Sep  7 11:54:19 ingram sshd[14657]: Failed password for r.r from 178.128.165.11 port 58748 ssh2
Sep  7 12:16:43 ingram sshd[14998]: Failed password for r.r from 178.128.165.11 port 51556 ssh2
Sep  7 12:23:02 ingram sshd[15071]: Failed password for r.r from 178.128.165.11 port 57486 ssh2


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=178.128.165.11

...

SmallBizIT.US 1 packets to tcp(22)

2020-09-05T07:26:37.250326galaxy.wi.uni-potsdam.de sshd[7631]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.161.21
2020-09-05T07:26:37.248434galaxy.wi.uni-potsdam.de sshd[7631]: Invalid user admin from 178.128.161.21 port 44602
2020-09-05T07:26:39.590420galaxy.wi.uni-potsdam.de sshd[7631]: Failed password for invalid user admin from 178.128.161.21 port 44602 ssh2
2020-09-05T07:26:47.883407galaxy.wi.uni-potsdam.de sshd[7643]: Invalid user admin from 178.128.161.21 port 41068
2020-09-05T07:26:47.885348galaxy.wi.uni-potsdam.de sshd[7643]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.161.21
2020-09-05T07:26:47.883407galaxy.wi.uni-potsdam.de sshd[7643]: Invalid user admin from 178.128.161.21 port 41068
2020-09-05T07:26:49.929679galaxy.wi.uni-potsdam.de sshd[7643]: Failed password for invalid user admin from 178.128.161.21 port 41068 ssh2
2020-09-05T07:26:58.486905galaxy.wi.uni-potsdam.de ss
...

Lines containing failures of 178.128.161.21
Sep  4 03:34:52 newdogma sshd[6064]: Did not receive identification string from 178.128.161.21 port 44260
Sep  4 03:35:06 newdogma sshd[6197]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.161.21  user=r.r
Sep  4 03:35:08 newdogma sshd[6197]: Failed password for r.r from 178.128.161.21 port 36308 ssh2
Sep  4 03:35:10 newdogma sshd[6197]: Received disconnect from 178.128.161.21 port 36308:11: Normal Shutdown, Thank you for playing [preauth]
Sep  4 03:35:10 newdogma sshd[6197]: Disconnected from authenticating user r.r 178.128.161.21 port 36308 [preauth]
Sep  4 03:37:00 newdogma sshd[7103]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.161.21  user=r.r
Sep  4 03:37:03 newdogma sshd[7103]: Failed password for r.r from 178.128.161.21 port 32840 ssh2
Sep  4 03:37:04 newdogma sshd[7103]: Received disconnect from 178.128.161.21 port 328........
------------------------------

Fail2Ban Ban Triggered

Port scan: Attack repeated for 24 hours

Unauthorized connection attempt detected from IP address 178.128.161.250 to port 2212 [T]

Unauthorized connection attempt detected from IP address 178.128.161.250 to port 6022 [T]

trying to access non-authorized port

Jul 30 19:11:16 hurricane sshd[17918]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.166.133  user=r.r
Jul 30 19:11:17 hurricane sshd[17918]: Failed password for r.r from 178.128.166.133 port 52338 ssh2
Jul 30 19:11:18 hurricane sshd[17918]: Received disconnect from 178.128.166.133 port 52338:11: Bye Bye [preauth]
Jul 30 19:11:18 hurricane sshd[17918]: Disconnected from 178.128.166.133 port 52338 [preauth]
Jul 30 19:17:44 hurricane sshd[17950]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.166.133  user=r.r
Jul 30 19:17:46 hurricane sshd[17950]: Failed password for r.r from 178.128.166.133 port 35316 ssh2
Jul 30 19:17:46 hurricane sshd[17950]: Received disconnect from 178.128.166.133 port 35316:11: Bye Bye [preauth]
Jul 30 19:17:46 hurricane sshd[17950]: Disconnected from 178.128.166.133 port 35316 [preauth]
Jul 30 19:22:08 hurricane sshd[17980]: pam_unix(sshd:auth): auth........
-------------------------------

Jul 26 08:41:55 hell sshd[6440]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.162.10
Jul 26 08:41:56 hell sshd[6440]: Failed password for invalid user leon from 178.128.162.10 port 38204 ssh2
...

Jul 20 07:40:01 ws12vmsma01 sshd[23321]: Invalid user zsc from 178.128.168.87
Jul 20 07:40:03 ws12vmsma01 sshd[23321]: Failed password for invalid user zsc from 178.128.168.87 port 32846 ssh2
Jul 20 07:48:26 ws12vmsma01 sshd[24605]: Invalid user jc from 178.128.168.87
...

2020-07-19T16:12:06.131783mail.csmailer.org sshd[10459]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.162.10
2020-07-19T16:12:06.128367mail.csmailer.org sshd[10459]: Invalid user imm from 178.128.162.10 port 34268
2020-07-19T16:12:08.293074mail.csmailer.org sshd[10459]: Failed password for invalid user imm from 178.128.162.10 port 34268 ssh2
2020-07-19T16:16:08.424615mail.csmailer.org sshd[10801]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.162.10  user=mysql
2020-07-19T16:16:09.808044mail.csmailer.org sshd[10801]: Failed password for mysql from 178.128.162.10 port 49224 ssh2
...

