$f2bV_matches

(pop3d) Failed POP3 login from 85.17.4.145 (NL/Netherlands/hosted-by.Eqservers.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Aug  7 08:27:40 ir1 dovecot[3110802]: pop3-login: Disconnected (auth failed, 1 attempts in 2 secs): user=, method=PLAIN, rip=85.17.4.145, lip=5.63.12.44, session=

Unauthorised access (Aug  7) SRC=112.237.40.2 LEN=40 TTL=46 ID=39760 TCP DPT=8080 WINDOW=13194 SYN 
Unauthorised access (Aug  6) SRC=112.237.40.2 LEN=40 TTL=46 ID=47881 TCP DPT=8080 WINDOW=4010 SYN 
Unauthorised access (Aug  6) SRC=112.237.40.2 LEN=40 TTL=46 ID=45543 TCP DPT=8080 WINDOW=13194 SYN

2020-08-07T04:47:08.768827shield sshd\[23858\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.173.238  user=root
2020-08-07T04:47:11.311508shield sshd\[23858\]: Failed password for root from 222.186.173.238 port 10680 ssh2
2020-08-07T04:47:14.955385shield sshd\[23858\]: Failed password for root from 222.186.173.238 port 10680 ssh2
2020-08-07T04:47:17.838912shield sshd\[23858\]: Failed password for root from 222.186.173.238 port 10680 ssh2
2020-08-07T04:47:21.132224shield sshd\[23858\]: Failed password for root from 222.186.173.238 port 10680 ssh2

SSH Brute Force

2020-08-07T10:53:38.212584hostname sshd[9079]: Failed password for root from 163.44.169.18 port 44784 ssh2
2020-08-07T10:57:42.592688hostname sshd[10712]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=v163-44-169-18.a066.g.tyo1.static.cnode.io  user=root
2020-08-07T10:57:44.297195hostname sshd[10712]: Failed password for root from 163.44.169.18 port 55778 ssh2
...

Aug  7 06:50:33 vps639187 sshd\[15259\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.15.62  user=root
Aug  7 06:50:35 vps639187 sshd\[15259\]: Failed password for root from 222.186.15.62 port 31773 ssh2
Aug  7 06:50:38 vps639187 sshd\[15259\]: Failed password for root from 222.186.15.62 port 31773 ssh2
...

Aug  7 07:02:35 santamaria sshd\[13130\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.99.104.138  user=root
Aug  7 07:02:37 santamaria sshd\[13130\]: Failed password for root from 118.99.104.138 port 58750 ssh2
Aug  7 07:07:32 santamaria sshd\[13234\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.99.104.138  user=root
...

212.129.59.36 - - [07/Aug/2020:05:57:40 +0200] "POST /xmlrpc.php HTTP/1.1" 403 146 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
212.129.59.36 - - [07/Aug/2020:05:58:10 +0200] "POST /xmlrpc.php HTTP/1.1" 403 146 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
...

Port-scan: detected 342 distinct ports within a 24-hour window.

Aug 7 05:54:21 *hidden* sshd[28400]: Failed password for *hidden* from 37.59.224.39 port 51510 ssh2 Aug 7 05:57:54 *hidden* sshd[28839]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.59.224.39 user=root Aug 7 05:57:56 *hidden* sshd[28839]: Failed password for *hidden* from 37.59.224.39 port 55901 ssh2

2020-08-07T05:48:27.799403amanda2.illicoweb.com sshd\[2109\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.4.2.58  user=root
2020-08-07T05:48:30.638009amanda2.illicoweb.com sshd\[2109\]: Failed password for root from 189.4.2.58 port 55714 ssh2
2020-08-07T05:53:13.389110amanda2.illicoweb.com sshd\[3120\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.4.2.58  user=root
2020-08-07T05:53:15.490105amanda2.illicoweb.com sshd\[3120\]: Failed password for root from 189.4.2.58 port 42846 ssh2
2020-08-07T05:57:59.701302amanda2.illicoweb.com sshd\[4004\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.4.2.58  user=root
...

Aug  7 06:42:12 buvik sshd[16601]: Failed password for root from 218.92.0.220 port 42119 ssh2
Aug  7 06:42:15 buvik sshd[16601]: Failed password for root from 218.92.0.220 port 42119 ssh2
Aug  7 06:42:17 buvik sshd[16601]: Failed password for root from 218.92.0.220 port 42119 ssh2
...

detected by Fail2Ban

Lines containing failures of 206.253.167.195
Aug  7 05:33:02 kmh-wsh-001-nbg03 sshd[14541]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.253.167.195  user=r.r
Aug  7 05:33:04 kmh-wsh-001-nbg03 sshd[14541]: Failed password for r.r from 206.253.167.195 port 36780 ssh2
Aug  7 05:33:04 kmh-wsh-001-nbg03 sshd[14541]: Received disconnect from 206.253.167.195 port 36780:11: Bye Bye [preauth]
Aug  7 05:33:04 kmh-wsh-001-nbg03 sshd[14541]: Disconnected from authenticating user r.r 206.253.167.195 port 36780 [preauth]
Aug  7 05:46:38 kmh-wsh-001-nbg03 sshd[16085]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.253.167.195  user=r.r
Aug  7 05:46:41 kmh-wsh-001-nbg03 sshd[16085]: Failed password for r.r from 206.253.167.195 port 45762 ssh2
Aug  7 05:46:43 kmh-wsh-001-nbg03 sshd[16085]: Received disconnect from 206.253.167.195 port 45762:11: Bye Bye [preauth]
Aug  7 05:46:43 kmh-wsh-001-nbg03 ........
------------------------------