Nov  1 14:41:22 meumeu sshd[31869]: Failed password for root from 106.13.133.80 port 60510 ssh2
Nov  1 14:47:53 meumeu sshd[32733]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.133.80 
Nov  1 14:47:55 meumeu sshd[32733]: Failed password for invalid user president from 106.13.133.80 port 45382 ssh2
...

Oct 18 08:13:08 vps647732 sshd[13884]: Failed password for root from 106.13.133.80 port 59766 ssh2
...

*Port Scan* detected from 106.13.133.80 (CN/China/-). 4 hits in the last 270 seconds

Oct 14 06:36:48 vps647732 sshd[6788]: Failed password for root from 106.13.133.80 port 59930 ssh2
...

Oct 11 06:37:49 www sshd\[21401\]: Failed password for root from 106.13.133.80 port 56158 ssh2Oct 11 06:42:12 www sshd\[21737\]: Failed password for root from 106.13.133.80 port 35384 ssh2Oct 11 06:46:28 www sshd\[21934\]: Failed password for root from 106.13.133.80 port 42798 ssh2
...

Oct  8 19:21:42 *** sshd[8842]: User root from 106.13.133.80 not allowed because not listed in AllowUsers

Oct  5 10:28:05 MK-Soft-VM5 sshd[6941]: Failed password for root from 106.13.133.80 port 38082 ssh2
...

Oct  2 23:36:18 friendsofhawaii sshd\[1744\]: Invalid user mc from 106.13.133.80
Oct  2 23:36:18 friendsofhawaii sshd\[1744\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.133.80
Oct  2 23:36:20 friendsofhawaii sshd\[1744\]: Failed password for invalid user mc from 106.13.133.80 port 49678 ssh2
Oct  2 23:42:06 friendsofhawaii sshd\[2372\]: Invalid user lotus from 106.13.133.80
Oct  2 23:42:06 friendsofhawaii sshd\[2372\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.133.80

Oct  1 20:04:10 kapalua sshd\[16030\]: Invalid user alaimo from 106.13.133.80
Oct  1 20:04:10 kapalua sshd\[16030\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.133.80
Oct  1 20:04:12 kapalua sshd\[16030\]: Failed password for invalid user alaimo from 106.13.133.80 port 54882 ssh2
Oct  1 20:09:45 kapalua sshd\[16751\]: Invalid user user from 106.13.133.80
Oct  1 20:09:45 kapalua sshd\[16751\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.133.80

Sep  7 05:07:49 vps691689 sshd[29256]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.133.80
Sep  7 05:07:52 vps691689 sshd[29256]: Failed password for invalid user letmein from 106.13.133.80 port 34034 ssh2
...

Sep  3 17:13:10 areeb-Workstation sshd[4363]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.133.80
Sep  3 17:13:12 areeb-Workstation sshd[4363]: Failed password for invalid user temp from 106.13.133.80 port 54628 ssh2
...

Aug 29 11:19:48 h2177944 sshd\[3250\]: Invalid user sangley_xmb1 from 106.13.133.80 port 49052
Aug 29 11:19:48 h2177944 sshd\[3250\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.133.80
Aug 29 11:19:50 h2177944 sshd\[3250\]: Failed password for invalid user sangley_xmb1 from 106.13.133.80 port 49052 ssh2
Aug 29 11:25:13 h2177944 sshd\[3397\]: Invalid user null from 106.13.133.80 port 32884
...

Aug 29 10:09:48 h2177944 sshd\[929\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.133.80  user=root
Aug 29 10:09:50 h2177944 sshd\[929\]: Failed password for root from 106.13.133.80 port 33238 ssh2
Aug 29 10:15:17 h2177944 sshd\[1075\]: Invalid user xfs from 106.13.133.80 port 45312
Aug 29 10:15:17 h2177944 sshd\[1075\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.133.80
...

Aug 11 19:57:03 hosting sshd[6762]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.133.80  user=root
Aug 11 19:57:05 hosting sshd[6762]: Failed password for root from 106.13.133.80 port 46114 ssh2
...

Aug  4 09:16:33 v22019058497090703 sshd[14625]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.133.80
Aug  4 09:16:35 v22019058497090703 sshd[14625]: Failed password for invalid user creis from 106.13.133.80 port 57376 ssh2
Aug  4 09:22:03 v22019058497090703 sshd[14967]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.133.80
...

