SSH login attempts with user root at 2020-01-02.

Oct 11 23:53:45 *hidden* sshd[33031]: Invalid user teodora from 180.76.236.65 port 51230 Oct 11 23:53:45 *hidden* sshd[33031]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.236.65 Oct 11 23:53:48 *hidden* sshd[33031]: Failed password for invalid user teodora from 180.76.236.65 port 51230 ssh2

Oct 11 19:33:49 cdc sshd[3716]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.236.5  user=root
Oct 11 19:33:51 cdc sshd[3716]: Failed password for invalid user root from 180.76.236.5 port 49452 ssh2

Oct 11 12:04:01 OPSO sshd\[20485\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.236.5  user=root
Oct 11 12:04:03 OPSO sshd\[20485\]: Failed password for root from 180.76.236.5 port 57236 ssh2
Oct 11 12:05:41 OPSO sshd\[21016\]: Invalid user upload from 180.76.236.5 port 48352
Oct 11 12:05:41 OPSO sshd\[21016\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.236.5
Oct 11 12:05:43 OPSO sshd\[21016\]: Failed password for invalid user upload from 180.76.236.5 port 48352 ssh2

Invalid user info from 180.76.236.5 port 53338

Invalid user info from 180.76.236.5 port 53338

SSH login attempts.

Aug 29 05:57:17 ns382633 sshd\[30474\]: Invalid user frog from 180.76.236.65 port 56198
Aug 29 05:57:17 ns382633 sshd\[30474\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.236.65
Aug 29 05:57:19 ns382633 sshd\[30474\]: Failed password for invalid user frog from 180.76.236.65 port 56198 ssh2
Aug 29 06:03:04 ns382633 sshd\[31424\]: Invalid user ksk from 180.76.236.65 port 58938
Aug 29 06:03:04 ns382633 sshd\[31424\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.236.65

Aug 17 13:19:46 santamaria sshd\[28410\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.236.65  user=root
Aug 17 13:19:49 santamaria sshd\[28410\]: Failed password for root from 180.76.236.65 port 42272 ssh2
Aug 17 13:22:18 santamaria sshd\[28449\]: Invalid user usuario1 from 180.76.236.65
Aug 17 13:22:18 santamaria sshd\[28449\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.236.65
Aug 17 13:22:19 santamaria sshd\[28449\]: Failed password for invalid user usuario1 from 180.76.236.65 port 41456 ssh2
Aug 17 13:24:46 santamaria sshd\[28479\]: Invalid user testwww from 180.76.236.65
Aug 17 13:27:23 santamaria sshd\[28495\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.236.65  user=root
Aug 17 13:27:25 santamaria sshd\[28495\]: Failed password for root from 180.76.236.65 port 39842 ssh2
...

2020-08-08T05:41:51.453860ns386461 sshd\[14978\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.236.5  user=root
2020-08-08T05:41:53.142357ns386461 sshd\[14978\]: Failed password for root from 180.76.236.5 port 55556 ssh2
2020-08-08T05:55:44.876290ns386461 sshd\[28266\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.236.5  user=root
2020-08-08T05:55:46.585885ns386461 sshd\[28266\]: Failed password for root from 180.76.236.5 port 41550 ssh2
2020-08-08T06:00:22.302974ns386461 sshd\[32412\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.236.5  user=root
...

