Oct 12 14:28:18 ws26vmsma01 sshd[90518]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.204.164
Oct 12 14:28:20 ws26vmsma01 sshd[90518]: Failed password for invalid user marcy from 128.199.204.164 port 48264 ssh2
...

Oct 12 09:57:32 abendstille sshd\[10380\]: Invalid user user from 128.199.204.164
Oct 12 09:57:32 abendstille sshd\[10380\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.204.164
Oct 12 09:57:35 abendstille sshd\[10380\]: Failed password for invalid user user from 128.199.204.164 port 55594 ssh2
Oct 12 10:01:28 abendstille sshd\[15329\]: Invalid user john from 128.199.204.164
Oct 12 10:01:28 abendstille sshd\[15329\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.204.164
...

Sep 30 19:16:52 ovpn sshd\[24137\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.204.164  user=root
Sep 30 19:16:54 ovpn sshd\[24137\]: Failed password for root from 128.199.204.164 port 52396 ssh2
Sep 30 19:20:51 ovpn sshd\[25119\]: Invalid user debian from 128.199.204.164
Sep 30 19:20:51 ovpn sshd\[25119\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.204.164
Sep 30 19:20:53 ovpn sshd\[25119\]: Failed password for invalid user debian from 128.199.204.164 port 35466 ssh2

2020-09-30T13:13:00.979478abusebot-2.cloudsearch.cf sshd[560]: Invalid user postgres from 128.199.204.164 port 49698
2020-09-30T13:13:00.984944abusebot-2.cloudsearch.cf sshd[560]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.204.164
2020-09-30T13:13:00.979478abusebot-2.cloudsearch.cf sshd[560]: Invalid user postgres from 128.199.204.164 port 49698
2020-09-30T13:13:03.283048abusebot-2.cloudsearch.cf sshd[560]: Failed password for invalid user postgres from 128.199.204.164 port 49698 ssh2
2020-09-30T13:17:20.823943abusebot-2.cloudsearch.cf sshd[617]: Invalid user ftpuser from 128.199.204.164 port 55974
2020-09-30T13:17:20.829622abusebot-2.cloudsearch.cf sshd[617]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.204.164
2020-09-30T13:17:20.823943abusebot-2.cloudsearch.cf sshd[617]: Invalid user ftpuser from 128.199.204.164 port 55974
2020-09-30T13:17:22.485551abusebot-2.cloudsearch.cf sshd[6
...

Tried sshing with brute force.

SSH Brute-Force reported by Fail2Ban

Sep 22 16:38:57 ns382633 sshd\[9266\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.204.164  user=root
Sep 22 16:38:59 ns382633 sshd\[9266\]: Failed password for root from 128.199.204.164 port 53482 ssh2
Sep 22 16:56:01 ns382633 sshd\[12635\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.204.164  user=root
Sep 22 16:56:02 ns382633 sshd\[12635\]: Failed password for root from 128.199.204.164 port 45356 ssh2
Sep 22 17:00:37 ns382633 sshd\[13491\]: Invalid user administrador from 128.199.204.164 port 53290
Sep 22 17:00:37 ns382633 sshd\[13491\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.204.164

(sshd) Failed SSH login from 128.199.204.164 (SG/Singapore/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Sep 22 04:37:40 server4 sshd[15894]: Invalid user micha from 128.199.204.164
Sep 22 04:37:40 server4 sshd[15894]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.204.164 
Sep 22 04:37:42 server4 sshd[15894]: Failed password for invalid user micha from 128.199.204.164 port 39558 ssh2
Sep 22 04:39:16 server4 sshd[16904]: Invalid user juancarlos from 128.199.204.164
Sep 22 04:39:16 server4 sshd[16904]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.204.164

(sshd) Failed SSH login from 128.199.204.164 (SG/Singapore/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Sep 17 09:50:13 optimus sshd[3841]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.204.164  user=root
Sep 17 09:50:15 optimus sshd[3841]: Failed password for root from 128.199.204.164 port 59772 ssh2
Sep 17 09:54:38 optimus sshd[5470]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.204.164  user=root
Sep 17 09:54:39 optimus sshd[5470]: Failed password for root from 128.199.204.164 port 41738 ssh2
Sep 17 10:03:37 optimus sshd[9386]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.204.164  user=root

2020-09-17T08:40:36.281633ollin.zadara.org sshd[456757]: Invalid user chad from 128.199.204.164 port 57346
2020-09-17T08:40:38.740285ollin.zadara.org sshd[456757]: Failed password for invalid user chad from 128.199.204.164 port 57346 ssh2
...

Sep 17 00:00:00 mavik sshd[15307]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.204.164  user=root
Sep 17 00:00:02 mavik sshd[15307]: Failed password for root from 128.199.204.164 port 36264 ssh2
Sep 17 00:03:28 mavik sshd[15510]: Invalid user cehost from 128.199.204.164
Sep 17 00:03:28 mavik sshd[15510]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.204.164
Sep 17 00:03:31 mavik sshd[15510]: Failed password for invalid user cehost from 128.199.204.164 port 36024 ssh2
...

