Aug 27 18:24:41 mellenthin sshd[5373]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.155.26.79
Aug 27 18:24:43 mellenthin sshd[5373]: Failed password for invalid user mia from 139.155.26.79 port 36754 ssh2

Aug 25 19:35:06 *** sshd[8106]: User root from 139.155.26.79 not allowed because not listed in AllowUsers

Aug 20 14:05:30 santamaria sshd\[24646\]: Invalid user testadmin from 139.155.26.79
Aug 20 14:05:30 santamaria sshd\[24646\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.155.26.79
Aug 20 14:05:33 santamaria sshd\[24646\]: Failed password for invalid user testadmin from 139.155.26.79 port 33634 ssh2
...

Aug 16 23:28:30 minden010 sshd[8591]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.155.26.79
Aug 16 23:28:32 minden010 sshd[8591]: Failed password for invalid user krishna from 139.155.26.79 port 45808 ssh2
Aug 16 23:32:45 minden010 sshd[9993]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.155.26.79
...

2020-08-07T08:11:45.278595amanda2.illicoweb.com sshd\[29115\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.155.26.79  user=root
2020-08-07T08:11:47.137791amanda2.illicoweb.com sshd\[29115\]: Failed password for root from 139.155.26.79 port 41766 ssh2
2020-08-07T08:14:42.060161amanda2.illicoweb.com sshd\[29576\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.155.26.79  user=root
2020-08-07T08:14:44.550940amanda2.illicoweb.com sshd\[29576\]: Failed password for root from 139.155.26.79 port 55626 ssh2
2020-08-07T08:17:30.100898amanda2.illicoweb.com sshd\[30114\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.155.26.79  user=root
...

Aug  5 20:37:04 onepixel sshd[2170428]: Failed password for root from 139.155.26.79 port 53454 ssh2
Aug  5 20:39:18 onepixel sshd[2171878]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.155.26.79  user=root
Aug  5 20:39:19 onepixel sshd[2171878]: Failed password for root from 139.155.26.79 port 55544 ssh2
Aug  5 20:41:30 onepixel sshd[2173143]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.155.26.79  user=root
Aug  5 20:41:32 onepixel sshd[2173143]: Failed password for root from 139.155.26.79 port 57636 ssh2

Jul 25 00:31:03 Host-KLAX-C sshd[20174]: Invalid user sales from 139.155.26.79 port 51762
...

$f2bV_matches

Mar  7 01:07:17 srv-ubuntu-dev3 sshd[29977]: Invalid user cpanelconnecttrack from 139.155.26.91
Mar  7 01:07:17 srv-ubuntu-dev3 sshd[29977]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.155.26.91
Mar  7 01:07:17 srv-ubuntu-dev3 sshd[29977]: Invalid user cpanelconnecttrack from 139.155.26.91
Mar  7 01:07:20 srv-ubuntu-dev3 sshd[29977]: Failed password for invalid user cpanelconnecttrack from 139.155.26.91 port 33128 ssh2
Mar  7 01:10:41 srv-ubuntu-dev3 sshd[30549]: Invalid user rhodecode from 139.155.26.91
Mar  7 01:10:41 srv-ubuntu-dev3 sshd[30549]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.155.26.91
Mar  7 01:10:41 srv-ubuntu-dev3 sshd[30549]: Invalid user rhodecode from 139.155.26.91
Mar  7 01:10:43 srv-ubuntu-dev3 sshd[30549]: Failed password for invalid user rhodecode from 139.155.26.91 port 46278 ssh2
Mar  7 01:14:04 srv-ubuntu-dev3 sshd[31075]: Invalid user steam from 139.155.26.91
...

Mar  4 11:49:16 nextcloud sshd\[3402\]: Invalid user lsfadmin from 139.155.26.91
Mar  4 11:49:16 nextcloud sshd\[3402\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.155.26.91
Mar  4 11:49:17 nextcloud sshd\[3402\]: Failed password for invalid user lsfadmin from 139.155.26.91 port 48948 ssh2

2020-02-21T14:55:52.368936homeassistant sshd[15431]: Invalid user jenkins from 139.155.26.91 port 43530
2020-02-21T14:55:52.377339homeassistant sshd[15431]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.155.26.91
...

