Oct 14 01:30:16 prox sshd[13442]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.187.131.111 
Oct 14 01:30:18 prox sshd[13442]: Failed password for invalid user vseslav from 52.187.131.111 port 50404 ssh2

2020-08-03T04:11:28.616219shield sshd\[30293\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.187.132.240  user=root
2020-08-03T04:11:30.178031shield sshd\[30293\]: Failed password for root from 52.187.132.240 port 60300 ssh2
2020-08-03T04:16:06.050374shield sshd\[31237\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.187.132.240  user=root
2020-08-03T04:16:08.445033shield sshd\[31237\]: Failed password for root from 52.187.132.240 port 48768 ssh2
2020-08-03T04:20:51.158615shield sshd\[32206\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.187.132.240  user=root

SSH Brute Force

2020-07-27T11:50:38.556024abusebot-3.cloudsearch.cf sshd[24112]: Invalid user norbi from 52.187.132.240 port 59212
2020-07-27T11:50:38.561623abusebot-3.cloudsearch.cf sshd[24112]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.187.132.240
2020-07-27T11:50:38.556024abusebot-3.cloudsearch.cf sshd[24112]: Invalid user norbi from 52.187.132.240 port 59212
2020-07-27T11:50:40.088211abusebot-3.cloudsearch.cf sshd[24112]: Failed password for invalid user norbi from 52.187.132.240 port 59212 ssh2
2020-07-27T11:53:54.676543abusebot-3.cloudsearch.cf sshd[24164]: Invalid user jdc from 52.187.132.240 port 45116
2020-07-27T11:53:54.682080abusebot-3.cloudsearch.cf sshd[24164]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.187.132.240
2020-07-27T11:53:54.676543abusebot-3.cloudsearch.cf sshd[24164]: Invalid user jdc from 52.187.132.240 port 45116
2020-07-27T11:53:55.782174abusebot-3.cloudsearch.cf sshd[24164]: Fai
...

Invalid user rancher from 52.187.132.240 port 45190

Jul 23 14:09:33 django-0 sshd[2142]: Invalid user infa from 52.187.132.240
...

Unauthorized connection attempt detected from IP address 52.187.135.186 to port 1433 [T]

reported through recidive - multiple failed attempts(SSH)

SSH brute-force attempt

Lines containing failures of 52.187.135.186
Jul 14 01:12:51 shared12 sshd[29814]: Invalid user admin from 52.187.135.186 port 45204
Jul 14 01:12:51 shared12 sshd[29814]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.187.135.186
Jul 14 01:12:53 shared12 sshd[29814]: Failed password for invalid user admin from 52.187.135.186 port 45204 ssh2
Jul 14 01:12:53 shared12 sshd[29814]: Received disconnect from 52.187.135.186 port 45204:11: Client disconnecting normally [preauth]
Jul 14 01:12:53 shared12 sshd[29814]: Disconnected from invalid user admin 52.187.135.186 port 45204 [preauth]


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=52.187.135.186

2020-06-27T22:54:32.642941abusebot-5.cloudsearch.cf sshd[19431]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.187.130.217  user=root
2020-06-27T22:54:34.558157abusebot-5.cloudsearch.cf sshd[19431]: Failed password for root from 52.187.130.217 port 50892 ssh2
2020-06-27T22:56:49.149045abusebot-5.cloudsearch.cf sshd[19439]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.187.130.217  user=root
2020-06-27T22:56:51.540666abusebot-5.cloudsearch.cf sshd[19439]: Failed password for root from 52.187.130.217 port 57168 ssh2
2020-06-27T22:59:07.953461abusebot-5.cloudsearch.cf sshd[19446]: Invalid user ba from 52.187.130.217 port 35210
2020-06-27T22:59:07.957916abusebot-5.cloudsearch.cf sshd[19446]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.187.130.217
2020-06-27T22:59:07.953461abusebot-5.cloudsearch.cf sshd[19446]: Invalid user ba from 52.187.130.217 port 3521
...

fail2ban -- 52.187.130.217
...

