Aug 11 00:27:36 [snip] sshd[9777]: Invalid user brenda from 116.7.176.235 port 36176
Aug 11 00:27:36 [snip] sshd[9777]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.7.176.235
Aug 11 00:27:38 [snip] sshd[9777]: Failed password for invalid user brenda from 116.7.176.235 port 36176 ssh2[...]

$f2bV_matches

2020-01-26 05:06:40 dovecot_login authenticator failed for (…) [116.7.176.42]: 535 Incorrect authentication data (set_id=nologin)

Nov 14 20:37:54 firewall sshd[4303]: Invalid user abcdefghijklmnopq from 116.7.176.146
Nov 14 20:37:56 firewall sshd[4303]: Failed password for invalid user abcdefghijklmnopq from 116.7.176.146 port 46502 ssh2
Nov 14 20:42:18 firewall sshd[4375]: Invalid user luis123 from 116.7.176.146
...

Nov  8 23:36:46 lnxded64 sshd[8855]: Failed password for root from 116.7.176.146 port 57428 ssh2
Nov  8 23:36:46 lnxded64 sshd[8855]: Failed password for root from 116.7.176.146 port 57428 ssh2

Oct 24 05:55:50 jane sshd[16705]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.7.176.146 
Oct 24 05:55:52 jane sshd[16705]: Failed password for invalid user adm from 116.7.176.146 port 53334 ssh2
...

2019-10-16T00:37:12.982799homeassistant sshd[5161]: Invalid user nyx from 116.7.176.146 port 56246
2019-10-16T00:37:13.000567homeassistant sshd[5161]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.7.176.146
...

Oct 14 06:05:52 ncomp sshd[18967]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.7.176.146  user=root
Oct 14 06:05:53 ncomp sshd[18967]: Failed password for root from 116.7.176.146 port 47448 ssh2
Oct 14 06:21:00 ncomp sshd[19202]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.7.176.146  user=root
Oct 14 06:21:02 ncomp sshd[19202]: Failed password for root from 116.7.176.146 port 55466 ssh2

Oct 12 14:11:18 sshgateway sshd\[4152\]: Invalid user Irene@321 from 116.7.176.146
Oct 12 14:11:18 sshgateway sshd\[4152\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.7.176.146
Oct 12 14:11:19 sshgateway sshd\[4152\]: Failed password for invalid user Irene@321 from 116.7.176.146 port 60334 ssh2

Oct  6 07:04:59 site3 sshd\[56870\]: Invalid user Einstein2017 from 116.7.176.146
Oct  6 07:04:59 site3 sshd\[56870\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.7.176.146
Oct  6 07:05:00 site3 sshd\[56870\]: Failed password for invalid user Einstein2017 from 116.7.176.146 port 60310 ssh2
Oct  6 07:09:17 site3 sshd\[56997\]: Invalid user Space123 from 116.7.176.146
Oct  6 07:09:17 site3 sshd\[56997\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.7.176.146
...

[Aegis] @ 2019-10-05 04:50:47  0100 -> Attempted Administrator Privilege Gain: ET SCAN LibSSH Based Frequent SSH Connections Likely BruteForce Attack

2019-09-23T03:03:29.0620831495-001 sshd\[29184\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.7.176.146
2019-09-23T03:03:30.3996321495-001 sshd\[29184\]: Failed password for invalid user PRECISIONGLMGR from 116.7.176.146 port 37292 ssh2
2019-09-23T03:18:12.6916221495-001 sshd\[24711\]: Invalid user servercsgo from 116.7.176.146 port 38972
2019-09-23T03:18:12.6948541495-001 sshd\[24711\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.7.176.146
2019-09-23T03:18:14.2529831495-001 sshd\[24711\]: Failed password for invalid user servercsgo from 116.7.176.146 port 38972 ssh2
2019-09-23T03:23:03.2469101495-001 sshd\[24988\]: Invalid user crontab from 116.7.176.146 port 48946
...

