2020-10-06T03:12:22.9552991495-001 sshd[45372]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.211.108.143  user=root
2020-10-06T03:12:25.0269621495-001 sshd[45372]: Failed password for root from 129.211.108.143 port 60314 ssh2
2020-10-06T03:17:13.9669721495-001 sshd[46001]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.211.108.143  user=root
2020-10-06T03:17:15.9837361495-001 sshd[46001]: Failed password for root from 129.211.108.143 port 39250 ssh2
2020-10-06T03:22:02.1370471495-001 sshd[16709]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.211.108.143  user=root
2020-10-06T03:22:04.1629051495-001 sshd[16709]: Failed password for root from 129.211.108.143 port 46412 ssh2
...

2020-10-06T03:12:22.9552991495-001 sshd[45372]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.211.108.143  user=root
2020-10-06T03:12:25.0269621495-001 sshd[45372]: Failed password for root from 129.211.108.143 port 60314 ssh2
2020-10-06T03:17:13.9669721495-001 sshd[46001]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.211.108.143  user=root
2020-10-06T03:17:15.9837361495-001 sshd[46001]: Failed password for root from 129.211.108.143 port 39250 ssh2
2020-10-06T03:22:02.1370471495-001 sshd[16709]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.211.108.143  user=root
2020-10-06T03:22:04.1629051495-001 sshd[16709]: Failed password for root from 129.211.108.143 port 46412 ssh2
...

2020-10-06T01:36:58.5196001495-001 sshd[40044]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.211.108.143  user=root
2020-10-06T01:37:00.1152811495-001 sshd[40044]: Failed password for root from 129.211.108.143 port 36822 ssh2
2020-10-06T01:46:23.1668771495-001 sshd[40521]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.211.108.143  user=root
2020-10-06T01:46:24.9934081495-001 sshd[40521]: Failed password for root from 129.211.108.143 port 51154 ssh2
2020-10-06T01:51:36.3174801495-001 sshd[40795]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.211.108.143  user=root
2020-10-06T01:51:37.7823361495-001 sshd[40795]: Failed password for root from 129.211.108.143 port 58340 ssh2
...

Triggered by Fail2Ban at Ares web server

Invalid user gabor from 129.211.108.240 port 59170

srv02 Mass scanning activity detected Target: 29306  ..

Jul 12 10:51:33 *** sshd[7779]: Invalid user andrea from 129.211.108.240

SSH Invalid Login

SSH Invalid Login

2020-06-06T06:14:16.461834+02:00  sshd[23786]: Failed password for root from 129.211.108.240 port 56102 ssh2

Lines containing failures of 129.211.108.240
Jun  1 07:25:54 shared03 sshd[13331]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.211.108.240  user=r.r
Jun  1 07:25:55 shared03 sshd[13331]: Failed password for r.r from 129.211.108.240 port 46364 ssh2
Jun  1 07:25:55 shared03 sshd[13331]: Received disconnect from 129.211.108.240 port 46364:11: Bye Bye [preauth]
Jun  1 07:25:55 shared03 sshd[13331]: Disconnected from authenticating user r.r 129.211.108.240 port 46364 [preauth]
Jun  1 07:35:34 shared03 sshd[17389]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.211.108.240  user=r.r
Jun  1 07:35:36 shared03 sshd[17389]: Failed password for r.r from 129.211.108.240 port 38768 ssh2
Jun  1 07:35:37 shared03 sshd[17389]: Received disconnect from 129.211.108.240 port 38768:11: Bye Bye [preauth]
Jun  1 07:35:37 shared03 sshd[17389]: Disconnected from authenticating user r.r 129.211.108.240 p........
------------------------------

May  5 23:57:13 gw1 sshd[19779]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.211.108.201
May  5 23:57:14 gw1 sshd[19779]: Failed password for invalid user obc from 129.211.108.201 port 40104 ssh2
...

Apr 29 03:35:27 itv-usvr-02 sshd[26755]: Invalid user uuu from 129.211.108.201 port 41148
Apr 29 03:35:27 itv-usvr-02 sshd[26755]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.211.108.201
Apr 29 03:35:27 itv-usvr-02 sshd[26755]: Invalid user uuu from 129.211.108.201 port 41148
Apr 29 03:35:29 itv-usvr-02 sshd[26755]: Failed password for invalid user uuu from 129.211.108.201 port 41148 ssh2
Apr 29 03:45:02 itv-usvr-02 sshd[27102]: Invalid user ypf from 129.211.108.201 port 32774

$f2bV_matches

Apr 19 14:04:13 host sshd[24977]: Invalid user admin from 129.211.108.201 port 55446
...

CloudCIX Reconnaissance Scan Detected, PTR: PTR record not found

Oct  6 06:02:03 microserver sshd[30201]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=198.245.63.94  user=root
Oct  6 06:02:05 microserver sshd[30201]: Failed password for root from 198.245.63.94 port 43258 ssh2
Oct  6 06:05:54 microserver sshd[30856]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=198.245.63.94  user=root
Oct  6 06:05:56 microserver sshd[30856]: Failed password for root from 198.245.63.94 port 38430 ssh2
Oct  6 06:09:41 microserver sshd[31084]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=198.245.63.94  user=root
Oct  6 06:20:52 microserver sshd[32946]: Invalid user 321 from 198.245.63.94 port 48090
Oct  6 06:20:52 microserver sshd[32946]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=198.245.63.94
Oct  6 06:20:54 microserver sshd[32946]: Failed password for invalid user 321 from 198.245.63.94 port 48090 ssh2
Oct  6 06:24:45

