Nov 26 08:56:25 odroid64 sshd\[23130\]: User root from 165.227.93.144 not allowed because not listed in AllowUsers
Nov 26 08:56:25 odroid64 sshd\[23130\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.227.93.144  user=root
...

SSH login attempts with invalid user

Invalid user sasha from 165.227.93.144 port 45940

Invalid user 1234 from 165.227.93.144 port 49248

Oct 18 12:10:56 Tower sshd[28792]: Connection from 165.227.93.144 port 57284 on 192.168.10.220 port 22
Oct 18 12:10:57 Tower sshd[28792]: Failed password for root from 165.227.93.144 port 57284 ssh2
Oct 18 12:10:57 Tower sshd[28792]: Received disconnect from 165.227.93.144 port 57284:11: Bye Bye [preauth]
Oct 18 12:10:57 Tower sshd[28792]: Disconnected from authenticating user root 165.227.93.144 port 57284 [preauth]

Oct 16 13:24:35 MK-Soft-VM6 sshd[17164]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.227.93.144 
Oct 16 13:24:37 MK-Soft-VM6 sshd[17164]: Failed password for invalid user sun from 165.227.93.144 port 51076 ssh2
...

Lines containing failures of 165.227.93.144
Oct 16 03:06:44 smtp-out sshd[6609]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.227.93.144  user=r.r
Oct 16 03:06:46 smtp-out sshd[6609]: Failed password for r.r from 165.227.93.144 port 33504 ssh2
Oct 16 03:06:48 smtp-out sshd[6609]: Received disconnect from 165.227.93.144 port 33504:11: Bye Bye [preauth]
Oct 16 03:06:48 smtp-out sshd[6609]: Disconnected from authenticating user r.r 165.227.93.144 port 33504 [preauth]
Oct 16 03:58:04 smtp-out sshd[8477]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.227.93.144  user=r.r
Oct 16 03:58:07 smtp-out sshd[8477]: Failed password for r.r from 165.227.93.144 port 33388 ssh2
Oct 16 03:58:08 smtp-out sshd[8477]: Received disconnect from 165.227.93.144 port 33388:11: Bye Bye [preauth]
Oct 16 03:58:08 smtp-out sshd[8477]: Disconnected from authenticating user r.r 165.227.93.144 port 33388 [preaut........
------------------------------

Jun 10 06:21:45 pi sshd[26837]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.227.93.39 
Jun 10 06:21:47 pi sshd[26837]: Failed password for invalid user user from 165.227.93.39 port 60022 ssh2

Jun 25 01:19:54 abendstille sshd\[20496\]: Invalid user wq from 165.227.93.39
Jun 25 01:19:54 abendstille sshd\[20496\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.227.93.39
Jun 25 01:19:56 abendstille sshd\[20496\]: Failed password for invalid user wq from 165.227.93.39 port 44966 ssh2
Jun 25 01:23:14 abendstille sshd\[23883\]: Invalid user minecraft from 165.227.93.39
Jun 25 01:23:14 abendstille sshd\[23883\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.227.93.39
...

Jun 19 09:33:13 ws19vmsma01 sshd[142252]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.227.93.39
Jun 19 09:33:15 ws19vmsma01 sshd[142252]: Failed password for invalid user user11 from 165.227.93.39 port 59658 ssh2
...

2020-06-13T23:11:12.426890billing sshd[14161]: Failed password for root from 165.227.93.39 port 40464 ssh2
2020-06-13T23:14:22.326950billing sshd[20427]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=server5.mobiticket.co.ke  user=root
2020-06-13T23:14:24.422103billing sshd[20427]: Failed password for root from 165.227.93.39 port 40126 ssh2
...

Jun  9 05:43:11 webhost01 sshd[6554]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.227.93.39
Jun  9 05:43:13 webhost01 sshd[6554]: Failed password for invalid user xgs from 165.227.93.39 port 46936 ssh2
...

