May 11 07:27:01 pi sshd[32240]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.50.55 
May 11 07:27:04 pi sshd[32240]: Failed password for invalid user bernard from 165.22.50.55 port 35246 ssh2

May 30 05:47:43 vmi345603 sshd[30339]: Failed password for root from 165.22.50.55 port 54412 ssh2
...

May 26 06:56:01 firewall sshd[8585]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.50.55
May 26 06:56:01 firewall sshd[8585]: Invalid user vinay from 165.22.50.55
May 26 06:56:03 firewall sshd[8585]: Failed password for invalid user vinay from 165.22.50.55 port 42836 ssh2
...

May 21 22:29:19 server sshd[11759]: Failed password for invalid user epk from 165.22.50.55 port 50600 ssh2
May 21 22:31:34 server sshd[14411]: Failed password for invalid user mqo from 165.22.50.55 port 58840 ssh2
May 21 22:33:53 server sshd[16941]: Failed password for invalid user hvi from 165.22.50.55 port 38844 ssh2

May 15 06:57:05 santamaria sshd\[25404\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.50.55  user=root
May 15 06:57:08 santamaria sshd\[25404\]: Failed password for root from 165.22.50.55 port 47810 ssh2
May 15 07:00:52 santamaria sshd\[25445\]: Invalid user user2 from 165.22.50.55
May 15 07:00:52 santamaria sshd\[25445\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.50.55
...

Invalid user hack from 165.22.50.55 port 60048

firewall-block, port(s): 10379/tcp

Unauthorized connection attempt detected from IP address 165.22.50.164 to port 4982 [T]

Aug 15 05:47:47 serwer sshd\[15758\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.50.164  user=root
Aug 15 05:47:48 serwer sshd\[15758\]: Failed password for root from 165.22.50.164 port 59414 ssh2
Aug 15 05:49:39 serwer sshd\[17102\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.50.164  user=root
...

Aug 14 05:41:46 onepixel sshd[502573]: Failed password for root from 165.22.50.164 port 59464 ssh2
Aug 14 05:43:47 onepixel sshd[503683]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.50.164  user=root
Aug 14 05:43:49 onepixel sshd[503683]: Failed password for root from 165.22.50.164 port 60062 ssh2
Aug 14 05:45:42 onepixel sshd[504774]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.50.164  user=root
Aug 14 05:45:44 onepixel sshd[504774]: Failed password for root from 165.22.50.164 port 60660 ssh2

Aug  2 21:35:15 cumulus sshd[4640]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.50.164  user=r.r
Aug  2 21:35:18 cumulus sshd[4640]: Failed password for r.r from 165.22.50.164 port 40810 ssh2
Aug  2 21:35:18 cumulus sshd[4640]: Received disconnect from 165.22.50.164 port 40810:11: Bye Bye [preauth]
Aug  2 21:35:18 cumulus sshd[4640]: Disconnected from 165.22.50.164 port 40810 [preauth]
Aug  2 21:36:18 cumulus sshd[4736]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.50.164  user=r.r
Aug  2 21:36:20 cumulus sshd[4736]: Failed password for r.r from 165.22.50.164 port 52894 ssh2
Aug  2 21:36:20 cumulus sshd[4736]: Received disconnect from 165.22.50.164 port 52894:11: Bye Bye [preauth]
Aug  2 21:36:20 cumulus sshd[4736]: Disconnected from 165.22.50.164 port 52894 [preauth]
Aug  2 21:36:54 cumulus sshd[4796]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 t........
-------------------------------

May 30 16:16:36 vpn01 sshd[29106]: Failed password for root from 165.22.50.67 port 57314 ssh2
...

Fail2Ban Ban Triggered (2)

Automatic report BANNED IP

Automatic report - Banned IP Access

2019-10-03 12:21:25,752 fail2ban.actions        \[946\]: NOTICE  \[sshd\] Ban 165.22.50.65
2019-10-03 12:52:46,516 fail2ban.actions        \[946\]: NOTICE  \[sshd\] Ban 165.22.50.65
2019-10-03 13:24:11,683 fail2ban.actions        \[946\]: NOTICE  \[sshd\] Ban 165.22.50.65
2019-10-03 13:55:33,750 fail2ban.actions        \[946\]: NOTICE  \[sshd\] Ban 165.22.50.65
2019-10-03 14:25:44,977 fail2ban.actions        \[946\]: NOTICE  \[sshd\] Ban 165.22.50.65
...

