Nov 17 01:48:46 microserver sshd[8407]: Invalid user moriguchi from 51.75.52.241 port 43490
Nov 17 01:48:46 microserver sshd[8407]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.52.241
Nov 17 01:48:47 microserver sshd[8407]: Failed password for invalid user moriguchi from 51.75.52.241 port 43490 ssh2
Nov 17 01:53:17 microserver sshd[9065]: Invalid user transki from 51.75.52.241 port 58062
Nov 17 01:53:17 microserver sshd[9065]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.52.241
Nov 17 02:07:12 microserver sshd[11006]: Invalid user guest3 from 51.75.52.241 port 54612
Nov 17 02:07:12 microserver sshd[11006]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.52.241
Nov 17 02:07:14 microserver sshd[11006]: Failed password for invalid user guest3 from 51.75.52.241 port 54612 ssh2
Nov 17 02:10:47 microserver sshd[11628]: pam_unix(sshd:auth): authentication failure; logname= u

Oct  7 21:47:13 markkoudstaal sshd[24969]: Failed password for root from 51.75.52.241 port 50904 ssh2
Oct  7 21:51:01 markkoudstaal sshd[25443]: Failed password for root from 51.75.52.241 port 37788 ssh2

Oct  5 19:05:51 SilenceServices sshd[29038]: Failed password for root from 51.75.52.241 port 55884 ssh2
Oct  5 19:10:01 SilenceServices sshd[30213]: Failed password for root from 51.75.52.241 port 42188 ssh2

Sep 29 22:59:14 wbs sshd\[9567\]: Invalid user mauro from 51.75.52.241
Sep 29 22:59:14 wbs sshd\[9567\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ns3133276.ip-51-75-52.eu
Sep 29 22:59:16 wbs sshd\[9567\]: Failed password for invalid user mauro from 51.75.52.241 port 46610 ssh2
Sep 29 23:03:13 wbs sshd\[9902\]: Invalid user voorde from 51.75.52.241
Sep 29 23:03:13 wbs sshd\[9902\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ns3133276.ip-51-75-52.eu

Sep 29 08:41:14 heissa sshd\[21653\]: Invalid user glassfish from 51.75.52.241 port 57200
Sep 29 08:41:14 heissa sshd\[21653\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ns3133276.ip-51-75-52.eu
Sep 29 08:41:16 heissa sshd\[21653\]: Failed password for invalid user glassfish from 51.75.52.241 port 57200 ssh2
Sep 29 08:45:04 heissa sshd\[22053\]: Invalid user rator from 51.75.52.241 port 43580
Sep 29 08:45:04 heissa sshd\[22053\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ns3133276.ip-51-75-52.eu

Sep 28 14:29:24 www sshd[6027]: refused connect from ns3133276.ip-51-75-52.eu (51.75.52.241) - 3 ssh attempts

Sep 27 07:01:44 web8 sshd\[28894\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.52.241  user=root
Sep 27 07:01:46 web8 sshd\[28894\]: Failed password for root from 51.75.52.241 port 37724 ssh2
Sep 27 07:05:50 web8 sshd\[30793\]: Invalid user nurul from 51.75.52.241
Sep 27 07:05:50 web8 sshd\[30793\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.52.241
Sep 27 07:05:53 web8 sshd\[30793\]: Failed password for invalid user nurul from 51.75.52.241 port 53492 ssh2

2019-09-21T21:54:41.817300abusebot-4.cloudsearch.cf sshd\[18916\]: Invalid user acc from 51.75.52.241 port 52052

firewall-block, port(s): 23/tcp

Sep 10 18:21:32 lanister sshd[1156]: Invalid user tom from 51.75.52.241
Sep 10 18:21:32 lanister sshd[1156]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.52.241
Sep 10 18:21:32 lanister sshd[1156]: Invalid user tom from 51.75.52.241
Sep 10 18:21:34 lanister sshd[1156]: Failed password for invalid user tom from 51.75.52.241 port 57294 ssh2
...

