2020-09-26T16:18:59.278956abusebot-8.cloudsearch.cf sshd[3873]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61-221-64-4.hinet-ip.hinet.net  user=root
2020-09-26T16:19:00.988379abusebot-8.cloudsearch.cf sshd[3873]: Failed password for root from 61.221.64.4 port 35862 ssh2
2020-09-26T16:21:48.304639abusebot-8.cloudsearch.cf sshd[3877]: Invalid user sms from 61.221.64.4 port 51652
2020-09-26T16:21:48.312844abusebot-8.cloudsearch.cf sshd[3877]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61-221-64-4.hinet-ip.hinet.net
2020-09-26T16:21:48.304639abusebot-8.cloudsearch.cf sshd[3877]: Invalid user sms from 61.221.64.4 port 51652
2020-09-26T16:21:50.555479abusebot-8.cloudsearch.cf sshd[3877]: Failed password for invalid user sms from 61.221.64.4 port 51652 ssh2
2020-09-26T16:24:31.019128abusebot-8.cloudsearch.cf sshd[3886]: Invalid user st from 61.221.64.4 port 39224
...

Sep 26 06:02:08 root sshd[28877]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61-221-64-4.hinet-ip.hinet.net  user=root
Sep 26 06:02:11 root sshd[28877]: Failed password for root from 61.221.64.4 port 47106 ssh2
...

bruteforce detected

"Unauthorized connection attempt on SSHD detected"

Multiple SSH authentication failures from 61.221.64.4

Multiple SSH authentication failures from 61.221.64.4

SSH Invalid Login

Aug 21 07:40:47 cosmoit sshd[15742]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.221.64.4

Aug 13 00:05:11 jane sshd[4677]: Failed password for root from 61.221.64.4 port 52036 ssh2
...

2020-07-29 14:49:34,210 fail2ban.actions        [18606]: NOTICE  [sshd] Ban 61.221.64.6
2020-07-29 15:07:33,230 fail2ban.actions        [18606]: NOTICE  [sshd] Ban 61.221.64.6
2020-07-29 15:25:40,460 fail2ban.actions        [18606]: NOTICE  [sshd] Ban 61.221.64.6
2020-07-29 15:43:46,552 fail2ban.actions        [18606]: NOTICE  [sshd] Ban 61.221.64.6
2020-07-29 16:02:01,633 fail2ban.actions        [18606]: NOTICE  [sshd] Ban 61.221.64.6
...

Sep  4 05:27:23 pve1 sshd[1634]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.221.64.6 
Sep  4 05:27:25 pve1 sshd[1634]: Failed password for invalid user ares from 61.221.64.6 port 55776 ssh2
...

Sep  3 18:46:41 serwer sshd\[28898\]: Invalid user mukti from 61.221.64.6 port 33478
Sep  3 18:46:41 serwer sshd\[28898\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.221.64.6
Sep  3 18:46:44 serwer sshd\[28898\]: Failed password for invalid user mukti from 61.221.64.6 port 33478 ssh2
...

Aug 26 14:31:16 ns382633 sshd\[21336\]: Invalid user teamspeak3 from 61.221.64.5 port 41062
Aug 26 14:31:16 ns382633 sshd\[21336\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.221.64.5
Aug 26 14:31:18 ns382633 sshd\[21336\]: Failed password for invalid user teamspeak3 from 61.221.64.5 port 41062 ssh2
Aug 26 14:32:35 ns382633 sshd\[21491\]: Invalid user wzk from 61.221.64.5 port 53538
Aug 26 14:32:35 ns382633 sshd\[21491\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.221.64.5

Aug 19 06:44:41 localhost sshd[1007826]: Invalid user wangyi from 61.221.64.6 port 37150
...

