Exploited Host.

Jun 11 23:53:38 cp sshd[22172]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.220.207

2020-06-07T20:22:16.017607shield sshd\[32502\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.220.207  user=root
2020-06-07T20:22:17.749038shield sshd\[32502\]: Failed password for root from 128.199.220.207 port 55482 ssh2
2020-06-07T20:24:58.142935shield sshd\[32697\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.220.207  user=root
2020-06-07T20:25:00.115069shield sshd\[32697\]: Failed password for root from 128.199.220.207 port 42244 ssh2
2020-06-07T20:27:41.705672shield sshd\[626\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.220.207  user=root

Jun  2 14:04:33 melroy-server sshd[4407]: Failed password for root from 128.199.220.207 port 38776 ssh2
...

Jun  1 14:07:24 xeon sshd[16086]: Failed password for root from 128.199.220.207 port 60588 ssh2

2020-05-10T05:54:29.414737shield sshd\[4672\]: Invalid user beth from 128.199.220.207 port 48766
2020-05-10T05:54:29.418098shield sshd\[4672\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.220.207
2020-05-10T05:54:31.231575shield sshd\[4672\]: Failed password for invalid user beth from 128.199.220.207 port 48766 ssh2
2020-05-10T05:58:58.542352shield sshd\[6999\]: Invalid user admin from 128.199.220.207 port 57018
2020-05-10T05:58:58.546155shield sshd\[6999\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.220.207

k+ssh-bruteforce

Apr  3 10:29:27 vserver sshd\[8137\]: Failed password for root from 128.199.220.207 port 56764 ssh2Apr  3 10:32:35 vserver sshd\[8181\]: Failed password for root from 128.199.220.207 port 48836 ssh2Apr  3 10:35:38 vserver sshd\[8214\]: Failed password for root from 128.199.220.207 port 40974 ssh2Apr  3 10:38:44 vserver sshd\[8239\]: Failed password for root from 128.199.220.207 port 32994 ssh2
...

SSH invalid-user multiple login attempts

Mar 23 20:33:52 vpn01 sshd[29693]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.220.207
Mar 23 20:33:54 vpn01 sshd[29693]: Failed password for invalid user kensei from 128.199.220.207 port 38052 ssh2
...

Mar 21 17:19:03 ourumov-web sshd\[2991\]: Invalid user tb from 128.199.220.207 port 55342
Mar 21 17:19:03 ourumov-web sshd\[2991\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.220.207
Mar 21 17:19:05 ourumov-web sshd\[2991\]: Failed password for invalid user tb from 128.199.220.207 port 55342 ssh2
...

Mar  1 sshd[28377]: Invalid user oracle from 128.199.220.207 port 40032

Feb 21 08:54:59  sshd\[20528\]: Invalid user zhoumin from 128.199.220.207Feb 21 08:55:01  sshd\[20528\]: Failed password for invalid user zhoumin from 128.199.220.207 port 59638 ssh2
...

Feb 20 05:53:41 minden010 sshd[15809]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.220.207
Feb 20 05:53:43 minden010 sshd[15809]: Failed password for invalid user dev from 128.199.220.207 port 53826 ssh2
Feb 20 05:56:39 minden010 sshd[16731]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.220.207
...

Invalid user ocadmin from 128.199.220.207 port 52266

Feb 15 05:52:50 haigwepa sshd[22951]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.220.207 
Feb 15 05:52:52 haigwepa sshd[22951]: Failed password for invalid user build from 128.199.220.207 port 38116 ssh2
...

Feb  6 03:33:14 server sshd\[27055\]: Invalid user tdn from 128.199.220.207
Feb  6 03:33:14 server sshd\[27055\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.220.207 
Feb  6 03:33:15 server sshd\[27055\]: Failed password for invalid user tdn from 128.199.220.207 port 50834 ssh2
Feb  6 22:57:02 server sshd\[1144\]: Invalid user tmg from 128.199.220.207
Feb  6 22:57:02 server sshd\[1144\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.220.207 
...

2020-01-25T23:55:09.958089shield sshd\[32233\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.220.207  user=root
2020-01-25T23:55:11.696594shield sshd\[32233\]: Failed password for root from 128.199.220.207 port 42382 ssh2
2020-01-25T23:59:15.432913shield sshd\[966\]: Invalid user d from 128.199.220.207 port 39080
2020-01-25T23:59:15.437790shield sshd\[966\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.220.207
2020-01-25T23:59:17.281592shield sshd\[966\]: Failed password for invalid user d from 128.199.220.207 port 39080 ssh2

SSH Brute-Force reported by Fail2Ban

[Aegis] @ 2020-01-03 18:38:38  0000 -> Attempted Administrator Privilege Gain: ET SCAN LibSSH Based Frequent SSH Connections Likely BruteForce Attack

2020-07-24T00:24:59.587428afi-git.jinr.ru sshd[13495]: Invalid user taras from 128.199.220.197 port 36746
2020-07-24T00:24:59.590798afi-git.jinr.ru sshd[13495]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.220.197
2020-07-24T00:24:59.587428afi-git.jinr.ru sshd[13495]: Invalid user taras from 128.199.220.197 port 36746
2020-07-24T00:25:01.817945afi-git.jinr.ru sshd[13495]: Failed password for invalid user taras from 128.199.220.197 port 36746 ssh2
2020-07-24T00:29:21.592207afi-git.jinr.ru sshd[14723]: Invalid user panasonic from 128.199.220.197 port 51188
...

Jul 22 08:22:00 eventyay sshd[25220]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.220.197
Jul 22 08:22:02 eventyay sshd[25220]: Failed password for invalid user kim from 128.199.220.197 port 34936 ssh2
Jul 22 08:24:32 eventyay sshd[25295]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.220.197
...

