Aug  2 02:02:43 web9 sshd\[16071\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.178.40.97  user=root
Aug  2 02:02:44 web9 sshd\[16071\]: Failed password for root from 51.178.40.97 port 38742 ssh2
Aug  2 02:06:43 web9 sshd\[16590\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.178.40.97  user=root
Aug  2 02:06:45 web9 sshd\[16590\]: Failed password for root from 51.178.40.97 port 50978 ssh2
Aug  2 02:10:39 web9 sshd\[17170\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.178.40.97  user=root

(imapd) Failed IMAP login from 118.69.225.57 (VN/Vietnam/118-69-225-57-static.hcm.fpt.vn): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Aug  2 16:40:28 ir1 dovecot[3110802]: imap-login: Disconnected (auth failed, 1 attempts in 5 secs): user=, method=PLAIN, rip=118.69.225.57, lip=5.63.12.44, TLS: Connection closed, session=

(smtpauth) Failed SMTP AUTH login from 82.177.126.99 (PL/Poland/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 2020-08-02 16:40:55 plain authenticator failed for ([82.177.126.99]) [82.177.126.99]: 535 Incorrect authentication data (set_id=reta.reta5246@iwnt.com)

 TCP (SYN) 192.35.168.236:5006 -> port 9345, len 44

Aug  2 12:56:59 game-panel sshd[406]: Failed password for root from 81.192.8.14 port 42392 ssh2
Aug  2 13:00:35 game-panel sshd[570]: Failed password for root from 81.192.8.14 port 41448 ssh2

Aug  2 14:20:59 inter-technics sshd[29006]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=163.44.169.18  user=root
Aug  2 14:21:01 inter-technics sshd[29006]: Failed password for root from 163.44.169.18 port 59908 ssh2
Aug  2 14:24:31 inter-technics sshd[29244]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=163.44.169.18  user=root
Aug  2 14:24:33 inter-technics sshd[29244]: Failed password for root from 163.44.169.18 port 57454 ssh2
Aug  2 14:28:05 inter-technics sshd[29480]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=163.44.169.18  user=root
Aug  2 14:28:06 inter-technics sshd[29480]: Failed password for root from 163.44.169.18 port 55004 ssh2
...

Aug  2 20:16:33 dhoomketu sshd[2107256]: Failed password for root from 112.85.42.89 port 45421 ssh2
Aug  2 20:18:58 dhoomketu sshd[2107264]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.85.42.89  user=root
Aug  2 20:18:59 dhoomketu sshd[2107264]: Failed password for root from 112.85.42.89 port 62374 ssh2
Aug  2 20:20:25 dhoomketu sshd[2107272]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.85.42.89  user=root
Aug  2 20:20:27 dhoomketu sshd[2107272]: Failed password for root from 112.85.42.89 port 62689 ssh2
...

Aug  2 08:10:38 logopedia-1vcpu-1gb-nyc1-01 sshd[113873]: Failed password for root from 128.201.78.220 port 33360 ssh2
...

Aug  2 15:10:36 hosting sshd[17201]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.182.99.72  user=root
Aug  2 15:10:38 hosting sshd[17201]: Failed password for root from 2.182.99.72 port 40994 ssh2
...

Aug  2 12:56:48 vps-51d81928 sshd[394133]: Failed password for root from 157.245.142.218 port 36314 ssh2
Aug  2 12:58:04 vps-51d81928 sshd[394156]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.142.218  user=root
Aug  2 12:58:06 vps-51d81928 sshd[394156]: Failed password for root from 157.245.142.218 port 54280 ssh2
Aug  2 12:59:22 vps-51d81928 sshd[394174]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.142.218  user=root
Aug  2 12:59:24 vps-51d81928 sshd[394174]: Failed password for root from 157.245.142.218 port 44014 ssh2
...

Aug  2 17:07:05 gw1 sshd[9791]: Failed password for root from 129.204.2.171 port 43020 ssh2
...

Aug  2 19:22:57 gw1 sshd[12674]: Failed password for root from 117.35.118.42 port 38590 ssh2
...

detected by Fail2Ban

Aug 2 17:15:50 *host* sshd\[6619\]: User *user* from 218.92.0.215 not allowed because none of user's groups are listed in AllowGroups

Aug  2 16:50:43 dcd-gentoo sshd[22029]: User root from 218.92.0.191 not allowed because none of user's groups are listed in AllowGroups
Aug  2 16:50:47 dcd-gentoo sshd[22029]: error: PAM: Authentication failure for illegal user root from 218.92.0.191
Aug  2 16:50:47 dcd-gentoo sshd[22029]: Failed keyboard-interactive/pam for invalid user root from 218.92.0.191 port 45399 ssh2
...