BEGIN{FS="from[[:space:]]+|[[:space:]]+port"} $2~/^[0-9]{1,3}(\.[0-9]{1,3}){3}$/{print $2}

QkVHSU57RlM9ImZyb21bWzpzcGFjZTpdXSt8W1s6c3BhY2U6XV0rcG9ydCJ9ICQyfi9eWzAtOV17MSwzfShcLlswLTldezEsM30pezN9JC97cHJpbnQgJDJ9

T2N0ICA5IDIyOjQ1OjQ4IGlwLTE3Mi0yNi0xNC0yMyBzc2hkWzE4MDgwXTogRGlzY29ubmVjdGVkIGZyb20gMzQuMTAxLjI1MS44MiBwb3J0IDU5MzQ0IFtwcmVhdXRoXQpPY3QgIDkgMjI6NDY6NDEgaXAtMTcyLTI2LTE0LTIzIHNzaGRbMTgwODJdOiBEaWQgbm90IHJlY2VpdmUgaWRlbnRpZmljYXRpb24gc3RyaW5nIGZyb20gMjA5LjE3Ljk3LjE4IHBvcnQgNjQ1NTAKT2N0ICA5IDIyOjQ3OjIzIGlwLTE3Mi0yNi0xNC0yMyBzc2hkWzE4MDgzXTogQ29ubmVjdGlvbiBjbG9zZWQgYnkgNzQuMTIwLjE0LjUyIHBvcnQgNDQ1NzggW3ByZWF1dGhdCk9jdCAgOSAyMjo1NDowMyBpcC0xNzItMjYtMTQtMjMgc3NoZFsxODA4OF06IEludmFsaWQgdXNlciBjaXNjbyBmcm9tIDEwNi4xMy4yMzMuNSBwb3J0IDQ0MTgwCk9jdCAgOSAyMjo1NDowMyBpcC0xNzItMjYtMTQtMjMgc3NoZFsxODA4OF06IGlucHV0X3VzZXJhdXRoX3JlcXVlc3Q6IGludmFsaWQgdXNlciBjaXNjbyBbcHJlYXV0aF0KT2N0ICA5IDIyOjU0OjAzIGlwLTE3Mi0yNi0xNC0yMyBzc2hkWzE4MDg4XTogUmVjZWl2ZWQgZGlzY29ubmVjdCBmcm9tIDEwNi4xMy4yMzMuNSBwb3J0IDQ0MTgwOjExOiBCeWUgQnllIFtwcmVhdXRoXQpPY3QgIDkgMjI6NTQ6MDMgaXAtMTcyLTI2LTE0LTIzIHNzaGRbMTgwODhdOiBEaXNjb25uZWN0ZWQgZnJvbSAxMDYuMTMuMjMzLjUgcG9ydCA0NDE4MCBbcHJlYXV0aF0KT2N0ICA5IDIyOjU2OjUzIGlwLTE3Mi0yNi0xNC0yMyBzc2hkWzE4MDkwXTogcmV2ZXJzZSBtYXBwaW5nIGNoZWNraW5nIGdldGFkZHJpbmZvIGZvciByZWFpYS50dW1ibGxlcy5jb20gWzE0MS45OC45LjMyXSBmYWlsZWQgLSBQT1NTSUJMRSBCUkVBSy1JTiBBVFRFTVBUIQpPY3QgIDkgMjI6NTY6NTQgaXAtMTcyLTI2LTE0LTIzIHNzaGRbMTgwOTBdOiBDb25uZWN0aW9uIGNsb3NlZCBieSAxNDEuOTguOS4zMiBwb3J0IDM0NTM3IFtwcmVhdXRoXQpPY3QgIDkgMjI6NTY6NTcgaXAtMTcyLTI2LTE0LTIzIHNzaGRbMTgwOTJdOiByZXZlcnNlIG1hcHBpbmcgY2hlY2tpbmcgZ2V0YWRkcmluZm8gZm9yIGtlaS50dW1ibGxlcy5jb20gWzE0MS45OC45LjMzXSBmYWlsZWQgLSBQT1NTSUJMRSBCUkVBSy1JTiBBVFRFTVBUIQ==

Oct  9 22:45:48 ip-172-26-14-23 sshd[18080]: Disconnected from 34.101.251.82 port 59344 [preauth]
Oct  9 22:46:41 ip-172-26-14-23 sshd[18082]: Did not receive identification string from 209.17.97.18 port 64550
Oct  9 22:47:23 ip-172-26-14-23 sshd[18083]: Connection closed by 74.120.14.52 port 44578 [preauth]
Oct  9 22:54:03 ip-172-26-14-23 sshd[18088]: Invalid user cisco from 106.13.233.5 port 44180
Oct  9 22:54:03 ip-172-26-14-23 sshd[18088]: input_userauth_request: invalid user cisco [preauth]
Oct  9 22:54:03 ip-172-26-14-23 sshd[18088]: Received disconnect from 106.13.233.5 port 44180:11: Bye Bye [preauth]
Oct  9 22:54:03 ip-172-26-14-23 sshd[18088]: Disconnected from 106.13.233.5 port 44180 [preauth]
Oct  9 22:56:53 ip-172-26-14-23 sshd[18090]: reverse mapping checking getaddrinfo for reaia.tumblles.com [141.98.9.32] failed - POSSIBLE BREAK-IN ATTEMPT!
Oct  9 22:56:54 ip-172-26-14-23 sshd[18090]: Connection closed by 141.98.9.32 port 34537 [preauth]
Oct  9 22:56:57 ip-172-26-14-23 sshd[18092]: reverse mapping checking getaddrinfo for kei.tumblles.com [141.98.9.33] failed - POSSIBLE BREAK-IN ATTEMPT!