167.71.67.66 - - \[25/May/2020:06:16:50 +0200\] "POST /wp-login.php HTTP/1.0" 200 5932 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"
167.71.67.66 - - \[25/May/2020:06:16:51 +0200\] "POST /xmlrpc.php HTTP/1.0" 200 736 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"
167.71.67.66 - - \[25/May/2020:06:17:02 +0200\] "POST /wp-login.php HTTP/1.0" 200 16669 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"

167.71.67.66 - - [23/May/2020:14:00:56 +0200] "GET /wp-login.php HTTP/1.1" 200 5865 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
167.71.67.66 - - [23/May/2020:14:00:58 +0200] "POST /wp-login.php HTTP/1.1" 200 6116 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
167.71.67.66 - - [23/May/2020:14:00:58 +0200] "POST /xmlrpc.php HTTP/1.1" 200 427 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"

167.71.67.66 - - \[15/May/2020:17:00:01 +0200\] "POST /wp-login.php HTTP/1.0" 200 2797 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"
167.71.67.66 - - \[15/May/2020:17:00:02 +0200\] "POST /wp-login.php HTTP/1.0" 200 2796 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"
167.71.67.66 - - \[15/May/2020:17:00:04 +0200\] "POST /wp-login.php HTTP/1.0" 200 2771 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"

167.71.67.66 - - \[15/May/2020:05:55:54 +0200\] "POST /wp-login.php HTTP/1.0" 200 5508 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"
167.71.67.66 - - \[15/May/2020:05:55:56 +0200\] "POST /wp-login.php HTTP/1.0" 200 5506 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"
167.71.67.66 - - \[15/May/2020:05:55:57 +0200\] "POST /xmlrpc.php HTTP/1.0" 200 736 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"

2020-07-07T11:46:45+0200 Failed SSH Authentication/Brute Force Attack. (Server 9)

Brute-force attempt banned

2020-06-17T03:55:11.371222shield sshd\[29910\]: Invalid user a from 167.71.67.238 port 56012
2020-06-17T03:55:11.374952shield sshd\[29910\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.67.238
2020-06-17T03:55:13.032530shield sshd\[29910\]: Failed password for invalid user a from 167.71.67.238 port 56012 ssh2
2020-06-17T03:57:16.604112shield sshd\[30246\]: Invalid user yaroslav from 167.71.67.238 port 34638
2020-06-17T03:57:16.607809shield sshd\[30246\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.67.238

Jun 11 07:12:18 cp sshd[27365]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.67.238

Jun  5 13:18:47 ns382633 sshd\[24202\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.67.238  user=root
Jun  5 13:18:49 ns382633 sshd\[24202\]: Failed password for root from 167.71.67.238 port 58578 ssh2
Jun  5 13:29:25 ns382633 sshd\[26129\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.67.238  user=root
Jun  5 13:29:27 ns382633 sshd\[26129\]: Failed password for root from 167.71.67.238 port 59518 ssh2
Jun  5 13:32:42 ns382633 sshd\[26849\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.67.238  user=root

2020-05-31T20:46:11.748993shield sshd\[10742\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.67.238  user=root
2020-05-31T20:46:13.308378shield sshd\[10742\]: Failed password for root from 167.71.67.238 port 60032 ssh2
2020-05-31T20:49:36.853924shield sshd\[11447\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.67.238  user=root
2020-05-31T20:49:38.222621shield sshd\[11447\]: Failed password for root from 167.71.67.238 port 36874 ssh2
2020-05-31T20:52:56.395152shield sshd\[12247\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.67.238  user=root

Invalid user mattl from 167.71.67.238 port 59048

May 24 17:36:43 ourumov-web sshd\[28516\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.67.238  user=root
May 24 17:36:45 ourumov-web sshd\[28516\]: Failed password for root from 167.71.67.238 port 37012 ssh2
May 24 17:46:10 ourumov-web sshd\[29170\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.67.238  user=www-data
...

"Unauthorized connection attempt on SSHD detected"

2020-05-11T01:39:13.6219201495-001 sshd[7948]: Failed password for invalid user sinusbot from 167.71.67.238 port 41598 ssh2
2020-05-11T01:42:25.1468301495-001 sshd[8060]: Invalid user abel from 167.71.67.238 port 47172
2020-05-11T01:42:25.1537201495-001 sshd[8060]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.67.238
2020-05-11T01:42:25.1468301495-001 sshd[8060]: Invalid user abel from 167.71.67.238 port 47172
2020-05-11T01:42:27.4584481495-001 sshd[8060]: Failed password for invalid user abel from 167.71.67.238 port 47172 ssh2
2020-05-11T01:45:39.4567571495-001 sshd[8192]: Invalid user marry from 167.71.67.238 port 52612
...

Cowrie Honeypot: Unauthorised SSH/Telnet login attempt with user "ec2-user" at 2020-05-04T14:20:53Z

SSH Invalid Login

2020-05-03T17:06:36.673568vivaldi2.tree2.info sshd[20141]: Invalid user ctj from 167.71.67.230
2020-05-03T17:06:36.709515vivaldi2.tree2.info sshd[20141]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.67.230
2020-05-03T17:06:36.673568vivaldi2.tree2.info sshd[20141]: Invalid user ctj from 167.71.67.230
2020-05-03T17:06:38.591697vivaldi2.tree2.info sshd[20141]: Failed password for invalid user ctj from 167.71.67.230 port 16474 ssh2
2020-05-03T17:10:30.655846vivaldi2.tree2.info sshd[20352]: Invalid user wq from 167.71.67.230
...

