2020-03-31T09:27:39.617653abusebot-2.cloudsearch.cf sshd[27164]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.red-80-58-155.staticip.rima-tde.net  user=root
2020-03-31T09:27:41.340463abusebot-2.cloudsearch.cf sshd[27164]: Failed password for root from 80.58.155.116 port 59842 ssh2
2020-03-31T09:29:40.600922abusebot-2.cloudsearch.cf sshd[27267]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.red-80-58-155.staticip.rima-tde.net  user=root
2020-03-31T09:29:42.933891abusebot-2.cloudsearch.cf sshd[27267]: Failed password for root from 80.58.155.116 port 60724 ssh2
2020-03-31T09:30:47.803608abusebot-2.cloudsearch.cf sshd[27328]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.red-80-58-155.staticip.rima-tde.net  user=root
2020-03-31T09:30:49.665298abusebot-2.cloudsearch.cf sshd[27328]: Failed password for root from 80.58.155.116 port 49934 ssh2
2020-03-31T09
...

Dec 20 00:23:42 marvibiene sshd[10994]: Invalid user tiffany from 80.58.157.231 port 18850
Dec 20 00:23:42 marvibiene sshd[10994]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.58.157.231
Dec 20 00:23:42 marvibiene sshd[10994]: Invalid user tiffany from 80.58.157.231 port 18850
Dec 20 00:23:44 marvibiene sshd[10994]: Failed password for invalid user tiffany from 80.58.157.231 port 18850 ssh2
...

Dec 17 08:59:06 php1 sshd\[31238\]: Invalid user Password67 from 80.58.157.231
Dec 17 08:59:06 php1 sshd\[31238\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=231.red-80-58-157.staticip.rima-tde.net
Dec 17 08:59:09 php1 sshd\[31238\]: Failed password for invalid user Password67 from 80.58.157.231 port 46675 ssh2
Dec 17 09:04:12 php1 sshd\[31981\]: Invalid user elichi from 80.58.157.231
Dec 17 09:04:12 php1 sshd\[31981\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=231.red-80-58-157.staticip.rima-tde.net

Dec 14 18:43:21 localhost sshd\[74675\]: Invalid user appltest from 80.58.157.231 port 14877
Dec 14 18:43:21 localhost sshd\[74675\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.58.157.231
Dec 14 18:43:23 localhost sshd\[74675\]: Failed password for invalid user appltest from 80.58.157.231 port 14877 ssh2
Dec 14 18:48:36 localhost sshd\[74811\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.58.157.231  user=root
Dec 14 18:48:38 localhost sshd\[74811\]: Failed password for root from 80.58.157.231 port 21701 ssh2
...

Dec 14 00:56:38 mail sshd\[5060\]: Invalid user bmedina from 80.58.157.231
Dec 14 00:56:38 mail sshd\[5060\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.58.157.231
Dec 14 00:56:40 mail sshd\[5060\]: Failed password for invalid user bmedina from 80.58.157.231 port 45192 ssh2
...

Dec 13 08:37:46 v22018086721571380 sshd[27409]: Failed password for invalid user atai from 80.58.157.231 port 32691 ssh2

Nov  1 19:08:58 auw2 sshd\[29393\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=231.red-80-58-157.staticip.rima-tde.net  user=root
Nov  1 19:08:59 auw2 sshd\[29393\]: Failed password for root from 80.58.157.231 port 48642 ssh2
Nov  1 19:13:06 auw2 sshd\[29843\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=231.red-80-58-157.staticip.rima-tde.net  user=root
Nov  1 19:13:08 auw2 sshd\[29843\]: Failed password for root from 80.58.157.231 port 40037 ssh2
Nov  1 19:17:09 auw2 sshd\[30179\]: Invalid user in from 80.58.157.231

Oct 28 16:29:26 server sshd\[19607\]: User root from 80.58.157.231 not allowed because listed in DenyUsers
Oct 28 16:29:26 server sshd\[19607\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.58.157.231  user=root
Oct 28 16:29:28 server sshd\[19607\]: Failed password for invalid user root from 80.58.157.231 port 37977 ssh2
Oct 28 16:33:34 server sshd\[27893\]: User root from 80.58.157.231 not allowed because listed in DenyUsers
Oct 28 16:33:34 server sshd\[27893\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.58.157.231  user=root

