May  5 03:06:09 ns3164893 sshd[27378]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.76.6.126
May  5 03:06:11 ns3164893 sshd[27378]: Failed password for invalid user mekon from 64.76.6.126 port 40968 ssh2
...

Feb 22 12:11:17 mout sshd[4361]: Invalid user administrator from 64.76.6.126 port 55362

Invalid user ftpuser2 from 64.76.6.126 port 35849

Unauthorized connection attempt detected from IP address 64.76.6.126 to port 2220 [J]

Jan 17 18:01:08 * sshd[22664]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.76.6.126
Jan 17 18:01:10 * sshd[22664]: Failed password for invalid user admin from 64.76.6.126 port 1025 ssh2

Unauthorized connection attempt detected from IP address 64.76.6.126 to port 22

Unauthorized connection attempt detected from IP address 64.76.6.126 to port 22

Dec  7 12:10:15 host sshd[13335]: Invalid user ubuntu from 64.76.6.126 port 59293
...

Nov 25 08:10:40 vps666546 sshd\[14100\]: Invalid user cupsys from 64.76.6.126 port 40245
Nov 25 08:10:40 vps666546 sshd\[14100\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.76.6.126
Nov 25 08:10:42 vps666546 sshd\[14100\]: Failed password for invalid user cupsys from 64.76.6.126 port 40245 ssh2
Nov 25 08:16:21 vps666546 sshd\[14273\]: Invalid user zoltrix from 64.76.6.126 port 55482
Nov 25 08:16:21 vps666546 sshd\[14273\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.76.6.126
...

2019-11-20T15:18:32.203869abusebot-2.cloudsearch.cf sshd\[31167\]: Invalid user morgan from 64.76.6.126 port 56575

SSH Bruteforce

Nov 16 00:21:49 server sshd\[5832\]: Invalid user backup from 64.76.6.126
Nov 16 00:21:49 server sshd\[5832\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.76.6.126 
Nov 16 00:21:52 server sshd\[5832\]: Failed password for invalid user backup from 64.76.6.126 port 39278 ssh2
Nov 16 00:59:38 server sshd\[16052\]: Invalid user ftpuser from 64.76.6.126
Nov 16 00:59:38 server sshd\[16052\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.76.6.126 
...

SSH login attempts, brute-force attack.
Date: Sun Nov 10. 23:08:15 2019 +0100
Source IP: 64.76.6.126 (AR/Argentina/64-76-6-126.dynamic.impsat.net.ar)

Log entries:
Nov 10 23:03:18 iron sshd[2473]: Invalid user testuser from 64.76.6.126
Nov 10 23:03:18 iron sshd[2473]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.76.6.126
Nov 10 23:03:20 iron sshd[2473]: Failed password for invalid user testuser from 64.76.6.126 port 45730 ssh2
Nov 10 23:08:12 iron sshd[3044]: Invalid user guest from 64.76.6.126
Nov 10 23:08:12 iron sshd[3044]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.76.6.126

detected by Fail2Ban

2019-10-31T13:47:52.459697abusebot-8.cloudsearch.cf sshd\[29854\]: Invalid user nw from 64.76.6.126 port 42579

2019-09-29T22:47:14.079095  sshd[20009]: Invalid user agario from 64.76.6.126 port 45780
2019-09-29T22:47:14.093442  sshd[20009]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.76.6.126
2019-09-29T22:47:14.079095  sshd[20009]: Invalid user agario from 64.76.6.126 port 45780
2019-09-29T22:47:16.245183  sshd[20009]: Failed password for invalid user agario from 64.76.6.126 port 45780 ssh2
2019-09-29T22:52:07.947163  sshd[20050]: Invalid user nas from 64.76.6.126 port 38496
...