May 28 20:11:21 melroy-server sshd[1413]: Failed password for root from 165.227.93.39 port 53062 ssh2
...

Invalid user rgl from 165.227.93.39 port 48786

2020-05-10T22:40:18.104129shield sshd\[12338\]: Invalid user jack from 165.227.93.39 port 39098
2020-05-10T22:40:18.107568shield sshd\[12338\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=server5.mobiticket.co.ke
2020-05-10T22:40:19.459332shield sshd\[12338\]: Failed password for invalid user jack from 165.227.93.39 port 39098 ssh2
2020-05-10T22:43:37.502270shield sshd\[13704\]: Invalid user olivia from 165.227.93.39 port 45242
2020-05-10T22:43:37.505960shield sshd\[13704\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=server5.mobiticket.co.ke

2020-05-10T18:07:24.833244shield sshd\[11589\]: Invalid user oracle from 165.227.93.39 port 50824
2020-05-10T18:07:24.837243shield sshd\[11589\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=server5.mobiticket.co.ke
2020-05-10T18:07:26.993624shield sshd\[11589\]: Failed password for invalid user oracle from 165.227.93.39 port 50824 ssh2
2020-05-10T18:10:52.241911shield sshd\[12985\]: Invalid user deploy from 165.227.93.39 port 59580
2020-05-10T18:10:52.246015shield sshd\[12985\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=server5.mobiticket.co.ke

Bruteforce detected by fail2ban

Invalid user ck from 165.227.93.39 port 52394

Apr 14 09:15:47 vps46666688 sshd[16147]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.227.93.39
Apr 14 09:15:47 vps46666688 sshd[16147]: Failed password for invalid user admin from 165.227.93.39 port 36836 ssh2
...

2020-04-07T05:16:07.039166randservbullet-proofcloud-66.localdomain sshd[32377]: Invalid user chandra from 165.227.93.39 port 33686
2020-04-07T05:16:07.073099randservbullet-proofcloud-66.localdomain sshd[32377]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=server5.mobiticket.co.ke
2020-04-07T05:16:07.039166randservbullet-proofcloud-66.localdomain sshd[32377]: Invalid user chandra from 165.227.93.39 port 33686
2020-04-07T05:16:08.771037randservbullet-proofcloud-66.localdomain sshd[32377]: Failed password for invalid user chandra from 165.227.93.39 port 33686 ssh2
...

(sshd) Failed SSH login from 165.227.93.39 (US/United States/server5.mobiticket.co.ke): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Apr  4 02:17:47 amsweb01 sshd[31026]: Failed password for root from 165.227.93.39 port 58672 ssh2
Apr  4 02:27:51 amsweb01 sshd[32341]: Failed password for root from 165.227.93.39 port 34342 ssh2
Apr  4 02:31:43 amsweb01 sshd[708]: Failed password for root from 165.227.93.39 port 43346 ssh2
Apr  4 02:35:13 amsweb01 sshd[1739]: Failed password for root from 165.227.93.39 port 52350 ssh2
Apr  4 02:38:42 amsweb01 sshd[2249]: Failed password for root from 165.227.93.39 port 33126 ssh2

SSH brute-force: detected 6 distinct usernames within a 24-hour window.

20 attempts against mh-misbehave-ban on sonic

Honeypot attack, port: 445, PTR: PTR record not found

Feb  8 05:14:05 Ubuntu-1404-trusty-64-minimal sshd\[1424\]: Invalid user bww from 182.209.86.10
Feb  8 05:14:05 Ubuntu-1404-trusty-64-minimal sshd\[1424\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.209.86.10
Feb  8 05:14:07 Ubuntu-1404-trusty-64-minimal sshd\[1424\]: Failed password for invalid user bww from 182.209.86.10 port 36711 ssh2
Feb  8 05:55:38 Ubuntu-1404-trusty-64-minimal sshd\[24840\]: Invalid user oxb from 182.209.86.10
Feb  8 05:55:38 Ubuntu-1404-trusty-64-minimal sshd\[24840\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.209.86.10

