May 13 11:26:44 itv-usvr-02 sshd[3609]: Invalid user dovecot1 from 80.211.245.103 port 49144
May 13 11:26:44 itv-usvr-02 sshd[3609]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.245.103
May 13 11:26:44 itv-usvr-02 sshd[3609]: Invalid user dovecot1 from 80.211.245.103 port 49144
May 13 11:26:46 itv-usvr-02 sshd[3609]: Failed password for invalid user dovecot1 from 80.211.245.103 port 49144 ssh2
May 13 11:31:42 itv-usvr-02 sshd[3743]: Invalid user wanda from 80.211.245.103 port 57636

May 11 16:54:24 itv-usvr-01 sshd[13814]: Invalid user admin from 80.211.245.103
May 11 16:54:24 itv-usvr-01 sshd[13814]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.245.103
May 11 16:54:24 itv-usvr-01 sshd[13814]: Invalid user admin from 80.211.245.103
May 11 16:54:26 itv-usvr-01 sshd[13814]: Failed password for invalid user admin from 80.211.245.103 port 58974 ssh2

May  9 01:09:52 gw1 sshd[32236]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.245.103
May  9 01:09:54 gw1 sshd[32236]: Failed password for invalid user sports from 80.211.245.103 port 32946 ssh2
...

$f2bV_matches

SSH bruteforce

2020-05-04T20:22:49.944944shield sshd\[6192\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.245.103  user=root
2020-05-04T20:22:51.559258shield sshd\[6192\]: Failed password for root from 80.211.245.103 port 46180 ssh2
2020-05-04T20:27:37.097174shield sshd\[7614\]: Invalid user johanna from 80.211.245.103 port 55622
2020-05-04T20:27:37.101601shield sshd\[7614\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.245.103
2020-05-04T20:27:39.252972shield sshd\[7614\]: Failed password for invalid user johanna from 80.211.245.103 port 55622 ssh2

Invalid user test from 80.211.245.103 port 36222

Apr 25 16:10:41 pkdns2 sshd\[29223\]: Invalid user ams from 80.211.245.103Apr 25 16:10:43 pkdns2 sshd\[29223\]: Failed password for invalid user ams from 80.211.245.103 port 48518 ssh2Apr 25 16:15:15 pkdns2 sshd\[29423\]: Invalid user qqq from 80.211.245.103Apr 25 16:15:16 pkdns2 sshd\[29423\]: Failed password for invalid user qqq from 80.211.245.103 port 60922 ssh2Apr 25 16:19:47 pkdns2 sshd\[29566\]: Invalid user nice from 80.211.245.103Apr 25 16:19:49 pkdns2 sshd\[29566\]: Failed password for invalid user nice from 80.211.245.103 port 45096 ssh2
...

Apr 13 00:20:03 lock-38 sshd[923328]: Failed password for root from 80.211.245.103 port 40424 ssh2
Apr 13 00:24:23 lock-38 sshd[923511]: Failed password for root from 80.211.245.103 port 38862 ssh2
Apr 13 00:28:30 lock-38 sshd[923680]: Invalid user doku from 80.211.245.103 port 37296
Apr 13 00:28:30 lock-38 sshd[923680]: Invalid user doku from 80.211.245.103 port 37296
Apr 13 00:28:30 lock-38 sshd[923680]: Failed password for invalid user doku from 80.211.245.103 port 37296 ssh2
...

Apr 13 20:08:32 eventyay sshd[3460]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.245.103
Apr 13 20:08:34 eventyay sshd[3460]: Failed password for invalid user castis from 80.211.245.103 port 52480 ssh2
Apr 13 20:13:06 eventyay sshd[3678]: Failed password for root from 80.211.245.103 port 33316 ssh2
...

<6 unauthorized SSH connections

SSH Bruteforce attack

$f2bV_matches

May 25 16:02:35 MainVPS sshd[15808]: Invalid user travel from 80.211.245.129 port 35516
May 25 16:02:35 MainVPS sshd[15808]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.245.129
May 25 16:02:35 MainVPS sshd[15808]: Invalid user travel from 80.211.245.129 port 35516
May 25 16:02:37 MainVPS sshd[15808]: Failed password for invalid user travel from 80.211.245.129 port 35516 ssh2
May 25 16:05:45 MainVPS sshd[18314]: Invalid user cron from 80.211.245.129 port 54362
...

