Aug 11 01:03:30 vps691689 sshd[9650]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.45.147.17
Aug 11 01:03:33 vps691689 sshd[9650]: Failed password for invalid user ftpuser from 202.45.147.17 port 42989 ssh2
...

Aug 10 05:48:40 MK-Soft-Root1 sshd\[2040\]: Invalid user unicorn from 202.45.147.17 port 43683
Aug 10 05:48:40 MK-Soft-Root1 sshd\[2040\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.45.147.17
Aug 10 05:48:42 MK-Soft-Root1 sshd\[2040\]: Failed password for invalid user unicorn from 202.45.147.17 port 43683 ssh2
...

Aug  8 23:44:45 mail1 sshd\[20033\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.45.147.17  user=root
Aug  8 23:44:47 mail1 sshd\[20033\]: Failed password for root from 202.45.147.17 port 39786 ssh2
Aug  8 23:54:56 mail1 sshd\[24561\]: Invalid user Ionut from 202.45.147.17 port 40578
Aug  8 23:54:56 mail1 sshd\[24561\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.45.147.17
Aug  8 23:54:58 mail1 sshd\[24561\]: Failed password for invalid user Ionut from 202.45.147.17 port 40578 ssh2
...

Aug  6 03:32:18 legacy sshd[17415]: Failed password for root from 202.45.147.17 port 53046 ssh2
Aug  6 03:36:54 legacy sshd[17503]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.45.147.17
Aug  6 03:36:57 legacy sshd[17503]: Failed password for invalid user dev from 202.45.147.17 port 50168 ssh2
...

Aug  1 08:52:05 www4 sshd\[31730\]: Invalid user bluecore from 202.45.147.17
Aug  1 08:52:05 www4 sshd\[31730\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.45.147.17
Aug  1 08:52:07 www4 sshd\[31730\]: Failed password for invalid user bluecore from 202.45.147.17 port 39208 ssh2
Aug  1 08:56:52 www4 sshd\[32208\]: Invalid user him from 202.45.147.17
Aug  1 08:56:52 www4 sshd\[32208\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.45.147.17
...

Jul 31 20:39:50 vps691689 sshd[30777]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.45.147.17
Jul 31 20:39:53 vps691689 sshd[30777]: Failed password for invalid user lacey from 202.45.147.17 port 57205 ssh2
...

SSH invalid-user multiple login try

Jul 27 00:56:51 vps200512 sshd\[13947\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.45.147.17  user=mysql
Jul 27 00:56:53 vps200512 sshd\[13947\]: Failed password for mysql from 202.45.147.17 port 52429 ssh2
Jul 27 01:01:55 vps200512 sshd\[14032\]: Invalid user linas from 202.45.147.17
Jul 27 01:01:55 vps200512 sshd\[14032\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.45.147.17
Jul 27 01:01:57 vps200512 sshd\[14032\]: Failed password for invalid user linas from 202.45.147.17 port 50684 ssh2

Jul 27 00:17:00 vps200512 sshd\[13202\]: Invalid user bocloud from 202.45.147.17
Jul 27 00:17:00 vps200512 sshd\[13202\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.45.147.17
Jul 27 00:17:02 vps200512 sshd\[13202\]: Failed password for invalid user bocloud from 202.45.147.17 port 38165 ssh2
Jul 27 00:22:03 vps200512 sshd\[13275\]: Invalid user alex from 202.45.147.17
Jul 27 00:22:03 vps200512 sshd\[13275\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.45.147.17

Jul 26 11:51:42 vps200512 sshd\[31687\]: Invalid user support from 202.45.147.17
Jul 26 11:51:42 vps200512 sshd\[31687\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.45.147.17
Jul 26 11:51:44 vps200512 sshd\[31687\]: Failed password for invalid user support from 202.45.147.17 port 52690 ssh2
Jul 26 11:56:38 vps200512 sshd\[31821\]: Invalid user rama from 202.45.147.17
Jul 26 11:56:38 vps200512 sshd\[31821\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.45.147.17

