Web bot pretended to be a good bot (identified based on gethostbyaddr)

Dec  5 10:54:44 sd-53420 sshd\[11478\]: Invalid user pi from 151.29.13.92
Dec  5 10:54:44 sd-53420 sshd\[11478\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=151.29.13.92
Dec  5 10:54:44 sd-53420 sshd\[11480\]: Invalid user pi from 151.29.13.92
Dec  5 10:54:44 sd-53420 sshd\[11480\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=151.29.13.92
Dec  5 10:54:46 sd-53420 sshd\[11478\]: Failed password for invalid user pi from 151.29.13.92 port 59730 ssh2
...

Dec  5 10:36:56 ns41 sshd[3363]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.113.157.155

Dec  5 07:12:25 sshd: Connection from 94.191.41.77 port 55874
Dec  5 07:12:27 sshd: Invalid user ssh from 94.191.41.77
Dec  5 07:12:27 sshd: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.191.41.77
Dec  5 07:12:28 sshd: Failed password for invalid user ssh from 94.191.41.77 port 55874 ssh2
Dec  5 07:12:29 sshd: Received disconnect from 94.191.41.77: 11: Bye Bye [preauth]

Dec  5 07:27:11 smtp postfix/smtpd[63394]: NOQUEUE: reject: RCPT from wren.jcnovel.com[63.81.87.156]: 554 5.7.1 Service unavailable; Client host [63.81.87.156] blocked using zen.spamhaus.org; https://www.spamhaus.org/sbl/query/SBLCSS; from= to= proto=ESMTP helo=
...

Dec  5 00:28:56 auw2 sshd\[14105\]: Invalid user dzulkarnain from 157.245.98.160
Dec  5 00:28:56 auw2 sshd\[14105\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.98.160
Dec  5 00:28:58 auw2 sshd\[14105\]: Failed password for invalid user dzulkarnain from 157.245.98.160 port 60276 ssh2
Dec  5 00:35:15 auw2 sshd\[14754\]: Invalid user chia-hua from 157.245.98.160
Dec  5 00:35:15 auw2 sshd\[14754\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.98.160

2019-12-05T10:46:40.807383shield sshd\[29352\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.111.249.133  user=root
2019-12-05T10:46:43.538319shield sshd\[29352\]: Failed password for root from 190.111.249.133 port 59226 ssh2
2019-12-05T10:53:34.572433shield sshd\[30830\]: Invalid user nikolopoulos from 190.111.249.133 port 41558
2019-12-05T10:53:34.577794shield sshd\[30830\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.111.249.133
2019-12-05T10:53:36.807142shield sshd\[30830\]: Failed password for invalid user nikolopoulos from 190.111.249.133 port 41558 ssh2

Dec  5 11:26:46 MK-Soft-VM4 sshd[13374]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=35.222.214.146 
Dec  5 11:26:49 MK-Soft-VM4 sshd[13374]: Failed password for invalid user nidecker from 35.222.214.146 port 53212 ssh2
...

Dec  5 16:08:12 gw1 sshd[9938]: Failed password for root from 195.58.123.109 port 40788 ssh2
...

Dec  5 12:48:07 sauna sshd[98571]: Failed password for backup from 107.13.186.21 port 51826 ssh2
...

Dec  5 11:40:51 lnxded63 sshd[23300]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=163.47.214.158
Dec  5 11:40:53 lnxded63 sshd[23300]: Failed password for invalid user yaliz from 163.47.214.158 port 47318 ssh2
Dec  5 11:47:23 lnxded63 sshd[23744]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=163.47.214.158

" "

Dec  5 11:56:28 vps647732 sshd[5109]: Failed password for root from 180.111.132.101 port 20241 ssh2
Dec  5 12:04:15 vps647732 sshd[5324]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.111.132.101
...

web-1 [ssh] SSH Attack

2019-12-05T09:42:07Z - RDP login failed multiple times. (157.245.177.154)