Apr 15 14:03:56 vserver sshd\[17324\]: Failed password for proxy from 189.8.108.161 port 50490 ssh2Apr 15 14:08:32 vserver sshd\[17354\]: Invalid user admin from 189.8.108.161Apr 15 14:08:33 vserver sshd\[17354\]: Failed password for invalid user admin from 189.8.108.161 port 59162 ssh2Apr 15 14:12:57 vserver sshd\[17438\]: Invalid user operator from 189.8.108.161
...

Apr 10 04:42:25 ift sshd\[41487\]: Failed password for root from 189.8.108.161 port 43614 ssh2Apr 10 04:46:53 ift sshd\[42375\]: Invalid user pgadmin from 189.8.108.161Apr 10 04:46:55 ift sshd\[42375\]: Failed password for invalid user pgadmin from 189.8.108.161 port 51350 ssh2Apr 10 04:51:18 ift sshd\[43151\]: Invalid user test from 189.8.108.161Apr 10 04:51:20 ift sshd\[43151\]: Failed password for invalid user test from 189.8.108.161 port 59082 ssh2
...

Apr  9 00:03:00 h2779839 sshd[1573]: Invalid user student from 189.8.108.161 port 53462
Apr  9 00:03:00 h2779839 sshd[1573]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.8.108.161
Apr  9 00:03:00 h2779839 sshd[1573]: Invalid user student from 189.8.108.161 port 53462
Apr  9 00:03:02 h2779839 sshd[1573]: Failed password for invalid user student from 189.8.108.161 port 53462 ssh2
Apr  9 00:07:29 h2779839 sshd[2938]: Invalid user duanxd from 189.8.108.161 port 35436
Apr  9 00:07:29 h2779839 sshd[2938]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.8.108.161
Apr  9 00:07:29 h2779839 sshd[2938]: Invalid user duanxd from 189.8.108.161 port 35436
Apr  9 00:07:31 h2779839 sshd[2938]: Failed password for invalid user duanxd from 189.8.108.161 port 35436 ssh2
Apr  9 00:11:46 h2779839 sshd[3105]: Invalid user user from 189.8.108.161 port 45642
...

Apr  4 15:48:47 localhost sshd[119476]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.8.108.161  user=root
Apr  4 15:48:50 localhost sshd[119476]: Failed password for root from 189.8.108.161 port 57802 ssh2
Apr  4 15:53:35 localhost sshd[119957]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.8.108.161  user=root
Apr  4 15:53:37 localhost sshd[119957]: Failed password for root from 189.8.108.161 port 38944 ssh2
Apr  4 15:58:23 localhost sshd[120418]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.8.108.161  user=root
Apr  4 15:58:25 localhost sshd[120418]: Failed password for root from 189.8.108.161 port 48318 ssh2
...

Mar 31 10:46:00 pkdns2 sshd\[1487\]: Failed password for root from 189.8.108.161 port 35588 ssh2Mar 31 10:47:47 pkdns2 sshd\[1559\]: Failed password for root from 189.8.108.161 port 60070 ssh2Mar 31 10:49:31 pkdns2 sshd\[1637\]: Invalid user shouqiang from 189.8.108.161Mar 31 10:49:32 pkdns2 sshd\[1637\]: Failed password for invalid user shouqiang from 189.8.108.161 port 56334 ssh2Mar 31 10:51:20 pkdns2 sshd\[1764\]: Failed password for root from 189.8.108.161 port 52596 ssh2Mar 31 10:53:07 pkdns2 sshd\[1858\]: Invalid user www from 189.8.108.161
...

