Oct 28 19:37:05 hanapaa sshd\[29254\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.72.238.178  user=root
Oct 28 19:37:07 hanapaa sshd\[29254\]: Failed password for root from 201.72.238.178 port 29130 ssh2
Oct 28 19:42:13 hanapaa sshd\[29742\]: Invalid user contabil from 201.72.238.178
Oct 28 19:42:13 hanapaa sshd\[29742\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.72.238.178
Oct 28 19:42:15 hanapaa sshd\[29742\]: Failed password for invalid user contabil from 201.72.238.178 port 47321 ssh2

Sep 26 07:54:58 pornomens sshd\[4100\]: Invalid user trobz from 201.72.238.178 port 33638
Sep 26 07:54:58 pornomens sshd\[4100\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.72.238.178
Sep 26 07:55:00 pornomens sshd\[4100\]: Failed password for invalid user trobz from 201.72.238.178 port 33638 ssh2
...

SSH Bruteforce attempt

Sep 19 16:38:00 hpm sshd\[27198\]: Invalid user user from 201.72.238.178
Sep 19 16:38:00 hpm sshd\[27198\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.72.238.178
Sep 19 16:38:02 hpm sshd\[27198\]: Failed password for invalid user user from 201.72.238.178 port 55028 ssh2
Sep 19 16:43:22 hpm sshd\[27780\]: Invalid user amaina from 201.72.238.178
Sep 19 16:43:22 hpm sshd\[27780\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.72.238.178

$f2bV_matches

Invalid user giannetti from 201.72.238.179 port 1820

Invalid user yoyo from 201.72.238.179 port 10802

Dec 22 05:45:52 legacy sshd[2468]: Failed password for root from 201.72.238.179 port 49144 ssh2
Dec 22 05:55:03 legacy sshd[2841]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.72.238.179
Dec 22 05:55:05 legacy sshd[2841]: Failed password for invalid user kun from 201.72.238.179 port 29440 ssh2
...

Dec 17 23:14:39 server sshd\[5810\]: Invalid user eteminan from 201.72.238.179
Dec 17 23:14:39 server sshd\[5810\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.72.238.179 
Dec 17 23:14:40 server sshd\[5810\]: Failed password for invalid user eteminan from 201.72.238.179 port 15225 ssh2
Dec 17 23:20:46 server sshd\[7864\]: Invalid user canacint from 201.72.238.179
Dec 17 23:20:46 server sshd\[7864\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.72.238.179 
...

Unauthorized connection attempt detected from IP address 201.72.238.179 to port 22

Dec 11 19:53:17 kapalua sshd\[16434\]: Invalid user royer from 201.72.238.179
Dec 11 19:53:17 kapalua sshd\[16434\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.72.238.179
Dec 11 19:53:19 kapalua sshd\[16434\]: Failed password for invalid user royer from 201.72.238.179 port 43943 ssh2
Dec 11 20:00:16 kapalua sshd\[17111\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.72.238.179  user=root
Dec 11 20:00:18 kapalua sshd\[17111\]: Failed password for root from 201.72.238.179 port 38265 ssh2

2019-12-09T08:40:38.025887abusebot-8.cloudsearch.cf sshd\[31935\]: Invalid user lene from 201.72.238.179 port 33840

Dec  7 15:16:15 microserver sshd[2651]: Invalid user cray from 201.72.238.179 port 53476
Dec  7 15:16:15 microserver sshd[2651]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.72.238.179
Dec  7 15:16:17 microserver sshd[2651]: Failed password for invalid user cray from 201.72.238.179 port 53476 ssh2
Dec  7 15:23:13 microserver sshd[3573]: Invalid user phyto2123 from 201.72.238.179 port 4528
Dec  7 15:23:13 microserver sshd[3573]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.72.238.179
Dec  7 15:36:56 microserver sshd[5719]: Invalid user balduin from 201.72.238.179 port 51230
Dec  7 15:36:56 microserver sshd[5719]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.72.238.179
Dec  7 15:36:58 microserver sshd[5719]: Failed password for invalid user balduin from 201.72.238.179 port 51230 ssh2
Dec  7 15:43:56 microserver sshd[6629]: Invalid user janney from 201.72.238.179 port 24780

