Dec 12 08:28:16 vps647732 sshd[21350]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.239.37.139
Dec 12 08:28:19 vps647732 sshd[21350]: Failed password for invalid user precious from 173.239.37.139 port 33716 ssh2
...

Triggered by Fail2Ban at Vostok web server

Dec  9 11:16:10 hpm sshd\[18045\]: Invalid user ctz from 173.239.37.139
Dec  9 11:16:10 hpm sshd\[18045\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.239.37.139
Dec  9 11:16:12 hpm sshd\[18045\]: Failed password for invalid user ctz from 173.239.37.139 port 58760 ssh2
Dec  9 11:21:42 hpm sshd\[18830\]: Invalid user 12345 from 173.239.37.139
Dec  9 11:21:42 hpm sshd\[18830\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.239.37.139

Nov 10 05:52:36 mail sshd\[34777\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.239.37.139  user=root
...

2019-11-03T15:07:49.682669shield sshd\[24902\]: Invalid user oleta from 173.239.37.139 port 41352
2019-11-03T15:07:49.687056shield sshd\[24902\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.239.37.139
2019-11-03T15:07:51.610831shield sshd\[24902\]: Failed password for invalid user oleta from 173.239.37.139 port 41352 ssh2
2019-11-03T15:11:50.239291shield sshd\[26198\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.239.37.139  user=root
2019-11-03T15:11:52.248469shield sshd\[26198\]: Failed password for root from 173.239.37.139 port 51548 ssh2

Nov  3 08:46:10 server sshd\[28464\]: Invalid user nr from 173.239.37.139
Nov  3 08:46:10 server sshd\[28464\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.239.37.139 
Nov  3 08:46:12 server sshd\[28464\]: Failed password for invalid user nr from 173.239.37.139 port 32976 ssh2
Nov  3 08:54:10 server sshd\[30441\]: Invalid user tcloud from 173.239.37.139
Nov  3 08:54:10 server sshd\[30441\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.239.37.139 
...

Nov  2 04:23:17 apollo sshd\[16950\]: Failed password for root from 173.239.37.139 port 39766 ssh2Nov  2 04:38:25 apollo sshd\[17001\]: Failed password for root from 173.239.37.139 port 56866 ssh2Nov  2 04:41:50 apollo sshd\[17023\]: Failed password for root from 173.239.37.139 port 38438 ssh2
...

Oct 31 10:21:16 MK-Soft-VM6 sshd[23365]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.239.37.139 
Oct 31 10:21:18 MK-Soft-VM6 sshd[23365]: Failed password for invalid user user from 173.239.37.139 port 38822 ssh2
...

Invalid user adam from 173.239.37.139 port 40946

2019-10-02T13:06:14.603502tmaserv sshd\[15663\]: Invalid user pa from 173.239.37.139 port 36874
2019-10-02T13:06:14.608900tmaserv sshd\[15663\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.239.37.139
2019-10-02T13:06:16.516967tmaserv sshd\[15663\]: Failed password for invalid user pa from 173.239.37.139 port 36874 ssh2
2019-10-02T13:10:25.920858tmaserv sshd\[15805\]: Invalid user dino from 173.239.37.139 port 50532
2019-10-02T13:10:25.925377tmaserv sshd\[15805\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.239.37.139
2019-10-02T13:10:27.957979tmaserv sshd\[15805\]: Failed password for invalid user dino from 173.239.37.139 port 50532 ssh2
...