Jul 21 06:58:12 ws24vmsma01 sshd[139693]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.220.197
Jul 21 06:58:14 ws24vmsma01 sshd[139693]: Failed password for invalid user mahima from 128.199.220.197 port 52888 ssh2
...

Jul 17 03:14:34 propaganda sshd[10097]: Connection from 128.199.220.232 port 33444 on 10.0.0.160 port 22 rdomain ""
Jul 17 03:14:35 propaganda sshd[10097]: Connection closed by 128.199.220.232 port 33444 [preauth]

Jul 17 06:06:37 vps687878 sshd\[14244\]: Failed password for invalid user ching from 128.199.220.197 port 51336 ssh2
Jul 17 06:10:55 vps687878 sshd\[14814\]: Invalid user rack from 128.199.220.197 port 38710
Jul 17 06:10:55 vps687878 sshd\[14814\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.220.197
Jul 17 06:10:57 vps687878 sshd\[14814\]: Failed password for invalid user rack from 128.199.220.197 port 38710 ssh2
Jul 17 06:15:25 vps687878 sshd\[15259\]: Invalid user liulei from 128.199.220.197 port 54322
Jul 17 06:15:25 vps687878 sshd\[15259\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.220.197
...

Cowrie Honeypot: 3 unauthorised SSH/Telnet login attempts between 2020-07-16T05:50:51Z and 2020-07-16T06:02:29Z

$f2bV_matches

Jul  8 14:41:23 electroncash sshd[34254]: Invalid user vagrant from 128.199.220.197 port 52880
Jul  8 14:41:23 electroncash sshd[34254]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.220.197 
Jul  8 14:41:23 electroncash sshd[34254]: Invalid user vagrant from 128.199.220.197 port 52880
Jul  8 14:41:25 electroncash sshd[34254]: Failed password for invalid user vagrant from 128.199.220.197 port 52880 ssh2
Jul  8 14:44:06 electroncash sshd[34949]: Invalid user rabbitmq from 128.199.220.197 port 39046
...

(sshd) Failed SSH login from 128.199.220.197 (SG/Singapore/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Jul  4 11:13:17 amsweb01 sshd[31070]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.220.197  user=root
Jul  4 11:13:19 amsweb01 sshd[31070]: Failed password for root from 128.199.220.197 port 54154 ssh2
Jul  4 11:14:51 amsweb01 sshd[477]: Invalid user testftp from 128.199.220.197 port 46060
Jul  4 11:14:54 amsweb01 sshd[477]: Failed password for invalid user testftp from 128.199.220.197 port 46060 ssh2
Jul  4 11:16:03 amsweb01 sshd[771]: Invalid user balaji from 128.199.220.197 port 33532

Jun 28 08:01:06 piServer sshd[31297]: Failed password for root from 128.199.220.197 port 36334 ssh2
Jun 28 08:04:43 piServer sshd[31584]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.220.197 
Jun 28 08:04:45 piServer sshd[31584]: Failed password for invalid user rachel from 128.199.220.197 port 35776 ssh2
...

(sshd) Failed SSH login from 128.199.220.197 (SG/Singapore/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Jun 27 11:30:18 amsweb01 sshd[31060]: Invalid user itd from 128.199.220.197 port 33690
Jun 27 11:30:20 amsweb01 sshd[31060]: Failed password for invalid user itd from 128.199.220.197 port 33690 ssh2
Jun 27 11:42:40 amsweb01 sshd[777]: Invalid user k from 128.199.220.197 port 59898
Jun 27 11:42:41 amsweb01 sshd[777]: Failed password for invalid user k from 128.199.220.197 port 59898 ssh2
Jun 27 11:45:54 amsweb01 sshd[1310]: Invalid user ken from 128.199.220.197 port 56404

$f2bV_matches

Jun 20 17:50:30 ovpn sshd\[23265\]: Invalid user newuser from 128.199.220.197
Jun 20 17:50:30 ovpn sshd\[23265\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.220.197
Jun 20 17:50:32 ovpn sshd\[23265\]: Failed password for invalid user newuser from 128.199.220.197 port 48126 ssh2
Jun 20 18:01:36 ovpn sshd\[25879\]: Invalid user vmuser from 128.199.220.197
Jun 20 18:01:36 ovpn sshd\[25879\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.220.197

2020-06-20T10:53:02+0200 Failed SSH Authentication/Brute Force Attack. (Server 10)

Invalid user student from 128.199.220.197 port 49194

Unauthorized connection attempt detected from IP address 60.169.209.149 to port 5555 [J]

Unauthorized connection attempt detected from IP address 123.179.129.248 to port 6656 [T]

Unauthorized connection attempt detected from IP address 120.72.106.138 to port 82 [J]

Unauthorized connection attempt detected from IP address 123.179.130.127 to port 6656 [T]

Unauthorized connection attempt detected from IP address 101.205.144.72 to port 6656 [T]

Unauthorized connection attempt detected from IP address 122.242.57.86 to port 6656 [T]

Unauthorized connection attempt detected from IP address 61.131.228.76 to port 1433 [J]

Unauthorized connection attempt detected from IP address 106.15.74.76 to port 22 [T]

Unauthorized connection attempt detected from IP address 78.239.45.63 to port 2220 [J]

Unauthorized connection attempt detected from IP address 101.206.235.207 to port 6656 [T]

Unauthorized connection attempt detected from IP address 123.103.121.2 to port 1433 [J]

Unauthorized connection attempt detected from IP address 109.92.178.7 to port 2220 [J]

8080/tcp
[2020-01-26]1pkt

Unauthorized connection attempt detected from IP address 113.141.70.200 to port 1433 [J]

Unauthorized connection attempt detected from IP address 115.224.66.103 to port 6656 [T]