Jul 18 10:01:45 meumeu sshd[29786]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.198.86.24 
Jul 18 10:01:47 meumeu sshd[29786]: Failed password for invalid user account from 181.198.86.24 port 59587 ssh2
Jul 18 10:07:21 meumeu sshd[30773]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.198.86.24 
...

Automatic report - Port Scan Attack

Jul 18 10:02:14 mail sshd\[31803\]: Invalid user kun from 87.98.147.104 port 43442
Jul 18 10:02:14 mail sshd\[31803\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=87.98.147.104
Jul 18 10:02:15 mail sshd\[31803\]: Failed password for invalid user kun from 87.98.147.104 port 43442 ssh2
Jul 18 10:06:45 mail sshd\[32494\]: Invalid user rakesh from 87.98.147.104 port 42434
Jul 18 10:06:45 mail sshd\[32494\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=87.98.147.104

Jul 18 08:25:19 debian sshd\[9139\]: Invalid user bsd1 from 106.12.194.207 port 43610
Jul 18 08:25:19 debian sshd\[9139\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.194.207
...

Jul 18 10:30:21 srv-4 sshd\[8065\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=77.43.74.58  user=postgres
Jul 18 10:30:23 srv-4 sshd\[8065\]: Failed password for postgres from 77.43.74.58 port 35366 ssh2
Jul 18 10:35:18 srv-4 sshd\[8511\]: Invalid user cam from 77.43.74.58
Jul 18 10:35:18 srv-4 sshd\[8511\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=77.43.74.58
...

Jul 17 22:58:59 vps200512 sshd\[21674\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.141.139.23  user=root
Jul 17 22:59:02 vps200512 sshd\[21674\]: Failed password for root from 125.141.139.23 port 42376 ssh2
Jul 17 23:04:54 vps200512 sshd\[21849\]: Invalid user ts from 125.141.139.23
Jul 17 23:04:54 vps200512 sshd\[21849\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.141.139.23
Jul 17 23:04:56 vps200512 sshd\[21849\]: Failed password for invalid user ts from 125.141.139.23 port 41404 ssh2

Jul 18 02:23:38 aat-srv002 sshd[3092]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=220.130.221.140
Jul 18 02:23:40 aat-srv002 sshd[3092]: Failed password for invalid user alarm from 220.130.221.140 port 37152 ssh2
Jul 18 02:28:53 aat-srv002 sshd[3184]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=220.130.221.140
Jul 18 02:28:55 aat-srv002 sshd[3184]: Failed password for invalid user front from 220.130.221.140 port 60234 ssh2
...

Jul 18 09:38:37 vps691689 sshd[31600]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.216.250
Jul 18 09:38:40 vps691689 sshd[31600]: Failed password for invalid user video from 128.199.216.250 port 42632 ssh2
...

\[2019-07-18 03:11:26\] NOTICE\[20804\] chan_sip.c: Registration from '\' failed for '5.62.41.147:8272' - Wrong password
\[2019-07-18 03:11:26\] SECURITY\[20812\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-07-18T03:11:26.044-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="2586",SessionID="0x7f06f85ff978",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/5.62.41.147/58258",Challenge="4b8e131c",ReceivedChallenge="4b8e131c",ReceivedHash="b7122ebc69152df50d66984a5860eb2f"
\[2019-07-18 03:12:44\] NOTICE\[20804\] chan_sip.c: Registration from '\' failed for '5.62.41.147:8381' - Wrong password
\[2019-07-18 03:12:44\] SECURITY\[20812\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-07-18T03:12:44.475-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="2587",SessionID="0x7f06f878a398",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/5.62.41.147/6

Lines containing failures of 189.120.180.173
Jul 16 06:01:17 shared12 sshd[1673]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.120.180.173  user=r.r
Jul 16 06:01:19 shared12 sshd[1673]: Failed password for r.r from 189.120.180.173 port 60844 ssh2
Jul 16 06:01:27 shared12 sshd[1673]: message repeated 4 times: [ Failed password for r.r from 189.120.180.173 port 60844 ssh2]
Jul 16 06:01:30 shared12 sshd[1673]: Failed password for r.r from 189.120.180.173 port 60844 ssh2
Jul 16 06:01:30 shared12 sshd[1673]: error: maximum authentication attempts exceeded for r.r from 189.120.180.173 port 60844 ssh2 [preauth]
Jul 16 06:01:30 shared12 sshd[1673]: Disconnecting authenticating user r.r 189.120.180.173 port 60844: Too many authentication failures [preauth]
Jul 16 06:01:30 shared12 sshd[1673]: PAM 5 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.120.180.173  user=r.r


........
-----------------------------------------------
https://www.blockl

Automatic report - Port Scan Attack

Jul 18 06:56:39 localhost sshd\[43911\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.230.36.189  user=root
Jul 18 06:56:41 localhost sshd\[43911\]: Failed password for root from 157.230.36.189 port 41422 ssh2
...

Jul 18 09:18:41 rpi sshd[3394]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.70.182.185 
Jul 18 09:18:44 rpi sshd[3394]: Failed password for invalid user dwight from 118.70.182.185 port 65124 ssh2

Fail2Ban Ban Triggered

SSH Bruteforce @ SigaVPN honeypot