Sep 29 02:00:08 friendsofhawaii sshd\[975\]: Invalid user nmis from 173.239.37.139
Sep 29 02:00:08 friendsofhawaii sshd\[975\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.239.37.139
Sep 29 02:00:10 friendsofhawaii sshd\[975\]: Failed password for invalid user nmis from 173.239.37.139 port 35338 ssh2
Sep 29 02:04:24 friendsofhawaii sshd\[1340\]: Invalid user postmaster from 173.239.37.139
Sep 29 02:04:24 friendsofhawaii sshd\[1340\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.239.37.139

2019-09-22T04:19:16.232667abusebot-7.cloudsearch.cf sshd\[20621\]: Invalid user speed from 173.239.37.139 port 48816

$f2bV_matches

Sep  2 04:19:32 hcbbdb sshd\[24352\]: Invalid user telnetd from 173.239.37.139
Sep  2 04:19:32 hcbbdb sshd\[24352\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.239.37.139
Sep  2 04:19:34 hcbbdb sshd\[24352\]: Failed password for invalid user telnetd from 173.239.37.139 port 37550 ssh2
Sep  2 04:23:26 hcbbdb sshd\[24856\]: Invalid user mbc from 173.239.37.139
Sep  2 04:23:26 hcbbdb sshd\[24856\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.239.37.139

Aug 30 16:29:27 TORMINT sshd\[1869\]: Invalid user aldous from 173.239.37.139
Aug 30 16:29:27 TORMINT sshd\[1869\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.239.37.139
Aug 30 16:29:28 TORMINT sshd\[1869\]: Failed password for invalid user aldous from 173.239.37.139 port 45582 ssh2
...

Aug 28 06:27:59 nextcloud sshd\[17208\]: Invalid user avis from 173.239.37.139
Aug 28 06:27:59 nextcloud sshd\[17208\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.239.37.139
Aug 28 06:28:01 nextcloud sshd\[17208\]: Failed password for invalid user avis from 173.239.37.139 port 43204 ssh2
...

Aug 12 19:57:08 vibhu-HP-Z238-Microtower-Workstation sshd\[17150\]: Invalid user wp from 173.239.37.139
Aug 12 19:57:08 vibhu-HP-Z238-Microtower-Workstation sshd\[17150\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.239.37.139
Aug 12 19:57:10 vibhu-HP-Z238-Microtower-Workstation sshd\[17150\]: Failed password for invalid user wp from 173.239.37.139 port 41550 ssh2
Aug 12 20:01:12 vibhu-HP-Z238-Microtower-Workstation sshd\[17254\]: Invalid user sttest from 173.239.37.139
Aug 12 20:01:12 vibhu-HP-Z238-Microtower-Workstation sshd\[17254\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.239.37.139
...

Aug 10 15:24:54 debian sshd\[4086\]: Invalid user ts from 173.239.37.139 port 41362
Aug 10 15:24:54 debian sshd\[4086\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.239.37.139
...

Aug  5 01:22:33 dedicated sshd[31738]: Invalid user debbie from 173.239.37.139 port 42240

Fail2Ban Ban Triggered

Dec 13 10:09:21 hell sshd[4212]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.239.37.163
Dec 13 10:09:23 hell sshd[4212]: Failed password for invalid user mohamed from 173.239.37.163 port 54846 ssh2
...

<6 unauthorized SSH connections

Nov 15 07:56:02 vps01 sshd[32505]: Failed password for root from 173.239.37.163 port 37612 ssh2

Nov 15 05:59:13 vps01 sshd[22352]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.239.37.163
Nov 15 05:59:15 vps01 sshd[22352]: Failed password for invalid user dbus from 173.239.37.163 port 40028 ssh2

Repeated brute force against a port

Nov 10 15:09:48 server sshd\[19089\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.239.37.163  user=root
Nov 10 15:09:49 server sshd\[19089\]: Failed password for root from 173.239.37.163 port 48404 ssh2
Nov 10 15:27:51 server sshd\[23959\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.239.37.163  user=root
Nov 10 15:27:53 server sshd\[23959\]: Failed password for root from 173.239.37.163 port 49506 ssh2
Nov 10 15:31:16 server sshd\[25024\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.239.37.163  user=root
...