Dec  4 21:05:54 web1 sshd\[16600\]: Invalid user mahon from 201.72.238.179
Dec  4 21:05:54 web1 sshd\[16600\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.72.238.179
Dec  4 21:05:56 web1 sshd\[16600\]: Failed password for invalid user mahon from 201.72.238.179 port 24544 ssh2
Dec  4 21:13:13 web1 sshd\[17371\]: Invalid user politic from 201.72.238.179
Dec  4 21:13:13 web1 sshd\[17371\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.72.238.179

Nov 19 14:19:53 legacy sshd[17962]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.72.238.179
Nov 19 14:19:55 legacy sshd[17962]: Failed password for invalid user table from 201.72.238.179 port 34565 ssh2
Nov 19 14:24:51 legacy sshd[18084]: Failed password for root from 201.72.238.179 port 6446 ssh2
...

Nov  8 23:39:12 cvbnet sshd[24315]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.72.238.179 
Nov  8 23:39:14 cvbnet sshd[24315]: Failed password for invalid user jboss from 201.72.238.179 port 62354 ssh2
...

Oct  8 14:59:17 * sshd[24686]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.72.238.180
Oct  8 14:59:19 * sshd[24686]: Failed password for invalid user 123Winter from 201.72.238.180 port 20873 ssh2

Oct  7 14:59:28 echo390 sshd[24289]: Failed password for root from 201.72.238.180 port 33459 ssh2
Oct  7 15:04:46 echo390 sshd[26921]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.72.238.180  user=root
Oct  7 15:04:48 echo390 sshd[26921]: Failed password for root from 201.72.238.180 port 2363 ssh2
Oct  7 15:09:59 echo390 sshd[28415]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.72.238.180  user=root
Oct  7 15:10:01 echo390 sshd[28415]: Failed password for root from 201.72.238.180 port 11626 ssh2
...

Oct  7 01:07:18 php1 sshd\[3192\]: Invalid user Alain2016 from 201.72.238.180
Oct  7 01:07:18 php1 sshd\[3192\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.72.238.180
Oct  7 01:07:20 php1 sshd\[3192\]: Failed password for invalid user Alain2016 from 201.72.238.180 port 11998 ssh2
Oct  7 01:12:36 php1 sshd\[3758\]: Invalid user Qwerty@6 from 201.72.238.180
Oct  7 01:12:36 php1 sshd\[3758\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.72.238.180

Oct 10 09:04:37 jane sshd[21675]: Failed password for root from 82.117.190.170 port 43935 ssh2
...

Oct  6 18:16:58 km20725 sshd[32186]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.18.216  user=r.r
Oct  6 18:17:00 km20725 sshd[32186]: Failed password for r.r from 148.70.18.216 port 42144 ssh2
Oct  6 18:17:01 km20725 sshd[32186]: Received disconnect from 148.70.18.216: 11: Bye Bye [preauth]
Oct  6 18:24:09 km20725 sshd[32594]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.18.216  user=r.r
Oct  6 18:24:12 km20725 sshd[32594]: Failed password for r.r from 148.70.18.216 port 59502 ssh2
Oct  6 18:24:12 km20725 sshd[32594]: Received disconnect from 148.70.18.216: 11: Bye Bye [preauth]
Oct  6 18:42:32 km20725 sshd[1857]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.18.216  user=r.r
Oct  6 1
.... truncated .... 

Oct  6 18:16:58 km20725 sshd[32186]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser........
-------------------------------

Oct 10 09:51:29 [munged] sshd[29004]: Failed password for root from 106.12.12.7 port 52860 ssh2

2019-10-10T03:49:53.421896abusebot-2.cloudsearch.cf sshd\[11184\]: Invalid user Admin@2010 from 213.32.65.111 port 56992

Oct 10 04:07:53 www_kotimaassa_fi sshd[32440]: Failed password for root from 203.110.90.195 port 59791 ssh2
...

Oct 10 09:59:01 rotator sshd\[15970\]: Failed password for root from 192.42.116.22 port 56582 ssh2Oct 10 09:59:04 rotator sshd\[15970\]: Failed password for root from 192.42.116.22 port 56582 ssh2Oct 10 09:59:07 rotator sshd\[15970\]: Failed password for root from 192.42.116.22 port 56582 ssh2Oct 10 09:59:10 rotator sshd\[15970\]: Failed password for root from 192.42.116.22 port 56582 ssh2Oct 10 09:59:13 rotator sshd\[15970\]: Failed password for root from 192.42.116.22 port 56582 ssh2Oct 10 09:59:16 rotator sshd\[15970\]: Failed password for root from 192.42.116.22 port 56582 ssh2
...

