Oct  6 21:28:06 lnxweb61 sshd[13751]: Failed password for root from 51.77.150.203 port 57972 ssh2
Oct  6 21:28:06 lnxweb61 sshd[13751]: Failed password for root from 51.77.150.203 port 57972 ssh2

Sep 29 14:27:21 vm1 sshd[27898]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.77.150.203
Sep 29 14:27:22 vm1 sshd[27898]: Failed password for invalid user apache from 51.77.150.203 port 58278 ssh2
...

51.77.150.118 (FR/France/-), 5 distributed sshd attacks on account [root] in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_DISTATTACK; Logs: Sep 24 06:21:02 server5 sshd[27312]: Failed password for root from 190.210.60.4 port 53962 ssh2
Sep 24 06:21:00 server5 sshd[27312]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.210.60.4  user=root
Sep 24 06:24:47 server5 sshd[29042]: Failed password for root from 74.141.132.233 port 58034 ssh2
Sep 24 06:38:11 server5 sshd[1937]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=179.146.37.173  user=root
Sep 24 06:32:59 server5 sshd[32301]: Failed password for root from 51.77.150.118 port 39100 ssh2

IP Addresses Blocked:

190.210.60.4 (AR/Argentina/-)
74.141.132.233 (US/United States/-)
179.146.37.173 (BR/Brazil/-)

s2.hscode.pl - SSH Attack

(sshd) Failed SSH login from 51.77.150.118 (FR/France/Grand Est/Strasbourg/118.ip-51-77-150.eu): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Sep 23 13:00:33 atlas sshd[15610]: Invalid user zhang from 51.77.150.118 port 47772
Sep 23 13:00:35 atlas sshd[15610]: Failed password for invalid user zhang from 51.77.150.118 port 47772 ssh2
Sep 23 13:13:38 atlas sshd[20970]: Invalid user ts3srv from 51.77.150.118 port 40960
Sep 23 13:13:40 atlas sshd[20970]: Failed password for invalid user ts3srv from 51.77.150.118 port 40960 ssh2
Sep 23 13:17:34 atlas sshd[22627]: Invalid user phpmyadmin from 51.77.150.118 port 48656

$f2bV_matches

(sshd) Failed SSH login from 51.77.150.203 (FR/France/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Sep  2 16:25:34 vps sshd[5080]: Invalid user app from 51.77.150.203 port 35162
Sep  2 16:25:35 vps sshd[5080]: Failed password for invalid user app from 51.77.150.203 port 35162 ssh2
Sep  2 16:35:23 vps sshd[9752]: Invalid user jsk from 51.77.150.203 port 51868
Sep  2 16:35:25 vps sshd[9752]: Failed password for invalid user jsk from 51.77.150.203 port 51868 ssh2
Sep  2 16:38:55 vps sshd[11159]: Invalid user cristina from 51.77.150.203 port 57548

Invalid user musikbot from 51.77.150.203 port 53300

2020-08-24T09:14:02.998997vps751288.ovh.net sshd\[13437\]: Invalid user zs from 51.77.150.203 port 52054
2020-08-24T09:14:03.007847vps751288.ovh.net sshd\[13437\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.ip-51-77-150.eu
2020-08-24T09:14:05.025845vps751288.ovh.net sshd\[13437\]: Failed password for invalid user zs from 51.77.150.203 port 52054 ssh2
2020-08-24T09:17:35.771364vps751288.ovh.net sshd\[13476\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.ip-51-77-150.eu  user=root
2020-08-24T09:17:38.224817vps751288.ovh.net sshd\[13476\]: Failed password for root from 51.77.150.203 port 58330 ssh2

Banned for a week because repeated abuses, for example SSH, but not only

2020-08-22T00:49:58.759593lavrinenko.info sshd[4800]: Failed password for root from 51.77.150.203 port 33616 ssh2
2020-08-22T00:53:06.371731lavrinenko.info sshd[4890]: Invalid user git from 51.77.150.203 port 40752
2020-08-22T00:53:06.381153lavrinenko.info sshd[4890]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.77.150.203
2020-08-22T00:53:06.371731lavrinenko.info sshd[4890]: Invalid user git from 51.77.150.203 port 40752
2020-08-22T00:53:08.777852lavrinenko.info sshd[4890]: Failed password for invalid user git from 51.77.150.203 port 40752 ssh2
...

2020-08-21T13:52:13.954369randservbullet-proofcloud-66.localdomain sshd[16468]: Invalid user tunel from 51.77.150.118 port 59818
2020-08-21T13:52:13.958918randservbullet-proofcloud-66.localdomain sshd[16468]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.ip-51-77-150.eu
2020-08-21T13:52:13.954369randservbullet-proofcloud-66.localdomain sshd[16468]: Invalid user tunel from 51.77.150.118 port 59818
2020-08-21T13:52:15.674260randservbullet-proofcloud-66.localdomain sshd[16468]: Failed password for invalid user tunel from 51.77.150.118 port 59818 ssh2
...

Aug 18 10:32:05 vps647732 sshd[30531]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.77.150.203
Aug 18 10:32:06 vps647732 sshd[30531]: Failed password for invalid user sinusbot from 51.77.150.203 port 53122 ssh2
...

2020-08-16T02:36:35.246966hostname sshd[41496]: Failed password for root from 51.77.150.118 port 49136 ssh2
...

