Aug 15 20:16:30 hcbbdb sshd\[12423\]: Invalid user sirle from 196.43.196.108
Aug 15 20:16:30 hcbbdb sshd\[12423\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=196.43.196.108
Aug 15 20:16:32 hcbbdb sshd\[12423\]: Failed password for invalid user sirle from 196.43.196.108 port 48410 ssh2
Aug 15 20:21:34 hcbbdb sshd\[13023\]: Invalid user mukesh from 196.43.196.108
Aug 15 20:21:34 hcbbdb sshd\[13023\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=196.43.196.108

Aug 16 01:46:30 vibhu-HP-Z238-Microtower-Workstation sshd\[27499\]: Invalid user r00t from 150.109.198.225
Aug 16 01:46:30 vibhu-HP-Z238-Microtower-Workstation sshd\[27499\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=150.109.198.225
Aug 16 01:46:32 vibhu-HP-Z238-Microtower-Workstation sshd\[27499\]: Failed password for invalid user r00t from 150.109.198.225 port 40474 ssh2
Aug 16 01:51:34 vibhu-HP-Z238-Microtower-Workstation sshd\[27724\]: Invalid user botuser from 150.109.198.225
Aug 16 01:51:34 vibhu-HP-Z238-Microtower-Workstation sshd\[27724\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=150.109.198.225
...

Aug 15 14:31:03 mail sshd\[1914\]: Failed password for root from 86.104.220.20 port 52905 ssh2
Aug 15 14:50:41 mail sshd\[2434\]: Invalid user milan from 86.104.220.20 port 26329
Aug 15 14:50:41 mail sshd\[2434\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=86.104.220.20
...

NAME : AS6128 CIDR : 69.122.32.0/20 SYN Flood DDoS Attack US - block certain countries :) IP: 69.122.35.173  Denial-of-Service Attack (DoS) Detected and Blocked by ADMIN  - data recovery https://help-dysk.pl

Aug 15 03:54:35 shared02 sshd[29535]: Invalid user aufbauorganisation from 189.59.40.212
Aug 15 03:54:35 shared02 sshd[29535]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.59.40.212
Aug 15 03:54:38 shared02 sshd[29535]: Failed password for invalid user aufbauorganisation from 189.59.40.212 port 57590 ssh2
Aug 15 03:54:38 shared02 sshd[29535]: Received disconnect from 189.59.40.212 port 57590:11: Bye Bye [preauth]
Aug 15 03:54:38 shared02 sshd[29535]: Disconnected from 189.59.40.212 port 57590 [preauth]
Aug 15 04:02:16 shared02 sshd[3028]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.59.40.212  user=r.r
Aug 15 04:02:18 shared02 sshd[3028]: Failed password for r.r from 189.59.40.212 port 47934 ssh2
Aug 15 04:02:18 shared02 sshd[3028]: Received d
.... truncated .... 

Aug 15 03:54:35 shared02 sshd[29535]: Invalid user aufbauorganisation from 189.59.40.212
Aug 15 03:54:35 shared02 ........
-------------------------------

2019-08-15T11:53:10.477964abusebot-6.cloudsearch.cf sshd\[30280\]: Invalid user tam from 124.16.139.145 port 41650

Aug 15 22:21:37 www sshd\[29524\]: Invalid user test3 from 167.114.114.193 port 57956
...

SSH/22 Probe, BF, Hack -

\[2019-08-15 15:42:31\] NOTICE\[2288\] chan_sip.c: Registration from '"1464" \' failed for '185.203.236.47:5084' - Wrong password
\[2019-08-15 15:42:31\] SECURITY\[2326\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-08-15T15:42:31.006-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="1464",SessionID="0x7ff4d0155c88",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/185.203.236.47/5084",Challenge="50cfef76",ReceivedChallenge="50cfef76",ReceivedHash="f4001a27936d7aa292efde177d65940e"
\[2019-08-15 15:43:08\] NOTICE\[2288\] chan_sip.c: Registration from '"2164" \' failed for '185.203.236.47:5071' - Wrong password
\[2019-08-15 15:43:08\] SECURITY\[2326\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-08-15T15:43:08.590-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="2164",SessionID="0x7ff4d0045808",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4

[Aegis] @ 2019-08-15 12:00:42  0100 -> Attempted Administrator Privilege Gain: ET SCAN LibSSH Based Frequent SSH Connections Likely BruteForce Attack

Aug 15 09:59:51 hanapaa sshd\[14709\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.170.242.108  user=root
Aug 15 09:59:52 hanapaa sshd\[14709\]: Failed password for root from 177.170.242.108 port 57294 ssh2
Aug 15 10:05:49 hanapaa sshd\[15163\]: Invalid user cathy from 177.170.242.108
Aug 15 10:05:49 hanapaa sshd\[15163\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.170.242.108
Aug 15 10:05:51 hanapaa sshd\[15163\]: Failed password for invalid user cathy from 177.170.242.108 port 40926 ssh2

Splunk® : Brute-Force login attempt on SSH:
Aug 15 16:21:41 testbed sshd[4595]: Connection closed by 1.52.165.210 port 46409 [preauth]

Aug 15 10:33:40 tdfoods sshd\[26183\]: Invalid user mahendra from 142.93.141.59
Aug 15 10:33:40 tdfoods sshd\[26183\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=device-proxy.hosting.autoenterprise.com.ua
Aug 15 10:33:41 tdfoods sshd\[26183\]: Failed password for invalid user mahendra from 142.93.141.59 port 57438 ssh2
Aug 15 10:37:49 tdfoods sshd\[26548\]: Invalid user teste from 142.93.141.59
Aug 15 10:37:49 tdfoods sshd\[26548\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=device-proxy.hosting.autoenterprise.com.ua

Invalid user staffc from 139.59.41.154 port 46766

Aug 15 16:16:38 vps200512 sshd\[22678\]: Invalid user printer from 129.28.154.240
Aug 15 16:16:38 vps200512 sshd\[22678\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.28.154.240
Aug 15 16:16:41 vps200512 sshd\[22678\]: Failed password for invalid user printer from 129.28.154.240 port 39836 ssh2
Aug 15 16:21:36 vps200512 sshd\[22787\]: Invalid user physics from 129.28.154.240
Aug 15 16:21:36 vps200512 sshd\[22787\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.28.154.240