Jun 10 10:20:42 XXXXXX sshd[49985]: Invalid user admin from 180.76.36.158 port 41654

May 31 05:52:18 abendstille sshd\[27551\]: Invalid user telnet from 180.76.36.158
May 31 05:52:18 abendstille sshd\[27551\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.36.158
May 31 05:52:19 abendstille sshd\[27551\]: Failed password for invalid user telnet from 180.76.36.158 port 46282 ssh2
May 31 05:53:38 abendstille sshd\[28865\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.36.158  user=root
May 31 05:53:40 abendstille sshd\[28865\]: Failed password for root from 180.76.36.158 port 57082 ssh2
...

May 25 08:52:31 Nxxxxxxx sshd[20727]: Failed password for invalid user zxin10 from 180.76.36.158 port 54424 ssh2
May 25 08:53:51 Nxxxxxxx sshd[23922]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.36.158  user=r.r
May 25 08:53:54 Nxxxxxxx sshd[23922]: Failed password for r.r from 180.76.36.158 port 37698 ssh2
May 25 08:55:16 Nxxxxxxx sshd[26866]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.36.158  user=r.r
May 25 08:55:18 Nxxxxxxx sshd[26866]: Failed password for r.r from 180.76.36.158 port 49194 ssh2


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=180.76.36.158

(sshd) Failed SSH login from 180.76.36.158 (CN/China/-): 5 in the last 3600 secs

May 21 09:07:46 cdc sshd[9032]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.36.138 
May 21 09:07:48 cdc sshd[9032]: Failed password for invalid user bigdata from 180.76.36.138 port 36812 ssh2

May 15 00:00:37 nextcloud sshd\[24704\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.36.158  user=clamav
May 15 00:00:39 nextcloud sshd\[24704\]: Failed password for clamav from 180.76.36.158 port 41932 ssh2
May 15 00:07:20 nextcloud sshd\[1940\]: Invalid user ftpuser from 180.76.36.158
May 15 00:07:20 nextcloud sshd\[1940\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.36.158

Wordpress malicious attack:[sshd]

May  3 22:52:54 inter-technics sshd[23604]: Invalid user confluence from 180.76.36.158 port 50824
May  3 22:52:54 inter-technics sshd[23604]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.36.158
May  3 22:52:54 inter-technics sshd[23604]: Invalid user confluence from 180.76.36.158 port 50824
May  3 22:52:56 inter-technics sshd[23604]: Failed password for invalid user confluence from 180.76.36.158 port 50824 ssh2
May  3 22:59:50 inter-technics sshd[25293]: Invalid user unix from 180.76.36.158 port 53200
...

2020-05-02T20:25:38.961836dmca.cloudsearch.cf sshd[27831]: Invalid user gb from 180.76.36.158 port 52756
2020-05-02T20:25:38.967888dmca.cloudsearch.cf sshd[27831]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.36.158
2020-05-02T20:25:38.961836dmca.cloudsearch.cf sshd[27831]: Invalid user gb from 180.76.36.158 port 52756
2020-05-02T20:25:41.019840dmca.cloudsearch.cf sshd[27831]: Failed password for invalid user gb from 180.76.36.158 port 52756 ssh2
2020-05-02T20:32:40.941644dmca.cloudsearch.cf sshd[28244]: Invalid user wyq from 180.76.36.158 port 56626
2020-05-02T20:32:40.948433dmca.cloudsearch.cf sshd[28244]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.36.158
2020-05-02T20:32:40.941644dmca.cloudsearch.cf sshd[28244]: Invalid user wyq from 180.76.36.158 port 56626
2020-05-02T20:32:43.266341dmca.cloudsearch.cf sshd[28244]: Failed password for invalid user wyq from 180.76.36.158 port 56626 
...

