Aug 24 10:09:09 vlre-nyc-1 sshd\[11006\]: Invalid user mysql from 168.194.162.128
Aug 24 10:09:09 vlre-nyc-1 sshd\[11006\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=168.194.162.128
Aug 24 10:09:11 vlre-nyc-1 sshd\[11006\]: Failed password for invalid user mysql from 168.194.162.128 port 19025 ssh2
Aug 24 10:13:00 vlre-nyc-1 sshd\[11242\]: Invalid user janus from 168.194.162.128
Aug 24 10:13:00 vlre-nyc-1 sshd\[11242\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=168.194.162.128
...

2020-08-20T07:16:55.127785shield sshd\[26048\]: Invalid user alcatel from 168.194.162.128 port 24568
2020-08-20T07:16:55.138871shield sshd\[26048\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=168.194.162.128
2020-08-20T07:16:56.905206shield sshd\[26048\]: Failed password for invalid user alcatel from 168.194.162.128 port 24568 ssh2
2020-08-20T07:18:40.340640shield sshd\[26275\]: Invalid user build from 168.194.162.128 port 31326
2020-08-20T07:18:40.348414shield sshd\[26275\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=168.194.162.128

Lines containing failures of 168.194.162.128
Aug 17 20:41:20 kmh-vmh-001-fsn07 sshd[16616]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=168.194.162.128  user=news
Aug 17 20:41:22 kmh-vmh-001-fsn07 sshd[16616]: Failed password for news from 168.194.162.128 port 37277 ssh2
Aug 17 20:41:24 kmh-vmh-001-fsn07 sshd[16616]: Received disconnect from 168.194.162.128 port 37277:11: Bye Bye [preauth]
Aug 17 20:41:24 kmh-vmh-001-fsn07 sshd[16616]: Disconnected from authenticating user news 168.194.162.128 port 37277 [preauth]
Aug 17 20:50:24 kmh-vmh-001-fsn07 sshd[18885]: Invalid user ly from 168.194.162.128 port 53502
Aug 17 20:50:24 kmh-vmh-001-fsn07 sshd[18885]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=168.194.162.128 
Aug 17 20:50:26 kmh-vmh-001-fsn07 sshd[18885]: Failed password for invalid user ly from 168.194.162.128 port 53502 ssh2


........
-----------------------------------------------
https://www.blocklist.de/en/view.h

Sep 29 16:18:21 * sshd[707]: Failed password for root from 168.194.162.156 port 55963 ssh2

Sep 29 09:43:11 pve1 sshd[21694]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=168.194.162.156 
Sep 29 09:43:13 pve1 sshd[21694]: Failed password for invalid user odoo from 168.194.162.156 port 14455 ssh2
...

Aug 29 16:15:32 journals sshd\[9322\]: Invalid user angel from 168.194.162.166
Aug 29 16:15:32 journals sshd\[9322\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=168.194.162.166
Aug 29 16:15:34 journals sshd\[9322\]: Failed password for invalid user angel from 168.194.162.166 port 7123 ssh2
Aug 29 16:19:55 journals sshd\[9767\]: Invalid user sidney from 168.194.162.166
Aug 29 16:19:55 journals sshd\[9767\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=168.194.162.166
...

Aug  7 14:45:42 myhostname sshd[32356]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=168.194.162.135  user=r.r
Aug  7 14:45:44 myhostname sshd[32356]: Failed password for r.r from 168.194.162.135 port 23305 ssh2
Aug  7 14:45:44 myhostname sshd[32356]: Received disconnect from 168.194.162.135 port 23305:11: Bye Bye [preauth]
Aug  7 14:45:44 myhostname sshd[32356]: Disconnected from 168.194.162.135 port 23305 [preauth]
Aug  7 14:48:27 myhostname sshd[1915]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=168.194.162.135  user=r.r


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=168.194.162.135

Jul 30 05:48:57 sso sshd[30060]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=168.194.162.141
Jul 30 05:48:59 sso sshd[30060]: Failed password for invalid user rtliu from 168.194.162.141 port 18747 ssh2
...

