Oct  4 22:08:25 host1 sshd[1110534]: Failed password for root from 51.255.172.77 port 37828 ssh2
Oct  4 22:12:45 host1 sshd[1110943]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.255.172.77  user=root
Oct  4 22:12:47 host1 sshd[1110943]: Failed password for root from 51.255.172.77 port 45092 ssh2
Oct  4 22:12:45 host1 sshd[1110943]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.255.172.77  user=root
Oct  4 22:12:47 host1 sshd[1110943]: Failed password for root from 51.255.172.77 port 45092 ssh2
...

[ssh] SSH attack

<6 unauthorized SSH connections

$f2bV_matches

sshd: Failed password for .... from 51.255.172.77 port 50888 ssh2 (10 attempts)

$f2bV_matches

...

SSH Invalid Login

Invalid user pau from 51.255.172.77 port 42088

Sep  4 03:17:45 vps639187 sshd\[18797\]: Invalid user hadoop from 51.255.172.77 port 52650
Sep  4 03:17:45 vps639187 sshd\[18797\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.255.172.77
Sep  4 03:17:48 vps639187 sshd\[18797\]: Failed password for invalid user hadoop from 51.255.172.77 port 52650 ssh2
...

Sep  3 10:07:28 dignus sshd[25942]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.255.172.77  user=root
Sep  3 10:07:30 dignus sshd[25942]: Failed password for root from 51.255.172.77 port 42442 ssh2
Sep  3 10:11:44 dignus sshd[26596]: Invalid user monte from 51.255.172.77 port 47704
Sep  3 10:11:44 dignus sshd[26596]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.255.172.77
Sep  3 10:11:45 dignus sshd[26596]: Failed password for invalid user monte from 51.255.172.77 port 47704 ssh2
...

Aug 26 16:08:52 [host] sshd[14145]: Invalid user l
Aug 26 16:08:52 [host] sshd[14145]: pam_unix(sshd:
Aug 26 16:08:54 [host] sshd[14145]: Failed passwor

Aug 19 04:34:57 firewall sshd[26358]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.255.172.77
Aug 19 04:34:57 firewall sshd[26358]: Invalid user web from 51.255.172.77
Aug 19 04:34:59 firewall sshd[26358]: Failed password for invalid user web from 51.255.172.77 port 38268 ssh2
...

Fail2Ban

Aug  2 10:21:30 gw1 sshd[1088]: Failed password for root from 51.255.172.77 port 42514 ssh2
...

2020-07-28T03:52:59.000827shield sshd\[17060\]: Invalid user osm2 from 51.255.172.77 port 44616
2020-07-28T03:52:59.010017shield sshd\[17060\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=77.ip-51-255-172.eu
2020-07-28T03:53:01.792944shield sshd\[17060\]: Failed password for invalid user osm2 from 51.255.172.77 port 44616 ssh2
2020-07-28T03:57:46.286146shield sshd\[18196\]: Invalid user gitlab-prometheus from 51.255.172.77 port 56920
2020-07-28T03:57:46.296751shield sshd\[18196\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=77.ip-51-255-172.eu

Jul 26 16:30:08 fhem-rasp sshd[10341]: Invalid user unix from 51.255.172.77 port 50974
...

Jul 21 06:27:29 *** sshd[25330]: Invalid user sandy from 51.255.172.77

Invalid user shoutcast from 51.255.172.77 port 36086

Jul 12 12:32:50 prod4 sshd\[8235\]: Invalid user renxiaoyan from 51.255.172.77
Jul 12 12:32:53 prod4 sshd\[8235\]: Failed password for invalid user renxiaoyan from 51.255.172.77 port 57070 ssh2
Jul 12 12:36:57 prod4 sshd\[10251\]: Invalid user madeline from 51.255.172.77
...

Jun 27 15:04:20 cdc sshd[7584]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.255.172.77  user=root
Jun 27 15:04:22 cdc sshd[7584]: Failed password for invalid user root from 51.255.172.77 port 48754 ssh2

no

(sshd) Failed SSH login from 51.255.172.198 (FR/France/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Aug 31 00:33:18 server sshd[11222]: Invalid user mc from 51.255.172.198
Aug 31 00:33:20 server sshd[11222]: Failed password for invalid user mc from 51.255.172.198 port 41598 ssh2
Aug 31 00:42:23 server sshd[12579]: Invalid user ubuntu from 51.255.172.198
Aug 31 00:42:25 server sshd[12579]: Failed password for invalid user ubuntu from 51.255.172.198 port 41968 ssh2
Aug 31 00:49:44 server sshd[13674]: Invalid user carmen from 51.255.172.198

SSH Brute Force

Aug  8 10:34:34 mockhub sshd[2603]: Failed password for root from 51.255.172.198 port 56368 ssh2
...

Aug  8 06:54:16 pve1 sshd[8755]: Failed password for root from 51.255.172.198 port 46824 ssh2
...

$f2bV_matches

Invalid user soporte from 51.255.172.198 port 55632

Automatic report BANNED IP

Jul 21 16:46:35 [host] sshd[4996]: pam_unix(sshd:a
Jul 21 16:46:37 [host] sshd[4996]: Failed password
Jul 21 16:54:26 [host] sshd[5241]: Invalid user el
Jul 21 16:54:27 [host] sshd[5241]: pam_unix(sshd:a
Jul 21 16:54:29 [host] sshd[5241]: Failed password

Jun  7 16:47:03 mellenthin sshd[30842]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.255.172.198  user=root
Jun  7 16:47:05 mellenthin sshd[30842]: Failed password for invalid user root from 51.255.172.198 port 34210 ssh2

Jun  5 22:08:13 ns382633 sshd\[24931\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.255.172.198  user=root
Jun  5 22:08:15 ns382633 sshd\[24931\]: Failed password for root from 51.255.172.198 port 43458 ssh2
Jun  5 22:19:40 ns382633 sshd\[26957\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.255.172.198  user=root
Jun  5 22:19:43 ns382633 sshd\[26957\]: Failed password for root from 51.255.172.198 port 56458 ssh2
Jun  5 22:26:39 ns382633 sshd\[28534\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.255.172.198  user=root

May 27 11:56:29 IngegnereFirenze sshd[16664]: User root from 51.255.172.198 not allowed because not listed in AllowUsers
...

