Aug 12 23:03:23 * sshd[9617]: Failed password for git from 147.135.163.95 port 44546 ssh2

Aug  2 07:51:20 abendstille sshd\[23761\]: Invalid user 123456789 from 147.135.163.95
Aug  2 07:51:20 abendstille sshd\[23762\]: Invalid user 123456789 from 147.135.163.95
Aug  2 07:51:20 abendstille sshd\[23761\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=147.135.163.95
Aug  2 07:51:20 abendstille sshd\[23762\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=147.135.163.95
Aug  2 07:51:23 abendstille sshd\[23761\]: Failed password for invalid user 123456789 from 147.135.163.95 port 33494 ssh2
Aug  2 07:51:23 abendstille sshd\[23762\]: Failed password for invalid user 123456789 from 147.135.163.95 port 53202 ssh2
...

Aug  2 01:57:15 abendstille sshd\[7065\]: Invalid user 1234567 from 147.135.163.95
Aug  2 01:57:15 abendstille sshd\[7065\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=147.135.163.95
Aug  2 01:57:15 abendstille sshd\[7064\]: Invalid user 1234567 from 147.135.163.95
Aug  2 01:57:15 abendstille sshd\[7064\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=147.135.163.95
Aug  2 01:57:17 abendstille sshd\[7065\]: Failed password for invalid user 1234567 from 147.135.163.95 port 39718 ssh2
...

Aug  1 16:28:35 abendstille sshd\[28286\]: Invalid user ts3pass from 147.135.163.95
Aug  1 16:28:35 abendstille sshd\[28285\]: Invalid user ts3pass from 147.135.163.95
Aug  1 16:28:35 abendstille sshd\[28285\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=147.135.163.95
Aug  1 16:28:35 abendstille sshd\[28286\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=147.135.163.95
Aug  1 16:28:37 abendstille sshd\[28285\]: Failed password for invalid user ts3pass from 147.135.163.95 port 47776 ssh2
Aug  1 16:28:37 abendstille sshd\[28286\]: Failed password for invalid user ts3pass from 147.135.163.95 port 39252 ssh2
...

Aug  1 06:18:22 abendstille sshd\[12394\]: Invalid user ts from 147.135.163.95
Aug  1 06:18:22 abendstille sshd\[12393\]: Invalid user ts from 147.135.163.95
Aug  1 06:18:22 abendstille sshd\[12394\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=147.135.163.95
Aug  1 06:18:22 abendstille sshd\[12393\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=147.135.163.95
Aug  1 06:18:25 abendstille sshd\[12394\]: Failed password for invalid user ts from 147.135.163.95 port 59110 ssh2
Aug  1 06:18:25 abendstille sshd\[12393\]: Failed password for invalid user ts from 147.135.163.95 port 50582 ssh2
...

Jul 28 21:49:11 ovpn sshd[7399]: Did not receive identification string from 147.135.163.95
Jul 28 21:49:59 ovpn sshd[7582]: Did not receive identification string from 147.135.163.95
Jul 28 21:51:02 ovpn sshd[7890]: Invalid user ftpuser from 147.135.163.95
Jul 28 21:51:02 ovpn sshd[7890]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=147.135.163.95
Jul 28 21:51:04 ovpn sshd[7890]: Failed password for invalid user ftpuser from 147.135.163.95 port 41172 ssh2
Jul 28 21:51:04 ovpn sshd[7890]: Received disconnect from 147.135.163.95 port 41172:11: Normal Shutdown, Thank you for playing [preauth]
Jul 28 21:51:04 ovpn sshd[7890]: Disconnected from 147.135.163.95 port 41172 [preauth]
Jul 28 21:52:20 ovpn sshd[8199]: Invalid user ghostname from 147.135.163.95
Jul 28 21:52:20 ovpn sshd[8199]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=147.135.163.95
Jul 28 21:52:22 ovpn sshd[8199]: Failed passwor........
------------------------------

SSH Brute-Forcing (server1)

(sshd) Failed SSH login from 147.135.163.90 (FR/France/ip90.ip-147-135-163.eu): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Mar  1 08:09:05 amsweb01 sshd[29060]: Invalid user visitor from 147.135.163.90 port 34344
Mar  1 08:09:06 amsweb01 sshd[29060]: Failed password for invalid user visitor from 147.135.163.90 port 34344 ssh2
Mar  1 08:16:05 amsweb01 sshd[1549]: Invalid user lichengzhang from 147.135.163.90 port 58440
Mar  1 08:16:07 amsweb01 sshd[1549]: Failed password for invalid user lichengzhang from 147.135.163.90 port 58440 ssh2
Mar  1 08:19:53 amsweb01 sshd[3263]: Failed password for root from 147.135.163.90 port 41838 ssh2

...

