$f2bV_matches

2019-10-24T21:17:34.817265hub.schaetter.us sshd\[15984\]: Invalid user 70 from 202.59.166.148 port 42564
2019-10-24T21:17:34.827934hub.schaetter.us sshd\[15984\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=smtp.waytodeal.com
2019-10-24T21:17:36.912333hub.schaetter.us sshd\[15984\]: Failed password for invalid user 70 from 202.59.166.148 port 42564 ssh2
2019-10-24T21:24:23.153603hub.schaetter.us sshd\[16028\]: Invalid user user from 202.59.166.148 port 33173
2019-10-24T21:24:23.163162hub.schaetter.us sshd\[16028\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=smtp.waytodeal.com
...

SSH invalid-user multiple login try

Oct 16 07:07:58 vps647732 sshd[27359]: Failed password for root from 202.59.166.148 port 59990 ssh2
Oct 16 07:13:42 vps647732 sshd[27479]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.59.166.148
...

2019-09-21T09:39:37.0014101495-001 sshd\[48875\]: Failed password for invalid user deb from 202.59.166.148 port 56019 ssh2
2019-09-21T09:52:13.5962651495-001 sshd\[49736\]: Invalid user iw from 202.59.166.148 port 41230
2019-09-21T09:52:13.6002301495-001 sshd\[49736\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=smtp.waytodeal.com
2019-09-21T09:52:15.8914911495-001 sshd\[49736\]: Failed password for invalid user iw from 202.59.166.148 port 41230 ssh2
2019-09-21T09:58:46.5999951495-001 sshd\[50160\]: Invalid user diamond from 202.59.166.148 port 36730
2019-09-21T09:58:46.6034641495-001 sshd\[50160\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=smtp.waytodeal.com
...

Sep 10 08:06:17 [host] sshd[813]: Invalid user nagios from 202.59.166.148
Sep 10 08:06:17 [host] sshd[813]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.59.166.148
Sep 10 08:06:19 [host] sshd[813]: Failed password for invalid user nagios from 202.59.166.148 port 42464 ssh2

Sep  4 08:36:44 icinga sshd[5846]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.59.166.148
Sep  4 08:36:47 icinga sshd[5846]: Failed password for invalid user customer1 from 202.59.166.148 port 39349 ssh2
...

Sep  3 12:20:34 auw2 sshd\[14163\]: Invalid user ggutierrez from 202.59.166.148
Sep  3 12:20:34 auw2 sshd\[14163\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=smtp.waytodeal.com
Sep  3 12:20:36 auw2 sshd\[14163\]: Failed password for invalid user ggutierrez from 202.59.166.148 port 59197 ssh2
Sep  3 12:25:35 auw2 sshd\[14601\]: Invalid user asa from 202.59.166.148
Sep  3 12:25:35 auw2 sshd\[14601\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=smtp.waytodeal.com

Aug 18 09:32:13 web8 sshd\[15406\]: Invalid user sloan from 202.59.166.148
Aug 18 09:32:13 web8 sshd\[15406\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.59.166.148
Aug 18 09:32:15 web8 sshd\[15406\]: Failed password for invalid user sloan from 202.59.166.148 port 48370 ssh2
Aug 18 09:36:55 web8 sshd\[17550\]: Invalid user prom from 202.59.166.148
Aug 18 09:36:55 web8 sshd\[17550\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.59.166.148

Aug 13 20:04:00 XXX sshd[6181]: Invalid user sitekeur from 202.59.166.148 port 45980

Invalid user synadmin from 202.59.166.148 port 55298

Oct 10 18:29:51 abendstille sshd\[3129\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.59.166.146  user=root
Oct 10 18:29:54 abendstille sshd\[3129\]: Failed password for root from 202.59.166.146 port 51518 ssh2
Oct 10 18:38:16 abendstille sshd\[13371\]: Invalid user test from 202.59.166.146
Oct 10 18:38:16 abendstille sshd\[13371\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.59.166.146
Oct 10 18:38:18 abendstille sshd\[13371\]: Failed password for invalid user test from 202.59.166.146 port 53961 ssh2
...

