2020-08-27T18:20:36.106471+02:00  sshd[20407]: Failed password for invalid user bxm from 187.162.51.63 port 41472 ssh2

2020-08-25T06:13:48.493596shield sshd\[13802\]: Invalid user oracle from 187.162.51.63 port 36198
2020-08-25T06:13:48.511800shield sshd\[13802\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=187-162-51-63.static.axtel.net
2020-08-25T06:13:50.473401shield sshd\[13802\]: Failed password for invalid user oracle from 187.162.51.63 port 36198 ssh2
2020-08-25T06:17:45.400344shield sshd\[14055\]: Invalid user nagios from 187.162.51.63 port 39213
2020-08-25T06:17:45.409764shield sshd\[14055\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=187-162-51-63.static.axtel.net

Aug 18 09:20:37 ift sshd\[1773\]: Invalid user service from 187.162.51.63Aug 18 09:20:39 ift sshd\[1773\]: Failed password for invalid user service from 187.162.51.63 port 38386 ssh2Aug 18 09:24:24 ift sshd\[2032\]: Failed password for root from 187.162.51.63 port 40971 ssh2Aug 18 09:28:19 ift sshd\[2560\]: Invalid user wlw from 187.162.51.63Aug 18 09:28:21 ift sshd\[2560\]: Failed password for invalid user wlw from 187.162.51.63 port 43557 ssh2
...

Aug 14 11:17:31 lanister sshd[27772]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.162.51.63  user=root
Aug 14 11:17:33 lanister sshd[27772]: Failed password for root from 187.162.51.63 port 54290 ssh2
Aug 14 11:21:33 lanister sshd[27819]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.162.51.63  user=root
Aug 14 11:21:36 lanister sshd[27819]: Failed password for root from 187.162.51.63 port 57840 ssh2

Fail2Ban - SSH Bruteforce Attempt

Jul 19 00:11:51 abendstille sshd\[3409\]: Invalid user glh from 187.162.51.63
Jul 19 00:11:51 abendstille sshd\[3409\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.162.51.63
Jul 19 00:11:54 abendstille sshd\[3409\]: Failed password for invalid user glh from 187.162.51.63 port 49769 ssh2
Jul 19 00:16:19 abendstille sshd\[7916\]: Invalid user luka from 187.162.51.63
Jul 19 00:16:19 abendstille sshd\[7916\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.162.51.63
...

2020-07-14T14:42:02+0000 Failed SSH Authentication/Brute Force Attack. (Server 6)

Jul 12 19:10:28 sso sshd[20774]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.162.51.63
Jul 12 19:10:30 sso sshd[20774]: Failed password for invalid user leon from 187.162.51.63 port 59545 ssh2
...

Invalid user sysmanager from 187.162.51.63 port 55679

Multiple SSH authentication failures from 187.162.51.63

2020-06-24T08:45:37.767010amanda2.illicoweb.com sshd\[15284\]: Invalid user ths from 187.162.51.63 port 41722
2020-06-24T08:45:37.770609amanda2.illicoweb.com sshd\[15284\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=187-162-51-63.static.axtel.net
2020-06-24T08:45:40.120741amanda2.illicoweb.com sshd\[15284\]: Failed password for invalid user ths from 187.162.51.63 port 41722 ssh2
2020-06-24T08:55:05.173935amanda2.illicoweb.com sshd\[15806\]: Invalid user misp from 187.162.51.63 port 42768
2020-06-24T08:55:05.180624amanda2.illicoweb.com sshd\[15806\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=187-162-51-63.static.axtel.net
...

Jun 22 19:59:43 nextcloud sshd\[25955\]: Invalid user zg from 187.162.51.63
Jun 22 19:59:43 nextcloud sshd\[25955\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.162.51.63
Jun 22 19:59:45 nextcloud sshd\[25955\]: Failed password for invalid user zg from 187.162.51.63 port 42747 ssh2

SSH Brute-Force. Ports scanning.