Oct 24 12:46:37 game-panel sshd[524]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.58.157.231
Oct 24 12:46:39 game-panel sshd[524]: Failed password for invalid user drive from 80.58.157.231 port 22890 ssh2
Oct 24 12:50:34 game-panel sshd[670]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.58.157.231

Oct 23 21:05:11 localhost sshd\[11485\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.58.157.231  user=root
Oct 23 21:05:14 localhost sshd\[11485\]: Failed password for root from 80.58.157.231 port 30468 ssh2
Oct 23 21:09:33 localhost sshd\[11888\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.58.157.231  user=root

Oct 22 01:54:14 auw2 sshd\[30861\]: Invalid user cloudtest from 80.58.157.231
Oct 22 01:54:14 auw2 sshd\[30861\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=231.red-80-58-157.staticip.rima-tde.net
Oct 22 01:54:17 auw2 sshd\[30861\]: Failed password for invalid user cloudtest from 80.58.157.231 port 46138 ssh2
Oct 22 01:58:15 auw2 sshd\[31206\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=231.red-80-58-157.staticip.rima-tde.net  user=root
Oct 22 01:58:17 auw2 sshd\[31206\]: Failed password for root from 80.58.157.231 port 36095 ssh2

$f2bV_matches

2019-10-09T21:38:37.732250shield sshd\[26782\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=231.red-80-58-157.staticip.rima-tde.net  user=root
2019-10-09T21:38:39.613910shield sshd\[26782\]: Failed password for root from 80.58.157.231 port 31518 ssh2
2019-10-09T21:42:47.065854shield sshd\[27230\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=231.red-80-58-157.staticip.rima-tde.net  user=root
2019-10-09T21:42:49.604476shield sshd\[27230\]: Failed password for root from 80.58.157.231 port 21484 ssh2
2019-10-09T21:46:48.574308shield sshd\[27640\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=231.red-80-58-157.staticip.rima-tde.net  user=root

Oct  5 05:56:51 web9 sshd\[8517\]: Invalid user !q@w\#e\$r from 80.58.157.231
Oct  5 05:56:51 web9 sshd\[8517\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.58.157.231
Oct  5 05:56:53 web9 sshd\[8517\]: Failed password for invalid user !q@w\#e\$r from 80.58.157.231 port 11045 ssh2
Oct  5 06:01:15 web9 sshd\[9120\]: Invalid user Lion1@3 from 80.58.157.231
Oct  5 06:01:15 web9 sshd\[9120\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.58.157.231

Sep 29 14:24:36 lcprod sshd\[18487\]: Invalid user yb from 80.58.157.231
Sep 29 14:24:36 lcprod sshd\[18487\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=231.red-80-58-157.staticip.rima-tde.net
Sep 29 14:24:38 lcprod sshd\[18487\]: Failed password for invalid user yb from 80.58.157.231 port 32168 ssh2
Sep 29 14:28:42 lcprod sshd\[18855\]: Invalid user admin from 80.58.157.231
Sep 29 14:28:42 lcprod sshd\[18855\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=231.red-80-58-157.staticip.rima-tde.net

Nov 24 23:07:56 vpn01 sshd[29587]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.226.250.69
Nov 24 23:07:58 vpn01 sshd[29587]: Failed password for invalid user single from 188.226.250.69 port 60826 ssh2
...

Fail2Ban Ban Triggered

2019-11-24 15:43:10 1iYt6T-00052l-Gd SMTP connection from \(\[103.110.169.62\]\) \[103.110.169.62\]:25097 I=\[193.107.90.29\]:25 closed by DROP in ACL
2019-11-24 15:43:27 1iYt6j-000538-AG SMTP connection from \(\[103.110.169.62\]\) \[103.110.169.62\]:25197 I=\[193.107.90.29\]:25 closed by DROP in ACL
2019-11-24 15:43:38 1iYt6v-00053F-3w SMTP connection from \(\[103.110.169.62\]\) \[103.110.169.62\]:25283 I=\[193.107.90.29\]:25 closed by DROP in ACL
...

