Nov 30 17:11:57 sauna sshd[121416]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.142.115
Nov 30 17:11:59 sauna sshd[121416]: Failed password for invalid user 1957 from 106.13.142.115 port 56100 ssh2
...

Automatic report - Banned IP Access

Port scan, attempted C&C

2019-11-28T20:25:52.450012ldap.arvenenaske.de sshd[24461]: Connection from 174.62.92.148 port 51502 on 5.199.128.55 port 22
2019-11-28T20:25:53.445804ldap.arvenenaske.de sshd[24461]: Invalid user brose from 174.62.92.148 port 51502
2019-11-28T20:25:53.453572ldap.arvenenaske.de sshd[24461]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=174.62.92.148 user=brose
2019-11-28T20:25:53.454684ldap.arvenenaske.de sshd[24461]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=174.62.92.148
2019-11-28T20:25:52.450012ldap.arvenenaske.de sshd[24461]: Connection from 174.62.92.148 port 51502 on 5.199.128.55 port 22
2019-11-28T20:25:53.445804ldap.arvenenaske.de sshd[24461]: Invalid user brose from 174.62.92.148 port 51502
2019-11-28T20:25:55.442817ldap.arvenenaske.de sshd[24461]: Failed password for invalid user brose from 174.62.92.148 port 51502 ssh2
2019-11-28T20:29:28.374446ldap.arvenenaske.de sshd[24464........
------------------------------

Nov 30 05:20:18 php1 sshd\[13714\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.85.42.180  user=root
Nov 30 05:20:20 php1 sshd\[13714\]: Failed password for root from 112.85.42.180 port 49849 ssh2
Nov 30 05:20:23 php1 sshd\[13714\]: Failed password for root from 112.85.42.180 port 49849 ssh2
Nov 30 05:20:26 php1 sshd\[13714\]: Failed password for root from 112.85.42.180 port 49849 ssh2
Nov 30 05:20:37 php1 sshd\[13728\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.85.42.180  user=root

Nov 30 14:21:27 web02 sshd[27568]: Did not receive identification string from 23.98.38.160
Nov 30 14:22:45 web02 sshd[27720]: Invalid user dup from 23.98.38.160
Nov 30 14:22:45 web02 sshd[27720]: Received disconnect from 23.98.38.160: 11: Bye Bye [preauth]
Nov 30 14:25:42 web02 sshd[28109]: Invalid user testuser from 23.98.38.160
Nov 30 14:25:43 web02 sshd[28109]: Received disconnect from 23.98.38.160: 11: Bye Bye [preauth]
Nov 30 14:28:40 web02 sshd[28460]: User r.r from 23.98.38.160 not allowed because none of user's groups are listed in AllowGroups
Nov 30 14:28:40 web02 sshd[28460]: Received disconnect from 23.98.38.160: 11: Bye Bye [preauth]


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=23.98.38.160

2019-11-30T15:00:29.274970shield sshd\[13047\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.52.234  user=root
2019-11-30T15:00:30.938050shield sshd\[13047\]: Failed password for root from 106.13.52.234 port 57552 ssh2
2019-11-30T15:05:05.021056shield sshd\[14810\]: Invalid user htl1 from 106.13.52.234 port 57876
2019-11-30T15:05:05.025454shield sshd\[14810\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.52.234
2019-11-30T15:05:07.244505shield sshd\[14810\]: Failed password for invalid user htl1 from 106.13.52.234 port 57876 ssh2

\[2019-11-30 10:24:58\] NOTICE\[2754\] chan_sip.c: Registration from '"1018" \' failed for '37.49.230.63:5679' - Wrong password
\[2019-11-30 10:24:58\] SECURITY\[2765\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-11-30T10:24:58.219-0500",Severity="Error",Service="SIP",EventVersion="2",AccountID="1018",SessionID="0x7f26c4a90648",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.230.63/5679",Challenge="5c9390d6",ReceivedChallenge="5c9390d6",ReceivedHash="75b33e302abd2431f595017a58684120"
\[2019-11-30 10:24:58\] NOTICE\[2754\] chan_sip.c: Registration from '"1018" \' failed for '37.49.230.63:5679' - Wrong password
\[2019-11-30 10:24:58\] SECURITY\[2765\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-11-30T10:24:58.329-0500",Severity="Error",Service="SIP",EventVersion="2",AccountID="1018",SessionID="0x7f26c4ab1d88",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/3

Nov 30 10:32:48 linuxvps sshd\[9258\]: Invalid user epos from 88.116.5.26
Nov 30 10:32:48 linuxvps sshd\[9258\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=88.116.5.26
Nov 30 10:32:51 linuxvps sshd\[9258\]: Failed password for invalid user epos from 88.116.5.26 port 45044 ssh2
Nov 30 10:38:16 linuxvps sshd\[12187\]: Invalid user goei from 88.116.5.26
Nov 30 10:38:16 linuxvps sshd\[12187\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=88.116.5.26

Nov 30 10:46:09 linuxvps sshd\[16439\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.175.169  user=root
Nov 30 10:46:12 linuxvps sshd\[16439\]: Failed password for root from 222.186.175.169 port 45842 ssh2
Nov 30 10:46:29 linuxvps sshd\[16646\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.175.169  user=root
Nov 30 10:46:31 linuxvps sshd\[16646\]: Failed password for root from 222.186.175.169 port 56594 ssh2
Nov 30 10:46:52 linuxvps sshd\[16837\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.175.169  user=root

SSH/22 MH Probe, BF, Hack -

11/30/2019-09:37:51.786722 49.234.211.228 Protocol: 6 ET SCAN NMAP -sS window 1024

Automatic report - Port Scan Attack

11/30/2019-10:35:47.895742 45.82.153.35 Protocol: 6 ET CINS Active Threat Intelligence Poor Reputation IP group 42

1575124669 - 11/30/2019 15:37:49 Host: 106.13.68.196/106.13.68.196 Port: 6667 TCP Blocked