Oct  2 00:18:29 ajax sshd[29859]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.204.142 
Oct  2 00:18:31 ajax sshd[29859]: Failed password for invalid user laura from 157.245.204.142 port 33904 ssh2

Oct  1 15:46:07 mavik sshd[29518]: Invalid user u1 from 157.245.204.125
Oct  1 15:46:07 mavik sshd[29518]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.204.125
Oct  1 15:46:09 mavik sshd[29518]: Failed password for invalid user u1 from 157.245.204.125 port 44562 ssh2
Oct  1 15:50:53 mavik sshd[29685]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.204.125  user=root
Oct  1 15:50:55 mavik sshd[29685]: Failed password for root from 157.245.204.125 port 53964 ssh2
...

Oct  1 20:48:56 gw1 sshd[6933]: Failed password for root from 157.245.204.142 port 60280 ssh2
Oct  1 20:53:30 gw1 sshd[6973]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.204.142
...

Oct  1 14:33:06 mavik sshd[26479]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.204.125
Oct  1 14:33:08 mavik sshd[26479]: Failed password for invalid user ubuntu from 157.245.204.125 port 35350 ssh2
Oct  1 14:37:30 mavik sshd[26635]: Invalid user test from 157.245.204.125
Oct  1 14:37:30 mavik sshd[26635]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.204.125
Oct  1 14:37:32 mavik sshd[26635]: Failed password for invalid user test from 157.245.204.125 port 44746 ssh2
...

Oct  1 07:12:08 IngegnereFirenze sshd[24468]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.204.142  user=root
...

Oct  1 07:56:56 srv-ubuntu-dev3 sshd[55847]: Invalid user tt from 157.245.204.125
Oct  1 07:56:56 srv-ubuntu-dev3 sshd[55847]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.204.125
Oct  1 07:56:56 srv-ubuntu-dev3 sshd[55847]: Invalid user tt from 157.245.204.125
Oct  1 07:56:58 srv-ubuntu-dev3 sshd[55847]: Failed password for invalid user tt from 157.245.204.125 port 36206 ssh2
Oct  1 08:01:07 srv-ubuntu-dev3 sshd[56418]: Invalid user andy from 157.245.204.125
Oct  1 08:01:07 srv-ubuntu-dev3 sshd[56418]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.204.125
Oct  1 08:01:07 srv-ubuntu-dev3 sshd[56418]: Invalid user andy from 157.245.204.125
Oct  1 08:01:09 srv-ubuntu-dev3 sshd[56418]: Failed password for invalid user andy from 157.245.204.125 port 45016 ssh2
Oct  1 08:05:30 srv-ubuntu-dev3 sshd[56937]: Invalid user abcs from 157.245.204.125
...

2020-09-23 18:28:46 wonderland sshd[18639]: Disconnected from invalid user root 157.245.204.149 port 37820 [preauth]

Sep 23 11:01:39 host1 sshd[120065]: Failed password for root from 157.245.204.149 port 49020 ssh2
Sep 23 11:05:55 host1 sshd[120371]: Invalid user guest2 from 157.245.204.149 port 58098
Sep 23 11:05:55 host1 sshd[120371]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.204.149 
Sep 23 11:05:55 host1 sshd[120371]: Invalid user guest2 from 157.245.204.149 port 58098
Sep 23 11:05:57 host1 sshd[120371]: Failed password for invalid user guest2 from 157.245.204.149 port 58098 ssh2
...

fail2ban/Jun 29 14:39:28 h1962932 sshd[29747]: Invalid user swa from 157.245.204.153 port 39364
Jun 29 14:39:28 h1962932 sshd[29747]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.204.153
Jun 29 14:39:28 h1962932 sshd[29747]: Invalid user swa from 157.245.204.153 port 39364
Jun 29 14:39:30 h1962932 sshd[29747]: Failed password for invalid user swa from 157.245.204.153 port 39364 ssh2
Jun 29 14:45:56 h1962932 sshd[13271]: Invalid user asia from 157.245.204.153 port 9421

Jun 24 14:00:23 roki-contabo sshd\[26326\]: Invalid user ts3srv from 157.245.204.153
Jun 24 14:00:23 roki-contabo sshd\[26326\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.204.153
Jun 24 14:00:25 roki-contabo sshd\[26326\]: Failed password for invalid user ts3srv from 157.245.204.153 port 16258 ssh2
Jun 24 14:05:59 roki-contabo sshd\[26452\]: Invalid user admin from 157.245.204.153
Jun 24 14:05:59 roki-contabo sshd\[26452\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.204.153
...