Sep 28 14:25:41 game-panel sshd[29672]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.76.6.126
Sep 28 14:25:43 game-panel sshd[29672]: Failed password for invalid user toor from 64.76.6.126 port 38301 ssh2
Sep 28 14:33:27 game-panel sshd[29909]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.76.6.126

Sep 28 04:44:48 localhost sshd\[31821\]: Invalid user mcc from 64.76.6.126 port 41229
Sep 28 04:44:48 localhost sshd\[31821\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.76.6.126
Sep 28 04:44:50 localhost sshd\[31821\]: Failed password for invalid user mcc from 64.76.6.126 port 41229 ssh2
Sep 28 04:51:35 localhost sshd\[32038\]: Invalid user hostmaster from 64.76.6.126 port 37647
Sep 28 04:51:35 localhost sshd\[32038\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.76.6.126
...

Sep  1 05:35:38 minden010 sshd[22757]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.76.6.126
Sep  1 05:35:41 minden010 sshd[22757]: Failed password for invalid user opy from 64.76.6.126 port 54626 ssh2
Sep  1 05:43:55 minden010 sshd[25877]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.76.6.126
...

Aug 27 06:01:34 rpi sshd[15244]: Failed password for root from 64.76.6.126 port 59254 ssh2
Aug 27 06:08:25 rpi sshd[15428]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.76.6.126

Invalid user app from 64.76.6.126 port 47490

Jul 31 08:00:48 rpi sshd[5576]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.76.6.126 
Jul 31 08:00:50 rpi sshd[5576]: Failed password for invalid user ftp from 64.76.6.126 port 39503 ssh2

Triggered by Fail2Ban at Vostok web server

Jul 26 12:16:03 ArkNodeAT sshd\[25017\]: Invalid user ascension from 64.76.6.126
Jul 26 12:16:03 ArkNodeAT sshd\[25017\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.76.6.126
Jul 26 12:16:05 ArkNodeAT sshd\[25017\]: Failed password for invalid user ascension from 64.76.6.126 port 40490 ssh2

Jul 21 14:00:24 areeb-Workstation sshd\[1227\]: Invalid user nagios from 64.76.6.126
Jul 21 14:00:24 areeb-Workstation sshd\[1227\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.76.6.126
Jul 21 14:00:26 areeb-Workstation sshd\[1227\]: Failed password for invalid user nagios from 64.76.6.126 port 48808 ssh2
...

Invalid user iolanda from 64.76.6.126 port 35674

Jun 29 15:45:12 MK-Soft-VM4 sshd\[31881\]: Invalid user sysadmin from 64.76.6.126 port 57326
Jun 29 15:45:12 MK-Soft-VM4 sshd\[31881\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.76.6.126
Jun 29 15:45:14 MK-Soft-VM4 sshd\[31881\]: Failed password for invalid user sysadmin from 64.76.6.126 port 57326 ssh2
...

Jun 27 00:57:13 core01 sshd\[10789\]: Invalid user ftpuser from 64.76.6.126 port 38791
Jun 27 00:57:13 core01 sshd\[10789\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.76.6.126
...

Jun 22 08:27:53 vmd17057 sshd\[6973\]: Invalid user sui from 64.76.6.126 port 49731
Jun 22 08:27:53 vmd17057 sshd\[6973\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.76.6.126
Jun 22 08:27:55 vmd17057 sshd\[6973\]: Failed password for invalid user sui from 64.76.6.126 port 49731 ssh2
...

sshd

Lines containing failures of 81.40.55.56
Jun 11 14:48:07 shared07 sshd[16158]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.40.55.56  user=r.r
Jun 11 14:48:09 shared07 sshd[16158]: Failed password for r.r from 81.40.55.56 port 41240 ssh2
Jun 11 14:48:09 shared07 sshd[16158]: Received disconnect from 81.40.55.56 port 41240:11: Bye Bye [preauth]
Jun 11 14:48:09 shared07 sshd[16158]: Disconnected from authenticating user r.r 81.40.55.56 port 41240 [preauth]
Jun 11 15:04:24 shared07 sshd[21612]: Invalid user herve from 81.40.55.56 port 35010
Jun 11 15:04:24 shared07 sshd[21612]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.40.55.56
Jun 11 15:04:26 shared07 sshd[21612]: Failed password for invalid user herve from 81.40.55.56 port 35010 ssh2
Jun 11 15:04:26 shared07 sshd[21612]: Received disconnect from 81.40.55.56 port 35010:11: Bye Bye [preauth]
Jun 11 15:04:26 shared07 sshd[21612]: D........
------------------------------

