Feb 14 19:12:38 km20725 sshd[19500]: Invalid user mediafire from 192.34.63.43
Feb 14 19:12:38 km20725 sshd[19500]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.34.63.43
Feb 14 19:12:40 km20725 sshd[19500]: Failed password for invalid user mediafire from 192.34.63.43 port 49442 ssh2
Feb 14 19:12:40 km20725 sshd[19500]: Received disconnect from 192.34.63.43: 11: Bye Bye [preauth]
Feb 14 19:26:27 km20725 sshd[20118]: Invalid user adrc from 192.34.63.43
Feb 14 19:26:27 km20725 sshd[20118]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.34.63.43
Feb 14 19:26:29 km20725 sshd[20118]: Failed password for invalid user adrc from 192.34.63.43 port 46816 ssh2
Feb 14 19:26:29 km20725 sshd[20118]: Received disconnect from 192.34.63.43: 11: Bye Bye [preauth]
Feb 14 19:28:53 km20725 sshd[20169]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.34.63.43 ........
-------------------------------

Aug  4 06:35:23 mout sshd[9353]: Failed password for root from 192.34.63.128 port 45730 ssh2
Aug  4 06:35:21 mout sshd[9353]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.34.63.128  user=root
Aug  4 06:35:23 mout sshd[9353]: Failed password for root from 192.34.63.128 port 45730 ssh2

2020-07-28T05:49:54.695572shield sshd\[16198\]: Invalid user fangao from 192.34.63.128 port 47318
2020-07-28T05:49:54.704459shield sshd\[16198\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.34.63.128
2020-07-28T05:49:56.770820shield sshd\[16198\]: Failed password for invalid user fangao from 192.34.63.128 port 47318 ssh2
2020-07-28T05:53:44.998706shield sshd\[17681\]: Invalid user test_1 from 192.34.63.128 port 58280
2020-07-28T05:53:45.007863shield sshd\[17681\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.34.63.128

$f2bV_matches

Jul 24 10:50:14 server sshd[13170]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.34.63.128
Jul 24 10:50:16 server sshd[13170]: Failed password for invalid user andreas from 192.34.63.128 port 37112 ssh2
Jul 24 10:56:20 server sshd[14473]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.34.63.128
Jul 24 10:56:22 server sshd[14473]: Failed password for invalid user axente from 192.34.63.128 port 48974 ssh2

Cowrie Honeypot: 10 unauthorised SSH/Telnet login attempts between 2020-07-20T11:54:38Z and 2020-07-20T12:30:35Z

Invalid user petra from 192.34.63.128 port 48680

Jul 13 10:07:14 ift sshd\[64314\]: Invalid user zeus from 192.34.63.128Jul 13 10:07:16 ift sshd\[64314\]: Failed password for invalid user zeus from 192.34.63.128 port 46636 ssh2Jul 13 10:10:00 ift sshd\[64597\]: Invalid user update from 192.34.63.128Jul 13 10:10:01 ift sshd\[64597\]: Failed password for invalid user update from 192.34.63.128 port 42758 ssh2Jul 13 10:12:52 ift sshd\[65242\]: Invalid user yz from 192.34.63.128
...

Multiple SSH authentication failures from 192.34.63.128

Jun 29 06:51:27 marvibiene sshd[19488]: Invalid user natasha from 192.34.63.128 port 59630
Jun 29 06:51:27 marvibiene sshd[19488]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.34.63.128
Jun 29 06:51:27 marvibiene sshd[19488]: Invalid user natasha from 192.34.63.128 port 59630
Jun 29 06:51:30 marvibiene sshd[19488]: Failed password for invalid user natasha from 192.34.63.128 port 59630 ssh2
...

2020-06-26T12:44:15.758338dmca.cloudsearch.cf sshd[15143]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.34.63.128  user=root
2020-06-26T12:44:17.251528dmca.cloudsearch.cf sshd[15143]: Failed password for root from 192.34.63.128 port 56264 ssh2
2020-06-26T12:48:39.998601dmca.cloudsearch.cf sshd[15235]: Invalid user hua from 192.34.63.128 port 55854
2020-06-26T12:48:40.005024dmca.cloudsearch.cf sshd[15235]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.34.63.128
2020-06-26T12:48:39.998601dmca.cloudsearch.cf sshd[15235]: Invalid user hua from 192.34.63.128 port 55854
2020-06-26T12:48:42.210859dmca.cloudsearch.cf sshd[15235]: Failed password for invalid user hua from 192.34.63.128 port 55854 ssh2
2020-06-26T12:50:17.879385dmca.cloudsearch.cf sshd[15266]: Invalid user sentry from 192.34.63.128 port 56790
...

