Dec 17 17:15:38 markkoudstaal sshd[17158]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.51.162.170
Dec 17 17:15:40 markkoudstaal sshd[17158]: Failed password for invalid user transfiguration from 49.51.162.170 port 51246 ssh2
Dec 17 17:21:10 markkoudstaal sshd[17752]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.51.162.170

$f2bV_matches

Dec 17 13:47:21 goofy sshd\[26113\]: Invalid user cown from 110.49.71.241
Dec 17 13:47:21 goofy sshd\[26113\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=110.49.71.241
Dec 17 13:47:23 goofy sshd\[26113\]: Failed password for invalid user cown from 110.49.71.241 port 45522 ssh2
Dec 17 14:22:24 goofy sshd\[28170\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=110.49.71.241  user=root
Dec 17 14:22:26 goofy sshd\[28170\]: Failed password for root from 110.49.71.241 port 50824 ssh2

Dec 17 15:22:33 sso sshd[9144]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.153.23.187
Dec 17 15:22:35 sso sshd[9144]: Failed password for invalid user vikhals from 36.153.23.187 port 36810 ssh2
...

MultiHost/MultiPort Probe, Scan, Hack -

Dec 13 11:34:03 vtv3 sshd[18139]: Failed password for invalid user ftpuser from 220.76.107.50 port 52768 ssh2
Dec 13 11:40:46 vtv3 sshd[21504]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=220.76.107.50 
Dec 13 11:54:00 vtv3 sshd[27812]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=220.76.107.50 
Dec 13 11:54:03 vtv3 sshd[27812]: Failed password for invalid user mysqldump from 220.76.107.50 port 58958 ssh2
Dec 13 12:00:53 vtv3 sshd[31697]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=220.76.107.50 
Dec 13 12:14:12 vtv3 sshd[5501]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=220.76.107.50 
Dec 13 12:14:14 vtv3 sshd[5501]: Failed password for invalid user juanangel from 220.76.107.50 port 57352 ssh2
Dec 13 12:21:11 vtv3 sshd[9023]: Failed password for root from 220.76.107.50 port 45304 ssh2
Dec 13 12:34:39 vtv3 sshd[15245]: pam_unix(sshd:aut

Dec 17 20:15:50 host sshd[40249]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.135  user=root
Dec 17 20:15:52 host sshd[40249]: Failed password for root from 218.92.0.135 port 11939 ssh2
...

SSH/22 MH Probe, BF, Hack -

second attack within an hour

Dec 17 15:15:42 mxgate1 postfix/postscreen[29220]: CONNECT from [196.189.56.34]:46438 to [176.31.12.44]:25
Dec 17 15:15:42 mxgate1 postfix/dnsblog[29437]: addr 196.189.56.34 listed by domain zen.spamhaus.org as 127.0.0.3
Dec 17 15:15:42 mxgate1 postfix/dnsblog[29437]: addr 196.189.56.34 listed by domain zen.spamhaus.org as 127.0.0.11
Dec 17 15:15:42 mxgate1 postfix/dnsblog[29437]: addr 196.189.56.34 listed by domain zen.spamhaus.org as 127.0.0.4
Dec 17 15:15:42 mxgate1 postfix/dnsblog[29435]: addr 196.189.56.34 listed by domain cbl.abuseat.org as 127.0.0.2
Dec 17 15:15:42 mxgate1 postfix/dnsblog[29434]: addr 196.189.56.34 listed by domain bl.spamcop.net as 127.0.0.2
Dec 17 15:15:42 mxgate1 postfix/dnsblog[29436]: addr 196.189.56.34 listed by domain b.barracudacentral.org as 127.0.0.2
Dec 17 15:15:48 mxgate1 postfix/postscreen[29220]: DNSBL rank 5 for [196.189.56.34]:46438
Dec x@x
Dec 17 15:15:49 mxgate1 postfix/postscreen[29220]: HANGUP after 0.78 from [196.189.56.34]:4........
-------------------------------

Dec 17 19:39:54 srv206 sshd[25676]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.184  user=root
Dec 17 19:39:56 srv206 sshd[25676]: Failed password for root from 218.92.0.184 port 14745 ssh2
Dec 17 19:39:59 srv206 sshd[25676]: Failed password for root from 218.92.0.184 port 14745 ssh2
Dec 17 19:39:54 srv206 sshd[25676]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.184  user=root
Dec 17 19:39:56 srv206 sshd[25676]: Failed password for root from 218.92.0.184 port 14745 ssh2
Dec 17 19:39:59 srv206 sshd[25676]: Failed password for root from 218.92.0.184 port 14745 ssh2
...

MultiHost/MultiPort Probe, Scan, Hack -

Dec 17 19:23:58 icinga sshd[15715]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.32.221.142
Dec 17 19:24:00 icinga sshd[15715]: Failed password for invalid user fa from 178.32.221.142 port 35936 ssh2
...

Lines containing failures of 178.122.220.25
Dec 17 15:17:26 shared11 sshd[19306]: Invalid user admin from 178.122.220.25 port 54380
Dec 17 15:17:26 shared11 sshd[19306]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.122.220.25
Dec 17 15:17:28 shared11 sshd[19306]: Failed password for invalid user admin from 178.122.220.25 port 54380 ssh2
Dec 17 15:17:28 shared11 sshd[19306]: Connection closed by invalid user admin 178.122.220.25 port 54380 [preauth]


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=178.122.220.25

Dec 17 15:22:22 grey postfix/smtpd\[16921\]: NOQUEUE: reject: RCPT from unknown\[103.119.229.33\]: 554 5.7.1 Service unavailable\; Client host \[103.119.229.33\] blocked using truncate.gbudb.net\; http://www.gbudb.com/truncate/ \[103.119.229.33\]\; from=\ to=\ proto=ESMTP helo=\<\[36.79.41.159\]\>
...