Automated report - ssh fail2ban:
Jul 27 12:01:49 wrong password, user=team12345, port=34188, ssh2
Jul 27 12:33:52 authentication failure 
Jul 27 12:33:54 wrong password, user=daho, port=45552, ssh2

web-1 [ssh] SSH Attack

2019-07-16T12:20:57.714506abusebot-2.cloudsearch.cf sshd\[426\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.133.80  user=root

(sshd) Failed SSH login from 106.13.133.190 (CN/China/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Sep 21 16:29:29 server2 sshd[12768]: Invalid user test from 106.13.133.190 port 39790
Sep 21 16:29:31 server2 sshd[12768]: Failed password for invalid user test from 106.13.133.190 port 39790 ssh2
Sep 21 16:36:09 server2 sshd[14307]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.133.190  user=root
Sep 21 16:36:10 server2 sshd[14307]: Failed password for root from 106.13.133.190 port 51834 ssh2
Sep 21 16:45:58 server2 sshd[15653]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.133.190  user=nagios

Sep 21 16:21:31 localhost sshd[3145715]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.133.190  user=root
Sep 21 16:21:33 localhost sshd[3145715]: Failed password for root from 106.13.133.190 port 59962 ssh2
...

Aug 16 05:50:32 db sshd[20897]: User root from 106.13.133.190 not allowed because none of user's groups are listed in AllowGroups
...

(sshd) Failed SSH login from 106.13.133.190 (CN/China/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Aug  5 14:09:51 amsweb01 sshd[19384]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.133.190  user=root
Aug  5 14:09:52 amsweb01 sshd[19384]: Failed password for root from 106.13.133.190 port 35206 ssh2
Aug  5 14:14:33 amsweb01 sshd[20206]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.133.190  user=root
Aug  5 14:14:34 amsweb01 sshd[20206]: Failed password for root from 106.13.133.190 port 52644 ssh2
Aug  5 14:16:56 amsweb01 sshd[20453]: Invalid user server#2008 from 106.13.133.190 port 50308

Aug  2 23:31:21 vps647732 sshd[21860]: Failed password for root from 106.13.133.190 port 50430 ssh2
...

Aug  2 07:53:10 rancher-0 sshd[719795]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.133.190  user=root
Aug  2 07:53:12 rancher-0 sshd[719795]: Failed password for root from 106.13.133.190 port 53514 ssh2
...

(sshd) Failed SSH login from 106.13.133.190 (CN/China/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Jul 17 13:52:46 grace sshd[28729]: Invalid user kelly from 106.13.133.190 port 50090
Jul 17 13:52:48 grace sshd[28729]: Failed password for invalid user kelly from 106.13.133.190 port 50090 ssh2
Jul 17 14:10:06 grace sshd[31353]: Invalid user josep from 106.13.133.190 port 56866
Jul 17 14:10:08 grace sshd[31353]: Failed password for invalid user josep from 106.13.133.190 port 56866 ssh2
Jul 17 14:16:08 grace sshd[32485]: Invalid user git from 106.13.133.190 port 38954

2020-07-06T16:57:51.559147xentho-1 sshd[905187]: Invalid user christa from 106.13.133.190 port 46630
2020-07-06T16:57:53.642106xentho-1 sshd[905187]: Failed password for invalid user christa from 106.13.133.190 port 46630 ssh2
2020-07-06T17:00:14.574513xentho-1 sshd[905211]: Invalid user testing1 from 106.13.133.190 port 52554
2020-07-06T17:00:14.584238xentho-1 sshd[905211]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.133.190
2020-07-06T17:00:14.574513xentho-1 sshd[905211]: Invalid user testing1 from 106.13.133.190 port 52554
2020-07-06T17:00:16.622768xentho-1 sshd[905211]: Failed password for invalid user testing1 from 106.13.133.190 port 52554 ssh2
2020-07-06T17:02:37.075430xentho-1 sshd[905256]: Invalid user teamspeak from 106.13.133.190 port 58458
2020-07-06T17:02:37.082114xentho-1 sshd[905256]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.133.190
2020-07-06T17:02:37.075430xentho-1 
...