Invalid user murai from 157.245.204.153 port 7556

2020-04-09T03:54:22Z - RDP login failed multiple times. (157.245.204.198)

2020-04-01T09:24:55Z - RDP login failed multiple times. (157.245.204.198)

Unauthorized connection attempt detected from IP address 157.245.204.227 to port 2220 [J]

Jan 21 14:39:53 ns4 sshd[7762]: Invalid user dy from 157.245.204.139
Jan 21 14:39:53 ns4 sshd[7762]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.204.139 
Jan 21 14:39:55 ns4 sshd[7762]: Failed password for invalid user dy from 157.245.204.139 port 56190 ssh2
Jan 21 14:44:55 ns4 sshd[8987]: Invalid user marco from 157.245.204.139
Jan 21 14:44:55 ns4 sshd[8987]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.204.139 
Jan 21 14:44:57 ns4 sshd[8987]: Failed password for invalid user marco from 157.245.204.139 port 38930 ssh2


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=157.245.204.139

2020-09-05T08:45:07.314102lavrinenko.info sshd[841]: Failed password for root from 222.186.173.142 port 13356 ssh2
2020-09-05T08:45:13.027720lavrinenko.info sshd[841]: Failed password for root from 222.186.173.142 port 13356 ssh2
2020-09-05T08:45:18.999683lavrinenko.info sshd[841]: Failed password for root from 222.186.173.142 port 13356 ssh2
2020-09-05T08:45:23.975082lavrinenko.info sshd[841]: Failed password for root from 222.186.173.142 port 13356 ssh2
2020-09-05T08:45:23.989744lavrinenko.info sshd[841]: error: maximum authentication attempts exceeded for root from 222.186.173.142 port 13356 ssh2 [preauth]
...

Sep  5 07:26:53 santamaria sshd\[30425\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.42.213  user=root
Sep  5 07:26:55 santamaria sshd\[30425\]: Failed password for root from 222.186.42.213 port 33508 ssh2
Sep  5 07:27:05 santamaria sshd\[30427\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.42.213  user=root
...

Sep  4 18:51:41 mellenthin postfix/smtpd[32154]: NOQUEUE: reject: RCPT from unknown[151.50.88.96]: 554 5.7.1 Service unavailable; Client host [151.50.88.96] blocked using zen.spamhaus.org; https://www.spamhaus.org/query/ip/151.50.88.96; from= to= proto=ESMTP helo=

2020-09-05T07:26:37.250326galaxy.wi.uni-potsdam.de sshd[7631]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.161.21
2020-09-05T07:26:37.248434galaxy.wi.uni-potsdam.de sshd[7631]: Invalid user admin from 178.128.161.21 port 44602
2020-09-05T07:26:39.590420galaxy.wi.uni-potsdam.de sshd[7631]: Failed password for invalid user admin from 178.128.161.21 port 44602 ssh2
2020-09-05T07:26:47.883407galaxy.wi.uni-potsdam.de sshd[7643]: Invalid user admin from 178.128.161.21 port 41068
2020-09-05T07:26:47.885348galaxy.wi.uni-potsdam.de sshd[7643]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.161.21
2020-09-05T07:26:47.883407galaxy.wi.uni-potsdam.de sshd[7643]: Invalid user admin from 178.128.161.21 port 41068
2020-09-05T07:26:49.929679galaxy.wi.uni-potsdam.de sshd[7643]: Failed password for invalid user admin from 178.128.161.21 port 41068 ssh2
2020-09-05T07:26:58.486905galaxy.wi.uni-potsdam.de ss
...

Port Scan detected!
...