Unauthorized connection attempt detected from IP address 139.155.26.91 to port 2220 [J]

Jan 10 23:11:35 mout sshd[28473]: Invalid user wpyan from 139.155.26.91 port 50962

2020-01-08T01:05:11.7037171495-001 sshd[45305]: Invalid user sqi from 139.155.26.91 port 43360
2020-01-08T01:05:11.7067771495-001 sshd[45305]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.155.26.91
2020-01-08T01:05:11.7037171495-001 sshd[45305]: Invalid user sqi from 139.155.26.91 port 43360
2020-01-08T01:05:13.1867211495-001 sshd[45305]: Failed password for invalid user sqi from 139.155.26.91 port 43360 ssh2
2020-01-08T01:09:19.8604261495-001 sshd[45448]: Invalid user factorio from 139.155.26.91 port 38924
2020-01-08T01:09:19.8634581495-001 sshd[45448]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.155.26.91
2020-01-08T01:09:19.8604261495-001 sshd[45448]: Invalid user factorio from 139.155.26.91 port 38924
2020-01-08T01:09:21.7244621495-001 sshd[45448]: Failed password for invalid user factorio from 139.155.26.91 port 38924 ssh2
2020-01-08T01:13:14.4353641495-001 sshd[45575]: Invalid user xrdp
...

Invalid user admin from 139.155.26.91 port 43692

Dec 22 08:28:06 mockhub sshd[7270]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.155.26.91
Dec 22 08:28:08 mockhub sshd[7270]: Failed password for invalid user tomoyo from 139.155.26.91 port 55468 ssh2
...

2019-12-09T11:03:41.404738abusebot-5.cloudsearch.cf sshd\[3565\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.155.26.91  user=root

Dec  7 07:18:52 vtv3 sshd[25463]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.155.26.91 
Dec  7 07:18:55 vtv3 sshd[25463]: Failed password for invalid user delegue from 139.155.26.91 port 34188 ssh2
Dec  7 07:25:10 vtv3 sshd[28583]: Failed password for root from 139.155.26.91 port 39108 ssh2
Dec  7 07:37:41 vtv3 sshd[2124]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.155.26.91 
Dec  7 07:37:42 vtv3 sshd[2124]: Failed password for invalid user frink from 139.155.26.91 port 48958 ssh2
Dec  7 07:44:28 vtv3 sshd[4936]: Failed password for root from 139.155.26.91 port 53910 ssh2
Dec  7 07:58:03 vtv3 sshd[11118]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.155.26.91 
Dec  7 07:58:06 vtv3 sshd[11118]: Failed password for invalid user sheu from 139.155.26.91 port 35582 ssh2
Dec  7 08:05:04 vtv3 sshd[14099]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tt

Dec  3 19:55:55 nextcloud sshd\[4978\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.155.26.91  user=root
Dec  3 19:55:57 nextcloud sshd\[4978\]: Failed password for root from 139.155.26.91 port 39080 ssh2
Dec  3 20:01:32 nextcloud sshd\[14234\]: Invalid user webadmin from 139.155.26.91
...

Dec  3 12:08:31 localhost sshd\[8035\]: Invalid user cimmie from 139.155.26.91 port 37054
Dec  3 12:08:31 localhost sshd\[8035\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.155.26.91
Dec  3 12:08:33 localhost sshd\[8035\]: Failed password for invalid user cimmie from 139.155.26.91 port 37054 ssh2
Dec  3 12:16:06 localhost sshd\[8337\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.155.26.91  user=root
Dec  3 12:16:07 localhost sshd\[8337\]: Failed password for root from 139.155.26.91 port 42546 ssh2
...

Dec  2 20:16:45 php1 sshd\[25524\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.155.26.91  user=root
Dec  2 20:16:47 php1 sshd\[25524\]: Failed password for root from 139.155.26.91 port 46970 ssh2
Dec  2 20:23:50 php1 sshd\[26392\]: Invalid user muni from 139.155.26.91
Dec  2 20:23:50 php1 sshd\[26392\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.155.26.91
Dec  2 20:23:52 php1 sshd\[26392\]: Failed password for invalid user muni from 139.155.26.91 port 53846 ssh2

Invalid user gouillon from 139.155.26.91 port 41670

Jul  3 01:16:04 ovpn sshd\[4795\]: Invalid user admin from 37.49.224.204
Jul  3 01:16:04 ovpn sshd\[4795\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.224.204
Jul  3 01:16:06 ovpn sshd\[4795\]: Failed password for invalid user admin from 37.49.224.204 port 60024 ssh2
Jul  3 01:16:12 ovpn sshd\[4815\]: Invalid user support from 37.49.224.204
Jul  3 01:16:12 ovpn sshd\[4815\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.224.204

