Apr  7 15:57:42 [host] sshd[8795]: Invalid user de
Apr  7 15:57:42 [host] sshd[8795]: pam_unix(sshd:a
Apr  7 15:57:44 [host] sshd[8795]: Failed password

Invalid user coracaobobo from 34.92.228.170 port 43396

Invalid user carol from 34.92.228.170 port 58938

Aug 23 06:58:09 home sshd[3551626]: Invalid user io from 34.92.228.170 port 32954
Aug 23 06:58:09 home sshd[3551626]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.92.228.170 
Aug 23 06:58:09 home sshd[3551626]: Invalid user io from 34.92.228.170 port 32954
Aug 23 06:58:10 home sshd[3551626]: Failed password for invalid user io from 34.92.228.170 port 32954 ssh2
Aug 23 07:01:00 home sshd[3552665]: Invalid user team1 from 34.92.228.170 port 47660
...

Aug 22 06:39:32 firewall sshd[23434]: Invalid user debian from 34.92.228.170
Aug 22 06:39:33 firewall sshd[23434]: Failed password for invalid user debian from 34.92.228.170 port 60720 ssh2
Aug 22 06:45:43 firewall sshd[23612]: Invalid user hanbo from 34.92.228.170
...

Blocked for port scanning.
Time: Sat Aug 1. 14:44:52 2020 +0200
IP: 34.92.22.121 (US/United States/121.22.92.34.bc.googleusercontent.com)

Sample of block hits:
Aug 1 14:42:16 vserv kernel: [5461620.948184] Firewall: *TCP_IN Blocked* IN=venet0 OUT= MAC= SRC=34.92.22.121 DST=[removed] LEN=60 TOS=0x00 PREC=0x00 TTL=55 ID=31302 DF PROTO=TCP SPT=53282 DPT=5555 WINDOW=28400 RES=0x00 SYN URGP=0
Aug 1 14:42:16 vserv kernel: [5461621.031230] Firewall: *TCP_IN Blocked* IN=venet0 OUT= MAC= SRC=34.92.22.121 DST=[removed] LEN=60 TOS=0x00 PREC=0x00 TTL=55 ID=56865 DF PROTO=TCP SPT=56942 DPT=5555 WINDOW=28400 RES=0x00 SYN URGP=0
Aug 1 14:42:17 vserv kernel: [5461621.949898] Firewall: *TCP_IN Blocked* IN=venet0 OUT= MAC= SRC=34.92.22.121 DST=[removed] LEN=60 TOS=0x00 PREC=0x00 TTL=55 ID=31303 DF PROTO=TCP SPT=53282 DPT=5555 WINDOW=28400 RES=0x00 SYN URGP=0
Aug 1 14:42:17 vserv kernel: [5461622.034687] Firewall: *TCP_IN Blocked* IN=venet0 OUT= MAC= SRC=34.92.22.121 DST=[removed] LEN=60 TOS=0x00 PREC=0x00 TTL=55 ID

HTTP/80/443/8080 Probe, Hack -

Jun 13 09:00:46 ns382633 sshd\[29336\]: Invalid user dongzy from 34.92.221.45 port 40586
Jun 13 09:00:46 ns382633 sshd\[29336\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.92.221.45
Jun 13 09:00:47 ns382633 sshd\[29336\]: Failed password for invalid user dongzy from 34.92.221.45 port 40586 ssh2
Jun 13 09:07:15 ns382633 sshd\[30442\]: Invalid user admin from 34.92.221.45 port 46576
Jun 13 09:07:15 ns382633 sshd\[30442\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.92.221.45

ET CINS Active Threat Intelligence Poor Reputation IP group 13 - port: 15381 proto: TCP cat: Misc Attack

srv02 Mass scanning activity detected Target: 15381  ..

2020-04-21T11:04:06.251186vps751288.ovh.net sshd\[17199\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.229.92.34.bc.googleusercontent.com  user=root
2020-04-21T11:04:08.685607vps751288.ovh.net sshd\[17199\]: Failed password for root from 34.92.229.91 port 45390 ssh2
2020-04-21T11:10:18.038250vps751288.ovh.net sshd\[17225\]: Invalid user ftpuser from 34.92.229.91 port 60134
2020-04-21T11:10:18.046984vps751288.ovh.net sshd\[17225\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.229.92.34.bc.googleusercontent.com
2020-04-21T11:10:19.891504vps751288.ovh.net sshd\[17225\]: Failed password for invalid user ftpuser from 34.92.229.91 port 60134 ssh2

