Sep  7 16:46:16 l02a sshd[19968]: Invalid user admin from 62.210.37.82
Sep  7 16:46:16 l02a sshd[19968]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62-210-37-82.rev.poneytelecom.eu 
Sep  7 16:46:16 l02a sshd[19968]: Invalid user admin from 62.210.37.82
Sep  7 16:46:18 l02a sshd[19968]: Failed password for invalid user admin from 62.210.37.82 port 36308 ssh2

Sep  7 12:08:40 vpn01 sshd[1678]: Failed password for root from 62.210.37.82 port 45428 ssh2
Sep  7 12:08:51 vpn01 sshd[1678]: error: maximum authentication attempts exceeded for root from 62.210.37.82 port 45428 ssh2 [preauth]
...

Fail2Ban Ban Triggered

Aug 27 02:52:05 marvibiene sshd[21978]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.210.37.82 
Aug 27 02:52:07 marvibiene sshd[21978]: Failed password for invalid user admin from 62.210.37.82 port 36217 ssh2

xmlrpc attack

Jul 11 22:38:46 vmd26974 sshd[16583]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.210.37.82
Jul 11 22:38:47 vmd26974 sshd[16583]: Failed password for invalid user admin from 62.210.37.82 port 38913 ssh2
...

schuetzenmusikanten.de 62.210.37.82 [30/Jun/2020:11:27:55 +0200] "POST /xmlrpc.php HTTP/1.0" 301 511 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:61.0) Gecko/20100101 Firefox/61.0"
schuetzenmusikanten.de 62.210.37.82 [30/Jun/2020:11:27:56 +0200] "POST /xmlrpc.php HTTP/1.0" 200 3595 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:61.0) Gecko/20100101 Firefox/61.0"

Jun  7 09:20:36 [Censored Hostname] sshd[19655]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.210.37.82 
Jun  7 09:20:38 [Censored Hostname] sshd[19655]: Failed password for invalid user acoustic from 62.210.37.82 port 34452 ssh2[...]

May 13 19:53:57 host sshd[10493]: Invalid user ubnt from 62.210.37.82 port 32936

CMS (WordPress or Joomla) login attempt.

Feb  4 01:05:24 v22019058497090703 sshd[14465]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.210.37.82
Feb  4 01:05:26 v22019058497090703 sshd[14465]: Failed password for invalid user admin from 62.210.37.82 port 39296 ssh2
...

Invalid user pi from 62.210.37.82 port 43798

Unauthorized access detected from banned ip

Unauthorized access detected from banned ip

Invalid user aaron from 62.210.37.82 port 45002

Oct 24 06:03:27 thevastnessof sshd[7000]: Failed password for root from 62.210.37.82 port 42226 ssh2
...

Oct 14 13:47:58 sso sshd[11265]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.210.37.82
Oct 14 13:48:00 sso sshd[11265]: Failed password for invalid user 1111 from 62.210.37.82 port 34511 ssh2
...

Oct  9 16:26:37 rotator sshd\[23444\]: Failed password for root from 62.210.37.82 port 33038 ssh2Oct  9 16:26:39 rotator sshd\[23444\]: Failed password for root from 62.210.37.82 port 33038 ssh2Oct  9 16:26:42 rotator sshd\[23444\]: Failed password for root from 62.210.37.82 port 33038 ssh2Oct  9 16:26:44 rotator sshd\[23444\]: Failed password for root from 62.210.37.82 port 33038 ssh2Oct  9 16:26:47 rotator sshd\[23444\]: Failed password for root from 62.210.37.82 port 33038 ssh2Oct  9 16:26:49 rotator sshd\[23444\]: Failed password for root from 62.210.37.82 port 33038 ssh2
...

2019-10-08T20:05:08.166266abusebot.cloudsearch.cf sshd\[30839\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=62-210-37-82.rev.poneytelecom.eu  user=root

Oct  6 16:44:47 vpn01 sshd[26057]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.210.37.82
Oct  6 16:44:48 vpn01 sshd[26057]: Failed password for invalid user db2inst1 from 62.210.37.82 port 42628 ssh2
...

$f2bV_matches

Oct  2 06:18:47 rotator sshd\[22890\]: Failed password for root from 62.210.37.82 port 33329 ssh2Oct  2 06:18:49 rotator sshd\[22890\]: Failed password for root from 62.210.37.82 port 33329 ssh2Oct  2 06:18:52 rotator sshd\[22890\]: Failed password for root from 62.210.37.82 port 33329 ssh2Oct  2 06:18:55 rotator sshd\[22890\]: Failed password for root from 62.210.37.82 port 33329 ssh2Oct  2 06:18:57 rotator sshd\[22890\]: Failed password for root from 62.210.37.82 port 33329 ssh2Oct  2 06:19:00 rotator sshd\[22890\]: Failed password for root from 62.210.37.82 port 33329 ssh2
...