Oct 10 10:14:29 santamaria sshd\[1728\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.59.166.146  user=root
Oct 10 10:14:31 santamaria sshd\[1728\]: Failed password for root from 202.59.166.146 port 38220 ssh2
Oct 10 10:20:47 santamaria sshd\[1828\]: Invalid user ak47 from 202.59.166.146
Oct 10 10:20:47 santamaria sshd\[1828\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.59.166.146
...

Aug 30 14:48:17 IngegnereFirenze sshd[11726]: Failed password for invalid user vnc from 202.59.166.146 port 45427 ssh2
...

Invalid user raja from 202.59.166.146 port 60898

2020-08-22 01:37:31,583 fail2ban.actions: WARNING [ssh] Ban 202.59.166.146

Aug 15 05:56:09 ajax sshd[28038]: Failed password for root from 202.59.166.146 port 58093 ssh2

Aug  9 22:30:54 vps333114 sshd[19593]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.59.166.146  user=root
Aug  9 22:30:56 vps333114 sshd[19593]: Failed password for root from 202.59.166.146 port 37998 ssh2
...

Aug  7 11:36:20 sso sshd[19946]: Failed password for root from 202.59.166.146 port 35432 ssh2
...

2020-08-05T04:49:08.7626591495-001 sshd[13964]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.59.166.146  user=root
2020-08-05T04:49:11.2187631495-001 sshd[13964]: Failed password for root from 202.59.166.146 port 39371 ssh2
2020-08-05T04:52:24.4473761495-001 sshd[14186]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.59.166.146  user=root
2020-08-05T04:52:26.4773601495-001 sshd[14186]: Failed password for root from 202.59.166.146 port 50922 ssh2
2020-08-05T04:55:32.2036651495-001 sshd[14351]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.59.166.146  user=root
2020-08-05T04:55:34.7101681495-001 sshd[14351]: Failed password for root from 202.59.166.146 port 34231 ssh2
...

2020-07-31T07:28:19.1423061495-001 sshd[42795]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.59.166.146  user=root
2020-07-31T07:28:20.7072201495-001 sshd[42795]: Failed password for root from 202.59.166.146 port 37771 ssh2
2020-07-31T07:38:37.0933381495-001 sshd[43268]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.59.166.146  user=root
2020-07-31T07:38:39.1651311495-001 sshd[43268]: Failed password for root from 202.59.166.146 port 43239 ssh2
2020-07-31T07:48:59.8171211495-001 sshd[43635]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.59.166.146  user=root
2020-07-31T07:49:02.2799861495-001 sshd[43635]: Failed password for root from 202.59.166.146 port 48709 ssh2
...

Jul 19 07:48:42 ip-172-31-61-156 sshd[16688]: Invalid user report from 202.59.166.146
Jul 19 07:48:42 ip-172-31-61-156 sshd[16688]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.59.166.146
Jul 19 07:48:42 ip-172-31-61-156 sshd[16688]: Invalid user report from 202.59.166.146
Jul 19 07:48:44 ip-172-31-61-156 sshd[16688]: Failed password for invalid user report from 202.59.166.146 port 60102 ssh2
Jul 19 07:55:51 ip-172-31-61-156 sshd[17080]: Invalid user xum from 202.59.166.146
...

21 attempts against mh-ssh on maple

2019-10-06T04:30:01.890204abusebot-4.cloudsearch.cf sshd\[8518\]: Invalid user P4sswort123 from 139.199.113.2 port 62316
2019-10-06T04:30:01.894062abusebot-4.cloudsearch.cf sshd\[8518\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.199.113.2

Oct  6 06:39:20 MK-Soft-VM4 sshd[13339]: Failed password for root from 222.186.15.110 port 62016 ssh2
Oct  6 06:39:22 MK-Soft-VM4 sshd[13339]: Failed password for root from 222.186.15.110 port 62016 ssh2
...

