Dec  4 13:01:23 plusreed sshd[14701]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=79.124.7.241  user=root
Dec  4 13:01:25 plusreed sshd[14701]: Failed password for root from 79.124.7.241 port 50076 ssh2
...

Nov 26 07:54:59 hosting sshd[26766]: Invalid user erickson from 79.124.7.241 port 53162
...

Nov 12 22:48:19 eddieflores sshd\[2350\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=79.124.7.241  user=root
Nov 12 22:48:21 eddieflores sshd\[2350\]: Failed password for root from 79.124.7.241 port 36542 ssh2
Nov 12 22:53:21 eddieflores sshd\[2754\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=79.124.7.241  user=root
Nov 12 22:53:22 eddieflores sshd\[2754\]: Failed password for root from 79.124.7.241 port 33200 ssh2
Nov 12 22:58:16 eddieflores sshd\[3183\]: Invalid user mendorf from 79.124.7.241
Nov 12 22:58:16 eddieflores sshd\[3183\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=79.124.7.241

Nov  7 01:43:54 ovpn sshd\[16654\]: Invalid user ts from 79.124.7.241
Nov  7 01:43:54 ovpn sshd\[16654\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=79.124.7.241
Nov  7 01:43:56 ovpn sshd\[16654\]: Failed password for invalid user ts from 79.124.7.241 port 54530 ssh2
Nov  7 01:48:52 ovpn sshd\[17723\]: Invalid user vagrant from 79.124.7.241
Nov  7 01:48:52 ovpn sshd\[17723\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=79.124.7.241

Port Scan: TCP/443

Port Scan: TCP/443

Port Scan: TCP/443

Jun 23 14:04:55 Ubuntu-1404-trusty-64-minimal sshd\[16032\]: Invalid user ftpuser from 79.124.7.88
Jun 23 14:04:55 Ubuntu-1404-trusty-64-minimal sshd\[16032\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=79.124.7.88
Jun 23 14:04:57 Ubuntu-1404-trusty-64-minimal sshd\[16032\]: Failed password for invalid user ftpuser from 79.124.7.88 port 50676 ssh2
Jun 23 14:07:32 Ubuntu-1404-trusty-64-minimal sshd\[17444\]: Invalid user post from 79.124.7.88
Jun 23 14:07:32 Ubuntu-1404-trusty-64-minimal sshd\[17444\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=79.124.7.88

SSH authentication failure x 6 reported by Fail2Ban
...

May 27 13:55:34  sshd\[29008\]: User root from 79.124.7.78 not allowed because not listed in AllowUsersMay 27 13:55:35  sshd\[29008\]: Failed password for invalid user root from 79.124.7.78 port 48320 ssh2
...

Invalid user vvm from 79.124.7.78 port 51288

2020-05-14 13:56:35 server sshd[32997]: Failed password for invalid user francesca from 79.124.7.78 port 54364 ssh2

May 15 07:31:21 legacy sshd[1331]: Failed password for root from 79.124.7.78 port 57580 ssh2
May 15 07:35:32 legacy sshd[1542]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=79.124.7.78
May 15 07:35:35 legacy sshd[1542]: Failed password for invalid user azuniga from 79.124.7.78 port 38220 ssh2
...

May 12 09:00:40 lukav-desktop sshd\[1792\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=79.124.7.78  user=root
May 12 09:00:42 lukav-desktop sshd\[1792\]: Failed password for root from 79.124.7.78 port 38984 ssh2
May 12 09:04:24 lukav-desktop sshd\[1855\]: Invalid user jenkins from 79.124.7.78
May 12 09:04:24 lukav-desktop sshd\[1855\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=79.124.7.78
May 12 09:04:27 lukav-desktop sshd\[1855\]: Failed password for invalid user jenkins from 79.124.7.78 port 46962 ssh2