Oct  2 00:32:39 rotator sshd\[26675\]: Failed password for root from 62.210.37.82 port 36344 ssh2Oct  2 00:32:41 rotator sshd\[26675\]: Failed password for root from 62.210.37.82 port 36344 ssh2Oct  2 00:32:43 rotator sshd\[26675\]: Failed password for root from 62.210.37.82 port 36344 ssh2Oct  2 00:32:46 rotator sshd\[26675\]: Failed password for root from 62.210.37.82 port 36344 ssh2Oct  2 00:32:48 rotator sshd\[26675\]: Failed password for root from 62.210.37.82 port 36344 ssh2Oct  2 00:32:51 rotator sshd\[26675\]: Failed password for root from 62.210.37.82 port 36344 ssh2
...

ssh brute force

Sep 29 14:08:56 rotator sshd\[20823\]: Failed password for root from 62.210.37.82 port 37812 ssh2Sep 29 14:08:58 rotator sshd\[20823\]: Failed password for root from 62.210.37.82 port 37812 ssh2Sep 29 14:09:00 rotator sshd\[20823\]: Failed password for root from 62.210.37.82 port 37812 ssh2Sep 29 14:09:03 rotator sshd\[20823\]: Failed password for root from 62.210.37.82 port 37812 ssh2Sep 29 14:09:05 rotator sshd\[20823\]: Failed password for root from 62.210.37.82 port 37812 ssh2Sep 29 14:09:08 rotator sshd\[20823\]: Failed password for root from 62.210.37.82 port 37812 ssh2
...

Sep 24 06:50:23 km20725 sshd\[10754\]: Invalid user abel from 62.210.37.82Sep 24 06:50:25 km20725 sshd\[10754\]: Failed password for invalid user abel from 62.210.37.82 port 36093 ssh2Sep 24 06:50:28 km20725 sshd\[10754\]: Failed password for invalid user abel from 62.210.37.82 port 36093 ssh2Sep 24 06:50:31 km20725 sshd\[10754\]: Failed password for invalid user abel from 62.210.37.82 port 36093 ssh2
...

Sep 19 21:30:40 cvbmail sshd\[3905\]: Invalid user 22 from 62.210.37.82
Sep 19 21:30:40 cvbmail sshd\[3905\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.210.37.82
Sep 19 21:30:42 cvbmail sshd\[3905\]: Failed password for invalid user 22 from 62.210.37.82 port 45402 ssh2

Automated report - ssh fail2ban:
Sep 17 21:19:02 authentication failure 
Sep 17 21:19:03 wrong password, user=oracle, port=39533, ssh2
Sep 17 21:19:07 wrong password, user=oracle, port=39533, ssh2
Sep 17 21:19:11 wrong password, user=oracle, port=39533, ssh2

0,66-11/03 [bc01/m20] concatform PostRequest-Spammer scoring: essen

2019-08-31T05:03:10.019417abusebot.cloudsearch.cf sshd\[8264\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=62-210-37-82.rev.poneytelecom.eu  user=root

Oct 17 15:55:15 rotator sshd\[12309\]: Invalid user juan from 62.210.37.15Oct 17 15:55:17 rotator sshd\[12309\]: Failed password for invalid user juan from 62.210.37.15 port 60858 ssh2Oct 17 15:55:20 rotator sshd\[12309\]: Failed password for invalid user juan from 62.210.37.15 port 60858 ssh2Oct 17 15:55:22 rotator sshd\[12480\]: Invalid user kafka from 62.210.37.15Oct 17 15:55:25 rotator sshd\[12480\]: Failed password for invalid user kafka from 62.210.37.15 port 36412 ssh2Oct 17 15:55:27 rotator sshd\[12480\]: Failed password for invalid user kafka from 62.210.37.15 port 36412 ssh2
...

Oct 10 09:37:38 rotator sshd\[12422\]: Failed password for root from 62.210.37.15 port 58194 ssh2Oct 10 09:37:40 rotator sshd\[12422\]: Failed password for root from 62.210.37.15 port 58194 ssh2Oct 10 09:37:42 rotator sshd\[12422\]: Failed password for root from 62.210.37.15 port 58194 ssh2Oct 10 09:37:45 rotator sshd\[12422\]: Failed password for root from 62.210.37.15 port 58194 ssh2Oct 10 09:37:47 rotator sshd\[12422\]: Failed password for root from 62.210.37.15 port 58194 ssh2Oct 10 09:37:49 rotator sshd\[12422\]: Failed password for root from 62.210.37.15 port 58194 ssh2
...