(sshd) Failed SSH login from 80.211.245.223 (PL/Poland/host223-245-211-80.static.arubacloud.pl): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: May  8 17:31:01 amsweb01 sshd[29593]: Invalid user hostmaster from 80.211.245.223 port 47962
May  8 17:31:03 amsweb01 sshd[29593]: Failed password for invalid user hostmaster from 80.211.245.223 port 47962 ssh2
May  8 17:38:01 amsweb01 sshd[30245]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.245.223  user=root
May  8 17:38:03 amsweb01 sshd[30245]: Failed password for root from 80.211.245.223 port 51760 ssh2
May  8 17:43:19 amsweb01 sshd[30973]: Invalid user mongodb from 80.211.245.223 port 34118

2020-05-04T22:55:03.331152amanda2.illicoweb.com sshd\[32731\]: Invalid user maxwell from 80.211.245.223 port 41222
2020-05-04T22:55:03.337637amanda2.illicoweb.com sshd\[32731\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.245.223
2020-05-04T22:55:04.786582amanda2.illicoweb.com sshd\[32731\]: Failed password for invalid user maxwell from 80.211.245.223 port 41222 ssh2
2020-05-04T23:00:36.694948amanda2.illicoweb.com sshd\[32935\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.245.223  user=root
2020-05-04T23:00:38.529731amanda2.illicoweb.com sshd\[32935\]: Failed password for root from 80.211.245.223 port 51922 ssh2
...

21 attempts against mh-ssh on cloud

$f2bV_matches

SSH brute-force: detected 10 distinct usernames within a 24-hour window.

Apr 28 09:09:56 prox sshd[28782]: Failed password for root from 80.211.245.223 port 45552 ssh2
Apr 28 09:20:51 prox sshd[8473]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.245.223

Apr 28 02:14:47 host5 sshd[29320]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.245.129
Apr 28 02:14:47 host5 sshd[29320]: Invalid user nnn from 80.211.245.129 port 40124
Apr 28 02:14:49 host5 sshd[29320]: Failed password for invalid user nnn from 80.211.245.129 port 40124 ssh2
...

2020-04-24T20:52:17.156428Z 088e5c6ac087 New connection: 80.211.245.223:35736 (172.17.0.5:2222) [session: 088e5c6ac087]
2020-04-24T20:57:23.232244Z 15324ed34cb0 New connection: 80.211.245.223:48150 (172.17.0.5:2222) [session: 15324ed34cb0]

Invalid user admin from 80.211.245.223 port 43316

Apr 23 19:45:50 DAAP sshd[24898]: Invalid user zj from 80.211.245.129 port 58328
Apr 23 19:45:50 DAAP sshd[24898]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.245.129
Apr 23 19:45:50 DAAP sshd[24898]: Invalid user zj from 80.211.245.129 port 58328
Apr 23 19:45:52 DAAP sshd[24898]: Failed password for invalid user zj from 80.211.245.129 port 58328 ssh2
Apr 23 19:51:42 DAAP sshd[24978]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.245.129  user=root
Apr 23 19:51:44 DAAP sshd[24978]: Failed password for root from 80.211.245.129 port 44152 ssh2
...

Apr 22 17:33:20 *** sshd[22213]: User root from 80.211.245.223 not allowed because not listed in AllowUsers

$f2bV_matches

SSH Login Bruteforce

(sshd) Failed SSH login from 80.211.245.129 (PL/Poland/host129-245-211-80.static.arubacloud.pl): 10 in the last 3600 secs

Dec  2 15:19:00 pi sshd\[26214\]: Failed password for invalid user daffi from 51.75.124.215 port 54512 ssh2
Dec  2 15:24:44 pi sshd\[26470\]: Invalid user yyyyyyyy from 51.75.124.215 port 38244
Dec  2 15:24:44 pi sshd\[26470\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.124.215
Dec  2 15:24:47 pi sshd\[26470\]: Failed password for invalid user yyyyyyyy from 51.75.124.215 port 38244 ssh2
Dec  2 15:30:26 pi sshd\[26680\]: Invalid user 123 from 51.75.124.215 port 50208
...

