2019-11-13T05:08:51.338200hub.schaetter.us sshd\[16968\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.173.154  user=root
2019-11-13T05:08:53.421318hub.schaetter.us sshd\[16968\]: Failed password for root from 222.186.173.154 port 24820 ssh2
2019-11-13T05:08:56.486240hub.schaetter.us sshd\[16968\]: Failed password for root from 222.186.173.154 port 24820 ssh2
2019-11-13T05:08:59.966986hub.schaetter.us sshd\[16968\]: Failed password for root from 222.186.173.154 port 24820 ssh2
2019-11-13T05:09:03.329834hub.schaetter.us sshd\[16968\]: Failed password for root from 222.186.173.154 port 24820 ssh2
...

2019-11-13T05:59:19.4572441240 sshd\[2593\]: Invalid user nobutomo from 123.30.249.104 port 49610
2019-11-13T05:59:19.4601291240 sshd\[2593\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.30.249.104
2019-11-13T05:59:21.3479161240 sshd\[2593\]: Failed password for invalid user nobutomo from 123.30.249.104 port 49610 ssh2
...

$f2bV_matches

2019-11-13T06:25:25.060663+01:00 lumpi kernel: [3445101.176897] INPUT:DROP:SPAMHAUS_EDROP:IN=eth0 OUT= MAC=52:54:a2:01:a5:04:d2:74:7f:6e:37:e3:08:00 SRC=81.22.45.115 DST=172.31.1.100 LEN=40 TOS=0x00 PREC=0x00 TTL=244 ID=27831 PROTO=TCP SPT=40293 DPT=584 WINDOW=1024 RES=0x00 SYN URGP=0 
...

Nov 12 19:10:57 wbs sshd\[25663\]: Invalid user server from 223.171.32.56
Nov 12 19:10:57 wbs sshd\[25663\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=223.171.32.56
Nov 12 19:10:59 wbs sshd\[25663\]: Failed password for invalid user server from 223.171.32.56 port 23893 ssh2
Nov 12 19:14:55 wbs sshd\[25990\]: Invalid user merical from 223.171.32.56
Nov 12 19:14:55 wbs sshd\[25990\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=223.171.32.56

Nov 13 05:58:27 ns41 sshd[7014]: Failed password for root from 138.68.4.198 port 57616 ssh2
Nov 13 05:58:27 ns41 sshd[7014]: Failed password for root from 138.68.4.198 port 57616 ssh2

Nov 13 06:06:31 MK-Soft-VM8 sshd[15361]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=197.253.6.249 
Nov 13 06:06:33 MK-Soft-VM8 sshd[15361]: Failed password for invalid user asterisk from 197.253.6.249 port 43359 ssh2
...

Nov 13 10:06:45 gw1 sshd[4494]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.205.202.35
Nov 13 10:06:47 gw1 sshd[4494]: Failed password for invalid user garaia from 200.205.202.35 port 54508 ssh2
...

Nov 13 05:59:08 srv1 sshd[29805]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.176.136.101
Nov 13 05:59:09 srv1 sshd[29805]: Failed password for invalid user test from 117.176.136.101 port 44490 ssh2
...

Automatic report - Port Scan Attack

2019-11-13 H=185-226-113-180.broadband.tenet.odessa.ua \[185.226.113.180\] F=\ rejected RCPT \: Mail not accepted. 185.226.113.180 is listed at a DNSBL.
2019-11-13 H=185-226-113-180.broadband.tenet.odessa.ua \[185.226.113.180\] F=\ rejected RCPT \: Mail not accepted. 185.226.113.180 is listed at a DNSBL.
2019-11-13 H=185-226-113-180.broadband.tenet.odessa.ua \[185.226.113.180\] F=\ rejected RCPT \: Mail not accepted. 185.226.113.180 is listed at a DNSBL.

IP Ban Report :  
 https://help-dysk.pl/wordpress-firewall-plugins/ip/185.52.67.126/ 
 
 IT - 1H : (8)  
 Protection Against DDoS WordPress plugin :  
 "odzyskiwanie danych help-dysk" 
 IP Address Ranges by Country : IT 
 NAME ASN : ASN202146 
 
 IP : 185.52.67.126 
 
 CIDR : 185.52.67.0/24 
 
 PREFIX COUNT : 4 
 
 UNIQUE IP COUNT : 1024 
 
 
 ATTACKS DETECTED ASN202146 :  
  1H - 1 
  3H - 1 
  6H - 1 
 12H - 1 
 24H - 1 
 
 DateTime : 2019-11-13 05:59:22 
 
 INFO : Port Scan TELNET Detected and Blocked by ADMIN  - data recovery

Nov 13 06:20:22 dedicated sshd[24419]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.49.202  user=root
Nov 13 06:20:24 dedicated sshd[24419]: Failed password for root from 142.93.49.202 port 35494 ssh2

Automatic report - Port Scan Attack

Unauthorised access (Nov 13) SRC=59.144.167.142 LEN=52 TTL=116 ID=13218 DF TCP DPT=445 WINDOW=8192 SYN