940. On Jun 20 2020 experienced a Brute Force SSH login attempt -> 56 unique times by 192.34.63.128.

Jun  7 08:33:04 MainVPS sshd[29245]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.34.63.128  user=root
Jun  7 08:33:06 MainVPS sshd[29245]: Failed password for root from 192.34.63.128 port 34360 ssh2
Jun  7 08:36:25 MainVPS sshd[32221]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.34.63.128  user=root
Jun  7 08:36:27 MainVPS sshd[32221]: Failed password for root from 192.34.63.128 port 38234 ssh2
Jun  7 08:39:40 MainVPS sshd[2533]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.34.63.128  user=root
Jun  7 08:39:43 MainVPS sshd[2533]: Failed password for root from 192.34.63.128 port 42106 ssh2
...

2020-06-02T09:48:19.510756dmca.cloudsearch.cf sshd[12912]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.34.63.128  user=root
2020-06-02T09:48:22.017283dmca.cloudsearch.cf sshd[12912]: Failed password for root from 192.34.63.128 port 52012 ssh2
2020-06-02T09:51:32.659569dmca.cloudsearch.cf sshd[13153]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.34.63.128  user=root
2020-06-02T09:51:34.327968dmca.cloudsearch.cf sshd[13153]: Failed password for root from 192.34.63.128 port 55920 ssh2
2020-06-02T09:54:44.054999dmca.cloudsearch.cf sshd[13385]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.34.63.128  user=root
2020-06-02T09:54:46.079933dmca.cloudsearch.cf sshd[13385]: Failed password for root from 192.34.63.128 port 59828 ssh2
2020-06-02T09:57:51.561327dmca.cloudsearch.cf sshd[13625]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 t
...

Jun  1 05:46:00 jane sshd[24700]: Failed password for root from 192.34.63.128 port 38350 ssh2
...

2020-05-26T17:41:15.314640homeassistant sshd[19706]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.34.63.128  user=root
2020-05-26T17:41:17.847110homeassistant sshd[19706]: Failed password for root from 192.34.63.128 port 43680 ssh2
...

Apr 25 20:15:24 ubuntu sshd[26950]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.166.23.63
Apr 25 20:15:26 ubuntu sshd[26950]: Failed password for invalid user jenkins from 111.166.23.63 port 6490 ssh2
Apr 25 20:18:28 ubuntu sshd[27015]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.166.23.63

2019-10-08T07:34:44.051571abusebot-5.cloudsearch.cf sshd\[368\]: Invalid user Motdepasse1@1 from 54.37.158.218 port 39552

2019-10-08T06:34:03.906358abusebot-5.cloudsearch.cf sshd\[32200\]: Invalid user robert from 218.150.220.202 port 35790

IP Ban Report : https://help-dysk.pl/wordpress-firewall-plugins/ip/78.178.177.85/ 
 TR - 1H : (68)  
 Protection Against DDoS WordPress plugin :  
 "odzyskiwanie danych help-dysk" 
 IP Address Ranges by Country : TR 
 NAME ASN : ASN9121 
 
 IP : 78.178.177.85 
 
 CIDR : 78.178.160.0/19 
 
 PREFIX COUNT : 4577 
 
 UNIQUE IP COUNT : 6868736 
 
 
 WYKRYTE ATAKI Z ASN9121 :  
  1H - 3 
  3H - 8 
  6H - 10 
 12H - 25 
 24H - 48 
 
 DateTime : 2019-10-08 05:50:36 
 
 INFO : Port Scan TELNET Detected and Blocked by ADMIN  - data recovery

Oct  8 14:04:36 server sshd\[18668\]: User root from 54.39.147.2 not allowed because listed in DenyUsers
Oct  8 14:04:36 server sshd\[18668\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.39.147.2  user=root
Oct  8 14:04:38 server sshd\[18668\]: Failed password for invalid user root from 54.39.147.2 port 60839 ssh2
Oct  8 14:08:51 server sshd\[4914\]: User root from 54.39.147.2 not allowed because listed in DenyUsers
Oct  8 14:08:51 server sshd\[4914\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.39.147.2  user=root

Oct  8 14:06:24 www sshd\[73669\]: Invalid user Nantes@123 from 14.18.93.114
Oct  8 14:06:24 www sshd\[73669\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.18.93.114
Oct  8 14:06:26 www sshd\[73669\]: Failed password for invalid user Nantes@123 from 14.18.93.114 port 50757 ssh2
...

