Jul 16 21:47:57 our-server-hostname postfix/smtpd[14081]: connect from unknown[209.97.170.131]
Jul x@x
Jul 16 21:48:01 our-server-hostname postfix/smtpd[14081]: disconnect from unknown[209.97.170.131]
Jul 16 21:49:00 our-server-hostname postfix/smtpd[14081]: connect from unknown[209.97.170.131]
Jul x@x
Jul 16 21:49:03 our-server-hostname postfix/smtpd[14081]: disconnect from unknown[209.97.170.131]
Jul 16 21:53:50 our-server-hostname postfix/smtpd[15403]: connect from unknown[209.97.170.131]
Jul x@x
Jul 16 21:53:53 our-server-hostname postfix/smtpd[15403]: disconnect from unknown[209.97.170.131]
Jul 16 21:55:23 our-server-hostname postfix/smtpd[13805]: connect from unknown[209.97.170.131]
Jul x@x
Jul 16 21:55:26 our-server-hostname postfix/smtpd[13805]: disconnect from unknown[209.97.170.131]
Jul 16 21:57:24 our-server-hostname postfix/smtpd[14124]: connect from unknown[209.97.170.131]
Jul x@x
Jul 16 21:57:27 our-server-hostname postfix/smtpd[14124]: disconnect from unk........
-------------------------------

06/30/2020-13:37:40.996498 209.97.170.74 Protocol: 6 ET SCAN NMAP -sS window 1024

May  1 07:26:56 vlre-nyc-1 sshd\[22918\]: Invalid user jb from 209.97.170.56
May  1 07:26:56 vlre-nyc-1 sshd\[22918\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=209.97.170.56
May  1 07:26:57 vlre-nyc-1 sshd\[22918\]: Failed password for invalid user jb from 209.97.170.56 port 35194 ssh2
May  1 07:33:52 vlre-nyc-1 sshd\[23171\]: Invalid user deploy from 209.97.170.56
May  1 07:33:52 vlre-nyc-1 sshd\[23171\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=209.97.170.56
...

Apr 16 05:56:16 vpn01 sshd[17872]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=209.97.170.56
Apr 16 05:56:18 vpn01 sshd[17872]: Failed password for invalid user user from 209.97.170.56 port 44012 ssh2
...

Feb 25 01:39:00 vps691689 sshd[21169]: Failed password for root from 209.97.170.188 port 48988 ssh2
Feb 25 01:43:06 vps691689 sshd[21289]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=209.97.170.188
...

Feb 18 20:47:03 silence02 sshd[2489]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=209.97.170.188
Feb 18 20:47:05 silence02 sshd[2489]: Failed password for invalid user niranjan from 209.97.170.188 port 33160 ssh2
Feb 18 20:50:15 silence02 sshd[3943]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=209.97.170.188

Feb 14 09:46:23 XXX sshd[14828]: Invalid user couchdb from 209.97.170.188 port 33548

Feb 10 19:01:43 ks10 sshd[3555742]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=209.97.170.188 
Feb 10 19:01:45 ks10 sshd[3555742]: Failed password for invalid user iuk from 209.97.170.188 port 56564 ssh2
...

2020-02-10T05:54:07.810195centos sshd\[26851\]: Invalid user ixa from 209.97.170.188 port 56374
2020-02-10T05:54:07.814797centos sshd\[26851\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=209.97.170.188
2020-02-10T05:54:10.023495centos sshd\[26851\]: Failed password for invalid user ixa from 209.97.170.188 port 56374 ssh2

209.97.170.232 - - [30/Nov/2019:07:27:28 +0100] "POST /wp-login.php HTTP/1.1" 200 3123 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
209.97.170.232 - - [30/Nov/2019:07:27:34 +0100] "POST /wp-login.php HTTP/1.1" 200 3102 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
...

