Jul 19 18:08:40 santamaria sshd\[21668\]: Invalid user zzh from 180.76.232.80
Jul 19 18:08:40 santamaria sshd\[21668\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.232.80
Jul 19 18:08:43 santamaria sshd\[21668\]: Failed password for invalid user zzh from 180.76.232.80 port 50882 ssh2
...

srv02 SSH BruteForce Attacks 22 ..

firewall-block, port(s): 5431/tcp

May 28 18:32:33 *** sshd[10403]: User root from 180.76.232.80 not allowed because not listed in AllowUsers

Unauthorised connection attempt detected at AUO NODE 4. System is sshd. Protected by AUO Stack Web Application Firewall (WAF)

Invalid user ovx from 180.76.232.80 port 42322

Invalid user test from 180.76.232.80 port 44086

May  8 09:22:22 gw1 sshd[681]: Failed password for root from 180.76.232.80 port 39702 ssh2
...

Apr 26 17:40:36 vps46666688 sshd[29021]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.232.80
Apr 26 17:40:38 vps46666688 sshd[29021]: Failed password for invalid user pms from 180.76.232.80 port 44334 ssh2
...

Apr 25 14:24:00 mail sshd\[27554\]: Invalid user wdigi from 180.76.232.80
Apr 25 14:24:00 mail sshd\[27554\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.232.80
...

Jul 29 18:03:39 ws22vmsma01 sshd[226987]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.232.66
Jul 29 18:03:40 ws22vmsma01 sshd[226987]: Failed password for invalid user ceadmin from 180.76.232.66 port 35912 ssh2
...

" "

Jun 24 10:14:17 h1745522 sshd[12547]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.232.66  user=root
Jun 24 10:14:19 h1745522 sshd[12547]: Failed password for root from 180.76.232.66 port 47924 ssh2
Jun 24 10:15:46 h1745522 sshd[12638]: Invalid user xuyf from 180.76.232.66 port 57818
Jun 24 10:15:46 h1745522 sshd[12638]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.232.66
Jun 24 10:15:46 h1745522 sshd[12638]: Invalid user xuyf from 180.76.232.66 port 57818
Jun 24 10:15:48 h1745522 sshd[12638]: Failed password for invalid user xuyf from 180.76.232.66 port 57818 ssh2
Jun 24 10:19:04 h1745522 sshd[12796]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.232.66  user=root
Jun 24 10:19:06 h1745522 sshd[12796]: Failed password for root from 180.76.232.66 port 49354 ssh2
Jun 24 10:22:13 h1745522 sshd[13041]: pam_unix(sshd:auth): authentication failu
...

Jun 15 13:22:14 ip-172-31-61-156 sshd[31587]: Failed password for invalid user internet from 180.76.232.66 port 37232 ssh2
Jun 15 13:22:13 ip-172-31-61-156 sshd[31587]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.232.66
Jun 15 13:22:13 ip-172-31-61-156 sshd[31587]: Invalid user internet from 180.76.232.66
Jun 15 13:22:14 ip-172-31-61-156 sshd[31587]: Failed password for invalid user internet from 180.76.232.66 port 37232 ssh2
Jun 15 13:24:32 ip-172-31-61-156 sshd[31664]: Invalid user test2 from 180.76.232.66
...

Jun 12 06:13:12 vps sshd[580206]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.232.66  user=root
Jun 12 06:13:14 vps sshd[580206]: Failed password for root from 180.76.232.66 port 44184 ssh2
Jun 12 06:15:15 vps sshd[593450]: Invalid user xuxy from 180.76.232.66 port 46034
Jun 12 06:15:15 vps sshd[593450]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.232.66
Jun 12 06:15:17 vps sshd[593450]: Failed password for invalid user xuxy from 180.76.232.66 port 46034 ssh2
...

May 26 00:11:45 124388 sshd[4783]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.232.66
May 26 00:11:45 124388 sshd[4783]: Invalid user orh from 180.76.232.66 port 33758
May 26 00:11:47 124388 sshd[4783]: Failed password for invalid user orh from 180.76.232.66 port 33758 ssh2
May 26 00:14:33 124388 sshd[4805]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.232.66  user=root
May 26 00:14:35 124388 sshd[4805]: Failed password for root from 180.76.232.66 port 53102 ssh2

May  7 03:17:03 firewall sshd[20672]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.232.66
May  7 03:17:03 firewall sshd[20672]: Invalid user poc from 180.76.232.66
May  7 03:17:05 firewall sshd[20672]: Failed password for invalid user poc from 180.76.232.66 port 52368 ssh2
...

Apr 29 13:39:09 dev0-dcde-rnet sshd[8076]: Failed password for root from 180.76.232.66 port 33530 ssh2
Apr 29 14:04:01 dev0-dcde-rnet sshd[8377]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.232.66
Apr 29 14:04:03 dev0-dcde-rnet sshd[8377]: Failed password for invalid user jetty from 180.76.232.66 port 60502 ssh2

Apr 27 13:52:18 [host] sshd[20091]: Invalid user e
Apr 27 13:52:18 [host] sshd[20091]: pam_unix(sshd:
Apr 27 13:52:20 [host] sshd[20091]: Failed passwor

$f2bV_matches

Apr  1 09:59:39 marvibiene sshd[16717]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.232.66  user=root
Apr  1 09:59:42 marvibiene sshd[16717]: Failed password for root from 180.76.232.66 port 46614 ssh2
Apr  1 10:15:26 marvibiene sshd[17220]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.232.66  user=root
Apr  1 10:15:27 marvibiene sshd[17220]: Failed password for root from 180.76.232.66 port 33296 ssh2
...

Mar  3 05:23:53 gw1 sshd[11970]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.232.66
Mar  3 05:23:55 gw1 sshd[11970]: Failed password for invalid user amandabackup from 180.76.232.66 port 34492 ssh2
...

