Aug 19 19:24:57 MK-Soft-VM6 sshd\[16113\]: Invalid user ftpuser from 178.128.3.152 port 40632
Aug 19 19:24:57 MK-Soft-VM6 sshd\[16113\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.3.152
Aug 19 19:24:59 MK-Soft-VM6 sshd\[16113\]: Failed password for invalid user ftpuser from 178.128.3.152 port 40632 ssh2
...

Jul 25 18:17:20 *** sshd[5220]: Failed password for invalid user administrator from 178.128.3.152 port 49006 ssh2
Jul 27 21:25:47 *** sshd[11711]: Failed password for invalid user support from 178.128.3.152 port 37840 ssh2

Invalid user hadoop from 178.128.3.152 port 53852

Jul 25 20:41:42 *** sshd[28683]: User root from 178.128.3.152 not allowed because not listed in AllowUsers

IP attempted unauthorised action

Invalid user user from 178.128.3.152 port 50034

Jul 21 02:32:09 *** sshd[737]: Invalid user nagios from 178.128.3.152

Invalid user vscan from 178.128.3.152 port 47928

Jul 19 10:33:26 nextcloud sshd\[6026\]: Invalid user usuario from 178.128.3.152
Jul 19 10:33:26 nextcloud sshd\[6026\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.3.152
Jul 19 10:33:29 nextcloud sshd\[6026\]: Failed password for invalid user usuario from 178.128.3.152 port 37942 ssh2
...

Invalid user bmm from 178.128.3.152 port 43580

Jul 16 15:20:09 MK-Soft-VM4 sshd\[24950\]: Invalid user test02 from 178.128.3.152 port 37698
Jul 16 15:20:09 MK-Soft-VM4 sshd\[24950\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.3.152
Jul 16 15:20:11 MK-Soft-VM4 sshd\[24950\]: Failed password for invalid user test02 from 178.128.3.152 port 37698 ssh2
...

2019-07-13T11:09:09.724287abusebot.cloudsearch.cf sshd\[22254\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.3.152  user=root

Jul 13 01:02:48 marvibiene sshd[10225]: Invalid user noemi from 178.128.3.152 port 59686
Jul 13 01:02:48 marvibiene sshd[10225]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.3.152
Jul 13 01:02:48 marvibiene sshd[10225]: Invalid user noemi from 178.128.3.152 port 59686
Jul 13 01:02:49 marvibiene sshd[10225]: Failed password for invalid user noemi from 178.128.3.152 port 59686 ssh2
...

Jul 12 03:17:00 marvibiene sshd[58752]: Invalid user tamara from 178.128.3.152 port 43776
Jul 12 03:17:00 marvibiene sshd[58752]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.3.152
Jul 12 03:17:00 marvibiene sshd[58752]: Invalid user tamara from 178.128.3.152 port 43776
Jul 12 03:17:03 marvibiene sshd[58752]: Failed password for invalid user tamara from 178.128.3.152 port 43776 ssh2
...

Jul 11 05:23:59 MK-Soft-VM5 sshd\[14229\]: Invalid user user from 178.128.3.152 port 47516
Jul 11 05:23:59 MK-Soft-VM5 sshd\[14229\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.3.152
Jul 11 05:24:00 MK-Soft-VM5 sshd\[14229\]: Failed password for invalid user user from 178.128.3.152 port 47516 ssh2
...

SSH bruteforce (Triggered fail2ban)

Triggered by Fail2Ban at Vostok web server

Jul  9 04:22:47 thevastnessof sshd[31016]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.3.152
...

Jul  8 18:22:40 MK-Soft-VM6 sshd\[10810\]: Invalid user sk8ter from 178.128.3.152 port 44328
Jul  8 18:22:40 MK-Soft-VM6 sshd\[10810\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.3.152
Jul  8 18:22:42 MK-Soft-VM6 sshd\[10810\]: Failed password for invalid user sk8ter from 178.128.3.152 port 44328 ssh2
...

Secure Email Login Failed for list, (, ) and has logged from 178.128.3.152 IP address.

Jul  6 11:46:57 MK-Soft-VM3 sshd\[21585\]: Invalid user index from 178.128.3.152 port 35314
Jul  6 11:46:57 MK-Soft-VM3 sshd\[21585\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.3.152
Jul  6 11:46:59 MK-Soft-VM3 sshd\[21585\]: Failed password for invalid user index from 178.128.3.152 port 35314 ssh2
...

