Jan  2 19:26:43 prox sshd[9898]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.161.242.220 
Jan  2 19:26:46 prox sshd[9898]: Failed password for invalid user glenn from 173.161.242.220 port 8684 ssh2

Dec 22 08:32:31 cvbnet sshd[6266]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.161.242.220 
Dec 22 08:32:32 cvbnet sshd[6266]: Failed password for invalid user desop from 173.161.242.220 port 7552 ssh2
...

Dec 18 02:38:19 plusreed sshd[25915]: Invalid user Passw0rd! from 173.161.242.220
...

Dec 12 13:56:37 web9 sshd\[21290\]: Invalid user test from 173.161.242.220
Dec 12 13:56:37 web9 sshd\[21290\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.161.242.220
Dec 12 13:56:39 web9 sshd\[21290\]: Failed password for invalid user test from 173.161.242.220 port 8496 ssh2
Dec 12 14:03:35 web9 sshd\[22414\]: Invalid user rpc from 173.161.242.220
Dec 12 14:03:35 web9 sshd\[22414\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.161.242.220

Nov 28 13:56:07 odroid64 sshd\[1297\]: Invalid user kellerman from 173.161.242.220
Nov 28 13:56:07 odroid64 sshd\[1297\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.161.242.220
...

Dec  9 10:49:25 thevastnessof sshd[7624]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.161.242.220
...

Dec  5 16:04:24 vtv3 sshd[8048]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.161.242.220 
Dec  5 16:04:26 vtv3 sshd[8048]: Failed password for invalid user yoyo from 173.161.242.220 port 7233 ssh2
Dec  5 16:13:23 vtv3 sshd[12369]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.161.242.220 
Dec  5 16:28:03 vtv3 sshd[19755]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.161.242.220 
Dec  5 16:28:05 vtv3 sshd[19755]: Failed password for invalid user brill from 173.161.242.220 port 7777 ssh2
Dec  5 16:35:30 vtv3 sshd[23719]: Failed password for root from 173.161.242.220 port 8031 ssh2
Dec  5 16:49:58 vtv3 sshd[30503]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.161.242.220 
Dec  5 16:50:00 vtv3 sshd[30503]: Failed password for invalid user db_shv from 173.161.242.220 port 8360 ssh2
Dec  5 16:57:18 vtv3 sshd[1906]: pam_unix(sshd:a

2019-12-03T10:15:44.844099shield sshd\[764\]: Invalid user thepasswordofmps060315 from 173.161.242.220 port 8784
2019-12-03T10:15:44.848765shield sshd\[764\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=173-161-242-220-philadelphia.hfc.comcastbusiness.net
2019-12-03T10:15:46.690981shield sshd\[764\]: Failed password for invalid user thepasswordofmps060315 from 173.161.242.220 port 8784 ssh2
2019-12-03T10:23:01.510499shield sshd\[1549\]: Invalid user 123qaz from 173.161.242.220 port 8932
2019-12-03T10:23:01.525685shield sshd\[1549\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=173-161-242-220-philadelphia.hfc.comcastbusiness.net

Nov  5 00:11:13 plusreed sshd[20504]: Invalid user 110579 from 173.161.242.220
...

Oct 30 16:58:56 TORMINT sshd\[17174\]: Invalid user lv@123 from 173.161.242.220
Oct 30 16:58:56 TORMINT sshd\[17174\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.161.242.220
Oct 30 16:58:58 TORMINT sshd\[17174\]: Failed password for invalid user lv@123 from 173.161.242.220 port 8959 ssh2
...

2019-10-08T16:53:08.312574abusebot-7.cloudsearch.cf sshd\[18397\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=173-161-242-217-philadelphia.hfc.comcastbusiness.net  user=root

Oct  6 15:49:28 mail sshd\[46678\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.161.242.217  user=root
...

2019-10-03 03:20:59,918 fail2ban.actions        \[946\]: NOTICE  \[sshd\] Ban 173.161.242.217
2019-10-03 03:51:55,432 fail2ban.actions        \[946\]: NOTICE  \[sshd\] Ban 173.161.242.217
2019-10-03 04:25:52,554 fail2ban.actions        \[946\]: NOTICE  \[sshd\] Ban 173.161.242.217
2019-10-03 04:59:59,148 fail2ban.actions        \[946\]: NOTICE  \[sshd\] Ban 173.161.242.217
2019-10-03 05:33:56,265 fail2ban.actions        \[946\]: NOTICE  \[sshd\] Ban 173.161.242.217
...

