[2020-05-22 15:02:24] NOTICE[1157] chan_sip.c: Registration from 'xxxxxtestxxxx ' failed for '138.68.253.235:5060' - Wrong password
[2020-05-22 15:02:24] SECURITY[1173] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-05-22T15:02:24.326-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="xxxxxtestxxxx",SessionID="0x7f5f106cb5a8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/138.68.253.235/5060",Challenge="7fc27a10",ReceivedChallenge="7fc27a10",ReceivedHash="f908e26f1c25426f5719b9aa26ec26bd"
[2020-05-22 15:02:24] NOTICE[1157] chan_sip.c: Registration from '6888 ' failed for '138.68.253.235:5060' - Wrong password
[2020-05-22 15:02:24] SECURITY[1173] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-05-22T15:02:24.467-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="6888",SessionID="0x7f5f1062dd88",LocalAddress="IPV4/UDP/192.168.244.6/5060",
...

[2020-05-22 07:04:17] NOTICE[1157] chan_sip.c: Registration from 'xxxxxtestxxxx ' failed for '138.68.253.235:5060' - Wrong password
[2020-05-22 07:04:17] SECURITY[1173] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-05-22T07:04:17.599-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="xxxxxtestxxxx",SessionID="0x7f5f1027fe28",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/138.68.253.235/5060",Challenge="3c172517",ReceivedChallenge="3c172517",ReceivedHash="e5b97e8b67cb390a3c75058abbd5d2e6"
[2020-05-22 07:04:17] NOTICE[1157] chan_sip.c: Registration from '7501 ' failed for '138.68.253.235:5060' - Wrong password
[2020-05-22 07:04:17] SECURITY[1173] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-05-22T07:04:17.758-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="7501",SessionID="0x7f5f100266a8",LocalAddress="IPV4/UDP/192.168.244.6/5060",
...

[2020-05-20 19:30:15] NOTICE[1157] chan_sip.c: Registration from 'xxxxxtestxxxx ' failed for '138.68.253.235:5060' - Wrong password
[2020-05-20 19:30:15] SECURITY[1173] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-05-20T19:30:15.129-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="xxxxxtestxxxx",SessionID="0x7f5f1051dd08",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/138.68.253.235/5060",Challenge="5fd2a5d9",ReceivedChallenge="5fd2a5d9",ReceivedHash="ab6fc5b8cc99f7b17ef7f28b37b8de35"
[2020-05-20 19:30:15] NOTICE[1157] chan_sip.c: Registration from '270270 ' failed for '138.68.253.235:5060' - Wrong password
[2020-05-20 19:30:15] SECURITY[1173] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-05-20T19:30:15.273-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="270270",SessionID="0x7f5f100266a8",LocalAddress="IPV4/UDP/192.168.244.6/
...

$f2bV_matches

Time:     Thu Oct  1 10:55:46 2020 +0000
IP:       138.68.253.149 (US/United States/-)
Failures: 5 (sshd)
Interval: 3600 seconds
Blocked:  Permanent Block [LF_SSHD]

Log entries:

Oct  1 10:51:54 29-1 sshd[18268]: Invalid user hari from 138.68.253.149 port 58058
Oct  1 10:51:55 29-1 sshd[18268]: Failed password for invalid user hari from 138.68.253.149 port 58058 ssh2
Oct  1 10:54:06 29-1 sshd[18607]: Invalid user www from 138.68.253.149 port 37444
Oct  1 10:54:08 29-1 sshd[18607]: Failed password for invalid user www from 138.68.253.149 port 37444 ssh2
Oct  1 10:55:45 29-1 sshd[18854]: Invalid user ubuntu from 138.68.253.149 port 39752

k+ssh-bruteforce

$f2bV_matches

Sep 18 16:15:07 firewall sshd[1687]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.253.149
Sep 18 16:15:07 firewall sshd[1687]: Invalid user postgres from 138.68.253.149
Sep 18 16:15:08 firewall sshd[1687]: Failed password for invalid user postgres from 138.68.253.149 port 45956 ssh2
...

2020-09-13T21:40:20.298077server.mjenks.net sshd[1070025]: Failed password for root from 138.68.253.149 port 58496 ssh2
2020-09-13T21:43:47.149651server.mjenks.net sshd[1070422]: Invalid user admin from 138.68.253.149 port 36496
2020-09-13T21:43:47.156741server.mjenks.net sshd[1070422]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.253.149
2020-09-13T21:43:47.149651server.mjenks.net sshd[1070422]: Invalid user admin from 138.68.253.149 port 36496
2020-09-13T21:43:49.517610server.mjenks.net sshd[1070422]: Failed password for invalid user admin from 138.68.253.149 port 36496 ssh2
...

