May  2 18:54:37 ns382633 sshd\[22890\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.109.56  user=root
May  2 18:54:39 ns382633 sshd\[22890\]: Failed password for root from 91.121.109.56 port 57218 ssh2
May  2 19:10:30 ns382633 sshd\[26471\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.109.56  user=root
May  2 19:10:32 ns382633 sshd\[26471\]: Failed password for root from 91.121.109.56 port 32836 ssh2
May  2 19:14:22 ns382633 sshd\[26925\]: Invalid user mode from 91.121.109.56 port 44142
May  2 19:14:22 ns382633 sshd\[26925\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.109.56

May  2 00:17:16 lanister sshd[24894]: Invalid user action from 91.121.109.56
May  2 00:17:16 lanister sshd[24894]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.109.56
May  2 00:17:16 lanister sshd[24894]: Invalid user action from 91.121.109.56
May  2 00:17:18 lanister sshd[24894]: Failed password for invalid user action from 91.121.109.56 port 53900 ssh2

SSH login attempts.

Apr 24 16:56:57 localhost sshd[121220]: Invalid user discover from 91.121.109.56 port 57574
Apr 24 16:56:57 localhost sshd[121220]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=ns348809.ip-91-121-109.eu
Apr 24 16:56:57 localhost sshd[121220]: Invalid user discover from 91.121.109.56 port 57574
Apr 24 16:56:59 localhost sshd[121220]: Failed password for invalid user discover from 91.121.109.56 port 57574 ssh2
Apr 24 17:01:07 localhost sshd[121849]: Invalid user vc from 91.121.109.56 port 46184
...

Invalid user je from 91.121.109.56 port 46180

Apr 19 06:38:28 plex sshd[9440]: Invalid user ubuntu from 91.121.109.56 port 41024

Invalid user user from 91.121.109.56 port 55822

Jul 10 05:35:04 mockhub sshd[7933]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.109.45
Jul 10 05:35:07 mockhub sshd[7933]: Failed password for invalid user acer from 91.121.109.45 port 34974 ssh2
...

Jul 10 08:29:39 ns382633 sshd\[23524\]: Invalid user liangzheming from 91.121.109.45 port 34854
Jul 10 08:29:39 ns382633 sshd\[23524\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.109.45
Jul 10 08:29:41 ns382633 sshd\[23524\]: Failed password for invalid user liangzheming from 91.121.109.45 port 34854 ssh2
Jul 10 08:43:59 ns382633 sshd\[26228\]: Invalid user clint from 91.121.109.45 port 59488
Jul 10 08:43:59 ns382633 sshd\[26228\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.109.45

Fail2Ban Ban Triggered (2)

Jun 27 18:58:53 dev0-dcde-rnet sshd[30819]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.109.45
Jun 27 18:58:55 dev0-dcde-rnet sshd[30819]: Failed password for invalid user hsk from 91.121.109.45 port 44369 ssh2
Jun 27 19:02:01 dev0-dcde-rnet sshd[30837]: Failed password for root from 91.121.109.45 port 43697 ssh2

Jun 17 23:55:35 Tower sshd[29092]: Connection from 91.121.109.45 port 43446 on 192.168.10.220 port 22 rdomain ""
Jun 17 23:55:36 Tower sshd[29092]: Failed password for root from 91.121.109.45 port 43446 ssh2
Jun 17 23:55:36 Tower sshd[29092]: Received disconnect from 91.121.109.45 port 43446:11: Bye Bye [preauth]
Jun 17 23:55:36 Tower sshd[29092]: Disconnected from authenticating user root 91.121.109.45 port 43446 [preauth]

Jun 17 15:02:29 lukav-desktop sshd\[3275\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.109.45  user=root
Jun 17 15:02:30 lukav-desktop sshd\[3275\]: Failed password for root from 91.121.109.45 port 35009 ssh2
Jun 17 15:05:30 lukav-desktop sshd\[22604\]: Invalid user scan from 91.121.109.45
Jun 17 15:05:30 lukav-desktop sshd\[22604\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.109.45
Jun 17 15:05:32 lukav-desktop sshd\[22604\]: Failed password for invalid user scan from 91.121.109.45 port 34886 ssh2

(sshd) Failed SSH login from 91.121.109.45 (FR/France/ns372573.ip-91-121-109.eu): 5 in the last 3600 secs

Jun  1 12:31:07 web8 sshd\[24874\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.109.45  user=root
Jun  1 12:31:09 web8 sshd\[24874\]: Failed password for root from 91.121.109.45 port 53301 ssh2
Jun  1 12:33:09 web8 sshd\[25831\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.109.45  user=root
Jun  1 12:33:12 web8 sshd\[25831\]: Failed password for root from 91.121.109.45 port 43771 ssh2
Jun  1 12:35:16 web8 sshd\[26883\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.109.45  user=root

2020-05-31T12:37:43.698454ns386461 sshd\[7736\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ns372573.ip-91-121-109.eu  user=root
2020-05-31T12:37:45.348441ns386461 sshd\[7736\]: Failed password for root from 91.121.109.45 port 55475 ssh2
2020-05-31T12:50:33.839318ns386461 sshd\[19013\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ns372573.ip-91-121-109.eu  user=root
2020-05-31T12:50:36.195214ns386461 sshd\[19013\]: Failed password for root from 91.121.109.45 port 55086 ssh2
2020-05-31T12:53:42.165708ns386461 sshd\[22071\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ns372573.ip-91-121-109.eu  user=root
...