2019-10-06T00:00:55.2403031495-001 sshd\[24817\]: Failed password for invalid user \^YHN\&UJM from 148.70.77.22 port 49560 ssh2
2019-10-06T00:11:36.7396461495-001 sshd\[25799\]: Invalid user P@55W0RD2018 from 148.70.77.22 port 42916
2019-10-06T00:11:36.7427961495-001 sshd\[25799\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.77.22
2019-10-06T00:11:38.4157711495-001 sshd\[25799\]: Failed password for invalid user P@55W0RD2018 from 148.70.77.22 port 42916 ssh2
2019-10-06T00:16:56.7825391495-001 sshd\[26240\]: Invalid user P@55W0RD2018 from 148.70.77.22 port 53708
2019-10-06T00:16:56.7896571495-001 sshd\[26240\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.77.22
...

port scan and connect, tcp 80 (http)

Oct  6 06:55:30 MK-Soft-VM7 sshd[18588]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.157.229.23 
Oct  6 06:55:32 MK-Soft-VM7 sshd[18588]: Failed password for invalid user 3edcVFR$5tgb from 121.157.229.23 port 45006 ssh2
...

Invalid user jimmy from 176.107.131.128 port 56754

Oct  6 04:43:10 venus sshd\[19961\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.89.157.197  user=root
Oct  6 04:43:12 venus sshd\[19961\]: Failed password for root from 36.89.157.197 port 47934 ssh2
Oct  6 04:47:39 venus sshd\[20065\]: Invalid user 123 from 36.89.157.197 port 58758
...

$f2bV_matches

Oct  5 18:46:09 eddieflores sshd\[9803\]: Invalid user Pablo123 from 188.131.142.109
Oct  5 18:46:09 eddieflores sshd\[9803\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.131.142.109
Oct  5 18:46:10 eddieflores sshd\[9803\]: Failed password for invalid user Pablo123 from 188.131.142.109 port 49758 ssh2
Oct  5 18:51:04 eddieflores sshd\[10237\]: Invalid user ROOT@123 from 188.131.142.109
Oct  5 18:51:04 eddieflores sshd\[10237\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.131.142.109

2019-10-05 22:54:06 H=(176-197-103-58.goodline.info) [176.197.103.58]:49323 I=[192.147.25.65]:25 F= rejected RCPT : RBL: found in thrukfz5b56tq6xao6odgdyjrq.zen.dq.spamhaus.net (127.0.0.3, 127.0.0.4) (https://www.spamhaus.org/sbl/query/SBLCSS)
2019-10-05 22:54:06 H=(176-197-103-58.goodline.info) [176.197.103.58]:49323 I=[192.147.25.65]:25 F= rejected RCPT : RBL: found in thrukfz5b56tq6xao6odgdyjrq.zen.dq.spamhaus.net (127.0.0.3, 127.0.0.4) (https://www.spamhaus.org/sbl/query/SBLCSS)
2019-10-05 22:54:06 H=(176-197-103-58.goodline.info) [176.197.103.58]:49323 I=[192.147.25.65]:25 F= rejected RCPT : RBL: found in thrukfz5b56tq6xao6odgdyjrq.zen.dq.spamhaus.net (127.0.0.3, 127.0.0.4) (https://www.spamhaus.org/sbl/query/SBLCSS)
...

Oct  5 19:06:39 php1 sshd\[31579\]: Invalid user z1x2c3v4 from 63.240.240.74
Oct  5 19:06:39 php1 sshd\[31579\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=63.240.240.74
Oct  5 19:06:40 php1 sshd\[31579\]: Failed password for invalid user z1x2c3v4 from 63.240.240.74 port 35883 ssh2
Oct  5 19:10:35 php1 sshd\[32149\]: Invalid user Einstein-123 from 63.240.240.74
Oct  5 19:10:35 php1 sshd\[32149\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=63.240.240.74

Oct  5 19:14:35 friendsofhawaii sshd\[11661\]: Invalid user P@ssword2017 from 103.76.252.6
Oct  5 19:14:35 friendsofhawaii sshd\[11661\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.76.252.6
Oct  5 19:14:37 friendsofhawaii sshd\[11661\]: Failed password for invalid user P@ssword2017 from 103.76.252.6 port 59169 ssh2
Oct  5 19:19:05 friendsofhawaii sshd\[12073\]: Invalid user P@ssword2017 from 103.76.252.6
Oct  5 19:19:05 friendsofhawaii sshd\[12073\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.76.252.6

Oct  6 07:11:10 www sshd\[35941\]: Invalid user 123Wild from 164.132.81.106Oct  6 07:11:12 www sshd\[35941\]: Failed password for invalid user 123Wild from 164.132.81.106 port 38286 ssh2Oct  6 07:14:30 www sshd\[36032\]: Invalid user Aa@1234567 from 164.132.81.106
...

[Sun Oct 06 00:54:23.323518 2019] [:error] [pid 203646] [client 109.93.230.144:36530] [client 109.93.230.144] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "91"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 18)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "127.0.0.1"] [uri "/cgi-bin/ViewLog.asp"] [unique_id "XZllb0looZarxTX3S1nJuwAAAAY"]
...

Oct  6 04:52:56 www_kotimaassa_fi sshd[10096]: Failed password for root from 104.199.251.248 port 52904 ssh2
...