Apr 10 10:07:19 host sshd[45889]: Invalid user nagios from 51.15.79.194 port 39006
...

Fail2Ban Ban Triggered (2)

2020-04-03T01:43:08.928760Z 9094c888bc19 New connection: 51.15.79.194:37898 (172.17.0.4:2222) [session: 9094c888bc19]
2020-04-03T01:57:20.075042Z faf259896a2a New connection: 51.15.79.194:38256 (172.17.0.4:2222) [session: faf259896a2a]

Mar 30 08:34:35 srv-ubuntu-dev3 sshd[120399]: Invalid user sdq from 51.15.79.194
Mar 30 08:34:35 srv-ubuntu-dev3 sshd[120399]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.15.79.194
Mar 30 08:34:35 srv-ubuntu-dev3 sshd[120399]: Invalid user sdq from 51.15.79.194
Mar 30 08:34:38 srv-ubuntu-dev3 sshd[120399]: Failed password for invalid user sdq from 51.15.79.194 port 39682 ssh2
Mar 30 08:38:26 srv-ubuntu-dev3 sshd[121167]: Invalid user era from 51.15.79.194
Mar 30 08:38:26 srv-ubuntu-dev3 sshd[121167]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.15.79.194
Mar 30 08:38:26 srv-ubuntu-dev3 sshd[121167]: Invalid user era from 51.15.79.194
Mar 30 08:38:28 srv-ubuntu-dev3 sshd[121167]: Failed password for invalid user era from 51.15.79.194 port 51928 ssh2
Mar 30 08:42:16 srv-ubuntu-dev3 sshd[121769]: Invalid user skie from 51.15.79.194
...

Mar 11 15:41:53 [host] sshd[30371]: pam_unix(sshd:
Mar 11 15:41:55 [host] sshd[30371]: Failed passwor
Mar 11 15:46:02 [host] sshd[30524]: pam_unix(sshd:

Mar 11 03:45:58 h2779839 sshd[19071]: Invalid user passw from 51.15.79.194 port 60238
Mar 11 03:45:58 h2779839 sshd[19071]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.15.79.194
Mar 11 03:45:58 h2779839 sshd[19071]: Invalid user passw from 51.15.79.194 port 60238
Mar 11 03:46:00 h2779839 sshd[19071]: Failed password for invalid user passw from 51.15.79.194 port 60238 ssh2
Mar 11 03:49:19 h2779839 sshd[19112]: Invalid user ananth from 51.15.79.194 port 41182
Mar 11 03:49:19 h2779839 sshd[19112]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.15.79.194
Mar 11 03:49:19 h2779839 sshd[19112]: Invalid user ananth from 51.15.79.194 port 41182
Mar 11 03:49:21 h2779839 sshd[19112]: Failed password for invalid user ananth from 51.15.79.194 port 41182 ssh2
Mar 11 03:52:46 h2779839 sshd[19166]: Invalid user amandabackuppass from 51.15.79.194 port 50344
...

Feb 17 20:23:57 v22018076622670303 sshd\[4902\]: Invalid user beecho from 51.15.79.194 port 41412
Feb 17 20:23:57 v22018076622670303 sshd\[4902\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.15.79.194
Feb 17 20:23:58 v22018076622670303 sshd\[4902\]: Failed password for invalid user beecho from 51.15.79.194 port 41412 ssh2
...

Unauthorized connection attempt detected from IP address 51.15.79.194 to port 2220 [J]

Unauthorized connection attempt detected from IP address 51.15.79.194 to port 2220 [J]

1578128851 - 01/04/2020 10:07:31 Host: 51.15.79.194/51.15.79.194 Port: 22 TCP Blocked

Dec 26 16:36:35 pi sshd\[1971\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.15.79.194  user=root
Dec 26 16:36:37 pi sshd\[1971\]: Failed password for root from 51.15.79.194 port 49666 ssh2
Dec 26 16:38:30 pi sshd\[1992\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.15.79.194  user=nobody
Dec 26 16:38:32 pi sshd\[1992\]: Failed password for nobody from 51.15.79.194 port 40412 ssh2
Dec 26 16:40:31 pi sshd\[2094\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.15.79.194  user=mysql
...

Tried sshing with brute force.

Dec 21 08:53:54 * sshd[10808]: Failed password for root from 51.15.79.194 port 56556 ssh2
Dec 21 08:59:31 * sshd[11516]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.15.79.194

Lines containing failures of 51.15.79.194
Dec 17 06:01:27 shared10 sshd[17993]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.15.79.194  user=r.r
Dec 17 06:01:29 shared10 sshd[17993]: Failed password for r.r from 51.15.79.194 port 38090 ssh2
Dec 17 06:01:29 shared10 sshd[17993]: Received disconnect from 51.15.79.194 port 38090:11: Bye Bye [preauth]
Dec 17 06:01:29 shared10 sshd[17993]: Disconnected from authenticating user r.r 51.15.79.194 port 38090 [preauth]
Dec 17 06:12:41 shared10 sshd[22321]: Invalid user rehak from 51.15.79.194 port 52420
Dec 17 06:12:41 shared10 sshd[22321]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.15.79.194
Dec 17 06:12:43 shared10 sshd[22321]: Failed password for invalid user rehak from 51.15.79.194 port 52420 ssh2
Dec 17 06:12:43 shared10 sshd[22321]: Received disconnect from 51.15.79.194 port 52420:11: Bye Bye [preauth]
Dec 17 06:12:43 shared10 sshd[........
------------------------------

Dec 13 15:26:56 xxxxxxx0 sshd[19520]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.15.79.194  user=r.r
Dec 13 15:26:58 xxxxxxx0 sshd[19520]: Failed password for r.r from 51.15.79.194 port 50392 ssh2
Dec 13 15:33:36 xxxxxxx0 sshd[21046]: Invalid user schroyen from 51.15.79.194 port 43844
Dec 13 15:33:36 xxxxxxx0 sshd[21046]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.15.79.194
Dec 13 15:33:38 xxxxxxx0 sshd[21046]: Failed password for invalid user schroyen from 51.15.79.194 port 43844 ssh2

........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=51.15.79.194

Aug 26 04:52:52 shivevps sshd[3817]: Bad protocol version identification '\024' from 51.15.79.82 port 51224
Aug 26 04:52:53 shivevps sshd[3912]: Bad protocol version identification '\024' from 51.15.79.82 port 51532
Aug 26 04:54:45 shivevps sshd[7862]: Bad protocol version identification '\024' from 51.15.79.82 port 58480
...

