Sep 17 15:00:11 XXXXXX sshd[64451]: Invalid user sanjeev from 178.32.44.233 port 49376

Sep 17 07:56:33 freedom sshd\[12953\]: Invalid user hyperic from 178.32.44.233 port 60082
Sep 17 07:58:37 freedom sshd\[12963\]: Invalid user hyperic from 178.32.44.233 port 46642
Sep 17 08:00:38 freedom sshd\[12974\]: Invalid user its from 178.32.44.233 port 33274
Sep 17 08:02:40 freedom sshd\[12988\]: Invalid user its from 178.32.44.233 port 48288
Sep 17 08:04:45 freedom sshd\[13003\]: Invalid user its from 178.32.44.233 port 35072
...

Sep 16 22:01:16 XXXXXX sshd[8035]: Invalid user wink from 178.32.44.233 port 40912

Jun 11 07:21:46 server sshd[11292]: Failed password for invalid user git2 from 178.32.44.233 port 44050 ssh2
Jun 11 07:37:46 server sshd[30798]: Failed password for invalid user git3 from 178.32.44.233 port 47270 ssh2
Jun 11 07:56:39 server sshd[17617]: Failed password for invalid user git from 178.32.44.233 port 50602 ssh2

Jun 10 08:38:17 vps639187 sshd\[7078\]: Invalid user sinusbot from 178.32.44.233 port 41450
Jun 10 08:38:17 vps639187 sshd\[7078\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.32.44.233
Jun 10 08:38:19 vps639187 sshd\[7078\]: Failed password for invalid user sinusbot from 178.32.44.233 port 41450 ssh2
...

Jun 10 01:52:23 vps639187 sshd\[1584\]: Invalid user raju from 178.32.44.233 port 44046
Jun 10 01:52:23 vps639187 sshd\[1584\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.32.44.233
Jun 10 01:52:25 vps639187 sshd\[1584\]: Failed password for invalid user raju from 178.32.44.233 port 44046 ssh2
...

Jun  9 16:39:12 vps639187 sshd\[26024\]: Invalid user bot from 178.32.44.233 port 48472
Jun  9 16:39:12 vps639187 sshd\[26024\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.32.44.233
Jun  9 16:39:14 vps639187 sshd\[26024\]: Failed password for invalid user bot from 178.32.44.233 port 48472 ssh2
...

Apr  3 03:56:30 dcd-gentoo sshd[5353]: Invalid user servercsgo from 178.32.44.233 port 49070
Apr  3 03:57:17 dcd-gentoo sshd[5392]: Invalid user servercsgo from 178.32.44.233 port 51198
Apr  3 03:58:08 dcd-gentoo sshd[5423]: Invalid user servercsgo from 178.32.44.233 port 53602
...

2020-03-24T17:05:04.268935vps773228.ovh.net sshd[32183]: Invalid user lty from 178.32.44.233 port 40710
2020-03-24T17:05:04.279750vps773228.ovh.net sshd[32183]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=ip233.ip-178-32-44.eu
2020-03-24T17:05:04.268935vps773228.ovh.net sshd[32183]: Invalid user lty from 178.32.44.233 port 40710
2020-03-24T17:05:06.671406vps773228.ovh.net sshd[32183]: Failed password for invalid user lty from 178.32.44.233 port 40710 ssh2
2020-03-24T17:05:36.289019vps773228.ovh.net sshd[32408]: Invalid user lty from 178.32.44.233 port 53266
...

Dec  8 15:56:30 mail sshd\[3536\]: Invalid user Azur123 from 178.32.44.197
Dec  8 15:56:30 mail sshd\[3536\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.32.44.197
Dec  8 15:56:31 mail sshd\[3536\]: Failed password for invalid user Azur123 from 178.32.44.197 port 2419 ssh2
...