Invalid user lx from 202.45.147.118 port 36702

SSH invalid-user multiple login attempts

2020-09-28T01:43:40.060550xentho-1 sshd[1051434]: Invalid user admin from 202.45.147.118 port 49480
2020-09-28T01:43:41.799340xentho-1 sshd[1051434]: Failed password for invalid user admin from 202.45.147.118 port 49480 ssh2
2020-09-28T01:46:02.205494xentho-1 sshd[1051458]: Invalid user myftp from 202.45.147.118 port 34074
2020-09-28T01:46:02.211890xentho-1 sshd[1051458]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.45.147.118
2020-09-28T01:46:02.205494xentho-1 sshd[1051458]: Invalid user myftp from 202.45.147.118 port 34074
2020-09-28T01:46:04.104614xentho-1 sshd[1051458]: Failed password for invalid user myftp from 202.45.147.118 port 34074 ssh2
2020-09-28T01:48:18.547620xentho-1 sshd[1051472]: Invalid user dcadmin from 202.45.147.118 port 46893
2020-09-28T01:48:18.555271xentho-1 sshd[1051472]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.45.147.118
2020-09-28T01:48:18.547620xentho-1 sshd[10
...

$f2bV_matches

frenzy

Nov 25 01:03:10 mout sshd[26749]: Invalid user briski from 202.45.147.125 port 55466

Invalid user bulgaria from 202.45.147.125 port 44874
pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.45.147.125
Failed password for invalid user bulgaria from 202.45.147.125 port 44874 ssh2
Invalid user zatoichi from 202.45.147.125 port 34834
pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.45.147.125

Nov  5 16:03:02 localhost sshd\[13165\]: Invalid user samuel1 from 202.45.147.125
Nov  5 16:03:02 localhost sshd\[13165\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.45.147.125
Nov  5 16:03:04 localhost sshd\[13165\]: Failed password for invalid user samuel1 from 202.45.147.125 port 40474 ssh2
Nov  5 16:06:26 localhost sshd\[13436\]: Invalid user 1003 from 202.45.147.125
Nov  5 16:06:26 localhost sshd\[13436\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.45.147.125
...

Automatic report - Banned IP Access

Oct 29 04:43:15 anodpoucpklekan sshd[64380]: Invalid user Juhana from 202.45.147.125 port 40030
...

$f2bV_matches

Oct 11 04:44:05 wbs sshd\[19067\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.45.147.125  user=root
Oct 11 04:44:07 wbs sshd\[19067\]: Failed password for root from 202.45.147.125 port 45838 ssh2
Oct 11 04:48:16 wbs sshd\[19412\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.45.147.125  user=root
Oct 11 04:48:17 wbs sshd\[19412\]: Failed password for root from 202.45.147.125 port 36290 ssh2
Oct 11 04:52:32 wbs sshd\[19797\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.45.147.125  user=root

F2B jail: sshd. Time: 2019-10-01 00:31:27, Reported by: VKReport

Sep 16 21:21:24 core sshd[27328]: Invalid user Administrator from 202.45.147.125 port 59673
Sep 16 21:21:26 core sshd[27328]: Failed password for invalid user Administrator from 202.45.147.125 port 59673 ssh2
...

Automated report - ssh fail2ban:
Sep 16 01:18:25 authentication failure 
Sep 16 01:18:27 wrong password, user=wesley, port=52274, ssh2
Sep 16 01:22:16 authentication failure

[2020-09-28 17:01:25] NOTICE[1159] chan_sip.c: Registration from '"2010" ' failed for '108.62.123.167:5328' - Wrong password
[2020-09-28 17:01:25] SECURITY[1198] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-09-28T17:01:25.549-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="2010",SessionID="0x7fcaa00dd368",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/108.62.123.167/5328",Challenge="172b15a8",ReceivedChallenge="172b15a8",ReceivedHash="40f06e3cc4f3eae10470eda9fb7a0b0e"
[2020-09-28 17:01:25] NOTICE[1159] chan_sip.c: Registration from '"2010" ' failed for '108.62.123.167:5328' - Wrong password
[2020-09-28 17:01:25] SECURITY[1198] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-09-28T17:01:25.636-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="2010",SessionID="0x7fcaa02d7a38",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP
...

Sep 28 16:19:03 george sshd[19214]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.65.133.140  user=root
Sep 28 16:19:05 george sshd[19214]: Failed password for root from 159.65.133.140 port 57090 ssh2
Sep 28 16:23:25 george sshd[19261]: Invalid user karl from 159.65.133.140 port 37422
Sep 28 16:23:25 george sshd[19261]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.65.133.140 
Sep 28 16:23:27 george sshd[19261]: Failed password for invalid user karl from 159.65.133.140 port 37422 ssh2
...