Sep 22 21:48:41 game-panel sshd[15009]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.7.176.146
Sep 22 21:48:43 game-panel sshd[15009]: Failed password for invalid user 123456 from 116.7.176.146 port 44806 ssh2
Sep 22 21:52:51 game-panel sshd[15166]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.7.176.146

Sep 16 21:11:29 meumeu sshd[5393]: Failed password for sshd from 116.7.176.146 port 42458 ssh2
Sep 16 21:15:40 meumeu sshd[5878]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.7.176.146 
Sep 16 21:15:43 meumeu sshd[5878]: Failed password for invalid user xxx from 116.7.176.146 port 53784 ssh2
...

Sep  6 08:47:57 www5 sshd\[12618\]: Invalid user teamspeak3 from 116.7.176.146
Sep  6 08:47:57 www5 sshd\[12618\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.7.176.146
Sep  6 08:48:00 www5 sshd\[12618\]: Failed password for invalid user teamspeak3 from 116.7.176.146 port 41590 ssh2
...

Sep  3 20:06:41 mail sshd\[18337\]: Failed password for invalid user adi from 116.7.176.148 port 44412 ssh2
Sep  3 20:23:52 mail sshd\[19001\]: Invalid user zipcode from 116.7.176.148 port 50012
Sep  3 20:23:52 mail sshd\[19001\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.7.176.148
...

Oct  6 21:53:29 vps647732 sshd[17373]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.105.122.62
Oct  6 21:53:31 vps647732 sshd[17373]: Failed password for invalid user zabbix from 46.105.122.62 port 57900 ssh2
...

Oct  6 20:31:16 vtv3 sshd\[5114\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.103.241.211  user=root
Oct  6 20:31:18 vtv3 sshd\[5114\]: Failed password for root from 36.103.241.211 port 36890 ssh2
Oct  6 20:36:11 vtv3 sshd\[8434\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.103.241.211  user=root
Oct  6 20:36:13 vtv3 sshd\[8434\]: Failed password for root from 36.103.241.211 port 44656 ssh2
Oct  6 20:41:09 vtv3 sshd\[10855\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.103.241.211  user=root
Oct  6 20:55:14 vtv3 sshd\[18502\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.103.241.211  user=root
Oct  6 20:55:16 vtv3 sshd\[18502\]: Failed password for root from 36.103.241.211 port 47496 ssh2
Oct  6 21:00:00 vtv3 sshd\[20554\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhos

Oct  6 22:13:39 SilenceServices sshd[2636]: Failed password for root from 192.227.252.24 port 33840 ssh2
Oct  6 22:17:56 SilenceServices sshd[3866]: Failed password for root from 192.227.252.24 port 44372 ssh2

Oct  6 20:38:43 web8 sshd\[5254\]: Invalid user Games@2017 from 80.88.90.86
Oct  6 20:38:43 web8 sshd\[5254\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.88.90.86
Oct  6 20:38:45 web8 sshd\[5254\]: Failed password for invalid user Games@2017 from 80.88.90.86 port 54842 ssh2
Oct  6 20:42:55 web8 sshd\[7128\]: Invalid user P@ssword2020 from 80.88.90.86
Oct  6 20:42:55 web8 sshd\[7128\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.88.90.86

2019-10-06T08:47:19.2617451495-001 sshd\[55517\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=76.73.206.90  user=root
2019-10-06T08:47:21.2023411495-001 sshd\[55517\]: Failed password for root from 76.73.206.90 port 38629 ssh2
2019-10-06T08:51:44.0268551495-001 sshd\[55839\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=76.73.206.90  user=root
2019-10-06T08:51:45.8770171495-001 sshd\[55839\]: Failed password for root from 76.73.206.90 port 49955 ssh2
2019-10-06T08:56:17.4625481495-001 sshd\[56146\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=76.73.206.90  user=root
2019-10-06T08:56:19.5937531495-001 sshd\[56146\]: Failed password for root from 76.73.206.90 port 43189 ssh2
...