$f2bV_matches

Aug  8 15:48:36 server sshd\[23804\]: Invalid user postgres from 79.124.7.4 port 54232
Aug  8 15:48:36 server sshd\[23804\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=79.124.7.4
Aug  8 15:48:38 server sshd\[23804\]: Failed password for invalid user postgres from 79.124.7.4 port 54232 ssh2
Aug  8 15:56:12 server sshd\[2873\]: Invalid user augurio from 79.124.7.4 port 49814
Aug  8 15:56:12 server sshd\[2873\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=79.124.7.4

Aug  8 11:48:02 server sshd\[25807\]: Invalid user ebook from 79.124.7.4 port 51782
Aug  8 11:48:02 server sshd\[25807\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=79.124.7.4
Aug  8 11:48:04 server sshd\[25807\]: Failed password for invalid user ebook from 79.124.7.4 port 51782 ssh2
Aug  8 11:55:42 server sshd\[2961\]: Invalid user sv from 79.124.7.4 port 47280
Aug  8 11:55:42 server sshd\[2961\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=79.124.7.4

SSH Brute Force, server-1 sshd[30683]: Failed password for invalid user elsie from 79.124.7.4 port 34468 ssh2

Aug  5 23:05:43 vtv3 sshd\[5207\]: Invalid user snow from 79.124.7.4 port 52118
Aug  5 23:05:43 vtv3 sshd\[5207\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=79.124.7.4
Aug  5 23:05:44 vtv3 sshd\[5207\]: Failed password for invalid user snow from 79.124.7.4 port 52118 ssh2
Aug  5 23:15:09 vtv3 sshd\[9792\]: Invalid user isabelle from 79.124.7.4 port 50554
Aug  5 23:15:09 vtv3 sshd\[9792\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=79.124.7.4
Aug  5 23:34:38 vtv3 sshd\[19207\]: Invalid user db2inst2 from 79.124.7.4 port 47634
Aug  5 23:34:38 vtv3 sshd\[19207\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=79.124.7.4
Aug  5 23:34:40 vtv3 sshd\[19207\]: Failed password for invalid user db2inst2 from 79.124.7.4 port 47634 ssh2
Aug  5 23:43:31 vtv3 sshd\[23621\]: Invalid user stuttgart from 79.124.7.4 port 45864
Aug  5 23:43:31 vtv3 sshd\[23621\]: pam_unix\(sshd:auth\): aut

(sshd) Failed SSH login from 210.206.92.137 (KR/South Korea/-): 2 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Jun  4 22:24:01 ubnt-55d23 sshd[28923]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.206.92.137  user=root
Jun  4 22:24:02 ubnt-55d23 sshd[28923]: Failed password for root from 210.206.92.137 port 50281 ssh2

\[Jun  5 06:20:26\] NOTICE\[2019\] chan_sip.c: Registration from '\' failed for '195.181.170.84:60918' - Wrong password
\[Jun  5 06:20:49\] NOTICE\[2019\] chan_sip.c: Registration from '\' failed for '195.181.170.84:56317' - Wrong password
\[Jun  5 06:21:11\] NOTICE\[2019\] chan_sip.c: Registration from '\' failed for '195.181.170.84:51623' - Wrong password
\[Jun  5 06:21:34\] NOTICE\[2019\] chan_sip.c: Registration from '\' failed for '195.181.170.84:63559' - Wrong password
\[Jun  5 06:21:58\] NOTICE\[2019\] chan_sip.c: Registration from '\' failed for '195.181.170.84:59653' - Wrong password
\[Jun  5 06:22:21\] NOTICE\[2019\] chan_sip.c: Registration from '\' failed for '195.181.170.84:55511' - Wrong password
\[Jun  5 06:22:45\] NOTICE\[2019\] chan_sip.c: Registration from '\' fai
...