Invalid user bulbakov from 51.255.172.198 port 48284

5x Failed Password

Invalid user bulbakov from 51.255.172.198 port 48284

Invalid user company from 51.255.172.198 port 32898

Port Scan
...

2020-08-03T13:33:47.537617shield sshd\[24640\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.65.136.141  user=root
2020-08-03T13:33:49.877969shield sshd\[24640\]: Failed password for root from 159.65.136.141 port 46750 ssh2
2020-08-03T13:37:43.102320shield sshd\[25073\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.65.136.141  user=root
2020-08-03T13:37:44.840518shield sshd\[25073\]: Failed password for root from 159.65.136.141 port 44464 ssh2
2020-08-03T13:41:30.923116shield sshd\[25637\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.65.136.141  user=root

Attempted Brute Force (cpaneld)

Aug  3 17:02:42 lukav-desktop sshd\[10720\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=176.117.39.44  user=root
Aug  3 17:02:44 lukav-desktop sshd\[10720\]: Failed password for root from 176.117.39.44 port 43694 ssh2
Aug  3 17:06:52 lukav-desktop sshd\[21983\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=176.117.39.44  user=root
Aug  3 17:06:54 lukav-desktop sshd\[21983\]: Failed password for root from 176.117.39.44 port 54076 ssh2
Aug  3 17:10:47 lukav-desktop sshd\[20248\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=176.117.39.44  user=root

Triggered by Fail2Ban at Ares web server

Wordpress attack

Aug  3 17:09:55 jane sshd[7747]: Failed password for root from 200.169.6.206 port 53611 ssh2
...

2020-08-03T14:17:13.827019ns386461 sshd\[21557\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.175.196.241  user=root
2020-08-03T14:17:16.493576ns386461 sshd\[21557\]: Failed password for root from 134.175.196.241 port 50022 ssh2
2020-08-03T14:36:14.376469ns386461 sshd\[7224\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.175.196.241  user=root
2020-08-03T14:36:16.679511ns386461 sshd\[7224\]: Failed password for root from 134.175.196.241 port 49304 ssh2
2020-08-03T14:43:13.171526ns386461 sshd\[13382\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.175.196.241  user=root
...

 TCP (SYN) 45.129.33.15:40228 -> port 8728, len 44

"fail2ban match"

2020-08-03T17:17:38.926931lavrinenko.info sshd[8933]: Failed password for root from 52.81.87.43 port 35454 ssh2
2020-08-03T17:20:10.135980lavrinenko.info sshd[9026]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.81.87.43  user=root
2020-08-03T17:20:12.199930lavrinenko.info sshd[9026]: Failed password for root from 52.81.87.43 port 50778 ssh2
2020-08-03T17:22:48.425248lavrinenko.info sshd[9120]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.81.87.43  user=root
2020-08-03T17:22:50.514081lavrinenko.info sshd[9120]: Failed password for root from 52.81.87.43 port 37870 ssh2
...

Aug 3 15:44:48 *hidden* sshd[13981]: Failed password for *hidden* from 106.52.158.85 port 43144 ssh2 Aug 3 15:51:12 *hidden* sshd[28723]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.52.158.85 user=root Aug 3 15:51:14 *hidden* sshd[28723]: Failed password for *hidden* from 106.52.158.85 port 51928 ssh2

Aug  3 12:20:36 124388 sshd[6992]: Failed password for invalid user Admin_1234 from 118.25.195.78 port 36328 ssh2
Aug  3 12:25:30 124388 sshd[7222]: Invalid user 62716849 from 118.25.195.78 port 57276
Aug  3 12:25:30 124388 sshd[7222]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.25.195.78
Aug  3 12:25:30 124388 sshd[7222]: Invalid user 62716849 from 118.25.195.78 port 57276
Aug  3 12:25:32 124388 sshd[7222]: Failed password for invalid user 62716849 from 118.25.195.78 port 57276 ssh2

Automatic report - Banned IP Access

Lines containing failures of 103.123.219.1
Aug  3 10:11:25 shared05 sshd[21339]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.123.219.1  user=r.r
Aug  3 10:11:27 shared05 sshd[21339]: Failed password for r.r from 103.123.219.1 port 39054 ssh2
Aug  3 10:11:27 shared05 sshd[21339]: Received disconnect from 103.123.219.1 port 39054:11: Bye Bye [preauth]
Aug  3 10:11:27 shared05 sshd[21339]: Disconnected from authenticating user r.r 103.123.219.1 port 39054 [preauth]
Aug  3 10:19:13 shared05 sshd[23822]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.123.219.1  user=r.r
Aug  3 10:19:15 shared05 sshd[23822]: Failed password for r.r from 103.123.219.1 port 55244 ssh2
Aug  3 10:19:15 shared05 sshd[23822]: Received disconnect from 103.123.219.1 port 55244:11: Bye Bye [preauth]
Aug  3 10:19:15 shared05 sshd[23822]: Disconnected from authenticating user r.r 103.123.219.1 port 55244 [preauth........
------------------------------