Oct  6 16:28:35 xentho sshd[13648]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.42.4  user=root
Oct  6 16:28:37 xentho sshd[13648]: Failed password for root from 222.186.42.4 port 57096 ssh2
Oct  6 16:28:41 xentho sshd[13648]: Failed password for root from 222.186.42.4 port 57096 ssh2
Oct  6 16:28:35 xentho sshd[13648]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.42.4  user=root
Oct  6 16:28:37 xentho sshd[13648]: Failed password for root from 222.186.42.4 port 57096 ssh2
Oct  6 16:28:41 xentho sshd[13648]: Failed password for root from 222.186.42.4 port 57096 ssh2
Oct  6 16:28:35 xentho sshd[13648]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.42.4  user=root
Oct  6 16:28:37 xentho sshd[13648]: Failed password for root from 222.186.42.4 port 57096 ssh2
Oct  6 16:28:41 xentho sshd[13648]: Failed password for root from 222.186.42.4 po
...

2019-10-06T22:06:25.4931181240 sshd\[21526\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.77.148.77  user=root
2019-10-06T22:06:27.9470121240 sshd\[21526\]: Failed password for root from 51.77.148.77 port 54616 ssh2
2019-10-06T22:13:10.1296451240 sshd\[21963\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.77.148.77  user=root
...

Oct  6 22:19:20 dedicated sshd[778]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.72.208.74  user=root
Oct  6 22:19:22 dedicated sshd[778]: Failed password for root from 148.72.208.74 port 47596 ssh2

EventTime:Mon Oct 7 06:52:19 AEDT 2019,EventName:Script not found,TargetDataNamespace:/,TargetDataContainer:srv/www/upperbay.info/site/media/js/,TargetDataName:register.ub,SourceIP:66.249.64.222,VendorOutcomeCode:E_NULL,InitiatorServiceName:44790

DATE:2019-10-06 22:06:30, IP:222.186.15.65, PORT:ssh SSH brute force auth on honeypot server (honey-neo-dc-bis)

Oct  6 22:36:03 vps647732 sshd[18462]: Failed password for root from 124.204.36.138 port 31960 ssh2
...

Oct  6 10:03:56 php1 sshd\[18429\]: Invalid user 7y8u9i0o from 190.202.54.12
Oct  6 10:03:56 php1 sshd\[18429\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.202.54.12
Oct  6 10:03:58 php1 sshd\[18429\]: Failed password for invalid user 7y8u9i0o from 190.202.54.12 port 10621 ssh2
Oct  6 10:09:03 php1 sshd\[18860\]: Invalid user PassW0rd@2018 from 190.202.54.12
Oct  6 10:09:03 php1 sshd\[18860\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.202.54.12

2019-10-06 14:53:27 H=(210.181.86.177.lemnet.com.br) [177.86.181.210]:34659 I=[192.147.25.65]:25 F= rejected RCPT : RBL: found in thrukfz5b56tq6xao6odgdyjrq.zen.dq.spamhaus.net (127.0.0.3, 127.0.0.4) (https://www.spamhaus.org/query/ip/177.86.181.210)
2019-10-06 14:53:28 H=(210.181.86.177.lemnet.com.br) [177.86.181.210]:34659 I=[192.147.25.65]:25 F= rejected RCPT : RBL: found in thrukfz5b56tq6xao6odgdyjrq.zen.dq.spamhaus.net (127.0.0.3, 127.0.0.4) (https://www.spamhaus.org/sbl/query/SBLCSS)
2019-10-06 14:53:29 H=(210.181.86.177.lemnet.com.br) [177.86.181.210]:34659 I=[192.147.25.65]:25 F= rejected RCPT : RBL: found in thrukfz5b56tq6xao6odgdyjrq.zen.dq.spamhaus.net (127.0.0.3, 127.0.0.4) (https://www.spamhaus.org/query/ip/177.86.181.210)
...

Brute force attempt

Oct  6 15:50:17 xtremcommunity sshd\[254803\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=124.127.133.158  user=root
Oct  6 15:50:19 xtremcommunity sshd\[254803\]: Failed password for root from 124.127.133.158 port 40622 ssh2
Oct  6 15:53:43 xtremcommunity sshd\[254867\]: Invalid user 123 from 124.127.133.158 port 44938
Oct  6 15:53:43 xtremcommunity sshd\[254867\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=124.127.133.158
Oct  6 15:53:46 xtremcommunity sshd\[254867\]: Failed password for invalid user 123 from 124.127.133.158 port 44938 ssh2
...