Apr 18 19:37:37 ns4 sshd[30878]: Invalid user gold from 180.76.36.138
Apr 18 19:37:38 ns4 sshd[30878]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.36.138 
Apr 18 19:37:39 ns4 sshd[30878]: Failed password for invalid user gold from 180.76.36.138 port 56300 ssh2
Apr 18 19:42:50 ns4 sshd[31922]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.36.138  user=r.r
Apr 18 19:42:53 ns4 sshd[31922]: Failed password for r.r from 180.76.36.138 port 57200 ssh2


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=180.76.36.138

Invalid user info from 180.76.36.226 port 51176
pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.36.226
Failed password for invalid user info from 180.76.36.226 port 51176 ssh2
Invalid user spring from 180.76.36.226 port 60796
pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.36.226

Nov  5 07:57:57 localhost sshd\[22756\]: Invalid user jira from 180.76.36.226
Nov  5 07:57:57 localhost sshd\[22756\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.36.226
Nov  5 07:57:59 localhost sshd\[22756\]: Failed password for invalid user jira from 180.76.36.226 port 58556 ssh2
Nov  5 08:03:25 localhost sshd\[23003\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.36.226  user=root
Nov  5 08:03:28 localhost sshd\[23003\]: Failed password for root from 180.76.36.226 port 38952 ssh2
...

Oct 27 15:54:25 lnxmail61 sshd[5124]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.36.226

Lines containing failures of 118.27.13.207
Oct  6 23:47:31 shared05 sshd[26703]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.27.13.207  user=r.r
Oct  6 23:47:32 shared05 sshd[26703]: Failed password for r.r from 118.27.13.207 port 36102 ssh2
Oct  6 23:47:33 shared05 sshd[26703]: Received disconnect from 118.27.13.207 port 36102:11: Bye Bye [preauth]
Oct  6 23:47:33 shared05 sshd[26703]: Disconnected from authenticating user r.r 118.27.13.207 port 36102 [preauth]
Oct  6 23:59:46 shared05 sshd[30426]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.27.13.207  user=r.r
Oct  6 23:59:48 shared05 sshd[30426]: Failed password for r.r from 118.27.13.207 port 48610 ssh2
Oct  6 23:59:48 shared05 sshd[30426]: Received disconnect from 118.27.13.207 port 48610:11: Bye Bye [preauth]
Oct  6 23:59:48 shared05 sshd[30426]: Disconnected from authenticating user r.r 118.27.13.207 port 48610 [preauth........
------------------------------

Oct  7 22:23:35 eventyay sshd[17655]: Failed password for root from 49.88.112.90 port 28325 ssh2
Oct  7 22:23:38 eventyay sshd[17655]: Failed password for root from 49.88.112.90 port 28325 ssh2
Oct  7 22:23:40 eventyay sshd[17655]: Failed password for root from 49.88.112.90 port 28325 ssh2
...

Oct  7 21:52:21 km20725 sshd\[29321\]: Invalid user abba from 92.62.139.103Oct  7 21:52:23 km20725 sshd\[29321\]: Failed password for invalid user abba from 92.62.139.103 port 54954 ssh2Oct  7 21:52:26 km20725 sshd\[29321\]: Failed password for invalid user abba from 92.62.139.103 port 54954 ssh2Oct  7 21:52:28 km20725 sshd\[29321\]: Failed password for invalid user abba from 92.62.139.103 port 54954 ssh2
...

Oct  7 21:53:06 MK-Soft-VM4 sshd[5452]: Failed password for root from 49.88.112.74 port 47264 ssh2
Oct  7 21:53:08 MK-Soft-VM4 sshd[5452]: Failed password for root from 49.88.112.74 port 47264 ssh2
...

Oct  7 20:38:02 localhost sshd\[129570\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=158.69.194.115  user=root
Oct  7 20:38:04 localhost sshd\[129570\]: Failed password for root from 158.69.194.115 port 33786 ssh2
Oct  7 20:42:42 localhost sshd\[129839\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=158.69.194.115  user=root
Oct  7 20:42:44 localhost sshd\[129839\]: Failed password for root from 158.69.194.115 port 54340 ssh2
Oct  7 20:47:24 localhost sshd\[129998\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=158.69.194.115  user=root
...

