(sshd) Failed SSH login from 125.19.153.156 (IN/India/okaya.tk): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Feb 27 19:44:26 amsweb01 sshd[4649]: Invalid user proxy from 125.19.153.156 port 40427
Feb 27 19:44:28 amsweb01 sshd[4649]: Failed password for invalid user proxy from 125.19.153.156 port 40427 ssh2
Feb 27 20:11:54 amsweb01 sshd[6984]: Invalid user xvwei from 125.19.153.156 port 44438
Feb 27 20:11:56 amsweb01 sshd[6984]: Failed password for invalid user xvwei from 125.19.153.156 port 44438 ssh2
Feb 27 20:23:45 amsweb01 sshd[8021]: Invalid user isl from 125.19.153.156 port 51214

Feb 27 15:21:47 debian-2gb-nbg1-2 kernel: \[5072500.822231\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=216.218.206.93 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=243 ID=54321 PROTO=TCP SPT=34376 DPT=8080 WINDOW=65535 RES=0x00 SYN URGP=0

Feb 27 15:31:07 ns382633 sshd\[12369\]: Invalid user xuming from 121.229.48.89 port 34110
Feb 27 15:31:07 ns382633 sshd\[12369\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.229.48.89
Feb 27 15:31:09 ns382633 sshd\[12369\]: Failed password for invalid user xuming from 121.229.48.89 port 34110 ssh2
Feb 27 16:10:33 ns382633 sshd\[19294\]: Invalid user work from 121.229.48.89 port 40666
Feb 27 16:10:33 ns382633 sshd\[19294\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.229.48.89

IP Ban Report :  
 https://help-dysk.pl/wordpress-firewall-plugins/ip/155.133.83.23/ 
 
 PL - 1H : (33)  
 Protection Against DDoS WordPress plugin :  
 "odzyskiwanie danych help-dysk" 
 IP Address Ranges by Country : PL 
 NAME ASN : ASN199250 
 
 IP : 155.133.83.23 
 
 CIDR : 155.133.83.0/24 
 
 PREFIX COUNT : 4 
 
 UNIQUE IP COUNT : 1792 
 
 
 ATTACKS DETECTED ASN199250 :  
  1H - 1 
  3H - 1 
  6H - 1 
 12H - 1 
 24H - 1 
 
 DateTime : 2020-02-27 15:21:12 
 
 INFO : Server 408 - Looking for resource vulnerabilities Detected and Blocked by ADMIN  - data recovery

Lines containing failures of 84.38.180.44
Feb 27 10:09:54 UTC__SANYALnet-Labs__cac1 sshd[4606]: Connection from 84.38.180.44 port 51318 on 104.167.106.93 port 22
Feb 27 10:09:55 UTC__SANYALnet-Labs__cac1 sshd[4606]: Address 84.38.180.44 maps to rm01.ru, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!
Feb 27 10:09:55 UTC__SANYALnet-Labs__cac1 sshd[4606]: Invalid user at from 84.38.180.44 port 51318
Feb 27 10:09:55 UTC__SANYALnet-Labs__cac1 sshd[4606]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=84.38.180.44
Feb 27 10:09:57 UTC__SANYALnet-Labs__cac1 sshd[4606]: Failed password for invalid user at from 84.38.180.44 port 51318 ssh2
Feb 27 10:09:57 UTC__SANYALnet-Labs__cac1 sshd[4606]: Received disconnect from 84.38.180.44 port 51318:11: Bye Bye [preauth]
Feb 27 10:09:57 UTC__SANYALnet-Labs__cac1 sshd[4606]: Disconnected from 84.38.180.44 port 51318 [preauth]
Feb 27 10:36:11 UTC__SANYALnet-Labs__cac1 sshd[5320........
------------------------------

Fail2Ban Ban Triggered

Lines containing failures of 192.241.236.167
2020-02-27 15:05:58 SMTP protocol synchronization error (input sent whostnamehout wahostnameing for greeting): rejected connection from H=[192.241.236.167] input="EHLO zg0213a-266
"


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=192.241.236.167

Brute-force general attack.

20/2/27@09:21:33: FAIL: Alarm-Network address from=113.172.227.165
...

2020-02-27 08:21:23 H=(mx76.mb1p.com) [150.242.252.128]:48270 I=[192.147.25.65]:25 F= rejected RCPT : RBL: found in thrukfz5b56tq6xao6odgdyjrq.zen.dq.spamhaus.net (127.0.0.3, 127.0.0.4) (https://www.spamhaus.org/sbl/query/SBLCSS)
2020-02-27 08:21:23 H=(mx76.mb1p.com) [150.242.252.128]:48270 I=[192.147.25.65]:25 F= rejected RCPT : RBL: found in thrukfz5b56tq6xao6odgdyjrq.zen.dq.spamhaus.net (127.0.0.3, 127.0.0.4) (https://www.spamhaus.org/sbl/query/SBLCSS)
2020-02-27 08:21:23 H=(mx76.mb1p.com) [150.242.252.128]:48270 I=[192.147.25.65]:25 F= rejected RCPT : RBL: found in thrukfz5b56tq6xao6odgdyjrq.zen.dq.spamhaus.net (127.0.0.3, 127.0.0.4) (https://www.spamhaus.org/sbl/query/SBLCSS)
...

Feb 27 11:21:57 firewall sshd[29325]: Invalid user admin from 123.21.210.73
Feb 27 11:21:59 firewall sshd[29325]: Failed password for invalid user admin from 123.21.210.73 port 33020 ssh2
Feb 27 11:22:05 firewall sshd[29328]: Invalid user admin from 123.21.210.73
...

Feb 27 09:34:31 web1 sshd\[24333\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.31.83  user=root
Feb 27 09:34:33 web1 sshd\[24333\]: Failed password for root from 222.186.31.83 port 27779 ssh2
Feb 27 09:34:35 web1 sshd\[24333\]: Failed password for root from 222.186.31.83 port 27779 ssh2
Feb 27 09:34:37 web1 sshd\[24333\]: Failed password for root from 222.186.31.83 port 27779 ssh2
Feb 27 09:43:18 web1 sshd\[25258\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.31.83  user=root

firewall-block, port(s): 1433/tcp

Feb 27 19:35:27 work-partkepr sshd\[15842\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.190.92  user=root
Feb 27 19:35:28 work-partkepr sshd\[15842\]: Failed password for root from 222.186.190.92 port 54410 ssh2
...

Feb 27 19:15:57 lukav-desktop sshd\[23594\]: Invalid user ubuntu from 192.99.56.117
Feb 27 19:15:57 lukav-desktop sshd\[23594\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.99.56.117
Feb 27 19:16:00 lukav-desktop sshd\[23594\]: Failed password for invalid user ubuntu from 192.99.56.117 port 59482 ssh2
Feb 27 19:19:23 lukav-desktop sshd\[31876\]: Invalid user ubuntu from 192.99.56.117
Feb 27 19:19:23 lukav-desktop sshd\[31876\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.99.56.117