Aug  2 09:31:26 ns sshd[974]: Connection from 180.76.236.5 port 33232 on 134.119.36.27 port 22
Aug  2 09:31:29 ns sshd[974]: User r.r from 180.76.236.5 not allowed because not listed in AllowUsers
Aug  2 09:31:29 ns sshd[974]: Failed password for invalid user r.r from 180.76.236.5 port 33232 ssh2
Aug  2 09:31:29 ns sshd[974]: Received disconnect from 180.76.236.5 port 33232:11: Bye Bye [preauth]
Aug  2 09:31:29 ns sshd[974]: Disconnected from 180.76.236.5 port 33232 [preauth]
Aug  2 09:49:46 ns sshd[24749]: Connection from 180.76.236.5 port 52926 on 134.119.36.27 port 22
Aug  2 09:49:48 ns sshd[24749]: User r.r from 180.76.236.5 not allowed because not listed in AllowUsers
Aug  2 09:49:48 ns sshd[24749]: Failed password for invalid user r.r from 180.76.236.5 port 52926 ssh2
Aug  2 09:49:49 ns sshd[24749]: Received disconnect from 180.76.236.5 port 52926:11: Bye Bye [preauth]
Aug  2 09:49:49 ns sshd[24749]: Disconnected from 180.76.236.5 port 52926 [preauth]
Aug  2 09:55........
-------------------------------

2020-07-24 07:19:57,842 fail2ban.actions: WARNING [ssh] Ban 180.76.236.65

2020-06-20T15:12:02.074695shield sshd\[7145\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.236.65  user=root
2020-06-20T15:12:04.894907shield sshd\[7145\]: Failed password for root from 180.76.236.65 port 57494 ssh2
2020-06-20T15:16:50.680930shield sshd\[7774\]: Invalid user yhy from 180.76.236.65 port 48680
2020-06-20T15:16:50.684954shield sshd\[7774\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.236.65
2020-06-20T15:16:52.707363shield sshd\[7774\]: Failed password for invalid user yhy from 180.76.236.65 port 48680 ssh2

Jun 19 07:57:00 h2427292 sshd\[20430\]: Invalid user admin from 180.76.236.65
Jun 19 07:57:00 h2427292 sshd\[20430\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.236.65 
Jun 19 07:57:02 h2427292 sshd\[20430\]: Failed password for invalid user admin from 180.76.236.65 port 40128 ssh2
...

Unauthorized access or intrusion attempt detected from Thor banned IP

$f2bV_matches

10 attempts against mh-misc-ban on heat.magehost.pro

Dec 20 01:07:52 host sshd[29031]: Invalid user livezey from 134.175.18.62 port 41640
Dec 20 01:07:52 host sshd[29031]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.175.18.62
Dec 20 01:07:54 host sshd[29031]: Failed password for invalid user livezey from 134.175.18.62 port 41640 ssh2
Dec 20 01:07:54 host sshd[29031]: Received disconnect from 134.175.18.62 port 41640:11: Bye Bye [preauth]
Dec 20 01:07:54 host sshd[29031]: Disconnected from invalid user livezey 134.175.18.62 port 41640 [preauth]
Dec 20 01:16:57 host sshd[31352]: Invalid user ftpuser from 134.175.18.62 port 48992
Dec 20 01:16:57 host sshd[31352]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.175.18.62
Dec 20 01:16:59 host sshd[31352]: Failed password for invalid user ftpuser from 134.175.18.62 port 48992 ssh2
Dec 20 01:16:59 host sshd[31352]: Received disconnect from 134.175.18.62 port 48992:11: Bye Bye [preauth]
De........
-------------------------------

(imapd) Failed IMAP login from 45.224.105.42 (AR/Argentina/-): 1 in the last 3600 secs

firewall-block, port(s): 1080/tcp

Dec 22 10:19:59 vserver sshd\[624\]: Invalid user test from 86.21.205.149Dec 22 10:20:01 vserver sshd\[624\]: Failed password for invalid user test from 86.21.205.149 port 47158 ssh2Dec 22 10:25:19 vserver sshd\[675\]: Invalid user webadmin from 86.21.205.149Dec 22 10:25:21 vserver sshd\[675\]: Failed password for invalid user webadmin from 86.21.205.149 port 47890 ssh2
...

