Jun 29 17:39:43 gw1 sshd[21735]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.175.220
Jun 29 17:39:45 gw1 sshd[21735]: Failed password for invalid user test2 from 128.199.175.220 port 58450 ssh2
...

Invalid user bocloud from 128.199.175.220 port 59980

2020-06-06T09:29:29.287284amanda2.illicoweb.com sshd\[6709\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.175.242  user=root
2020-06-06T09:29:31.089979amanda2.illicoweb.com sshd\[6709\]: Failed password for root from 128.199.175.242 port 18283 ssh2
2020-06-06T09:34:32.618502amanda2.illicoweb.com sshd\[7101\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.175.242  user=root
2020-06-06T09:34:35.018256amanda2.illicoweb.com sshd\[7101\]: Failed password for root from 128.199.175.242 port 13724 ssh2
2020-06-06T09:39:26.893215amanda2.illicoweb.com sshd\[7254\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.175.242  user=root
...

Jun  2 05:48:24 mellenthin sshd[10504]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.175.242  user=root
Jun  2 05:48:26 mellenthin sshd[10504]: Failed password for invalid user root from 128.199.175.242 port 13110 ssh2

May 31 07:27:12 vps647732 sshd[30720]: Failed password for root from 128.199.175.83 port 18232 ssh2
...

May 26 10:57:53 nextcloud sshd\[6769\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.175.242  user=root
May 26 10:57:55 nextcloud sshd\[6769\]: Failed password for root from 128.199.175.242 port 25041 ssh2
May 26 11:02:20 nextcloud sshd\[13187\]: Invalid user debug from 128.199.175.242

May 26 02:05:23 web01 sshd[14303]: Failed password for root from 128.199.175.242 port 42851 ssh2
...

(sshd) Failed SSH login from 128.199.175.83 (SG/Singapore/-): 5 in the last 3600 secs

May 25 05:55:25 ArkNodeAT sshd\[7711\]: Invalid user daniel from 128.199.175.114
May 25 05:55:25 ArkNodeAT sshd\[7711\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.175.114
May 25 05:55:28 ArkNodeAT sshd\[7711\]: Failed password for invalid user daniel from 128.199.175.114 port 41529 ssh2

May 24 21:34:16 game-panel sshd[16391]: Failed password for root from 128.199.175.235 port 1862 ssh2
May 24 21:37:25 game-panel sshd[16545]: Failed password for root from 128.199.175.235 port 43006 ssh2

Apr  7 07:18:47 pixelmemory sshd[26728]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.175.89
Apr  7 07:18:49 pixelmemory sshd[26728]: Failed password for invalid user test from 128.199.175.89 port 52292 ssh2
Apr  7 07:23:32 pixelmemory sshd[27497]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.175.89
...

k+ssh-bruteforce

Invalid user vadim from 128.199.175.89 port 46324

Feb 24 01:48:08 server sshd\[26223\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.175.116  user=root
Feb 24 01:48:10 server sshd\[26223\]: Failed password for root from 128.199.175.116 port 42784 ssh2
Feb 24 01:48:17 server sshd\[26229\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.175.116  user=root
Feb 24 01:48:19 server sshd\[26229\]: Failed password for root from 128.199.175.116 port 48178 ssh2
Feb 24 01:48:26 server sshd\[26236\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.175.116  user=root
...

Feb 23 16:27:30 mail sshd\[28324\]: Invalid user admin from 128.199.175.116
Feb 23 16:27:38 mail sshd\[28353\]: Invalid user admin from 128.199.175.116
Feb 23 16:27:47 mail sshd\[28356\]: Invalid user ubuntu from 128.199.175.116
Feb 23 16:28:03 mail sshd\[28387\]: Invalid user user from 128.199.175.116
Feb 23 16:28:12 mail sshd\[28390\]: Invalid user ubnt from 128.199.175.116
...

Dec  5 18:43:54 admin sshd[21164]: Invalid user apache from 45.120.153.88 port 55264
Dec  5 18:43:54 admin sshd[21164]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.120.153.88
Dec  5 18:43:56 admin sshd[21164]: Failed password for invalid user apache from 45.120.153.88 port 55264 ssh2
Dec  5 18:43:56 admin sshd[21164]: Received disconnect from 45.120.153.88 port 55264:11: Bye Bye [preauth]
Dec  5 18:43:56 admin sshd[21164]: Disconnected from 45.120.153.88 port 55264 [preauth]
Dec  5 18:55:05 admin sshd[21632]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.120.153.88  user=mail
Dec  5 18:55:07 admin sshd[21632]: Failed password for mail from 45.120.153.88 port 50554 ssh2
Dec  5 18:55:07 admin sshd[21632]: Received disconnect from 45.120.153.88 port 50554:11: Bye Bye [preauth]
Dec  5 18:55:07 admin sshd[21632]: Disconnected from 45.120.153.88 port 50554 [preauth]
Dec  5 19:00:52 adm........
-------------------------------

Dec  6 08:22:46 grey postfix/smtpd\[26620\]: NOQUEUE: reject: RCPT from gruesome.sapuxfiori.com\[63.80.184.100\]: 554 5.7.1 Service unavailable\; Client host \[63.80.184.100\] blocked using truncate.gbudb.net\; http://www.gbudb.com/truncate/ \[63.80.184.100\]\; from=\ to=\ proto=ESMTP helo=\
...

Dec  6 11:57:07 h2177944 sshd\[19653\]: Invalid user admin from 41.33.119.67 port 14141
Dec  6 11:57:07 h2177944 sshd\[19653\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=41.33.119.67
Dec  6 11:57:09 h2177944 sshd\[19653\]: Failed password for invalid user admin from 41.33.119.67 port 14141 ssh2
Dec  6 12:03:25 h2177944 sshd\[20316\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=41.33.119.67  user=root
...

