Aug 27 14:09:58 game-panel sshd[6558]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.172.121.6
Aug 27 14:10:00 game-panel sshd[6558]: Failed password for invalid user nbi from 167.172.121.6 port 42320 ssh2
Aug 27 14:13:38 game-panel sshd[6815]: Failed password for root from 167.172.121.6 port 45756 ssh2

Aug 23 22:35:23 vpn01 sshd[10735]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.172.121.6
Aug 23 22:35:26 vpn01 sshd[10735]: Failed password for invalid user y from 167.172.121.6 port 55086 ssh2
...

Multiple SSH authentication failures from 167.172.121.6

Aug 13 22:42:44 vps647732 sshd[10032]: Failed password for root from 167.172.121.6 port 42864 ssh2
...

Fail2Ban - SSH Bruteforce Attempt

Aug  9 15:16:55 pve1 sshd[4609]: Failed password for root from 167.172.121.6 port 41072 ssh2
...

Aug  8 06:55:54 ns381471 sshd[28185]: Failed password for root from 167.172.121.6 port 46610 ssh2

Jul 11 14:22:30 meumeu sshd[387248]: Invalid user oafe from 167.172.121.115 port 51556
Jul 11 14:22:30 meumeu sshd[387248]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.172.121.115 
Jul 11 14:22:30 meumeu sshd[387248]: Invalid user oafe from 167.172.121.115 port 51556
Jul 11 14:22:32 meumeu sshd[387248]: Failed password for invalid user oafe from 167.172.121.115 port 51556 ssh2
Jul 11 14:23:25 meumeu sshd[387267]: Invalid user lch from 167.172.121.115 port 37940
Jul 11 14:23:25 meumeu sshd[387267]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.172.121.115 
Jul 11 14:23:25 meumeu sshd[387267]: Invalid user lch from 167.172.121.115 port 37940
Jul 11 14:23:27 meumeu sshd[387267]: Failed password for invalid user lch from 167.172.121.115 port 37940 ssh2
Jul 11 14:24:26 meumeu sshd[387320]: Invalid user wangzhiyong from 167.172.121.115 port 52558
...

"Unauthorized connection attempt on SSHD detected"

$f2bV_matches

Jun 30 01:30:06 ny01 sshd[6236]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.172.121.115
Jun 30 01:30:08 ny01 sshd[6236]: Failed password for invalid user lukas from 167.172.121.115 port 58344 ssh2
Jun 30 01:33:19 ny01 sshd[6611]: Failed password for root from 167.172.121.115 port 57758 ssh2

Jun 29 06:58:53 h1745522 sshd[18410]: Invalid user maestro from 167.172.121.115 port 45512
Jun 29 06:58:53 h1745522 sshd[18410]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.172.121.115
Jun 29 06:58:53 h1745522 sshd[18410]: Invalid user maestro from 167.172.121.115 port 45512
Jun 29 06:58:56 h1745522 sshd[18410]: Failed password for invalid user maestro from 167.172.121.115 port 45512 ssh2
Jun 29 07:02:09 h1745522 sshd[19741]: Invalid user reghan from 167.172.121.115 port 43852
Jun 29 07:02:09 h1745522 sshd[19741]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.172.121.115
Jun 29 07:02:09 h1745522 sshd[19741]: Invalid user reghan from 167.172.121.115 port 43852
Jun 29 07:02:12 h1745522 sshd[19741]: Failed password for invalid user reghan from 167.172.121.115 port 43852 ssh2
Jun 29 07:05:38 h1745522 sshd[19857]: Invalid user ftp from 167.172.121.115 port 42192
...

(mod_security) mod_security (id:210492) triggered by 167.172.121.252 (US/United States/-): 5 in the last 3600 secs

Jun 24 22:17:36 server1 sshd\[12802\]: Invalid user ggarcia from 167.172.121.115
Jun 24 22:17:36 server1 sshd\[12802\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.172.121.115 
Jun 24 22:17:38 server1 sshd\[12802\]: Failed password for invalid user ggarcia from 167.172.121.115 port 56960 ssh2
Jun 24 22:19:19 server1 sshd\[13968\]: Invalid user ucp from 167.172.121.115
Jun 24 22:19:19 server1 sshd\[13968\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.172.121.115 
Jun 24 22:19:22 server1 sshd\[13968\]: Failed password for invalid user ucp from 167.172.121.115 port 58494 ssh2
Jun 24 22:21:06 server1 sshd\[15172\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.172.121.115  user=root
Jun 24 22:21:08 server1 sshd\[15172\]: Failed password for root from 167.172.121.115 port 60030 ssh2
...

Jun 24 01:15:10 vps sshd[10472]: Failed password for root from 167.172.121.115 port 43034 ssh2
Jun 24 01:30:15 vps sshd[11356]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.172.121.115 
Jun 24 01:30:17 vps sshd[11356]: Failed password for invalid user rb from 167.172.121.115 port 52298 ssh2
...

