SSH Brute-Forcing (server1)

IP was detected trying to Brute-Force SSH, FTP, Web Apps, Port-Scan or Hacking.

2020-04-03 22:58:44 H=(OlczDkCxW5) [114.231.8.105]:3344 I=[192.147.25.65]:25 F= rejected RCPT <1761573796@qq.com>: RBL: found in thrukfz5b56tq6xao6odgdyjrq.zen.dq.spamhaus.net (127.0.0.11, 127.0.0.4, 127.0.0.3) (https://www.spamhaus.org/sbl/query/SBLCSS)
2020-04-03 22:58:51 dovecot_login authenticator failed for (bFygJhWIB) [114.231.8.105]:1627 I=[192.147.25.65]:25: 535 Incorrect authentication data (set_id=abuse@lerctr.org)
2020-04-03 22:59:01 dovecot_login authenticator failed for (RSQ6ej) [114.231.8.105]:4302 I=[192.147.25.65]:25: 535 Incorrect authentication data (set_id=abuse@lerctr.org)
...

Unauthorized connection attempt detected from IP address 66.240.205.34 to port 4664 [T]

Apr  4 06:17:57 mintao sshd\[30797\]: Invalid user ubnt from 45.67.15.137\
Apr  4 06:17:58 mintao sshd\[30801\]: Invalid user admin from 45.67.15.137\

Apr  4 06:51:01 www4 sshd\[46308\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.102.250.71  user=root
Apr  4 06:51:04 www4 sshd\[46308\]: Failed password for root from 113.102.250.71 port 28723 ssh2
Apr  4 06:58:44 www4 sshd\[46895\]: Invalid user lijiulong from 113.102.250.71
...

" "

Apr  4 06:27:15 vps647732 sshd[11009]: Failed password for root from 165.227.55.56 port 59928 ssh2
...

ssh bruteforce

Apr  4 07:11:35 hosting sshd[13902]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.227.5.149  user=root
Apr  4 07:11:37 hosting sshd[13902]: Failed password for root from 165.227.5.149 port 41158 ssh2
Apr  4 07:14:41 hosting sshd[14189]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.227.5.149  user=root
Apr  4 07:14:43 hosting sshd[14189]: Failed password for root from 165.227.5.149 port 37888 ssh2
...

Apr  4 06:37:35 srv01 sshd[1853]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.91.102  user=root
Apr  4 06:37:37 srv01 sshd[1853]: Failed password for root from 106.12.91.102 port 60532 ssh2
Apr  4 06:42:09 srv01 sshd[7142]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.91.102  user=root
Apr  4 06:42:11 srv01 sshd[7142]: Failed password for root from 106.12.91.102 port 59664 ssh2
Apr  4 06:47:00 srv01 sshd[7557]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.91.102  user=root
Apr  4 06:47:02 srv01 sshd[7557]: Failed password for root from 106.12.91.102 port 58796 ssh2
...

Too many connections or unauthorized access detected from Arctic banned ip

fail2ban/Apr  4 05:55:09 h1962932 sshd[27758]: Invalid user wftuser from 51.77.220.183 port 45210
Apr  4 05:55:09 h1962932 sshd[27758]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.ip-51-77-220.eu
Apr  4 05:55:09 h1962932 sshd[27758]: Invalid user wftuser from 51.77.220.183 port 45210
Apr  4 05:55:11 h1962932 sshd[27758]: Failed password for invalid user wftuser from 51.77.220.183 port 45210 ssh2
Apr  4 05:59:15 h1962932 sshd[27889]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.ip-51-77-220.eu  user=root
Apr  4 05:59:17 h1962932 sshd[27889]: Failed password for root from 51.77.220.183 port 32876 ssh2

2020-04-04T05:55:27.479988librenms sshd[4656]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.198.110.205  user=root
2020-04-04T05:55:29.073618librenms sshd[4656]: Failed password for root from 94.198.110.205 port 33810 ssh2
2020-04-04T05:59:12.362837librenms sshd[4720]: Invalid user wu from 94.198.110.205 port 38452
...

Apr  4 05:56:09 vpn01 sshd[32603]: Failed password for root from 110.166.87.248 port 39472 ssh2
...