May 30 12:10:32 marvibiene sshd[14486]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.159.154.204  user=root
May 30 12:10:33 marvibiene sshd[14486]: Failed password for root from 201.159.154.204 port 36247 ssh2
May 30 12:13:24 marvibiene sshd[14490]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.159.154.204  user=root
May 30 12:13:26 marvibiene sshd[14490]: Failed password for root from 201.159.154.204 port 6250 ssh2
...

"Unauthorized connection attempt on SSHD detected"

May 16 21:09:16 game-panel sshd[15905]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.159.154.204
May 16 21:09:18 game-panel sshd[15905]: Failed password for invalid user admin from 201.159.154.204 port 2844 ssh2
May 16 21:14:04 game-panel sshd[16134]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.159.154.204

2020-04-27T13:53:33.773863sd-86998 sshd[11184]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.159.154.204  user=root
2020-04-27T13:53:35.406223sd-86998 sshd[11184]: Failed password for root from 201.159.154.204 port 1847 ssh2
2020-04-27T13:56:53.688983sd-86998 sshd[11507]: Invalid user lm from 201.159.154.204 port 20851
2020-04-27T13:56:53.694496sd-86998 sshd[11507]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.159.154.204
2020-04-27T13:56:53.688983sd-86998 sshd[11507]: Invalid user lm from 201.159.154.204 port 20851
2020-04-27T13:56:55.452054sd-86998 sshd[11507]: Failed password for invalid user lm from 201.159.154.204 port 20851 ssh2
...

SSH brute force attempt

Automatic report - Port Scan Attack

port scan and connect, tcp 23 (telnet)

Unauthorized connection attempt detected from IP address 201.159.153.127 to port 23 [J]

slow and persistent scanner

Automatic report - Banned IP Access

Dec 13 13:09:56 linuxvps sshd\[12265\]: Invalid user yoyo from 201.159.154.204
Dec 13 13:09:56 linuxvps sshd\[12265\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.159.154.204
Dec 13 13:09:58 linuxvps sshd\[12265\]: Failed password for invalid user yoyo from 201.159.154.204 port 15319 ssh2
Dec 13 13:17:29 linuxvps sshd\[16631\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.159.154.204  user=root
Dec 13 13:17:31 linuxvps sshd\[16631\]: Failed password for root from 201.159.154.204 port 17880 ssh2

Dec  8 20:23:33 zeus sshd[28326]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.159.154.204 
Dec  8 20:23:35 zeus sshd[28326]: Failed password for invalid user www from 201.159.154.204 port 45295 ssh2
Dec  8 20:31:02 zeus sshd[28606]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.159.154.204 
Dec  8 20:31:04 zeus sshd[28606]: Failed password for invalid user dmanager2 from 201.159.154.204 port 56918 ssh2

Dec  7 11:33:23 hcbbdb sshd\[1725\]: Invalid user erlbacher from 201.159.154.204
Dec  7 11:33:23 hcbbdb sshd\[1725\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.159.154.204
Dec  7 11:33:25 hcbbdb sshd\[1725\]: Failed password for invalid user erlbacher from 201.159.154.204 port 54516 ssh2
Dec  7 11:41:05 hcbbdb sshd\[2637\]: Invalid user nobody6666 from 201.159.154.204
Dec  7 11:41:05 hcbbdb sshd\[2637\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.159.154.204

Dec  4 11:52:02 areeb-Workstation sshd[30548]: Failed password for root from 201.159.154.204 port 62985 ssh2
Dec  4 12:00:19 areeb-Workstation sshd[31140]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.159.154.204 
...

Dec  2 19:13:02 php1 sshd\[2155\]: Invalid user erh from 201.159.154.204
Dec  2 19:13:02 php1 sshd\[2155\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.159.154.204
Dec  2 19:13:04 php1 sshd\[2155\]: Failed password for invalid user erh from 201.159.154.204 port 49443 ssh2
Dec  2 19:21:18 php1 sshd\[2969\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.159.154.204  user=root
Dec  2 19:21:20 php1 sshd\[2969\]: Failed password for root from 201.159.154.204 port 39777 ssh2

Oct  1 19:33:18 vps647732 sshd[32734]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=171.244.140.174
Oct  1 19:33:20 vps647732 sshd[32734]: Failed password for invalid user vboxsf from 171.244.140.174 port 44214 ssh2
...