Jun  5 20:14:33 hanapaa sshd\[17978\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.172.121.115  user=root
Jun  5 20:14:35 hanapaa sshd\[17978\]: Failed password for root from 167.172.121.115 port 55762 ssh2
Jun  5 20:16:41 hanapaa sshd\[18132\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.172.121.115  user=root
Jun  5 20:16:44 hanapaa sshd\[18132\]: Failed password for root from 167.172.121.115 port 35378 ssh2
Jun  5 20:18:54 hanapaa sshd\[18304\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.172.121.115  user=root

Jun  5 06:57:39 server sshd[34218]: Failed password for root from 167.172.121.115 port 33036 ssh2
Jun  5 07:01:16 server sshd[37481]: Failed password for root from 167.172.121.115 port 37438 ssh2
Jun  5 07:04:58 server sshd[40495]: Failed password for root from 167.172.121.115 port 41838 ssh2

(sshd) Failed SSH login from 167.172.121.115 (US/United States/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Jun  5 00:01:18 s1 sshd[15101]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.172.121.115  user=root
Jun  5 00:01:20 s1 sshd[15101]: Failed password for root from 167.172.121.115 port 44176 ssh2
Jun  5 00:04:41 s1 sshd[15253]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.172.121.115  user=root
Jun  5 00:04:43 s1 sshd[15253]: Failed password for root from 167.172.121.115 port 48116 ssh2
Jun  5 00:08:05 s1 sshd[15618]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.172.121.115  user=root

May 31 10:03:18 vmi345603 sshd[8828]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.172.121.115
May 31 10:03:20 vmi345603 sshd[8828]: Failed password for invalid user aogola from 167.172.121.115 port 52372 ssh2
...

Dec  7 20:48:27 mercury smtpd[1197]: 239b46fd3edcb5ce smtp event=failed-command address=167.172.121.251 host=167.172.121.251 command="RCPT to:" result="550 Invalid recipient"
...

Aug  8 17:11:23 SilenceServices sshd[23808]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.68.143.26
Aug  8 17:11:25 SilenceServices sshd[23808]: Failed password for invalid user admin from 51.68.143.26 port 46078 ssh2
Aug  8 17:15:35 SilenceServices sshd[26910]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.68.143.26

Aug  8 14:02:22 pornomens sshd\[4133\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.165.224.22  user=zabbix
Aug  8 14:02:23 pornomens sshd\[4133\]: Failed password for zabbix from 202.165.224.22 port 56334 ssh2
Aug  8 14:07:57 pornomens sshd\[4140\]: Invalid user user1 from 202.165.224.22 port 49542
Aug  8 14:07:57 pornomens sshd\[4140\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.165.224.22
...

Automatic report - Banned IP Access

Aug  8 14:36:52 thevastnessof sshd[15476]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.57.194
...

Aug  8 08:45:15 josie sshd[30349]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=39.82.165.124  user=r.r
Aug  8 08:45:17 josie sshd[30349]: Failed password for r.r from 39.82.165.124 port 58717 ssh2
Aug  8 08:45:20 josie sshd[30349]: Failed password for r.r from 39.82.165.124 port 58717 ssh2
Aug  8 08:45:22 josie sshd[30349]: Failed password for r.r from 39.82.165.124 port 58717 ssh2
Aug  8 08:45:25 josie sshd[30349]: Failed password for r.r from 39.82.165.124 port 58717 ssh2
Aug  8 08:45:27 josie sshd[30349]: Failed password for r.r from 39.82.165.124 port 58717 ssh2
Aug  8 08:45:29 josie sshd[30349]: Failed password for r.r from 39.82.165.124 port 58717 ssh2
Aug  8 08:45:29 josie sshd[30349]: PAM 5 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=39.82.165.124  user=r.r


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=39.82.165.124

MYH,DEF GET /wp-admin/setup-config.php?step=1

Aug  8 16:21:23 root sshd[16155]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=13.76.162.90 
Aug  8 16:21:25 root sshd[16155]: Failed password for invalid user girl from 13.76.162.90 port 59412 ssh2
Aug  8 16:26:46 root sshd[16187]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=13.76.162.90 
...

Aug  8 12:10:11 XXX sshd[19078]: Invalid user maxwell from 106.13.47.10 port 42400

404 NOT FOUND

Aug  8 13:06:00 ms-srv sshd[4385]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.178.106.124
Aug  8 13:06:02 ms-srv sshd[4385]: Failed password for invalid user jodi from 180.178.106.124 port 45086 ssh2

Aug  8 16:21:17 server sshd\[23590\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.79.131.234  user=games
Aug  8 16:21:19 server sshd\[23590\]: Failed password for games from 121.79.131.234 port 44106 ssh2
Aug  8 16:31:06 server sshd\[18487\]: User root from 121.79.131.234 not allowed because listed in DenyUsers
Aug  8 16:31:06 server sshd\[18487\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.79.131.234  user=root
Aug  8 16:31:08 server sshd\[18487\]: Failed password for invalid user root from 121.79.131.234 port 60998 ssh2

114.215.159.136 - - [08/Aug/2019:13:58:08 +0200] "GET /index.php?s=/index/ hink" 400 0 "-" "-"

Aug  8 16:09:49 yabzik sshd[22442]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.200.22
Aug  8 16:09:52 yabzik sshd[22442]: Failed password for invalid user almacen from 206.189.200.22 port 46724 ssh2
Aug  8 16:14:11 yabzik sshd[23869]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.200.22

Aug  8 14:20:01 ArkNodeAT sshd\[10781\]: Invalid user flopy from 185.122.56.211
Aug  8 14:20:01 ArkNodeAT sshd\[10781\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.122.56.211
Aug  8 14:20:03 ArkNodeAT sshd\[10781\]: Failed password for invalid user flopy from 185.122.56.211 port 44734 ssh2

DATE:2019-08-08 15:35:52, IP:185.219.221.205, PORT:telnet Telnet brute force auth on honeypot server (honey-neo-dc)