Lines containing failures of 92.73.250.52
Jun  3 19:13:36 *** sshd[21743]: Invalid user pi from 92.73.250.52 port 44130
Jun  3 19:13:36 *** sshd[21743]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.73.250.52
Jun  3 19:13:36 *** sshd[21745]: Invalid user pi from 92.73.250.52 port 44132
Jun  3 19:13:36 *** sshd[21745]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.73.250.52
Jun  3 19:13:38 *** sshd[21743]: Failed password for invalid user pi from 92.73.250.52 port 44130 ssh2
Jun  3 19:13:38 *** sshd[21743]: Connection closed by invalid user pi 92.73.250.52 port 44130 [preauth]
Jun  3 19:13:38 *** sshd[21745]: Failed password for invalid user pi from 92.73.250.52 port 44132 ssh2
Jun  3 19:13:38 *** sshd[21745]: Connection closed by invalid user pi 92.73.250.52 port 44132 [preauth]


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=92.73.250.52

Jun  4 23:02:40 abendstille sshd\[24291\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.30.57  user=root
Jun  4 23:02:42 abendstille sshd\[24291\]: Failed password for root from 222.186.30.57 port 32985 ssh2
Jun  4 23:02:48 abendstille sshd\[24334\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.30.57  user=root
Jun  4 23:02:50 abendstille sshd\[24334\]: Failed password for root from 222.186.30.57 port 59594 ssh2
Jun  4 23:02:52 abendstille sshd\[24334\]: Failed password for root from 222.186.30.57 port 59594 ssh2
...

Jun  4 22:04:26 mail postfix/smtpd\[5109\]: warning: unknown\[46.38.145.253\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6\
Jun  4 22:06:04 mail postfix/smtpd\[5035\]: warning: unknown\[46.38.145.253\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6\
Jun  4 22:37:26 mail postfix/smtpd\[6057\]: warning: unknown\[46.38.145.253\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6\
Jun  4 22:39:03 mail postfix/smtpd\[6057\]: warning: unknown\[46.38.145.253\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6\

Brute force attempt

Lines containing failures of 49.12.97.162
Jun  3 21:32:54 majoron sshd[22675]: Did not receive identification string from 49.12.97.162 port 40486
Jun  3 21:34:20 majoron sshd[23776]: Invalid user redhat from 49.12.97.162 port 35706
Jun  3 21:34:20 majoron sshd[23776]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.12.97.162 
Jun  3 21:34:22 majoron sshd[23776]: Failed password for invalid user redhat from 49.12.97.162 port 35706 ssh2
Jun  3 21:34:23 majoron sshd[23776]: Received disconnect from 49.12.97.162 port 35706:11: Normal Shutdown, Thank you for playing [preauth]
Jun  3 21:34:23 majoron sshd[23776]: Disconnected from invalid user redhat 49.12.97.162 port 35706 [preauth]


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=49.12.97.162

SSH Brute Force

Unauthorized SSH login attempts

/_api/v2.0/shares/u!aHR0cHM6Ly9ibG9nLmhhbWV0YmVub2l0LmluZm8vd3AtY29udGVudC91cGxvYWRzLzIwMjAvMDYvaW1hZ2VfdGh1bWIucG5n/driveItem/thumbnails/0/c400x99999/content/?preferNoRedirect=true&prefer=extendCacheMaxAge&clientType=modernWebPart

leo_www

Jun  4 20:17:29 localhost sshd[1368]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=124.248.48.105  user=root
Jun  4 20:17:30 localhost sshd[1368]: Failed password for root from 124.248.48.105 port 33400 ssh2
Jun  4 20:20:36 localhost sshd[1667]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=124.248.48.105  user=root
Jun  4 20:20:39 localhost sshd[1667]: Failed password for root from 124.248.48.105 port 54590 ssh2
Jun  4 20:23:44 localhost sshd[1966]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=124.248.48.105  user=root
Jun  4 20:23:45 localhost sshd[1966]: Failed password for root from 124.248.48.105 port 47528 ssh2
...

$f2bV_matches

Jun  4 22:19:39 serwer sshd\[12538\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.80.168.28  user=root
Jun  4 22:19:41 serwer sshd\[12538\]: Failed password for root from 2.80.168.28 port 43266 ssh2
Jun  4 22:23:31 serwer sshd\[13058\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.80.168.28  user=root
...

Jun  4 22:30:10 eventyay sshd[7472]: Failed password for root from 103.95.41.9 port 34270 ssh2
Jun  4 22:34:08 eventyay sshd[7561]: Failed password for root from 103.95.41.9 port 35839 ssh2
...