Oct 31 07:37:24 dedicated sshd[15105]: Invalid user !Z@X#C from 209.97.170.176 port 41966

Oct 30 04:49:06 web1 sshd\[19731\]: Invalid user teamspeak4 from 209.97.170.176
Oct 30 04:49:06 web1 sshd\[19731\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=209.97.170.176
Oct 30 04:49:07 web1 sshd\[19731\]: Failed password for invalid user teamspeak4 from 209.97.170.176 port 54050 ssh2
Oct 30 04:53:31 web1 sshd\[20100\]: Invalid user cmsftp from 209.97.170.176
Oct 30 04:53:31 web1 sshd\[20100\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=209.97.170.176

Oct 28 11:01:23 keyhelp sshd[12224]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=209.97.170.176  user=r.r
Oct 28 11:01:25 keyhelp sshd[12224]: Failed password for r.r from 209.97.170.176 port 47968 ssh2
Oct 28 11:01:25 keyhelp sshd[12224]: Received disconnect from 209.97.170.176 port 47968:11: Bye Bye [preauth]
Oct 28 11:01:25 keyhelp sshd[12224]: Disconnected from 209.97.170.176 port 47968 [preauth]
Oct 28 11:15:43 keyhelp sshd[14768]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=209.97.170.176  user=r.r
Oct 28 11:15:45 keyhelp sshd[14768]: Failed password for r.r from 209.97.170.176 port 48172 ssh2
Oct 28 11:15:45 keyhelp sshd[14768]: Received disconnect from 209.97.170.176 port 48172:11: Bye Bye [preauth]
Oct 28 11:15:45 keyhelp sshd[14768]: Disconnected from 209.97.170.176 port 48172 [preauth]
Oct 28 11:19:49 keyhelp sshd[15298]: pam_unix(sshd:auth): authentication failure; lognam........
-------------------------------

Aug  3 05:10:00 server sshd\[13155\]: Invalid user imre from 209.97.170.94 port 53568
Aug  3 05:10:00 server sshd\[13155\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=209.97.170.94
Aug  3 05:10:02 server sshd\[13155\]: Failed password for invalid user imre from 209.97.170.94 port 53568 ssh2
Aug  3 05:16:30 server sshd\[11868\]: User root from 209.97.170.94 not allowed because listed in DenyUsers
Aug  3 05:16:30 server sshd\[11868\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=209.97.170.94  user=root

28.07.2019 19:08:50 SSH access blocked by firewall

Sep  7 05:59:17 lcprod sshd\[10185\]: Invalid user 1234 from 222.242.104.188
Sep  7 05:59:17 lcprod sshd\[10185\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.242.104.188
Sep  7 05:59:19 lcprod sshd\[10185\]: Failed password for invalid user 1234 from 222.242.104.188 port 59290 ssh2
Sep  7 06:06:52 lcprod sshd\[10824\]: Invalid user 123 from 222.242.104.188
Sep  7 06:06:52 lcprod sshd\[10824\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.242.104.188

Unauthorized connection attempt from IP address 154.236.159.233 on Port 445(SMB)

\[2019-09-07 18:30:38\] NOTICE\[603\] res_pjsip/pjsip_distributor.c: Request 'REGISTER' from '\' failed for '5.62.41.170:13069' \(callid: 1035677388-256703499-63010709\) - Failed to authenticate
\[2019-09-07 18:30:38\] SECURITY\[1715\] res_security_log.c: SecurityEvent="ChallengeResponseFailed",EventTV="2019-09-07T18:30:38.570+0200",Severity="Error",Service="PJSIP",EventVersion="1",AccountID="\",SessionID="1035677388-256703499-63010709",LocalAddress="IPV4/UDP/188.40.118.248/5060",RemoteAddress="IPV4/UDP/5.62.41.170/13069",Challenge="1567873838/e585215322fc2d45e8e6e61ead7d842f",Response="52bea22b59483ba08df50250ae5e0caa",ExpectedResponse=""
\[2019-09-07 18:30:38\] NOTICE\[25634\] res_pjsip/pjsip_distributor.c: Request 'REGISTER' from '\' failed for '5.62.41.170:13069' \(callid: 1035677388-256703499-63010709\) - Failed to authenticate
\[2019-09-07 18:30:38\] SECURITY\[1715\] res_security_log.c: SecurityEvent="ChallengeResponseFailed",Eve

Sep  7 11:52:54 game-panel sshd[10211]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=207.154.218.16
Sep  7 11:52:56 game-panel sshd[10211]: Failed password for invalid user admin1 from 207.154.218.16 port 48596 ssh2
Sep  7 11:57:29 game-panel sshd[10377]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=207.154.218.16

Sep  7 05:46:26 php1 sshd\[22765\]: Invalid user mcadmin from 106.12.221.86
Sep  7 05:46:26 php1 sshd\[22765\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.221.86
Sep  7 05:46:28 php1 sshd\[22765\]: Failed password for invalid user mcadmin from 106.12.221.86 port 52970 ssh2
Sep  7 05:50:17 php1 sshd\[23090\]: Invalid user developer1234 from 106.12.221.86
Sep  7 05:50:17 php1 sshd\[23090\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.221.86

Sep  7 12:45:58 raspberrypi sshd\[12204\]: Invalid user test123 from 79.121.121.4
...

