2020-10-07T17:14:05.385160randservbullet-proofcloud-66.localdomain sshd[11759]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.88.12.72  user=root
2020-10-07T17:14:06.648756randservbullet-proofcloud-66.localdomain sshd[11759]: Failed password for root from 45.88.12.72 port 33198 ssh2
2020-10-07T17:29:25.885557randservbullet-proofcloud-66.localdomain sshd[11779]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.88.12.72  user=root
2020-10-07T17:29:27.781587randservbullet-proofcloud-66.localdomain sshd[11779]: Failed password for root from 45.88.12.72 port 60064 ssh2
...

Repeated brute force against a port

Sep  8 12:36:38 rancher-0 sshd[1496140]: Invalid user Friends from 45.88.12.72 port 43876
...

2020-08-26T08:38:08.408986sorsha.thespaminator.com sshd[3902]: Invalid user ub from 45.88.12.72 port 49596
2020-08-26T08:38:10.650020sorsha.thespaminator.com sshd[3902]: Failed password for invalid user ub from 45.88.12.72 port 49596 ssh2
...

fail2ban/Aug 21 16:07:02 h1962932 sshd[27252]: Invalid user llq from 45.88.12.72 port 52822
Aug 21 16:07:03 h1962932 sshd[27252]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.88.12.72
Aug 21 16:07:02 h1962932 sshd[27252]: Invalid user llq from 45.88.12.72 port 52822
Aug 21 16:07:03 h1962932 sshd[27252]: Failed password for invalid user llq from 45.88.12.72 port 52822 ssh2
Aug 21 16:11:09 h1962932 sshd[27374]: Invalid user Administrator from 45.88.12.72 port 52020

Invalid user hadoop from 45.88.12.72 port 42694

Aug 13 12:58:23 localhost sshd[107121]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.88.12.72  user=root
Aug 13 12:58:25 localhost sshd[107121]: Failed password for root from 45.88.12.72 port 56506 ssh2
Aug 13 13:02:16 localhost sshd[107609]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.88.12.72  user=root
Aug 13 13:02:17 localhost sshd[107609]: Failed password for root from 45.88.12.72 port 35630 ssh2
Aug 13 13:06:19 localhost sshd[108004]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.88.12.72  user=root
Aug 13 13:06:21 localhost sshd[108004]: Failed password for root from 45.88.12.72 port 43014 ssh2
...

Aug 11 04:57:29 jumpserver sshd[105429]: Failed password for root from 45.88.12.72 port 47314 ssh2
Aug 11 04:59:46 jumpserver sshd[105436]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.88.12.72  user=root
Aug 11 04:59:47 jumpserver sshd[105436]: Failed password for root from 45.88.12.72 port 54058 ssh2
...

Aug  9 00:42:35 ws24vmsma01 sshd[23831]: Failed password for root from 45.88.12.72 port 41318 ssh2
Aug  9 00:54:44 ws24vmsma01 sshd[54857]: Failed password for root from 45.88.12.72 port 48356 ssh2
...

2020-08-08T18:48:14.350433mail.standpoint.com.ua sshd[3812]: Failed password for root from 45.88.12.72 port 40066 ssh2
2020-08-08T18:49:28.697191mail.standpoint.com.ua sshd[3991]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.88.12.72  user=root
2020-08-08T18:49:30.732443mail.standpoint.com.ua sshd[3991]: Failed password for root from 45.88.12.72 port 54596 ssh2
2020-08-08T18:52:17.134705mail.standpoint.com.ua sshd[4650]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.88.12.72  user=root
2020-08-08T18:52:19.370704mail.standpoint.com.ua sshd[4650]: Failed password for root from 45.88.12.72 port 55414 ssh2
...

(sshd) Failed SSH login from 45.88.12.72 (HK/Hong Kong/-): 5 in the last 3600 secs

2020-07-30 00:56:52.798923-0500  localhost sshd[14391]: Failed password for invalid user nagatalab from 45.88.12.72 port 58568 ssh2

Jul  8 12:29:52 gw1 sshd[6762]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.88.12.72
Jul  8 12:29:53 gw1 sshd[6762]: Failed password for invalid user account from 45.88.12.72 port 38360 ssh2
...