Aug 18 14:16:21 Ubuntu-1404-trusty-64-minimal sshd\[10359\]: Invalid user wms from 61.221.64.5
Aug 18 14:16:21 Ubuntu-1404-trusty-64-minimal sshd\[10359\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.221.64.5
Aug 18 14:16:23 Ubuntu-1404-trusty-64-minimal sshd\[10359\]: Failed password for invalid user wms from 61.221.64.5 port 39650 ssh2
Aug 18 14:31:58 Ubuntu-1404-trusty-64-minimal sshd\[26492\]: Invalid user migrate from 61.221.64.5
Aug 18 14:31:58 Ubuntu-1404-trusty-64-minimal sshd\[26492\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.221.64.5

Aug 13 05:13:25 webhost01 sshd[26841]: Failed password for root from 61.221.64.6 port 51786 ssh2
...

Jul 28 13:11:37 plex-server sshd[855350]: Invalid user yangpengfei from 61.221.64.6 port 44480
Jul 28 13:11:37 plex-server sshd[855350]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.221.64.6 
Jul 28 13:11:37 plex-server sshd[855350]: Invalid user yangpengfei from 61.221.64.6 port 44480
Jul 28 13:11:39 plex-server sshd[855350]: Failed password for invalid user yangpengfei from 61.221.64.6 port 44480 ssh2
Jul 28 13:16:12 plex-server sshd[857814]: Invalid user documedias from 61.221.64.6 port 58674
...

Fail2Ban - SSH Bruteforce Attempt

Jul 21 03:50:30 our-server-hostname sshd[6216]: Invalid user aa from 61.221.64.6
Jul 21 03:50:30 our-server-hostname sshd[6216]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61-221-64-6.hinet-ip.hinet.net 
Jul 21 03:50:32 our-server-hostname sshd[6216]: Failed password for invalid user aa from 61.221.64.6 port 48532 ssh2
Jul 21 04:05:03 our-server-hostname sshd[8324]: Invalid user millard from 61.221.64.6
Jul 21 04:05:03 our-server-hostname sshd[8324]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61-221-64-6.hinet-ip.hinet.net 
Jul 21 04:05:04 our-server-hostname sshd[8324]: Failed password for invalid user millard from 61.221.64.6 port 48784 ssh2
Jul 21 04:09:31 our-server-hostname sshd[9019]: Invalid user uos from 61.221.64.6
Jul 21 04:09:31 our-server-hostname sshd[9019]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61-221-64-6.hinet-ip.hin........
-------------------------------

2020-07-20T01:33:02.561794amanda2.illicoweb.com sshd\[14579\]: Invalid user song from 61.221.64.6 port 56524
2020-07-20T01:33:02.564641amanda2.illicoweb.com sshd\[14579\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=61-221-64-6.hinet-ip.hinet.net
2020-07-20T01:33:04.672850amanda2.illicoweb.com sshd\[14579\]: Failed password for invalid user song from 61.221.64.6 port 56524 ssh2
2020-07-20T01:37:21.117703amanda2.illicoweb.com sshd\[14779\]: Invalid user admin from 61.221.64.6 port 44916
2020-07-20T01:37:21.120362amanda2.illicoweb.com sshd\[14779\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=61-221-64-6.hinet-ip.hinet.net
...

Telnet/23 MH Probe, BF, Hack -

Aug 14 18:30:11 ns382633 sshd\[1772\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.38.240.23  user=root
Aug 14 18:30:13 ns382633 sshd\[1772\]: Failed password for root from 54.38.240.23 port 49518 ssh2
Aug 14 18:43:58 ns382633 sshd\[3776\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.38.240.23  user=root
Aug 14 18:44:00 ns382633 sshd\[3776\]: Failed password for root from 54.38.240.23 port 57650 ssh2
Aug 14 18:47:58 ns382633 sshd\[4715\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.38.240.23  user=root

Aug 14 16:10:19 buvik sshd[12793]: Failed password for root from 120.70.100.159 port 39922 ssh2
Aug 14 16:18:53 buvik sshd[13885]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.70.100.159  user=root
Aug 14 16:18:55 buvik sshd[13885]: Failed password for root from 120.70.100.159 port 53168 ssh2
...

