Coordinated SSH brute-force attack from different IPs. pam_unix(sshd:auth):

2020-08-31 18:00:48,963 fail2ban.actions: WARNING [ssh] Ban 138.97.23.190

Invalid user pan from 138.97.23.190 port 52316

2020-08-20T01:27:55.070227hostname sshd[15309]: Failed password for invalid user ts from 138.97.23.190 port 39540 ssh2
...

2020-08-18T05:01:30.511619billing sshd[24790]: Invalid user ywq from 138.97.23.190 port 56240
2020-08-18T05:01:32.925134billing sshd[24790]: Failed password for invalid user ywq from 138.97.23.190 port 56240 ssh2
2020-08-18T05:08:55.039070billing sshd[8683]: Invalid user steam from 138.97.23.190 port 36908
...

Jul 13 11:59:30 cp sshd[20647]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.97.23.190

Invalid user system from 138.97.23.190 port 50614

May 30 10:50:36 server sshd[10446]: Failed password for root from 138.97.23.190 port 33214 ssh2
May 30 10:55:10 server sshd[10749]: Failed password for root from 138.97.23.190 port 39008 ssh2
...

2020-05-25T04:32:51.2667751495-001 sshd[20947]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=dynamic-138-97-23-190.camontelecom.net.br  user=root
2020-05-25T04:32:53.1019671495-001 sshd[20947]: Failed password for root from 138.97.23.190 port 58700 ssh2
2020-05-25T04:35:49.5880561495-001 sshd[21095]: Invalid user sole from 138.97.23.190 port 41348
2020-05-25T04:35:49.5958391495-001 sshd[21095]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=dynamic-138-97-23-190.camontelecom.net.br
2020-05-25T04:35:49.5880561495-001 sshd[21095]: Invalid user sole from 138.97.23.190 port 41348
2020-05-25T04:35:51.8678151495-001 sshd[21095]: Failed password for invalid user sole from 138.97.23.190 port 41348 ssh2
...

(sshd) Failed SSH login from 138.97.23.190 (BR/Brazil/dynamic-138-97-23-190.camontelecom.net.br): 5 in the last 3600 secs

fail2ban -- 138.97.23.190
...

Apr 30 13:10:08 game-panel sshd[21797]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.97.23.190
Apr 30 13:10:10 game-panel sshd[21797]: Failed password for invalid user wy from 138.97.23.190 port 44162 ssh2
Apr 30 13:15:19 game-panel sshd[21971]: Failed password for root from 138.97.23.190 port 57002 ssh2

2020-04-29T13:59:19.810118vps773228.ovh.net sshd[24609]: Failed password for invalid user molisoft from 138.97.23.190 port 40564 ssh2
2020-04-29T14:04:07.317604vps773228.ovh.net sshd[24683]: Invalid user poss from 138.97.23.190 port 51610
2020-04-29T14:04:07.329626vps773228.ovh.net sshd[24683]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=dynamic-138-97-23-190.camontelecom.net.br
2020-04-29T14:04:07.317604vps773228.ovh.net sshd[24683]: Invalid user poss from 138.97.23.190 port 51610
2020-04-29T14:04:08.774493vps773228.ovh.net sshd[24683]: Failed password for invalid user poss from 138.97.23.190 port 51610 ssh2
...

Apr 28 15:40:09 rotator sshd\[13587\]: Invalid user is from 138.97.23.190Apr 28 15:40:11 rotator sshd\[13587\]: Failed password for invalid user is from 138.97.23.190 port 54796 ssh2Apr 28 15:44:14 rotator sshd\[14250\]: Invalid user apex from 138.97.23.190Apr 28 15:44:17 rotator sshd\[14250\]: Failed password for invalid user apex from 138.97.23.190 port 54300 ssh2Apr 28 15:48:17 rotator sshd\[15035\]: Invalid user site1 from 138.97.23.190Apr 28 15:48:19 rotator sshd\[15035\]: Failed password for invalid user site1 from 138.97.23.190 port 53800 ssh2
...

Apr 20 12:45:03 vps46666688 sshd[20853]: Failed password for root from 138.97.23.190 port 57260 ssh2
Apr 20 12:54:55 vps46666688 sshd[21036]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.97.23.190
...

