Jun 14 22:02:51 server2 sshd\[12063\]: Invalid user admin from 85.239.35.161
Jun 14 22:02:51 server2 sshd\[12067\]: Invalid user  from 85.239.35.161
Jun 14 22:02:52 server2 sshd\[12070\]: Invalid user  from 85.239.35.161
Jun 14 22:02:52 server2 sshd\[12064\]: Invalid user admin from 85.239.35.161
Jun 14 22:02:52 server2 sshd\[12065\]: Invalid user  from 85.239.35.161
Jun 14 22:02:52 server2 sshd\[12066\]: Invalid user admin from 85.239.35.161

Jun 14 14:56:28 server2 sshd\[13173\]: Invalid user admin from 85.239.35.161
Jun 14 14:56:28 server2 sshd\[13161\]: Invalid user admin from 85.239.35.161
Jun 14 14:56:28 server2 sshd\[13163\]: Invalid user user from 85.239.35.161
Jun 14 14:56:28 server2 sshd\[13164\]: Invalid user user from 85.239.35.161
Jun 14 14:56:28 server2 sshd\[13160\]: Invalid user admin from 85.239.35.161
Jun 14 14:56:29 server2 sshd\[13162\]: Invalid user user from 85.239.35.161

Jun 13 08:47:57 server2 sshd\[21007\]: Invalid user admin from 85.239.35.161
Jun 13 08:47:59 server2 sshd\[21004\]: Invalid user  from 85.239.35.161
Jun 13 08:47:59 server2 sshd\[21006\]: Invalid user admin from 85.239.35.161
Jun 13 08:48:00 server2 sshd\[21012\]: Invalid user  from 85.239.35.161
Jun 13 08:48:00 server2 sshd\[21013\]: Invalid user admin from 85.239.35.161
Jun 13 08:48:01 server2 sshd\[21005\]: Invalid user  from 85.239.35.161

(sshd) Failed SSH login from 85.239.35.161 (RU/Russia/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Jun  8 12:12:41 amsweb01 sshd[7105]: Did not receive identification string from 85.239.35.161 port 40650
Jun  8 12:12:41 amsweb01 sshd[7104]: Did not receive identification string from 85.239.35.161 port 59750
Jun  8 12:12:55 amsweb01 sshd[7107]: Invalid user user from 85.239.35.161 port 40604
Jun  8 12:12:55 amsweb01 sshd[7106]: Invalid user user from 85.239.35.161 port 59738
Jun  8 12:12:57 amsweb01 sshd[7109]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.239.35.161  user=root

Jun  7 19:23:49 server2 sshd\[5795\]: Invalid user  from 85.239.35.161
Jun  7 19:23:50 server2 sshd\[5794\]: Invalid user  from 85.239.35.161
Jun  7 19:23:55 server2 sshd\[5798\]: Invalid user  from 85.239.35.161
Jun  7 19:23:55 server2 sshd\[5799\]: Invalid user admin from 85.239.35.161
Jun  7 19:23:57 server2 sshd\[5817\]: Invalid user user from 85.239.35.161
Jun  7 19:23:58 server2 sshd\[5797\]: Invalid user admin from 85.239.35.161

 TCP (SYN) 85.239.35.161:55764 -> port 1080, len 60

(sshd) Failed SSH login from 85.239.35.161 (RU/Russia/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Jun  5 00:48:47 amsweb01 sshd[31520]: Did not receive identification string from 85.239.35.161 port 53942
Jun  5 00:48:47 amsweb01 sshd[31519]: Did not receive identification string from 85.239.35.161 port 34832
Jun  5 00:48:57 amsweb01 sshd[31527]: Invalid user user from 85.239.35.161 port 36194
Jun  5 00:48:58 amsweb01 sshd[31521]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.239.35.161  user=admin
Jun  5 00:48:59 amsweb01 sshd[31522]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.239.35.161  user=admin

May 26 16:47:19 server2 sshd\[4560\]: Invalid user admin from 85.239.35.161
May 26 16:47:19 server2 sshd\[4559\]: Invalid user admin from 85.239.35.161
May 26 16:47:21 server2 sshd\[4564\]: Invalid user user from 85.239.35.161
May 26 16:47:21 server2 sshd\[4561\]: Invalid user admin from 85.239.35.161
May 26 16:47:21 server2 sshd\[4563\]: Invalid user user from 85.239.35.161
May 26 16:47:21 server2 sshd\[4562\]: Invalid user user from 85.239.35.161

May 25 15:54:23 server2 sshd\[5008\]: User root from 85.239.35.161 not allowed because not listed in AllowUsers
May 25 15:54:23 server2 sshd\[5010\]: User root from 85.239.35.161 not allowed because not listed in AllowUsers
May 25 15:54:25 server2 sshd\[5012\]: User root from 85.239.35.161 not allowed because not listed in AllowUsers
May 25 15:54:25 server2 sshd\[5009\]: Invalid user support from 85.239.35.161
May 25 15:54:25 server2 sshd\[5011\]: Invalid user support from 85.239.35.161
May 25 15:54:25 server2 sshd\[5017\]: Invalid user support from 85.239.35.161

May 24 11:04:35 server2 sshd\[20064\]: Invalid user  from 85.239.35.161
May 24 11:04:35 server2 sshd\[20066\]: Invalid user  from 85.239.35.161
May 24 11:04:44 server2 sshd\[20072\]: Invalid user admin from 85.239.35.161
May 24 11:04:45 server2 sshd\[20068\]: Invalid user  from 85.239.35.161
May 24 11:04:48 server2 sshd\[20073\]: Invalid user admin from 85.239.35.161
May 24 11:04:49 server2 sshd\[20076\]: Invalid user user from 85.239.35.161

May 23 18:10:52 server2 sshd\[17741\]: Invalid user user from 85.239.35.161
May 23 18:10:52 server2 sshd\[17743\]: Invalid user user from 85.239.35.161
May 23 18:10:53 server2 sshd\[17742\]: Invalid user user from 85.239.35.161
May 23 18:10:54 server2 sshd\[17747\]: User root from 85.239.35.161 not allowed because not listed in AllowUsers
May 23 18:10:55 server2 sshd\[17745\]: User root from 85.239.35.161 not allowed because not listed in AllowUsers
May 23 18:10:56 server2 sshd\[17744\]: User root from 85.239.35.161 not allowed because not listed in AllowUsers

May 22 20:56:40 server2 sshd\[3019\]: Invalid user user from 85.239.35.161
May 22 20:56:41 server2 sshd\[3023\]: User root from 85.239.35.161 not allowed because not listed in AllowUsers
May 22 20:56:44 server2 sshd\[3025\]: User root from 85.239.35.161 not allowed because not listed in AllowUsers
May 22 20:56:44 server2 sshd\[3022\]: Invalid user user from 85.239.35.161
May 22 20:56:44 server2 sshd\[3024\]: User root from 85.239.35.161 not allowed because not listed in AllowUsers
May 22 20:56:44 server2 sshd\[3021\]: Invalid user user from 85.239.35.161

May 21 13:20:23 server2 sshd\[5952\]: Invalid user user from 85.239.35.161
May 21 13:20:23 server2 sshd\[5951\]: User root from 85.239.35.161 not allowed because not listed in AllowUsers
May 21 13:20:25 server2 sshd\[5966\]: Invalid user user from 85.239.35.161
May 21 13:20:25 server2 sshd\[5954\]: User root from 85.239.35.161 not allowed because not listed in AllowUsers
May 21 13:20:26 server2 sshd\[5953\]: User root from 85.239.35.161 not allowed because not listed in AllowUsers
May 21 13:20:28 server2 sshd\[5949\]: Invalid user user from 85.239.35.161

May 21 00:14:32 server2 sshd\[23352\]: Invalid user user from 85.239.35.161
May 21 00:14:34 server2 sshd\[23357\]: Invalid user admin from 85.239.35.161
May 21 00:14:35 server2 sshd\[23353\]: Invalid user admin from 85.239.35.161
May 21 00:14:35 server2 sshd\[23356\]: Invalid user user from 85.239.35.161
May 21 00:14:36 server2 sshd\[23355\]: Invalid user user from 85.239.35.161
May 21 00:14:39 server2 sshd\[23354\]: Invalid user admin from 85.239.35.161

May 15 23:56:55 dns1 sshd[23416]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.239.35.161 
May 15 23:56:57 dns1 sshd[23416]: Failed password for invalid user support from 85.239.35.161 port 56520 ssh2
May 15 23:56:57 dns1 sshd[23417]: Failed password for root from 85.239.35.161 port 55926 ssh2

May 14 08:13:59 server2 sshd\[20544\]: User root from 85.239.35.161 not allowed because not listed in AllowUsers
May 14 08:13:59 server2 sshd\[20549\]: Invalid user support from 85.239.35.161
May 14 08:13:59 server2 sshd\[20545\]: User root from 85.239.35.161 not allowed because not listed in AllowUsers
May 14 08:14:00 server2 sshd\[20547\]: Invalid user support from 85.239.35.161
May 14 08:14:02 server2 sshd\[20548\]: Invalid user support from 85.239.35.161
May 14 08:14:02 server2 sshd\[20546\]: User root from 85.239.35.161 not allowed because not listed in AllowUsers

May 14 03:17:33 server2 sshd\[6480\]: Invalid user  from 85.239.35.161
May 14 03:17:34 server2 sshd\[6479\]: Invalid user  from 85.239.35.161
May 14 03:17:34 server2 sshd\[6481\]: Invalid user admin from 85.239.35.161
May 14 03:17:34 server2 sshd\[6478\]: Invalid user  from 85.239.35.161
May 14 03:17:34 server2 sshd\[6483\]: Invalid user admin from 85.239.35.161
May 14 03:17:35 server2 sshd\[6482\]: Invalid user admin from 85.239.35.161

May 10 21:37:24 dns1 sshd[27245]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.239.35.161 
May 10 21:37:24 dns1 sshd[27246]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.239.35.161 
May 10 21:37:26 dns1 sshd[27245]: Failed password for invalid user user from 85.239.35.161 port 8368 ssh2

May 10 20:19:25 server2 sshd\[11188\]: Invalid user support from 85.239.35.161
May 10 20:19:25 server2 sshd\[11189\]: Invalid user support from 85.239.35.161
May 10 20:19:26 server2 sshd\[11195\]: Invalid user support from 85.239.35.161
May 10 20:19:27 server2 sshd\[11186\]: User root from 85.239.35.161 not allowed because not listed in AllowUsers
May 10 20:19:27 server2 sshd\[11187\]: User root from 85.239.35.161 not allowed because not listed in AllowUsers
May 10 20:19:28 server2 sshd\[11190\]: User root from 85.239.35.161 not allowed because not listed in AllowUsers

May 10 08:00:01 dns1 sshd[23603]: Failed none for invalid user  from 85.239.35.161 port 4164 ssh2
May 10 08:00:01 dns1 sshd[23604]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.239.35.161 
May 10 08:00:02 dns1 sshd[23604]: Failed password for invalid user admin from 85.239.35.161 port 4174 ssh2

May  9 04:58:12 srv206 sshd[17073]: Invalid user admin from 85.239.35.161
...

May  8 23:21:01 srv206 sshd[15341]: Invalid user support from 85.239.35.161
May  8 23:21:01 srv206 sshd[15340]: Invalid user user from 85.239.35.161
...

2020-05-08T16:16:58.421555abusebot-8.cloudsearch.cf sshd[5378]: Invalid user support from 85.239.35.161 port 40394
2020-05-08T16:16:58.842719abusebot-8.cloudsearch.cf sshd[5380]: Invalid user user from 85.239.35.161 port 40226
2020-05-08T16:17:02.264625abusebot-8.cloudsearch.cf sshd[5379]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.239.35.161  user=root
2020-05-08T16:17:03.899088abusebot-8.cloudsearch.cf sshd[5379]: Failed password for root from 85.239.35.161 port 40388 ssh2
2020-05-08T16:17:02.426891abusebot-8.cloudsearch.cf sshd[5380]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.239.35.161
2020-05-08T16:16:58.842719abusebot-8.cloudsearch.cf sshd[5380]: Invalid user user from 85.239.35.161 port 40226
2020-05-08T16:17:04.061250abusebot-8.cloudsearch.cf sshd[5380]: Failed password for invalid user user from 85.239.35.161 port 40226 ssh2
...

May  8 06:26:06 vps639187 sshd\[3606\]: Invalid user  from 85.239.35.161 port 42306
May  8 06:26:06 vps639187 sshd\[3606\]: Failed none for invalid user  from 85.239.35.161 port 42306 ssh2
May  8 06:26:07 vps639187 sshd\[3607\]: Invalid user admin from 85.239.35.161 port 56462
...

May  7 20:49:45 game-panel sshd[13359]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.239.35.161
May  7 20:49:47 game-panel sshd[13359]: Failed password for invalid user user from 85.239.35.161 port 8070 ssh2
May  7 20:49:47 game-panel sshd[13360]: Failed password for root from 85.239.35.161 port 9704 ssh2

Blocked by fail2ban.

2020-05-07T12:55:09.259777vps751288.ovh.net sshd\[3413\]: Invalid user support from 85.239.35.161 port 61296
2020-05-07T12:55:10.511314vps751288.ovh.net sshd\[3412\]: Invalid user 0101 from 85.239.35.161 port 61306
2020-05-07T12:55:10.877396vps751288.ovh.net sshd\[3413\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.239.35.161
2020-05-07T12:55:11.058085vps751288.ovh.net sshd\[3411\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.239.35.161  user=root
2020-05-07T12:55:11.841699vps751288.ovh.net sshd\[3412\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.239.35.161

May  6 19:18:27 debian64 sshd[31763]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.239.35.161 
...

Unauthorized connection attempt detected from IP address 85.239.35.161 to port 22 [T]

Oct  9 19:25:10 vps sshd[29606]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.239.35.130 
Oct  9 19:25:13 vps sshd[29606]: Failed password for invalid user support from 85.239.35.130 port 53110 ssh2
Oct  9 19:25:13 vps sshd[29605]: Failed password for root from 85.239.35.130 port 53072 ssh2
...

Bruteforce detected by fail2ban

Oct  8 20:44:32 scw-tender-jepsen sshd[29629]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.239.35.130

Cowrie Honeypot: Unauthorised SSH/Telnet login attempt with user "root" at 2020-10-08T12:35:20Z

Cowrie Honeypot: Unauthorised SSH/Telnet login attempt with user "root" at 2020-10-08T04:58:08Z

Oct  7 18:59:33 vm2 sshd[14263]: Failed password for invalid user admin from 85.239.35.130 port 63344 ssh2
Oct  7 18:59:33 vm2 sshd[14267]: Failed password for invalid user user from 85.239.35.130 port 31508 ssh2
Oct  8 02:23:28 vm2 sshd[4261]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.239.35.130
...

Cowrie Honeypot: Unauthorised SSH/Telnet login attempt with user "root" at 2020-10-04T18:21:52Z

Oct  4 10:08:22 game-panel sshd[29770]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.239.35.130
Oct  4 10:08:24 game-panel sshd[29770]: Failed password for invalid user user from 85.239.35.130 port 7390 ssh2
Oct  4 10:08:24 game-panel sshd[29769]: Failed password for root from 85.239.35.130 port 7392 ssh2

Fail2Ban Ban Triggered (2)

2020-10-01T07:03:21.207952abusebot-4.cloudsearch.cf sshd[18259]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.239.35.18  user=root
2020-10-01T07:03:22.931084abusebot-4.cloudsearch.cf sshd[18259]: Failed password for root from 85.239.35.18 port 43064 ssh2
2020-10-01T07:08:08.522313abusebot-4.cloudsearch.cf sshd[18362]: Invalid user guest from 85.239.35.18 port 52306
2020-10-01T07:08:08.530143abusebot-4.cloudsearch.cf sshd[18362]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.239.35.18
2020-10-01T07:08:08.522313abusebot-4.cloudsearch.cf sshd[18362]: Invalid user guest from 85.239.35.18 port 52306
2020-10-01T07:08:10.985885abusebot-4.cloudsearch.cf sshd[18362]: Failed password for invalid user guest from 85.239.35.18 port 52306 ssh2
2020-10-01T07:12:45.675716abusebot-4.cloudsearch.cf sshd[18407]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.239.35.18  us
...

Sep 29 21:50:20 vps639187 sshd\[2856\]: Invalid user  from 85.239.35.130 port 48490
Sep 29 21:50:20 vps639187 sshd\[2857\]: Invalid user admin from 85.239.35.130 port 48504
Sep 29 21:50:20 vps639187 sshd\[2857\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.239.35.130
Sep 29 21:50:20 vps639187 sshd\[2856\]: Failed none for invalid user  from 85.239.35.130 port 48490 ssh2
Sep 29 21:50:20 vps639187 sshd\[2860\]: Invalid user user from 85.239.35.130 port 52042
Sep 29 21:50:20 vps639187 sshd\[2860\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.239.35.130
...

Sep 29 13:59:21 s2 sshd[11395]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.239.35.130 
Sep 29 13:59:23 s2 sshd[11395]: Failed password for invalid user support from 85.239.35.130 port 37006 ssh2
Sep 29 13:59:23 s2 sshd[11394]: Failed password for root from 85.239.35.130 port 36946 ssh2

Sep 29 04:08:48 scw-6657dc sshd[21417]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.239.35.130
Sep 29 04:08:48 scw-6657dc sshd[21417]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.239.35.130
Sep 29 04:08:51 scw-6657dc sshd[21417]: Failed password for invalid user admin from 85.239.35.130 port 1866 ssh2
...

Cowrie Honeypot: Unauthorised SSH/Telnet login attempt with user "user" at 2020-09-27T20:21:03Z

 TCP (SYN) 85.239.35.130:15348 -> port 22, len 60

Jun 13 07:08:10 eventyay sshd[20723]: Failed password for root from 222.186.42.155 port 22684 ssh2
Jun 13 07:08:13 eventyay sshd[20723]: Failed password for root from 222.186.42.155 port 22684 ssh2
Jun 13 07:08:15 eventyay sshd[20723]: Failed password for root from 222.186.42.155 port 22684 ssh2
...

Jun 12 18:45:01 web1 sshd\[27448\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.232.175.244  user=root
Jun 12 18:45:02 web1 sshd\[27448\]: Failed password for root from 49.232.175.244 port 40144 ssh2
Jun 12 18:49:32 web1 sshd\[27862\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.232.175.244  user=root
Jun 12 18:49:34 web1 sshd\[27862\]: Failed password for root from 49.232.175.244 port 34608 ssh2
Jun 12 18:53:55 web1 sshd\[28262\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.232.175.244  user=root

SMB Server BruteForce Attack

2020-06-13 00:37:12,065 fail2ban.actions        [937]: NOTICE  [sshd] Ban 222.186.15.115
2020-06-13 01:31:23,574 fail2ban.actions        [937]: NOTICE  [sshd] Ban 222.186.15.115
2020-06-13 04:23:51,863 fail2ban.actions        [937]: NOTICE  [sshd] Ban 222.186.15.115
2020-06-13 05:57:31,338 fail2ban.actions        [937]: NOTICE  [sshd] Ban 222.186.15.115
2020-06-13 07:01:55,953 fail2ban.actions        [937]: NOTICE  [sshd] Ban 222.186.15.115
...

Invalid user id from 217.133.58.148 port 47580

TCP port : 50030

Jun 13 07:05:06 abendstille sshd\[16314\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.165  user=root
Jun 13 07:05:08 abendstille sshd\[16320\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.165  user=root
Jun 13 07:05:08 abendstille sshd\[16314\]: Failed password for root from 218.92.0.165 port 11453 ssh2
Jun 13 07:05:09 abendstille sshd\[16320\]: Failed password for root from 218.92.0.165 port 52933 ssh2
Jun 13 07:05:11 abendstille sshd\[16314\]: Failed password for root from 218.92.0.165 port 11453 ssh2
...

Jun 13 07:36:16 srv01 postfix/smtpd\[23676\]: warning: unknown\[46.38.145.250\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jun 13 07:36:23 srv01 postfix/smtpd\[2158\]: warning: unknown\[46.38.145.250\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jun 13 07:36:57 srv01 postfix/smtpd\[4583\]: warning: unknown\[46.38.145.250\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jun 13 07:37:29 srv01 postfix/smtpd\[2158\]: warning: unknown\[46.38.145.250\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jun 13 07:37:49 srv01 postfix/smtpd\[4583\]: warning: unknown\[46.38.145.250\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
...

Jun 13 07:13:05 minden010 sshd[9030]: Failed password for root from 222.186.175.169 port 49212 ssh2
Jun 13 07:13:16 minden010 sshd[9030]: Failed password for root from 222.186.175.169 port 49212 ssh2
Jun 13 07:13:19 minden010 sshd[9030]: Failed password for root from 222.186.175.169 port 49212 ssh2
Jun 13 07:13:19 minden010 sshd[9030]: error: maximum authentication attempts exceeded for root from 222.186.175.169 port 49212 ssh2 [preauth]
...

TCP port : 30243

Jun 12 18:36:51 web1 sshd\[26482\]: Invalid user ftpusr from 162.62.29.207
Jun 12 18:36:51 web1 sshd\[26482\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.62.29.207
Jun 12 18:36:53 web1 sshd\[26482\]: Failed password for invalid user ftpusr from 162.62.29.207 port 55474 ssh2
Jun 12 18:42:00 web1 sshd\[27170\]: Invalid user jira from 162.62.29.207
Jun 12 18:42:00 web1 sshd\[27170\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.62.29.207

Jun 13 06:10:51 sso sshd[20841]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.170.254.146
Jun 13 06:10:53 sso sshd[20841]: Failed password for invalid user nvd from 107.170.254.146 port 58802 ssh2
...

$f2bV_matches

Cowrie Honeypot: 10 unauthorised SSH/Telnet login attempts between 2020-06-13T04:01:38Z and 2020-06-13T04:10:56Z

Jun 13 06:10:33 serwer sshd\[24705\]: Invalid user maildev from 119.18.194.168 port 53854
Jun 13 06:10:33 serwer sshd\[24705\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.18.194.168
Jun 13 06:10:35 serwer sshd\[24705\]: Failed password for invalid user maildev from 119.18.194.168 port 53854 ssh2
...