2019-10-06T03:55:16.325079abusebot-3.cloudsearch.cf sshd\[29155\]: Invalid user Driver@123 from 139.199.122.96 port 52557

Oct  6 05:55:20 MK-Soft-Root1 sshd[17380]: Failed password for bin from 142.44.142.15 port 49344 ssh2
Oct  6 05:55:20 MK-Soft-Root1 sshd[17382]: Failed password for daemon from 142.44.142.15 port 49382 ssh2
...

Oct  5 18:32:14 tdfoods sshd\[4535\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.54.219.106  user=root
Oct  5 18:32:16 tdfoods sshd\[4535\]: Failed password for root from 103.54.219.106 port 21213 ssh2
Oct  5 18:36:35 tdfoods sshd\[4914\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.54.219.106  user=root
Oct  5 18:36:36 tdfoods sshd\[4914\]: Failed password for root from 103.54.219.106 port 40510 ssh2
Oct  5 18:40:55 tdfoods sshd\[5384\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.54.219.106  user=root

postfix

Oct  6 03:42:15 localhost sshd\[30968\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.66.192  user=root
Oct  6 03:42:17 localhost sshd\[30968\]: Failed password for root from 139.59.66.192 port 57028 ssh2
Oct  6 03:54:33 localhost sshd\[31158\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.66.192  user=root
...

Oct  6 00:09:26 xtremcommunity sshd\[222045\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.197.0.125  user=root
Oct  6 00:09:29 xtremcommunity sshd\[222045\]: Failed password for root from 112.197.0.125 port 19647 ssh2
Oct  6 00:14:17 xtremcommunity sshd\[222124\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.197.0.125  user=root
Oct  6 00:14:19 xtremcommunity sshd\[222124\]: Failed password for root from 112.197.0.125 port 3733 ssh2
Oct  6 00:19:08 xtremcommunity sshd\[222214\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.197.0.125  user=root
...

Oct  5 18:08:49 hanapaa sshd\[30773\]: Invalid user Hospital123 from 14.248.83.163
Oct  5 18:08:49 hanapaa sshd\[30773\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.248.83.163
Oct  5 18:08:51 hanapaa sshd\[30773\]: Failed password for invalid user Hospital123 from 14.248.83.163 port 34760 ssh2
Oct  5 18:13:27 hanapaa sshd\[31262\]: Invalid user Hospital123 from 14.248.83.163
Oct  5 18:13:27 hanapaa sshd\[31262\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.248.83.163

Oct  6 06:22:15 vps691689 sshd[1376]: Failed password for root from 31.14.140.176 port 56272 ssh2
Oct  6 06:26:13 vps691689 sshd[1700]: Failed password for root from 31.14.140.176 port 38448 ssh2
...

3389BruteforceFW21

Oct  6 06:53:32 pkdns2 sshd\[11604\]: Address 142.93.222.197 maps to jira-support.terasoftware.com, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!Oct  6 06:53:35 pkdns2 sshd\[11604\]: Failed password for root from 142.93.222.197 port 45024 ssh2Oct  6 06:57:39 pkdns2 sshd\[11835\]: Address 142.93.222.197 maps to jira-support.terasoftware.com, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!Oct  6 06:57:41 pkdns2 sshd\[11835\]: Failed password for root from 142.93.222.197 port 56662 ssh2Oct  6 07:01:43 pkdns2 sshd\[12072\]: Address 142.93.222.197 maps to jira-support.terasoftware.com, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!Oct  6 07:01:43 pkdns2 sshd\[12072\]: Invalid user 12345 from 142.93.222.197
...

IMAP

Automatic report - Port Scan Attack

Unauthorised access (Oct  6) SRC=191.97.40.245 LEN=44 TTL=240 ID=26087 DF TCP DPT=8080 WINDOW=14600 SYN