Invalid user blake from 91.121.109.45 port 49601

$f2bV_matches

May  4 05:59:22 server sshd[26545]: Failed password for invalid user vrp from 91.121.109.45 port 36875 ssh2
May  4 06:07:39 server sshd[27088]: Failed password for invalid user bp from 91.121.109.45 port 36118 ssh2
May  4 06:11:06 server sshd[27482]: Failed password for invalid user robot from 91.121.109.45 port 41717 ssh2

Apr 14 01:05:23 ourumov-web sshd\[18876\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.109.45  user=avahi
Apr 14 01:05:24 ourumov-web sshd\[18876\]: Failed password for avahi from 91.121.109.45 port 55934 ssh2
Apr 14 01:11:40 ourumov-web sshd\[19367\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.109.45  user=root
...

Wordpress malicious attack:[sshd]

2020-04-03T17:15:03.129226abusebot-2.cloudsearch.cf sshd[26451]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=ns372573.ip-91-121-109.eu  user=root
2020-04-03T17:15:05.459294abusebot-2.cloudsearch.cf sshd[26451]: Failed password for root from 91.121.109.45 port 55074 ssh2
2020-04-03T17:20:40.838961abusebot-2.cloudsearch.cf sshd[26864]: Invalid user gituser from 91.121.109.45 port 41234
2020-04-03T17:20:40.845045abusebot-2.cloudsearch.cf sshd[26864]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=ns372573.ip-91-121-109.eu
2020-04-03T17:20:40.838961abusebot-2.cloudsearch.cf sshd[26864]: Invalid user gituser from 91.121.109.45 port 41234
2020-04-03T17:20:43.429263abusebot-2.cloudsearch.cf sshd[26864]: Failed password for invalid user gituser from 91.121.109.45 port 41234 ssh2
2020-04-03T17:23:32.548066abusebot-2.cloudsearch.cf sshd[27099]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 t
...

Oct  6 07:16:31 php1 sshd\[4845\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.228.137.6  user=root
Oct  6 07:16:33 php1 sshd\[4845\]: Failed password for root from 45.228.137.6 port 28836 ssh2
Oct  6 07:21:07 php1 sshd\[5712\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.228.137.6  user=root
Oct  6 07:21:10 php1 sshd\[5712\]: Failed password for root from 45.228.137.6 port 12057 ssh2
Oct  6 07:25:42 php1 sshd\[6603\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.228.137.6  user=root

Oct  6 16:49:00 MK-Soft-VM3 sshd[8120]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.183.133.21 
Oct  6 16:49:03 MK-Soft-VM3 sshd[8120]: Failed password for invalid user Lyon2017 from 68.183.133.21 port 49234 ssh2
...

2019-10-06T17:21:04.502952abusebot-5.cloudsearch.cf sshd\[13920\]: Invalid user robert from 188.165.242.200 port 57594

Oct  6 03:19:53 auw2 sshd\[32030\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.28.2.60  user=root
Oct  6 03:19:55 auw2 sshd\[32030\]: Failed password for root from 103.28.2.60 port 43244 ssh2
Oct  6 03:24:50 auw2 sshd\[32416\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.28.2.60  user=root
Oct  6 03:24:52 auw2 sshd\[32416\]: Failed password for root from 103.28.2.60 port 35596 ssh2
Oct  6 03:29:49 auw2 sshd\[405\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.28.2.60  user=root

BURG,WP GET /wp-login.php

postfix (unknown user, SPF fail or relay access denied)

Oct  6 12:53:06 plusreed sshd[21617]: Invalid user P4rol4_!@# from 138.68.48.118
...

Oct  6 15:10:24 thevastnessof sshd[26730]: Failed password for root from 51.38.224.110 port 48260 ssh2
...

MultiHost/MultiPort Probe, Scan, Hack -

WordPress wp-login brute force :: 166.62.80.109 0.120 BYPASS [06/Oct/2019:22:41:36  1100] [censored_1] "POST /wp-login.php HTTP/1.1" 200 3972 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"

Automatic report - Port Scan Attack

Oct  6 16:59:11 mail sshd[23664]: Invalid user pi from 123.233.88.191
Oct  6 16:59:11 mail sshd[23668]: Invalid user pi from 123.233.88.191
Oct  6 16:59:12 mail sshd[23668]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.233.88.191
Oct  6 16:59:11 mail sshd[23668]: Invalid user pi from 123.233.88.191
Oct  6 16:59:14 mail sshd[23668]: Failed password for invalid user pi from 123.233.88.191 port 54604 ssh2
Oct  6 16:59:11 mail sshd[23664]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.233.88.191
Oct  6 16:59:11 mail sshd[23664]: Invalid user pi from 123.233.88.191
Oct  6 16:59:14 mail sshd[23664]: Failed password for invalid user pi from 123.233.88.191 port 49585 ssh2
...

Wordpress attack

SSH invalid-user multiple login attempts

Oct  6 15:40:33 heissa sshd\[32114\]: Invalid user admin from 38.39.201.110 port 60214
Oct  6 15:40:37 heissa sshd\[32114\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=38.39.201.110
Oct  6 15:40:38 heissa sshd\[32114\]: Failed password for invalid user admin from 38.39.201.110 port 60214 ssh2
Oct  6 15:40:40 heissa sshd\[32115\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=38.39.201.110  user=root
Oct  6 15:40:42 heissa sshd\[32115\]: Failed password for root from 38.39.201.110 port 60212 ssh2