Honeypot attack, port: 445, PTR: static-170.nossaredetelecom.com.br.

Nov  6 11:03:54 legacy sshd[25899]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.204.235.30
Nov  6 11:03:55 legacy sshd[25899]: Failed password for invalid user connect from 138.204.235.30 port 39969 ssh2
Nov  6 11:08:41 legacy sshd[26039]: Failed password for root from 138.204.235.30 port 59516 ssh2
...

Nov  6 05:00:58 vtv3 sshd\[19402\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.204.235.30  user=root
Nov  6 05:01:00 vtv3 sshd\[19402\]: Failed password for root from 138.204.235.30 port 46213 ssh2
Nov  6 05:05:34 vtv3 sshd\[22298\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.204.235.30  user=root
Nov  6 05:05:36 vtv3 sshd\[22298\]: Failed password for root from 138.204.235.30 port 37500 ssh2
Nov  6 05:10:22 vtv3 sshd\[25215\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.204.235.30  user=root
Nov  6 05:24:30 vtv3 sshd\[1082\]: Invalid user cn from 138.204.235.30 port 59149
Nov  6 05:24:30 vtv3 sshd\[1082\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.204.235.30
Nov  6 05:24:32 vtv3 sshd\[1082\]: Failed password for invalid user cn from 138.204.235.30 port 59149 ssh2
Nov  6 05:29:16 vtv3 sshd\[4242\]: Invali

Lines containing failures of 138.204.235.30
Oct 29 01:42:35 shared11 sshd[7816]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.204.235.30  user=r.r
Oct 29 01:42:38 shared11 sshd[7816]: Failed password for r.r from 138.204.235.30 port 51014 ssh2
Oct 29 01:42:38 shared11 sshd[7816]: Received disconnect from 138.204.235.30 port 51014:11: Bye Bye [preauth]
Oct 29 01:42:38 shared11 sshd[7816]: Disconnected from authenticating user r.r 138.204.235.30 port 51014 [preauth]
Oct 29 01:57:12 shared11 sshd[12485]: Invalid user asconex from 138.204.235.30 port 40713
Oct 29 01:57:12 shared11 sshd[12485]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.204.235.30
Oct 29 01:57:14 shared11 sshd[12485]: Failed password for invalid user asconex from 138.204.235.30 port 40713 ssh2
Oct 29 01:57:14 shared11 sshd[12485]: Received disconnect from 138.204.235.30 port 40713:11: Bye Bye [preauth]
Oct 29 01:57........
------------------------------

2019-11-02T04:43:21.134156shield sshd\[26264\]: Invalid user q1w2e3r4 from 138.204.235.30 port 48644
2019-11-02T04:43:21.142369shield sshd\[26264\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.204.235.30
2019-11-02T04:43:23.482582shield sshd\[26264\]: Failed password for invalid user q1w2e3r4 from 138.204.235.30 port 48644 ssh2
2019-11-02T04:47:58.576752shield sshd\[27482\]: Invalid user Blood123 from 138.204.235.30 port 39622
2019-11-02T04:47:58.582282shield sshd\[27482\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.204.235.30

Too many connections or unauthorized access detected from Arctic banned ip

Lines containing failures of 138.204.235.30
Oct 29 01:42:35 shared11 sshd[7816]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.204.235.30  user=r.r
Oct 29 01:42:38 shared11 sshd[7816]: Failed password for r.r from 138.204.235.30 port 51014 ssh2
Oct 29 01:42:38 shared11 sshd[7816]: Received disconnect from 138.204.235.30 port 51014:11: Bye Bye [preauth]
Oct 29 01:42:38 shared11 sshd[7816]: Disconnected from authenticating user r.r 138.204.235.30 port 51014 [preauth]
Oct 29 01:57:12 shared11 sshd[12485]: Invalid user asconex from 138.204.235.30 port 40713
Oct 29 01:57:12 shared11 sshd[12485]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.204.235.30
Oct 29 01:57:14 shared11 sshd[12485]: Failed password for invalid user asconex from 138.204.235.30 port 40713 ssh2
Oct 29 01:57:14 shared11 sshd[12485]: Received disconnect from 138.204.235.30 port 40713:11: Bye Bye [preauth]
Oct 29 01:57........
------------------------------

Lines containing failures of 138.204.235.30
Oct 29 01:42:35 shared11 sshd[7816]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.204.235.30  user=r.r
Oct 29 01:42:38 shared11 sshd[7816]: Failed password for r.r from 138.204.235.30 port 51014 ssh2
Oct 29 01:42:38 shared11 sshd[7816]: Received disconnect from 138.204.235.30 port 51014:11: Bye Bye [preauth]
Oct 29 01:42:38 shared11 sshd[7816]: Disconnected from authenticating user r.r 138.204.235.30 port 51014 [preauth]
Oct 29 01:57:12 shared11 sshd[12485]: Invalid user asconex from 138.204.235.30 port 40713
Oct 29 01:57:12 shared11 sshd[12485]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.204.235.30
Oct 29 01:57:14 shared11 sshd[12485]: Failed password for invalid user asconex from 138.204.235.30 port 40713 ssh2
Oct 29 01:57:14 shared11 sshd[12485]: Received disconnect from 138.204.235.30 port 40713:11: Bye Bye [preauth]
Oct 29 01:57........
------------------------------

Nov 28 07:27:02 server sshd\[16348\]: Invalid user www from 128.199.47.148
Nov 28 07:27:02 server sshd\[16348\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.47.148 
Nov 28 07:27:03 server sshd\[16348\]: Failed password for invalid user www from 128.199.47.148 port 49496 ssh2
Nov 28 07:57:30 server sshd\[24249\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.47.148  user=daemon
Nov 28 07:57:32 server sshd\[24249\]: Failed password for daemon from 128.199.47.148 port 35070 ssh2
...