2019-11-02T20:37:57.827845ns547587 sshd\[2947\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.239.37.163  user=root
2019-11-02T20:37:59.366297ns547587 sshd\[2947\]: Failed password for root from 173.239.37.163 port 42254 ssh2
2019-11-02T20:41:10.905416ns547587 sshd\[9468\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.239.37.163  user=root
2019-11-02T20:41:12.940226ns547587 sshd\[9468\]: Failed password for root from 173.239.37.163 port 50848 ssh2
2019-11-02T20:44:33.175475ns547587 sshd\[16133\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.239.37.163  user=root
2019-11-02T20:44:34.743253ns547587 sshd\[16133\]: Failed password for root from 173.239.37.163 port 59448 ssh2
2019-11-02T20:47:52.001465ns547587 sshd\[22435\]: Invalid user neel from 173.239.37.163 port 39836
2019-11-02T20:47:52.007201ns547587 sshd\[22435\]: pam_unix\(sshd:auth\)
...

Nov  2 10:20:03 MK-Soft-VM3 sshd[24172]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.239.37.163 
Nov  2 10:20:05 MK-Soft-VM3 sshd[24172]: Failed password for invalid user mysql from 173.239.37.163 port 35962 ssh2
...

Oct 27 12:06:34 *** sshd[4289]: User root from 173.239.37.163 not allowed because not listed in AllowUsers

Oct 26 06:27:48 MK-Soft-VM5 sshd[25393]: Failed password for root from 173.239.37.163 port 38366 ssh2
...

Oct 14 18:29:34 hanapaa sshd\[9358\]: Invalid user student3 from 173.239.37.163
Oct 14 18:29:34 hanapaa sshd\[9358\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.239.37.163
Oct 14 18:29:36 hanapaa sshd\[9358\]: Failed password for invalid user student3 from 173.239.37.163 port 51250 ssh2
Oct 14 18:38:17 hanapaa sshd\[10076\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.239.37.163  user=root
Oct 14 18:38:19 hanapaa sshd\[10076\]: Failed password for root from 173.239.37.163 port 34482 ssh2

Automatic report - Banned IP Access

2019-10-14T04:46:43.115968shield sshd\[7419\]: Invalid user Jelszo1! from 173.239.37.152 port 44260
2019-10-14T04:46:43.123507shield sshd\[7419\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.239.37.152
2019-10-14T04:46:45.439031shield sshd\[7419\]: Failed password for invalid user Jelszo1! from 173.239.37.152 port 44260 ssh2
2019-10-14T04:50:11.283764shield sshd\[8755\]: Invalid user Amigo1@3 from 173.239.37.152 port 53368
2019-10-14T04:50:11.287812shield sshd\[8755\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.239.37.152

[ssh] SSH attack

Unauthorized connection attempt detected from IP address 69.197.161.210 to port 3389

Unauthorized connection attempt detected from IP address 106.12.140.168 to port 1744 [T]

Unauthorized connection attempt detected from IP address 122.96.140.194 to port 1433 [T]

Unauthorized connection attempt detected from IP address 119.97.77.225 to port 23 [T]

Unauthorized connection attempt detected from IP address 124.114.177.237 to port 1433 [T]

Unauthorized connection attempt detected from IP address 123.157.138.140 to port 1433 [T]

Unauthorized connection attempt detected from IP address 121.60.125.190 to port 1433 [T]

Unauthorized connection attempt detected from IP address 112.198.31.229 to port 8080 [T]

Unauthorized connection attempt detected from IP address 219.146.62.247 to port 1433

Apr 14 20:24:21 debian-2gb-nbg1-2 kernel: \[9147650.066337\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=220.248.200.132 DST=195.201.40.59 LEN=44 TOS=0x00 PREC=0x00 TTL=232 ID=15262 PROTO=TCP SPT=43912 DPT=1433 WINDOW=1024 RES=0x00 SYN URGP=0

Unauthorized connection attempt detected from IP address 120.43.129.12 to port 80 [T]

Unauthorized connection attempt detected from IP address 222.174.148.178 to port 445 [T]

Unauthorized connection attempt detected from IP address 164.52.24.178 to port 444 [T]

Unauthorized connection attempt detected from IP address 81.241.207.133 to port 23 [T]

Unauthorized connection attempt detected from IP address 129.204.106.181 to port 6380 [T]