Apr  8 02:37:55  sshd\[30008\]: Invalid user kuaisuweb from 163.44.159.50Apr  8 02:37:57  sshd\[30008\]: Failed password for invalid user kuaisuweb from 163.44.159.50 port 48512 ssh2
...

Mar 31 19:37:27 ArkNodeAT sshd\[22191\]: Invalid user test from 163.44.159.50
Mar 31 19:37:27 ArkNodeAT sshd\[22191\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=163.44.159.50
Mar 31 19:37:30 ArkNodeAT sshd\[22191\]: Failed password for invalid user test from 163.44.159.50 port 54736 ssh2

Mar 24 06:44:46 h2646465 sshd[16924]: Invalid user noc from 163.44.159.50
Mar 24 06:44:46 h2646465 sshd[16924]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=163.44.159.50
Mar 24 06:44:46 h2646465 sshd[16924]: Invalid user noc from 163.44.159.50
Mar 24 06:44:48 h2646465 sshd[16924]: Failed password for invalid user noc from 163.44.159.50 port 58324 ssh2
Mar 24 06:52:04 h2646465 sshd[19542]: Invalid user xuxo from 163.44.159.50
Mar 24 06:52:04 h2646465 sshd[19542]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=163.44.159.50
Mar 24 06:52:04 h2646465 sshd[19542]: Invalid user xuxo from 163.44.159.50
Mar 24 06:52:06 h2646465 sshd[19542]: Failed password for invalid user xuxo from 163.44.159.50 port 52610 ssh2
Mar 24 06:54:42 h2646465 sshd[20184]: Invalid user of from 163.44.159.50
...

Sep 30 19:21:02 marvibiene sshd[18177]: Invalid user admin from 163.44.159.154 port 56692
Sep 30 19:21:02 marvibiene sshd[18177]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=163.44.159.154
Sep 30 19:21:02 marvibiene sshd[18177]: Invalid user admin from 163.44.159.154 port 56692
Sep 30 19:21:05 marvibiene sshd[18177]: Failed password for invalid user admin from 163.44.159.154 port 56692 ssh2

Invalid user tester from 163.44.159.154 port 56342

Invalid user tester from 163.44.159.154 port 56342

Aug 30 11:43:31 doubuntu sshd[15454]: Did not receive identification string from 163.44.159.123 port 34890
Aug 30 11:48:20 doubuntu sshd[15464]: Did not receive identification string from 163.44.159.123 port 55224
Aug 30 11:49:11 doubuntu sshd[15466]: Did not receive identification string from 163.44.159.123 port 34370
...

Aug 18 01:54:30 sso sshd[13733]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=163.44.159.154
Aug 18 01:54:32 sso sshd[13733]: Failed password for invalid user vah from 163.44.159.154 port 41566 ssh2
...

leo_www

Jun 19 14:31:35 localhost sshd\[12598\]: Invalid user ts2 from 163.44.159.154
Jun 19 14:31:35 localhost sshd\[12598\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=163.44.159.154
Jun 19 14:31:37 localhost sshd\[12598\]: Failed password for invalid user ts2 from 163.44.159.154 port 60270 ssh2
Jun 19 14:34:30 localhost sshd\[12758\]: Invalid user testuser from 163.44.159.154
Jun 19 14:34:30 localhost sshd\[12758\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=163.44.159.154
...

Jun  3 14:49:28 journals sshd\[5609\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=163.44.159.154  user=root
Jun  3 14:49:30 journals sshd\[5609\]: Failed password for root from 163.44.159.154 port 47744 ssh2
Jun  3 14:53:31 journals sshd\[33640\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=163.44.159.154  user=root
Jun  3 14:53:33 journals sshd\[33640\]: Failed password for root from 163.44.159.154 port 50806 ssh2
Jun  3 14:57:34 journals sshd\[34214\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=163.44.159.154  user=root
...

DATE:2020-05-04 10:21:37, IP:163.44.159.154, PORT:ssh SSH brute force auth (docker-dc)

Apr 21 06:54:19 hosting sshd[25698]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=v163-44-159-123.a01a.g.sin1.static.cnode.io  user=root
Apr 21 06:54:21 hosting sshd[25698]: Failed password for root from 163.44.159.123 port 51866 ssh2
Apr 21 06:57:37 hosting sshd[26418]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=v163-44-159-123.a01a.g.sin1.static.cnode.io  user=root
Apr 21 06:57:39 hosting sshd[26418]: Failed password for root from 163.44.159.123 port 47250 ssh2
...

Invalid user ji from 163.44.159.154 port 36336

Apr 11 02:54:40 ny01 sshd[20820]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=163.44.159.123
Apr 11 02:54:43 ny01 sshd[20820]: Failed password for invalid user webmaster from 163.44.159.123 port 35794 ssh2
Apr 11 02:58:19 ny01 sshd[21745]: Failed password for root from 163.44.159.123 port 38090 ssh2

" "

[ssh] SSH attack

Apr  2 18:14:22 minden010 sshd[16714]: Failed password for root from 163.44.159.154 port 39832 ssh2
Apr  2 18:18:44 minden010 sshd[17257]: Failed password for root from 163.44.159.154 port 40720 ssh2
...

Sep  1 20:43:36 h2177944 sshd\[24643\]: Invalid user adam from 94.23.204.136 port 51564
Sep  1 20:43:36 h2177944 sshd\[24643\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.23.204.136
Sep  1 20:43:38 h2177944 sshd\[24643\]: Failed password for invalid user adam from 94.23.204.136 port 51564 ssh2
Sep  1 20:47:20 h2177944 sshd\[24694\]: Invalid user cs from 94.23.204.136 port 39756
...