SSH Brute-Forcing (ownc)

 TCP (SYN) 51.75.52.127:26200 -> port 999, len 44

scans once in preceeding hours on the ports (in chronological order) 2070 resulting in total of 1 scans from 51.75.52.0/22 block.

3089/tcp 5122/tcp 8663/tcp...
[2020-08-02/10-02]441pkt,341pt.(tcp)

Sep 12 05:13:35 *hidden* sshd[49967]: Failed password for *hidden* from 51.75.52.118 port 59616 ssh2 Sep 12 05:13:37 *hidden* sshd[49967]: Failed password for *hidden* from 51.75.52.118 port 59616 ssh2 Sep 12 05:13:39 *hidden* sshd[49967]: Failed password for *hidden* from 51.75.52.118 port 59616 ssh2

Sep 11 18:00:56 vps46666688 sshd[23921]: Failed password for root from 51.75.52.118 port 48784 ssh2
Sep 11 18:01:08 vps46666688 sshd[23921]: error: maximum authentication attempts exceeded for root from 51.75.52.118 port 48784 ssh2 [preauth]
...

Sep 10 13:10:34 marvibiene sshd[27085]: Failed password for root from 51.75.52.118 port 41870 ssh2
Sep 10 13:10:37 marvibiene sshd[27085]: Failed password for root from 51.75.52.118 port 41870 ssh2

$f2bV_matches

Sep  9 20:14:06 vps647732 sshd[24203]: Failed password for root from 51.75.52.118 port 48102 ssh2
Sep  9 20:14:18 vps647732 sshd[24203]: Failed password for root from 51.75.52.118 port 48102 ssh2
...

SSH Brute-Forcing (server2)

Port scanning [5 denied]

Port scanning [5 denied]

 TCP (SYN) 51.75.52.127:26200 -> port 8602, len 44

2020-09-05T17:47:15+0200 Failed SSH Authentication/Brute Force Attack. (Server 5)

Sep  4 20:46:04 auw2 sshd\[7832\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.52.118  user=root
Sep  4 20:46:07 auw2 sshd\[7832\]: Failed password for root from 51.75.52.118 port 45696 ssh2
Sep  4 20:46:09 auw2 sshd\[7832\]: Failed password for root from 51.75.52.118 port 45696 ssh2
Sep  4 20:46:12 auw2 sshd\[7832\]: Failed password for root from 51.75.52.118 port 45696 ssh2
Sep  4 20:46:14 auw2 sshd\[7832\]: Failed password for root from 51.75.52.118 port 45696 ssh2

51.75.52.118 (PL/Poland/-), 6 distributed sshd attacks on account [root] in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_DISTATTACK; Logs: Sep  4 18:15:52 server2 sshd[29097]: Failed password for root from 203.86.7.110 port 53482 ssh2
Sep  4 18:16:37 server2 sshd[29844]: Failed password for root from 51.75.52.118 port 55394 ssh2
Sep  4 18:18:17 server2 sshd[30613]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.112.27.170  user=root
Sep  4 18:18:19 server2 sshd[30613]: Failed password for root from 42.112.27.170 port 25844 ssh2
Sep  4 18:15:50 server2 sshd[29097]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.86.7.110  user=root
Sep  4 18:22:02 server2 sshd[1174]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.57.58  user=root

IP Addresses Blocked:

203.86.7.110 (CN/China/-)

Port 22 Scan, PTR: None

Dec  3 09:12:29 root sshd[29476]: Failed password for root from 218.92.0.145 port 4355 ssh2
Dec  3 09:12:34 root sshd[29476]: Failed password for root from 218.92.0.145 port 4355 ssh2
Dec  3 09:12:39 root sshd[29476]: Failed password for root from 218.92.0.145 port 4355 ssh2
Dec  3 09:12:43 root sshd[29476]: Failed password for root from 218.92.0.145 port 4355 ssh2
...

