Invalid user simran from 140.143.247.30 port 48530

Mar 27 19:41:26 XXXXXX sshd[52970]: Invalid user gat from 181.112.225.34 port 32874

2020-03-27T20:07:36.748088struts4.enskede.local sshd\[12909\]: Invalid user adamina from 145.239.94.191 port 37714
2020-03-27T20:07:36.754271struts4.enskede.local sshd\[12909\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=191.ip-145-239-94.eu
2020-03-27T20:07:39.100374struts4.enskede.local sshd\[12909\]: Failed password for invalid user adamina from 145.239.94.191 port 37714 ssh2
2020-03-27T20:12:49.224868struts4.enskede.local sshd\[13023\]: Invalid user prom from 145.239.94.191 port 46674
2020-03-27T20:12:49.231510struts4.enskede.local sshd\[13023\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=191.ip-145-239-94.eu
...

$f2bV_matches

Triggered by Fail2Ban at Ares web server

Mar 28 03:19:08 itv-usvr-01 sshd[10355]: Invalid user olo from 64.227.69.43
Mar 28 03:19:08 itv-usvr-01 sshd[10355]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.69.43
Mar 28 03:19:08 itv-usvr-01 sshd[10355]: Invalid user olo from 64.227.69.43
Mar 28 03:19:10 itv-usvr-01 sshd[10355]: Failed password for invalid user olo from 64.227.69.43 port 59696 ssh2
Mar 28 03:24:41 itv-usvr-01 sshd[10577]: Invalid user maren from 64.227.69.43

Mar 27 19:37:56 ns382633 sshd\[11047\]: Invalid user lgj from 104.200.110.191 port 60060
Mar 27 19:37:56 ns382633 sshd\[11047\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.200.110.191
Mar 27 19:37:58 ns382633 sshd\[11047\]: Failed password for invalid user lgj from 104.200.110.191 port 60060 ssh2
Mar 27 19:44:09 ns382633 sshd\[12258\]: Invalid user ricardo from 104.200.110.191 port 50924
Mar 27 19:44:09 ns382633 sshd\[12258\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.200.110.191

Mar 27 13:28:39 ns382633 sshd\[32672\]: Invalid user admin from 14.160.70.250 port 46610
Mar 27 13:28:39 ns382633 sshd\[32672\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.160.70.250
Mar 27 13:28:42 ns382633 sshd\[32672\]: Failed password for invalid user admin from 14.160.70.250 port 46610 ssh2
Mar 27 13:28:46 ns382633 sshd\[32674\]: Invalid user admin from 14.160.70.250 port 46639
Mar 27 13:28:46 ns382633 sshd\[32674\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.160.70.250

157.245.217.186 has been banned for [WebApp Attack]
...

[2020-03-27 15:56:06] NOTICE[1148] chan_sip.c: Registration from '' failed for '185.147.215.12:55341' - Wrong password
[2020-03-27 15:56:06] SECURITY[1163] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-03-27T15:56:06.723-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="1867",SessionID="0x7fd82c8d10a8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/185.147.215.12/55341",Challenge="6f333275",ReceivedChallenge="6f333275",ReceivedHash="b544500330a661237bb1c01b948076a6"
[2020-03-27 15:56:43] NOTICE[1148] chan_sip.c: Registration from '' failed for '185.147.215.12:51386' - Wrong password
[2020-03-27 15:56:43] SECURITY[1163] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-03-27T15:56:43.867-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="1266",SessionID="0x7fd82c221b18",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/185.147.21
...

Mar 27 16:52:26 meumeu sshd[6060]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.83.10.18 
Mar 27 16:52:29 meumeu sshd[6060]: Failed password for invalid user ktj from 202.83.10.18 port 50120 ssh2
Mar 27 16:56:34 meumeu sshd[6620]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.83.10.18 
...

Mar 27 13:21:15 server1 sshd\[3316\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.14.29.2 
Mar 27 13:21:17 server1 sshd\[3315\]: Failed password for invalid user stazo from 104.14.29.2 port 53111 ssh2
Mar 27 13:21:18 server1 sshd\[3316\]: Failed password for invalid user stazo from 104.14.29.2 port 53112 ssh2
Mar 27 13:25:44 server1 sshd\[4984\]: Invalid user hap from 104.14.29.2
Mar 27 13:25:44 server1 sshd\[4984\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.14.29.2 
...

SSH login attempts.

2020-03-27T12:41:33.672561shield sshd\[24629\]: Invalid user nth from 112.64.33.38 port 52727
2020-03-27T12:41:33.678682shield sshd\[24629\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.64.33.38
2020-03-27T12:41:35.346881shield sshd\[24629\]: Failed password for invalid user nth from 112.64.33.38 port 52727 ssh2
2020-03-27T12:45:50.409040shield sshd\[26101\]: Invalid user nlt from 112.64.33.38 port 43897
2020-03-27T12:45:50.417182shield sshd\[26101\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.64.33.38

Mar 27 20:17:57 vmd17057 sshd[21271]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.46.142.80 
Mar 27 20:17:58 vmd17057 sshd[21271]: Failed password for invalid user applmgr from 36.46.142.80 port 58580 ssh2
...