Nov 25 00:10:46 minden010 sshd[17811]: Failed password for root from 222.186.169.192 port 24994 ssh2
Nov 25 00:10:49 minden010 sshd[17811]: Failed password for root from 222.186.169.192 port 24994 ssh2
Nov 25 00:10:53 minden010 sshd[17811]: Failed password for root from 222.186.169.192 port 24994 ssh2
Nov 25 00:11:00 minden010 sshd[17811]: error: maximum authentication attempts exceeded for root from 222.186.169.192 port 24994 ssh2 [preauth]
...

port scan and connect, tcp 23 (telnet)

Nov 25 00:10:42 h2177944 sshd\[20079\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.175.140  user=root
Nov 25 00:10:45 h2177944 sshd\[20079\]: Failed password for root from 222.186.175.140 port 62182 ssh2
Nov 25 00:10:48 h2177944 sshd\[20079\]: Failed password for root from 222.186.175.140 port 62182 ssh2
Nov 25 00:10:52 h2177944 sshd\[20079\]: Failed password for root from 222.186.175.140 port 62182 ssh2
...

Nov 25 04:01:13 gw1 sshd[27885]: Failed password for root from 222.186.175.154 port 19458 ssh2
Nov 25 04:01:25 gw1 sshd[27885]: error: maximum authentication attempts exceeded for root from 222.186.175.154 port 19458 ssh2 [preauth]
...

2019-11-24T16:52:16.741514abusebot-5.cloudsearch.cf sshd\[18305\]: Invalid user tester1 from 123.234.219.226 port 16462

Nov 24 19:58:44 firewall sshd[3320]: Failed password for root from 49.88.112.76 port 25698 ssh2
Nov 24 19:59:15 firewall sshd[3349]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.88.112.76  user=root
Nov 24 19:59:17 firewall sshd[3349]: Failed password for root from 49.88.112.76 port 15395 ssh2
...

Nov 24 23:59:27 mout sshd[23330]: Invalid user rpm from 69.85.70.44 port 43482

Nov 24 04:34:37 php1 sshd\[2894\]: Invalid user martin from 119.29.62.104
Nov 24 04:34:37 php1 sshd\[2894\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.29.62.104
Nov 24 04:34:39 php1 sshd\[2894\]: Failed password for invalid user martin from 119.29.62.104 port 47994 ssh2
Nov 24 04:43:29 php1 sshd\[3824\]: Invalid user yorozu from 119.29.62.104
Nov 24 04:43:29 php1 sshd\[3824\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.29.62.104

port scan and connect, tcp 23 (telnet)

Nov 24 12:52:22 kapalua sshd\[24739\]: Invalid user lepreau from 152.136.170.148
Nov 24 12:52:22 kapalua sshd\[24739\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.136.170.148
Nov 24 12:52:24 kapalua sshd\[24739\]: Failed password for invalid user lepreau from 152.136.170.148 port 41428 ssh2
Nov 24 12:59:20 kapalua sshd\[25457\]: Invalid user great from 152.136.170.148
Nov 24 12:59:20 kapalua sshd\[25457\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.136.170.148

Nov 24 17:56:59 xentho sshd[7178]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.88.112.71  user=root
Nov 24 17:57:01 xentho sshd[7178]: Failed password for root from 49.88.112.71 port 22055 ssh2
Nov 24 17:57:03 xentho sshd[7178]: Failed password for root from 49.88.112.71 port 22055 ssh2
Nov 24 17:56:59 xentho sshd[7178]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.88.112.71  user=root
Nov 24 17:57:01 xentho sshd[7178]: Failed password for root from 49.88.112.71 port 22055 ssh2
Nov 24 17:57:03 xentho sshd[7178]: Failed password for root from 49.88.112.71 port 22055 ssh2
Nov 24 17:56:59 xentho sshd[7178]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.88.112.71  user=root
Nov 24 17:57:01 xentho sshd[7178]: Failed password for root from 49.88.112.71 port 22055 ssh2
Nov 24 17:57:03 xentho sshd[7178]: Failed password for root from 49.88.112.71 port 22055 
...

Nov 24 22:53:14 localhost sshd\[53922\]: Invalid user rstudio from 51.255.174.164 port 48036
Nov 24 22:53:14 localhost sshd\[53922\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.255.174.164
Nov 24 22:53:17 localhost sshd\[53922\]: Failed password for invalid user rstudio from 51.255.174.164 port 48036 ssh2
Nov 24 22:59:05 localhost sshd\[54061\]: Invalid user pcap from 51.255.174.164 port 55890
Nov 24 22:59:05 localhost sshd\[54061\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.255.174.164
...