Jul 20 08:26:09 ip-172-31-62-245 sshd\[14449\]: Invalid user no-reply from 5.135.161.72\
Jul 20 08:26:12 ip-172-31-62-245 sshd\[14449\]: Failed password for invalid user no-reply from 5.135.161.72 port 38502 ssh2\
Jul 20 08:30:30 ip-172-31-62-245 sshd\[14460\]: Invalid user support from 5.135.161.72\
Jul 20 08:30:32 ip-172-31-62-245 sshd\[14460\]: Failed password for invalid user support from 5.135.161.72 port 35724 ssh2\
Jul 20 08:34:55 ip-172-31-62-245 sshd\[14488\]: Invalid user terraria from 5.135.161.72\

Jul 19 13:18:27 vps200512 sshd\[3181\]: Invalid user ts1 from 5.135.161.72
Jul 19 13:18:27 vps200512 sshd\[3181\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.135.161.72
Jul 19 13:18:29 vps200512 sshd\[3181\]: Failed password for invalid user ts1 from 5.135.161.72 port 55082 ssh2
Jul 19 13:22:58 vps200512 sshd\[3305\]: Invalid user chester from 5.135.161.72
Jul 19 13:22:59 vps200512 sshd\[3305\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.135.161.72

Jul 19 08:26:47 vps200512 sshd\[30719\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.135.161.72  user=root
Jul 19 08:26:49 vps200512 sshd\[30719\]: Failed password for root from 5.135.161.72 port 38926 ssh2
Jul 19 08:31:23 vps200512 sshd\[30766\]: Invalid user oracle from 5.135.161.72
Jul 19 08:31:23 vps200512 sshd\[30766\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.135.161.72
Jul 19 08:31:24 vps200512 sshd\[30766\]: Failed password for invalid user oracle from 5.135.161.72 port 37414 ssh2

Jul 18 07:05:36 mail sshd\[30367\]: Invalid user admin from 5.135.161.72 port 36018
Jul 18 07:05:36 mail sshd\[30367\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.135.161.72
Jul 18 07:05:38 mail sshd\[30367\]: Failed password for invalid user admin from 5.135.161.72 port 36018 ssh2
Jul 18 07:10:06 mail sshd\[31298\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.135.161.72  user=root
Jul 18 07:10:07 mail sshd\[31298\]: Failed password for root from 5.135.161.72 port 34718 ssh2

Jul 18 02:20:13 mail sshd\[14554\]: Invalid user user from 5.135.161.72 port 38488
Jul 18 02:20:13 mail sshd\[14554\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.135.161.72
Jul 18 02:20:15 mail sshd\[14554\]: Failed password for invalid user user from 5.135.161.72 port 38488 ssh2
Jul 18 02:24:38 mail sshd\[15220\]: Invalid user ftp from 5.135.161.72 port 36602
Jul 18 02:24:38 mail sshd\[15220\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.135.161.72

ssh failed login

Jul  4 15:14:16 apollo sshd\[24222\]: Invalid user test from 5.135.161.72Jul  4 15:14:18 apollo sshd\[24222\]: Failed password for invalid user test from 5.135.161.72 port 51060 ssh2Jul  4 15:17:43 apollo sshd\[24233\]: Invalid user raghu.iyengar from 5.135.161.72
...

Fail2Ban Ban Triggered (2)

$f2bV_matches

Oct  3 19:17:52 ws26vmsma01 sshd[50173]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.135.161.7
Oct  3 19:17:53 ws26vmsma01 sshd[50173]: Failed password for invalid user work from 5.135.161.7 port 58844 ssh2
...

$f2bV_matches

Sep 29 12:17:52 rocket sshd[11848]: Failed password for invalid user digital from 5.135.161.7 port 37521 ssh2
Sep 29 12:22:50 rocket sshd[12480]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.135.161.7
Sep 29 12:22:52 rocket sshd[12480]: Failed password for invalid user deployer from 5.135.161.7 port 41379 ssh2
...

Sep 29 10:31:33 rocket sshd[29994]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.135.161.7
Sep 29 10:31:35 rocket sshd[29994]: Failed password for invalid user nagios from 5.135.161.7 port 41193 ssh2
Sep 29 10:36:35 rocket sshd[30670]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.135.161.7
...

