"SSH brute force auth login attempt."

2020-01-02T00:24:00.887405shield sshd\[8624\]: Invalid user root3333 from 47.40.20.138 port 51308
2020-01-02T00:24:00.891862shield sshd\[8624\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=47-40-20-138.dhcp.stls.mo.charter.com
2020-01-02T00:24:02.772755shield sshd\[8624\]: Failed password for invalid user root3333 from 47.40.20.138 port 51308 ssh2
2020-01-02T00:26:33.688016shield sshd\[9478\]: Invalid user adjangba from 47.40.20.138 port 46320
2020-01-02T00:26:33.692341shield sshd\[9478\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=47-40-20-138.dhcp.stls.mo.charter.com

$f2bV_matches

2019-12-21T16:00:13.3516141240 sshd\[12852\]: Invalid user ubuntu from 47.40.20.138 port 59000
2019-12-21T16:00:13.3541671240 sshd\[12852\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.40.20.138
2019-12-21T16:00:15.3416241240 sshd\[12852\]: Failed password for invalid user ubuntu from 47.40.20.138 port 59000 ssh2
...

Dec 14 09:22:30 vps647732 sshd[31336]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.40.20.138
Dec 14 09:22:31 vps647732 sshd[31336]: Failed password for invalid user michaela from 47.40.20.138 port 52186 ssh2
...

Dec 10 22:21:03 wbs sshd\[13277\]: Invalid user murl from 47.40.20.138
Dec 10 22:21:03 wbs sshd\[13277\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=47-40-20-138.dhcp.stls.mo.charter.com
Dec 10 22:21:05 wbs sshd\[13277\]: Failed password for invalid user murl from 47.40.20.138 port 60660 ssh2
Dec 10 22:26:36 wbs sshd\[13769\]: Invalid user fosli from 47.40.20.138
Dec 10 22:26:36 wbs sshd\[13769\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=47-40-20-138.dhcp.stls.mo.charter.com

2019-12-08T08:03:11.497242abusebot-4.cloudsearch.cf sshd\[10778\]: Invalid user tortorella from 47.40.20.138 port 51496

Dec  6 21:03:05 server sshd\[25088\]: Invalid user nabisco from 47.40.20.138
Dec  6 21:03:05 server sshd\[25088\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=47-40-20-138.dhcp.stls.mo.charter.com 
Dec  6 21:03:07 server sshd\[25088\]: Failed password for invalid user nabisco from 47.40.20.138 port 58854 ssh2
Dec  6 21:12:19 server sshd\[28048\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=47-40-20-138.dhcp.stls.mo.charter.com  user=root
Dec  6 21:12:20 server sshd\[28048\]: Failed password for root from 47.40.20.138 port 38238 ssh2
...

Dec  6 06:00:07 h2177944 sshd\[2119\]: Invalid user ahalieia from 47.40.20.138 port 56044
Dec  6 06:00:07 h2177944 sshd\[2119\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.40.20.138
Dec  6 06:00:09 h2177944 sshd\[2119\]: Failed password for invalid user ahalieia from 47.40.20.138 port 56044 ssh2
Dec  6 06:08:05 h2177944 sshd\[2621\]: Invalid user gruetzmacher from 47.40.20.138 port 45622
Dec  6 06:08:05 h2177944 sshd\[2621\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.40.20.138
...

Dec  5 00:33:25 xeon sshd[54629]: Failed password for invalid user quinlisk from 47.40.20.138 port 33098 ssh2

Dec  4 03:57:23 eddieflores sshd\[15908\]: Invalid user taz from 47.40.20.138
Dec  4 03:57:23 eddieflores sshd\[15908\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=47-40-20-138.dhcp.stls.mo.charter.com
Dec  4 03:57:25 eddieflores sshd\[15908\]: Failed password for invalid user taz from 47.40.20.138 port 44062 ssh2
Dec  4 04:03:23 eddieflores sshd\[16430\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=47-40-20-138.dhcp.stls.mo.charter.com  user=root
Dec  4 04:03:25 eddieflores sshd\[16430\]: Failed password for root from 47.40.20.138 port 40962 ssh2

Nov  3 08:32:08 piServer sshd[15219]: Failed password for root from 47.40.20.138 port 36480 ssh2
Nov  3 08:36:30 piServer sshd[15455]: Failed password for root from 47.40.20.138 port 47190 ssh2
...

fail2ban

$f2bV_matches

$f2bV_matches

Oct 10 23:13:53 v22019058497090703 sshd[18910]: Failed password for root from 47.40.20.138 port 54946 ssh2
Oct 10 23:17:35 v22019058497090703 sshd[19196]: Failed password for root from 47.40.20.138 port 38322 ssh2
...

Oct  6 16:52:31 v22018076622670303 sshd\[25235\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.40.20.138  user=root
Oct  6 16:52:33 v22018076622670303 sshd\[25235\]: Failed password for root from 47.40.20.138 port 48138 ssh2
Oct  6 16:56:19 v22018076622670303 sshd\[25267\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.40.20.138  user=root
...