Jul  7 05:51:44 h1745522 sshd[12933]: Invalid user jlopez from 168.194.162.142 port 53403
Jul  7 05:51:44 h1745522 sshd[12933]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=168.194.162.142
Jul  7 05:51:44 h1745522 sshd[12933]: Invalid user jlopez from 168.194.162.142 port 53403
Jul  7 05:51:47 h1745522 sshd[12933]: Failed password for invalid user jlopez from 168.194.162.142 port 53403 ssh2
Jul  7 05:54:50 h1745522 sshd[13130]: Invalid user jiankong from 168.194.162.142 port 53493
Jul  7 05:54:50 h1745522 sshd[13130]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=168.194.162.142
Jul  7 05:54:50 h1745522 sshd[13130]: Invalid user jiankong from 168.194.162.142 port 53493
Jul  7 05:54:51 h1745522 sshd[13130]: Failed password for invalid user jiankong from 168.194.162.142 port 53493 ssh2
Jul  7 05:58:11 h1745522 sshd[13342]: Invalid user pma from 168.194.162.142 port 50556
...

20 attempts against mh-ssh on train

Jun 23 05:47:54 server sshd[56887]: Failed password for invalid user sar from 168.194.162.204 port 40763 ssh2
Jun 23 05:51:39 server sshd[59709]: Failed password for invalid user wow from 168.194.162.204 port 16926 ssh2
Jun 23 05:55:44 server sshd[62643]: Failed password for root from 168.194.162.204 port 55865 ssh2

Jun 14 07:34:48 vmi345603 sshd[9246]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=168.194.162.200
Jun 14 07:34:49 vmi345603 sshd[9246]: Failed password for invalid user ubuntu from 168.194.162.200 port 23932 ssh2
...

Jun 13 04:18:32 scw-6657dc sshd[16762]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=168.194.162.200
Jun 13 04:18:32 scw-6657dc sshd[16762]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=168.194.162.200
Jun 13 04:18:34 scw-6657dc sshd[16762]: Failed password for invalid user abhinav from 168.194.162.200 port 30702 ssh2
...

prod6
...

frenzy

May 27 05:27:05 server1 sshd\[11640\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=168.194.162.200  user=root
May 27 05:27:07 server1 sshd\[11640\]: Failed password for root from 168.194.162.200 port 60153 ssh2
May 27 05:34:36 server1 sshd\[13697\]: Invalid user test from 168.194.162.200
May 27 05:34:36 server1 sshd\[13697\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=168.194.162.200 
May 27 05:34:38 server1 sshd\[13697\]: Failed password for invalid user test from 168.194.162.200 port 40711 ssh2
...

May 19 21:45:59 plex sshd[8174]: Invalid user uxi from 168.194.162.200 port 18400
May 19 21:45:59 plex sshd[8174]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=168.194.162.200
May 19 21:45:59 plex sshd[8174]: Invalid user uxi from 168.194.162.200 port 18400
May 19 21:46:02 plex sshd[8174]: Failed password for invalid user uxi from 168.194.162.200 port 18400 ssh2
May 19 21:49:57 plex sshd[8296]: Invalid user tjl from 168.194.162.200 port 31786

SASL PLAIN auth failed: ruser=...

Mar  3 23:05:02 MainVPS sshd[19900]: Invalid user asterisk from 129.28.97.252 port 36366
Mar  3 23:05:02 MainVPS sshd[19900]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.28.97.252
Mar  3 23:05:02 MainVPS sshd[19900]: Invalid user asterisk from 129.28.97.252 port 36366
Mar  3 23:05:04 MainVPS sshd[19900]: Failed password for invalid user asterisk from 129.28.97.252 port 36366 ssh2
Mar  3 23:09:45 MainVPS sshd[29013]: Invalid user Felix from 129.28.97.252 port 57004
...

Mar  3 23:09:55 grey postfix/smtpd\[25215\]: NOQUEUE: reject: RCPT from unknown\[112.23.113.230\]: 554 5.7.1 Service unavailable\; Client host \[112.23.113.230\] blocked using bl.spamcop.net\; Blocked - see https://www.spamcop.net/bl.shtml\?112.23.113.230\; from=\ to=\ proto=ESMTP helo=\
...

