Oct 19 00:10:12 ns postfix/smtpd[93075]: NOQUEUE: reject: RCPT from 173-13-162-138-sfba.hfc.comcastbusiness.net[173.13.162.138]: 554 5.7.1 Service unavailable; Client host [173.13.162.138] blocked using bl.spamcop.net; Blocked - see https://www.spamcop.net/bl.shtml?173.13.162.138; from= to=<*@*> proto=ESMTP helo=

$f2bV_matches

2019-10-19T05:50:51.339027lon01.zurich-datacenter.net sshd\[15649\]: Invalid user tunnel from 163.172.93.133 port 44370
2019-10-19T05:50:51.346793lon01.zurich-datacenter.net sshd\[15649\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ftkey.g-1.less.bangkokbagels.com
2019-10-19T05:50:53.238948lon01.zurich-datacenter.net sshd\[15649\]: Failed password for invalid user tunnel from 163.172.93.133 port 44370 ssh2
2019-10-19T05:54:45.295933lon01.zurich-datacenter.net sshd\[15745\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ftkey.g-1.less.bangkokbagels.com  user=root
2019-10-19T05:54:47.645770lon01.zurich-datacenter.net sshd\[15745\]: Failed password for root from 163.172.93.133 port 55566 ssh2
...

Oct 16 21:11:02 rb06 sshd[5933]: Failed password for invalid user r.r1 from 118.126.65.207 port 49742 ssh2
Oct 16 21:11:02 rb06 sshd[5933]: Received disconnect from 118.126.65.207: 11: Bye Bye [preauth]
Oct 16 21:28:57 rb06 sshd[21951]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.126.65.207  user=r.r
Oct 16 21:28:59 rb06 sshd[21951]: Failed password for r.r from 118.126.65.207 port 42438 ssh2
Oct 16 21:28:59 rb06 sshd[21951]: Received disconnect from 118.126.65.207: 11: Bye Bye [preauth]
Oct 16 21:33:52 rb06 sshd[23671]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.126.65.207  user=r.r
Oct 16 21:33:54 rb06 sshd[23671]: Failed password for r.r from 118.126.65.207 port 54130 ssh2
Oct 16 21:33:54 rb06 sshd[23671]: Received disconnect from 118.126.65.207: 11: Bye Bye [preauth]
Oct 16 21:38:11 rb06 sshd[26789]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=........
-------------------------------

Oct 19 06:19:31 game-panel sshd[9508]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.209.72.144
Oct 19 06:19:33 game-panel sshd[9508]: Failed password for invalid user pi from 186.209.72.144 port 41928 ssh2
Oct 19 06:24:52 game-panel sshd[9695]: Failed password for root from 186.209.72.144 port 55880 ssh2

Brute force attempt

Oct 18 20:06:01 php1 sshd\[1514\]: Invalid user gaetan from 165.22.182.168
Oct 18 20:06:01 php1 sshd\[1514\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.182.168
Oct 18 20:06:03 php1 sshd\[1514\]: Failed password for invalid user gaetan from 165.22.182.168 port 38122 ssh2
Oct 18 20:09:45 php1 sshd\[1974\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.182.168  user=root
Oct 18 20:09:46 php1 sshd\[1974\]: Failed password for root from 165.22.182.168 port 49374 ssh2

2019-10-19T06:11:25.250242abusebot-5.cloudsearch.cf sshd\[32569\]: Invalid user test from 222.72.135.177 port 62164

0,17-02/31 [bc01/m60] PostRequest-Spammer scoring: Durban01

Oct 19 08:35:07 root sshd[13501]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.90.165.26 
Oct 19 08:35:09 root sshd[13501]: Failed password for invalid user bas from 116.90.165.26 port 53046 ssh2
Oct 19 08:39:42 root sshd[13579]: Failed password for root from 116.90.165.26 port 33362 ssh2
...

Fail2Ban Ban Triggered

2019-10-19T06:38:51.940761abusebot-5.cloudsearch.cf sshd\[454\]: Invalid user robert from 117.66.243.77 port 52158

Unauthorised access (Oct 19) SRC=49.48.242.170 LEN=52 TTL=111 ID=671 DF TCP DPT=445 WINDOW=8192 SYN

*Port Scan* detected from 162.243.158.198 (US/United States/-). 4 hits in the last 291 seconds

$f2bV_matches