Apr 20 21:52:14 ns382633 sshd\[29867\]: Invalid user oracle from 34.92.229.91 port 52782
Apr 20 21:52:14 ns382633 sshd\[29867\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.92.229.91
Apr 20 21:52:16 ns382633 sshd\[29867\]: Failed password for invalid user oracle from 34.92.229.91 port 52782 ssh2
Apr 20 21:56:59 ns382633 sshd\[30770\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.92.229.91  user=root
Apr 20 21:57:02 ns382633 sshd\[30770\]: Failed password for root from 34.92.229.91 port 52060 ssh2

Apr 17 22:22:37 v22018086721571380 sshd[28058]: Failed password for invalid user test from 34.92.229.91 port 45378 ssh2

SSH Brute-Force reported by Fail2Ban

Apr  6 09:26:19 scivo sshd[24350]: Failed password for r.r from 34.92.224.13 port 47574 ssh2
Apr  6 09:26:19 scivo sshd[24350]: Received disconnect from 34.92.224.13: 11: Bye Bye [preauth]
Apr  6 09:33:52 scivo sshd[24766]: Failed password for r.r from 34.92.224.13 port 57926 ssh2
Apr  6 09:33:52 scivo sshd[24766]: Received disconnect from 34.92.224.13: 11: Bye Bye [preauth]
Apr  6 09:38:56 scivo sshd[25011]: Failed password for r.r from 34.92.224.13 port 41604 ssh2
Apr  6 09:38:56 scivo sshd[25011]: Received disconnect from 34.92.224.13: 11: Bye Bye [preauth]
Apr  6 09:43:59 scivo sshd[25331]: Failed password for r.r from 34.92.224.13 port 53514 ssh2
Apr  6 09:43:59 scivo sshd[25331]: Received disconnect from 34.92.224.13: 11: Bye Bye [preauth]
Apr  6 09:49:01 scivo sshd[25588]: Failed password for r.r from 34.92.224.13 port 37196 ssh2
Apr  6 09:49:01 scivo sshd[25588]: Received disconnect from 34.92.224.13: 11: Bye Bye [preauth]
Apr  6 09:53:59 scivo sshd[25840]: Fail........
-------------------------------

Apr  7 08:38:39 ns392434 sshd[9568]: Invalid user andrea from 34.92.22.182 port 42116
Apr  7 08:38:39 ns392434 sshd[9568]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.92.22.182
Apr  7 08:38:39 ns392434 sshd[9568]: Invalid user andrea from 34.92.22.182 port 42116
Apr  7 08:38:41 ns392434 sshd[9568]: Failed password for invalid user andrea from 34.92.22.182 port 42116 ssh2
Apr  7 08:51:23 ns392434 sshd[9863]: Invalid user nextcloud from 34.92.22.182 port 39382
Apr  7 08:51:23 ns392434 sshd[9863]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.92.22.182
Apr  7 08:51:23 ns392434 sshd[9863]: Invalid user nextcloud from 34.92.22.182 port 39382
Apr  7 08:51:25 ns392434 sshd[9863]: Failed password for invalid user nextcloud from 34.92.22.182 port 39382 ssh2
Apr  7 08:56:34 ns392434 sshd[9951]: Invalid user minecraft from 34.92.22.182 port 50360

May 10 23:57:44 hostnameproxy sshd[4919]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.128.28.56  user=r.r
May 10 23:57:46 hostnameproxy sshd[4919]: Failed password for r.r from 188.128.28.56 port 12013 ssh2
May 10 23:58:59 hostnameproxy sshd[4996]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.128.28.56  user=r.r
May 10 23:59:01 hostnameproxy sshd[4996]: Failed password for r.r from 188.128.28.56 port 10467 ssh2
May 10 23:59:09 hostnameproxy sshd[5005]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.128.28.56  user=r.r
May 10 23:59:11 hostnameproxy sshd[5005]: Failed password for r.r from 188.128.28.56 port 29456 ssh2
May 11 00:00:26 hostnameproxy sshd[5066]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.128.28.56  user=r.r
May 11 00:00:28 hostnameproxy sshd[5066]: Failed password for r.r ........
------------------------------

May 11 14:05:57 v22018086721571380 sshd[14530]: Failed password for invalid user ftpuser from 190.188.141.111 port 46314 ssh2
May 11 14:10:36 v22018086721571380 sshd[20352]: Failed password for invalid user admin from 190.188.141.111 port 55196 ssh2