2019-12-03T08:17:42.192318abusebot-5.cloudsearch.cf sshd\[8106\]: Invalid user lucas from 58.213.198.77 port 53838

" "

Dec  3 09:20:32 eventyay sshd[18784]: Failed password for root from 49.88.112.66 port 37170 ssh2
Dec  3 09:20:34 eventyay sshd[18784]: Failed password for root from 49.88.112.66 port 37170 ssh2
Dec  3 09:20:36 eventyay sshd[18784]: Failed password for root from 49.88.112.66 port 37170 ssh2
...

Dec  3 03:06:00 linuxvps sshd\[59167\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.237.245  user=news
Dec  3 03:06:02 linuxvps sshd\[59167\]: Failed password for news from 111.231.237.245 port 47569 ssh2
Dec  3 03:13:01 linuxvps sshd\[63439\]: Invalid user admin from 111.231.237.245
Dec  3 03:13:01 linuxvps sshd\[63439\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.237.245
Dec  3 03:13:03 linuxvps sshd\[63439\]: Failed password for invalid user admin from 111.231.237.245 port 36308 ssh2

12/03/2019-01:28:47.161677 190.217.106.74 Protocol: 6 ET SCAN Suspicious inbound to MSSQL port 1433

Host Scan

Dec  3 08:27:39 icinga sshd[18719]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.43.82.242 
Dec  3 08:27:41 icinga sshd[18719]: Failed password for invalid user robert from 14.43.82.242 port 40924 ssh2
Dec  3 08:42:03 icinga sshd[32030]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.43.82.242 
...

Dec  2 22:06:42 hpm sshd\[22597\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.77.241.51  user=root
Dec  2 22:06:44 hpm sshd\[22597\]: Failed password for root from 45.77.241.51 port 59842 ssh2
Dec  2 22:13:06 hpm sshd\[23308\]: Invalid user regena from 45.77.241.51
Dec  2 22:13:06 hpm sshd\[23308\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.77.241.51
Dec  2 22:13:08 hpm sshd\[23308\]: Failed password for invalid user regena from 45.77.241.51 port 43150 ssh2

Dec  2 22:06:55 php1 sshd\[8455\]: Invalid user apache from 27.150.169.223
Dec  2 22:06:55 php1 sshd\[8455\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.150.169.223
Dec  2 22:06:57 php1 sshd\[8455\]: Failed password for invalid user apache from 27.150.169.223 port 50395 ssh2
Dec  2 22:13:52 php1 sshd\[9414\]: Invalid user syse from 27.150.169.223
Dec  2 22:13:52 php1 sshd\[9414\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.150.169.223

Dec  3 09:11:15 sbg01 sshd[17998]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.245.5
Dec  3 09:11:17 sbg01 sshd[17998]: Failed password for invalid user ekreheim from 216.10.245.5 port 59384 ssh2
Dec  3 09:17:50 sbg01 sshd[18037]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.245.5

hello

2019-12-03T07:48:26.447562stark.klein-stark.info postfix/smtpd\[16976\]: NOQUEUE: reject: RCPT from island.sapuxfiori.com\[63.80.184.117\]: 554 5.7.1 \: Relay access denied\; from=\ to=\ proto=ESMTP helo=\
...

Dec  3 08:12:34 microserver sshd[63739]: Invalid user ching from 5.196.73.40 port 47620
Dec  3 08:12:34 microserver sshd[63739]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.196.73.40
Dec  3 08:12:36 microserver sshd[63739]: Failed password for invalid user ching from 5.196.73.40 port 47620 ssh2
Dec  3 08:20:47 microserver sshd[65080]: Invalid user loughran from 5.196.73.40 port 58772
Dec  3 08:20:47 microserver sshd[65080]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.196.73.40
Dec  3 08:52:36 microserver sshd[4398]: Invalid user hegdalsaunet from 5.196.73.40 port 46878
Dec  3 08:52:36 microserver sshd[4398]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.196.73.40
Dec  3 08:52:39 microserver sshd[4398]: Failed password for invalid user hegdalsaunet from 5.196.73.40 port 46878 ssh2
Dec  3 09:00:23 microserver sshd[5657]: Invalid user brady from 5.196.73.40 port 58028
Dec  3 09: