Nov 26 08:56:25 odroid64 sshd\[23130\]: User root from 165.227.93.144 not allowed because not listed in AllowUsers
Nov 26 08:56:25 odroid64 sshd\[23130\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.227.93.144  user=root
...

SSH login attempts with invalid user

Invalid user sasha from 165.227.93.144 port 45940

Invalid user 1234 from 165.227.93.144 port 49248

Oct 18 12:10:56 Tower sshd[28792]: Connection from 165.227.93.144 port 57284 on 192.168.10.220 port 22
Oct 18 12:10:57 Tower sshd[28792]: Failed password for root from 165.227.93.144 port 57284 ssh2
Oct 18 12:10:57 Tower sshd[28792]: Received disconnect from 165.227.93.144 port 57284:11: Bye Bye [preauth]
Oct 18 12:10:57 Tower sshd[28792]: Disconnected from authenticating user root 165.227.93.144 port 57284 [preauth]

Oct 16 13:24:35 MK-Soft-VM6 sshd[17164]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.227.93.144 
Oct 16 13:24:37 MK-Soft-VM6 sshd[17164]: Failed password for invalid user sun from 165.227.93.144 port 51076 ssh2
...

Lines containing failures of 165.227.93.144
Oct 16 03:06:44 smtp-out sshd[6609]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.227.93.144  user=r.r
Oct 16 03:06:46 smtp-out sshd[6609]: Failed password for r.r from 165.227.93.144 port 33504 ssh2
Oct 16 03:06:48 smtp-out sshd[6609]: Received disconnect from 165.227.93.144 port 33504:11: Bye Bye [preauth]
Oct 16 03:06:48 smtp-out sshd[6609]: Disconnected from authenticating user r.r 165.227.93.144 port 33504 [preauth]
Oct 16 03:58:04 smtp-out sshd[8477]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.227.93.144  user=r.r
Oct 16 03:58:07 smtp-out sshd[8477]: Failed password for r.r from 165.227.93.144 port 33388 ssh2
Oct 16 03:58:08 smtp-out sshd[8477]: Received disconnect from 165.227.93.144 port 33388:11: Bye Bye [preauth]
Oct 16 03:58:08 smtp-out sshd[8477]: Disconnected from authenticating user r.r 165.227.93.144 port 33388 [preaut........
------------------------------

Jun 10 06:21:45 pi sshd[26837]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.227.93.39 
Jun 10 06:21:47 pi sshd[26837]: Failed password for invalid user user from 165.227.93.39 port 60022 ssh2

Jun 25 01:19:54 abendstille sshd\[20496\]: Invalid user wq from 165.227.93.39
Jun 25 01:19:54 abendstille sshd\[20496\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.227.93.39
Jun 25 01:19:56 abendstille sshd\[20496\]: Failed password for invalid user wq from 165.227.93.39 port 44966 ssh2
Jun 25 01:23:14 abendstille sshd\[23883\]: Invalid user minecraft from 165.227.93.39
Jun 25 01:23:14 abendstille sshd\[23883\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.227.93.39
...

Jun 19 09:33:13 ws19vmsma01 sshd[142252]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.227.93.39
Jun 19 09:33:15 ws19vmsma01 sshd[142252]: Failed password for invalid user user11 from 165.227.93.39 port 59658 ssh2
...

2020-06-13T23:11:12.426890billing sshd[14161]: Failed password for root from 165.227.93.39 port 40464 ssh2
2020-06-13T23:14:22.326950billing sshd[20427]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=server5.mobiticket.co.ke  user=root
2020-06-13T23:14:24.422103billing sshd[20427]: Failed password for root from 165.227.93.39 port 40126 ssh2
...

Jun  9 05:43:11 webhost01 sshd[6554]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.227.93.39
Jun  9 05:43:13 webhost01 sshd[6554]: Failed password for invalid user xgs from 165.227.93.39 port 46936 ssh2
...

May 28 20:11:21 melroy-server sshd[1413]: Failed password for root from 165.227.93.39 port 53062 ssh2
...

Invalid user rgl from 165.227.93.39 port 48786

2020-05-10T22:40:18.104129shield sshd\[12338\]: Invalid user jack from 165.227.93.39 port 39098
2020-05-10T22:40:18.107568shield sshd\[12338\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=server5.mobiticket.co.ke
2020-05-10T22:40:19.459332shield sshd\[12338\]: Failed password for invalid user jack from 165.227.93.39 port 39098 ssh2
2020-05-10T22:43:37.502270shield sshd\[13704\]: Invalid user olivia from 165.227.93.39 port 45242
2020-05-10T22:43:37.505960shield sshd\[13704\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=server5.mobiticket.co.ke

2020-05-10T18:07:24.833244shield sshd\[11589\]: Invalid user oracle from 165.227.93.39 port 50824
2020-05-10T18:07:24.837243shield sshd\[11589\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=server5.mobiticket.co.ke
2020-05-10T18:07:26.993624shield sshd\[11589\]: Failed password for invalid user oracle from 165.227.93.39 port 50824 ssh2
2020-05-10T18:10:52.241911shield sshd\[12985\]: Invalid user deploy from 165.227.93.39 port 59580
2020-05-10T18:10:52.246015shield sshd\[12985\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=server5.mobiticket.co.ke

Bruteforce detected by fail2ban

Invalid user ck from 165.227.93.39 port 52394

Apr 14 09:15:47 vps46666688 sshd[16147]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.227.93.39
Apr 14 09:15:47 vps46666688 sshd[16147]: Failed password for invalid user admin from 165.227.93.39 port 36836 ssh2
...

2020-04-07T05:16:07.039166randservbullet-proofcloud-66.localdomain sshd[32377]: Invalid user chandra from 165.227.93.39 port 33686
2020-04-07T05:16:07.073099randservbullet-proofcloud-66.localdomain sshd[32377]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=server5.mobiticket.co.ke
2020-04-07T05:16:07.039166randservbullet-proofcloud-66.localdomain sshd[32377]: Invalid user chandra from 165.227.93.39 port 33686
2020-04-07T05:16:08.771037randservbullet-proofcloud-66.localdomain sshd[32377]: Failed password for invalid user chandra from 165.227.93.39 port 33686 ssh2
...

(sshd) Failed SSH login from 165.227.93.39 (US/United States/server5.mobiticket.co.ke): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Apr  4 02:17:47 amsweb01 sshd[31026]: Failed password for root from 165.227.93.39 port 58672 ssh2
Apr  4 02:27:51 amsweb01 sshd[32341]: Failed password for root from 165.227.93.39 port 34342 ssh2
Apr  4 02:31:43 amsweb01 sshd[708]: Failed password for root from 165.227.93.39 port 43346 ssh2
Apr  4 02:35:13 amsweb01 sshd[1739]: Failed password for root from 165.227.93.39 port 52350 ssh2
Apr  4 02:38:42 amsweb01 sshd[2249]: Failed password for root from 165.227.93.39 port 33126 ssh2

SSH brute-force: detected 6 distinct usernames within a 24-hour window.

Jan  2 06:14:07 vmd17057 sshd\[17901\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.173.226  user=root
Jan  2 06:14:09 vmd17057 sshd\[17901\]: Failed password for root from 222.186.173.226 port 37943 ssh2
Jan  2 06:14:13 vmd17057 sshd\[17901\]: Failed password for root from 222.186.173.226 port 37943 ssh2
...

Jan  2 05:59:35 grey postfix/smtpd\[20073\]: NOQUEUE: reject: RCPT from unknown\[114.237.188.186\]: 554 5.7.1 Service unavailable\; Client host \[114.237.188.186\] blocked using truncate.gbudb.net\; http://www.gbudb.com/truncate/ \[114.237.188.186\]\; from=\ to=\ proto=ESMTP helo=\
...

Honeypot attack, port: 445, PTR: PTR record not found

1577941158 - 01/02/2020 05:59:18 Host: 46.224.203.240/46.224.203.240 Port: 445 TCP Blocked

Jan  2 00:31:44 localhost sshd\[51079\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.89.240.188  user=root
Jan  2 00:31:46 localhost sshd\[51079\]: Failed password for root from 118.89.240.188 port 47910 ssh2
Jan  2 00:34:19 localhost sshd\[51145\]: Invalid user dulcia from 118.89.240.188 port 35930
Jan  2 00:34:19 localhost sshd\[51145\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.89.240.188
Jan  2 00:34:21 localhost sshd\[51145\]: Failed password for invalid user dulcia from 118.89.240.188 port 35930 ssh2
...