2019-10-08T11:22:13.130448shield sshd\[11640\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.203.190.189  user=root
2019-10-08T11:22:14.869518shield sshd\[11640\]: Failed password for root from 159.203.190.189 port 39937 ssh2
2019-10-08T11:25:09.889808shield sshd\[12425\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.203.190.189  user=root
2019-10-08T11:25:12.124508shield sshd\[12425\]: Failed password for root from 159.203.190.189 port 57246 ssh2
2019-10-08T11:28:14.619203shield sshd\[13219\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.203.190.189  user=root

Oct  7 18:40:47 our-server-hostname postfix/smtpd[7107]: connect from unknown[94.176.236.5]
Oct  7 18:40:48 our-server-hostname sqlgrey: grey: new: 94.176.236.5(94.176.236.5), x@x -> x@x
Oct  7 18:40:49 our-server-hostname postfix/policy-spf[20640]: : Policy action=PREPEND Received-SPF: none (secsuremail.com: No applicable sender policy available) receiver=x@x
Oct x@x
Oct  7 18:40:49 our-server-hostname postfix/smtpd[710
.... truncated .... 
3]: x@x
Oct  7 22:03:47 our-server-hostname postfix/smtpd[6563]: disconnect from unknown[94.176.236.5]
Oct  7 22:03:51 our-server-hostname postfix/smtpd[24638]: connect from unknown[94.176.236.5]
Oct  7 22:03:52 our-server-hostname postfix/smtpd[24733]: connect from unknown[94.176.236.5]
Oct  7 22:03:52 our-server-hostname sqlgrey: grey: throttling: 94.176.236.5(94.176.236.5), x@x -> x@x
Oct  7 22:03:52 our-server-hostname postfix/policy-spf[25724]: : Policy action=PREPEND Received-SPF: none (secsuremail.com: No applicable sender po........
-------------------------------

SSH bruteforce (Triggered fail2ban)

Apr 16 20:24:46 ubuntu sshd[27085]: Failed password for root from 111.123.76.75 port 52997 ssh2
Apr 16 20:24:49 ubuntu sshd[27085]: Failed password for root from 111.123.76.75 port 52997 ssh2
Apr 16 20:24:51 ubuntu sshd[27085]: Failed password for root from 111.123.76.75 port 52997 ssh2
Apr 16 20:24:53 ubuntu sshd[27085]: Failed password for root from 111.123.76.75 port 52997 ssh2

Apr 12 21:10:31 ubuntu sshd[28703]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.202.35
Apr 12 21:10:33 ubuntu sshd[28703]: Failed password for invalid user abey from 178.128.202.35 port 52112 ssh2
Apr 12 21:16:32 ubuntu sshd[28845]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.202.35

firewall-block, port(s): 8081/tcp, 8888/tcp

08.10.2019 11:01:34 Recursive DNS scan

May  2 22:19:23 ubuntu sshd[20219]: Failed password for invalid user lv from 111.12.52.188 port 58352 ssh2
May  2 22:23:49 ubuntu sshd[20374]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.12.52.188
May  2 22:23:51 ubuntu sshd[20374]: Failed password for invalid user sha from 111.12.52.188 port 58214 ssh2
May  2 22:28:03 ubuntu sshd[20501]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.12.52.188

\[2019-10-08 02:14:56\] NOTICE\[1887\] chan_sip.c: Registration from '"705" \' failed for '51.79.81.223:5995' - Wrong password
\[2019-10-08 02:14:56\] SECURITY\[1898\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-10-08T02:14:56.934-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="705",SessionID="0x7fc3ac2ed548",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/51.79.81.223/5995",Challenge="321becce",ReceivedChallenge="321becce",ReceivedHash="7e7893c79607355203195e78a162d252"
\[2019-10-08 02:14:56\] NOTICE\[1887\] chan_sip.c: Registration from '"705" \' failed for '51.79.81.223:5995' - Wrong password
\[2019-10-08 02:14:56\] SECURITY\[1898\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-10-08T02:14:56.992-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="705",SessionID="0x7fc3ac00c388",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/51.79.8