$f2bV_matches

(sshd) Failed SSH login from 45.184.24.5 (BR/Brazil/ns1.access-sollutions.net.br): 2 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: May 11 14:08:18 ubnt-55d23 sshd[10145]: Invalid user applmgr from 45.184.24.5 port 51784
May 11 14:08:20 ubnt-55d23 sshd[10145]: Failed password for invalid user applmgr from 45.184.24.5 port 51784 ssh2

1589198917 - 05/11/2020 14:08:37 Host: 2.35.247.228/2.35.247.228 Port: 445 TCP Blocked

May 11 12:08:35 system,error,critical: login failure for user admin from 120.29.60.118 via telnet
May 11 12:08:37 system,error,critical: login failure for user root from 120.29.60.118 via telnet
May 11 12:08:39 system,error,critical: login failure for user root from 120.29.60.118 via telnet
May 11 12:08:43 system,error,critical: login failure for user root from 120.29.60.118 via telnet
May 11 12:08:44 system,error,critical: login failure for user root from 120.29.60.118 via telnet
May 11 12:08:46 system,error,critical: login failure for user root from 120.29.60.118 via telnet
May 11 12:08:50 system,error,critical: login failure for user ubnt from 120.29.60.118 via telnet
May 11 12:08:52 system,error,critical: login failure for user root from 120.29.60.118 via telnet
May 11 12:08:53 system,error,critical: login failure for user admin from 120.29.60.118 via telnet
May 11 12:08:57 system,error,critical: login failure for user root from 120.29.60.118 via telnet

2020-05-11T15:03:06.468312vps773228.ovh.net sshd[26042]: Failed password for invalid user ut2k4server from 112.3.29.199 port 56648 ssh2
2020-05-11T15:07:27.201052vps773228.ovh.net sshd[26064]: Invalid user www-data from 112.3.29.199 port 40148
2020-05-11T15:07:27.212795vps773228.ovh.net sshd[26064]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.3.29.199
2020-05-11T15:07:27.201052vps773228.ovh.net sshd[26064]: Invalid user www-data from 112.3.29.199 port 40148
2020-05-11T15:07:29.569639vps773228.ovh.net sshd[26064]: Failed password for invalid user www-data from 112.3.29.199 port 40148 ssh2
...

attack

Automatic report - Port Scan Attack

May 11 14:00:25 web01.agentur-b-2.de postfix/smtpd[212820]: NOQUEUE: reject: RCPT from unknown[217.112.142.4]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
May 11 14:00:25 web01.agentur-b-2.de postfix/smtpd[212045]: NOQUEUE: reject: RCPT from unknown[217.112.142.4]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
May 11 14:06:17 web01.agentur-b-2.de postfix/smtpd[212045]: NOQUEUE: reject: RCPT from unknown[217.112.142.4]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
May 11 14:10:25 web01.agentur-b-2.de postfix/smtpd[216715]: NOQUEUE: reject: RCPT from unknown[217.112.142.4]: 450 4.7.1 : Helo comman

May 11 15:12:34 minden010 sshd[20256]: Failed password for root from 222.186.15.158 port 46342 ssh2
May 11 15:12:37 minden010 sshd[20256]: Failed password for root from 222.186.15.158 port 46342 ssh2
May 11 15:12:39 minden010 sshd[20256]: Failed password for root from 222.186.15.158 port 46342 ssh2
...

May 11 16:03:22 pkdns2 sshd\[9672\]: Invalid user hxt from 125.91.32.65May 11 16:03:24 pkdns2 sshd\[9672\]: Failed password for invalid user hxt from 125.91.32.65 port 53462 ssh2May 11 16:04:04 pkdns2 sshd\[9722\]: Invalid user ut3 from 125.91.32.65May 11 16:04:06 pkdns2 sshd\[9722\]: Failed password for invalid user ut3 from 125.91.32.65 port 58842 ssh2May 11 16:05:12 pkdns2 sshd\[9802\]: Invalid user lpa from 125.91.32.65May 11 16:05:14 pkdns2 sshd\[9802\]: Failed password for invalid user lpa from 125.91.32.65 port 4343 ssh2
...

5x Failed Password

May 11 15:28:48 vps647732 sshd[28354]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.211.60.153
May 11 15:28:50 vps647732 sshd[28354]: Failed password for invalid user ehi from 129.211.60.153 port 40060 ssh2
...

May 11 14:56:32 piServer sshd[16111]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.132.103.15 
May 11 14:56:33 piServer sshd[16111]: Failed password for invalid user ftpuser from 91.132.103.15 port 45732 ssh2
May 11 15:00:52 piServer sshd[16519]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.132.103.15 
...