Jun 22 14:09:50 ip-172-31-62-245 sshd\[22789\]: Invalid user orion from 52.187.130.217\
Jun 22 14:09:53 ip-172-31-62-245 sshd\[22789\]: Failed password for invalid user orion from 52.187.130.217 port 50080 ssh2\
Jun 22 14:12:27 ip-172-31-62-245 sshd\[22804\]: Invalid user oliver from 52.187.130.217\
Jun 22 14:12:29 ip-172-31-62-245 sshd\[22804\]: Failed password for invalid user oliver from 52.187.130.217 port 55674 ssh2\
Jun 22 14:14:59 ip-172-31-62-245 sshd\[22827\]: Invalid user teamspeak3 from 52.187.130.217\

Jun 22 06:15:00 srv-ubuntu-dev3 sshd[27738]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.187.130.217  user=mysql
Jun 22 06:15:02 srv-ubuntu-dev3 sshd[27738]: Failed password for mysql from 52.187.130.217 port 42076 ssh2
Jun 22 06:16:41 srv-ubuntu-dev3 sshd[28095]: Invalid user francesco from 52.187.130.217
Jun 22 06:16:41 srv-ubuntu-dev3 sshd[28095]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.187.130.217
Jun 22 06:16:41 srv-ubuntu-dev3 sshd[28095]: Invalid user francesco from 52.187.130.217
Jun 22 06:16:43 srv-ubuntu-dev3 sshd[28095]: Failed password for invalid user francesco from 52.187.130.217 port 33886 ssh2
Jun 22 06:18:22 srv-ubuntu-dev3 sshd[28375]: Invalid user justin from 52.187.130.217
Jun 22 06:18:22 srv-ubuntu-dev3 sshd[28375]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.187.130.217
Jun 22 06:18:22 srv-ubuntu-dev3 sshd[28375]: Invalid
...

2020-06-13T19:03:29.9094771495-001 sshd[41342]: Failed password for invalid user csxray from 52.187.130.217 port 41088 ssh2
2020-06-13T19:07:13.6606731495-001 sshd[41461]: Invalid user jenkins from 52.187.130.217 port 42736
2020-06-13T19:07:13.6642261495-001 sshd[41461]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.187.130.217
2020-06-13T19:07:13.6606731495-001 sshd[41461]: Invalid user jenkins from 52.187.130.217 port 42736
2020-06-13T19:07:15.7071151495-001 sshd[41461]: Failed password for invalid user jenkins from 52.187.130.217 port 42736 ssh2
2020-06-13T19:11:07.4620981495-001 sshd[41581]: Invalid user cycle from 52.187.130.217 port 44418
...

5160/udp 5070/udp...
[2020-06-23/26]4pkt,2pt.(udp)

Failed password for invalid user from 222.186.175.202 port 49568 ssh2

2020-06-26 20:47:51 auth_plain authenticator failed for (User) [46.38.145.250]: 535 Incorrect authentication data (set_id=appt@csmailer.org)
2020-06-26 20:48:30 auth_plain authenticator failed for (User) [46.38.145.250]: 535 Incorrect authentication data (set_id=timezone_string@csmailer.org)
2020-06-26 20:49:10 auth_plain authenticator failed for (User) [46.38.145.250]: 535 Incorrect authentication data (set_id=solutions@csmailer.org)
2020-06-26 20:49:52 auth_plain authenticator failed for (User) [46.38.145.250]: 535 Incorrect authentication data (set_id=tmp@csmailer.org)
2020-06-26 20:50:33 auth_plain authenticator failed for (User) [46.38.145.250]: 535 Incorrect authentication data (set_id=xmlfeed@csmailer.org)
...

SSH Bruteforce attack

SSH User Authentication Brute Force Attempt , PTR: ip68-9-227-100.ri.ri.cox.net.