Jul 19 03:48:56 ny01 sshd[1948]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.162.10
Jul 19 03:48:57 ny01 sshd[1948]: Failed password for invalid user hadoop from 178.128.162.10 port 60702 ssh2
Jul 19 03:53:00 ny01 sshd[2448]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.162.10

Jul 29 22:28:45 [host] sshd[23476]: Invalid user m
Jul 29 22:28:45 [host] sshd[23476]: pam_unix(sshd:
Jul 29 22:28:48 [host] sshd[23476]: Failed passwor

Jul 29 22:21:22 minden010 sshd[2995]: Failed password for root from 222.186.175.202 port 50660 ssh2
Jul 29 22:21:25 minden010 sshd[2995]: Failed password for root from 222.186.175.202 port 50660 ssh2
Jul 29 22:21:29 minden010 sshd[2995]: Failed password for root from 222.186.175.202 port 50660 ssh2
Jul 29 22:21:32 minden010 sshd[2995]: Failed password for root from 222.186.175.202 port 50660 ssh2
...

Unauthorised connection attempt detected at AUO NODE 4. System is sshd. Protected by AUO Stack Web Application Firewall (WAF)

Invalid user shenhan from 182.48.101.178 port 23677
pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.48.101.178
Invalid user shenhan from 182.48.101.178 port 23677
Failed password for invalid user shenhan from 182.48.101.178 port 23677 ssh2
Invalid user crh from 182.48.101.178 port 50644

Jul 29 22:05:35 ns382633 sshd\[30846\]: Invalid user acadmin from 59.144.48.34 port 32156
Jul 29 22:05:35 ns382633 sshd\[30846\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=59.144.48.34
Jul 29 22:05:37 ns382633 sshd\[30846\]: Failed password for invalid user acadmin from 59.144.48.34 port 32156 ssh2
Jul 29 22:16:40 ns382633 sshd\[578\]: Invalid user mjt from 59.144.48.34 port 9662
Jul 29 22:16:40 ns382633 sshd\[578\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=59.144.48.34

Jul 29 13:21:53 pixelmemory sshd[4176212]: Invalid user fujie from 187.12.181.106 port 55518
Jul 29 13:21:53 pixelmemory sshd[4176212]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.12.181.106 
Jul 29 13:21:53 pixelmemory sshd[4176212]: Invalid user fujie from 187.12.181.106 port 55518
Jul 29 13:21:55 pixelmemory sshd[4176212]: Failed password for invalid user fujie from 187.12.181.106 port 55518 ssh2
Jul 29 13:28:40 pixelmemory sshd[4187696]: Invalid user liran from 187.12.181.106 port 39538
...

2020-07-29T23:25:37.724608mail.standpoint.com.ua sshd[25034]: Invalid user gavin from 106.12.211.254 port 34198
2020-07-29T23:25:37.728361mail.standpoint.com.ua sshd[25034]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.211.254
2020-07-29T23:25:37.724608mail.standpoint.com.ua sshd[25034]: Invalid user gavin from 106.12.211.254 port 34198
2020-07-29T23:25:39.912472mail.standpoint.com.ua sshd[25034]: Failed password for invalid user gavin from 106.12.211.254 port 34198 ssh2
2020-07-29T23:27:07.148616mail.standpoint.com.ua sshd[25265]: Invalid user ugproj from 106.12.211.254 port 56330
...

Failed password for invalid user dongwei from 102.66.51.169 port 54340 ssh2

Unauthorised access (Jul 29) SRC=121.20.249.91 LEN=40 TTL=46 ID=21485 TCP DPT=8080 WINDOW=55752 SYN

Jul 29 22:41:04 abendstille sshd\[24770\]: Invalid user gcy from 202.179.76.187
Jul 29 22:41:04 abendstille sshd\[24770\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.179.76.187
Jul 29 22:41:06 abendstille sshd\[24770\]: Failed password for invalid user gcy from 202.179.76.187 port 39590 ssh2
Jul 29 22:45:24 abendstille sshd\[29686\]: Invalid user tmbcn from 202.179.76.187
Jul 29 22:45:24 abendstille sshd\[29686\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.179.76.187
...

Jul 29 22:25:11 OPSO sshd\[17766\]: Invalid user huangyc from 49.235.69.80 port 47080
Jul 29 22:25:11 OPSO sshd\[17766\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.235.69.80
Jul 29 22:25:13 OPSO sshd\[17766\]: Failed password for invalid user huangyc from 49.235.69.80 port 47080 ssh2
Jul 29 22:30:26 OPSO sshd\[19251\]: Invalid user pgadmin from 49.235.69.80 port 50802
Jul 29 22:30:26 OPSO sshd\[19251\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.235.69.80

Jul 29 20:19:09 rush sshd[21153]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=223.247.194.119
Jul 29 20:19:11 rush sshd[21153]: Failed password for invalid user shreya1 from 223.247.194.119 port 47388 ssh2
Jul 29 20:29:00 rush sshd[21479]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=223.247.194.119
...

Jul 29 22:28:55 debian-2gb-nbg1-2 kernel: \[18313029.303835\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=87.251.74.187 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=245 ID=64926 PROTO=TCP SPT=57172 DPT=10760 WINDOW=1024 RES=0x00 SYN URGP=0

Fail2Ban Ban Triggered

From: "Amazon.com" 
Amazon account phishing/fraud - MALICIOUS REDIRECT

UBE aimanbauk ([40.87.105.33]) Microsoft

Spam link parg.co = 178.238.224.248 Contabo GmbH – BLACKLISTED MALICIOUS REDIRECT:
-	sum.vn = 104.26.12.141, 104.26.13.141, 172.67.73.189 Cloudflare – blacklisted see https://www.phishtank.com/phish_detail.php?phish_id=6360304
-	amazon.verification.kozow.com = 94.249.167.244 GHOSTnet GmbH – blacklisted see https://transparencyreport.google.com/safe-browsing/search?url=http%3A%2F%2Famazon.verification.kozow.com%2F%3F16shop

SPF fxamplwo395845.com = aspmx.l.google.com 108.177.15.26, 108.177.15.27 Google