IP attempted unauthorised action

" "

Jul  2 10:24:49 pornomens sshd\[26556\]: Invalid user sharon from 178.128.3.152 port 42548
Jul  2 10:24:49 pornomens sshd\[26556\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.3.152
Jul  2 10:24:50 pornomens sshd\[26556\]: Failed password for invalid user sharon from 178.128.3.152 port 42548 ssh2
...

Jul  1 23:07:24 XXX sshd[13259]: Invalid user cheryl from 178.128.3.152 port 57960

Automatic report - Banned IP Access

178.128.36.26 is unauthorized and has been banned by fail2ban

178.128.36.26 - - [10/Oct/2020:22:28:07 +0100] "POST /wp-login.php HTTP/1.1" 200 2341 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
178.128.36.26 - - [10/Oct/2020:22:28:13 +0100] "POST /wp-login.php HTTP/1.1" 200 2282 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
178.128.36.26 - - [10/Oct/2020:22:28:13 +0100] "POST /xmlrpc.php HTTP/1.1" 403 219 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
...

178.128.36.26 - - [24/Sep/2020:19:42:29 +0100] "POST /wp-login.php HTTP/1.1" 200 2217 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
178.128.36.26 - - [24/Sep/2020:19:42:35 +0100] "POST /wp-login.php HTTP/1.1" 200 2183 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
178.128.36.26 - - [24/Sep/2020:19:42:35 +0100] "POST /xmlrpc.php HTTP/1.1" 403 219 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
...

178.128.36.26 - - \[24/Sep/2020:10:01:41 +0200\] "POST /wp-login.php HTTP/1.0" 200 4128 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"
178.128.36.26 - - \[24/Sep/2020:10:01:46 +0200\] "POST /wp-login.php HTTP/1.0" 200 3955 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"
178.128.36.26 - - \[24/Sep/2020:10:01:47 +0200\] "POST /xmlrpc.php HTTP/1.0" 200 736 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"

[Wed Sep 16 20:12:13.444379 2020] [php7:error] [pid 82746] [client 178.128.36.26:55123] script /Library/Server/Web/Data/Sites/customvisuals.com/wp-login.php not found or unable to stat, referer: http://mail.rhondaschienle.com/wp-login.php

[Wed Sep 16 20:12:13.444379 2020] [php7:error] [pid 82746] [client 178.128.36.26:55123] script /Library/Server/Web/Data/Sites/customvisuals.com/wp-login.php not found or unable to stat, referer: http://mail.rhondaschienle.com/wp-login.php

178.128.36.26 - - [16/Sep/2020:17:59:32 +0100] "POST /wp-login.php HTTP/1.1" 200 2261 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
178.128.36.26 - - [16/Sep/2020:17:59:32 +0100] "POST /wp-login.php HTTP/1.1" 200 2234 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
178.128.36.26 - - [16/Sep/2020:17:59:38 +0100] "POST /wp-login.php HTTP/1.1" 200 2190 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
...

Lines containing failures of 178.128.37.146
Aug  8 08:19:55 newdogma sshd[27733]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.37.146  user=r.r
Aug  8 08:19:56 newdogma sshd[27733]: Failed password for r.r from 178.128.37.146 port 46954 ssh2
Aug  8 08:19:57 newdogma sshd[27733]: Received disconnect from 178.128.37.146 port 46954:11: Bye Bye [preauth]
Aug  8 08:19:57 newdogma sshd[27733]: Disconnected from authenticating user r.r 178.128.37.146 port 46954 [preauth]
Aug  8 08:35:06 newdogma sshd[28427]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.37.146  user=r.r
Aug  8 08:35:08 newdogma sshd[28427]: Failed password for r.r from 178.128.37.146 port 46700 ssh2
Aug  8 08:35:09 newdogma sshd[28427]: Received disconnect from 178.128.37.146 port 46700:11: Bye Bye [preauth]
Aug  8 08:35:09 newdogma sshd[28427]: Disconnected from authenticating user r.r 178.128.37.146 port 46700........
------------------------------

fail2ban

SSH Invalid Login

Invalid user xiaomai from 178.128.34.14 port 53893

(sshd) Failed SSH login from 178.128.34.14 (GB/United Kingdom/207869.cloudwaysapps.com): 2 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Mar 21 17:32:32 ubnt-55d23 sshd[25958]: Invalid user webmaster from 178.128.34.14 port 49567
Mar 21 17:32:34 ubnt-55d23 sshd[25958]: Failed password for invalid user webmaster from 178.128.34.14 port 49567 ssh2

SSH login attempts.