Jun 10 12:52:02 server sshd[8319]: Failed password for invalid user xn from 106.13.133.190 port 50306 ssh2
Jun 10 12:55:19 server sshd[10970]: Failed password for invalid user raffaele from 106.13.133.190 port 41320 ssh2
Jun 10 12:58:36 server sshd[13504]: Failed password for invalid user jzapata from 106.13.133.190 port 60562 ssh2

Apr  3 22:34:36 server1 sshd\[1854\]: Invalid user kodi from 106.13.133.124
Apr  3 22:34:36 server1 sshd\[1854\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.133.124 
Apr  3 22:34:38 server1 sshd\[1854\]: Failed password for invalid user kodi from 106.13.133.124 port 38130 ssh2
Apr  3 22:38:53 server1 sshd\[3035\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.133.124  user=root
Apr  3 22:38:55 server1 sshd\[3035\]: Failed password for root from 106.13.133.124 port 58210 ssh2
...

2019-09-25 07:22:24 dovecot_login authenticator failed for (xn--66t80dn9s88i) [49.89.127.16]:54967 I=[192.147.25.65]:25: 535 Incorrect authentication data (set_id=test@lerctr.org)
2019-09-25 07:22:24 H=(xn--66t80dn9s88i) [49.89.127.16]:54967 I=[192.147.25.65]:25 sender verify fail for : Unrouteable address
2019-09-25 07:22:24 H=(xn--66t80dn9s88i) [49.89.127.16]:54967 I=[192.147.25.65]:25 F= rejected RCPT : Sender verify failed
...

Automatic report - Port Scan Attack

Sep 25 13:37:54 *** sshd[9872]: User root from 222.186.175.150 not allowed because not listed in AllowUsers

445/tcp 445/tcp 445/tcp
[2019-09-06/25]3pkt

SSH Brute-Force reported by Fail2Ban

Sep 25 16:01:16 dev0-dcde-rnet sshd[9638]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=60.251.217.192
Sep 25 16:01:18 dev0-dcde-rnet sshd[9638]: Failed password for invalid user ts5 from 60.251.217.192 port 51526 ssh2
Sep 25 16:07:31 dev0-dcde-rnet sshd[9669]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=60.251.217.192

[Wed Sep 25 09:53:53.762310 2019] [:error] [pid 28619] [client 118.140.149.10:48950] [client 118.140.149.10] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "91"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 21)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "127.0.0.1"] [uri "/cgi-bin/ViewLog.asp"] [unique_id "XYtjYcIPKh5wbvUtUbd9UQAAAAU"]
...

20 attempts against mh-misbehave-ban on comet.magehost.pro

Automatic report - Banned IP Access

19/9/25@10:07:57: FAIL: Alarm-SSH address from=222.186.175.151
...

Sep 25 14:00:16 monocul sshd[4856]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.15.217  user=root
Sep 25 14:00:18 monocul sshd[4856]: Failed password for root from 222.186.15.217 port 24696 ssh2
...

445/tcp 445/tcp
[2019-09-04/25]2pkt

Sep 25 14:25:21 hcbbdb sshd\[30862\]: Invalid user nagios from 132.232.40.86
Sep 25 14:25:21 hcbbdb sshd\[30862\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=132.232.40.86
Sep 25 14:25:23 hcbbdb sshd\[30862\]: Failed password for invalid user nagios from 132.232.40.86 port 46260 ssh2
Sep 25 14:31:42 hcbbdb sshd\[31499\]: Invalid user qy from 132.232.40.86
Sep 25 14:31:42 hcbbdb sshd\[31499\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=132.232.40.86

2019-09-25T08:17:17.5925211495-001 sshd\[51339\]: Failed password for invalid user stingray from 212.87.9.141 port 54910 ssh2
2019-09-25T08:29:59.6682551495-001 sshd\[52562\]: Invalid user Password!@\#x from 212.87.9.141 port 46084
2019-09-25T08:29:59.6758281495-001 sshd\[52562\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.87.9.141
2019-09-25T08:30:01.1408531495-001 sshd\[52562\]: Failed password for invalid user Password!@\#x from 212.87.9.141 port 46084 ssh2
2019-09-25T08:34:10.5060781495-001 sshd\[52802\]: Invalid user Qwerty1 from 212.87.9.141 port 21640
2019-09-25T08:34:10.5129561495-001 sshd\[52802\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.87.9.141
...

23/tcp 23/tcp
[2019-09-06/25]2pkt