Oct 14 00:04:51 cho sshd[605433]: Invalid user romero from 167.99.131.243 port 58420
Oct 14 00:04:51 cho sshd[605433]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.99.131.243 
Oct 14 00:04:51 cho sshd[605433]: Invalid user romero from 167.99.131.243 port 58420
Oct 14 00:04:53 cho sshd[605433]: Failed password for invalid user romero from 167.99.131.243 port 58420 ssh2
Oct 14 00:07:57 cho sshd[605555]: Invalid user mary from 167.99.131.243 port 33116
...

Sep 12 16:48:06 marvibiene sshd[16839]: Failed password for root from 167.99.131.243 port 38782 ssh2

" "

$f2bV_matches

Invalid user lighttpd from 167.99.131.243 port 36034

2020-08-22T08:58:32.169318centos sshd[20796]: Invalid user erp from 167.99.131.243 port 41708
2020-08-22T08:58:33.615032centos sshd[20796]: Failed password for invalid user erp from 167.99.131.243 port 41708 ssh2
2020-08-22T09:06:31.918909centos sshd[21279]: Invalid user irwan from 167.99.131.243 port 44214
...

Aug 12 06:06:00 srv-ubuntu-dev3 sshd[100421]: Invalid user 1q2w_123 from 167.99.131.243
Aug 12 06:06:00 srv-ubuntu-dev3 sshd[100421]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.99.131.243
Aug 12 06:06:00 srv-ubuntu-dev3 sshd[100421]: Invalid user 1q2w_123 from 167.99.131.243
Aug 12 06:06:02 srv-ubuntu-dev3 sshd[100421]: Failed password for invalid user 1q2w_123 from 167.99.131.243 port 47528 ssh2
Aug 12 06:09:41 srv-ubuntu-dev3 sshd[101019]: Invalid user qianyi861003!@# from 167.99.131.243
Aug 12 06:09:41 srv-ubuntu-dev3 sshd[101019]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.99.131.243
Aug 12 06:09:41 srv-ubuntu-dev3 sshd[101019]: Invalid user qianyi861003!@# from 167.99.131.243
Aug 12 06:09:43 srv-ubuntu-dev3 sshd[101019]: Failed password for invalid user qianyi861003!@# from 167.99.131.243 port 57106 ssh2
Aug 12 06:13:32 srv-ubuntu-dev3 sshd[101471]: Invalid user sa.2014 from 167.99.13
...

Brute-force attempt banned

Aug  7 23:40:00 piServer sshd[3803]: Failed password for root from 167.99.131.243 port 60690 ssh2
Aug  7 23:42:44 piServer sshd[4150]: Failed password for root from 167.99.131.243 port 52020 ssh2
...

Jul 20 02:13:21 server1 sshd\[21216\]: Failed password for invalid user six from 167.99.131.243 port 53126 ssh2
Jul 20 02:17:18 server1 sshd\[23652\]: Invalid user ctw from 167.99.131.243
Jul 20 02:17:18 server1 sshd\[23652\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.99.131.243 
Jul 20 02:17:20 server1 sshd\[23652\]: Failed password for invalid user ctw from 167.99.131.243 port 38632 ssh2
Jul 20 02:21:07 server1 sshd\[24727\]: Invalid user robert from 167.99.131.243
...

Invalid user packer from 167.99.131.243 port 44962

Jul 10 01:56:12 dignus sshd[2006]: Failed password for invalid user jace from 167.99.131.243 port 43990 ssh2
Jul 10 01:59:18 dignus sshd[2330]: Invalid user yongjiang from 167.99.131.243 port 41384
Jul 10 01:59:18 dignus sshd[2330]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.99.131.243
Jul 10 01:59:20 dignus sshd[2330]: Failed password for invalid user yongjiang from 167.99.131.243 port 41384 ssh2
Jul 10 02:02:19 dignus sshd[2690]: Invalid user roberts from 167.99.131.243 port 38772
...