Jun 26 22:55:30 h2779839 sshd[3076]: Invalid user admin1 from 106.54.202.136 port 45994
Jun 26 22:55:30 h2779839 sshd[3076]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.54.202.136
Jun 26 22:55:30 h2779839 sshd[3076]: Invalid user admin1 from 106.54.202.136 port 45994
Jun 26 22:55:32 h2779839 sshd[3076]: Failed password for invalid user admin1 from 106.54.202.136 port 45994 ssh2
Jun 26 22:59:02 h2779839 sshd[3162]: Invalid user jy from 106.54.202.136 port 57362
Jun 26 22:59:02 h2779839 sshd[3162]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.54.202.136
Jun 26 22:59:02 h2779839 sshd[3162]: Invalid user jy from 106.54.202.136 port 57362
Jun 26 22:59:04 h2779839 sshd[3162]: Failed password for invalid user jy from 106.54.202.136 port 57362 ssh2
Jun 26 23:02:38 h2779839 sshd[3315]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.54.202.136  user=root
Jun
...

Jun 26 22:26:55 datenbank sshd[60873]: Invalid user dayz from 85.16.196.105 port 45900
Jun 26 22:26:58 datenbank sshd[60873]: Failed password for invalid user dayz from 85.16.196.105 port 45900 ssh2
Jun 26 22:35:40 datenbank sshd[60910]: Invalid user gitlab_ci from 85.16.196.105 port 44242
...

Port 22 Scan, PTR: None

Jun 26 21:55:44 pve1 sshd[3454]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.38.160.4 
Jun 26 21:55:46 pve1 sshd[3454]: Failed password for invalid user tsserver from 54.38.160.4 port 54894 ssh2
...

Jun 26 22:52:44 abendstille sshd\[29814\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.221  user=root
Jun 26 22:52:46 abendstille sshd\[29814\]: Failed password for root from 218.92.0.221 port 62879 ssh2
Jun 26 22:52:48 abendstille sshd\[29814\]: Failed password for root from 218.92.0.221 port 62879 ssh2
Jun 26 22:52:49 abendstille sshd\[29814\]: Failed password for root from 218.92.0.221 port 62879 ssh2
Jun 26 22:52:51 abendstille sshd\[29916\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.221  user=root
...

Unauthorized connection attempt: SRC=80.92.29.11
...

Jun 26 23:20:41 fhem-rasp sshd[21587]: Invalid user rr from 138.197.129.38 port 56386
...

ET CINS Active Threat Intelligence Poor Reputation IP group 72 - port: 8060 proto: TCP cat: Misc Attack

Jun 26 21:44:59 h2646465 sshd[17357]: Invalid user chs from 111.229.95.77
Jun 26 21:44:59 h2646465 sshd[17357]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.229.95.77
Jun 26 21:44:59 h2646465 sshd[17357]: Invalid user chs from 111.229.95.77
Jun 26 21:45:00 h2646465 sshd[17357]: Failed password for invalid user chs from 111.229.95.77 port 37798 ssh2
Jun 26 21:58:38 h2646465 sshd[18307]: Invalid user ewa from 111.229.95.77
Jun 26 21:58:38 h2646465 sshd[18307]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.229.95.77
Jun 26 21:58:38 h2646465 sshd[18307]: Invalid user ewa from 111.229.95.77
Jun 26 21:58:40 h2646465 sshd[18307]: Failed password for invalid user ewa from 111.229.95.77 port 58350 ssh2
Jun 26 22:02:23 h2646465 sshd[19064]: Invalid user vegeta from 111.229.95.77
...

Jun 26 21:28:18 datenbank sshd[58342]: Invalid user schneider from 172.86.125.116 port 44306
Jun 26 21:28:20 datenbank sshd[58342]: Failed password for invalid user schneider from 172.86.125.116 port 44306 ssh2
Jun 26 21:55:33 datenbank sshd[59933]: Invalid user caja2 from 172.86.125.116 port 59912
...