Jan  1 23:51:01 localhost sshd\[21690\]: Invalid user admin from 14.163.217.132 port 53810
Jan  1 23:51:01 localhost sshd\[21690\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.163.217.132
Jan  1 23:51:03 localhost sshd\[21690\]: Failed password for invalid user admin from 14.163.217.132 port 53810 ssh2

Jan  2 02:08:18 mout sshd[17490]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.6.113  user=uucp
Jan  2 02:08:19 mout sshd[17490]: Failed password for uucp from 106.13.6.113 port 34854 ssh2

Jan  2 01:56:02 srv-ubuntu-dev3 sshd[116673]: Invalid user armend from 207.107.67.67
Jan  2 01:56:02 srv-ubuntu-dev3 sshd[116673]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=207.107.67.67
Jan  2 01:56:02 srv-ubuntu-dev3 sshd[116673]: Invalid user armend from 207.107.67.67
Jan  2 01:56:05 srv-ubuntu-dev3 sshd[116673]: Failed password for invalid user armend from 207.107.67.67 port 47300 ssh2
Jan  2 01:58:43 srv-ubuntu-dev3 sshd[116920]: Invalid user suvendu from 207.107.67.67
Jan  2 01:58:43 srv-ubuntu-dev3 sshd[116920]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=207.107.67.67
Jan  2 01:58:43 srv-ubuntu-dev3 sshd[116920]: Invalid user suvendu from 207.107.67.67
Jan  2 01:58:45 srv-ubuntu-dev3 sshd[116920]: Failed password for invalid user suvendu from 207.107.67.67 port 47814 ssh2
Jan  2 02:01:30 srv-ubuntu-dev3 sshd[117123]: Invalid user edith from 207.107.67.67
...

Jan  1 23:39:49 server sshd[37817]: Failed password for invalid user pracownik from 147.139.132.146 port 38630 ssh2
Jan  1 23:46:22 server sshd[38176]: Failed password for invalid user oracle from 147.139.132.146 port 50114 ssh2
Jan  1 23:50:46 server sshd[38423]: Failed password for root from 147.139.132.146 port 51552 ssh2

(From raphaenournareddy@gmail.com) Hello!  whenisnow.net 
 
Did you know that it is possible to send message fully legit? 
We presentation a new legitimate method of sending business offer through contact forms. Such forms are located on many sites. 
When such requests are sent, no personal data is used, and messages are sent to forms specifically designed to receive messages and appeals. 
Also, messages sent through communication Forms do not get into spam because such messages are considered important. 
We offer you to test our service for free. We will send up to 50,000 messages for you. 
The cost of sending one million messages is 49 USD. 
 
This message is created automatically. Please use the contact details below to contact us. 
 
Contact us. 
Telegram - @FeedbackFormEU 
Skype  FeedbackForm2019 
Email - feedbackform@make-success.com

Jan  2 02:11:51 localhost sshd\[8009\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.236.142.89  user=root
Jan  2 02:11:53 localhost sshd\[8009\]: Failed password for root from 104.236.142.89 port 55362 ssh2
Jan  2 02:14:49 localhost sshd\[8265\]: Invalid user xbot from 104.236.142.89 port 55260
Jan  2 02:14:49 localhost sshd\[8265\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.236.142.89

Jan  2 12:15:46 itv-usvr-02 sshd[17514]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.42.4  user=root
Jan  2 12:15:48 itv-usvr-02 sshd[17514]: Failed password for root from 222.186.42.4 port 20688 ssh2

Jan  2 01:59:19 ws22vmsma01 sshd[205477]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=35.201.243.170
Jan  2 01:59:21 ws22vmsma01 sshd[205477]: Failed password for invalid user thomas from 35.201.243.170 port 60152 ssh2
...

2020-01-02T04:56:59.411754abusebot-2.cloudsearch.cf sshd[9630]: Invalid user sismilich from 182.61.105.127 port 46006
2020-01-02T04:56:59.418786abusebot-2.cloudsearch.cf sshd[9630]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.105.127
2020-01-02T04:56:59.411754abusebot-2.cloudsearch.cf sshd[9630]: Invalid user sismilich from 182.61.105.127 port 46006
2020-01-02T04:57:01.514631abusebot-2.cloudsearch.cf sshd[9630]: Failed password for invalid user sismilich from 182.61.105.127 port 46006 ssh2
2020-01-02T04:59:30.108392abusebot-2.cloudsearch.cf sshd[9796]: Invalid user lamett from 182.61.105.127 port 41930
2020-01-02T04:59:30.115356abusebot-2.cloudsearch.cf sshd[9796]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.105.127
2020-01-02T04:59:30.108392abusebot-2.cloudsearch.cf sshd[9796]: Invalid user lamett from 182.61.105.127 port 41930
2020-01-02T04:59:31.608771abusebot-2.cloudsearch.cf sshd[
...

Jan  1 23:50:53 MK-Soft-VM5 sshd[9764]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.30.91.115 
Jan  1 23:50:55 MK-Soft-VM5 sshd[9764]: Failed password for invalid user ident from 31.30.91.115 port 42512 ssh2
...