Oct  3 15:23:53 jumpserver sshd[455015]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.159.189.39  user=root
Oct  3 15:23:55 jumpserver sshd[455015]: Failed password for root from 211.159.189.39 port 42652 ssh2
Oct  3 15:28:27 jumpserver sshd[455031]: Invalid user erica from 211.159.189.39 port 34992
...

[N1.H1.VM1] Port Scanner Detected Blocked by UFW

Oct  3 05:35:12 php1 sshd\[17768\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=93.61.137.226  user=root
Oct  3 05:35:14 php1 sshd\[17768\]: Failed password for root from 93.61.137.226 port 56096 ssh2
Oct  3 05:37:52 php1 sshd\[17904\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=93.61.137.226  user=root
Oct  3 05:37:54 php1 sshd\[17904\]: Failed password for root from 93.61.137.226 port 48899 ssh2
Oct  3 05:40:39 php1 sshd\[18420\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=93.61.137.226  user=root

SSH Brute-Force reported by Fail2Ban

Found on   CINS badguys     / proto=6  .  srcport=51245  .  dstport=23 Telnet  .     (1015)

Oct  3 19:56:35 srv-ubuntu-dev3 sshd[111899]: Invalid user jo from 178.128.210.230
Oct  3 19:56:35 srv-ubuntu-dev3 sshd[111899]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.210.230
Oct  3 19:56:35 srv-ubuntu-dev3 sshd[111899]: Invalid user jo from 178.128.210.230
Oct  3 19:56:37 srv-ubuntu-dev3 sshd[111899]: Failed password for invalid user jo from 178.128.210.230 port 50272 ssh2
Oct  3 20:00:36 srv-ubuntu-dev3 sshd[112500]: Invalid user ubuntu from 178.128.210.230
Oct  3 20:00:36 srv-ubuntu-dev3 sshd[112500]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.210.230
Oct  3 20:00:36 srv-ubuntu-dev3 sshd[112500]: Invalid user ubuntu from 178.128.210.230
Oct  3 20:00:38 srv-ubuntu-dev3 sshd[112500]: Failed password for invalid user ubuntu from 178.128.210.230 port 57498 ssh2
Oct  3 20:04:34 srv-ubuntu-dev3 sshd[113014]: Invalid user starbound from 178.128.210.230
...

[2020-10-03 01:26:22] NOTICE[1182] chan_sip.c: Registration from '"90" ' failed for '45.143.221.41:5706' - Wrong password
[2020-10-03 01:26:22] SECURITY[1204] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-10-03T01:26:22.683-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="90",SessionID="0x7f22f8418138",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/45.143.221.41/5706",Challenge="0e1c923a",ReceivedChallenge="0e1c923a",ReceivedHash="b39ce408c896502e1e1727b866803eb9"
[2020-10-03 01:26:22] NOTICE[1182] chan_sip.c: Registration from '"90" ' failed for '45.143.221.41:5706' - Wrong password
[2020-10-03 01:26:22] SECURITY[1204] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-10-03T01:26:22.872-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="90",SessionID="0x7f22f8081ea8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/45.143.221.41/
...

port scan and connect, tcp 80 (http)

RU spamvertising/fraud - From: Ultra Wifi Pro 

- UBE 208.82.118.236 (EHLO newstart.club) Ndchost
- Spam link mail.kraften.site = 185.56.88.154 Buzinessware FZCO – phishing redirect:
a) spendlesslist.com = 104.144.63.165 ServerMania
- Spam link #2 mail.kraften.site - phishing redirect:
a) spendlesslist.com = 104.144.63.165 ServerMania
b) safemailremove.com = 40.64.107.53 Microsoft Corporation
- Spam link newstart.club = host not found

Images - 151.101.120.193 Fastly
- https://imgur.com/wmqfoW2.png = Ultra Wifi Pro ad
- https://imgur.com/F6adfzn.png = Ultra Wifi Pro 73 Greentree Dr. #57 Dover DE 19904 – entity not found at listed address; BBB: Ultra HD Antennas & Ultra WiFi Pro – " this business is no longer in business "

2020-10-03T22:31:42.243596hostname sshd[63150]: Failed password for invalid user teacher1 from 183.234.184.4 port 45524 ssh2
...

$f2bV_matches

Oct  3 12:27:55 abendstille sshd\[13881\]: Invalid user marcel from 116.196.81.216
Oct  3 12:27:55 abendstille sshd\[13881\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.196.81.216
Oct  3 12:27:58 abendstille sshd\[13881\]: Failed password for invalid user marcel from 116.196.81.216 port 58196 ssh2
Oct  3 12:30:13 abendstille sshd\[16434\]: Invalid user james from 116.196.81.216
Oct  3 12:30:13 abendstille sshd\[16434\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.196.81.216
...

fail2ban: brute force SSH detected

Oct  3 02:36:02 web1 sshd\[12608\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=209.141.40.237  user=root
Oct  3 02:36:04 web1 sshd\[12608\]: Failed password for root from 209.141.40.237 port 42520 ssh2
Oct  3 02:39:28 web1 sshd\[12882\]: Invalid user rose from 209.141.40.237
Oct  3 02:39:28 web1 sshd\[12882\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=209.141.40.237
Oct  3 02:39:30 web1 sshd\[12882\]: Failed password for invalid user rose from 209.141.40.237 port 41530 ssh2

Oct  3 16:59:42 rocket sshd[20615]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.187.106.104
Oct  3 16:59:44 rocket sshd[20615]: Failed password for invalid user ftpuser from 37.187.106.104 port 35868 ssh2
...