2020-04-17T10:54:00.291492shield sshd\[18403\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=dynamic-138-97-23-190.camontelecom.net.br  user=root
2020-04-17T10:54:01.947056shield sshd\[18403\]: Failed password for root from 138.97.23.190 port 44354 ssh2
2020-04-17T10:55:36.052282shield sshd\[18657\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=dynamic-138-97-23-190.camontelecom.net.br  user=root
2020-04-17T10:55:37.880144shield sshd\[18657\]: Failed password for root from 138.97.23.190 port 37970 ssh2
2020-04-17T10:57:14.298233shield sshd\[18905\]: Invalid user la from 138.97.23.190 port 59824

Apr  9 07:01:00 scw-6657dc sshd[12538]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.97.23.190
Apr  9 07:01:00 scw-6657dc sshd[12538]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.97.23.190
Apr  9 07:01:01 scw-6657dc sshd[12538]: Failed password for invalid user vsftpd from 138.97.23.190 port 55452 ssh2
...

Invalid user shiqimeng from 138.97.23.190 port 33116

Invalid user shiqimeng from 138.97.23.190 port 35310

$f2bV_matches | Triggered by Fail2Ban at Vostok web server

Jan 25 06:13:04 game-panel sshd[31495]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.97.23.190
Jan 25 06:13:06 game-panel sshd[31495]: Failed password for invalid user connect from 138.97.23.190 port 34446 ssh2
Jan 25 06:16:23 game-panel sshd[31609]: Failed password for root from 138.97.23.190 port 34754 ssh2

Invalid user og from 138.97.23.190 port 36778

2020-01-01T05:09:27.792762shield sshd\[19648\]: Invalid user skilina from 138.97.23.190 port 54112
2020-01-01T05:09:27.797048shield sshd\[19648\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=dynamic-138-97-23-190.camontelecom.net.br
2020-01-01T05:09:29.705956shield sshd\[19648\]: Failed password for invalid user skilina from 138.97.23.190 port 54112 ssh2
2020-01-01T05:13:07.647891shield sshd\[20898\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=dynamic-138-97-23-190.camontelecom.net.br  user=root
2020-01-01T05:13:10.423545shield sshd\[20898\]: Failed password for root from 138.97.23.190 port 54030 ssh2

2020-06-03T15:30:55.079307struts4.enskede.local sshd\[10571\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.97.239.9  user=root
2020-06-03T15:30:57.984504struts4.enskede.local sshd\[10571\]: Failed password for root from 138.97.239.9 port 57648 ssh2
2020-06-03T15:35:20.566661struts4.enskede.local sshd\[10606\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.97.239.9  user=root
2020-06-03T15:35:23.537446struts4.enskede.local sshd\[10606\]: Failed password for root from 138.97.239.9 port 60017 ssh2
2020-06-03T15:39:47.811111struts4.enskede.local sshd\[10617\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.97.239.9  user=root
...

May 29 07:02:35 OPSO sshd\[5528\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.97.239.9  user=root
May 29 07:02:37 OPSO sshd\[5528\]: Failed password for root from 138.97.239.9 port 43243 ssh2
May 29 07:07:14 OPSO sshd\[6477\]: Invalid user ff from 138.97.239.9 port 45946
May 29 07:07:14 OPSO sshd\[6477\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.97.239.9
May 29 07:07:16 OPSO sshd\[6477\]: Failed password for invalid user ff from 138.97.239.9 port 45946 ssh2

Automatic report - Port Scan Attack

proto=tcp  .  spt=57013  .  dpt=25  .     (listed on     Github Combined on 3 lists )     (446)

Oct 20 07:19:20 lnxmysql61 sshd[26181]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.13.186.21

2019-10-20T06:19:05.122005tmaserv sshd\[4713\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.183.86.76
2019-10-20T06:19:07.228771tmaserv sshd\[4713\]: Failed password for invalid user root1 from 68.183.86.76 port 41146 ssh2
2019-10-20T07:20:24.231423tmaserv sshd\[7170\]: Invalid user ps from 68.183.86.76 port 44154
2019-10-20T07:20:24.235997tmaserv sshd\[7170\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.183.86.76
2019-10-20T07:20:26.406758tmaserv sshd\[7170\]: Failed password for invalid user ps from 68.183.86.76 port 44154 ssh2
2019-10-20T07:24:22.266342tmaserv sshd\[7481\]: Invalid user jchallenger from 68.183.86.76 port 53168
...