DATE:2019-10-03 19:59:17,IP:47.40.20.138,MATCHES:10,PORT:ssh

Oct  2 01:26:09 server sshd\[14803\]: Invalid user ui from 47.40.20.138 port 45396
Oct  2 01:26:09 server sshd\[14803\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.40.20.138
Oct  2 01:26:11 server sshd\[14803\]: Failed password for invalid user ui from 47.40.20.138 port 45396 ssh2
Oct  2 01:29:53 server sshd\[1048\]: Invalid user okab from 47.40.20.138 port 56532
Oct  2 01:29:53 server sshd\[1048\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.40.20.138

Sep 26 19:48:02 friendsofhawaii sshd\[21912\]: Invalid user manager from 47.40.20.138
Sep 26 19:48:02 friendsofhawaii sshd\[21912\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=47-40-20-138.dhcp.stls.mo.charter.com
Sep 26 19:48:05 friendsofhawaii sshd\[21912\]: Failed password for invalid user manager from 47.40.20.138 port 41626 ssh2
Sep 26 19:52:25 friendsofhawaii sshd\[22273\]: Invalid user db2inst1 from 47.40.20.138
Sep 26 19:52:25 friendsofhawaii sshd\[22273\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=47-40-20-138.dhcp.stls.mo.charter.com

Sep 24 01:43:45 aat-srv002 sshd[3467]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.40.20.138
Sep 24 01:43:46 aat-srv002 sshd[3467]: Failed password for invalid user foswiki from 47.40.20.138 port 36900 ssh2
Sep 24 01:47:29 aat-srv002 sshd[3558]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.40.20.138
Sep 24 01:47:32 aat-srv002 sshd[3558]: Failed password for invalid user vali from 47.40.20.138 port 49248 ssh2
...

SSH login attempts with user root at 2020-01-02.

Jan 12 01:09:42 XXX sshd[56540]: Invalid user debug from 142.93.154.90 port 42252

Unauthorized connection attempt detected from IP address 117.240.172.19 to port 2220 [J]

Automatic report - Port Scan Attack

Jan 13 00:24:22 pornomens sshd\[3599\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.180.171.95  user=root
Jan 13 00:24:24 pornomens sshd\[3599\]: Failed password for root from 180.180.171.95 port 33696 ssh2
Jan 13 00:27:18 pornomens sshd\[3645\]: Invalid user gmodserver4 from 180.180.171.95 port 60808
Jan 13 00:27:19 pornomens sshd\[3645\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.180.171.95
...

2020-01-12T19:05:08.7730671495-001 sshd[32453]: Invalid user jp from 190.104.149.36 port 50159
2020-01-12T19:05:08.7795541495-001 sshd[32453]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.104.149.36
2020-01-12T19:05:08.7730671495-001 sshd[32453]: Invalid user jp from 190.104.149.36 port 50159
2020-01-12T19:05:10.6196331495-001 sshd[32453]: Failed password for invalid user jp from 190.104.149.36 port 50159 ssh2
2020-01-12T19:07:26.1002191495-001 sshd[32570]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.104.149.36  user=root
2020-01-12T19:07:28.0824221495-001 sshd[32570]: Failed password for root from 190.104.149.36 port 59038 ssh2
2020-01-12T19:09:53.8031821495-001 sshd[32702]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.104.149.36  user=root
2020-01-12T19:09:55.7686801495-001 sshd[32702]: Failed password for root from 190.104.149.36 port 39682 ss
...

Unauthorized connection attempt detected from IP address 188.131.254.158 to port 2220 [J]

Jan 13 03:33:27 server sshd\[27825\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.175.147  user=root
Jan 13 03:33:28 server sshd\[27825\]: Failed password for root from 222.186.175.147 port 49758 ssh2
Jan 13 03:33:32 server sshd\[27825\]: Failed password for root from 222.186.175.147 port 49758 ssh2
Jan 13 03:33:35 server sshd\[27825\]: Failed password for root from 222.186.175.147 port 49758 ssh2
Jan 13 03:33:38 server sshd\[27825\]: Failed password for root from 222.186.175.147 port 49758 ssh2
...

25245/tcp 22986/tcp 47711/tcp...
[2020-01-10/13]720pkt,720pt.(tcp)

SCAMMER RATS ! 
Sun Jan 12 @ 10:17pm
SPAM[resolve_helo_domain]
109.228.56.166
tamunoene.nonju@accat.com.ng

It’s safe

Unauthorized connection attempt detected from IP address 110.52.215.86 to port 2220 [J]

Unauthorized connection attempt detected from IP address 140.143.228.18 to port 2220 [J]

Jan 12 17:49:54 hostnameproxy sshd[12677]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.40.250  user=r.r
Jan 12 17:49:56 hostnameproxy sshd[12677]: Failed password for r.r from 142.93.40.250 port 57708 ssh2
Jan 12 17:52:46 hostnameproxy sshd[12754]: Invalid user 1 from 142.93.40.250 port 32882
Jan 12 17:52:46 hostnameproxy sshd[12754]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.40.250
Jan 12 17:52:48 hostnameproxy sshd[12754]: Failed password for invalid user 1 from 142.93.40.250 port 32882 ssh2
Jan 12 17:55:35 hostnameproxy sshd[12861]: Invalid user alexandre from 142.93.40.250 port 36288
Jan 12 17:55:35 hostnameproxy sshd[12861]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.40.250
Jan 12 17:55:37 hostnameproxy sshd[12861]: Failed password for invalid user alexandre from 142.93.40.250 port 36288 ssh2
Jan 12 17:58:30 host........
------------------------------

Jan 13 00:09:36 unicornsoft sshd\[13679\]: User root from 112.85.42.176 not allowed because not listed in AllowUsers
Jan 13 00:09:36 unicornsoft sshd\[13679\]: Failed none for invalid user root from 112.85.42.176 port 65149 ssh2
Jan 13 00:09:36 unicornsoft sshd\[13679\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.85.42.176  user=root

Jan 13 01:27:56 sso sshd[19687]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.202.218
Jan 13 01:27:59 sso sshd[19687]: Failed password for invalid user wb from 51.75.202.218 port 33444 ssh2
...