Aug 14 20:31:26 ns382633 sshd\[25692\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.94.100.74  user=root
Aug 14 20:31:28 ns382633 sshd\[25692\]: Failed password for root from 36.94.100.74 port 36220 ssh2
Aug 14 20:36:21 ns382633 sshd\[26602\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.94.100.74  user=root
Aug 14 20:36:22 ns382633 sshd\[26602\]: Failed password for root from 36.94.100.74 port 41468 ssh2
Aug 14 20:41:15 ns382633 sshd\[27551\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.94.100.74  user=root

20/8/14@08:18:33: FAIL: Alarm-Network address from=182.156.230.250
...

Automatic report - Port Scan Attack

Aug 14 21:49:00 ip40 sshd[29579]: Failed password for root from 111.67.204.211 port 43412 ssh2
...

2020-08-14T15:54:54.1820341495-001 sshd[32816]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.27.196.35.bc.googleusercontent.com  user=root
2020-08-14T15:54:56.1586801495-001 sshd[32816]: Failed password for root from 35.196.27.1 port 50058 ssh2
2020-08-14T15:57:42.8702941495-001 sshd[32979]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.27.196.35.bc.googleusercontent.com  user=root
2020-08-14T15:57:44.9009451495-001 sshd[32979]: Failed password for root from 35.196.27.1 port 45678 ssh2
2020-08-14T16:00:40.2970071495-001 sshd[33080]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.27.196.35.bc.googleusercontent.com  user=root
2020-08-14T16:00:42.7746751495-001 sshd[33080]: Failed password for root from 35.196.27.1 port 41312 ssh2
...

Aug 14 20:07:39 minden010 sshd[17842]: Failed password for root from 128.199.124.159 port 48002 ssh2
Aug 14 20:09:59 minden010 sshd[18732]: Failed password for root from 128.199.124.159 port 53842 ssh2
...

Lines containing failures of 156.236.71.34
Aug 12 23:29:17 jarvis sshd[31171]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.236.71.34  user=r.r
Aug 12 23:29:20 jarvis sshd[31171]: Failed password for r.r from 156.236.71.34 port 44247 ssh2
Aug 12 23:29:22 jarvis sshd[31171]: Received disconnect from 156.236.71.34 port 44247:11: Bye Bye [preauth]
Aug 12 23:29:22 jarvis sshd[31171]: Disconnected from authenticating user r.r 156.236.71.34 port 44247 [preauth]
Aug 12 23:44:45 jarvis sshd[32057]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.236.71.34  user=r.r
Aug 12 23:44:47 jarvis sshd[32057]: Failed password for r.r from 156.236.71.34 port 56704 ssh2
Aug 12 23:44:48 jarvis sshd[32057]: Received disconnect from 156.236.71.34 port 56704:11: Bye Bye [preauth]
Aug 12 23:44:48 jarvis sshd[32057]: Disconnected from authenticating user r.r 156.236.71.34 port 56704 [preauth]
Aug 12 23:49:0........
------------------------------

$f2bV_matches

nginx-botsearch jail

Aug 14 16:17:52 vps46666688 sshd[1263]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.83.110.68
Aug 14 16:17:54 vps46666688 sshd[1263]: Failed password for invalid user Password@33 from 222.83.110.68 port 33416 ssh2
...

20/8/14@13:21:49: FAIL: Alarm-Network address from=177.73.99.208
...

Aug 14 21:17:42 sip sshd[1306992]: Failed password for root from 202.154.184.148 port 36334 ssh2
Aug 14 21:21:06 sip sshd[1307022]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.154.184.148  user=root
Aug 14 21:21:08 sip sshd[1307022]: Failed password for root from 202.154.184.148 port 59798 ssh2
...

 TCP (SYN) 109.148.147.211:49126 -> port 22, len 44