Lines containing failures of 218.98.26.182
Sep  1 18:04:15 cdb sshd[14777]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.98.26.182  user=r.r
Sep  1 18:04:17 cdb sshd[14777]: Failed password for r.r from 218.98.26.182 port 28786 ssh2
Sep  1 18:04:24 cdb sshd[14777]: message repeated 2 serveres: [ Failed password for r.r from 218.98.26.182 port 28786 ssh2]
Sep  1 18:04:24 cdb sshd[14777]: Received disconnect from 218.98.26.182 port 28786:11:  [preauth]
Sep  1 18:04:24 cdb sshd[14777]: Disconnected from authenticating user r.r 218.98.26.182 port 28786 [preauth]
Sep  1 18:04:24 cdb sshd[14777]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.98.26.182  user=r.r
Sep  1 18:04:26 cdb sshd[14789]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.98.26.182  user=r.r
Sep  1 18:04:28 cdb sshd[14789]: Failed password for r.r from 218.98.26.182 port 38408 ssh2
........
------------------------------

[portscan] Port scan

wp-login / xmlrpc attacks
Firefox version 62.0 running on Linux
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0

Sep  1 13:34:48 plusreed sshd[7016]: Invalid user shao from 185.56.153.231
...

Sep  1 15:22:02 vps200512 sshd\[2907\]: Invalid user kill from 167.71.239.25
Sep  1 15:22:02 vps200512 sshd\[2907\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.239.25
Sep  1 15:22:05 vps200512 sshd\[2907\]: Failed password for invalid user kill from 167.71.239.25 port 47930 ssh2
Sep  1 15:26:47 vps200512 sshd\[2972\]: Invalid user smb from 167.71.239.25
Sep  1 15:26:47 vps200512 sshd\[2972\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.239.25

2019-09-02T02:28:27.017572enmeeting.mahidol.ac.th sshd\[20835\]: Invalid user le from 188.166.239.106 port 46172
2019-09-02T02:28:27.031817enmeeting.mahidol.ac.th sshd\[20835\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=gadgedo.com
2019-09-02T02:28:29.921704enmeeting.mahidol.ac.th sshd\[20835\]: Failed password for invalid user le from 188.166.239.106 port 46172 ssh2
...

Automatic report - Banned IP Access

Sep  1 19:35:22 server6 sshd[28521]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.87.49.44  user=r.r
Sep  1 19:35:24 server6 sshd[28521]: Failed password for r.r from 106.87.49.44 port 55844 ssh2
Sep  1 19:35:27 server6 sshd[28521]: Failed password for r.r from 106.87.49.44 port 55844 ssh2
Sep  1 19:35:29 server6 sshd[28521]: Failed password for r.r from 106.87.49.44 port 55844 ssh2
Sep  1 19:35:31 server6 sshd[28521]: Failed password for r.r from 106.87.49.44 port 55844 ssh2
Sep  1 19:35:33 server6 sshd[28521]: Failed password for r.r from 106.87.49.44 port 55844 ssh2
Sep  1 19:35:35 server6 sshd[28521]: Failed password for r.r from 106.87.49.44 port 55844 ssh2
Sep  1 19:35:35 server6 sshd[28521]: Disconnecting: Too many authentication failures for r.r from 106.87.49.44 port 55844 ssh2 [preauth]
Sep  1 19:35:35 server6 sshd[28521]: PAM 5 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.87.49.44 ........
-------------------------------

Sep  1 09:31:08 eddieflores sshd\[9224\]: Invalid user ftpuser from 182.76.246.204
Sep  1 09:31:08 eddieflores sshd\[9224\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.76.246.204
Sep  1 09:31:10 eddieflores sshd\[9224\]: Failed password for invalid user ftpuser from 182.76.246.204 port 35764 ssh2
Sep  1 09:37:33 eddieflores sshd\[9701\]: Invalid user ep from 182.76.246.204
Sep  1 09:37:33 eddieflores sshd\[9701\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.76.246.204

Sep  1 20:08:21 [host] sshd[6876]: Invalid user oracle from 183.101.216.229
Sep  1 20:08:21 [host] sshd[6876]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.101.216.229
Sep  1 20:08:23 [host] sshd[6876]: Failed password for invalid user oracle from 183.101.216.229 port 34433 ssh2

01.09.2019 20:04:54 - Wordpress fail 
Detected by ELinOX-ALM

Automated report - ssh fail2ban:
Sep 1 20:39:21 authentication failure 
Sep 1 20:39:23 wrong password, user=its, port=35240, ssh2
Sep 1 20:44:20 authentication failure

Sep  1 21:32:53 eventyay sshd[25019]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=13.94.57.155
Sep  1 21:32:55 eventyay sshd[25019]: Failed password for invalid user ubuntu from 13.94.57.155 port 50980 ssh2
Sep  1 21:37:59 eventyay sshd[26438]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=13.94.57.155
...

\[2019-09-01 15:48:45\] NOTICE\[1829\] chan_sip.c: Registration from '\' failed for '5.62.41.171:6161' - Wrong password
\[2019-09-01 15:48:45\] SECURITY\[1837\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-09-01T15:48:45.431-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="2387",SessionID="0x7f7b309aa818",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/5.62.41.171/52656",Challenge="24c54e4d",ReceivedChallenge="24c54e4d",ReceivedHash="4f5885ba7e20653537f00d34a6dd3785"
\[2019-09-01 15:50:54\] NOTICE\[1829\] chan_sip.c: Registration from '\' failed for '5.62.41.171:6092' - Wrong password
\[2019-09-01 15:50:54\] SECURITY\[1837\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-09-01T15:50:54.278-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="2856",SessionID="0x7f7b30be0af8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/5.62.41.171/49614