Triggered by Fail2Ban

Jul 12 04:44:01 *** sshd[30937]: Failed password for invalid user git from 66.70.130.155 port 47186 ssh2
Jul 12 04:52:47 *** sshd[31067]: Failed password for invalid user cheryl from 66.70.130.155 port 57946 ssh2
Jul 12 05:01:03 *** sshd[31159]: Failed password for invalid user bash from 66.70.130.155 port 58738 ssh2
Jul 12 05:08:42 *** sshd[31305]: Failed password for invalid user elasticsearch from 66.70.130.155 port 59540 ssh2
Jul 12 05:16:42 *** sshd[31458]: Failed password for invalid user jenkins from 66.70.130.155 port 60334 ssh2
Jul 12 05:24:40 *** sshd[31586]: Failed password for invalid user cmb from 66.70.130.155 port 32898 ssh2
Jul 12 05:32:19 *** sshd[31661]: Failed password for invalid user yan from 66.70.130.155 port 33696 ssh2
Jul 12 05:40:08 *** sshd[31793]: Failed password for invalid user windows from 66.70.130.155 port 34492 ssh2
Jul 12 05:48:05 *** sshd[31957]: Failed password for invalid user geng from 66.70.130.155 port 35290 ssh2
Jul 12 05:55:44 *** sshd[32031]: Failed password for inv

Jul 12 19:20:19 plusreed sshd[5435]: Invalid user health from 106.13.98.92
...

\[2019-07-12 19:14:06\] NOTICE\[22786\] chan_sip.c: Registration from '\' failed for '37.120.135.221:1310' - Wrong password
\[2019-07-12 19:14:06\] SECURITY\[22794\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-07-12T19:14:06.460-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="5907",SessionID="0x7f754415c478",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.120.135.221/64848",Challenge="40016991",ReceivedChallenge="40016991",ReceivedHash="13894525a260a94c4d204e628097234d"
\[2019-07-12 19:15:15\] NOTICE\[22786\] chan_sip.c: Registration from '\' failed for '37.120.135.221:1359' - Wrong password
\[2019-07-12 19:15:15\] SECURITY\[22794\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-07-12T19:15:15.680-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="764",SessionID="0x7f75441b6d18",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.120

Attacks websites by trying to access known vulnerables of plugins, brute-force of backends or probing of administrative tools

Jul 13 01:50:30 meumeu sshd[22357]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.250.205.114 
Jul 13 01:50:32 meumeu sshd[22357]: Failed password for invalid user helpdesk from 180.250.205.114 port 44202 ssh2
Jul 13 01:56:38 meumeu sshd[23609]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.250.205.114 
...

Jul 12 18:25:33 aat-srv002 sshd[1434]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.185.157.31
Jul 12 18:25:36 aat-srv002 sshd[1434]: Failed password for invalid user admin from 146.185.157.31 port 43318 ssh2
Jul 12 18:32:55 aat-srv002 sshd[1602]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.185.157.31
Jul 12 18:32:57 aat-srv002 sshd[1602]: Failed password for invalid user noc from 146.185.157.31 port 45620 ssh2
...

Jul 12 21:58:55 dev0-dcde-rnet sshd[3915]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=220.120.106.254
Jul 12 21:58:57 dev0-dcde-rnet sshd[3915]: Failed password for invalid user admin from 220.120.106.254 port 46738 ssh2
Jul 12 22:05:01 dev0-dcde-rnet sshd[3966]: Failed password for root from 220.120.106.254 port 52656 ssh2

19/7/12@16:04:54: FAIL: Alarm-Intrusion address from=81.218.78.30
...

SSH invalid-user multiple login attempts

Jul 12 22:00:15 eventyay sshd[32033]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.213.63.120
Jul 12 22:00:17 eventyay sshd[32033]: Failed password for invalid user fa from 129.213.63.120 port 48260 ssh2
Jul 12 22:05:11 eventyay sshd[858]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.213.63.120
...

Mar  8 21:18:03 vtv3 sshd\[11997\]: Invalid user ha from 111.231.75.83 port 60840
Mar  8 21:18:03 vtv3 sshd\[11997\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.75.83
Mar  8 21:18:06 vtv3 sshd\[11997\]: Failed password for invalid user ha from 111.231.75.83 port 60840 ssh2
Mar  8 21:26:38 vtv3 sshd\[15418\]: Invalid user jj from 111.231.75.83 port 33636
Mar  8 21:26:38 vtv3 sshd\[15418\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.75.83
Mar 22 23:32:45 vtv3 sshd\[20153\]: Invalid user jz from 111.231.75.83 port 47686
Mar 22 23:32:45 vtv3 sshd\[20153\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.75.83
Mar 22 23:32:46 vtv3 sshd\[20153\]: Failed password for invalid user jz from 111.231.75.83 port 47686 ssh2
Mar 22 23:40:57 vtv3 sshd\[23662\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.75.83

Lines containing failures of 14.116.35.25
Jul 13 00:59:49 shared11 sshd[5480]: Invalid user support from 14.116.35.25 port 58786
Jul 13 00:59:49 shared11 sshd[5480]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.116.35.25
Jul 13 00:59:51 shared11 sshd[5480]: Failed password for invalid user support from 14.116.35.25 port 58786 ssh2


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=14.116.35.25

Attempt to log in with non-existing username "admin" /wp-login.php

$f2bV_matches