Mar 20 18:39:05 santamaria sshd\[8035\]: Invalid user onnagawa from 51.38.178.226
Mar 20 18:39:05 santamaria sshd\[8035\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.178.226
Mar 20 18:39:07 santamaria sshd\[8035\]: Failed password for invalid user onnagawa from 51.38.178.226 port 59588 ssh2
...

$f2bV_matches

Mar 13 05:50:32 * sshd[31272]: Failed password for root from 51.38.178.226 port 42730 ssh2
Mar 13 05:56:39 * sshd[31983]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.178.226

$f2bV_matches

Feb 21 15:47:23 server sshd\[16744\]: Invalid user zll from 51.38.178.226
Feb 21 15:47:23 server sshd\[16744\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=226.ip-51-38-178.eu 
Feb 21 15:47:24 server sshd\[16744\]: Failed password for invalid user zll from 51.38.178.226 port 39786 ssh2
Feb 22 09:57:09 server sshd\[32284\]: Invalid user mouzj from 51.38.178.226
Feb 22 09:57:09 server sshd\[32284\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=226.ip-51-38-178.eu 
...

Feb 15 23:45:19 sd-53420 sshd\[19705\]: Invalid user ireland from 51.38.178.226
Feb 15 23:45:19 sd-53420 sshd\[19705\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.178.226
Feb 15 23:45:20 sd-53420 sshd\[19705\]: Failed password for invalid user ireland from 51.38.178.226 port 35522 ssh2
Feb 15 23:47:19 sd-53420 sshd\[19950\]: Invalid user hama from 51.38.178.226
Feb 15 23:47:19 sd-53420 sshd\[19950\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.178.226
...

Dec 14 10:20:11 rotator sshd\[5188\]: Invalid user pullo from 51.38.178.226Dec 14 10:20:13 rotator sshd\[5188\]: Failed password for invalid user pullo from 51.38.178.226 port 38590 ssh2Dec 14 10:25:08 rotator sshd\[5900\]: Invalid user bierbrier from 51.38.178.226Dec 14 10:25:10 rotator sshd\[5900\]: Failed password for invalid user bierbrier from 51.38.178.226 port 46234 ssh2Dec 14 10:30:00 rotator sshd\[6507\]: Invalid user eh from 51.38.178.226Dec 14 10:30:02 rotator sshd\[6507\]: Failed password for invalid user eh from 51.38.178.226 port 53738 ssh2
...

Dec 12 08:30:16 legacy sshd[22564]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.178.226
Dec 12 08:30:17 legacy sshd[22564]: Failed password for invalid user juile from 51.38.178.226 port 49716 ssh2
Dec 12 08:36:19 legacy sshd[22845]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.178.226
...

Nov 24 20:12:51 ns382633 sshd\[16613\]: Invalid user dimitri from 51.38.178.226 port 51922
Nov 24 20:12:51 ns382633 sshd\[16613\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.178.226
Nov 24 20:12:53 ns382633 sshd\[16613\]: Failed password for invalid user dimitri from 51.38.178.226 port 51922 ssh2
Nov 24 20:50:07 ns382633 sshd\[23610\]: Invalid user darque from 51.38.178.226 port 54086
Nov 24 20:50:07 ns382633 sshd\[23610\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.178.226

(sshd) Failed SSH login from 51.38.178.226 (226.ip-51-38-178.eu): 5 in the last 3600 secs

Sep  8 19:49:08 php1 sshd\[4068\]: Invalid user 1 from 51.38.178.226
Sep  8 19:49:08 php1 sshd\[4068\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.178.226
Sep  8 19:49:10 php1 sshd\[4068\]: Failed password for invalid user 1 from 51.38.178.226 port 47230 ssh2
Sep  8 19:54:59 php1 sshd\[4674\]: Invalid user webserver from 51.38.178.226
Sep  8 19:54:59 php1 sshd\[4674\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.178.226