Oct  6 11:51:06 vpn01 sshd[14988]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.210.37.15
Oct  6 11:51:07 vpn01 sshd[14988]: Failed password for invalid user advance from 62.210.37.15 port 50136 ssh2
...

Automatic report - Banned IP Access

marleenrecords.breidenba.ch:80 62.210.37.15 - - \[21/Sep/2019:23:31:07 +0200\] "POST /xmlrpc.php HTTP/1.0" 301 521 "-" "Mozilla/5.0 \(Macintosh\; Intel Mac OS X 10_13_4\) AppleWebKit/537.36 \(KHTML, like Gecko\) Chrome/69.0.3497.100 Safari/537.36"
marleenrecords.breidenba.ch 62.210.37.15 \[21/Sep/2019:23:31:08 +0200\] "POST /xmlrpc.php HTTP/1.0" 200 3777 "-" "Mozilla/5.0 \(Macintosh\; Intel Mac OS X 10_13_4\) AppleWebKit/537.36 \(KHTML, like Gecko\) Chrome/69.0.3497.100 Safari/537.36"

Russian criminal botnet.

[Aegis] @ 2019-08-27 18:03:10  0100 -> Maximum authentication attempts exceeded.

May  7 14:38:04 ny01 sshd[13179]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.87.192.235
May  7 14:38:06 ny01 sshd[13179]: Failed password for invalid user kbe from 183.87.192.235 port 35896 ssh2
May  7 14:42:00 ny01 sshd[13677]: Failed password for root from 183.87.192.235 port 44896 ssh2

$f2bV_matches | Triggered by Fail2Ban at Vostok web server

May  7 22:27:31 eventyay sshd[30444]: Failed password for root from 222.186.175.154 port 48928 ssh2
May  7 22:27:34 eventyay sshd[30444]: Failed password for root from 222.186.175.154 port 48928 ssh2
May  7 22:27:44 eventyay sshd[30444]: error: maximum authentication attempts exceeded for root from 222.186.175.154 port 48928 ssh2 [preauth]
...

May  7 19:19:09 nextcloud sshd\[12142\]: Invalid user customer from 63.239.129.138
May  7 19:19:09 nextcloud sshd\[12142\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=63.239.129.138
May  7 19:19:11 nextcloud sshd\[12142\]: Failed password for invalid user customer from 63.239.129.138 port 47006 ssh2

$f2bV_matches

20 attempts against mh-misbehave-ban on thorn

May  7 21:57:16 h1745522 sshd[32100]: Invalid user tomcat1 from 5.89.35.84 port 58916
May  7 21:57:16 h1745522 sshd[32100]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.89.35.84
May  7 21:57:16 h1745522 sshd[32100]: Invalid user tomcat1 from 5.89.35.84 port 58916
May  7 21:57:19 h1745522 sshd[32100]: Failed password for invalid user tomcat1 from 5.89.35.84 port 58916 ssh2
May  7 22:00:24 h1745522 sshd[32268]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.89.35.84  user=root
May  7 22:00:25 h1745522 sshd[32268]: Failed password for root from 5.89.35.84 port 57140 ssh2
May  7 22:03:43 h1745522 sshd[32418]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.89.35.84  user=root
May  7 22:03:45 h1745522 sshd[32418]: Failed password for root from 5.89.35.84 port 55370 ssh2
May  7 22:06:56 h1745522 sshd[32621]: pam_unix(sshd:auth): authentication failure; logname= ui
...

May  7 21:06:43 vps647732 sshd[21314]: Failed password for root from 186.113.18.109 port 34488 ssh2
May  7 21:11:09 vps647732 sshd[21488]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.113.18.109
...

May  8 00:54:17 webhost01 sshd[1772]: Failed password for root from 123.120.156.219 port 55973 ssh2
May  8 00:56:11 webhost01 sshd[1791]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.120.156.219
...

May  7 19:20:51 scw-6657dc sshd[14194]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.79.90.72
May  7 19:20:51 scw-6657dc sshd[14194]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.79.90.72
May  7 19:20:53 scw-6657dc sshd[14194]: Failed password for invalid user zebra from 103.79.90.72 port 38768 ssh2
...

Brute-force attempt banned

May  7 22:42:25 debian-2gb-nbg1-2 kernel: \[11143029.068845\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=79.124.62.66 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=244 ID=9863 PROTO=TCP SPT=52874 DPT=3359 WINDOW=1024 RES=0x00 SYN URGP=0

ET CINS Active Threat Intelligence Poor Reputation IP group 27 - port: 15793 proto: TCP cat: Misc Attack

firewall-block, port(s): 445/tcp

May  7 21:24:04 * sshd[13312]: Failed password for root from 51.77.109.98 port 41250 ssh2
May  7 21:28:59 * sshd[14066]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.77.109.98