Sep  7 06:10:12 hiderm sshd\[7028\]: Invalid user user from 128.199.142.0
Sep  7 06:10:12 hiderm sshd\[7028\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.142.0
Sep  7 06:10:13 hiderm sshd\[7028\]: Failed password for invalid user user from 128.199.142.0 port 40036 ssh2
Sep  7 06:15:27 hiderm sshd\[7485\]: Invalid user usuario from 128.199.142.0
Sep  7 06:15:27 hiderm sshd\[7485\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.142.0

Sep  7 12:45:54 dcd-gentoo sshd[12797]: User root from 218.92.0.198 not allowed because none of user's groups are listed in AllowGroups
Sep  7 12:45:54 dcd-gentoo sshd[12797]: User root from 218.92.0.198 not allowed because none of user's groups are listed in AllowGroups
Sep  7 12:45:56 dcd-gentoo sshd[12797]: error: PAM: Authentication failure for illegal user root from 218.92.0.198
Sep  7 12:45:54 dcd-gentoo sshd[12797]: User root from 218.92.0.198 not allowed because none of user's groups are listed in AllowGroups
Sep  7 12:45:56 dcd-gentoo sshd[12797]: error: PAM: Authentication failure for illegal user root from 218.92.0.198
Sep  7 12:45:56 dcd-gentoo sshd[12797]: Failed keyboard-interactive/pam for invalid user root from 218.92.0.198 port 62924 ssh2
...

Automatic report - SSH Brute-Force Attack

Sep  7 14:32:31 s64-1 sshd[23637]: Failed password for mysql from 134.255.234.104 port 48712 ssh2
Sep  7 14:33:00 s64-1 sshd[23640]: Failed password for mysql from 134.255.234.104 port 40298 ssh2
...

Sep  7 01:52:15 lcprod sshd\[19365\]: Invalid user mongouser from 35.232.92.131
Sep  7 01:52:15 lcprod sshd\[19365\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=131.92.232.35.bc.googleusercontent.com
Sep  7 01:52:17 lcprod sshd\[19365\]: Failed password for invalid user mongouser from 35.232.92.131 port 51286 ssh2
Sep  7 01:56:36 lcprod sshd\[19743\]: Invalid user odoo from 35.232.92.131
Sep  7 01:56:36 lcprod sshd\[19743\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=131.92.232.35.bc.googleusercontent.com

DATE:2019-09-07 15:24:50, IP:109.255.23.150, PORT:ssh SSH brute force auth (thor)

Sep  7 17:31:55 rpi sshd[30735]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.226.55.241 
Sep  7 17:31:57 rpi sshd[30735]: Failed password for invalid user upload from 129.226.55.241 port 36994 ssh2

Sep  7 17:27:05 mail sshd\[31219\]: Invalid user alex from 125.215.207.40 port 34037
Sep  7 17:27:05 mail sshd\[31219\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.215.207.40
Sep  7 17:27:07 mail sshd\[31219\]: Failed password for invalid user alex from 125.215.207.40 port 34037 ssh2
Sep  7 17:36:41 mail sshd\[32297\]: Invalid user ftpuser from 125.215.207.40 port 33584
Sep  7 17:36:41 mail sshd\[32297\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.215.207.40

Sep  7 18:50:11 mail sshd\[7971\]: Invalid user oracle from 106.52.18.180 port 56456
Sep  7 18:50:11 mail sshd\[7971\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.52.18.180
Sep  7 18:50:13 mail sshd\[7971\]: Failed password for invalid user oracle from 106.52.18.180 port 56456 ssh2
Sep  7 18:57:42 mail sshd\[8598\]: Invalid user admin from 106.52.18.180 port 42882
Sep  7 18:57:42 mail sshd\[8598\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.52.18.180