Brute SSH

v+ssh-bruteforce

Feb 24 02:49:46 motanud sshd\[13459\]: Invalid user training from 88.207.227.5 port 51314
Feb 24 02:49:46 motanud sshd\[13459\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=88.207.227.5
Feb 24 02:49:49 motanud sshd\[13459\]: Failed password for invalid user training from 88.207.227.5 port 51314 ssh2

1562109356 - 07/03/2019 01:15:56 Host: scanners.labs.rapid7.com/146.185.25.177 Port: 47808 UDP Blocked

Jul  3 02:34:00 SilenceServices sshd[30539]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=140.143.239.156
Jul  3 02:34:02 SilenceServices sshd[30539]: Failed password for invalid user cardini from 140.143.239.156 port 54396 ssh2
Jul  3 02:36:42 SilenceServices sshd[442]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=140.143.239.156

2019-07-03T03:25:58.588638scmdmz1 sshd\[22728\]: Invalid user frank from 178.128.79.169 port 45070
2019-07-03T03:25:58.591736scmdmz1 sshd\[22728\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.79.169
2019-07-03T03:26:00.172813scmdmz1 sshd\[22728\]: Failed password for invalid user frank from 178.128.79.169 port 45070 ssh2
...

Jul  3 01:16:34 srv03 sshd\[23699\]: Invalid user 4 from 36.67.120.234 port 40952
Jul  3 01:16:34 srv03 sshd\[23699\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.67.120.234
Jul  3 01:16:35 srv03 sshd\[23699\]: Failed password for invalid user 4 from 36.67.120.234 port 40952 ssh2

Trying to deliver email spam, but blocked by RBL

Jul  3 01:16:39 MK-Soft-Root2 sshd\[19267\]: Invalid user pkjain from 79.1.212.37 port 53455
Jul  3 01:16:39 MK-Soft-Root2 sshd\[19267\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=79.1.212.37
Jul  3 01:16:42 MK-Soft-Root2 sshd\[19267\]: Failed password for invalid user pkjain from 79.1.212.37 port 53455 ssh2
...

unsolicited NTP

\[2019-07-02 21:20:08\] NOTICE\[13443\] chan_sip.c: Registration from '\' failed for '77.234.46.193:2622' - Wrong password
\[2019-07-02 21:20:08\] SECURITY\[13451\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-07-02T21:20:08.542-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="1011",SessionID="0x7f02f81ae088",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/77.234.46.193/57160",Challenge="7731fff5",ReceivedChallenge="7731fff5",ReceivedHash="08e4d2335f5dd4d3effc102911225033"
\[2019-07-02 21:20:22\] NOTICE\[13443\] chan_sip.c: Registration from '\' failed for '77.234.46.193:2695' - Wrong password
\[2019-07-02 21:20:22\] SECURITY\[13451\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-07-02T21:20:22.815-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="1012",SessionID="0x7f02f810d948",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/77.234.

Jul  2 13:33:22 garuda sshd[991573]: reveeclipse mapping checking getaddrinfo for 165-255-66-27.ip.adsl.co.za [165.255.66.27] failed - POSSIBLE BREAK-IN ATTEMPT!
Jul  2 13:33:22 garuda sshd[991573]: Invalid user fk from 165.255.66.27
Jul  2 13:33:22 garuda sshd[991573]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.255.66.27 
Jul  2 13:33:25 garuda sshd[991573]: Failed password for invalid user fk from 165.255.66.27 port 41828 ssh2
Jul  2 13:33:25 garuda sshd[991573]: Received disconnect from 165.255.66.27: 11: Bye Bye [preauth]
Jul  2 13:37:50 garuda sshd[992901]: reveeclipse mapping checking getaddrinfo for 165-255-66-27.ip.adsl.co.za [165.255.66.27] failed - POSSIBLE BREAK-IN ATTEMPT!
Jul  2 13:37:50 garuda sshd[992901]: Invalid user hadoop from 165.255.66.27
Jul  2 13:37:50 garuda sshd[992901]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.255.66.27 
Jul  2 13:37:53 garuda ss........
-------------------------------

Jan 11 03:37:39 motanud sshd\[19906\]: Invalid user deploy3 from 88.183.146.118 port 50774
Jan 11 03:37:39 motanud sshd\[19906\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=88.183.146.118
Jan 11 03:37:42 motanud sshd\[19906\]: Failed password for invalid user deploy3 from 88.183.146.118 port 50774 ssh2

port scan and connect, tcp 23 (telnet)