$f2bV_matches

2019-10-01T17:24:05.112385abusebot-8.cloudsearch.cf sshd\[8644\]: Invalid user umountfsys from 104.131.91.148 port 53940

2019-10-0114:13:281iFH1z-0007Ec-QH\<=info@imsuisse-sa.chH=\(imsuisse-sa.ch\)[106.209.152.140]:10292P=esmtpsaX=TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256CV=noA=dovecot_plain:info@imsuisse-sa.chS=2105id=6036D636-BC08-468B-BA11-714F80326330@imsuisse-sa.chT=""forshysmile88@yahoo.comsitstill2000@yahoo.comslundy47@yahoo.comsmileymac16@aol.comsoosbednbreakfast@alaska.comthomasninan@juno.com2019-10-0114:13:321iFH24-0007GG-1l\<=info@imsuisse-sa.chH=\(imsuisse-sa.ch\)[154.121.26.237]:12753P=esmtpsaX=TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256CV=noA=dovecot_plain:info@imsuisse-sa.chS=2050id=92603003-68FE-40AE-BBE3-622D7E99EBFE@imsuisse-sa.chT=""forvictoria_l_stull@msn.comsyeung@rubiconproject.com2019-10-0114:13:341iFH24-0007EJ-TT\<=info@imsuisse-sa.chH=\(imsuisse-sa.ch\)[157.39.83.216]:53267P=esmtpsaX=TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256CV=noA=dovecot_plain:info@imsuisse-sa.chS=2404id=0C10C69B-15D3-4CB2-B38F-ADD65588F41B@imsuisse-sa.chT=""foremmadarby10@yahoo.co.ukgillgoddard20@btinternet.comjacqui_keyworth@sky.comjil

2019-10-0114:13:251iFH1w-0007Ac-QS\<=info@imsuisse-sa.chH=\(imsuisse-sa.ch\)[1.38.181.4]:41145P=esmtpsaX=TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256CV=noA=dovecot_plain:info@imsuisse-sa.chS=2151id=A8832AC4-30A5-4FCC-B99D-0E3AAA1FB188@imsuisse-sa.chT=""forjan.zimmerman@honeywell.comjanet.lovely@patriot-consulting.comJasmine.Donnell@nationstarmail.comjaymelee@comcast.netjcady@aglresources.com2019-10-0114:13:261iFH1x-0007Cd-71\<=info@imsuisse-sa.chH=\(imsuisse-sa.ch\)[45.116.232.60]:62375P=esmtpsaX=TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256CV=noA=dovecot_plain:info@imsuisse-sa.chS=2757id=FD2DFD47-54A8-4B4F-B6CB-D9CC2E40781E@imsuisse-sa.chT=""forangel_m2468@yahoo.comjessmarangel@hotmail.comj7671@hotmail.comLittlestrauss@aol.comsuperstarsimo60@aol.combitzyboo16@live.com2019-10-0114:13:211iFH1r-00078n-Vv\<=info@imsuisse-sa.chH=\(imsuisse-sa.ch\)[202.134.9.131]:31296P=esmtpsaX=TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256CV=noA=dovecot_plain:info@imsuisse-sa.chS=2249id=2F568067-D02C-451B-B08E-B14B1C1851D8@imsuisse-sa.chT="\

Lines containing failures of 180.76.142.91 (max 1000)
Sep 30 10:10:16 localhost sshd[3307]: User nobody from 180.76.142.91 not allowed because none of user's groups are listed in AllowGroups
Sep 30 10:10:16 localhost sshd[3307]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.142.91  user=nobody
Sep 30 10:10:19 localhost sshd[3307]: Failed password for invalid user nobody from 180.76.142.91 port 39706 ssh2
Sep 30 10:10:21 localhost sshd[3307]: Received disconnect from 180.76.142.91 port 39706:11: Bye Bye [preauth]
Sep 30 10:10:21 localhost sshd[3307]: Disconnected from invalid user nobody 180.76.142.91 port 39706 [preauth]
Sep 30 10:31:06 localhost sshd[7062]: Invalid user test from 180.76.142.91 port 59424
Sep 30 10:31:06 localhost sshd[7062]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.142.91 
Sep 30 10:31:07 localhost sshd[7062]: Failed password for invalid user test from........
------------------------------