SSH Brute-Force attacks

Oct  5 21:41:04 sachi sshd\[3185\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ip197.ip-178-32-44.eu  user=root
Oct  5 21:41:06 sachi sshd\[3185\]: Failed password for root from 178.32.44.197 port 20969 ssh2
Oct  5 21:45:09 sachi sshd\[3514\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ip197.ip-178-32-44.eu  user=root
Oct  5 21:45:11 sachi sshd\[3514\]: Failed password for root from 178.32.44.197 port 42136 ssh2
Oct  5 21:49:16 sachi sshd\[3861\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ip197.ip-178-32-44.eu  user=root

Oct  5 00:41:14 MK-Soft-VM4 sshd[2431]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.32.44.197 
Oct  5 00:41:16 MK-Soft-VM4 sshd[2431]: Failed password for invalid user P@55w0rd@2018 from 178.32.44.197 port 48523 ssh2
...

Oct  3 19:40:22 web9 sshd\[4963\]: Invalid user Cheese2017 from 178.32.44.197
Oct  3 19:40:22 web9 sshd\[4963\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.32.44.197
Oct  3 19:40:25 web9 sshd\[4963\]: Failed password for invalid user Cheese2017 from 178.32.44.197 port 46113 ssh2
Oct  3 19:44:21 web9 sshd\[5457\]: Invalid user Angela123 from 178.32.44.197
Oct  3 19:44:21 web9 sshd\[5457\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.32.44.197

Oct  3 13:38:12 web8 sshd\[9247\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.32.44.197  user=root
Oct  3 13:38:14 web8 sshd\[9247\]: Failed password for root from 178.32.44.197 port 18513 ssh2
Oct  3 13:42:08 web8 sshd\[11071\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.32.44.197  user=root
Oct  3 13:42:10 web8 sshd\[11071\]: Failed password for root from 178.32.44.197 port 10503 ssh2
Oct  3 13:46:10 web8 sshd\[13041\]: Invalid user ftpadmin from 178.32.44.197

Oct  3 02:43:48 ny01 sshd[31251]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.32.44.197
Oct  3 02:43:50 ny01 sshd[31251]: Failed password for invalid user lisa4 from 178.32.44.197 port 36023 ssh2
Oct  3 02:47:48 ny01 sshd[31974]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.32.44.197

Oct  2 05:48:18 auw2 sshd\[27707\]: Invalid user demo from 178.32.44.197
Oct  2 05:48:18 auw2 sshd\[27707\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ip197.ip-178-32-44.eu
Oct  2 05:48:20 auw2 sshd\[27707\]: Failed password for invalid user demo from 178.32.44.197 port 23821 ssh2
Oct  2 05:52:37 auw2 sshd\[28065\]: Invalid user zimbra from 178.32.44.197
Oct  2 05:52:37 auw2 sshd\[28065\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ip197.ip-178-32-44.eu

Sep 30 10:49:08 MK-Soft-VM6 sshd[29647]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.32.44.197 
Sep 30 10:49:10 MK-Soft-VM6 sshd[29647]: Failed password for invalid user kavo from 178.32.44.197 port 24667 ssh2
...

Sep  8 10:27:30 SilenceServices sshd[21043]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.32.44.197
Sep  8 10:27:32 SilenceServices sshd[21043]: Failed password for invalid user user from 178.32.44.197 port 52019 ssh2
Sep  8 10:31:40 SilenceServices sshd[22567]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.32.44.197

Sep  8 08:22:40 SilenceServices sshd[6190]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.32.44.197
Sep  8 08:22:42 SilenceServices sshd[6190]: Failed password for invalid user user21 from 178.32.44.197 port 43414 ssh2
Sep  8 08:26:56 SilenceServices sshd[7853]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.32.44.197

$f2bV_matches

Aug  9 20:21:06 mail sshd\[28202\]: Failed password for invalid user mock from 178.32.44.197 port 33195 ssh2
Aug  9 20:36:33 mail sshd\[28446\]: Invalid user swilton from 178.32.44.197 port 36678
Aug  9 20:36:33 mail sshd\[28446\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.32.44.197
...

Aug  3 03:43:41 srv206 sshd[5020]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=ip197.ip-178-32-44.eu  user=root
Aug  3 03:43:42 srv206 sshd[5020]: Failed password for root from 178.32.44.197 port 39725 ssh2
...

