TCP (SYN) 193.228.91.109:46785 -> port 22, len 40

2020-08-15T12:17:24.590038abusebot-8.cloudsearch.cf sshd[19446]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51b7b625.dsl.pool.telekom.hu  user=root
2020-08-15T12:17:26.015170abusebot-8.cloudsearch.cf sshd[19446]: Failed password for root from 81.183.182.37 port 50112 ssh2
2020-08-15T12:21:42.745350abusebot-8.cloudsearch.cf sshd[19506]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51b7b625.dsl.pool.telekom.hu  user=root
2020-08-15T12:21:44.590108abusebot-8.cloudsearch.cf sshd[19506]: Failed password for root from 81.183.182.37 port 32872 ssh2
2020-08-15T12:25:56.460171abusebot-8.cloudsearch.cf sshd[19515]: Invalid user ~#$%^&*(),.; from 81.183.182.37 port 43882
2020-08-15T12:25:56.467089abusebot-8.cloudsearch.cf sshd[19515]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51b7b625.dsl.pool.telekom.hu
2020-08-15T12:25:56.460171abusebot-8.cloudsearch.cf sshd[1951
...

Aug 15 05:48:14 serwer sshd\[16073\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=101.231.166.39  user=root
Aug 15 05:48:15 serwer sshd\[16073\]: Failed password for root from 101.231.166.39 port 2061 ssh2
Aug 15 05:50:18 serwer sshd\[17657\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=101.231.166.39  user=root
...

[MK-VM2] Blocked by UFW

1597494362 - 08/15/2020 14:26:02 Host: 110.137.38.136/110.137.38.136 Port: 445 TCP Blocked

3 failed attempts at connecting to SSH.

Dovecot Invalid User Login Attempt.

Aug 15 05:47:29 serwer sshd\[15551\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.68.198.75  user=root
Aug 15 05:47:31 serwer sshd\[15551\]: Failed password for root from 51.68.198.75 port 36648 ssh2
Aug 15 05:49:15 serwer sshd\[16817\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.68.198.75  user=root
...

Aug 15 11:34:42 fhem-rasp sshd[3024]: Failed password for root from 189.244.87.218 port 46530 ssh2
Aug 15 11:34:44 fhem-rasp sshd[3024]: Disconnected from authenticating user root 189.244.87.218 port 46530 [preauth]
...

Aug 15 14:22:05 sip sshd[1314064]: Failed password for root from 157.230.100.192 port 54312 ssh2
Aug 15 14:25:45 sip sshd[1314102]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.230.100.192  user=root
Aug 15 14:25:47 sip sshd[1314102]: Failed password for root from 157.230.100.192 port 36018 ssh2
...

Aug 15 06:52:24 master sshd[6412]: Failed password for root from 211.103.222.34 port 6930 ssh2
Aug 15 06:58:45 master sshd[6499]: Failed password for root from 211.103.222.34 port 44868 ssh2
Aug 15 07:02:47 master sshd[6984]: Failed password for root from 211.103.222.34 port 11832 ssh2
Aug 15 07:06:52 master sshd[7057]: Failed password for root from 211.103.222.34 port 43138 ssh2
Aug 15 07:10:47 master sshd[7205]: Failed password for root from 211.103.222.34 port 9872 ssh2
Aug 15 07:14:31 master sshd[7225]: Failed password for root from 211.103.222.34 port 41020 ssh2
Aug 15 07:18:27 master sshd[7312]: Failed password for root from 211.103.222.34 port 7747 ssh2
Aug 15 07:22:25 master sshd[7421]: Failed password for root from 211.103.222.34 port 38929 ssh2
Aug 15 07:26:33 master sshd[7495]: Failed password for root from 211.103.222.34 port 5135 ssh2
Aug 15 07:30:37 master sshd[7956]: Failed password for root from 211.103.222.34 port 36168 ssh2

Port scan on 3 port(s): 3389 3390 3394

2020-08-15T14:18:22.465771v22018076590370373 sshd[30218]: Failed password for root from 106.55.149.162 port 40866 ssh2
2020-08-15T14:21:59.919959v22018076590370373 sshd[2896]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.55.149.162  user=root
2020-08-15T14:22:02.429949v22018076590370373 sshd[2896]: Failed password for root from 106.55.149.162 port 47512 ssh2
2020-08-15T14:25:18.358441v22018076590370373 sshd[26120]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.55.149.162  user=root
2020-08-15T14:25:20.521915v22018076590370373 sshd[26120]: Failed password for root from 106.55.149.162 port 54152 ssh2
...

2020-08-15T12:47:26.649082shield sshd\[20048\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.185  user=root
2020-08-15T12:47:28.455900shield sshd\[20048\]: Failed password for root from 218.92.0.185 port 20062 ssh2
2020-08-15T12:47:32.656786shield sshd\[20048\]: Failed password for root from 218.92.0.185 port 20062 ssh2
2020-08-15T12:47:36.320992shield sshd\[20048\]: Failed password for root from 218.92.0.185 port 20062 ssh2
2020-08-15T12:47:39.209984shield sshd\[20048\]: Failed password for root from 218.92.0.185 port 20062 ssh2

[Sat Aug 15 19:25:56.354856 2020] [:error] [pid 1165:tid 140592558245632] [client 173.252.95.112:49236] [client 173.252.95.112] ModSecurity: Access denied with code 403 (phase 2). Match of "eq 0" against "&REQUEST_HEADERS:Transfer-Encoding" required. [file "/etc/modsecurity/owasp-modsecurity-crs-3.2.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "202"] [id "920171"] [msg "GET or HEAD Request with Transfer-Encoding."] [data "1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.2.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "karangploso.jatim.bmkg.go.id"] [uri "/image-loader-worker-v3.js"] [unique_id "XzfUVOniW-eKEEIJLUNKMQABwwA"]
...