Sep 29 08:09:41 *** sshd[14896]: Invalid user comercial from 165.22.50.65

Sep 28 07:28:30 dallas01 sshd[11439]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.50.65
Sep 28 07:28:32 dallas01 sshd[11439]: Failed password for invalid user ftpaccess from 165.22.50.65 port 36444 ssh2
Sep 28 07:32:45 dallas01 sshd[12054]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.50.65

Sep 16 02:03:27 cp1server sshd[2102]: Invalid user PlcmSpIp from 165.22.50.65
Sep 16 02:03:27 cp1server sshd[2102]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.50.65 
Sep 16 02:03:29 cp1server sshd[2102]: Failed password for invalid user PlcmSpIp from 165.22.50.65 port 36496 ssh2
Sep 16 02:03:29 cp1server sshd[2103]: Received disconnect from 165.22.50.65: 11: Bye Bye
Sep 16 02:24:21 cp1server sshd[4388]: Invalid user ts4 from 165.22.50.65
Sep 16 02:24:22 cp1server sshd[4388]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.50.65 
Sep 16 02:24:24 cp1server sshd[4388]: Failed password for invalid user ts4 from 165.22.50.65 port 35378 ssh2
Sep 16 02:24:24 cp1server sshd[4389]: Received disconnect from 165.22.50.65: 11: Bye Bye
Sep 16 02:28:39 cp1server sshd[5062]: Invalid user to from 165.22.50.65
Sep 16 02:28:39 cp1server sshd[5062]: pam_unix(sshd:auth): authentication failur........
-------------------------------

Sep 15 09:58:45 eventyay sshd[21219]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.50.65
Sep 15 09:58:48 eventyay sshd[21219]: Failed password for invalid user event from 165.22.50.65 port 55390 ssh2
Sep 15 10:03:45 eventyay sshd[21338]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.50.65
...

Sep 13 20:59:02 srv206 sshd[12033]: Invalid user a1b1c3 from 165.22.50.65
...

SSH Brute-Force reported by Fail2Ban

2020-07-27T04:08:21.093018shield sshd\[4656\]: Invalid user mateusz from 200.116.47.247 port 51159
2020-07-27T04:08:21.102270shield sshd\[4656\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=conm200-116-47-247.epm.net.co
2020-07-27T04:08:23.829823shield sshd\[4656\]: Failed password for invalid user mateusz from 200.116.47.247 port 51159 ssh2
2020-07-27T04:14:08.790767shield sshd\[5180\]: Invalid user composer from 200.116.47.247 port 31337
2020-07-27T04:14:08.800578shield sshd\[5180\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=conm200-116-47-247.epm.net.co

Jul 27 07:19:43 ift sshd\[62370\]: Failed password for root from 222.186.175.212 port 21952 ssh2Jul 27 07:19:47 ift sshd\[62370\]: Failed password for root from 222.186.175.212 port 21952 ssh2Jul 27 07:19:58 ift sshd\[62370\]: Failed password for root from 222.186.175.212 port 21952 ssh2Jul 27 07:20:12 ift sshd\[62627\]: Failed password for root from 222.186.175.212 port 25712 ssh2Jul 27 07:20:47 ift sshd\[62693\]: Failed password for root from 222.186.175.212 port 24558 ssh2
...

2020-07-26T23:15:23.743075server.mjenks.net sshd[3769012]: Failed password for root from 85.209.0.103 port 43344 ssh2
2020-07-26T23:15:22.228476server.mjenks.net sshd[3769011]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.209.0.103  user=root
2020-07-26T23:15:23.743261server.mjenks.net sshd[3769011]: Failed password for root from 85.209.0.103 port 43354 ssh2
2020-07-26T23:15:22.362763server.mjenks.net sshd[3769010]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.209.0.103  user=root
2020-07-26T23:15:23.877567server.mjenks.net sshd[3769010]: Failed password for root from 85.209.0.103 port 43356 ssh2
...