(sshd) Failed SSH login from 167.99.131.243 (DE/Germany/-): 5 in the last 3600 secs

2020-06-27T05:48:16.843800ns2.routelink.net.id sshd[9044]: Failed password for invalid user ansible from 167.99.131.243 port 44972 ssh2
2020-06-27T05:50:58.671888ns2.routelink.net.id sshd[11201]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.99.131.243  user=root
2020-06-27T05:51:00.880801ns2.routelink.net.id sshd[11201]: Failed password for root from 167.99.131.243 port 45002 ssh2
...

srv02 SSH BruteForce Attacks 22 ..

Jun 22 09:17:33 buvik sshd[12386]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.99.131.243
Jun 22 09:17:35 buvik sshd[12386]: Failed password for invalid user cfr from 167.99.131.243 port 46252 ssh2
Jun 22 09:20:46 buvik sshd[12807]: Invalid user dcb from 167.99.131.243
...

Jun 20 07:21:21 piServer sshd[4974]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.99.131.243 
Jun 20 07:21:23 piServer sshd[4974]: Failed password for invalid user misha from 167.99.131.243 port 56858 ssh2
Jun 20 07:24:28 piServer sshd[5358]: Failed password for root from 167.99.131.243 port 56692 ssh2
...

...

Jun  5 01:58:08 lnxded63 sshd[16913]: Failed password for root from 167.99.131.243 port 49200 ssh2
Jun  5 01:58:08 lnxded63 sshd[16913]: Failed password for root from 167.99.131.243 port 49200 ssh2

(sshd) Failed SSH login from 167.99.131.243 (DE/Germany/-): 2 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Jun  1 05:48:40 ubnt-55d23 sshd[3763]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.99.131.243  user=root
Jun  1 05:48:42 ubnt-55d23 sshd[3763]: Failed password for root from 167.99.131.243 port 60480 ssh2

Invalid user user from 167.99.131.243 port 47420

May 28 14:33:32 ns381471 sshd[14216]: Failed password for root from 167.99.131.243 port 53116 ssh2

detected by Fail2Ban

2020-05-11T16:50:15.4631551240 sshd\[26914\]: Invalid user pastor from 167.99.131.243 port 51200
2020-05-11T16:50:15.4664051240 sshd\[26914\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.99.131.243
2020-05-11T16:50:16.9141921240 sshd\[26914\]: Failed password for invalid user pastor from 167.99.131.243 port 51200 ssh2
...

2020-05-08 00:02:50 server sshd[78625]: Failed password for invalid user developer from 167.99.131.243 port 40410 ssh2

$f2bV_matches

May  6 07:42:43 eventyay sshd[25548]: Failed password for postgres from 167.99.131.243 port 55654 ssh2
May  6 07:46:23 eventyay sshd[25778]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.99.131.243
May  6 07:46:24 eventyay sshd[25778]: Failed password for invalid user app from 167.99.131.243 port 36692 ssh2
...

Invalid user sinus1 from 167.99.131.243 port 47572

Apr 16 04:04:41 hcbbdb sshd\[22160\]: Invalid user postgres from 167.99.131.243
Apr 16 04:04:41 hcbbdb sshd\[22160\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.99.131.243
Apr 16 04:04:43 hcbbdb sshd\[22160\]: Failed password for invalid user postgres from 167.99.131.243 port 36376 ssh2
Apr 16 04:08:07 hcbbdb sshd\[22565\]: Invalid user il from 167.99.131.243
Apr 16 04:08:07 hcbbdb sshd\[22565\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.99.131.243

2020-04-10 UTC: (21x) - db2fenc1,grid,huidu,libuuid,mosquitto,nobodymuiefazan123456,nproc,parol,postgres(2x),redmine,root(2x),solr,sshvpn,teacher,test(2x),test4,ubuntu(2x)