Feb 21 22:21:11 marvibiene sshd[22929]: Invalid user chocolate from 189.8.108.161 port 42144
Feb 21 22:21:11 marvibiene sshd[22929]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.8.108.161
Feb 21 22:21:11 marvibiene sshd[22929]: Invalid user chocolate from 189.8.108.161 port 42144
Feb 21 22:21:14 marvibiene sshd[22929]: Failed password for invalid user chocolate from 189.8.108.161 port 42144 ssh2
...

detected by Fail2Ban

Sep 21 12:47:27 server sshd[37734]: Failed password for invalid user download from 189.8.108.50 port 49142 ssh2
Sep 21 12:51:38 server sshd[38624]: Failed password for invalid user admin from 189.8.108.50 port 53280 ssh2
Sep 21 12:55:57 server sshd[39506]: Failed password for invalid user user from 189.8.108.50 port 57422 ssh2

Jul 23 14:53:58 master sshd[12699]: Failed password for invalid user dpa from 189.8.108.50 port 56034 ssh2
Jul 23 15:06:17 master sshd[13129]: Failed password for invalid user rocessor from 189.8.108.50 port 42148 ssh2
Jul 23 15:11:22 master sshd[13210]: Failed password for invalid user stack from 189.8.108.50 port 57906 ssh2
Jul 23 15:16:22 master sshd[13269]: Failed password for invalid user guest from 189.8.108.50 port 45350 ssh2
Jul 23 15:21:40 master sshd[13331]: Failed password for invalid user zjy from 189.8.108.50 port 32830 ssh2
Jul 23 15:27:01 master sshd[13347]: Failed password for invalid user bert from 189.8.108.50 port 48554 ssh2
Jul 23 15:32:15 master sshd[13789]: Failed password for invalid user scaner from 189.8.108.50 port 36044 ssh2
Jul 23 15:37:38 master sshd[13819]: Failed password for invalid user rudi from 189.8.108.50 port 51758 ssh2
Jul 23 15:43:00 master sshd[13928]: Failed password for invalid user ct from 189.8.108.50 port 39290 ssh2

Jul 23 01:52:59 vpn01 sshd[27383]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.8.108.50
Jul 23 01:53:00 vpn01 sshd[27383]: Failed password for invalid user daniel from 189.8.108.50 port 33826 ssh2
...

Jun 30 03:33:27 XXX sshd[15042]: Invalid user ftpuser from 189.8.108.50 port 56172

2020-05-31T11:37:33.990360ollin.zadara.org sshd[26580]: Invalid user jamese from 189.8.108.50 port 49586
2020-05-31T11:37:35.663739ollin.zadara.org sshd[26580]: Failed password for invalid user jamese from 189.8.108.50 port 49586 ssh2
...

Jun 26 09:05:00 dallas01 sshd[10816]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.8.108.73
Jun 26 09:05:00 dallas01 sshd[10815]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.8.108.73
Jun 26 09:05:02 dallas01 sshd[10816]: Failed password for invalid user pi from 189.8.108.73 port 58209 ssh2

Jul 10 10:58:21 apollo sshd\[28391\]: Invalid user pi from 189.8.108.73Jul 10 10:58:21 apollo sshd\[28393\]: Invalid user pi from 189.8.108.73Jul 10 10:58:24 apollo sshd\[28391\]: Failed password for invalid user pi from 189.8.108.73 port 35684 ssh2
...

$f2bV_matches

Jul 4 13:35:54 *host* sshd\[18862\]: Unable to negotiate with 218.92.0.133 port 9502: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1 \[preauth\]

srv02 Mass scanning activity detected Target: 389(ldap) ..

US - - [03/Jul/2020:17:37:46 +0300] GET /go.php?https://tamago.care-cure.jp/shop/display_cart?return_url=http%3A%2F%2Fwww.cibertias.com%2Fttt-out.php%3Ff%3D1%26pct%3D75%26url%3Dhttps%253A%252F%252Fxn--72c7calxf3czac9hd8gra.com%252Fhome.php%253Fmod%253Dspace%2526uid%253D11251371 HTTP/1.0 403 292 - Mozilla/5.0 Windows NT 10.0; Win64; x64 AppleWebKit/537.36 KHTML, like Gecko Chrome/64.0.3282.189 Safari/537.36 Vivaldi/1.95.1077.60