Unauthorised access (Oct  1) SRC=222.211.180.250 LEN=40 TOS=0x10 PREC=0x40 TTL=49 ID=51936 TCP DPT=8080 WINDOW=43567 SYN 
Unauthorised access (Oct  1) SRC=222.211.180.250 LEN=40 TOS=0x10 PREC=0x40 TTL=49 ID=43399 TCP DPT=8080 WINDOW=43567 SYN 
Unauthorised access (Sep 30) SRC=222.211.180.250 LEN=40 TOS=0x10 PREC=0x40 TTL=49 ID=48564 TCP DPT=8080 WINDOW=43567 SYN

Automated reporting of FTP Brute Force

Automated reporting of FTP Brute Force

2019-10-0114:13:141iFH1k-00075p-Sb\<=info@imsuisse-sa.chH=\(imsuisse-sa.ch\)[157.51.224.144]:39520P=esmtpsaX=TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256CV=noA=dovecot_plain:info@imsuisse-sa.chS=2760id=3E0B6C95-C159-48C6-B89E-DE9126DB6C45@imsuisse-sa.chT=""foradw@loveheartland.comAmandaRudd33@yahoo.comkeith.bish@verizon.netnellees@verizon.netsarcuri73@msn.comashley.viviano@dcsg.comjatkins@rue21.comangelababich@me.comkbattaglia@zoominternet.netdjbeck123@comcast.netlbelko@mac.comTash407@aol.comchtqua@zoominternet.netpamntim@pghmail.comchelsea_rabold@yahoo.comcanzian@zoominternet.netbeth.carroll@dcsg.com2019-10-0114:13:141iFH1m-000796-Cq\<=info@imsuisse-sa.chH=\(imsuisse-sa.ch\)[196.64.117.203]:56095P=esmtpsaX=TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256CV=noA=dovecot_plain:info@imsuisse-sa.chS=2434id=20910BC1-FB5C-4F86-BA5A-64FCF9372E5D@imsuisse-sa.chT=""forlhunter@brg.comlibbygonyea@yahoo.comlibsen@tescharlotte.orglizzyrust@bellsouth.netljdougnc@yahoo.comljhedrick@carolina.rr.com2019-10-0114:13:161iFH1n-00076Q-DD\<=

Postfix-smtpd

Oct  1 14:13:12 apollo sshd\[3824\]: Invalid user temp from 128.199.90.245Oct  1 14:13:14 apollo sshd\[3824\]: Failed password for invalid user temp from 128.199.90.245 port 45466 ssh2Oct  1 14:20:28 apollo sshd\[3846\]: Failed password for root from 128.199.90.245 port 40719 ssh2
...

Oct  1 19:09:23 rotator sshd\[1511\]: Failed password for root from 51.83.76.139 port 49678 ssh2Oct  1 19:09:25 rotator sshd\[1511\]: Failed password for root from 51.83.76.139 port 49678 ssh2Oct  1 19:09:27 rotator sshd\[1511\]: Failed password for root from 51.83.76.139 port 49678 ssh2Oct  1 19:09:30 rotator sshd\[1511\]: Failed password for root from 51.83.76.139 port 49678 ssh2Oct  1 19:09:33 rotator sshd\[1511\]: Failed password for root from 51.83.76.139 port 49678 ssh2Oct  1 19:09:36 rotator sshd\[1511\]: Failed password for root from 51.83.76.139 port 49678 ssh2
...

Oct  1 13:27:52 anodpoucpklekan sshd[58972]: Invalid user vdr from 42.115.221.40 port 35058
...

Oct  1 08:08:05 hanapaa sshd\[9320\]: Invalid user thman from 63.240.240.74
Oct  1 08:08:05 hanapaa sshd\[9320\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=63.240.240.74
Oct  1 08:08:07 hanapaa sshd\[9320\]: Failed password for invalid user thman from 63.240.240.74 port 60174 ssh2
Oct  1 08:11:51 hanapaa sshd\[9733\]: Invalid user zm from 63.240.240.74
Oct  1 08:11:51 hanapaa sshd\[9733\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=63.240.240.74