Sep 26 19:11:37 vmd17057 sshd[15233]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.135.161.7 
Sep 26 19:11:39 vmd17057 sshd[15233]: Failed password for invalid user mary from 5.135.161.7 port 43327 ssh2
...

"fail2ban match"

$f2bV_matches

sshd: Failed password for .... from 5.135.161.7 port 36760 ssh2 (12 attempts)

2020-08-29T21:29:38.270903upcloud.m0sh1x2.com sshd[2614]: Invalid user demo from 5.135.161.7 port 46520

Aug 25 17:57:06 srv-ubuntu-dev3 sshd[46907]: Invalid user wds from 5.135.161.7
Aug 25 17:57:06 srv-ubuntu-dev3 sshd[46907]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.135.161.7
Aug 25 17:57:06 srv-ubuntu-dev3 sshd[46907]: Invalid user wds from 5.135.161.7
Aug 25 17:57:08 srv-ubuntu-dev3 sshd[46907]: Failed password for invalid user wds from 5.135.161.7 port 39795 ssh2
Aug 25 18:02:02 srv-ubuntu-dev3 sshd[47509]: Invalid user cs from 5.135.161.7
Aug 25 18:02:02 srv-ubuntu-dev3 sshd[47509]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.135.161.7
Aug 25 18:02:02 srv-ubuntu-dev3 sshd[47509]: Invalid user cs from 5.135.161.7
Aug 25 18:02:04 srv-ubuntu-dev3 sshd[47509]: Failed password for invalid user cs from 5.135.161.7 port 43126 ssh2
Aug 25 18:06:58 srv-ubuntu-dev3 sshd[48029]: Invalid user judge from 5.135.161.7
...

malicious Brute-Force reported by https://www.patrick-binder.de
...

(sshd) Failed SSH login from 5.135.161.7 (FR/France/ns329327.ip-5-135-161.eu): 5 in the last 3600 secs

Aug  6 23:39:19 Ubuntu-1404-trusty-64-minimal sshd\[15093\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.135.161.7  user=root
Aug  6 23:39:21 Ubuntu-1404-trusty-64-minimal sshd\[15093\]: Failed password for root from 5.135.161.7 port 49996 ssh2
Aug  6 23:48:31 Ubuntu-1404-trusty-64-minimal sshd\[22527\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.135.161.7  user=root
Aug  6 23:48:33 Ubuntu-1404-trusty-64-minimal sshd\[22527\]: Failed password for root from 5.135.161.7 port 53340 ssh2
Aug  6 23:54:06 Ubuntu-1404-trusty-64-minimal sshd\[28013\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.135.161.7  user=root

Sep  9 22:55:55 ny01 sshd[5085]: Failed password for root from 187.32.178.45 port 3783 ssh2
Sep  9 23:03:03 ny01 sshd[6487]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.32.178.45
Sep  9 23:03:06 ny01 sshd[6487]: Failed password for invalid user deploy from 187.32.178.45 port 60266 ssh2

Sep 10 03:22:20 smtp postfix/smtpd[6126]: NOQUEUE: reject: RCPT from wiserobotics-T1-0-0-153615-iacc02.blm.embratel.net.br[200.228.86.78]: 554 5.7.1 Service unavailable; Client host [200.228.86.78] blocked using bl.spamcop.net; Blocked - see https://www.spamcop.net/bl.shtml?200.228.86.78; from= to= proto=ESMTP helo=
...

Feb  1 02:38:35 vtv3 sshd\[26292\]: Invalid user teste from 51.75.122.16 port 40924
Feb  1 02:38:35 vtv3 sshd\[26292\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.122.16
Feb  1 02:38:37 vtv3 sshd\[26292\]: Failed password for invalid user teste from 51.75.122.16 port 40924 ssh2
Feb  1 02:41:21 vtv3 sshd\[27398\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.122.16  user=mail
Feb  1 02:41:23 vtv3 sshd\[27398\]: Failed password for mail from 51.75.122.16 port 33098 ssh2
Feb 12 20:48:47 vtv3 sshd\[6016\]: Invalid user cxwh from 51.75.122.16 port 34140
Feb 12 20:48:47 vtv3 sshd\[6016\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.122.16
Feb 12 20:48:49 vtv3 sshd\[6016\]: Failed password for invalid user cxwh from 51.75.122.16 port 34140 ssh2
Feb 12 20:53:59 vtv3 sshd\[7473\]: Invalid user web from 51.75.122.16 port 52424
Feb 12 20:53:59 vtv3 sshd\[7473\]: p

Sep 10 05:59:09 www sshd\[65174\]: Invalid user student1 from 91.134.140.242
Sep 10 05:59:09 www sshd\[65174\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.134.140.242
Sep 10 05:59:11 www sshd\[65174\]: Failed password for invalid user student1 from 91.134.140.242 port 33862 ssh2
...