Jul  4 07:12:54 onepixel sshd[1075780]: Failed password for root from 123.206.38.253 port 53462 ssh2
Jul  4 07:17:11 onepixel sshd[1077870]: Invalid user osmc from 123.206.38.253 port 43110
Jul  4 07:17:11 onepixel sshd[1077870]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.206.38.253 
Jul  4 07:17:11 onepixel sshd[1077870]: Invalid user osmc from 123.206.38.253 port 43110
Jul  4 07:17:13 onepixel sshd[1077870]: Failed password for invalid user osmc from 123.206.38.253 port 43110 ssh2

192.169.139.6 - - [04/Jul/2020:11:48:22 +0100] "POST /wp-login.php HTTP/1.1" 200 1993 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
192.169.139.6 - - [04/Jul/2020:11:48:24 +0100] "POST /wp-login.php HTTP/1.1" 200 1993 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
192.169.139.6 - - [04/Jul/2020:11:48:27 +0100] "POST /wp-login.php HTTP/1.1" 200 1993 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
...

Jul  4 12:53:23 plex sshd[13790]: Invalid user mcftp from 181.48.139.118 port 45238

2020-07-04T07:04:36.177567na-vps210223 sshd[31258]: Failed password for root from 37.49.230.133 port 43282 ssh2
2020-07-04T07:04:47.502233na-vps210223 sshd[31780]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.230.133  user=root
2020-07-04T07:04:49.413560na-vps210223 sshd[31780]: Failed password for root from 37.49.230.133 port 35802 ssh2
2020-07-04T07:05:00.874234na-vps210223 sshd[32302]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.230.133  user=root
2020-07-04T07:05:03.237113na-vps210223 sshd[32302]: Failed password for root from 37.49.230.133 port 56350 ssh2
...

Jul  4 09:57:02 localhost sshd[59277]: Invalid user testing from 150.242.97.109 port 34314
Jul  4 09:57:02 localhost sshd[59277]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=150.242.97.109
Jul  4 09:57:02 localhost sshd[59277]: Invalid user testing from 150.242.97.109 port 34314
Jul  4 09:57:04 localhost sshd[59277]: Failed password for invalid user testing from 150.242.97.109 port 34314 ssh2
Jul  4 10:00:40 localhost sshd[59686]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=150.242.97.109  user=ftp
Jul  4 10:00:43 localhost sshd[59686]: Failed password for ftp from 150.242.97.109 port 54870 ssh2
...

20 attempts against mh-ssh on road

US - - [03/Jul/2020:16:42:26 +0300] GET /go.php?https://www.aishamassage.com%2Ftantric-massage-in-london%2F HTTP/1.0 403 292 http://www.forseo.ru/ Mozilla/5.0 Windows NT 6.3; WOW64 AppleWebKit/537.36 KHTML, like Gecko Chrome/64.0.3282.186 YaBrowser/18.3.1.1232 Yowser/2.5 Safari/537.36

Jul  4 11:31:34 ns381471 sshd[5054]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=150.109.53.204
Jul  4 11:31:36 ns381471 sshd[5054]: Failed password for invalid user lqy from 150.109.53.204 port 60044 ssh2

$f2bV_matches

Unauthorized connection

2020-07-04 13:12:32 dovecot_login authenticator failed for \(User\) \[212.70.149.18\]: 535 Incorrect authentication data \(set_id=xid@no-server.de\)
2020-07-04 13:12:43 dovecot_login authenticator failed for \(User\) \[212.70.149.18\]: 535 Incorrect authentication data \(set_id=xid@no-server.de\)
2020-07-04 13:12:56 dovecot_login authenticator failed for \(User\) \[212.70.149.18\]: 535 Incorrect authentication data \(set_id=xenon@no-server.de\)
2020-07-04 13:13:08 dovecot_login authenticator failed for \(User\) \[212.70.149.18\]: 535 Incorrect authentication data \(set_id=xenon@no-server.de\)
2020-07-04 13:13:21 dovecot_login authenticator failed for \(User\) \[212.70.149.18\]: 535 Incorrect authentication data \(set_id=xenon@no-server.de\)
2020-07-04 13:13:25 dovecot_login authenticator failed for \(User\) \[212.70.149.18\]: 535 Incorrect authentication data \(set_id=xenon@no-server.de\)
...

20 attempts against mh-ssh on sea