Aug 16 19:22:52 h2646465 sshd[28247]: Invalid user dita from 200.169.6.202
Aug 16 19:22:52 h2646465 sshd[28247]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.169.6.202
Aug 16 19:22:52 h2646465 sshd[28247]: Invalid user dita from 200.169.6.202
Aug 16 19:22:53 h2646465 sshd[28247]: Failed password for invalid user dita from 200.169.6.202 port 43340 ssh2
Aug 16 19:29:57 h2646465 sshd[28910]: Invalid user share from 200.169.6.202
Aug 16 19:29:57 h2646465 sshd[28910]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.169.6.202
Aug 16 19:29:57 h2646465 sshd[28910]: Invalid user share from 200.169.6.202
Aug 16 19:30:00 h2646465 sshd[28910]: Failed password for invalid user share from 200.169.6.202 port 60833 ssh2
Aug 16 19:34:39 h2646465 sshd[29534]: Invalid user virgilio from 200.169.6.202
...

Jul  4 23:42:25 vps639187 sshd\[11754\]: Invalid user wg from 200.169.6.202 port 41394
Jul  4 23:42:25 vps639187 sshd\[11754\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.169.6.202
Jul  4 23:42:27 vps639187 sshd\[11754\]: Failed password for invalid user wg from 200.169.6.202 port 41394 ssh2
...

2020-06-25T07:57:32.365164mail.csmailer.org sshd[5061]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.169.6.202
2020-06-25T07:57:32.362205mail.csmailer.org sshd[5061]: Invalid user ubuntu from 200.169.6.202 port 36098
2020-06-25T07:57:34.638637mail.csmailer.org sshd[5061]: Failed password for invalid user ubuntu from 200.169.6.202 port 36098 ssh2
2020-06-25T08:01:35.567218mail.csmailer.org sshd[6111]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.169.6.202  user=root
2020-06-25T08:01:37.866048mail.csmailer.org sshd[6111]: Failed password for root from 200.169.6.202 port 35772 ssh2
...

Jun 23 09:31:05 mellenthin sshd[15607]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.169.6.202
Jun 23 09:31:07 mellenthin sshd[15607]: Failed password for invalid user team1 from 200.169.6.202 port 60799 ssh2

Automatic report - SSH Brute-Force Attack

Apr 10 05:15:05 *** sshd[13744]: Invalid user postgres from 200.169.6.202

Apr  8 17:10:00 ns392434 sshd[5276]: Invalid user das from 200.169.6.202 port 55961
Apr  8 17:10:00 ns392434 sshd[5276]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.169.6.202
Apr  8 17:10:00 ns392434 sshd[5276]: Invalid user das from 200.169.6.202 port 55961
Apr  8 17:10:03 ns392434 sshd[5276]: Failed password for invalid user das from 200.169.6.202 port 55961 ssh2
Apr  8 17:18:38 ns392434 sshd[5464]: Invalid user admin from 200.169.6.202 port 50612
Apr  8 17:18:38 ns392434 sshd[5464]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.169.6.202
Apr  8 17:18:38 ns392434 sshd[5464]: Invalid user admin from 200.169.6.202 port 50612
Apr  8 17:18:40 ns392434 sshd[5464]: Failed password for invalid user admin from 200.169.6.202 port 50612 ssh2
Apr  8 17:22:34 ns392434 sshd[5548]: Invalid user tester from 200.169.6.202 port 50105

Apr  6 19:48:39 *** sshd[21632]: Invalid user craig from 200.169.6.202

Oct 8 02:03:34 *hidden* sshd[19302]: Failed password for *hidden* from 200.169.6.206 port 46503 ssh2 Oct 8 02:07:32 *hidden* sshd[21213]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.169.6.206 user=root Oct 8 02:07:35 *hidden* sshd[21213]: Failed password for *hidden* from 200.169.6.206 port 44412 ssh2

Oct 8 02:03:34 *hidden* sshd[19302]: Failed password for *hidden* from 200.169.6.206 port 46503 ssh2 Oct 8 02:07:32 *hidden* sshd[21213]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.169.6.206 user=root Oct 8 02:07:35 *hidden* sshd[21213]: Failed password for *hidden* from 200.169.6.206 port 44412 ssh2