Jun 17 01:07:42 propaganda sshd[23431]: Connection from 45.88.12.72 port 51446 on 10.0.0.160 port 22 rdomain ""
Jun 17 01:07:42 propaganda sshd[23431]: Connection closed by 45.88.12.72 port 51446 [preauth]

2020-10-12T12:29:28.883312shield sshd\[22544\]: Invalid user sgi from 45.88.12.52 port 38682
2020-10-12T12:29:28.890876shield sshd\[22544\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.88.12.52
2020-10-12T12:29:30.856508shield sshd\[22544\]: Failed password for invalid user sgi from 45.88.12.52 port 38682 ssh2
2020-10-12T12:33:26.852460shield sshd\[23058\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.88.12.52  user=sshd
2020-10-12T12:33:29.490893shield sshd\[23058\]: Failed password for sshd from 45.88.12.52 port 43878 ssh2

Fail2Ban

invalid user

Sep 13 12:37:55 host2 sshd[1310429]: Failed password for root from 45.88.12.52 port 57926 ssh2
Sep 13 12:42:02 host2 sshd[1310610]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.88.12.52  user=root
Sep 13 12:42:04 host2 sshd[1310610]: Failed password for root from 45.88.12.52 port 43442 ssh2
Sep 13 12:42:02 host2 sshd[1310610]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.88.12.52  user=root
Sep 13 12:42:04 host2 sshd[1310610]: Failed password for root from 45.88.12.52 port 43442 ssh2
...

Lines containing failures of 45.88.12.165
Sep  7 07:41:04 shared07 sshd[21622]: Invalid user minecraftserver from 45.88.12.165 port 37208
Sep  7 07:41:04 shared07 sshd[21622]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.88.12.165
Sep  7 07:41:06 shared07 sshd[21622]: Failed password for invalid user minecraftserver from 45.88.12.165 port 37208 ssh2
Sep  7 07:41:06 shared07 sshd[21622]: Received disconnect from 45.88.12.165 port 37208:11: Bye Bye [preauth]
Sep  7 07:41:06 shared07 sshd[21622]: Disconnected from invalid user minecraftserver 45.88.12.165 port 37208 [preauth]


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=45.88.12.165

Aug 30 17:56:01 vpn01 sshd[32609]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.88.12.52
Aug 30 17:56:03 vpn01 sshd[32609]: Failed password for invalid user radio from 45.88.12.52 port 41898 ssh2
...

Aug 28 04:05:07 instance-2 sshd[24575]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.88.12.52 
Aug 28 04:05:10 instance-2 sshd[24575]: Failed password for invalid user surya from 45.88.12.52 port 43646 ssh2
Aug 28 04:09:18 instance-2 sshd[24619]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.88.12.52

Invalid user user3 from 45.88.12.165 port 58035

Aug 25 20:16:42 cho sshd[1613276]: Failed password for root from 45.88.12.165 port 42591 ssh2
Aug 25 20:18:51 cho sshd[1613512]: Invalid user david from 45.88.12.165 port 59199
Aug 25 20:18:51 cho sshd[1613512]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.88.12.165 
Aug 25 20:18:51 cho sshd[1613512]: Invalid user david from 45.88.12.165 port 59199
Aug 25 20:18:53 cho sshd[1613512]: Failed password for invalid user david from 45.88.12.165 port 59199 ssh2
...

