Log triage 200 pts · Medium

An auth.log excerpt from a bastion host. Which source address brute-forced its way in?

Sep  3 02:14:07 bastion sshd[2201]: Failed password for root from 198.51.100.17 port 51022 ssh2
Sep  3 02:14:09 bastion sshd[2201]: Failed password for root from 198.51.100.17 port 51022 ssh2
Sep  3 02:16:31 bastion sshd[2210]: Failed password for invalid user admin from 203.0.113.42 port 44120 ssh2
Sep  3 02:16:33 bastion sshd[2210]: Failed password for invalid user admin from 203.0.113.42 port 44120 ssh2
Sep  3 02:16:35 bastion sshd[2212]: Failed password for deploy from 203.0.113.42 port 44121 ssh2
Sep  3 02:16:38 bastion sshd[2212]: Failed password for deploy from 203.0.113.42 port 44121 ssh2
Sep  3 02:16:40 bastion sshd[2214]: Failed password for deploy from 203.0.113.42 port 44122 ssh2
Sep  3 02:16:44 bastion sshd[2214]: Accepted password for deploy from 203.0.113.42 port 44122 ssh2
Sep  3 02:16:44 bastion sshd[2214]: pam_unix(sshd:session): session opened for user deploy
Sep  3 02:20:02 bastion sshd[2230]: Accepted publickey for ops from 192.0.2.8 port 60110 ssh2
Sep  3 02:31:15 bastion sshd[2241]: Failed password for root from 198.51.100.17 port 51890 ssh2

Flag format: dbse{IP_with_dots_as_underscores}, for example dbse{192_0_2_1}.