Oct 10 09:04:01 sso sshd[24322]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=196.28.236.5
Oct 10 09:04:03 sso sshd[24322]: Failed password for invalid user Salve2017 from 196.28.236.5 port 45720 ssh2
...

Oct 10 10:09:46 tux-35-217 sshd\[26903\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.180.17  user=root
Oct 10 10:09:48 tux-35-217 sshd\[26903\]: Failed password for root from 222.186.180.17 port 34614 ssh2
Oct 10 10:09:52 tux-35-217 sshd\[26903\]: Failed password for root from 222.186.180.17 port 34614 ssh2
Oct 10 10:09:57 tux-35-217 sshd\[26903\]: Failed password for root from 222.186.180.17 port 34614 ssh2
...

10/10/2019-08:55:41.748773 76.17.44.218 Protocol: 6 ET CINS Active Threat Intelligence Poor Reputation IP group 73

Oct 10 06:12:35 herz-der-gamer sshd[27270]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.114.55.84  user=root
Oct 10 06:12:37 herz-der-gamer sshd[27270]: Failed password for root from 167.114.55.84 port 43502 ssh2
Oct 10 06:26:13 herz-der-gamer sshd[27591]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.114.55.84  user=root
Oct 10 06:26:15 herz-der-gamer sshd[27591]: Failed password for root from 167.114.55.84 port 54524 ssh2
...

2019-10-07T03:53:19.1583941495-001 sshd[8704]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.150.162.146  user=r.r
2019-10-07T03:53:21.3159661495-001 sshd[8704]: Failed password for r.r from 80.150.162.146 port 57809 ssh2
2019-10-07T04:15:16.1541461495-001 sshd[10572]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.150.162.146  user=r.r
2019-10-07T04:15:18.1115011495-001 sshd[10572]: Failed password for r.r from 80.150.162.146 port 58805 ssh2
2019-10-07T04:21:00.8805191495-001 sshd[11106]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.150.162.146  user=r.r
2019-10-07T04:21:02.7320011495-001 sshd[11106]: Failed password for r.r from 80.150.162.146 port 57958 ssh2

........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=80.150.162.146

Oct 10 09:32:04 server sshd\[24582\]: Invalid user Rodrigo@321 from 167.71.228.9 port 41576
Oct 10 09:32:04 server sshd\[24582\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.228.9
Oct 10 09:32:06 server sshd\[24582\]: Failed password for invalid user Rodrigo@321 from 167.71.228.9 port 41576 ssh2
Oct 10 09:36:44 server sshd\[9442\]: Invalid user 123Studio from 167.71.228.9 port 53696
Oct 10 09:36:44 server sshd\[9442\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.228.9

Lines containing failures of 139.59.7.251
Oct  7 03:53:20 shared07 sshd[17698]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.7.251  user=r.r
Oct  7 03:53:22 shared07 sshd[17698]: Failed password for r.r from 139.59.7.251 port 29979 ssh2
Oct  7 03:53:22 shared07 sshd[17698]: Received disconnect from 139.59.7.251 port 29979:11: Bye Bye [preauth]
Oct  7 03:53:22 shared07 sshd[17698]: Disconnected from authenticating user r.r 139.59.7.251 port 29979 [preauth]
Oct  7 04:25:25 shared07 sshd[31646]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.7.251  user=r.r
Oct  7 04:25:27 shared07 sshd[31646]: Failed password for r.r from 139.59.7.251 port 39637 ssh2
Oct  7 04:25:27 shared07 sshd[31646]: Received disconnect from 139.59.7.251 port 39637:11: Bye Bye [preauth]
Oct  7 04:25:27 shared07 sshd[31646]: Disconnected from authenticating user r.r 139.59.7.251 port 39637 [preauth]
Oct  7 ........
------------------------------

SPF Fail sender not permitted to send mail for @mundivox.com / Sent mail to target address hacked/leaked from abandonia in 2016

Scanning random ports - tries to find possible vulnerable services