Oct  5 01:31:54 hanapaa sshd\[7265\]: Invalid user P4sswort@123 from 173.161.242.217
Oct  5 01:31:54 hanapaa sshd\[7265\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=173-161-242-217-philadelphia.hfc.comcastbusiness.net
Oct  5 01:31:56 hanapaa sshd\[7265\]: Failed password for invalid user P4sswort@123 from 173.161.242.217 port 5094 ssh2
Oct  5 01:41:54 hanapaa sshd\[8179\]: Invalid user Lille!23 from 173.161.242.217
Oct  5 01:41:54 hanapaa sshd\[8179\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=173-161-242-217-philadelphia.hfc.comcastbusiness.net

Sep 23 12:30:51 hpm sshd\[16495\]: Invalid user mdpi from 173.161.242.217
Sep 23 12:30:51 hpm sshd\[16495\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=173-161-242-217-philadelphia.hfc.comcastbusiness.net
Sep 23 12:30:54 hpm sshd\[16495\]: Failed password for invalid user mdpi from 173.161.242.217 port 8300 ssh2
Sep 23 12:35:52 hpm sshd\[16910\]: Invalid user ts from 173.161.242.217
Sep 23 12:35:52 hpm sshd\[16910\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=173-161-242-217-philadelphia.hfc.comcastbusiness.net

Sep 19 18:08:10 dev0-dcde-rnet sshd[4510]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.161.242.217
Sep 19 18:08:12 dev0-dcde-rnet sshd[4510]: Failed password for invalid user tomcat from 173.161.242.217 port 8643 ssh2
Sep 19 18:13:15 dev0-dcde-rnet sshd[4530]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.161.242.217

Aug 30 21:05:29 meumeu sshd[25611]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.161.242.217 
Aug 30 21:05:31 meumeu sshd[25611]: Failed password for invalid user ankur from 173.161.242.217 port 5977 ssh2
Aug 30 21:10:54 meumeu sshd[26313]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.161.242.217 
...

Aug 28 16:03:12 hanapaa sshd\[508\]: Invalid user qs from 173.161.242.217
Aug 28 16:03:12 hanapaa sshd\[508\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=173-161-242-217-philadelphia.hfc.comcastbusiness.net
Aug 28 16:03:15 hanapaa sshd\[508\]: Failed password for invalid user qs from 173.161.242.217 port 6847 ssh2
Aug 28 16:08:41 hanapaa sshd\[991\]: Invalid user lexus from 173.161.242.217
Aug 28 16:08:41 hanapaa sshd\[991\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=173-161-242-217-philadelphia.hfc.comcastbusiness.net

Aug 27 14:35:53 vps647732 sshd[22613]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.161.242.217
Aug 27 14:35:55 vps647732 sshd[22613]: Failed password for invalid user marie from 173.161.242.217 port 5679 ssh2
...

Aug 25 18:41:46 friendsofhawaii sshd\[15794\]: Invalid user sl from 173.161.242.217
Aug 25 18:41:46 friendsofhawaii sshd\[15794\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=173-161-242-217-philadelphia.hfc.comcastbusiness.net
Aug 25 18:41:48 friendsofhawaii sshd\[15794\]: Failed password for invalid user sl from 173.161.242.217 port 9082 ssh2
Aug 25 18:47:12 friendsofhawaii sshd\[16268\]: Invalid user videolan from 173.161.242.217
Aug 25 18:47:12 friendsofhawaii sshd\[16268\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=173-161-242-217-philadelphia.hfc.comcastbusiness.net

Aug 23 22:21:05 eddieflores sshd\[6812\]: Invalid user sebastian from 173.161.242.217
Aug 23 22:21:05 eddieflores sshd\[6812\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=173-161-242-217-philadelphia.hfc.comcastbusiness.net
Aug 23 22:21:07 eddieflores sshd\[6812\]: Failed password for invalid user sebastian from 173.161.242.217 port 5701 ssh2
Aug 23 22:26:33 eddieflores sshd\[7271\]: Invalid user ops from 173.161.242.217
Aug 23 22:26:33 eddieflores sshd\[7271\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=173-161-242-217-philadelphia.hfc.comcastbusiness.net

Aug 22 13:17:03 legacy sshd[26056]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.161.242.217
Aug 22 13:17:05 legacy sshd[26056]: Failed password for invalid user guest from 173.161.242.217 port 5446 ssh2
Aug 22 13:22:28 legacy sshd[26244]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.161.242.217
...