Invalid user user from 178.128.34.14 port 39290

leo_www

May 31 19:26:18 debian-2gb-nbg1-2 kernel: \[13204754.087413\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=87.251.74.140 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=245 ID=59368 PROTO=TCP SPT=44773 DPT=7238 WINDOW=1024 RES=0x00 SYN URGP=0

[2020-05-31 13:17:32] NOTICE[1157] chan_sip.c: Registration from '' failed for '185.147.215.14:49624' - Wrong password
[2020-05-31 13:17:32] SECURITY[1173] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-05-31T13:17:32.027-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="2943",SessionID="0x7f5f1039ca78",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/185.147.215.14/49624",Challenge="0748ca65",ReceivedChallenge="0748ca65",ReceivedHash="a379fd4a5686d86b1911fbb56e4364de"
[2020-05-31 13:18:03] NOTICE[1157] chan_sip.c: Registration from '' failed for '185.147.215.14:59361' - Wrong password
[2020-05-31 13:18:03] SECURITY[1173] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-05-31T13:18:03.143-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="2944",SessionID="0x7f5f10787a08",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/185.147.21
...

May 31 18:55:58 OPSO sshd\[6416\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.250.55.195  user=root
May 31 18:56:00 OPSO sshd\[6416\]: Failed password for root from 180.250.55.195 port 44452 ssh2
May 31 19:00:38 OPSO sshd\[7341\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.250.55.195  user=root
May 31 19:00:40 OPSO sshd\[7341\]: Failed password for root from 180.250.55.195 port 48304 ssh2
May 31 19:05:20 OPSO sshd\[8764\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.250.55.195  user=root

2020-05-31T15:52:08.155913ionos.janbro.de sshd[17975]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=184.70.244.67  user=root
2020-05-31T15:52:10.313937ionos.janbro.de sshd[17975]: Failed password for root from 184.70.244.67 port 42820 ssh2
2020-05-31T15:56:07.952933ionos.janbro.de sshd[18008]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=184.70.244.67  user=root
2020-05-31T15:56:09.581066ionos.janbro.de sshd[18008]: Failed password for root from 184.70.244.67 port 48634 ssh2
2020-05-31T16:00:03.032414ionos.janbro.de sshd[18019]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=184.70.244.67  user=root
2020-05-31T16:00:05.060583ionos.janbro.de sshd[18019]: Failed password for root from 184.70.244.67 port 54448 ssh2
2020-05-31T16:04:01.882883ionos.janbro.de sshd[18050]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=184.70.2
...

May 31 14:09:47 debian-2gb-nbg1-2 kernel: \[13185764.059271\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=180.76.37.36 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=238 ID=47916 PROTO=TCP SPT=43082 DPT=12844 WINDOW=1024 RES=0x00 SYN URGP=0

2020-05-31T14:08:19.474990+02:00  sshd[25433]: Failed password for root from 213.244.123.182 port 44407 ssh2

Automatic report - Port Scan Attack

$f2bV_matches

Unauthorized connection attempt detected from IP address 61.133.118.6 to port 3389

May 31 16:41:28 XXXXXX sshd[18559]: Invalid user wangyu from 176.37.60.16 port 58092

2020-05-31T16:49:11.183822server.espacesoutien.com sshd[16855]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.10.125.209  user=root
2020-05-31T16:49:13.252205server.espacesoutien.com sshd[16855]: Failed password for root from 186.10.125.209 port 5006 ssh2
2020-05-31T16:49:55.091120server.espacesoutien.com sshd[16875]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.10.125.209  user=root
2020-05-31T16:49:57.535446server.espacesoutien.com sshd[16875]: Failed password for root from 186.10.125.209 port 29229 ssh2
...

 TCP (SYN) 45.91.101.18:56513 -> port 23, len 44

Unauthorized connection attempt detected from IP address 14.39.94.91 to port 2323

Unauthorized connection attempt detected from IP address 222.186.52.39 to port 22