Unauthorized connection attempt detected from IP address 181.46.193.87 to port 23

2020-06-13T16:24:51.140829lavrinenko.info sshd[8925]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.235.58.253  user=root
2020-06-13T16:24:52.921163lavrinenko.info sshd[8925]: Failed password for root from 49.235.58.253 port 43032 ssh2
2020-06-13T16:28:00.327445lavrinenko.info sshd[9108]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.235.58.253  user=root
2020-06-13T16:28:02.388451lavrinenko.info sshd[9108]: Failed password for root from 49.235.58.253 port 50442 ssh2
2020-06-13T16:31:06.982632lavrinenko.info sshd[9253]: Invalid user rawman from 49.235.58.253 port 57750
...

...

nft/Honeypot/22/73e86

2020-06-13T16:35[Censored Hostname] sshd[18601]: Failed password for invalid user v from 157.230.150.102 port 50698 ssh2
2020-06-13T16:38[Censored Hostname] sshd[19629]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.230.150.102  user=root
2020-06-13T16:38[Censored Hostname] sshd[19629]: Failed password for root from 157.230.150.102 port 51886 ssh2[...]

$f2bV_matches

Jun 13 08:21:32 lanister sshd[27749]: Invalid user bnq_ops from 118.24.233.44
Jun 13 08:21:34 lanister sshd[27749]: Failed password for invalid user bnq_ops from 118.24.233.44 port 46938 ssh2
Jun 13 08:25:59 lanister sshd[27808]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.24.233.44  user=root
Jun 13 08:26:01 lanister sshd[27808]: Failed password for root from 118.24.233.44 port 36116 ssh2

2020-06-13T12:26:08.910851Z 2d351d022312 New connection: 94.142.244.16:47719 (172.17.0.3:2222) [session: 2d351d022312]
2020-06-13T12:26:08.936644Z a8c586651eab New connection: 94.142.244.16:35445 (172.17.0.3:2222) [session: a8c586651eab]

[Sat Jun 13 06:17:03 2020 GMT] ecxznluf  [URIBL_INV,RDNS_NONE], Subject: Industrial Automation Part

Jun 13 11:11:57 firewall sshd[8615]: Failed password for root from 112.85.42.173 port 32999 ssh2
Jun 13 11:12:01 firewall sshd[8615]: Failed password for root from 112.85.42.173 port 32999 ssh2
Jun 13 11:12:04 firewall sshd[8615]: Failed password for root from 112.85.42.173 port 32999 ssh2
...

2020-06-13T09:28:54.4490661495-001 sshd[19795]: Invalid user anonymous from 54.39.238.84 port 12162
2020-06-13T09:28:56.5941721495-001 sshd[19795]: Failed password for invalid user anonymous from 54.39.238.84 port 12162 ssh2
2020-06-13T09:33:08.2448021495-001 sshd[19935]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=ip84.ip-54-39-238.net  user=nobody
2020-06-13T09:33:10.6347321495-001 sshd[19935]: Failed password for nobody from 54.39.238.84 port 8231 ssh2
2020-06-13T09:37:20.3606751495-001 sshd[20146]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=ip84.ip-54-39-238.net  user=root
2020-06-13T09:37:22.3025081495-001 sshd[20146]: Failed password for root from 54.39.238.84 port 5071 ssh2
...

Jun 13 14:17:46 localhost sshd[82695]: Invalid user zhangbo from 150.136.152.190 port 44488
Jun 13 14:17:46 localhost sshd[82695]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=150.136.152.190
Jun 13 14:17:46 localhost sshd[82695]: Invalid user zhangbo from 150.136.152.190 port 44488
Jun 13 14:17:48 localhost sshd[82695]: Failed password for invalid user zhangbo from 150.136.152.190 port 44488 ssh2
Jun 13 14:23:41 localhost sshd[83179]: Invalid user orangedev from 150.136.152.190 port 46168
...

1592051193 - 06/13/2020 14:26:33 Host: 1.173.244.225/1.173.244.225 Port: 445 TCP Blocked