd[15272]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.99.14 ........
-------------------------------

Dec  6 23:14:07 hpm sshd\[17112\]: Invalid user olkowski from 138.36.204.234
Dec  6 23:14:07 hpm sshd\[17112\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.36.204.234
Dec  6 23:14:08 hpm sshd\[17112\]: Failed password for invalid user olkowski from 138.36.204.234 port 17160 ssh2
Dec  6 23:20:57 hpm sshd\[17733\]: Invalid user mackenzie1234567 from 138.36.204.234
Dec  6 23:20:57 hpm sshd\[17733\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.36.204.234

UTC: 2019-12-06 port: 123/udp

2019-12-07T07:31:30.187626abusebot.cloudsearch.cf sshd\[24731\]: Invalid user oracle from 222.239.78.88 port 44850

Attempted spam UTC Dec 7 05:11:05 from=

163.172.7.215 was recorded 15 times by 15 hosts attempting to connect to the following ports: 5060. Incident counter (4h, 24h, all-time): 15, 15, 36

[Aegis] @ 2019-12-07 09:49:43  0000 -> Attempted Administrator Privilege Gain: ET SCAN LibSSH Based Frequent SSH Connections Likely BruteForce Attack

2019-12-07T06:28:18.752385abusebot-5.cloudsearch.cf sshd\[2986\]: Invalid user robert from 194.243.6.150 port 34548
2019-12-07T06:28:18.756455abusebot-5.cloudsearch.cf sshd\[2986\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=host150-6-static.243-194-b.business.telecomitalia.it