Aug 17 17:57:49 dhoomketu sshd[2426998]: Failed password for root from 51.77.150.203 port 51612 ssh2
Aug 17 18:01:29 dhoomketu sshd[2427058]: Invalid user ubuntu from 51.77.150.203 port 60578
Aug 17 18:01:29 dhoomketu sshd[2427058]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.77.150.203 
Aug 17 18:01:29 dhoomketu sshd[2427058]: Invalid user ubuntu from 51.77.150.203 port 60578
Aug 17 18:01:31 dhoomketu sshd[2427058]: Failed password for invalid user ubuntu from 51.77.150.203 port 60578 ssh2
...

67.205.153.94 - - \[30/Nov/2019:07:27:57 +0100\] "POST /wp-login.php HTTP/1.0" 200 7538 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"
67.205.153.94 - - \[30/Nov/2019:07:28:04 +0100\] "POST /wp-login.php HTTP/1.0" 200 7363 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"
67.205.153.94 - - \[30/Nov/2019:07:28:12 +0100\] "POST /wp-login.php HTTP/1.0" 200 7358 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"

Honeypot attack, port: 23, PTR: adsl-179.109.242.239.tellas.gr.

104.248.195.110 - - \[30/Nov/2019:07:27:34 +0100\] "POST /wp-login.php HTTP/1.0" 200 7538 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"
104.248.195.110 - - \[30/Nov/2019:07:27:36 +0100\] "POST /wp-login.php HTTP/1.0" 200 7363 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"
104.248.195.110 - - \[30/Nov/2019:07:27:39 +0100\] "POST /wp-login.php HTTP/1.0" 200 7358 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"

Nov 30 08:31:41 venus sshd\[2965\]: Invalid user test from 188.166.68.8 port 37920
Nov 30 08:31:41 venus sshd\[2965\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.166.68.8
Nov 30 08:31:43 venus sshd\[2965\]: Failed password for invalid user test from 188.166.68.8 port 37920 ssh2
...

Honeypot attack, port: 23, PTR: PTR record not found

Nov 30 07:43:11 ip-172-31-62-245 sshd\[12299\]: Invalid user guest from 103.80.36.34\
Nov 30 07:43:12 ip-172-31-62-245 sshd\[12299\]: Failed password for invalid user guest from 103.80.36.34 port 39962 ssh2\
Nov 30 07:46:52 ip-172-31-62-245 sshd\[12318\]: Invalid user sh from 103.80.36.34\
Nov 30 07:46:54 ip-172-31-62-245 sshd\[12318\]: Failed password for invalid user sh from 103.80.36.34 port 48326 ssh2\
Nov 30 07:50:33 ip-172-31-62-245 sshd\[12332\]: Invalid user admin from 103.80.36.34\

Nov 29 22:14:49 sachi sshd\[32528\]: Invalid user derud from 222.124.16.227
Nov 29 22:14:49 sachi sshd\[32528\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.124.16.227
Nov 29 22:14:51 sachi sshd\[32528\]: Failed password for invalid user derud from 222.124.16.227 port 41654 ssh2
Nov 29 22:22:34 sachi sshd\[767\]: Invalid user since from 222.124.16.227
Nov 29 22:22:34 sachi sshd\[767\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.124.16.227

fail2ban

\[2019-11-30 03:34:04\] SECURITY\[2765\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-11-30T03:34:04.898-0500",Severity="Error",Service="SIP",EventVersion="1",AccountID="68490048422069121",SessionID="0x7f26c4a72ee8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.230.60/59828",ACLName="no_extension_match"
\[2019-11-30 03:34:12\] SECURITY\[2765\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-11-30T03:34:12.751-0500",Severity="Error",Service="SIP",EventVersion="1",AccountID="55170048422069124",SessionID="0x7f26c4566d68",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.230.60/59724",ACLName="no_extension_match"
\[2019-11-30 03:34:21\] SECURITY\[2765\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-11-30T03:34:21.869-0500",Severity="Error",Service="SIP",EventVersion="1",AccountID="61430048422069122",SessionID="0x7f26c445f668",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.230.60/50931",ACLName="no_

$f2bV_matches

Nov 30 09:39:18 vps691689 sshd[13077]: Failed password for root from 106.12.137.46 port 43638 ssh2
Nov 30 09:43:13 vps691689 sshd[13143]: Failed password for root from 106.12.137.46 port 46910 ssh2
...

Nov 30 09:33:38 OPSO sshd\[24308\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.210  user=root
Nov 30 09:33:40 OPSO sshd\[24308\]: Failed password for root from 218.92.0.210 port 38000 ssh2
Nov 30 09:33:42 OPSO sshd\[24308\]: Failed password for root from 218.92.0.210 port 38000 ssh2
Nov 30 09:33:45 OPSO sshd\[24308\]: Failed password for root from 218.92.0.210 port 38000 ssh2
Nov 30 09:34:26 OPSO sshd\[24366\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.210  user=root

Nov 30 13:21:26 itv-usvr-01 sshd[16596]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.45.23.6  user=root
Nov 30 13:21:28 itv-usvr-01 sshd[16596]: Failed password for root from 216.45.23.6 port 60913 ssh2
Nov 30 13:24:38 itv-usvr-01 sshd[16680]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.45.23.6  user=root
Nov 30 13:24:40 itv-usvr-01 sshd[16680]: Failed password for root from 216.45.23.6 port 50507 ssh2
Nov 30 13:28:06 itv-usvr-01 sshd[16829]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.45.23.6  user=root
Nov 30 13:28:08 itv-usvr-01 sshd[16829]: Failed password for root from 216.45.23.6 port 40099 ssh2

Honeypot attack, port: 23, PTR: PTR record not found

Honeypot attack, port: 23, PTR: 46-252-208-183.pool.ic.km.ua.