Sep  6 07:01:48 lcprod sshd\[6609\]: Invalid user qwe123 from 51.38.178.226
Sep  6 07:01:48 lcprod sshd\[6609\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=226.ip-51-38-178.eu
Sep  6 07:01:50 lcprod sshd\[6609\]: Failed password for invalid user qwe123 from 51.38.178.226 port 38328 ssh2
Sep  6 07:06:26 lcprod sshd\[7003\]: Invalid user minecraft! from 51.38.178.226
Sep  6 07:06:26 lcprod sshd\[7003\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=226.ip-51-38-178.eu

Invalid user postgres from 51.38.178.226 port 34238

Aug 28 19:30:31 h2177944 sshd\[32452\]: Invalid user myuser from 51.38.178.226 port 45276
Aug 28 19:30:31 h2177944 sshd\[32452\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.178.226
Aug 28 19:30:33 h2177944 sshd\[32452\]: Failed password for invalid user myuser from 51.38.178.226 port 45276 ssh2
Aug 28 19:38:35 h2177944 sshd\[32649\]: Invalid user recruit from 51.38.178.226 port 42502
Aug 28 19:38:35 h2177944 sshd\[32649\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.178.226
...

Aug 28 14:26:52 rpi sshd[18335]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.178.226 
Aug 28 14:26:54 rpi sshd[18335]: Failed password for invalid user stefano from 51.38.178.226 port 41950 ssh2

Aug 27 21:57:05 SilenceServices sshd[2968]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.178.226
Aug 27 21:57:07 SilenceServices sshd[2968]: Failed password for invalid user sou from 51.38.178.226 port 55316 ssh2
Aug 27 22:01:01 SilenceServices sshd[4500]: Failed password for root from 51.38.178.226 port 44680 ssh2

Automatic report - Banned IP Access

Aug 17 07:23:06 thevastnessof sshd[617]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.178.226
...

Aug 15 10:33:17 php2 sshd\[9912\]: Invalid user thor from 51.38.178.226
Aug 15 10:33:17 php2 sshd\[9912\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=226.ip-51-38-178.eu
Aug 15 10:33:19 php2 sshd\[9912\]: Failed password for invalid user thor from 51.38.178.226 port 55898 ssh2
Aug 15 10:37:25 php2 sshd\[10260\]: Invalid user gggg from 51.38.178.226
Aug 15 10:37:25 php2 sshd\[10260\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=226.ip-51-38-178.eu

Aug 13 14:34:21 dedicated sshd[32063]: Invalid user dok from 51.38.178.226 port 60786

Aug 28 12:54:12 SilenceServices sshd[25302]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.178.74
Aug 28 12:54:14 SilenceServices sshd[25302]: Failed password for invalid user dkpal from 51.38.178.74 port 38744 ssh2
Aug 28 12:58:45 SilenceServices sshd[26987]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.178.74

Aug 25 23:18:20 SilenceServices sshd[14736]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.178.74
Aug 25 23:18:22 SilenceServices sshd[14736]: Failed password for invalid user test from 51.38.178.74 port 33802 ssh2
Aug 25 23:23:06 SilenceServices sshd[16654]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.178.74

Aug 22 08:47:54 MK-Soft-VM3 sshd\[5446\]: Invalid user aaaa from 51.38.178.74 port 51106
Aug 22 08:47:54 MK-Soft-VM3 sshd\[5446\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.178.74
Aug 22 08:47:56 MK-Soft-VM3 sshd\[5446\]: Failed password for invalid user aaaa from 51.38.178.74 port 51106 ssh2
...

Aug 22 05:01:56 MK-Soft-VM3 sshd\[26423\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.178.74  user=root
Aug 22 05:01:58 MK-Soft-VM3 sshd\[26423\]: Failed password for root from 51.38.178.74 port 40266 ssh2
Aug 22 05:10:16 MK-Soft-VM3 sshd\[26853\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.178.74  user=root
...

Unauthorized connection attempt from IP address 220.191.233.77 on Port 445(SMB)

DATE:2020-06-30 20:00:57,IP:51.38.189.138,MATCHES:10,PORT:ssh

Jun 30 22:06:02 sip sshd[802737]: Failed password for root from 218.92.0.192 port 61586 ssh2
Jun 30 22:06:05 sip sshd[802737]: Failed password for root from 218.92.0.192 port 61586 ssh2
Jun 30 22:06:08 sip sshd[802737]: Failed password for root from 218.92.0.192 port 61586 ssh2
...

