Jan  6 14:15:32 amit sshd\[23439\]: Invalid user nagios from 51.254.140.235
Jan  6 14:15:32 amit sshd\[23439\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.254.140.235
Jan  6 14:15:34 amit sshd\[23439\]: Failed password for invalid user nagios from 51.254.140.235 port 34956 ssh2
...

Jan  4 11:12:06 firewall sshd[23009]: Invalid user demon from 51.254.140.235
Jan  4 11:12:08 firewall sshd[23009]: Failed password for invalid user demon from 51.254.140.235 port 42860 ssh2
Jan  4 11:14:55 firewall sshd[23058]: Invalid user ooq from 51.254.140.235
...

5x Failed Password

Dec 23 08:02:22 nextcloud sshd\[28427\]: Invalid user kavaler from 51.254.140.235
Dec 23 08:02:22 nextcloud sshd\[28427\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.254.140.235
Dec 23 08:02:24 nextcloud sshd\[28427\]: Failed password for invalid user kavaler from 51.254.140.235 port 48322 ssh2
...

Dec 21 21:37:02 MK-Soft-VM4 sshd[10382]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.254.140.235 
Dec 21 21:37:03 MK-Soft-VM4 sshd[10382]: Failed password for invalid user sopiah from 51.254.140.235 port 36016 ssh2
...

Dec 17 11:46:18 lamijardin sshd[6815]: Invalid user server from 51.254.140.235
Dec 17 11:46:18 lamijardin sshd[6815]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.254.140.235
Dec 17 11:46:20 lamijardin sshd[6815]: Failed password for invalid user server from 51.254.140.235 port 53010 ssh2
Dec 17 11:46:20 lamijardin sshd[6815]: Received disconnect from 51.254.140.235 port 53010:11: Bye Bye [preauth]
Dec 17 11:46:20 lamijardin sshd[6815]: Disconnected from 51.254.140.235 port 53010 [preauth]
Dec 17 11:54:56 lamijardin sshd[6833]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.254.140.235  user=r.r
Dec 17 11:54:59 lamijardin sshd[6833]: Failed password for r.r from 51.254.140.235 port 47732 ssh2
Dec 17 11:54:59 lamijardin sshd[6833]: Received disconnect from 51.254.140.235 port 47732:11: Bye Bye [preauth]
Dec 17 11:54:59 lamijardin sshd[6833]: Disconnected from 51.254.140.235 port 477........
-------------------------------

Dec 17 11:46:18 lamijardin sshd[6815]: Invalid user server from 51.254.140.235
Dec 17 11:46:18 lamijardin sshd[6815]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.254.140.235
Dec 17 11:46:20 lamijardin sshd[6815]: Failed password for invalid user server from 51.254.140.235 port 53010 ssh2
Dec 17 11:46:20 lamijardin sshd[6815]: Received disconnect from 51.254.140.235 port 53010:11: Bye Bye [preauth]
Dec 17 11:46:20 lamijardin sshd[6815]: Disconnected from 51.254.140.235 port 53010 [preauth]
Dec 17 11:54:56 lamijardin sshd[6833]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.254.140.235  user=r.r
Dec 17 11:54:59 lamijardin sshd[6833]: Failed password for r.r from 51.254.140.235 port 47732 ssh2
Dec 17 11:54:59 lamijardin sshd[6833]: Received disconnect from 51.254.140.235 port 47732:11: Bye Bye [preauth]
Dec 17 11:54:59 lamijardin sshd[6833]: Disconnected from 51.254.140.235 port 477........
-------------------------------

no

Nov  5 07:29:49 vpn01 sshd[2016]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.254.140.83
Nov  5 07:29:51 vpn01 sshd[2016]: Failed password for invalid user nbvcxz from 51.254.140.83 port 37768 ssh2
...

Nov  5 01:15:18 plusreed sshd[2214]: Invalid user morango from 51.254.140.83
...