Nov 28 06:15:10 markkoudstaal sshd[19275]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.30.174.85
Nov 28 06:15:12 markkoudstaal sshd[19275]: Failed password for invalid user internet from 123.30.174.85 port 54924 ssh2
Nov 28 06:24:10 markkoudstaal sshd[20262]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.30.174.85

71.6.158.166 was recorded 7 times by 6 hosts attempting to connect to the following ports: 8545,3460,4022,16992,1777,9999,8889. Incident counter (4h, 24h, all-time): 7, 47, 1066

Nov 28 06:30:35 vps691689 sshd[7036]: Failed password for root from 222.186.180.9 port 53084 ssh2
Nov 28 06:30:45 vps691689 sshd[7036]: Failed password for root from 222.186.180.9 port 53084 ssh2
Nov 28 06:30:48 vps691689 sshd[7036]: Failed password for root from 222.186.180.9 port 53084 ssh2
Nov 28 06:30:48 vps691689 sshd[7036]: error: maximum authentication attempts exceeded for root from 222.186.180.9 port 53084 ssh2 [preauth]
...

Port 22 Scan, PTR: None

Nov 28 03:07:38 firewall sshd[26479]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.95.212.41
Nov 28 03:07:38 firewall sshd[26479]: Invalid user cw from 203.95.212.41
Nov 28 03:07:39 firewall sshd[26479]: Failed password for invalid user cw from 203.95.212.41 port 29608 ssh2
...

2019-11-28T05:36:33.244003abusebot-5.cloudsearch.cf sshd\[21184\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.169.192  user=root

Nov 15 23:00:59 microserver sshd[53966]: Invalid user fabriceg from 49.51.162.170 port 52522
Nov 15 23:00:59 microserver sshd[53966]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.51.162.170
Nov 15 23:01:01 microserver sshd[53966]: Failed password for invalid user fabriceg from 49.51.162.170 port 52522 ssh2
Nov 15 23:04:35 microserver sshd[54216]: Invalid user lena from 49.51.162.170 port 33724
Nov 15 23:04:35 microserver sshd[54216]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.51.162.170
Nov 15 23:15:35 microserver sshd[56037]: Invalid user admin999 from 49.51.162.170 port 33810
Nov 15 23:15:35 microserver sshd[56037]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.51.162.170
Nov 15 23:15:37 microserver sshd[56037]: Failed password for invalid user admin999 from 49.51.162.170 port 33810 ssh2
Nov 15 23:19:18 microserver sshd[56236]: Invalid user psb from 49.51.162.170 port 43

Nov 28 00:46:47 TORMINT sshd\[16147\]: Invalid user dos from 123.206.88.24
Nov 28 00:46:47 TORMINT sshd\[16147\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.206.88.24
Nov 28 00:46:49 TORMINT sshd\[16147\]: Failed password for invalid user dos from 123.206.88.24 port 47330 ssh2
...

Nov 28 00:09:11 linuxvps sshd\[43045\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.203.13.141  user=root
Nov 28 00:09:12 linuxvps sshd\[43045\]: Failed password for root from 159.203.13.141 port 54992 ssh2
Nov 28 00:15:06 linuxvps sshd\[46353\]: Invalid user macedo from 159.203.13.141
Nov 28 00:15:06 linuxvps sshd\[46353\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.203.13.141
Nov 28 00:15:08 linuxvps sshd\[46353\]: Failed password for invalid user macedo from 159.203.13.141 port 60450 ssh2

Nov 28 07:19:24 server sshd\[30151\]: Invalid user ryghseter from 35.187.234.161 port 47220
Nov 28 07:19:24 server sshd\[30151\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=35.187.234.161
Nov 28 07:19:26 server sshd\[30151\]: Failed password for invalid user ryghseter from 35.187.234.161 port 47220 ssh2
Nov 28 07:26:48 server sshd\[18419\]: Invalid user ssh from 35.187.234.161 port 54616
Nov 28 07:26:48 server sshd\[18419\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=35.187.234.161

Nov 28 04:57:55 hermescis postfix/smtpd\[4900\]: NOQUEUE: reject: RCPT from unknown\[197.188.203.247\]: 550 5.1.1 \: Recipient address rejected:* from=\ to=\ proto=ESMTP helo=\<\[197.188.203.247\]\>

Nov 28 06:52:28 jane sshd[18714]: Failed password for root from 218.92.0.157 port 45089 ssh2
Nov 28 06:52:33 jane sshd[18714]: Failed password for root from 218.92.0.157 port 45089 ssh2
...

Nov 27 19:32:48 web9 sshd\[4264\]: Invalid user lanet from 154.221.24.135
Nov 27 19:32:48 web9 sshd\[4264\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=154.221.24.135
Nov 27 19:32:50 web9 sshd\[4264\]: Failed password for invalid user lanet from 154.221.24.135 port 58406 ssh2
Nov 27 19:40:02 web9 sshd\[5135\]: Invalid user named from 154.221.24.135
Nov 27 19:40:02 web9 sshd\[5135\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=154.221.24.135

B: Abusive content scan (301)