2020-03-06T05:11:10.432197shield sshd\[29280\]: Invalid user mother from 139.155.127.59 port 37636
2020-03-06T05:11:10.438602shield sshd\[29280\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.155.127.59
2020-03-06T05:11:11.801635shield sshd\[29280\]: Failed password for invalid user mother from 139.155.127.59 port 37636 ssh2
2020-03-06T05:12:41.230527shield sshd\[29522\]: Invalid user admin from 139.155.127.59 port 54500
2020-03-06T05:12:41.239073shield sshd\[29522\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.155.127.59

Mar  6 09:24:00 nextcloud sshd\[30536\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.21.218  user=root
Mar  6 09:24:01 nextcloud sshd\[30536\]: Failed password for root from 138.197.21.218 port 41630 ssh2
Mar  6 09:29:48 nextcloud sshd\[5569\]: Invalid user git from 138.197.21.218
Mar  6 09:29:48 nextcloud sshd\[5569\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.21.218

LGS,WP GET /wp-login.php
GET /wp-login.php

Mar  6 08:00:16 server sshd\[29908\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=bourree.fr 
Mar  6 08:00:17 server sshd\[29908\]: Failed password for invalid user cftest from 164.132.46.197 port 58320 ssh2
Mar  6 14:02:58 server sshd\[26261\]: Invalid user freeswitch from 164.132.46.197
Mar  6 14:02:58 server sshd\[26261\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=bourree.fr 
Mar  6 14:03:00 server sshd\[26261\]: Failed password for invalid user freeswitch from 164.132.46.197 port 54796 ssh2
...

$f2bV_matches

Mar  5 20:47:31 web1 sshd\[3109\]: Invalid user lichaonan from 180.76.133.14
Mar  5 20:47:31 web1 sshd\[3109\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.133.14
Mar  5 20:47:32 web1 sshd\[3109\]: Failed password for invalid user lichaonan from 180.76.133.14 port 38490 ssh2
Mar  5 20:51:51 web1 sshd\[3473\]: Invalid user nisuser2 from 180.76.133.14
Mar  5 20:51:51 web1 sshd\[3473\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.133.14

Fail2Ban - SSH Bruteforce Attempt

[2020-03-06 07:05:14] NOTICE[1148] chan_sip.c: Registration from '' failed for '45.56.137.133:54000' - Wrong password
[2020-03-06 07:05:14] SECURITY[1163] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-03-06T07:05:14.838-0500",Severity="Error",Service="SIP",EventVersion="2",AccountID="2318",SessionID="0x7fd82c6c07b8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/45.56.137.133/54000",Challenge="7bdf22ab",ReceivedChallenge="7bdf22ab",ReceivedHash="120e6cd00885a9eea6bc5b72edb2cc26"
[2020-03-06 07:05:49] NOTICE[1148] chan_sip.c: Registration from '' failed for '45.56.137.133:49280' - Wrong password
[2020-03-06 07:05:49] SECURITY[1163] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-03-06T07:05:49.566-0500",Severity="Error",Service="SIP",EventVersion="2",AccountID="3121",SessionID="0x7fd82c6c07b8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/45.56.137.133
...

(sshd) Failed SSH login from 198.199.84.154 (US/United States/180128.cloudwaysapps.com): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Mar  6 11:17:47 amsweb01 sshd[22979]: Invalid user opensource from 198.199.84.154 port 39837
Mar  6 11:17:49 amsweb01 sshd[22979]: Failed password for invalid user opensource from 198.199.84.154 port 39837 ssh2
Mar  6 11:23:43 amsweb01 sshd[23609]: Invalid user ganhuaiyan from 198.199.84.154 port 53463
Mar  6 11:23:45 amsweb01 sshd[23609]: Failed password for invalid user ganhuaiyan from 198.199.84.154 port 53463 ssh2
Mar  6 11:27:56 amsweb01 sshd[23945]: Invalid user as-hadoop from 198.199.84.154 port 45228

Mar  6 13:24:07 MK-Soft-Root2 sshd[30124]: Failed password for root from 222.186.15.10 port 51847 ssh2
Mar  6 13:24:09 MK-Soft-Root2 sshd[30124]: Failed password for root from 222.186.15.10 port 51847 ssh2
...

SSH/22 MH Probe, BF, Hack -

2020-03-06T04:17:17.105527linuxbox-skyline sshd[158910]: Invalid user sandor from 31.184.252.166 port 59926
...

Automatic report - XMLRPC Attack

Mar  6 05:47:34 debian-2gb-nbg1-2 kernel: \[5729221.429952\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=89.220.207.242 DST=195.201.40.59 LEN=44 TOS=0x00 PREC=0x00 TTL=49 ID=19145 PROTO=TCP SPT=42366 DPT=37215 WINDOW=44150 RES=0x00 SYN URGP=0

SSH/22 MH Probe, BF, Hack -