$f2bV_matches

Aug 27 23:35:55 SilenceServices sshd[8438]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.254.140.108
Aug 27 23:35:57 SilenceServices sshd[8438]: Failed password for invalid user admin from 51.254.140.108 port 53772 ssh2
Aug 27 23:39:58 SilenceServices sshd[10037]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.254.140.108

Aug 24 05:28:39 auw2 sshd\[4884\]: Invalid user peewee from 51.254.140.108
Aug 24 05:28:39 auw2 sshd\[4884\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=108.ip-51-254-140.eu
Aug 24 05:28:40 auw2 sshd\[4884\]: Failed password for invalid user peewee from 51.254.140.108 port 43210 ssh2
Aug 24 05:32:47 auw2 sshd\[5282\]: Invalid user elisa from 51.254.140.108
Aug 24 05:32:47 auw2 sshd\[5282\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=108.ip-51-254-140.eu

2019-07-17T10:24:46.408588enmeeting.mahidol.ac.th sshd\[4642\]: User mysql from 108.ip-51-254-140.eu not allowed because not listed in AllowUsers
2019-07-17T10:24:46.425438enmeeting.mahidol.ac.th sshd\[4642\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=108.ip-51-254-140.eu  user=mysql
2019-07-17T10:24:48.474185enmeeting.mahidol.ac.th sshd\[4642\]: Failed password for invalid user mysql from 51.254.140.108 port 39549 ssh2
...

Jul 15 13:43:50 areeb-Workstation sshd\[17987\]: Invalid user donna from 51.254.140.108
Jul 15 13:43:50 areeb-Workstation sshd\[17987\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.254.140.108
Jul 15 13:43:52 areeb-Workstation sshd\[17987\]: Failed password for invalid user donna from 51.254.140.108 port 36721 ssh2
...

Jul 15 04:05:49 areeb-Workstation sshd\[20699\]: Invalid user danilo from 51.254.140.108
Jul 15 04:05:49 areeb-Workstation sshd\[20699\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.254.140.108
Jul 15 04:05:51 areeb-Workstation sshd\[20699\]: Failed password for invalid user danilo from 51.254.140.108 port 57653 ssh2
...

Jul 12 21:59:13 dedicated sshd[9374]: Invalid user default from 51.254.140.108 port 58366

Jul 10 01:35:11 srv03 sshd\[23253\]: Invalid user silvan from 51.254.140.108 port 57420
Jul 10 01:35:11 srv03 sshd\[23253\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.254.140.108
Jul 10 01:35:12 srv03 sshd\[23253\]: Failed password for invalid user silvan from 51.254.140.108 port 57420 ssh2

Jul  8 18:32:58 MK-Soft-VM3 sshd\[27277\]: Invalid user hadoopuser from 51.254.140.108 port 42485
Jul  8 18:32:58 MK-Soft-VM3 sshd\[27277\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.254.140.108
Jul  8 18:33:01 MK-Soft-VM3 sshd\[27277\]: Failed password for invalid user hadoopuser from 51.254.140.108 port 42485 ssh2
...

Jul  5 02:11:06 lnxweb62 sshd[26316]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.254.140.108

detected by Fail2Ban

SSH Brute Force

2020-10-09T05:13:34.703521morrigan.ad5gb.com sshd[3381167]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=147.135.173.235  user=root
2020-10-09T05:13:36.621320morrigan.ad5gb.com sshd[3381167]: Failed password for root from 147.135.173.235 port 54839 ssh2

ET CINS Active Threat Intelligence Poor Reputation IP group 27

Unauthorized connection attempt from IP address 191.189.10.16 on Port 445(SMB)

Unauthorized connection attempt from IP address 148.233.37.48 on Port 445(SMB)

2020-10-09T08:11:25.344757shield sshd\[16648\]: Invalid user Jessa from 128.199.76.76 port 2242
2020-10-09T08:11:25.354291shield sshd\[16648\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.76.76
2020-10-09T08:11:27.459332shield sshd\[16648\]: Failed password for invalid user Jessa from 128.199.76.76 port 2242 ssh2
2020-10-09T08:15:05.537047shield sshd\[16961\]: Invalid user Elgie from 128.199.76.76 port 43356
2020-10-09T08:15:05.545200shield sshd\[16961\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.76.76