[2020-02-08 03:14:55] NOTICE[1148] chan_sip.c: Registration from '' failed for '185.147.212.12:52755' - Wrong password
[2020-02-08 03:14:55] SECURITY[1163] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-02-08T03:14:55.497-0500",Severity="Error",Service="SIP",EventVersion="2",AccountID="7473",SessionID="0x7fd82cd25138",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/185.147.212.12/52755",Challenge="0b507dac",ReceivedChallenge="0b507dac",ReceivedHash="a7c8eeef31f35778d11947f9fe25198e"
[2020-02-08 03:16:02] NOTICE[1148] chan_sip.c: Registration from '' failed for '185.147.212.12:60256' - Wrong password
[2020-02-08 03:16:02] SECURITY[1163] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-02-08T03:16:02.394-0500",Severity="Error",Service="SIP",EventVersion="2",AccountID="6971",SessionID="0x7fd82c2bd8a8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/185.147.21
...

Honeypot attack, port: 445, PTR: PTR record not found

$f2bV_matches

Attempt to attack host OS, exploiting network vulnerabilities, on 08-02-2020 04:55:10.

2020-02-08T04:55:20.680579abusebot-2.cloudsearch.cf sshd[27107]: Invalid user pi from 77.3.58.15 port 60524
2020-02-08T04:55:20.703250abusebot-2.cloudsearch.cf sshd[27108]: Invalid user pi from 77.3.58.15 port 60526
2020-02-08T04:55:20.713743abusebot-2.cloudsearch.cf sshd[27107]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=x4d033a0f.dyn.telefonica.de
2020-02-08T04:55:20.680579abusebot-2.cloudsearch.cf sshd[27107]: Invalid user pi from 77.3.58.15 port 60524
2020-02-08T04:55:22.556217abusebot-2.cloudsearch.cf sshd[27107]: Failed password for invalid user pi from 77.3.58.15 port 60524 ssh2
2020-02-08T04:55:20.733369abusebot-2.cloudsearch.cf sshd[27108]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=x4d033a0f.dyn.telefonica.de
2020-02-08T04:55:20.703250abusebot-2.cloudsearch.cf sshd[27108]: Invalid user pi from 77.3.58.15 port 60526
2020-02-08T04:55:22.573307abusebot-2.cloudsearch.cf sshd[27108]: Failed p
...

Feb  8 09:45:59 tuotantolaitos sshd[2924]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.7.1.156
Feb  8 09:46:02 tuotantolaitos sshd[2924]: Failed password for invalid user sip from 178.7.1.156 port 35950 ssh2
...

Feb  8 06:06:49  sshd\[7415\]: Invalid user wjn from 39.36.221.93Feb  8 06:06:51  sshd\[7415\]: Failed password for invalid user wjn from 39.36.221.93 port 37386 ssh2
...

Feb  8 07:32:27 zeus sshd[23260]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.44.106.12 
Feb  8 07:32:29 zeus sshd[23260]: Failed password for invalid user afw from 187.44.106.12 port 56972 ssh2
Feb  8 07:37:53 zeus sshd[23302]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.44.106.12 
Feb  8 07:37:55 zeus sshd[23302]: Failed password for invalid user myq from 187.44.106.12 port 33623 ssh2

1581137722 - 02/08/2020 05:55:22 Host: 23.88.164.106/23.88.164.106 Port: 445 TCP Blocked

Feb  8 06:41:04 legacy sshd[14932]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.186.128
Feb  8 06:41:06 legacy sshd[14932]: Failed password for invalid user cru from 167.71.186.128 port 55108 ssh2
Feb  8 06:44:26 legacy sshd[15073]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.186.128
...

Honeypot attack, port: 5555, PTR: 52.94.63.218.broad.km.yn.dynamic.163data.com.cn.

Automatic report - Port Scan Attack