F2B jail: sshd. Time: 2019-12-10 08:01:40, Reported by: VKReport

Dec 10 13:39:25 lcl-usvr-02 sshd[3896]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.85.42.174  user=root
Dec 10 13:39:26 lcl-usvr-02 sshd[3896]: Failed password for root from 112.85.42.174 port 12075 ssh2
...

$f2bV_matches

Dec 10 07:42:23 MK-Soft-Root1 sshd[9347]: Failed password for root from 222.186.180.17 port 50276 ssh2
Dec 10 07:42:26 MK-Soft-Root1 sshd[9347]: Failed password for root from 222.186.180.17 port 50276 ssh2
...

Brute force attempt

Dec 10 06:30:45 flomail dovecot: imap-login: Disconnected (auth failed, 1 attempts in 6 secs): user=, method=PLAIN, rip=146.71.16.96, lip=10.140.194.78, TLS, session=
Dec 10 06:31:04 flomail dovecot: imap-login: Disconnected (auth failed, 1 attempts in 8 secs): user=, method=PLAIN, rip=146.71.16.96, lip=10.140.194.78, TLS: Disconnected, session=

Dec 10 07:57:19 OPSO sshd\[30289\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.218.21.8  user=root
Dec 10 07:57:21 OPSO sshd\[30289\]: Failed password for root from 217.218.21.8 port 43696 ssh2
Dec 10 08:03:42 OPSO sshd\[31996\]: Invalid user test from 217.218.21.8 port 42714
Dec 10 08:03:42 OPSO sshd\[31996\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.218.21.8
Dec 10 08:03:44 OPSO sshd\[31996\]: Failed password for invalid user test from 217.218.21.8 port 42714 ssh2

[Aegis] @ 2019-12-10 07:38:45  0000 -> Attempted Administrator Privilege Gain: ET SCAN LibSSH Based Frequent SSH Connections Likely BruteForce Attack

Dec  9 20:41:53 auw2 sshd\[28730\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.180.41  user=root
Dec  9 20:41:55 auw2 sshd\[28730\]: Failed password for root from 222.186.180.41 port 23724 ssh2
Dec  9 20:41:59 auw2 sshd\[28730\]: Failed password for root from 222.186.180.41 port 23724 ssh2
Dec  9 20:42:02 auw2 sshd\[28730\]: Failed password for root from 222.186.180.41 port 23724 ssh2
Dec  9 20:42:05 auw2 sshd\[28730\]: Failed password for root from 222.186.180.41 port 23724 ssh2

Dec 10 07:43:36 meumeu sshd[22228]: Failed password for root from 218.92.0.156 port 52209 ssh2
Dec 10 07:43:41 meumeu sshd[22228]: Failed password for root from 218.92.0.156 port 52209 ssh2
Dec 10 07:43:53 meumeu sshd[22228]: error: maximum authentication attempts exceeded for root from 218.92.0.156 port 52209 ssh2 [preauth]
...

Dec  9 20:59:17 php1 sshd\[12510\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=147.ip-51-68-231.eu  user=root
Dec  9 20:59:19 php1 sshd\[12510\]: Failed password for root from 51.68.231.147 port 35294 ssh2
Dec  9 21:04:36 php1 sshd\[13221\]: Invalid user cn from 51.68.231.147
Dec  9 21:04:36 php1 sshd\[13221\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=147.ip-51-68-231.eu
Dec  9 21:04:38 php1 sshd\[13221\]: Failed password for invalid user cn from 51.68.231.147 port 43312 ssh2

SASL broute force

Dec 10 08:00:41 * sshd[8244]: Failed password for root from 218.92.0.134 port 56655 ssh2
Dec 10 08:00:56 * sshd[8244]: error: maximum authentication attempts exceeded for root from 218.92.0.134 port 56655 ssh2 [preauth]

Invalid user webadmin from 118.24.13.248 port 47770
pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.24.13.248
Failed password for invalid user webadmin from 118.24.13.248 port 47770 ssh2
Invalid user woodroffe from 118.24.13.248 port 54120
pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.24.13.248

Dec 10 07:13:28 jane sshd[8622]: Failed password for sshd from 54.37.68.191 port 54660 ssh2
Dec 10 07:18:44 jane sshd[12279]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.37.68.191 
...