\[2019-10-07 16:27:40\] NOTICE\[1887\] chan_sip.c: Registration from '"1700" \' failed for '51.89.41.85:5079' - Wrong password
\[2019-10-07 16:27:40\] SECURITY\[1898\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-10-07T16:27:40.855-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="1700",SessionID="0x7fc3ac636978",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/51.89.41.85/5079",Challenge="777925eb",ReceivedChallenge="777925eb",ReceivedHash="c55bfb19bc6e5775b53a941a45d629e5"
\[2019-10-07 16:27:40\] NOTICE\[1887\] chan_sip.c: Registration from '"1700" \' failed for '51.89.41.85:5079' - Wrong password
\[2019-10-07 16:27:40\] SECURITY\[1898\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-10-07T16:27:40.976-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="1700",SessionID="0x7fc3ac561978",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/51.8

07.10.2019 20:39:33 SSH access blocked by firewall

Oct  7 21:52:51 vpn01 sshd[19653]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.134.159.21
Oct  7 21:52:52 vpn01 sshd[19653]: Failed password for invalid user Asd12345 from 121.134.159.21 port 48340 ssh2
...

Oct  5 23:35:34 liveconfig01 sshd[20392]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.139.101.21  user=r.r
Oct  5 23:35:36 liveconfig01 sshd[20392]: Failed password for r.r from 61.139.101.21 port 60892 ssh2
Oct  5 23:35:36 liveconfig01 sshd[20392]: Received disconnect from 61.139.101.21 port 60892:11: Bye Bye [preauth]
Oct  5 23:35:36 liveconfig01 sshd[20392]: Disconnected from 61.139.101.21 port 60892 [preauth]
Oct  5 23:58:09 liveconfig01 sshd[21381]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.139.101.21  user=r.r
Oct  5 23:58:11 liveconfig01 sshd[21381]: Failed password for r.r from 61.139.101.21 port 48964 ssh2
Oct  5 23:58:11 liveconfig01 sshd[21381]: Received disconnect from 61.139.101.21 port 48964:11: Bye Bye [preauth]
Oct  5 23:58:11 liveconfig01 sshd[21381]: Disconnected from 61.139.101.21 port 48964 [preauth]
Oct  6 00:02:06 liveconfig01 sshd[21556]: pam_unix(sshd:........
-------------------------------

Oct  7 14:01:30 pi01 sshd[16439]: Connection from 162.13.14.74 port 58830 on 192.168.1.10 port 22
Oct  7 14:01:31 pi01 sshd[16439]: User r.r from 162.13.14.74 not allowed because not listed in AllowUsers
Oct  7 14:01:31 pi01 sshd[16439]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.13.14.74  user=r.r
Oct  7 14:01:33 pi01 sshd[16439]: Failed password for invalid user r.r from 162.13.14.74 port 58830 ssh2
Oct  7 14:01:33 pi01 sshd[16439]: Received disconnect from 162.13.14.74 port 58830:11: Bye Bye [preauth]
Oct  7 14:01:33 pi01 sshd[16439]: Disconnected from 162.13.14.74 port 58830 [preauth]
Oct  7 14:12:05 pi01 sshd[16576]: Connection from 162.13.14.74 port 42976 on 192.168.1.10 port 22
Oct  7 14:12:06 pi01 sshd[16576]: User r.r from 162.13.14.74 not allowed because not listed in AllowUsers
Oct  7 14:12:06 pi01 sshd[16576]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.13.14.74 ........
-------------------------------

Oct  7 22:19:39 core sshd[3841]: Invalid user nhy6MJU& from 175.158.50.174 port 6902
Oct  7 22:19:41 core sshd[3841]: Failed password for invalid user nhy6MJU& from 175.158.50.174 port 6902 ssh2
...

port scan and connect, tcp 1433 (ms-sql-s)

Oct  7 10:21:42 web9 sshd\[17193\]: Invalid user 123Impact from 111.231.144.219
Oct  7 10:21:42 web9 sshd\[17193\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.144.219
Oct  7 10:21:44 web9 sshd\[17193\]: Failed password for invalid user 123Impact from 111.231.144.219 port 35177 ssh2
Oct  7 10:25:48 web9 sshd\[17803\]: Invalid user Passw0rt!   from 111.231.144.219
Oct  7 10:25:48 web9 sshd\[17803\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.144.219

2019-10-07T20:25:29.146998abusebot.cloudsearch.cf sshd\[9216\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.ip-51-255-174.eu  user=root

RDP brute force attack detected by fail2ban