Dec 19 05:14:57 tdfoods sshd\[29413\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ip83.ip-147-135-163.eu  user=root
Dec 19 05:14:58 tdfoods sshd\[29413\]: Failed password for root from 147.135.163.83 port 33425 ssh2
Dec 19 05:21:38 tdfoods sshd\[30019\]: Invalid user administrator from 147.135.163.83
Dec 19 05:21:38 tdfoods sshd\[30019\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ip83.ip-147-135-163.eu
Dec 19 05:21:40 tdfoods sshd\[30019\]: Failed password for invalid user administrator from 147.135.163.83 port 40167 ssh2

Dec 18 06:01:09 firewall sshd[17230]: Invalid user sorana from 147.135.163.83
Dec 18 06:01:11 firewall sshd[17230]: Failed password for invalid user sorana from 147.135.163.83 port 39982 ssh2
Dec 18 06:06:50 firewall sshd[17383]: Invalid user qtss from 147.135.163.83
...

Invalid user taskovich from 147.135.163.83 port 60535

Dec  8 00:50:40 localhost sshd\[21935\]: Invalid user packer from 147.135.163.83 port 38247
Dec  8 00:50:40 localhost sshd\[21935\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=147.135.163.83
Dec  8 00:50:42 localhost sshd\[21935\]: Failed password for invalid user packer from 147.135.163.83 port 38247 ssh2

Dec  4 21:27:56 SilenceServices sshd[19624]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=147.135.163.83
Dec  4 21:27:58 SilenceServices sshd[19624]: Failed password for invalid user ts3 from 147.135.163.83 port 55313 ssh2
Dec  4 21:29:11 SilenceServices sshd[20023]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=147.135.163.83

Nov 10 17:21:59 vps691689 sshd[25289]: Failed password for root from 147.135.163.102 port 47180 ssh2
Nov 10 17:25:50 vps691689 sshd[25382]: Failed password for root from 147.135.163.102 port 56868 ssh2
...

[Aegis] @ 2019-10-26 18:00:53  0100 -> Attempted Administrator Privilege Gain: ET SCAN LibSSH Based Frequent SSH Connections Likely BruteForce Attack

Invalid user java from 147.135.163.102 port 51872

Oct 21 23:40:46 eventyay sshd[26237]: Failed password for root from 147.135.163.81 port 55106 ssh2
Oct 21 23:44:12 eventyay sshd[26273]: Failed password for root from 147.135.163.81 port 38038 ssh2
...

Oct 16 03:47:46 cumulus sshd[8557]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=147.135.163.81  user=r.r
Oct 16 03:47:48 cumulus sshd[8557]: Failed password for r.r from 147.135.163.81 port 34548 ssh2
Oct 16 03:47:48 cumulus sshd[8557]: Received disconnect from 147.135.163.81 port 34548:11: Bye Bye [preauth]
Oct 16 03:47:48 cumulus sshd[8557]: Disconnected from 147.135.163.81 port 34548 [preauth]
Oct 16 04:05:38 cumulus sshd[8971]: Invalid user brunhilde from 147.135.163.81 port 56260
Oct 16 04:05:38 cumulus sshd[8971]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=147.135.163.81
Oct 16 04:05:40 cumulus sshd[8971]: Failed password for invalid user brunhilde from 147.135.163.81 port 56260 ssh2
Oct 16 04:05:40 cumulus sshd[8971]: Received disconnect from 147.135.163.81 port 56260:11: Bye Bye [preauth]
Oct 16 04:05:40 cumulus sshd[8971]: Disconnected from 147.135.163.81 port 56260 [preaut........
-------------------------------

Oct 13 07:51:15 plusreed sshd[10115]: Invalid user Mac@123 from 147.135.163.102
...