Honeypot attack, port: 81, PTR: PTR record not found

[2020-09-05 01:19:28] NOTICE[1194] chan_sip.c: Registration from '' failed for '185.147.212.8:65350' - Wrong password
[2020-09-05 01:19:28] SECURITY[1233] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-09-05T01:19:28.866-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="1995",SessionID="0x7f2ddc1b7848",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/185.147.212.8/65350",Challenge="4d1bdae6",ReceivedChallenge="4d1bdae6",ReceivedHash="27eead44287d078ecbe321dab13208de"
[2020-09-05 01:25:09] NOTICE[1194] chan_sip.c: Registration from '' failed for '185.147.212.8:53528' - Wrong password
[2020-09-05 01:25:09] SECURITY[1233] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-09-05T01:25:09.448-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="578",SessionID="0x7f2ddc04e988",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/185.147.212.8/5
...

103.95.83.184 - - [04/Sep/2020:18:44:31 +0100] "POST /xmlrpc.php HTTP/1.1" 403 219 "-" "Mozilla/5.0 (X11; Linux i686; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"
103.95.83.184 - - [04/Sep/2020:18:44:32 +0100] "POST /wp-login.php HTTP/1.1" 200 7644 "-" "Mozilla/5.0 (X11; Linux i686; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"
103.95.83.184 - - [04/Sep/2020:18:48:27 +0100] "POST /xmlrpc.php HTTP/1.1" 403 219 "-" "Mozilla/5.0 (X11; Linux i686; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"
...

Automatic report - Port Scan Attack

Sep  5 05:14:56 vps-51d81928 sshd[222555]: Invalid user gangadhar from 165.227.225.195 port 38920
Sep  5 05:14:56 vps-51d81928 sshd[222555]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.227.225.195 
Sep  5 05:14:56 vps-51d81928 sshd[222555]: Invalid user gangadhar from 165.227.225.195 port 38920
Sep  5 05:14:58 vps-51d81928 sshd[222555]: Failed password for invalid user gangadhar from 165.227.225.195 port 38920 ssh2
Sep  5 05:18:35 vps-51d81928 sshd[222628]: Invalid user tomcat from 165.227.225.195 port 44532
...

2020-09-05 08:51:10 dovecot_login authenticator failed for \(User\) \[45.142.120.36\]: 535 Incorrect authentication data \(set_id=colombo@org.ua\)2020-09-05 08:51:47 dovecot_login authenticator failed for \(User\) \[45.142.120.36\]: 535 Incorrect authentication data \(set_id=genjrot@org.ua\)2020-09-05 08:52:22 dovecot_login authenticator failed for \(User\) \[45.142.120.36\]: 535 Incorrect authentication data \(set_id=soluciones@org.ua\)
...

firewall-block, port(s): 3404/tcp, 4002/tcp, 8000/tcp, 10002/tcp

Sep  1 23:19:18 josie sshd[30350]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.85.42.67  user=r.r
Sep  1 23:19:19 josie sshd[30354]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.85.42.67  user=r.r
Sep  1 23:19:19 josie sshd[30351]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.85.42.67  user=r.r
Sep  1 23:19:20 josie sshd[30350]: Failed password for r.r from 112.85.42.67 port 49846 ssh2
Sep  1 23:19:20 josie sshd[30362]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.85.42.67  user=r.r
Sep  1 23:19:21 josie sshd[30354]: Failed password for r.r from 112.85.42.67 port 38200 ssh2
Sep  1 23:19:21 josie sshd[30351]: Failed password for r.r from 112.85.42.67 port 40952 ssh2
Sep  1 23:19:23 josie sshd[30362]: Failed password for r.r from 112.85.42.67 port 35035 ssh2
Sep  1 23:19:23 josie sshd[3........
-------------------------------

2020-09-05 08:21:46 dovecot_login authenticator failed for \(User\) \[45.142.120.137\]: 535 Incorrect authentication data \(set_id=jody@org.ua\)2020-09-05 08:22:23 dovecot_login authenticator failed for \(User\) \[45.142.120.137\]: 535 Incorrect authentication data \(set_id=thekla@org.ua\)2020-09-05 08:23:01 dovecot_login authenticator failed for \(User\) \[45.142.120.137\]: 535 Incorrect authentication data \(set_id=jeri@org.ua\)
...

Sep  5 02:01:22 vps46666688 sshd[20289]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.123.73
Sep  5 02:01:24 vps46666688 sshd[20289]: Failed password for invalid user zihang from 106.13.123.73 port 40396 ssh2
...