2020-10-05T07:42:18.877435shield sshd\[2890\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.247.250.238  user=root
2020-10-05T07:42:20.623581shield sshd\[2890\]: Failed password for root from 113.247.250.238 port 42682 ssh2
2020-10-05T07:45:10.842973shield sshd\[3259\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.247.250.238  user=root
2020-10-05T07:45:12.869887shield sshd\[3259\]: Failed password for root from 113.247.250.238 port 41252 ssh2
2020-10-05T07:48:06.326690shield sshd\[3499\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.247.250.238  user=root

Oct  5 19:33:57 sso sshd[14195]: Failed password for root from 112.85.42.110 port 50948 ssh2
Oct  5 19:34:00 sso sshd[14195]: Failed password for root from 112.85.42.110 port 50948 ssh2
...

Cowrie Honeypot: Unauthorised SSH/Telnet login attempt with user "root" at 2020-10-05T13:46:45Z

$f2bV_matches

 TCP (SYN) 125.166.1.55:6201 -> port 23, len 44

Oct  5 12:17:14 rotator sshd\[29726\]: Failed password for root from 193.112.213.248 port 35796 ssh2Oct  5 12:18:43 rotator sshd\[29767\]: Failed password for root from 193.112.213.248 port 52742 ssh2Oct  5 12:20:20 rotator sshd\[30456\]: Failed password for root from 193.112.213.248 port 41460 ssh2Oct  5 12:21:58 rotator sshd\[30567\]: Failed password for root from 193.112.213.248 port 58420 ssh2Oct  5 12:23:31 rotator sshd\[30595\]: Failed password for root from 193.112.213.248 port 47132 ssh2Oct  5 12:25:01 rotator sshd\[30615\]: Failed password for root from 193.112.213.248 port 35850 ssh2
...

Oct  5 16:27:30 dcd-gentoo sshd[26186]: User root from 218.92.0.195 not allowed because none of user's groups are listed in AllowGroups
Oct  5 16:27:33 dcd-gentoo sshd[26186]: error: PAM: Authentication failure for illegal user root from 218.92.0.195
Oct  5 16:27:33 dcd-gentoo sshd[26186]: Failed keyboard-interactive/pam for invalid user root from 218.92.0.195 port 50034 ssh2
...

Oct  5 19:12:12 dev0-dcde-rnet sshd[20961]: Failed password for root from 222.186.42.213 port 29786 ssh2
Oct  5 19:12:26 dev0-dcde-rnet sshd[20963]: Failed password for root from 222.186.42.213 port 51964 ssh2

Oct  5 17:30:40 PorscheCustomer sshd[26203]: Failed password for root from 175.24.36.114 port 40560 ssh2
Oct  5 17:32:10 PorscheCustomer sshd[26234]: Failed password for root from 175.24.36.114 port 55320 ssh2
...

Listed on    zen-spamhaus also abuseat.org   / proto=6  .  srcport=28576  .  dstport=23 Telnet  .     (3518)

[2020-10-04 19:46:17] NOTICE[1182][C-000012c9] chan_sip.c: Call from '' (46.249.32.146:61792) to extension '011441904911054' rejected because extension not found in context 'public'.
[2020-10-04 19:46:17] SECURITY[1204] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-10-04T19:46:17.310-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="011441904911054",SessionID="0x7f22f854d238",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/46.249.32.146/61792",ACLName="no_extension_match"
[2020-10-04 19:46:50] NOTICE[1182][C-000012cb] chan_sip.c: Call from '' (46.249.32.146:55337) to extension '9011441904911054' rejected because extension not found in context 'public'.
...

SSH invalid-user multiple login try

[munged]::443 2607:5300:60:35b3:: - - [05/Oct/2020:16:24:35 +0200] "POST /[munged]: HTTP/1.1" 200 6132 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"

scott    ssh:notty    37.187.96.130    2020-10-05T09:14:37-0700 - 2020-10-05T09:14:37-0700  (00:00)
...

Connection to SSH Honeypot - Detected by HoneypotDB