Aug  1 19:24:32 nextcloud sshd\[32475\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.32.44.197  user=root
Aug  1 19:24:34 nextcloud sshd\[32475\]: Failed password for root from 178.32.44.197 port 25818 ssh2
Aug  1 19:28:28 nextcloud sshd\[9548\]: Invalid user ashish from 178.32.44.197
...

detected by Fail2Ban

2019-09-14T07:58:14.279672enmeeting.mahidol.ac.th sshd\[11778\]: User root from 222.186.31.136 not allowed because not listed in AllowUsers
2019-09-14T07:58:14.662168enmeeting.mahidol.ac.th sshd\[11778\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.31.136  user=root
2019-09-14T07:58:16.846411enmeeting.mahidol.ac.th sshd\[11778\]: Failed password for invalid user root from 222.186.31.136 port 63858 ssh2
...

Sep 14 01:18:54 localhost sshd\[111073\]: Invalid user hadoop from 68.183.160.63 port 55690
Sep 14 01:18:54 localhost sshd\[111073\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.183.160.63
Sep 14 01:18:56 localhost sshd\[111073\]: Failed password for invalid user hadoop from 68.183.160.63 port 55690 ssh2
Sep 14 01:23:11 localhost sshd\[111172\]: Invalid user ts3 from 68.183.160.63 port 46104
Sep 14 01:23:11 localhost sshd\[111172\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.183.160.63
...

Invalid user zxiptv from 23.129.64.210 port 58553

Sep 13 23:53:53 SilenceServices sshd[12365]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.77.146.153
Sep 13 23:53:55 SilenceServices sshd[12365]: Failed password for invalid user plex123 from 51.77.146.153 port 43614 ssh2
Sep 13 23:58:13 SilenceServices sshd[13912]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.77.146.153

Sep 14 02:41:15 s64-1 sshd[29470]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=153.126.136.203
Sep 14 02:41:17 s64-1 sshd[29470]: Failed password for invalid user a from 153.126.136.203 port 56828 ssh2
Sep 14 02:46:08 s64-1 sshd[29664]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=153.126.136.203
...

Sep 13 15:07:01 sachi sshd\[19511\]: Invalid user safeuser from 223.111.184.10
Sep 13 15:07:01 sachi sshd\[19511\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=223.111.184.10
Sep 13 15:07:04 sachi sshd\[19511\]: Failed password for invalid user safeuser from 223.111.184.10 port 54204 ssh2
Sep 13 15:11:05 sachi sshd\[19944\]: Invalid user test from 223.111.184.10
Sep 13 15:11:05 sachi sshd\[19944\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=223.111.184.10

xmlrpc attack

2019-09-14T08:26:01.308206enmeeting.mahidol.ac.th sshd\[12009\]: User root from 188.254.0.112 not allowed because not listed in AllowUsers
2019-09-14T08:26:01.428687enmeeting.mahidol.ac.th sshd\[12009\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.254.0.112  user=root
2019-09-14T08:26:03.130714enmeeting.mahidol.ac.th sshd\[12009\]: Failed password for invalid user root from 188.254.0.112 port 53376 ssh2
...

Sep 14 01:07:40 web8 sshd\[22530\]: Invalid user password from 157.230.13.28
Sep 14 01:07:40 web8 sshd\[22530\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.230.13.28
Sep 14 01:07:42 web8 sshd\[22530\]: Failed password for invalid user password from 157.230.13.28 port 43092 ssh2
Sep 14 01:12:20 web8 sshd\[24877\]: Invalid user sftp from 157.230.13.28
Sep 14 01:12:20 web8 sshd\[24877\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.230.13.28

14.09.2019 01:33:50 SSH access blocked by firewall

proto=tcp  .  spt=48695  .  dpt=25  .     (listed on Blocklist de  Sep 13)     (961)

proto=tcp  .  spt=36882  .  dpt=25  .     (listed on Blocklist de  Sep 13)     (960)

Chat Spam

Sep 13 14:19:42 kapalua sshd\[12030\]: Invalid user user1 from 172.81.237.242
Sep 13 14:19:42 kapalua sshd\[12030\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=172.81.237.242
Sep 13 14:19:44 kapalua sshd\[12030\]: Failed password for invalid user user1 from 172.81.237.242 port 46002 ssh2
Sep 13 14:24:48 kapalua sshd\[12443\]: Invalid user user from 172.81.237.242
Sep 13 14:24:48 kapalua sshd\[12443\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=172.81.237.242