Invalid user guest from 220.186.188.205 port 58728

Failed password for invalid user from 222.186.175.169 port 58356 ssh2

Unauthorised connection attempt detected at AUO NODE 4. System is sshd. Protected by AUO Stack Web Application Firewall (WAF)

Sep 28 16:55:18 scw-tender-jepsen sshd[20369]: Failed password for root from 122.51.68.7 port 49694 ssh2
Sep 28 17:20:00 scw-tender-jepsen sshd[20924]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.68.7

SSH login attempts.

Sep 28 22:31:29 [host] sshd[31496]: Invalid user w
Sep 28 22:31:29 [host] sshd[31496]: pam_unix(sshd:
Sep 28 22:31:32 [host] sshd[31496]: Failed passwor

Trying ports that it shouldn't be.

2020-09-28T01:03:03.545763abusebot-8.cloudsearch.cf sshd[29956]: Invalid user it from 175.155.233.148 port 42496
2020-09-28T01:03:03.552385abusebot-8.cloudsearch.cf sshd[29956]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.155.233.148
2020-09-28T01:03:03.545763abusebot-8.cloudsearch.cf sshd[29956]: Invalid user it from 175.155.233.148 port 42496
2020-09-28T01:03:06.188072abusebot-8.cloudsearch.cf sshd[29956]: Failed password for invalid user it from 175.155.233.148 port 42496 ssh2
2020-09-28T01:08:26.116194abusebot-8.cloudsearch.cf sshd[30080]: Invalid user flask from 175.155.233.148 port 48482
2020-09-28T01:08:26.122327abusebot-8.cloudsearch.cf sshd[30080]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.155.233.148
2020-09-28T01:08:26.116194abusebot-8.cloudsearch.cf sshd[30080]: Invalid user flask from 175.155.233.148 port 48482
2020-09-28T01:08:28.432065abusebot-8.cloudsearch.cf sshd[30080]: F
...

Sep 28 14:40:59 main sshd[25516]: Failed password for invalid user deployer from 15.207.30.208 port 51824 ssh2
Sep 28 15:18:22 main sshd[25996]: Failed password for invalid user cisco from 15.207.30.208 port 38520 ssh2
Sep 28 15:29:29 main sshd[26129]: Failed password for invalid user ajay from 15.207.30.208 port 47958 ssh2
Sep 28 15:50:14 main sshd[26448]: Failed password for invalid user hadoop from 15.207.30.208 port 38622 ssh2
Sep 28 16:10:41 main sshd[26704]: Failed password for invalid user frank from 15.207.30.208 port 57500 ssh2
Sep 28 16:32:34 main sshd[26903]: Failed password for invalid user 123456 from 15.207.30.208 port 48140 ssh2
Sep 28 16:54:15 main sshd[27103]: Failed password for invalid user premier from 15.207.30.208 port 38742 ssh2
Sep 28 17:04:54 main sshd[27191]: Failed password for invalid user copy from 15.207.30.208 port 48220 ssh2
Sep 28 17:15:16 main sshd[27339]: Failed password for invalid user teste from 15.207.30.208 port 57666 ssh2

1601326671 - 09/29/2020 03:57:51 Host: worker-15.sfj.censys-scanner.com/192.35.168.249 Port: 2 TCP Blocked
...

Sep 27 19:52:42 pixelmemory sshd[1228380]: Failed password for root from 2.180.25.167 port 53420 ssh2
Sep 27 20:00:16 pixelmemory sshd[1230233]: Invalid user testing from 2.180.25.167 port 50748
Sep 27 20:00:16 pixelmemory sshd[1230233]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.180.25.167 
Sep 27 20:00:16 pixelmemory sshd[1230233]: Invalid user testing from 2.180.25.167 port 50748
Sep 27 20:00:18 pixelmemory sshd[1230233]: Failed password for invalid user testing from 2.180.25.167 port 50748 ssh2
...

ET DROP Dshield Block Listed Source group 1 - port: 28637 proto: tcp cat: Misc Attackbytes: 60

SSH login attempts.