May  2 16:23:43 r.ca sshd[29087]: Failed password for invalid user ts3srv from 167.71.67.238 port 60392 ssh2

Apr 28 23:50:40 mout sshd[1708]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.67.238  user=root
Apr 28 23:50:42 mout sshd[1708]: Failed password for root from 167.71.67.238 port 33430 ssh2

Invalid user bitnami from 106.12.4.158 port 50092

TCP ports : 1723 / 3128 / 3389

Listed on    zen-spamhaus also abuseat.org   / proto=6  .  srcport=42223  .  dstport=5555  .     (3843)

2020-10-02T20:39:10.942299server.espacesoutien.com sshd[19681]: Invalid user git from 106.75.231.227 port 49848
2020-10-02T20:39:10.958410server.espacesoutien.com sshd[19681]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.75.231.227
2020-10-02T20:39:10.942299server.espacesoutien.com sshd[19681]: Invalid user git from 106.75.231.227 port 49848
2020-10-02T20:39:12.740846server.espacesoutien.com sshd[19681]: Failed password for invalid user git from 106.75.231.227 port 49848 ssh2
...

21 attempts against mh-misbehave-ban on oak

Oct  1 20:33:40 XXX sshd[13822]: Did not receive identification string from 117.5.152.161
Oct  1 20:33:40 XXX sshd[13824]: Did not receive identification string from 117.5.152.161
Oct  1 20:33:40 XXX sshd[13823]: Did not receive identification string from 117.5.152.161
Oct  1 20:33:40 XXX sshd[13825]: Did not receive identification string from 117.5.152.161
Oct  1 20:33:40 XXX sshd[13826]: Did not receive identification string from 117.5.152.161
Oct  1 20:33:40 XXX sshd[13827]: Did not receive identification string from 117.5.152.161
Oct  1 20:33:44 XXX sshd[13845]: Address 117.5.152.161 maps to localhost, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!
Oct  1 20:33:44 XXX sshd[13845]: Invalid user nagesh from 117.5.152.161
Oct  1 20:33:44 XXX sshd[13844]: Address 117.5.152.161 maps to localhost, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!
Oct  1 20:33:44 XXX sshd[13844]: Invalid user nagesh from 117.5.152.161
Oct  1 20:........
-------------------------------

ssh intrusion attempt

Oct  1 23:37:37 vps647732 sshd[31032]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.79.122.105
Oct  1 23:37:39 vps647732 sshd[31032]: Failed password for invalid user admin2 from 212.79.122.105 port 51198 ssh2
...

firewall-block, port(s): 12834/tcp

Oct  2 21:00:48 ns392434 sshd[32681]: Invalid user teste1 from 139.59.83.179 port 57244
Oct  2 21:00:48 ns392434 sshd[32681]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.83.179
Oct  2 21:00:48 ns392434 sshd[32681]: Invalid user teste1 from 139.59.83.179 port 57244
Oct  2 21:00:51 ns392434 sshd[32681]: Failed password for invalid user teste1 from 139.59.83.179 port 57244 ssh2
Oct  2 21:03:02 ns392434 sshd[347]: Invalid user vnc from 139.59.83.179 port 52858
Oct  2 21:03:02 ns392434 sshd[347]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.83.179
Oct  2 21:03:02 ns392434 sshd[347]: Invalid user vnc from 139.59.83.179 port 52858
Oct  2 21:03:04 ns392434 sshd[347]: Failed password for invalid user vnc from 139.59.83.179 port 52858 ssh2
Oct  2 21:04:39 ns392434 sshd[356]: Invalid user jordan from 139.59.83.179 port 43620

Oct  2 22:27:11 pve1 sshd[17210]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.90.182.123 
Oct  2 22:27:13 pve1 sshd[17210]: Failed password for invalid user service from 128.90.182.123 port 63906 ssh2
...

Lines containing failures of 190.133.210.32 (max 1000)
Oct  1 22:39:29 srv sshd[80140]: Connection closed by 190.133.210.32 port 54713
Oct  1 22:39:33 srv sshd[80142]: Invalid user thostname0nich from 190.133.210.32 port 55051


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=190.133.210.32

Oct  2 20:50:25  sshd\[13409\]: User root from 106.53.220.103 not allowed because not listed in AllowUsersOct  2 20:50:27  sshd\[13409\]: Failed password for invalid user root from 106.53.220.103 port 34690 ssh2
...

2020-10-02T12:45:13.255913shield sshd\[1320\]: Invalid user admin from 150.136.12.28 port 41104
2020-10-02T12:45:13.264803shield sshd\[1320\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=150.136.12.28
2020-10-02T12:45:15.141006shield sshd\[1320\]: Failed password for invalid user admin from 150.136.12.28 port 41104 ssh2
2020-10-02T12:48:56.491533shield sshd\[2280\]: Invalid user kali from 150.136.12.28 port 48924
2020-10-02T12:48:56.500164shield sshd\[2280\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=150.136.12.28

Unauthorized SSH login attempts