Sep  9 22:05:06 aat-srv002 sshd[1724]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.32.215.89
Sep  9 22:05:08 aat-srv002 sshd[1724]: Failed password for invalid user postgres from 178.32.215.89 port 39396 ssh2
Sep  9 22:10:41 aat-srv002 sshd[1858]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.32.215.89
Sep  9 22:10:43 aat-srv002 sshd[1858]: Failed password for invalid user vbox from 178.32.215.89 port 44812 ssh2
...

schuetzenmusikanten.de 203.156.63.19 \[10/Sep/2019:03:21:52 +0200\] "POST /wp-login.php HTTP/1.1" 200 5683 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"
schuetzenmusikanten.de 203.156.63.19 \[10/Sep/2019:03:21:54 +0200\] "POST /wp-login.php HTTP/1.1" 200 5649 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"

Sep  9 16:27:33 sachi sshd\[19873\]: Invalid user debian from 93.43.39.56
Sep  9 16:27:33 sachi sshd\[19873\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=posta.teamleadersrl.it
Sep  9 16:27:35 sachi sshd\[19873\]: Failed password for invalid user debian from 93.43.39.56 port 57826 ssh2
Sep  9 16:35:42 sachi sshd\[20597\]: Invalid user git from 93.43.39.56
Sep  9 16:35:42 sachi sshd\[20597\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=posta.teamleadersrl.it

Sep 10 05:25:47 icinga sshd[16763]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.159.8
Sep 10 05:25:49 icinga sshd[16763]: Failed password for invalid user postgrespass from 128.199.159.8 port 54298 ssh2
...

Automatic report - Port Scan Attack

Sep  9 17:17:34 php1 sshd\[6422\]: Invalid user christian from 193.70.2.117
Sep  9 17:17:34 php1 sshd\[6422\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.ip-193-70-2.eu
Sep  9 17:17:35 php1 sshd\[6422\]: Failed password for invalid user christian from 193.70.2.117 port 57200 ssh2
Sep  9 17:22:51 php1 sshd\[7036\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.ip-193-70-2.eu  user=mysql
Sep  9 17:22:54 php1 sshd\[7036\]: Failed password for mysql from 193.70.2.117 port 39692 ssh2

Sep 10 04:31:04 eventyay sshd[17151]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=176.79.135.185
Sep 10 04:31:06 eventyay sshd[17151]: Failed password for invalid user oracle from 176.79.135.185 port 61444 ssh2
Sep 10 04:39:54 eventyay sshd[17282]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=176.79.135.185
...

Sep 10 06:18:13 www sshd\[646\]: Invalid user tomcat from 74.141.132.233
Sep 10 06:18:13 www sshd\[646\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=74.141.132.233
Sep 10 06:18:15 www sshd\[646\]: Failed password for invalid user tomcat from 74.141.132.233 port 37518 ssh2
...

Sep 10 05:11:52 hosting sshd[3557]: Invalid user student1 from 74.63.250.6 port 37422
...

Sep  9 16:40:55 web9 sshd\[18833\]: Invalid user sail_ftp from 151.80.217.219
Sep  9 16:40:55 web9 sshd\[18833\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=151.80.217.219
Sep  9 16:40:56 web9 sshd\[18833\]: Failed password for invalid user sail_ftp from 151.80.217.219 port 41244 ssh2
Sep  9 16:46:42 web9 sshd\[19871\]: Invalid user 201 from 151.80.217.219
Sep  9 16:46:42 web9 sshd\[19871\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=151.80.217.219

Sep  9 22:35:44 ny01 sshd[1063]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.99.94
Sep  9 22:35:46 ny01 sshd[1063]: Failed password for invalid user christian from 165.22.99.94 port 60422 ssh2
Sep  9 22:42:05 ny01 sshd[2277]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.99.94