Aug 15 22:21:02 MK-Soft-Root1 sshd\[31285\]: Invalid user ruth from 173.161.242.217 port 5642
Aug 15 22:21:02 MK-Soft-Root1 sshd\[31285\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.161.242.217
Aug 15 22:21:05 MK-Soft-Root1 sshd\[31285\]: Failed password for invalid user ruth from 173.161.242.217 port 5642 ssh2
...

31.07.2019 09:18:18 SSH access blocked by firewall

SSH/22 MH Probe, BF, Hack -

As always with amazon web services

Automatic report - Banned IP Access

Oct  9 14:56:51 localhost sshd\[1268\]: Invalid user qwerty@123 from 49.235.173.155 port 43840
Oct  9 14:56:51 localhost sshd\[1268\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.235.173.155
Oct  9 14:56:54 localhost sshd\[1268\]: Failed password for invalid user qwerty@123 from 49.235.173.155 port 43840 ssh2

IP Ban Report : https://help-dysk.pl/wordpress-firewall-plugins/ip/106.43.40.66/ 
 CN - 1H : (510)  
 Protection Against DDoS WordPress plugin :  
 "odzyskiwanie danych help-dysk" 
 IP Address Ranges by Country : CN 
 NAME ASN : ASN4134 
 
 IP : 106.43.40.66 
 
 CIDR : 106.43.0.0/16 
 
 PREFIX COUNT : 5430 
 
 UNIQUE IP COUNT : 106919680 
 
 
 WYKRYTE ATAKI Z ASN4134 :  
  1H - 13 
  3H - 30 
  6H - 63 
 12H - 113 
 24H - 216 
 
 DateTime : 2019-10-09 13:39:36 
 
 INFO : Port Scan TELNET Detected and Blocked by ADMIN  - data recovery

Oct  9 14:14:42 microserver sshd[21307]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.183.90  user=root
Oct  9 14:14:44 microserver sshd[21307]: Failed password for root from 178.128.183.90 port 40890 ssh2
Oct  9 14:18:57 microserver sshd[21925]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.183.90  user=root
Oct  9 14:18:59 microserver sshd[21925]: Failed password for root from 178.128.183.90 port 52656 ssh2
Oct  9 14:23:16 microserver sshd[22579]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.183.90  user=root
Oct  9 14:35:53 microserver sshd[24443]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.183.90  user=root
Oct  9 14:35:55 microserver sshd[24443]: Failed password for root from 178.128.183.90 port 43264 ssh2
Oct  9 14:40:09 microserver sshd[24890]: pam_unix(sshd:auth): authentication failure; logname= uid

Oct  9 15:18:18 MK-Soft-VM4 sshd[778]: Failed password for root from 222.186.42.15 port 15442 ssh2
Oct  9 15:18:20 MK-Soft-VM4 sshd[778]: Failed password for root from 222.186.42.15 port 15442 ssh2
...

SSH Bruteforce

10/09/2019-08:34:27.687031 45.136.109.82 Protocol: 6 ET SCAN NMAP -sS window 1024

Oct  9 20:22:05 webhost01 sshd[14616]: Failed password for root from 110.80.17.26 port 36262 ssh2
...

Oct  9 18:37:14 areeb-Workstation sshd[29264]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.24.82.164
Oct  9 18:37:17 areeb-Workstation sshd[29264]: Failed password for invalid user cent0s2016 from 118.24.82.164 port 34542 ssh2
...

firewall-block, port(s): 9021/tcp

(ftpd) Failed FTP login from 122.121.131.186 (TW/Taiwan/122-121-131-186.dynamic-ip.hinet.net): 10 in the last 3600 secs

v+ssh-bruteforce

1588/tcp 81/tcp
[2019-10-09]2pkt

Oct  9 **REMOVED** dovecot: imap-login: Disconnected \(auth failed, 1 attempts in 5 secs\): user=\, method=PLAIN, rip=183.219.101.110, lip=**REMOVED**, TLS: Disconnected, session=\
Oct  9 **REMOVED** dovecot: imap-login: Disconnected \(auth failed, 1 attempts in 6 secs\): user=\, method=PLAIN, rip=183.219.101.110, lip=**REMOVED**, TLS, session=\<3xn5HXaUfLS322Vu\>
Oct  9 **REMOVED** dovecot: imap-login: Disconnected \(auth failed, 1 attempts in 6 secs\): user=\, method=PLAIN, rip=183.219.101.110, lip=**REMOVED**, TLS: Disconnected, session=\<+y3evniUPua322Vu\>