2019-10-19T22:32:19.6193861495-001 sshd\[6658\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=136.158.92.34.bc.googleusercontent.com
2019-10-19T22:32:21.5299591495-001 sshd\[6658\]: Failed password for invalid user beatriz from 34.92.158.136 port 51254 ssh2
2019-10-19T23:35:06.8272901495-001 sshd\[9022\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=136.158.92.34.bc.googleusercontent.com  user=root
2019-10-19T23:35:09.5493131495-001 sshd\[9022\]: Failed password for root from 34.92.158.136 port 56716 ssh2
2019-10-19T23:47:23.2968491495-001 sshd\[9454\]: Invalid user + from 34.92.158.136 port 40798
2019-10-19T23:47:23.3168191495-001 sshd\[9454\]: Failed password for invalid user + from 34.92.158.136 port 40798 ssh2
...

Oct 20 07:05:34 vps647732 sshd[1960]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.12.43
Oct 20 07:05:36 vps647732 sshd[1960]: Failed password for invalid user polarbear from 138.68.12.43 port 59442 ssh2
...

Oct 20 06:25:09 meumeu sshd[7764]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.232.59.109 
Oct 20 06:25:10 meumeu sshd[7764]: Failed password for invalid user jordi from 49.232.59.109 port 46062 ssh2
Oct 20 06:30:38 meumeu sshd[8434]: Failed password for root from 49.232.59.109 port 60912 ssh2
...

2019-10-20T03:56:57.276617abusebot.cloudsearch.cf sshd\[19232\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=223.241.247.214  user=root

Oct 20 03:56:27 ip-172-31-1-72 sshd\[30948\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.15.246  user=root
Oct 20 03:56:29 ip-172-31-1-72 sshd\[30948\]: Failed password for root from 222.186.15.246 port 54200 ssh2
Oct 20 03:56:55 ip-172-31-1-72 sshd\[30952\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.15.246  user=root
Oct 20 03:56:57 ip-172-31-1-72 sshd\[30952\]: Failed password for root from 222.186.15.246 port 10577 ssh2
Oct 20 03:57:25 ip-172-31-1-72 sshd\[30954\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.15.246  user=root

Invalid user vincintz from 61.133.232.251 port 11595

invalid login attempt

Oct 20 06:50:58 microserver sshd[13212]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.39.254  user=root
Oct 20 06:50:59 microserver sshd[13212]: Failed password for root from 182.61.39.254 port 51118 ssh2
Oct 20 06:55:48 microserver sshd[13854]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.39.254  user=root
Oct 20 06:55:50 microserver sshd[13854]: Failed password for root from 182.61.39.254 port 59448 ssh2
Oct 20 07:00:25 microserver sshd[14492]: Invalid user dw from 182.61.39.254 port 39572
Oct 20 07:14:40 microserver sshd[16068]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.39.254  user=root
Oct 20 07:14:42 microserver sshd[16068]: Failed password for root from 182.61.39.254 port 36322 ssh2
Oct 20 07:19:27 microserver sshd[16743]: Invalid user adi from 182.61.39.254 port 44692
Oct 20 07:19:27 microserver sshd[16743]: pam_unix(sshd:auth): authentication failure

Fail2Ban Ban Triggered

Oct 20 06:29:22 SilenceServices sshd[404]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=145.239.76.62
Oct 20 06:29:23 SilenceServices sshd[404]: Failed password for invalid user david from 145.239.76.62 port 48819 ssh2
Oct 20 06:29:59 SilenceServices sshd[580]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=145.239.76.62

2019-10-20T04:59:42.671757abusebot-5.cloudsearch.cf sshd\[15926\]: Invalid user bjorn from 175.211.116.226 port 47326

Oct 20 06:30:10 heissa sshd\[21547\]: Invalid user pgsql from 221.226.28.244 port 58758
Oct 20 06:30:10 heissa sshd\[21547\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.226.28.244
Oct 20 06:30:12 heissa sshd\[21547\]: Failed password for invalid user pgsql from 221.226.28.244 port 58758 ssh2
Oct 20 06:34:44 heissa sshd\[22272\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.226.28.244  user=root
Oct 20 06:34:46 heissa sshd\[22272\]: Failed password for root from 221.226.28.244 port 14406 ssh2

invalid login attempt