SSH Brute-Force attacks

Invalid user ubuntu from 183.82.34.246 port 42308

SSH invalid-user multiple login attempts

2020-08-28T07:50:44.793573cyberdyne sshd[1659721]: Invalid user cvsuser from 65.49.223.231 port 44778
2020-08-28T07:50:44.799014cyberdyne sshd[1659721]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=65.49.223.231
2020-08-28T07:50:44.793573cyberdyne sshd[1659721]: Invalid user cvsuser from 65.49.223.231 port 44778
2020-08-28T07:50:47.065252cyberdyne sshd[1659721]: Failed password for invalid user cvsuser from 65.49.223.231 port 44778 ssh2
...

2020-08-28T07:25:11.703223mail.standpoint.com.ua sshd[10399]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.6.84.34
2020-08-28T07:25:11.700574mail.standpoint.com.ua sshd[10399]: Invalid user view from 116.6.84.34 port 31278
2020-08-28T07:25:13.631429mail.standpoint.com.ua sshd[10399]: Failed password for invalid user view from 116.6.84.34 port 31278 ssh2
2020-08-28T07:28:44.415593mail.standpoint.com.ua sshd[10902]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.6.84.34  user=root
2020-08-28T07:28:46.585080mail.standpoint.com.ua sshd[10902]: Failed password for root from 116.6.84.34 port 8908 ssh2
...

Aug 28 07:42:25 Ubuntu-1404-trusty-64-minimal sshd\[15998\]: Invalid user testftp from 119.181.19.21
Aug 28 07:42:25 Ubuntu-1404-trusty-64-minimal sshd\[15998\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.181.19.21
Aug 28 07:42:27 Ubuntu-1404-trusty-64-minimal sshd\[15998\]: Failed password for invalid user testftp from 119.181.19.21 port 60210 ssh2
Aug 28 07:49:36 Ubuntu-1404-trusty-64-minimal sshd\[20076\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.181.19.21  user=games
Aug 28 07:49:38 Ubuntu-1404-trusty-64-minimal sshd\[20076\]: Failed password for games from 119.181.19.21 port 44136 ssh2

2020-08-28T06:10:12.788017abusebot-7.cloudsearch.cf sshd[21789]: Invalid user test from 46.238.122.54 port 42351
2020-08-28T06:10:12.791975abusebot-7.cloudsearch.cf sshd[21789]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=e122-54.icpnet.pl
2020-08-28T06:10:12.788017abusebot-7.cloudsearch.cf sshd[21789]: Invalid user test from 46.238.122.54 port 42351
2020-08-28T06:10:14.737088abusebot-7.cloudsearch.cf sshd[21789]: Failed password for invalid user test from 46.238.122.54 port 42351 ssh2
2020-08-28T06:16:50.735181abusebot-7.cloudsearch.cf sshd[21859]: Invalid user lucy from 46.238.122.54 port 60623
2020-08-28T06:16:50.739173abusebot-7.cloudsearch.cf sshd[21859]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=e122-54.icpnet.pl
2020-08-28T06:16:50.735181abusebot-7.cloudsearch.cf sshd[21859]: Invalid user lucy from 46.238.122.54 port 60623
2020-08-28T06:16:52.990061abusebot-7.cloudsearch.cf sshd[21859]: Fai
...

Aug 28 04:10:17 vlre-nyc-1 sshd\[15321\]: Invalid user temp from 106.52.212.117
Aug 28 04:10:17 vlre-nyc-1 sshd\[15321\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.52.212.117
Aug 28 04:10:19 vlre-nyc-1 sshd\[15321\]: Failed password for invalid user temp from 106.52.212.117 port 33592 ssh2
Aug 28 04:12:39 vlre-nyc-1 sshd\[15371\]: Invalid user xk from 106.52.212.117
Aug 28 04:12:39 vlre-nyc-1 sshd\[15371\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.52.212.117
...

(sshd) Failed SSH login from 61.19.127.228 (TH/Thailand/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Aug 28 07:48:42 srv sshd[25839]: Invalid user brenda from 61.19.127.228 port 53894
Aug 28 07:48:44 srv sshd[25839]: Failed password for invalid user brenda from 61.19.127.228 port 53894 ssh2
Aug 28 07:52:48 srv sshd[25943]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.19.127.228  user=root
Aug 28 07:52:50 srv sshd[25943]: Failed password for root from 61.19.127.228 port 47702 ssh2
Aug 28 07:55:08 srv sshd[25990]: Invalid user vmc from 61.19.127.228 port 53330

Triggered by Fail2Ban at Ares web server

 TCP (SYN) 77.89.244.198:13579 -> port 23, len 44

(sshd) Failed SSH login from 23.129.64.187 (US/United States/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Aug 28 06:50:23 amsweb01 sshd[6824]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.129.64.187  user=root
Aug 28 06:50:25 amsweb01 sshd[6824]: Failed password for root from 23.129.64.187 port 42201 ssh2
Aug 28 06:50:27 amsweb01 sshd[6824]: Failed password for root from 23.129.64.187 port 42201 ssh2
Aug 28 06:50:30 amsweb01 sshd[6824]: Failed password for root from 23.129.64.187 port 42201 ssh2
Aug 28 06:50:32 amsweb01 sshd[6824]: Failed password for root from 23.129.64.187 port 42201 ssh2

Aug 28 03:53:35 scw-focused-cartwright sshd[30482]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.239.209.24
Aug 28 03:53:37 scw-focused-cartwright sshd[30482]: Failed password for invalid user squid from 117.239.209.24 port 33024 ssh2

Aug 28 07:05:14 buvik sshd[1280]: Invalid user sjj from 124.165.205.126
Aug 28 07:05:14 buvik sshd[1280]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=124.165.205.126
Aug 28 07:05:16 buvik sshd[1280]: Failed password for invalid user sjj from 124.165.205.126 port 55618 ssh2
...

Invalid user soporte from 217.14.211.216 port 45196