Dec  2 14:35:41 relay postfix/smtpd\[27571\]: NOQUEUE: reject: RCPT from unknown\[181.41.216.143\]: 554 5.7.1 \: Relay access denied\; from=\ to=\ proto=ESMTP helo=\<\[181.41.216.131\]\>
Dec  2 14:35:41 relay postfix/smtpd\[27571\]: NOQUEUE: reject: RCPT from unknown\[181.41.216.143\]: 554 5.7.1 \: Relay access denied\; from=\ to=\ proto=ESMTP helo=\<\[181.41.216.131\]\>
Dec  2 14:35:41 relay postfix/smtpd\[27571\]: NOQUEUE: reject: RCPT from unknown\[181.41.216.143\]: 554 5.7.1 \: Relay access denied\; from=\ to=\ proto=ESMTP helo=\<\[181.41.216.131\]\>
Dec  2 14:35:41 relay postfix/smtpd\[27571\]: NOQUEUE: reject: RCPT from unknown\[181.41.216.143\]: 554 5.7.1 \: Relay access denied\; from=\

Dec  2 19:56:57 gw1 sshd[30410]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.201.65.162
Dec  2 19:56:59 gw1 sshd[30410]: Failed password for invalid user guest from 118.201.65.162 port 35465 ssh2
...

Unauthorised access (Dec  2) SRC=186.112.255.214 LEN=52 TOS=0x10 PREC=0x40 TTL=114 ID=8165 DF TCP DPT=445 WINDOW=8192 SYN 
Unauthorised access (Dec  2) SRC=186.112.255.214 LEN=52 TOS=0x10 PREC=0x40 TTL=114 ID=29724 DF TCP DPT=445 WINDOW=8192 SYN

Dec  2 05:18:52 php1 sshd\[11910\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.37.230.141  user=root
Dec  2 05:18:54 php1 sshd\[11910\]: Failed password for root from 54.37.230.141 port 52434 ssh2
Dec  2 05:24:32 php1 sshd\[12417\]: Invalid user tmackenzie from 54.37.230.141
Dec  2 05:24:32 php1 sshd\[12417\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.37.230.141
Dec  2 05:24:34 php1 sshd\[12417\]: Failed password for invalid user tmackenzie from 54.37.230.141 port 35632 ssh2

2019-12-02T13:35:35.256207abusebot-2.cloudsearch.cf sshd\[27373\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.41.86.59  user=lp

Dec  2 16:15:05 server sshd\[4658\]: Invalid user ts from 103.242.200.38
Dec  2 16:15:05 server sshd\[4658\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.242.200.38 
Dec  2 16:15:07 server sshd\[4658\]: Failed password for invalid user ts from 103.242.200.38 port 8981 ssh2
Dec  2 16:35:48 server sshd\[10798\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.242.200.38  user=root
Dec  2 16:35:49 server sshd\[10798\]: Failed password for root from 103.242.200.38 port 49059 ssh2
...

Dec  2 16:16:15 legacy sshd[28000]: Failed password for root from 218.92.0.189 port 57644 ssh2
Dec  2 16:16:17 legacy sshd[28000]: Failed password for root from 218.92.0.189 port 57644 ssh2
Dec  2 16:16:20 legacy sshd[28000]: Failed password for root from 218.92.0.189 port 57644 ssh2
...

Dec  2 15:57:55 MK-Soft-VM7 sshd[16007]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.231.70.170 
Dec  2 15:57:57 MK-Soft-VM7 sshd[16007]: Failed password for invalid user mysql from 103.231.70.170 port 60672 ssh2
...

2019-12-02T15:13:11.368444abusebot-3.cloudsearch.cf sshd\[29259\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.181  user=root

2019-12-02T14:17:09.360595shield sshd\[16882\]: Invalid user cobbe from 106.12.128.24 port 38700
2019-12-02T14:17:09.365231shield sshd\[16882\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.128.24
2019-12-02T14:17:11.192723shield sshd\[16882\]: Failed password for invalid user cobbe from 106.12.128.24 port 38700 ssh2
2019-12-02T14:25:43.105327shield sshd\[18225\]: Invalid user mohsin from 106.12.128.24 port 47514
2019-12-02T14:25:43.109962shield sshd\[18225\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.128.24

Dec  2 04:07:24 sachi sshd\[9078\]: Invalid user costanza from 67.55.92.89
Dec  2 04:07:24 sachi sshd\[9078\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=67.55.92.89
Dec  2 04:07:27 sachi sshd\[9078\]: Failed password for invalid user costanza from 67.55.92.89 port 46188 ssh2
Dec  2 04:13:41 sachi sshd\[9757\]: Invalid user dong from 67.55.92.89
Dec  2 04:13:41 sachi sshd\[9757\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=67.55.92.89

Port 22 Scan, PTR: None

2019-12-02T15:19:24.179027abusebot-4.cloudsearch.cf sshd\[16227\]: Invalid user milldam from 103.51.153.235 port 43004