Jun  8 14:04:44 Ubuntu-1404-trusty-64-minimal sshd\[27454\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.162.51.63  user=root
Jun  8 14:04:45 Ubuntu-1404-trusty-64-minimal sshd\[27454\]: Failed password for root from 187.162.51.63 port 43713 ssh2
Jun  8 14:18:06 Ubuntu-1404-trusty-64-minimal sshd\[5734\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.162.51.63  user=root
Jun  8 14:18:08 Ubuntu-1404-trusty-64-minimal sshd\[5734\]: Failed password for root from 187.162.51.63 port 40880 ssh2
Jun  8 14:21:26 Ubuntu-1404-trusty-64-minimal sshd\[8337\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.162.51.63  user=root

Jun  6 18:03:29 ny01 sshd[13203]: Failed password for root from 187.162.51.63 port 45245 ssh2
Jun  6 18:07:06 ny01 sshd[13669]: Failed password for root from 187.162.51.63 port 46723 ssh2

SSH Brute Force

Dec  3 04:20:53 hanapaa sshd\[19477\]: Invalid user saikumar from 193.112.6.241
Dec  3 04:20:53 hanapaa sshd\[19477\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.112.6.241
Dec  3 04:20:55 hanapaa sshd\[19477\]: Failed password for invalid user saikumar from 193.112.6.241 port 58062 ssh2
Dec  3 04:29:00 hanapaa sshd\[20251\]: Invalid user allys from 193.112.6.241
Dec  3 04:29:00 hanapaa sshd\[20251\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.112.6.241

Dec  3 04:21:33 kapalua sshd\[28582\]: Invalid user Contrasena321 from 170.79.14.18
Dec  3 04:21:33 kapalua sshd\[28582\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=170.79.14.18
Dec  3 04:21:34 kapalua sshd\[28582\]: Failed password for invalid user Contrasena321 from 170.79.14.18 port 46380 ssh2
Dec  3 04:29:13 kapalua sshd\[29347\]: Invalid user 12330 from 170.79.14.18
Dec  3 04:29:13 kapalua sshd\[29347\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=170.79.14.18

scan z

Sql/code injection probe

Dec  3 15:47:17 yesfletchmain sshd\[26841\]: User games from 217.182.170.81 not allowed because not listed in AllowUsers
Dec  3 15:47:17 yesfletchmain sshd\[26841\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.182.170.81  user=games
Dec  3 15:47:19 yesfletchmain sshd\[26841\]: Failed password for invalid user games from 217.182.170.81 port 56790 ssh2
Dec  3 15:52:32 yesfletchmain sshd\[26952\]: Invalid user w from 217.182.170.81 port 39210
Dec  3 15:52:32 yesfletchmain sshd\[26952\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.182.170.81
...

Dec  3 01:11:09 newdogma sshd[15809]: Invalid user gdm from 211.24.110.125 port 52334
Dec  3 01:11:09 newdogma sshd[15809]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.24.110.125
Dec  3 01:11:11 newdogma sshd[15809]: Failed password for invalid user gdm from 211.24.110.125 port 52334 ssh2
Dec  3 01:11:11 newdogma sshd[15809]: Received disconnect from 211.24.110.125 port 52334:11: Bye Bye [preauth]
Dec  3 01:11:11 newdogma sshd[15809]: Disconnected from 211.24.110.125 port 52334 [preauth]
Dec  3 01:28:12 newdogma sshd[15970]: Invalid user ident from 211.24.110.125 port 51368
Dec  3 01:28:12 newdogma sshd[15970]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.24.110.125
Dec  3 01:28:15 newdogma sshd[15970]: Failed password for invalid user ident from 211.24.110.125 port 51368 ssh2
Dec  3 01:28:15 newdogma sshd[15970]: Received disconnect from 211.24.110.125 port 51368:11: Bye Bye ........
-------------------------------