2020-06-30T20:56:33.849160beta postfix/smtpd[6840]: warning: unknown[46.38.148.2]: SASL LOGIN authentication failed: authentication failure
2020-06-30T20:56:56.636539beta postfix/smtpd[6843]: warning: unknown[46.38.148.2]: SASL LOGIN authentication failed: authentication failure
2020-06-30T20:57:17.750100beta postfix/smtpd[6848]: warning: unknown[46.38.148.2]: SASL LOGIN authentication failed: authentication failure
...

[2020-06-30 16:23:53] NOTICE[1273] chan_sip.c: Registration from '"1001" ' failed for '103.145.12.168:5394' - Wrong password
[2020-06-30 16:23:53] SECURITY[1288] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-06-30T16:23:53.581-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="1001",SessionID="0x7f31c03f7758",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/103.145.12.168/5394",Challenge="5ca62201",ReceivedChallenge="5ca62201",ReceivedHash="2c07cf653afb3f7992277a5a2fd1fa01"
[2020-06-30 16:23:53] NOTICE[1273] chan_sip.c: Registration from '"1001" ' failed for '103.145.12.168:5394' - Wrong password
[2020-06-30 16:23:53] SECURITY[1288] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-06-30T16:23:53.730-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="1001",SessionID="0x7f31c01842d8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP
...

Jun 30 20:05:39 [host] sshd[29132]: pam_unix(sshd:
Jun 30 20:05:41 [host] sshd[29132]: Failed passwor
Jun 30 20:13:27 [host] sshd[29570]: pam_unix(sshd:

$f2bV_matches

Jun 30 15:30:42 game-panel sshd[5735]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=96.9.70.234
Jun 30 15:30:44 game-panel sshd[5735]: Failed password for invalid user leo from 96.9.70.234 port 44898 ssh2
Jun 30 15:34:11 game-panel sshd[5873]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=96.9.70.234

Jun 30 20:16:59 localhost sshd[96409]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.15.62  user=root
Jun 30 20:17:01 localhost sshd[96409]: Failed password for root from 222.186.15.62 port 29934 ssh2
Jun 30 20:17:03 localhost sshd[96409]: Failed password for root from 222.186.15.62 port 29934 ssh2
Jun 30 20:16:59 localhost sshd[96409]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.15.62  user=root
Jun 30 20:17:01 localhost sshd[96409]: Failed password for root from 222.186.15.62 port 29934 ssh2
Jun 30 20:17:03 localhost sshd[96409]: Failed password for root from 222.186.15.62 port 29934 ssh2
Jun 30 20:16:59 localhost sshd[96409]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.15.62  user=root
Jun 30 20:17:01 localhost sshd[96409]: Failed password for root from 222.186.15.62 port 29934 ssh2
Jun 30 20:17:03 localhost sshd[96409]: Failed pas
...

Jun 30 13:34:09 pbkit sshd[601320]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.137.96.15  user=root
Jun 30 13:34:12 pbkit sshd[601320]: Failed password for root from 177.137.96.15 port 52434 ssh2
Jun 30 13:34:50 pbkit sshd[601347]: Invalid user admin from 177.137.96.15 port 60048
...

Honeypot attack, port: 445, PTR: 196.52.43.57.netsystemsresearch.com.

Jul  1 01:46:53 dhoomketu sshd[1167309]: Failed password for root from 112.85.42.89 port 24401 ssh2
Jul  1 01:46:48 dhoomketu sshd[1167309]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.85.42.89  user=root
Jul  1 01:46:51 dhoomketu sshd[1167309]: Failed password for root from 112.85.42.89 port 24401 ssh2
Jul  1 01:46:53 dhoomketu sshd[1167309]: Failed password for root from 112.85.42.89 port 24401 ssh2
Jul  1 01:46:56 dhoomketu sshd[1167309]: Failed password for root from 112.85.42.89 port 24401 ssh2
...

Auto reported by IDS

 TCP (SYN) 196.52.43.66:62485 -> port 5902, len 44

Fail2Ban - SSH Bruteforce Attempt