Automatic report - Banned IP Access

Lines containing failures of 71.211.144.1
Oct  7 09:25:32 shared12 sshd[30389]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=71.211.144.1  user=r.r
Oct  7 09:25:34 shared12 sshd[30389]: Failed password for r.r from 71.211.144.1 port 47626 ssh2
Oct  7 09:25:34 shared12 sshd[30389]: Received disconnect from 71.211.144.1 port 47626:11: Bye Bye [preauth]
Oct  7 09:25:34 shared12 sshd[30389]: Disconnected from authenticating user r.r 71.211.144.1 port 47626 [preauth]
Oct  7 09:29:14 shared12 sshd[31326]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=71.211.144.1  user=r.r
Oct  7 09:29:15 shared12 sshd[31326]: Failed password for r.r from 71.211.144.1 port 42910 ssh2
Oct  7 09:29:15 shared12 sshd[31326]: Received disconnect from 71.211.144.1 port 42910:11: Bye Bye [preauth]
Oct  7 09:29:15 shared12 sshd[31326]: Disconnected from authenticating user r.r 71.211.144.1 port 42910 [preauth]


........
-----------------------------------

Oct  9 09:59:03 localhost sshd\[29401\]: Invalid user ftp_user from 187.174.65.4 port 47864
Oct  9 09:59:03 localhost sshd\[29401\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.174.65.4
Oct  9 09:59:04 localhost sshd\[29401\]: Failed password for invalid user ftp_user from 187.174.65.4 port 47864 ssh2
...

2020-10-09T13:39:14.392893cyberdyne sshd[1709578]: Invalid user hal from 2.232.250.91 port 57220
2020-10-09T13:39:16.951091cyberdyne sshd[1709578]: Failed password for invalid user hal from 2.232.250.91 port 57220 ssh2
2020-10-09T13:41:35.388678cyberdyne sshd[1710398]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.232.250.91  user=root
2020-10-09T13:41:37.295594cyberdyne sshd[1710398]: Failed password for root from 2.232.250.91 port 65343 ssh2
...

2020-10-09 03:19:08 server sshd[49933]: Failed password for invalid user root from 49.234.105.124 port 50800 ssh2

ET SCAN NMAP -sS window 1024

Oct  9 13:39:58 ns382633 sshd\[23534\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.155.225.104  user=root
Oct  9 13:40:00 ns382633 sshd\[23534\]: Failed password for root from 211.155.225.104 port 49398 ssh2
Oct  9 13:52:14 ns382633 sshd\[25404\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.155.225.104  user=root
Oct  9 13:52:17 ns382633 sshd\[25404\]: Failed password for root from 211.155.225.104 port 61475 ssh2
Oct  9 13:56:13 ns382633 sshd\[26074\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.155.225.104  user=root

2020-10-09T14:26:30.494678abusebot.cloudsearch.cf sshd[16222]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.ip-54-37-154.eu  user=root
2020-10-09T14:26:32.814498abusebot.cloudsearch.cf sshd[16222]: Failed password for root from 54.37.154.113 port 43850 ssh2
2020-10-09T14:30:38.796420abusebot.cloudsearch.cf sshd[16450]: Invalid user mysql from 54.37.154.113 port 49242
2020-10-09T14:30:38.803379abusebot.cloudsearch.cf sshd[16450]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.ip-54-37-154.eu
2020-10-09T14:30:38.796420abusebot.cloudsearch.cf sshd[16450]: Invalid user mysql from 54.37.154.113 port 49242
2020-10-09T14:30:40.838422abusebot.cloudsearch.cf sshd[16450]: Failed password for invalid user mysql from 54.37.154.113 port 49242 ssh2
2020-10-09T14:34:30.829362abusebot.cloudsearch.cf sshd[16497]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.ip-54-37
...

Oct  9 04:58:51 george sshd[2719]: Failed password for root from 112.85.42.187 port 25221 ssh2
Oct  9 04:58:55 george sshd[2719]: Failed password for root from 112.85.42.187 port 25221 ssh2
Oct  9 05:00:17 george sshd[2788]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.85.42.187  user=root
Oct  9 05:00:19 george sshd[2788]: Failed password for root from 112.85.42.187 port 18988 ssh2
Oct  9 05:00:23 george sshd[2788]: Failed password for root from 112.85.42.187 port 18988 ssh2
...