Jun 14 05:43:11 django-0 sshd\[18553\]: Failed password for root from 192.144.230.158 port 60070 ssh2Jun 14 05:47:28 django-0 sshd\[18665\]: Invalid user postgres from 192.144.230.158Jun 14 05:47:30 django-0 sshd\[18665\]: Failed password for invalid user postgres from 192.144.230.158 port 43224 ssh2
...

2020-06-13T20:59:19.377950abusebot-4.cloudsearch.cf sshd[4298]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.144.230.158  user=root
2020-06-13T20:59:20.914919abusebot-4.cloudsearch.cf sshd[4298]: Failed password for root from 192.144.230.158 port 57832 ssh2
2020-06-13T21:05:22.236920abusebot-4.cloudsearch.cf sshd[4747]: Invalid user git from 192.144.230.158 port 40218
2020-06-13T21:05:22.246207abusebot-4.cloudsearch.cf sshd[4747]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.144.230.158
2020-06-13T21:05:22.236920abusebot-4.cloudsearch.cf sshd[4747]: Invalid user git from 192.144.230.158 port 40218
2020-06-13T21:05:23.948872abusebot-4.cloudsearch.cf sshd[4747]: Failed password for invalid user git from 192.144.230.158 port 40218 ssh2
2020-06-13T21:07:46.842874abusebot-4.cloudsearch.cf sshd[4871]: Invalid user zhangf from 192.144.230.158 port 36932
...

Invalid user admin from 192.144.230.158 port 37878

Jun  6 22:50:08 marvibiene sshd[14069]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.144.230.158  user=root
Jun  6 22:50:10 marvibiene sshd[14069]: Failed password for root from 192.144.230.158 port 35820 ssh2
Jun  6 22:58:47 marvibiene sshd[14122]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.144.230.158  user=root
Jun  6 22:58:49 marvibiene sshd[14122]: Failed password for root from 192.144.230.158 port 36536 ssh2
...

5x Failed Password

May 24 08:55:01 sshgateway sshd\[3140\]: Invalid user rhf from 192.144.230.158
May 24 08:55:01 sshgateway sshd\[3140\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.144.230.158
May 24 08:55:03 sshgateway sshd\[3140\]: Failed password for invalid user rhf from 192.144.230.158 port 34202 ssh2

Invalid user hldms from 192.144.230.158 port 32810

DATE:2020-05-13 10:46:36, IP:192.144.230.158, PORT:ssh SSH brute force auth (docker-dc)

Apr 16 14:51:04  sshd[15460]: Failed password for invalid user mz from 192.144.230.158 port 51926 ssh2

Apr 10 06:43:39 meumeu sshd[31151]: Failed password for minecraft from 192.144.230.158 port 44700 ssh2
Apr 10 06:51:39 meumeu sshd[32119]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.144.230.158 
Apr 10 06:51:41 meumeu sshd[32119]: Failed password for invalid user user1 from 192.144.230.158 port 48456 ssh2
...

Lines containing failures of 192.144.230.158 (max 1000)
Apr  3 20:23:20 localhost sshd[31169]: User r.r from 192.144.230.158 not allowed because listed in DenyUsers
Apr  3 20:23:20 localhost sshd[31169]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.144.230.158  user=r.r
Apr  3 20:23:22 localhost sshd[31169]: Failed password for invalid user r.r from 192.144.230.158 port 42830 ssh2
Apr  3 20:23:25 localhost sshd[31169]: Received disconnect from 192.144.230.158 port 42830:11: Bye Bye [preauth]
Apr  3 20:23:25 localhost sshd[31169]: Disconnected from invalid user r.r 192.144.230.158 port 42830 [preauth]
Apr  3 20:38:46 localhost sshd[2113]: User r.r from 192.144.230.158 not allowed because listed in DenyUsers
Apr  3 20:38:46 localhost sshd[2113]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.144.230.158  user=r.r
Apr  3 20:38:47 localhost sshd[2113]: Failed password for invalid user........
------------------------------