2020-09-13T21:40:20.298077server.mjenks.net sshd[1070025]: Failed password for root from 138.68.253.149 port 58496 ssh2
2020-09-13T21:43:47.149651server.mjenks.net sshd[1070422]: Invalid user admin from 138.68.253.149 port 36496
2020-09-13T21:43:47.156741server.mjenks.net sshd[1070422]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.253.149
2020-09-13T21:43:47.149651server.mjenks.net sshd[1070422]: Invalid user admin from 138.68.253.149 port 36496
2020-09-13T21:43:49.517610server.mjenks.net sshd[1070422]: Failed password for invalid user admin from 138.68.253.149 port 36496 ssh2
...

Sep 13 21:36:24 ip-172-31-16-56 sshd\[14588\]: Failed password for root from 138.68.253.149 port 39628 ssh2\
Sep 13 21:38:45 ip-172-31-16-56 sshd\[14612\]: Failed password for root from 138.68.253.149 port 53224 ssh2\
Sep 13 21:41:10 ip-172-31-16-56 sshd\[14723\]: Failed password for root from 138.68.253.149 port 38588 ssh2\
Sep 13 21:43:30 ip-172-31-16-56 sshd\[14750\]: Invalid user koeso from 138.68.253.149\
Sep 13 21:43:31 ip-172-31-16-56 sshd\[14750\]: Failed password for invalid user koeso from 138.68.253.149 port 52192 ssh2\

Aug 30 08:06:00 ns381471 sshd[21651]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.253.149
Aug 30 08:06:02 ns381471 sshd[21651]: Failed password for invalid user francesco from 138.68.253.149 port 41998 ssh2

Aug 24 18:32:30 root sshd[24489]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.253.149 
Aug 24 18:32:32 root sshd[24489]: Failed password for invalid user owen from 138.68.253.149 port 59400 ssh2
Aug 24 18:42:56 root sshd[26012]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.253.149 
...

Aug 14 22:35:58 myvps sshd[11407]: Failed password for root from 138.68.253.149 port 52616 ssh2
Aug 14 22:44:51 myvps sshd[16915]: Failed password for root from 138.68.253.149 port 37468 ssh2
...

Aug  6 07:55:46 hell sshd[9487]: Failed password for root from 138.68.253.149 port 51536 ssh2
...

Aug  4 20:46:03 mout sshd[18045]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.253.149  user=root
Aug  4 20:46:05 mout sshd[18045]: Failed password for root from 138.68.253.149 port 56116 ssh2

Aug  3 09:43:59 minden010 sshd[3547]: Failed password for root from 138.68.253.149 port 45694 ssh2
Aug  3 09:46:59 minden010 sshd[4562]: Failed password for root from 138.68.253.149 port 41960 ssh2
...

Invalid user wac from 138.68.253.149 port 39262

2020-06-19T16:08:14+0200 Failed SSH Authentication/Brute Force Attack.(Server 2)

Jun 19 15:07:57 ift sshd\[4637\]: Invalid user rui from 107.170.192.131Jun 19 15:07:59 ift sshd\[4637\]: Failed password for invalid user rui from 107.170.192.131 port 34282 ssh2Jun 19 15:12:04 ift sshd\[5774\]: Invalid user leonard from 107.170.192.131Jun 19 15:12:07 ift sshd\[5774\]: Failed password for invalid user leonard from 107.170.192.131 port 53607 ssh2Jun 19 15:16:17 ift sshd\[6537\]: Invalid user 123 from 107.170.192.131
...

178.62.101.117 - - \[19/Jun/2020:14:16:09 +0200\] "POST /wp-login.php HTTP/1.0" 200 2561 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"
178.62.101.117 - - \[19/Jun/2020:14:16:10 +0200\] "POST /wp-login.php HTTP/1.0" 200 2564 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"
178.62.101.117 - - \[19/Jun/2020:14:16:12 +0200\] "POST /wp-login.php HTTP/1.0" 200 2559 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"

2020-06-19T14:12:45.190734vps751288.ovh.net sshd\[7220\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.129.14.218  user=root
2020-06-19T14:12:46.713252vps751288.ovh.net sshd\[7220\]: Failed password for root from 181.129.14.218 port 13902 ssh2
2020-06-19T14:16:19.154144vps751288.ovh.net sshd\[7260\]: Invalid user test from 181.129.14.218 port 21254
2020-06-19T14:16:19.166924vps751288.ovh.net sshd\[7260\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.129.14.218
2020-06-19T14:16:21.401842vps751288.ovh.net sshd\[7260\]: Failed password for invalid user test from 181.129.14.218 port 21254 ssh2