Oct 8 02:03:34 *hidden* sshd[19302]: Failed password for *hidden* from 200.169.6.206 port 46503 ssh2 Oct 8 02:07:32 *hidden* sshd[21213]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.169.6.206 user=root Oct 8 02:07:35 *hidden* sshd[21213]: Failed password for *hidden* from 200.169.6.206 port 44412 ssh2

Oct  9 18:05:49 dhoomketu sshd[3696194]: Failed password for root from 200.169.6.206 port 42271 ssh2
Oct  9 18:09:30 dhoomketu sshd[3696347]: Invalid user radvd from 200.169.6.206 port 39439
Oct  9 18:09:31 dhoomketu sshd[3696347]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.169.6.206 
Oct  9 18:09:30 dhoomketu sshd[3696347]: Invalid user radvd from 200.169.6.206 port 39439
Oct  9 18:09:33 dhoomketu sshd[3696347]: Failed password for invalid user radvd from 200.169.6.206 port 39439 ssh2
...

Oct  9 04:28:45 ns41 sshd[13696]: Failed password for root from 200.169.6.206 port 53270 ssh2
Oct  9 04:28:45 ns41 sshd[13696]: Failed password for root from 200.169.6.206 port 53270 ssh2

vps:sshd-InvalidUser

Connection to SSH Honeypot - Detected by HoneypotDB

2020-08-06T16:49:56.726225ns386461 sshd\[26188\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.169.6.206  user=root
2020-08-06T16:49:58.958506ns386461 sshd\[26188\]: Failed password for root from 200.169.6.206 port 46416 ssh2
2020-08-06T17:06:02.281842ns386461 sshd\[9282\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.169.6.206  user=root
2020-08-06T17:06:04.127795ns386461 sshd\[9282\]: Failed password for root from 200.169.6.206 port 55337 ssh2
2020-08-06T17:10:55.636404ns386461 sshd\[13830\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.169.6.206  user=root
...

Aug  3 17:09:55 jane sshd[7747]: Failed password for root from 200.169.6.206 port 53611 ssh2
...

Jul 21 11:56:45 vps647732 sshd[14223]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.169.6.206
Jul 21 11:56:46 vps647732 sshd[14223]: Failed password for invalid user renuka from 200.169.6.206 port 40371 ssh2
...

Jul 10 15:14:49 lnxmysql61 sshd[10015]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.169.6.206

Jun 13 07:56:07 electroncash sshd[5378]: Invalid user tsingsoon from 200.169.6.204 port 54141
Jun 13 07:56:07 electroncash sshd[5378]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.169.6.204 
Jun 13 07:56:07 electroncash sshd[5378]: Invalid user tsingsoon from 200.169.6.204 port 54141
Jun 13 07:56:09 electroncash sshd[5378]: Failed password for invalid user tsingsoon from 200.169.6.204 port 54141 ssh2
Jun 13 07:59:35 electroncash sshd[6251]: Invalid user oracle from 200.169.6.204 port 49219
...

May 27 06:23:06 vps639187 sshd\[29730\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.169.6.204  user=root
May 27 06:23:07 vps639187 sshd\[29730\]: Failed password for root from 200.169.6.204 port 56787 ssh2
May 27 06:24:43 vps639187 sshd\[29753\]: Invalid user admin from 200.169.6.204 port 39000
May 27 06:24:43 vps639187 sshd\[29753\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.169.6.204
...

SSH login attempts.

$f2bV_matches

Dec 25 01:39:52 mc1 kernel: \[1393193.611171\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:11:a9:7b:d2:74:7f:6e:37:e3:08:00 SRC=45.136.108.116 DST=159.69.205.51 LEN=40 TOS=0x00 PREC=0x00 TTL=245 ID=58509 PROTO=TCP SPT=47415 DPT=7350 WINDOW=1024 RES=0x00 SYN URGP=0 
Dec 25 01:42:00 mc1 kernel: \[1393321.261259\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:11:a9:7b:d2:74:7f:6e:37:e3:08:00 SRC=45.136.108.116 DST=159.69.205.51 LEN=40 TOS=0x00 PREC=0x00 TTL=245 ID=38320 PROTO=TCP SPT=47415 DPT=7385 WINDOW=1024 RES=0x00 SYN URGP=0 
Dec 25 01:45:54 mc1 kernel: \[1393555.663760\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:11:a9:7b:d2:74:7f:6e:37:e3:08:00 SRC=45.136.108.116 DST=159.69.205.51 LEN=40 TOS=0x00 PREC=0x00 TTL=245 ID=9252 PROTO=TCP SPT=47415 DPT=1170 WINDOW=1024 RES=0x00 SYN URGP=0 
...