Mar  3 23:09:51 mail sshd\[13710\]: Invalid user ashish from 223.111.144.148
Mar  3 23:09:51 mail sshd\[13710\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=223.111.144.148
Mar  3 23:09:53 mail sshd\[13710\]: Failed password for invalid user ashish from 223.111.144.148 port 56880 ssh2
...

Mar  3 23:56:25 ns381471 sshd[4287]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.175.208.73
Mar  3 23:56:27 ns381471 sshd[4287]: Failed password for invalid user cftest from 185.175.208.73 port 52284 ssh2

pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.30.187  user=root
Failed password for root from 222.186.30.187 port 64311 ssh2
Failed password for root from 222.186.30.187 port 64311 ssh2
Failed password for root from 222.186.30.187 port 64311 ssh2
pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.30.187  user=root

DATE:2020-03-03 23:09:28, IP:103.80.36.34, PORT:ssh SSH brute force auth (docker-dc)

Mar  3 23:50:35 localhost sshd\[23735\]: Invalid user app from 37.49.207.240 port 36710
Mar  3 23:50:35 localhost sshd\[23735\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.207.240
Mar  3 23:50:37 localhost sshd\[23735\]: Failed password for invalid user app from 37.49.207.240 port 36710 ssh2

Mar  3 12:04:35 php1 sshd\[15244\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.154.48.51  user=leadershipworks
Mar  3 12:04:37 php1 sshd\[15244\]: Failed password for leadershipworks from 190.154.48.51 port 41281 ssh2
Mar  3 12:09:25 php1 sshd\[15734\]: Invalid user user from 190.154.48.51
Mar  3 12:09:25 php1 sshd\[15734\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.154.48.51
Mar  3 12:09:26 php1 sshd\[15734\]: Failed password for invalid user user from 190.154.48.51 port 54281 ssh2

$f2bV_matches

Mar  3 18:17:28 NPSTNNYC01T sshd[26742]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.94.21.138
Mar  3 18:17:30 NPSTNNYC01T sshd[26742]: Failed password for invalid user xuyz from 34.94.21.138 port 37476 ssh2
Mar  3 18:23:37 NPSTNNYC01T sshd[27681]: Failed password for bin from 34.94.21.138 port 41692 ssh2
...

Mar  3 23:52:17 sd-53420 sshd\[14717\]: Invalid user admin from 198.211.110.116
Mar  3 23:52:17 sd-53420 sshd\[14717\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=198.211.110.116
Mar  3 23:52:18 sd-53420 sshd\[14717\]: Failed password for invalid user admin from 198.211.110.116 port 46968 ssh2
Mar  4 00:01:42 sd-53420 sshd\[15514\]: Invalid user alex from 198.211.110.116
Mar  4 00:01:42 sd-53420 sshd\[15514\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=198.211.110.116
...

Automatic report - Port Scan Attack

2020-03-04T00:13:42.326798vps773228.ovh.net sshd[8013]: Invalid user user from 157.65.168.230 port 35969
2020-03-04T00:13:42.336174vps773228.ovh.net sshd[8013]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.65.168.230
2020-03-04T00:13:42.326798vps773228.ovh.net sshd[8013]: Invalid user user from 157.65.168.230 port 35969
2020-03-04T00:13:44.500371vps773228.ovh.net sshd[8013]: Failed password for invalid user user from 157.65.168.230 port 35969 ssh2
2020-03-04T00:23:06.582020vps773228.ovh.net sshd[8216]: Invalid user influxdb from 157.65.168.230 port 55647
2020-03-04T00:23:06.591882vps773228.ovh.net sshd[8216]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.65.168.230
2020-03-04T00:23:06.582020vps773228.ovh.net sshd[8216]: Invalid user influxdb from 157.65.168.230 port 55647
2020-03-04T00:23:08.515366vps773228.ovh.net sshd[8216]: Failed password for invalid user influxdb from 157.65.168.230 port 5
...

Telnetd brute force attack detected by fail2ban