Dec 21 20:19:34 server sshd\[9303\]: Failed password for mysql from 86.56.11.228 port 59284 ssh2
Dec 22 10:10:58 server sshd\[8932\]: Invalid user gweneth from 86.56.11.228
Dec 22 10:10:58 server sshd\[8932\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=cable-86-56-11-228.cust.telecolumbus.net 
Dec 22 10:11:01 server sshd\[8932\]: Failed password for invalid user gweneth from 86.56.11.228 port 60706 ssh2
Dec 22 10:26:42 server sshd\[13835\]: Invalid user pushpavalli from 86.56.11.228
Dec 22 10:26:42 server sshd\[13835\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=cable-86-56-11-228.cust.telecolumbus.net 
...

Dec 22 03:52:14 linuxvps sshd\[30601\]: Invalid user a from 200.150.99.251
Dec 22 03:52:14 linuxvps sshd\[30601\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.150.99.251
Dec 22 03:52:16 linuxvps sshd\[30601\]: Failed password for invalid user a from 200.150.99.251 port 30868 ssh2
Dec 22 03:59:01 linuxvps sshd\[35186\]: Invalid user chu from 200.150.99.251
Dec 22 03:59:01 linuxvps sshd\[35186\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.150.99.251

Dec 22 15:55:47 vibhu-HP-Z238-Microtower-Workstation sshd\[29476\]: Invalid user rootuser from 37.139.2.218
Dec 22 15:55:47 vibhu-HP-Z238-Microtower-Workstation sshd\[29476\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.139.2.218
Dec 22 15:55:49 vibhu-HP-Z238-Microtower-Workstation sshd\[29476\]: Failed password for invalid user rootuser from 37.139.2.218 port 35578 ssh2
Dec 22 16:02:45 vibhu-HP-Z238-Microtower-Workstation sshd\[29802\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.139.2.218  user=root
Dec 22 16:02:47 vibhu-HP-Z238-Microtower-Workstation sshd\[29802\]: Failed password for root from 37.139.2.218 port 41050 ssh2
...

12/22/2019-05:15:14.278273 185.175.93.18 Protocol: 6 ET DROP Dshield Block Listed Source group 1

Dec 22 15:33:06 gw1 sshd[18250]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.21.32
Dec 22 15:33:08 gw1 sshd[18250]: Failed password for invalid user ko from 178.128.21.32 port 42202 ssh2
...

12/22/2019-01:26:17.180886 89.248.168.176 Protocol: 6 ET DROP Dshield Block Listed Source group 1

2019-12-22 00:26:06 H=(tradewindshoa.com) [179.108.73.245]:60257 I=[192.147.25.65]:25 F= rejected RCPT : RBL: found in thrukfz5b56tq6xao6odgdyjrq.zen.dq.spamhaus.net (127.0.0.3, 127.0.0.11, 127.0.0.4) (https://www.spamhaus.org/sbl/query/SBLCSS)
2019-12-22 00:26:07 H=(tradewindshoa.com) [179.108.73.245]:60257 I=[192.147.25.65]:25 F= rejected RCPT : RBL: found in thrukfz5b56tq6xao6odgdyjrq.zen.dq.spamhaus.net (127.0.0.11, 127.0.0.4, 127.0.0.3) (https://www.spamhaus.org/query/ip/179.108.73.245)
2019-12-22 00:26:08 H=(tradewindshoa.com) [179.108.73.245]:60257 I=[192.147.25.65]:25 F= rejected RCPT : RBL: found in thrukfz5b56tq6xao6odgdyjrq.zen.dq.spamhaus.net (127.0.0.11, 127.0.0.4, 127.0.0.3) (https://www.spamhaus.org/sbl/query/SBLCSS)
...

Dec 22 11:42:34 eventyay sshd[11803]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.192.167.36
Dec 22 11:42:36 eventyay sshd[11803]: Failed password for invalid user mkt from 211.192.167.36 port 45886 ssh2
Dec 22 11:48:26 eventyay sshd[12014]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.192.167.36
...

Dec 22 10:13:10 dedicated sshd[19762]: Invalid user test from 182.61.39.254 port 59338

Unauthorized connection attempt detected from IP address 1.53.68.242 to port 445