SMTP/25/465/587-993/995 Probe, Reject, BadAuth, Hack, SPAM -

Message ID	<47N.20190213154431.8.3721.7a67b41e3808486797c2b446653183ce@www.yelMepbyBPmp.com>
Created at:	Fri, Dec 20, 2019 at 3:17 PM (Delivered after -2436 seconds)
From:	Body Secret👌 
To:	
Subject:	Hurry ! Claim your exclusive trial today!
SPF:	PASS with IP 3.125.32.185
ARC-Authentication-Results: i=1; mx.google.com;
       spf=pass (google.com: best guess record for domain of awdurcer@fpjh9---fpjh9----us-west-2.compute.amazonaws.com designates 3.125.32.185 as permitted sender) smtp.mailfrom=AWDuRcER@fpjh9---fpjh9----us-west-2.compute.amazonaws.com
Return-Path: 
Received: from epm.mythemeshop.com (ec2-3-125-32-185.eu-central-1.compute.amazonaws.com. [3.125.32.185])
        by mx.google.com with ESMTP id f9si9798523pgc.151.2019.12.20.12.36.52

SSH brutforce

Dec 21 21:20:48 gw1 sshd[6127]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.91.102.49
Dec 21 21:20:50 gw1 sshd[6127]: Failed password for invalid user qwang from 51.91.102.49 port 51240 ssh2
...

Dec 21 17:09:19 meumeu sshd[23108]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.161.52.241 
Dec 21 17:09:21 meumeu sshd[23108]: Failed password for invalid user merril from 46.161.52.241 port 9334 ssh2
Dec 21 17:14:50 meumeu sshd[23862]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.161.52.241 
...

firewall-block, port(s): 8443/tcp

Dec 21 17:21:11 serwer sshd\[9433\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.173.238  user=root
Dec 21 17:21:12 serwer sshd\[9434\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.173.238  user=root
Dec 21 17:21:13 serwer sshd\[9433\]: Failed password for root from 222.186.173.238 port 25136 ssh2
Dec 21 17:21:14 serwer sshd\[9434\]: Failed password for root from 222.186.173.238 port 21318 ssh2
...

$f2bV_matches

Dec 21 17:38:31 MK-Soft-VM6 sshd[18622]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.79.90.72 
Dec 21 17:38:33 MK-Soft-VM6 sshd[18622]: Failed password for invalid user mantis from 103.79.90.72 port 34929 ssh2
...

Dec 21 06:26:09 wbs sshd\[8541\]: Invalid user keyg from 148.72.210.28
Dec 21 06:26:09 wbs sshd\[8541\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ip-148-72-210-28.ip.secureserver.net
Dec 21 06:26:11 wbs sshd\[8541\]: Failed password for invalid user keyg from 148.72.210.28 port 36374 ssh2
Dec 21 06:32:49 wbs sshd\[9180\]: Invalid user Cde3Xsw2Zaq1 from 148.72.210.28
Dec 21 06:32:49 wbs sshd\[9180\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ip-148-72-210-28.ip.secureserver.net

Attempt to attack host OS, exploiting network vulnerabilities, on 21-12-2019 14:55:15.

Dec 21 10:06:12 linuxvps sshd\[29388\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.126.170  user=root
Dec 21 10:06:14 linuxvps sshd\[29388\]: Failed password for root from 104.248.126.170 port 33954 ssh2
Dec 21 10:11:44 linuxvps sshd\[32935\]: Invalid user gean from 104.248.126.170
Dec 21 10:11:44 linuxvps sshd\[32935\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.126.170
Dec 21 10:11:47 linuxvps sshd\[32935\]: Failed password for invalid user gean from 104.248.126.170 port 39012 ssh2

Attempt to attack host OS, exploiting network vulnerabilities, on 21-12-2019 14:55:14.

Dec 21 10:49:49 ny01 sshd[30516]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.49.9.210
Dec 21 10:49:51 ny01 sshd[30516]: Failed password for invalid user thimo from 178.49.9.210 port 48262 ssh2
Dec 21 10:56:43 ny01 sshd[31561]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.49.9.210

MultiHost/MultiPort Probe, Scan, Hack -

Dec 21 16:05:49 localhost sshd[31371]: Invalid user Admin from 103.99.10.50 port 64239
...