Automatic report - Banned IP Access

Dec 24 18:12:01 eola postfix/smtpd[17948]: warning: hostname 172.2.90.117.broad.zj.js.dynamic.163data.com.cn does not resolve to address 117.90.2.172: Name or service not known
Dec 24 18:12:01 eola postfix/smtpd[17948]: connect from unknown[117.90.2.172]
Dec 24 18:12:02 eola postfix/smtpd[17948]: lost connection after AUTH from unknown[117.90.2.172]
Dec 24 18:12:02 eola postfix/smtpd[17948]: disconnect from unknown[117.90.2.172] ehlo=1 auth=0/1 commands=1/2
Dec 24 18:12:02 eola postfix/smtpd[17948]: warning: hostname 172.2.90.117.broad.zj.js.dynamic.163data.com.cn does not resolve to address 117.90.2.172: Name or service not known
Dec 24 18:12:02 eola postfix/smtpd[17948]: connect from unknown[117.90.2.172]
Dec 24 18:12:03 eola postfix/smtpd[17948]: lost connection after AUTH from unknown[117.90.2.172]
Dec 24 18:12:03 eola postfix/smtpd[17948]: disconnect from unknown[117.90.2.172] ehlo=1 auth=0/1 commands=1/2
Dec 24 18:12:22 eola postfix/smtpd[17948]: warning: hostname........
-------------------------------

Automatic report - XMLRPC Attack

MultiHost/MultiPort Probe, Scan, Hack -

Dec 25 06:08:50 root sshd[12797]: Failed password for root from 222.186.180.8 port 65532 ssh2
Dec 25 06:08:54 root sshd[12797]: Failed password for root from 222.186.180.8 port 65532 ssh2
Dec 25 06:09:06 root sshd[12844]: Failed password for root from 222.186.180.8 port 1194 ssh2
...

Unauthorized connection attempt detected from IP address 106.13.181.68 to port 22

Dec 25 01:35:37 v22018076622670303 sshd\[23159\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.175.155  user=root
Dec 25 01:35:39 v22018076622670303 sshd\[23159\]: Failed password for root from 222.186.175.155 port 60102 ssh2
Dec 25 01:35:42 v22018076622670303 sshd\[23159\]: Failed password for root from 222.186.175.155 port 60102 ssh2
...

Dec 25 06:09:03 meumeu sshd[25313]: Failed password for root from 222.186.175.169 port 28852 ssh2
Dec 25 06:09:23 meumeu sshd[25313]: error: maximum authentication attempts exceeded for root from 222.186.175.169 port 28852 ssh2 [preauth]
Dec 25 06:09:42 meumeu sshd[25440]: Failed password for root from 222.186.175.169 port 63718 ssh2
...

Dec 25 01:07:28 51-15-180-239 sshd[1056]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.183.236.29  user=root
Dec 25 01:07:31 51-15-180-239 sshd[1056]: Failed password for root from 68.183.236.29 port 59122 ssh2
...

Dec 24 21:38:55 vps46666688 sshd[21976]: Failed password for root from 223.71.139.98 port 58112 ssh2
Dec 24 21:45:50 vps46666688 sshd[22290]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=223.71.139.98
...

ssh failed login

Dec 25 01:20:01 vpn01 sshd[6676]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.99.83.237
Dec 25 01:20:03 vpn01 sshd[6676]: Failed password for invalid user home from 167.99.83.237 port 44180 ssh2
...

Auto reported by IDS

Dec 25 01:52:17 icinga sshd[17032]: Failed password for root from 222.186.173.215 port 1176 ssh2
Dec 25 01:52:29 icinga sshd[17032]: error: maximum authentication attempts exceeded for root from 222.186.173.215 port 1176 ssh2 [preauth]
...