Wordpress Admin Login attack

Dec  6 07:34:42 *** sshd[20267]: Invalid user support from 206.189.136.160

Port scan on 2 port(s): 2377 4243

Dec  5 21:52:15 tdfoods sshd\[25938\]: Invalid user postgres from 112.216.51.122
Dec  5 21:52:15 tdfoods sshd\[25938\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.216.51.122
Dec  5 21:52:17 tdfoods sshd\[25938\]: Failed password for invalid user postgres from 112.216.51.122 port 56080 ssh2
Dec  5 21:56:04 tdfoods sshd\[26313\]: Invalid user joby from 112.216.51.122
Dec  5 21:56:04 tdfoods sshd\[26313\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.216.51.122

Dec  5 22:26:15 our-server-hostname postfix/smtpd[26297]: connect from unknown[116.101.196.141]
Dec  5 22:26:16 our-server-hostname postfix/smtpd[26297]: NOQUEUE: reject: RCPT from unknown[116.101.196.141]: 504 5.5.2 : Helo command rejected: need fully-qualified hostname; from=x@x helo=
Dec  5 22:26:17 our-server-hostname postfix/smtpd[26297]: NOQUEUE: reject: RCPT from unknown[116.101.196.141]: 504 5.5.2 : Helo command rejected: need fully-qualified hostname; from=x@x helo=
Dec  5 22:26:17 our-server-hostname postfix/smtpd[26297]: lost connection after RCPT from unknown[116.101.196.141]
Dec  5 22:26:17 our-server-hostname postfix/smtpd[26297]: disconnect from unknown[116.101.196.141]
Dec  5 23:00:03 our-server-hostname postfix/smtpd[29901]: connect from unknown[116.101.196.141]
Dec  5 23:00:05 our-server-hostname postfix/smtpd[29901]: NOQUEUE: reject: RCPT from unknown[116.101.196.141]: 504 5.5.2 : Helo command rejected: need fully-qualif........
-------------------------------

Dec  6 05:40:36 TORMINT sshd\[7731\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=163.47.214.158  user=root
Dec  6 05:40:38 TORMINT sshd\[7731\]: Failed password for root from 163.47.214.158 port 46718 ssh2
Dec  6 05:47:32 TORMINT sshd\[8340\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=163.47.214.158  user=root
...

2019-12-06T10:44:16.496317shield sshd\[19400\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.38.59  user=root
2019-12-06T10:44:18.674498shield sshd\[19400\]: Failed password for root from 106.13.38.59 port 55824 ssh2
2019-12-06T10:53:52.282101shield sshd\[21193\]: Invalid user 7 from 106.13.38.59 port 60741
2019-12-06T10:53:52.286604shield sshd\[21193\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.38.59
2019-12-06T10:53:54.204019shield sshd\[21193\]: Failed password for invalid user 7 from 106.13.38.59 port 60741 ssh2

19/12/6@01:25:27: FAIL: IoT-SSH address from=89.38.145.90
...

Dec  6 13:52:13 server sshd\[2371\]: Invalid user ssh from 185.73.113.89
Dec  6 13:52:13 server sshd\[2371\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=185-73-113-89.nrp.co 
Dec  6 13:52:15 server sshd\[2371\]: Failed password for invalid user ssh from 185.73.113.89 port 42356 ssh2
Dec  6 14:00:35 server sshd\[4893\]: Invalid user burnet from 185.73.113.89
Dec  6 14:00:35 server sshd\[4893\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=185-73-113-89.nrp.co 
...

Dec  6 11:23:14 meumeu sshd[26241]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.250.18.87 
Dec  6 11:23:17 meumeu sshd[26241]: Failed password for invalid user armstead from 180.250.18.87 port 37216 ssh2
Dec  6 11:31:16 meumeu sshd[27556]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.250.18.87 
...

Dec  5 17:40:18 reporting2 sshd[12581]: reveeclipse mapping checking getaddrinfo for idc.ly.ha [42.51.194.15] failed - POSSIBLE BREAK-IN ATTEMPT!
Dec  5 17:40:18 reporting2 sshd[12581]: User r.r from 42.51.194.15 not allowed because not listed in AllowUsers
Dec  5 17:40:18 reporting2 sshd[12581]: Failed password for invalid user r.r from 42.51.194.15 port 1244 ssh2
Dec  5 17:40:19 reporting2 sshd[12581]: Failed password for invalid user r.r from 42.51.194.15 port 1244 ssh2
Dec  5 17:40:19 reporting2 sshd[12581]: Failed password for invalid user r.r from 42.51.194.15 port 1244 ssh2
Dec  5 17:40:20 reporting2 sshd[12581]: Failed password for invalid user r.r from 42.51.194.15 port 1244 ssh2
Dec  5 17:40:21 reporting2 sshd[12581]: Failed password for invalid user r.r from 42.51.194.15 port 1244 ssh2
Dec  5 17:40:25 reporting2 sshd[12638]:
.... truncated .... 
539]: User r.r from 42.51.194.15 not allowed because not listed in AllowUsers
Dec  5 18:22:17 reporting2 sshd[3539]........
-------------------------------

Dec  6 11:07:35 nextcloud sshd\[1026\]: Invalid user varkey from 51.77.230.125
Dec  6 11:07:35 nextcloud sshd\[1026\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.77.230.125
Dec  6 11:07:37 nextcloud sshd\[1026\]: Failed password for invalid user varkey from 51.77.230.125 port 59918 ssh2
...