2020-08-25T03:56:24+0000 Failed SSH Authentication/Brute Force Attack. (Server 6)

Invalid user xjg from 45.88.12.52 port 41536

2020-08-20T04:06:05.886120shield sshd\[4421\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.88.12.165  user=root
2020-08-20T04:06:07.764747shield sshd\[4421\]: Failed password for root from 45.88.12.165 port 42625 ssh2
2020-08-20T04:07:42.824477shield sshd\[4782\]: Invalid user huy from 45.88.12.165 port 55116
2020-08-20T04:07:42.832817shield sshd\[4782\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.88.12.165
2020-08-20T04:07:45.027551shield sshd\[4782\]: Failed password for invalid user huy from 45.88.12.165 port 55116 ssh2

Aug 17 11:12:54 vps sshd[394943]: Invalid user minecraft from 45.88.12.52 port 55944
Aug 17 11:12:54 vps sshd[394943]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.88.12.52
Aug 17 11:12:56 vps sshd[394943]: Failed password for invalid user minecraft from 45.88.12.52 port 55944 ssh2
Aug 17 11:14:52 vps sshd[403331]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.88.12.52  user=root
Aug 17 11:14:54 vps sshd[403331]: Failed password for root from 45.88.12.52 port 55986 ssh2
...

Aug 10 11:28:33 ajax sshd[4501]: Failed password for root from 45.88.12.52 port 35764 ssh2

Aug  8 16:08:52 web-main sshd[802504]: Failed password for root from 45.88.12.52 port 42124 ssh2
Aug  8 16:13:18 web-main sshd[802549]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.88.12.52  user=root
Aug  8 16:13:21 web-main sshd[802549]: Failed password for root from 45.88.12.52 port 49476 ssh2

2020-04-24 UTC: (35x) - abdelhamid,adeline,aeneas,amavis,anonymous,brian,bullyserver,camilo,chen,cjchen,deploy1234,doug,fabio,gitolite,kmem,lia,liam,mc3,medieval,mv,mysql-test,postgrey,qody,quser,right,root(2x),sampath,site,teetotum,test5,tf2server,tomato,tomcat,vagrant

Apr 25 08:00:23 server sshd[19568]: Failed password for invalid user miner from 182.61.41.84 port 38280 ssh2
Apr 25 08:03:12 server sshd[20520]: Failed password for invalid user elias from 182.61.41.84 port 45702 ssh2
Apr 25 08:06:10 server sshd[21436]: Failed password for invalid user sg from 182.61.41.84 port 53112 ssh2

Apr 25 09:10:07 game-panel sshd[11471]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=60.220.185.61
Apr 25 09:10:09 game-panel sshd[11471]: Failed password for invalid user user from 60.220.185.61 port 52094 ssh2
Apr 25 09:12:17 game-panel sshd[11563]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=60.220.185.61

Apr 25 06:52:12 sso sshd[4106]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.242.55
Apr 25 06:52:13 sso sshd[4106]: Failed password for invalid user sylwester from 148.70.242.55 port 53140 ssh2
...

nft/Honeypot/22/73e86

[portscan] Port scan

2020-04-24 UTC: (44x) - actionteam,admco,admin,apples,backup,bobby,bouncer,chase,cj,djmax,dracula,ft,matt,newuser,nkinyanjui,opscode,owner,paps,password(2x),position,postgres,pouria,redis,rolo,root(4x),setup,spotlight,squid,superadmin,teampspeak3,test,test8,tftpd,ts,uptime,web,wpyan,wt,www,yw

Apr 25 08:51:43 ns381471 sshd[8739]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=196.188.42.130
Apr 25 08:51:45 ns381471 sshd[8739]: Failed password for invalid user cliqruser from 196.188.42.130 port 50031 ssh2

Brute-force attempt banned

1,17-10/02 [bc01/m32] PostRequest-Spammer scoring: essen

Apr 25 11:06:00 debian-2gb-nbg1-2 kernel: \[10064500.731488\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=89.248.167.141 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=247 ID=4628 PROTO=TCP SPT=55793 DPT=6740 WINDOW=1024 RES=0x00 SYN URGP=0

failed_logins

Repeated brute force against a port

(imapd) Failed IMAP login from 177.130.60.243 (BR/Brazil/243-60-130-177.redewsp.com.br): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Apr 25 08:21:10 ir1 dovecot[264309]: imap-login: Disconnected (auth failed, 1 attempts in 5 secs): user=, method=PLAIN, rip=177.130.60.243, lip=5.63.12.44, session=

Apr 25 07:52:18 XXXXXX sshd[49990]: Invalid user p@ssw0rd from 185.149.23.44 port 58500