Oct 10 03:14:34 web9 sshd\[997\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=147.135.163.102  user=root
Oct 10 03:14:36 web9 sshd\[997\]: Failed password for root from 147.135.163.102 port 57514 ssh2
Oct 10 03:19:32 web9 sshd\[1757\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=147.135.163.102  user=root
Oct 10 03:19:33 web9 sshd\[1757\]: Failed password for root from 147.135.163.102 port 41206 ssh2
Oct 10 03:24:32 web9 sshd\[2382\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=147.135.163.102  user=root

Automatic report - SSH Brute-Force Attack

Aug 18 05:00:19 andromeda sshd\[19711\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.63.203.234  user=root
Aug 18 05:00:20 andromeda sshd\[19711\]: Failed password for root from 123.63.203.234 port 47988 ssh2
Aug 18 05:00:23 andromeda sshd\[19711\]: Failed password for root from 123.63.203.234 port 47988 ssh2

Aug 18 15:15:31 yabzik sshd[13064]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.129.241.87
Aug 18 15:15:32 yabzik sshd[13064]: Failed password for invalid user docker from 203.129.241.87 port 48892 ssh2
Aug 18 15:21:10 yabzik sshd[14941]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.129.241.87

Aug 18 12:14:09 www_kotimaassa_fi sshd[24631]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.51.36.182
Aug 18 12:14:11 www_kotimaassa_fi sshd[24631]: Failed password for invalid user testuser from 106.51.36.182 port 32796 ssh2
...

Unauthorized connection attempt from IP address 186.67.197.202 on Port 445(SMB)

Aug 18 00:30:00 xtremcommunity sshd\[4854\]: Invalid user ji from 103.74.123.83 port 60432
Aug 18 00:30:00 xtremcommunity sshd\[4854\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.74.123.83
Aug 18 00:30:02 xtremcommunity sshd\[4854\]: Failed password for invalid user ji from 103.74.123.83 port 60432 ssh2
Aug 18 00:35:25 xtremcommunity sshd\[5025\]: Invalid user php5 from 103.74.123.83 port 50192
Aug 18 00:35:25 xtremcommunity sshd\[5025\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.74.123.83
...

Unauthorized connection attempt from IP address 179.49.11.234 on Port 445(SMB)

Aug 18 09:32:13 web8 sshd\[15406\]: Invalid user sloan from 202.59.166.148
Aug 18 09:32:13 web8 sshd\[15406\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.59.166.148
Aug 18 09:32:15 web8 sshd\[15406\]: Failed password for invalid user sloan from 202.59.166.148 port 48370 ssh2
Aug 18 09:36:55 web8 sshd\[17550\]: Invalid user prom from 202.59.166.148
Aug 18 09:36:55 web8 sshd\[17550\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.59.166.148

Aug 18 06:51:25 aat-srv002 sshd[16679]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.149.183
Aug 18 06:51:26 aat-srv002 sshd[16679]: Failed password for invalid user tester from 139.59.149.183 port 42403 ssh2
Aug 18 06:55:23 aat-srv002 sshd[16812]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.149.183
Aug 18 06:55:25 aat-srv002 sshd[16812]: Failed password for invalid user lfc from 139.59.149.183 port 37398 ssh2
...

Aug 18 18:17:20 localhost sshd[25856]: Invalid user project from 50.249.31.13 port 58202
Aug 18 18:17:20 localhost sshd[25856]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=50.249.31.13
Aug 18 18:17:20 localhost sshd[25856]: Invalid user project from 50.249.31.13 port 58202
Aug 18 18:17:22 localhost sshd[25856]: Failed password for invalid user project from 50.249.31.13 port 58202 ssh2
...

2019-08-18T06:55:40.658216abusebot-3.cloudsearch.cf sshd\[24037\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.220.15.5  user=root

2019-08-18T05:15:46.800278mizuno.rwx.ovh sshd[14851]: Connection from 142.93.254.124 port 34900 on 78.46.61.178 port 22
2019-08-18T05:15:47.387811mizuno.rwx.ovh sshd[14851]: Invalid user www-data from 142.93.254.124 port 34900
2019-08-18T05:15:47.397277mizuno.rwx.ovh sshd[14851]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.254.124
2019-08-18T05:15:46.800278mizuno.rwx.ovh sshd[14851]: Connection from 142.93.254.124 port 34900 on 78.46.61.178 port 22
2019-08-18T05:15:47.387811mizuno.rwx.ovh sshd[14851]: Invalid user www-data from 142.93.254.124 port 34900
2019-08-18T05:15:49.184618mizuno.rwx.ovh sshd[14851]: Failed password for invalid user www-data from 142.93.254.124 port 34900 ssh2
...

08/17/2019-23:00:27.526520 73.156.193.207 Protocol: 6 ET CINS Active Threat Intelligence Poor Reputation IP group 72

Aug 18 04:26:31 XXX sshd[1991]: Invalid user oracle from 139.255.89.98 port 37028

$f2bV_matches