Feb 24 15:11:09 web1 sshd\[6159\]: Invalid user krishna from 180.76.232.66
Feb 24 15:11:09 web1 sshd\[6159\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.232.66
Feb 24 15:11:10 web1 sshd\[6159\]: Failed password for invalid user krishna from 180.76.232.66 port 40664 ssh2
Feb 24 15:12:58 web1 sshd\[6358\]: Invalid user compose from 180.76.232.66
Feb 24 15:12:58 web1 sshd\[6358\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.232.66

Unauthorized connection attempt detected from IP address 180.76.232.66 to port 2220 [J]

Jan  1 07:22:12 localhost sshd\[25639\]: Invalid user bank from 180.76.232.66 port 35362
Jan  1 07:22:12 localhost sshd\[25639\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.232.66
Jan  1 07:22:14 localhost sshd\[25639\]: Failed password for invalid user bank from 180.76.232.66 port 35362 ssh2
Jan  1 07:25:43 localhost sshd\[25732\]: Invalid user sjur from 180.76.232.66 port 60470
Jan  1 07:25:43 localhost sshd\[25732\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.232.66
...

port scan and connect, tcp 22 (ssh)

2020-05-14T05:35:12.757116abusebot-4.cloudsearch.cf sshd[10413]: Invalid user test from 138.68.236.50 port 59168
2020-05-14T05:35:12.763738abusebot-4.cloudsearch.cf sshd[10413]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.236.50
2020-05-14T05:35:12.757116abusebot-4.cloudsearch.cf sshd[10413]: Invalid user test from 138.68.236.50 port 59168
2020-05-14T05:35:14.936398abusebot-4.cloudsearch.cf sshd[10413]: Failed password for invalid user test from 138.68.236.50 port 59168 ssh2
2020-05-14T05:40:14.292028abusebot-4.cloudsearch.cf sshd[10659]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.236.50  user=root
2020-05-14T05:40:16.258806abusebot-4.cloudsearch.cf sshd[10659]: Failed password for root from 138.68.236.50 port 37394 ssh2
2020-05-14T05:42:49.243695abusebot-4.cloudsearch.cf sshd[10935]: Invalid user postgres from 138.68.236.50 port 42318
...

May 14 07:30:54 combo sshd[19602]: Failed password for root from 218.92.0.172 port 37467 ssh2
May 14 07:30:57 combo sshd[19602]: Failed password for root from 218.92.0.172 port 37467 ssh2
May 14 07:31:01 combo sshd[19602]: Failed password for root from 218.92.0.172 port 37467 ssh2
...

$f2bV_matches

May 14 05:42:19 ip-172-31-62-245 sshd\[31746\]: Invalid user mr from 106.13.227.104\
May 14 05:42:22 ip-172-31-62-245 sshd\[31746\]: Failed password for invalid user mr from 106.13.227.104 port 39748 ssh2\
May 14 05:44:02 ip-172-31-62-245 sshd\[31765\]: Invalid user elcabo from 106.13.227.104\
May 14 05:44:04 ip-172-31-62-245 sshd\[31765\]: Failed password for invalid user elcabo from 106.13.227.104 port 57194 ssh2\
May 14 05:45:46 ip-172-31-62-245 sshd\[31796\]: Invalid user usu\\303\\241rio from 106.13.227.104\

20 attempts against mh-misbehave-ban on pluto

Malicious Traffic/Form Submission

2020-05-14T06:08:18.486255shield sshd\[27522\]: Invalid user user from 201.132.119.2 port 15829
2020-05-14T06:08:18.565570shield sshd\[27522\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.132.119.2
2020-05-14T06:08:20.717496shield sshd\[27522\]: Failed password for invalid user user from 201.132.119.2 port 15829 ssh2
2020-05-14T06:10:35.203170shield sshd\[28005\]: Invalid user deploy from 201.132.119.2 port 64353
2020-05-14T06:10:35.213254shield sshd\[28005\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.132.119.2

May 14 08:09:06 ArkNodeAT sshd\[11767\]: Invalid user admin from 62.171.146.58
May 14 08:09:06 ArkNodeAT sshd\[11767\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.171.146.58
May 14 08:09:08 ArkNodeAT sshd\[11767\]: Failed password for invalid user admin from 62.171.146.58 port 52232 ssh2

May 14 08:13:58 buvik sshd[2504]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.37.151.239
May 14 08:14:00 buvik sshd[2504]: Failed password for invalid user bodiesel from 54.37.151.239 port 56888 ssh2
May 14 08:16:34 buvik sshd[2857]: Invalid user epro from 54.37.151.239
...

May 14 08:22:28 vmanager6029 sshd\[14384\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.30.112  user=root
May 14 08:22:30 vmanager6029 sshd\[14382\]: error: PAM: Authentication failure for root from 222.186.30.112
May 14 08:22:30 vmanager6029 sshd\[14387\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.30.112  user=root

May 14 02:48:25 ny01 sshd[32726]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.165.24.200
May 14 02:48:27 ny01 sshd[32726]: Failed password for invalid user deploy from 188.165.24.200 port 51920 ssh2
May 14 02:51:46 ny01 sshd[649]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.165.24.200

May 14 08:19:49 buvik sshd[3276]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=168.232.167.58
May 14 08:19:51 buvik sshd[3276]: Failed password for invalid user lions from 168.232.167.58 port 56646 ssh2
May 14 08:24:25 buvik sshd[3889]: Invalid user 2 from 168.232.167.58
...

May 14 07:49:57 * sshd[19731]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=89.36.220.145
May 14 07:49:59 * sshd[19731]: Failed password for invalid user grace from 89.36.220.145 port 59017 ssh2

leo_www