F2B jail: sshd. Time: 2019-12-02 23:20:05, Reported by: VKReport

Dec  2 17:06:37 plusreed sshd[32110]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.241.249.53  user=root
Dec  2 17:06:39 plusreed sshd[32110]: Failed password for root from 192.241.249.53 port 55193 ssh2
...

Dec  2 21:54:31 localhost sshd\[57466\]: Invalid user michael from 117.119.86.144 port 51620
Dec  2 21:54:31 localhost sshd\[57466\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.119.86.144
Dec  2 21:54:33 localhost sshd\[57466\]: Failed password for invalid user michael from 117.119.86.144 port 51620 ssh2
Dec  2 22:00:57 localhost sshd\[57607\]: Invalid user hung from 117.119.86.144 port 51830
Dec  2 22:00:57 localhost sshd\[57607\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.119.86.144
...

fail2ban

Dec  2 13:54:32 ihweb003 sshd[17190]: Connection from 45.95.168.105 port 54470 on 139.59.173.177 port 22
Dec  2 13:54:32 ihweb003 sshd[17190]: Did not receive identification string from 45.95.168.105 port 54470
Dec  2 13:57:35 ihweb003 sshd[17742]: Connection from 45.95.168.105 port 54086 on 139.59.173.177 port 22
Dec  2 13:57:36 ihweb003 sshd[17742]: Address 45.95.168.105 maps to maxko-hosting.com, but this does not map back to the address.
Dec  2 13:57:36 ihweb003 sshd[17742]: User r.r from 45.95.168.105 not allowed because none of user's groups are listed in AllowGroups
Dec  2 13:57:36 ihweb003 sshd[17742]: Received disconnect from 45.95.168.105 port 54086:11: Normal Shutdown, Thank you for playing [preauth]
Dec  2 13:57:36 ihweb003 sshd[17742]: Disconnected from 45.95.168.105 port 54086 [preauth]
Dec  2 13:58:36 ihweb003 sshd[17907]: Connection from 45.95.168.105 port 42174 on 139.59.173.177 port 22
Dec  2 13:58:36 ihweb003 sshd[17907]: Address 45.95.168.105 maps to........
-------------------------------

Dec  2 22:57:44 srv206 sshd[25901]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.138  user=root
Dec  2 22:57:46 srv206 sshd[25901]: Failed password for root from 218.92.0.138 port 59226 ssh2
...

400 BAD REQUEST

$f2bV_matches

Dec  2 12:03:07 eddieflores sshd\[14741\]: Invalid user hinckley from 92.222.84.34
Dec  2 12:03:07 eddieflores sshd\[14741\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.ip-92-222-84.eu
Dec  2 12:03:09 eddieflores sshd\[14741\]: Failed password for invalid user hinckley from 92.222.84.34 port 53544 ssh2
Dec  2 12:08:27 eddieflores sshd\[15251\]: Invalid user www from 92.222.84.34
Dec  2 12:08:27 eddieflores sshd\[15251\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.ip-92-222-84.eu

2019-12-02T22:06:29.212684shield sshd\[12420\]: Invalid user sales2 from 91.207.40.45 port 39234
2019-12-02T22:06:29.218203shield sshd\[12420\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.netcom-e.ru
2019-12-02T22:06:31.597000shield sshd\[12420\]: Failed password for invalid user sales2 from 91.207.40.45 port 39234 ssh2
2019-12-02T22:12:32.011174shield sshd\[14470\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.netcom-e.ru  user=root
2019-12-02T22:12:34.414391shield sshd\[14470\]: Failed password for root from 91.207.40.45 port 50952 ssh2

Dec  2 12:01:03 sachi sshd\[23833\]: Invalid user dovecot from 5.135.185.27
Dec  2 12:01:03 sachi sshd\[23833\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ns3290539.ip-5-135-185.eu
Dec  2 12:01:05 sachi sshd\[23833\]: Failed password for invalid user dovecot from 5.135.185.27 port 58596 ssh2
Dec  2 12:06:21 sachi sshd\[24403\]: Invalid user hertzschuch from 5.135.185.27
Dec  2 12:06:21 sachi sshd\[24403\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ns3290539.ip-5-135-185.eu

Dec  2 22:28:45 h2177944 sshd\[29891\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.155.21.46  user=root
Dec  2 22:28:46 h2177944 sshd\[29891\]: Failed password for root from 139.155.21.46 port 40642 ssh2
Dec  2 22:35:11 h2177944 sshd\[30282\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.155.21.46  user=root
Dec  2 22:35:13 h2177944 sshd\[30282\]: Failed password for root from 139.155.21.46 port 47666 ssh2
...

Dec  2 23:14:49 jane sshd[4616]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.131.3.91 
Dec  2 23:14:52 jane sshd[4616]: Failed password for invalid user larry from 120.131.3.91 port 37446 ssh2
...

TCP Port Scanning

" "