Jun 19 03:02:26 php1 sshd\[2511\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.88.112.113  user=root
Jun 19 03:02:28 php1 sshd\[2511\]: Failed password for root from 49.88.112.113 port 40816 ssh2
Jun 19 03:02:30 php1 sshd\[2511\]: Failed password for root from 49.88.112.113 port 40816 ssh2
Jun 19 03:02:32 php1 sshd\[2511\]: Failed password for root from 49.88.112.113 port 40816 ssh2
Jun 19 03:03:30 php1 sshd\[2580\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.88.112.113  user=root

Port scan: Attack repeated for 24 hours

2020-06-19T12:18:35.198010shield sshd\[9760\]: Invalid user sandt from 211.251.246.185 port 48567
2020-06-19T12:18:35.200543shield sshd\[9760\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.251.246.185
2020-06-19T12:18:36.772865shield sshd\[9760\]: Failed password for invalid user sandt from 211.251.246.185 port 48567 ssh2
2020-06-19T12:22:44.588611shield sshd\[10338\]: Invalid user maz from 211.251.246.185 port 47657
2020-06-19T12:22:44.592698shield sshd\[10338\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.251.246.185

Brute forcing email accounts

Jun 19 14:22:05 www6-3 sshd[15426]: Invalid user personal from 201.179.223.96 port 52645
Jun 19 14:22:05 www6-3 sshd[15426]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.179.223.96
Jun 19 14:22:07 www6-3 sshd[15426]: Failed password for invalid user personal from 201.179.223.96 port 52645 ssh2
Jun 19 14:22:08 www6-3 sshd[15426]: Received disconnect from 201.179.223.96 port 52645:11: Bye Bye [preauth]
Jun 19 14:22:08 www6-3 sshd[15426]: Disconnected from 201.179.223.96 port 52645 [preauth]
Jun 19 14:31:29 www6-3 sshd[16038]: Invalid user hadoopuser from 201.179.223.96 port 47165
Jun 19 14:31:29 www6-3 sshd[16038]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.179.223.96


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=201.179.223.96

Jun 19 09:10:15 ny01 sshd[24687]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.95.100
Jun 19 09:10:17 ny01 sshd[24687]: Failed password for invalid user suporte from 106.13.95.100 port 37794 ssh2
Jun 19 09:14:02 ny01 sshd[25177]: Failed password for root from 106.13.95.100 port 58436 ssh2

Jun 19 14:14:18 vps sshd[360627]: Invalid user ubuntu from 180.76.148.87 port 36059
Jun 19 14:14:18 vps sshd[360627]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.148.87
Jun 19 14:14:21 vps sshd[360627]: Failed password for invalid user ubuntu from 180.76.148.87 port 36059 ssh2
Jun 19 14:16:34 vps sshd[373841]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.148.87  user=root
Jun 19 14:16:36 vps sshd[373841]: Failed password for root from 180.76.148.87 port 50456 ssh2
...

NL_IPV_<177>1592577084 [1:2403445:58121] ET CINS Active Threat Intelligence Poor Reputation IP UDP group 73 [Classification: Misc Attack] [Priority: 2]:  {UDP} 80.82.77.245:37742

Jun 19 16:04:14 roki-contabo sshd\[1467\]: Invalid user openstack from 220.130.10.13
Jun 19 16:04:14 roki-contabo sshd\[1467\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=220.130.10.13
Jun 19 16:04:17 roki-contabo sshd\[1467\]: Failed password for invalid user openstack from 220.130.10.13 port 57186 ssh2
Jun 19 16:25:34 roki-contabo sshd\[1717\]: Invalid user zeng from 220.130.10.13
Jun 19 16:25:34 roki-contabo sshd\[1717\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=220.130.10.13
...

(sshd) Failed SSH login from 77.65.17.2 (PL/Poland/dns1.poznan.uw.gov.pl): 5 in the last 3600 secs

Jun 19 14:27:24 scw-6657dc sshd[25207]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.153.37.194
Jun 19 14:27:24 scw-6657dc sshd[25207]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.153.37.194
Jun 19 14:27:26 scw-6657dc sshd[25207]: Failed password for invalid user caleb from 202.153.37.194 port 55516 ssh2
...