Sep 17 05:03:11 server sshd[30365]: Failed password for invalid user marrah from 192.144.230.43 port 36776 ssh2
Sep 17 05:07:49 server sshd[32680]: Failed password for root from 192.144.230.43 port 43086 ssh2
Sep 17 05:12:27 server sshd[2702]: Failed password for root from 192.144.230.43 port 49398 ssh2

Sep 17 05:03:11 server sshd[30365]: Failed password for invalid user marrah from 192.144.230.43 port 36776 ssh2
Sep 17 05:07:49 server sshd[32680]: Failed password for root from 192.144.230.43 port 43086 ssh2
Sep 17 05:12:27 server sshd[2702]: Failed password for root from 192.144.230.43 port 49398 ssh2

SSH Invalid Login

2020-08-23T11:13:33.941835afi-git.jinr.ru sshd[444]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.144.230.43
2020-08-23T11:13:33.938732afi-git.jinr.ru sshd[444]: Invalid user yr from 192.144.230.43 port 50564
2020-08-23T11:13:35.841203afi-git.jinr.ru sshd[444]: Failed password for invalid user yr from 192.144.230.43 port 50564 ssh2
2020-08-23T11:17:56.869864afi-git.jinr.ru sshd[1609]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.144.230.43  user=root
2020-08-23T11:17:59.206037afi-git.jinr.ru sshd[1609]: Failed password for root from 192.144.230.43 port 43184 ssh2
...

Aug  4 11:21:28 fhem-rasp sshd[12299]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.144.230.43  user=root
Aug  4 11:21:31 fhem-rasp sshd[12299]: Failed password for root from 192.144.230.43 port 51906 ssh2
...

$f2bV_matches

Jul 22 06:01:00 itv-usvr-02 sshd[20664]: Invalid user juan from 192.144.230.43 port 58518
Jul 22 06:01:00 itv-usvr-02 sshd[20664]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.144.230.43
Jul 22 06:01:00 itv-usvr-02 sshd[20664]: Invalid user juan from 192.144.230.43 port 58518
Jul 22 06:01:02 itv-usvr-02 sshd[20664]: Failed password for invalid user juan from 192.144.230.43 port 58518 ssh2
Jul 22 06:05:24 itv-usvr-02 sshd[20786]: Invalid user rupesh from 192.144.230.43 port 39364

Invalid user atena from 192.144.230.43 port 36436

Jul 12 13:57:02 ncomp sshd[6163]: Invalid user auburn from 192.144.230.221
Jul 12 13:57:02 ncomp sshd[6163]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.144.230.221
Jul 12 13:57:02 ncomp sshd[6163]: Invalid user auburn from 192.144.230.221
Jul 12 13:57:03 ncomp sshd[6163]: Failed password for invalid user auburn from 192.144.230.221 port 40152 ssh2

2020-07-06T03:49:46.527662abusebot-6.cloudsearch.cf sshd[6413]: Invalid user dennis from 192.144.230.221 port 44560
2020-07-06T03:49:46.533477abusebot-6.cloudsearch.cf sshd[6413]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.144.230.221
2020-07-06T03:49:46.527662abusebot-6.cloudsearch.cf sshd[6413]: Invalid user dennis from 192.144.230.221 port 44560
2020-07-06T03:49:48.662554abusebot-6.cloudsearch.cf sshd[6413]: Failed password for invalid user dennis from 192.144.230.221 port 44560 ssh2
2020-07-06T03:52:53.293414abusebot-6.cloudsearch.cf sshd[6434]: Invalid user jader from 192.144.230.221 port 46412
2020-07-06T03:52:53.298774abusebot-6.cloudsearch.cf sshd[6434]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.144.230.221
2020-07-06T03:52:53.293414abusebot-6.cloudsearch.cf sshd[6434]: Invalid user jader from 192.144.230.221 port 46412
2020-07-06T03:52:55.432862abusebot-6.cloudsearch.cf sshd[6434
...