2020-09-10T10:15:41.293969cyberdyne sshd[514278]: Invalid user nak from 128.199.204.26 port 48994
2020-09-10T10:15:41.297772cyberdyne sshd[514278]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.204.26
2020-09-10T10:15:41.293969cyberdyne sshd[514278]: Invalid user nak from 128.199.204.26 port 48994
2020-09-10T10:15:43.310306cyberdyne sshd[514278]: Failed password for invalid user nak from 128.199.204.26 port 48994 ssh2
...

2020-09-10T10:15:41.293969cyberdyne sshd[514278]: Invalid user nak from 128.199.204.26 port 48994
2020-09-10T10:15:41.297772cyberdyne sshd[514278]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.204.26
2020-09-10T10:15:41.293969cyberdyne sshd[514278]: Invalid user nak from 128.199.204.26 port 48994
2020-09-10T10:15:43.310306cyberdyne sshd[514278]: Failed password for invalid user nak from 128.199.204.26 port 48994 ssh2
...

Invalid user tomcat from 128.199.204.26 port 51882

...

villaromeo.de 202.29.30.204 \[27/Jul/2019:07:10:47 +0200\] "POST /wp-login.php HTTP/1.1" 200 2061 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"
villaromeo.de 202.29.30.204 \[27/Jul/2019:07:10:48 +0200\] "POST /wp-login.php HTTP/1.1" 200 2066 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"

Rude login attack (2 tries in 1d)

Jul 27 08:04:08 localhost sshd\[53426\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.254.222  user=root
Jul 27 08:04:10 localhost sshd\[53426\]: Failed password for root from 104.248.254.222 port 38216 ssh2
Jul 27 08:08:26 localhost sshd\[53542\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.254.222  user=root
Jul 27 08:08:28 localhost sshd\[53542\]: Failed password for root from 104.248.254.222 port 34230 ssh2
Jul 27 08:12:40 localhost sshd\[53710\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.254.222  user=root
...

xmlrpc attack

Jul 27 08:37:35 mail sshd\[27429\]: Invalid user Bernard from 119.57.162.18 port 51913
Jul 27 08:37:35 mail sshd\[27429\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.57.162.18
Jul 27 08:37:38 mail sshd\[27429\]: Failed password for invalid user Bernard from 119.57.162.18 port 51913 ssh2
Jul 27 08:44:05 mail sshd\[28244\]: Invalid user !QAZ3edc from 119.57.162.18 port 43901
Jul 27 08:44:05 mail sshd\[28244\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.57.162.18

TCP port 23 (Telnet) attempt blocked by firewall. [2019-07-27 07:08:41]

Jul 27 08:42:25 localhost sshd\[44832\]: Invalid user ivan from 121.201.78.33 port 14106
Jul 27 08:42:25 localhost sshd\[44832\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.201.78.33
...

port scan and connect, tcp 23 (telnet)

Jul 27 10:22:29 dedicated sshd[30876]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.99.155.54  user=root
Jul 27 10:22:31 dedicated sshd[30876]: Failed password for root from 167.99.155.54 port 57854 ssh2

failed_logins

Rude login attack (2 tries in 1d)

ssh failed login

\[2019-07-27 04:26:09\] NOTICE\[2288\] chan_sip.c: Registration from '\' failed for '63.143.35.146:63853' - Wrong password
\[2019-07-27 04:26:09\] SECURITY\[2326\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-07-27T04:26:09.735-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="90",SessionID="0x7ff4d004fe18",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/63.143.35.146/63853",Challenge="56d7e889",ReceivedChallenge="56d7e889",ReceivedHash="375cd90b431bb738b375d2d17a82400b"
\[2019-07-27 04:26:20\] NOTICE\[2288\] chan_sip.c: Registration from '\' failed for '63.143.35.146:49508' - Wrong password
\[2019-07-27 04:26:20\] SECURITY\[2326\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-07-27T04:26:20.147-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="911",SessionID="0x7ff4d00a7228",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/63.143.35.146/4

Jul 27 11:24:19 server sshd\[15401\]: User root from 106.12.103.98 not allowed because listed in DenyUsers
Jul 27 11:24:20 server sshd\[15401\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.103.98  user=root
Jul 27 11:24:22 server sshd\[15401\]: Failed password for invalid user root from 106.12.103.98 port 41350 ssh2
Jul 27 11:30:14 server sshd\[10660\]: User root from 106.12.103.98 not allowed because listed in DenyUsers
Jul 27 11:30:14 server sshd\[10660\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.103.98  user=root

2019-07-27 03:19:13 H=(ludus.it) [92.247.142.182]:52514 I=[192.147.25.65]:25 sender verify fail for : Unrouteable address
2019-07-27 03:19:13 H=(ludus.it) [92.247.142.182]:52514 I=[192.147.25.65]:25 F= rejected RCPT : Sender verify failed
2019-07-27 03:19:14 H=(ludus.it) [92.247.142.182]:52514 I=[192.147.25.65]:25 F= rejected RCPT : Sender verify failed
...