Triggered by Fail2Ban at Ares web server

\[2019-12-03 10:56:55\] NOTICE\[2754\] chan_sip.c: Registration from '"101" \' failed for '185.53.88.95:5448' - Wrong password
\[2019-12-03 10:56:55\] SECURITY\[2765\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-12-03T10:56:55.554-0500",Severity="Error",Service="SIP",EventVersion="2",AccountID="101",SessionID="0x7f26c4840358",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/185.53.88.95/5448",Challenge="2e5efc9a",ReceivedChallenge="2e5efc9a",ReceivedHash="cf256850fb08be37c713e296da708002"
\[2019-12-03 10:56:55\] NOTICE\[2754\] chan_sip.c: Registration from '"101" \' failed for '185.53.88.95:5448' - Wrong password
\[2019-12-03 10:56:55\] SECURITY\[2765\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-12-03T10:56:55.672-0500",Severity="Error",Service="SIP",EventVersion="2",AccountID="101",SessionID="0x7f26c40cecf8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/185.53.

Dec  3 16:34:57 sso sshd[8857]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.103.254.24
Dec  3 16:34:58 sso sshd[8857]: Failed password for invalid user redmine from 177.103.254.24 port 45798 ssh2
...

2019-12-03 17:26:21 dovecot_login authenticator failed for \(\[45.82.153.138\]\) \[45.82.153.138\]: 535 Incorrect authentication data \(set_id=admin@nophost.com\)
2019-12-03 17:26:32 dovecot_login authenticator failed for \(\[45.82.153.138\]\) \[45.82.153.138\]: 535 Incorrect authentication data
2019-12-03 17:26:45 dovecot_login authenticator failed for \(\[45.82.153.138\]\) \[45.82.153.138\]: 535 Incorrect authentication data
2019-12-03 17:27:02 dovecot_login authenticator failed for \(\[45.82.153.138\]\) \[45.82.153.138\]: 535 Incorrect authentication data
2019-12-03 17:27:11 dovecot_login authenticator failed for \(\[45.82.153.138\]\) \[45.82.153.138\]: 535 Incorrect authentication data

Dec  3 19:52:01 server sshd\[31970\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.85.42.178  user=root
Dec  3 19:52:03 server sshd\[31970\]: Failed password for root from 112.85.42.178 port 17716 ssh2
Dec  3 19:52:07 server sshd\[31970\]: Failed password for root from 112.85.42.178 port 17716 ssh2
Dec  3 19:52:10 server sshd\[31970\]: Failed password for root from 112.85.42.178 port 17716 ssh2
Dec  3 19:52:13 server sshd\[31970\]: Failed password for root from 112.85.42.178 port 17716 ssh2
...

Dec  3 12:55:51 ws12vmsma01 sshd[61457]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=207-238-47-212.rev.cloud.scaleway.com 
Dec  3 12:55:51 ws12vmsma01 sshd[61457]: Invalid user test from 212.47.238.207
Dec  3 12:55:53 ws12vmsma01 sshd[61457]: Failed password for invalid user test from 212.47.238.207 port 43960 ssh2
...

Dec  3 16:49:08 venus sshd\[28387\]: Invalid user rpm from 152.136.76.134 port 57920
Dec  3 16:49:08 venus sshd\[28387\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.136.76.134
Dec  3 16:49:10 venus sshd\[28387\]: Failed password for invalid user rpm from 152.136.76.134 port 57920 ssh2
...

Dec  3 06:40:35 wbs sshd\[7289\]: Invalid user habiba from 92.207.180.50
Dec  3 06:40:35 wbs sshd\[7289\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.207.180.50
Dec  3 06:40:37 wbs sshd\[7289\]: Failed password for invalid user habiba from 92.207.180.50 port 56400 ssh2
Dec  3 06:47:09 wbs sshd\[7829\]: Invalid user nfs from 92.207.180.50
Dec  3 06:47:09 wbs sshd\[7829\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.207.180.50