Feb  3 05:53:40 v22018076622670303 sshd\[28734\]: Invalid user nue from 5.172.14.241 port 8948
Feb  3 05:53:40 v22018076622670303 sshd\[28734\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.172.14.241
Feb  3 05:53:42 v22018076622670303 sshd\[28734\]: Failed password for invalid user nue from 5.172.14.241 port 8948 ssh2
...

unauthorized connection attempt

Feb  3 07:08:29 dcd-gentoo sshd[1249]: User root from 222.186.175.150 not allowed because none of user's groups are listed in AllowGroups
Feb  3 07:08:33 dcd-gentoo sshd[1249]: error: PAM: Authentication failure for illegal user root from 222.186.175.150
Feb  3 07:08:29 dcd-gentoo sshd[1249]: User root from 222.186.175.150 not allowed because none of user's groups are listed in AllowGroups
Feb  3 07:08:33 dcd-gentoo sshd[1249]: error: PAM: Authentication failure for illegal user root from 222.186.175.150
Feb  3 07:08:29 dcd-gentoo sshd[1249]: User root from 222.186.175.150 not allowed because none of user's groups are listed in AllowGroups
Feb  3 07:08:33 dcd-gentoo sshd[1249]: error: PAM: Authentication failure for illegal user root from 222.186.175.150
Feb  3 07:08:33 dcd-gentoo sshd[1249]: Failed keyboard-interactive/pam for invalid user root from 222.186.175.150 port 33018 ssh2
...

20 attempts against mh-misbehave-ban on pluto

Feb  3 12:09:09 lcl-usvr-02 sshd[26261]: Invalid user admin from 193.32.163.123 port 59166
...

Feb  3 07:55:19 lukav-desktop sshd\[8749\]: Invalid user 123654 from 124.128.153.17
Feb  3 07:55:19 lukav-desktop sshd\[8749\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=124.128.153.17
Feb  3 07:55:21 lukav-desktop sshd\[8749\]: Failed password for invalid user 123654 from 124.128.153.17 port 58596 ssh2
Feb  3 07:58:22 lukav-desktop sshd\[10691\]: Invalid user atscale from 124.128.153.17
Feb  3 07:58:22 lukav-desktop sshd\[10691\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=124.128.153.17

Feb  3 05:53:29 pornomens sshd\[17075\]: Invalid user kevin1 from 73.54.151.243 port 43532
Feb  3 05:53:29 pornomens sshd\[17075\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=73.54.151.243
Feb  3 05:53:30 pornomens sshd\[17075\]: Failed password for invalid user kevin1 from 73.54.151.243 port 43532 ssh2
...

Unauthorized connection attempt detected from IP address 46.101.48.191 to port 2220 [J]

Feb  2 20:07:13 auw2 sshd\[18310\]: Invalid user george1 from 14.29.244.64
Feb  2 20:07:13 auw2 sshd\[18310\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.29.244.64
Feb  2 20:07:15 auw2 sshd\[18310\]: Failed password for invalid user george1 from 14.29.244.64 port 47302 ssh2
Feb  2 20:15:29 auw2 sshd\[18763\]: Invalid user leonardo from 14.29.244.64
Feb  2 20:15:29 auw2 sshd\[18763\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.29.244.64

DATE:2020-02-03 05:52:52, IP:88.248.98.65, PORT:telnet Telnet brute force auth on honeypot server (epe-honey1-hq)

Feb  3 06:51:30 MK-Soft-VM3 sshd[13302]: Failed password for root from 49.88.112.76 port 34546 ssh2
Feb  3 06:51:33 MK-Soft-VM3 sshd[13302]: Failed password for root from 49.88.112.76 port 34546 ssh2
...

Automatic report - XMLRPC Attack

Received: from p-mtain009.msg.pkvw.co.charter.net ([107.14.174.244])
          by cdptpa-fep09.email.rr.com
          (InterMail vM.8.04.03.24 201-2389-100-172-20151028) with ESMTP
          id <20200202195213.ZYQT15580.cdptpa-fep09.email.rr.com@p-mtain009.msg.pkvw.co.charter.net>
          for ; Sun, 2 Feb 2020 19:52:13 +0000
Received: from p-impin020.msg.pkvw.co.charter.net ([47.43.26.179])
          by p-mtain009.msg.pkvw.co.charter.net
          (InterMail vM.9.01.00.037.1 201-2473-137-122-172) with ESMTP
          id <20200202195212.YMCZ29913.p-mtain009.msg.pkvw.co.charter.net@p-impin020.msg.pkvw.co.charter.net>
          for ; Sun, 2 Feb 2020 19:52:12 +0000
Received: from mde-web-02.ig-1.net ([158.58.178.109])
	by cmsmtp with ESMTP
	id yLHvie4TkFQaHyLHwiC3hu; Sun, 02 Feb 2020 19:52:12 +000

Unauthorized connection attempt detected from IP address 82.146.40.70 to port 2220 [J]

Feb  3 05:43:41 v22018076622670303 sshd\[28638\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.1.149.196  user=root
Feb  3 05:43:43 v22018076622670303 sshd\[28638\]: Failed password for root from 116.1.149.196 port 60598 ssh2
Feb  3 05:52:50 v22018076622670303 sshd\[28722\]: Invalid user test from 116.1.149.196 port 55310
Feb  3 05:52:50 v22018076622670303 sshd\[28722\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.1.149.196
...