2020-07-27 03:36:30,108 fail2ban.actions        [937]: NOTICE  [sshd] Ban 58.23.16.254
2020-07-27 04:10:38,640 fail2ban.actions        [937]: NOTICE  [sshd] Ban 58.23.16.254
2020-07-27 04:45:47,492 fail2ban.actions        [937]: NOTICE  [sshd] Ban 58.23.16.254
2020-07-27 05:21:06,589 fail2ban.actions        [937]: NOTICE  [sshd] Ban 58.23.16.254
2020-07-27 05:56:59,461 fail2ban.actions        [937]: NOTICE  [sshd] Ban 58.23.16.254
...

"fail2ban match"

2020-07-27T02:07:55.413366mail.broermann.family sshd[3138]: Invalid user mat from 68.183.133.156 port 35908
2020-07-27T02:07:55.418788mail.broermann.family sshd[3138]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.183.133.156
2020-07-27T02:07:55.413366mail.broermann.family sshd[3138]: Invalid user mat from 68.183.133.156 port 35908
2020-07-27T02:07:57.030093mail.broermann.family sshd[3138]: Failed password for invalid user mat from 68.183.133.156 port 35908 ssh2
2020-07-27T02:12:43.299244mail.broermann.family sshd[3317]: Invalid user anurag from 68.183.133.156 port 49304
...

20 attempts against mh-misbehave-ban on wood

Jul 26 21:15:52 dignus sshd[10943]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=150.109.115.108
Jul 26 21:15:54 dignus sshd[10943]: Failed password for invalid user chris from 150.109.115.108 port 36468 ssh2
Jul 26 21:19:29 dignus sshd[11442]: Invalid user work from 150.109.115.108 port 37492
Jul 26 21:19:29 dignus sshd[11442]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=150.109.115.108
Jul 26 21:19:30 dignus sshd[11442]: Failed password for invalid user work from 150.109.115.108 port 37492 ssh2
...

IP 91.240.61.209 attacked honeypot on port: 1433 at 7/26/2020 8:56:04 PM

Jul 27 09:27:03 lunarastro sshd[32466]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.98.182 
Jul 27 09:27:04 lunarastro sshd[32466]: Failed password for invalid user hj from 106.12.98.182 port 36310 ssh2

Jul 27 10:56:35 itv-usvr-01 sshd[21032]: Invalid user admin from 54.38.75.41
Jul 27 10:56:35 itv-usvr-01 sshd[21032]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.38.75.41
Jul 27 10:56:35 itv-usvr-01 sshd[21032]: Invalid user admin from 54.38.75.41
Jul 27 10:56:38 itv-usvr-01 sshd[21032]: Failed password for invalid user admin from 54.38.75.41 port 54832 ssh2
Jul 27 10:56:40 itv-usvr-01 sshd[21034]: Invalid user admin from 54.38.75.41

Jul 27 00:52:32 firewall sshd[25827]: Invalid user deployer from 118.24.108.205
Jul 27 00:52:35 firewall sshd[25827]: Failed password for invalid user deployer from 118.24.108.205 port 51732 ssh2
Jul 27 00:56:36 firewall sshd[25917]: Invalid user connie from 118.24.108.205
...

Jul 27 06:00:39 abendstille sshd\[20680\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.15.62  user=root
Jul 27 06:00:41 abendstille sshd\[20680\]: Failed password for root from 222.186.15.62 port 11022 ssh2
Jul 27 06:00:43 abendstille sshd\[20680\]: Failed password for root from 222.186.15.62 port 11022 ssh2
Jul 27 06:00:45 abendstille sshd\[20680\]: Failed password for root from 222.186.15.62 port 11022 ssh2
Jul 27 06:00:48 abendstille sshd\[20908\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.15.62  user=root
...

(pop3d) Failed POP3 login from 151.242.76.237 (IR/Iran/151-242-76-237.shatel.ir): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Jul 27 08:26:23 ir1 dovecot[3110802]: pop3-login: Aborted login (auth failed, 1 attempts in 2 secs): user=, method=PLAIN, rip=151.242.76.237, lip=5.63.12.44, session=