Triggered by Fail2Ban at Ares web server

SSH Invalid Login

Failed password for invalid user shaca from 192.144.230.221 port 52788 ssh2

Jun 13 23:50:14 vps647732 sshd[1607]: Failed password for root from 192.144.230.221 port 52770 ssh2
...

Jun 13 05:13:47 askasleikir sshd[24042]: Failed password for invalid user admin from 192.144.230.221 port 58258 ssh2
Jun 13 04:55:56 askasleikir sshd[23319]: Failed password for invalid user wxj from 192.144.230.221 port 55364 ssh2
Jun 13 05:05:22 askasleikir sshd[23733]: Failed password for invalid user xautomation from 192.144.230.221 port 58646 ssh2

Unauthorized connection attempt detected from IP address 111.229.101.220 to port 2220 [J]

Unauthorized connection attempt detected from IP address 158.69.192.35 to port 2220 [J]

Feb  3 14:29:27 grey postfix/smtpd\[18785\]: NOQUEUE: reject: RCPT from unknown\[200.118.219.181\]: 554 5.7.1 Service unavailable\; Client host \[200.118.219.181\] blocked using dul.dnsbl.sorbs.net\; Dynamic IP Addresses See: http://www.sorbs.net/lookup.shtml\?200.118.219.181\; from=\ to=\ proto=ESMTP helo=\
...

...

Feb  3 15:08:01 localhost sshd\[29809\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.30.35  user=root
Feb  3 15:08:03 localhost sshd\[29809\]: Failed password for root from 222.186.30.35 port 18277 ssh2
Feb  3 15:08:05 localhost sshd\[29809\]: Failed password for root from 222.186.30.35 port 18277 ssh2

Feb  3 14:29:29 grey postfix/smtpd\[17319\]: NOQUEUE: reject: RCPT from unknown\[188.163.76.98\]: 554 5.7.1 Service unavailable\; Client host \[188.163.76.98\] blocked using cbl.abuseat.org\; Blocked - see http://www.abuseat.org/lookup.cgi\?ip=188.163.76.98\; from=\ to=\ proto=ESMTP helo=\<188-163-76-98.broadband.kyivstar.net\>
...

Feb  3 14:56:01 legacy sshd[11335]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.69.222
Feb  3 14:56:03 legacy sshd[11335]: Failed password for invalid user sb from 111.231.69.222 port 53074 ssh2
Feb  3 14:59:29 legacy sshd[11573]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.69.222
...

Feb  3 18:52:55 gw1 sshd[18355]: Failed password for root from 49.233.183.155 port 49526 ssh2
...

...

Telnet/23 MH Probe, BF, Hack -

Feb  3 14:59:33 v22018076622670303 sshd\[3102\]: Invalid user chinacat from 158.69.137.130 port 48578
Feb  3 14:59:33 v22018076622670303 sshd\[3102\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=158.69.137.130
Feb  3 14:59:35 v22018076622670303 sshd\[3102\]: Failed password for invalid user chinacat from 158.69.137.130 port 48578 ssh2
...

Feb  3 14:29:32 localhost sshd\[26050\]: Invalid user admin from 92.63.194.90 port 40000
Feb  3 14:29:32 localhost sshd\[26050\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.63.194.90
Feb  3 14:29:35 localhost sshd\[26050\]: Failed password for invalid user admin from 92.63.194.90 port 40000 ssh2

Honeypot attack, port: 445, PTR: PTR record not found

trying to access non-authorized port

Feb  3 14:29:31 MK-Soft-Root2 sshd[9183]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.156.203.3 
Feb  3 14:29:33 MK-Soft-Root2 sshd[9183]: Failed password for invalid user postmaster from 121.156.203.3 port 36862 ssh2
...