Apr  6 17:32:38 wordpress wordpress(blog.ruhnke.cloud)[27177]: XML-RPC authentication attempt for unknown user z_r from 2001:19f0:6c01:295d:5400:2ff:fe80:3a0e

Dec 18 02:28:26 km20725 sshd[16813]: Invalid user lembi from 1.9.128.17
Dec 18 02:28:26 km20725 sshd[16813]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.9.128.17
Dec 18 02:28:28 km20725 sshd[16813]: Failed password for invalid user lembi from 1.9.128.17 port 4548 ssh2
Dec 18 02:28:28 km20725 sshd[16813]: Received disconnect from 1.9.128.17: 11: Bye Bye [preauth]
Dec 18 02:54:39 km20725 sshd[18295]: Invalid user quackenbush from 1.9.128.17
Dec 18 02:54:39 km20725 sshd[18295]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.9.128.17
Dec 18 02:54:41 km20725 sshd[18295]: Failed password for invalid user quackenbush from 1.9.128.17 port 56104 ssh2
Dec 18 02:54:41 km20725 sshd[18295]: Received disconnect from 1.9.128.17: 11: Bye Bye [preauth]
Dec 18 03:01:01 km20725 sshd[18634]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.9.128.17  user=r.r
Dec........
-------------------------------

Dec 19 16:20:23 xeon sshd[29394]: Failed password for root from 27.50.24.83 port 55316 ssh2

Dec 19 05:20:09 hpm sshd\[27981\]: Invalid user peanut from 213.32.22.239
Dec 19 05:20:09 hpm sshd\[27981\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=239.ip-213-32-22.eu
Dec 19 05:20:11 hpm sshd\[27981\]: Failed password for invalid user peanut from 213.32.22.239 port 48758 ssh2
Dec 19 05:25:08 hpm sshd\[28449\]: Invalid user hassel from 213.32.22.239
Dec 19 05:25:08 hpm sshd\[28449\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=239.ip-213-32-22.eu

2019-12-19 15:24:52 auth_login authenticator failed for (localhost.localdomain) [188.162.43.22]: 535 Incorrect authentication data (set_id=news@bobostore.ru)
2019-12-19 15:41:15 auth_login authenticator failed for (localhost.localdomain) [188.162.43.22]: 535 Incorrect authentication data (set_id=news@rada.poltava.ua)
...

Dec 19 15:38:27 grey postfix/smtpd\[15064\]: NOQUEUE: reject: RCPT from unknown\[45.120.115.218\]: 554 5.7.1 Service unavailable\; Client host \[45.120.115.218\] blocked using bl.spamcop.net\; Blocked - see https://www.spamcop.net/bl.shtml\?45.120.115.218\; from=\ to=\ proto=ESMTP helo=\<45.120.115-218.mazedanetworks.net\>
...

Dec 19 15:38:52 vpn01 sshd[21873]: Failed password for root from 185.195.237.24 port 33219 ssh2
Dec 19 15:39:06 vpn01 sshd[21873]: Failed password for root from 185.195.237.24 port 33219 ssh2
Dec 19 15:39:06 vpn01 sshd[21873]: error: maximum authentication attempts exceeded for root from 185.195.237.24 port 33219 ssh2 [preauth]
...

Dec 19 15:18:00 sip sshd[16303]: Failed password for root from 49.235.83.156 port 45488 ssh2
Dec 19 15:38:58 sip sshd[16451]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.235.83.156
Dec 19 15:38:59 sip sshd[16451]: Failed password for invalid user wallop from 49.235.83.156 port 33938 ssh2

port scan and connect, tcp 1433 (ms-sql-s)

Dec 19 10:01:11 plusreed sshd[6616]: Invalid user cherrier from 117.55.241.2
Dec 19 10:01:11 plusreed sshd[6616]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.55.241.2
Dec 19 10:01:11 plusreed sshd[6616]: Invalid user cherrier from 117.55.241.2
Dec 19 10:01:13 plusreed sshd[6616]: Failed password for invalid user cherrier from 117.55.241.2 port 50986 ssh2
...

Unauthorized connection attempt detected from IP address 164.52.0.142 to port 445

familiengesundheitszentrum-fulda.de 125.214.58.214 [19/Dec/2019:15:53:15 +0100] "POST /wp-login.php HTTP/1.1" 200 6330 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
familiengesundheitszentrum-fulda.de 125.214.58.214 [19/Dec/2019:15:53:20 +0100] "POST /wp-login.php HTTP/1.1" 200 6288 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"

Dec 19 04:30:20 web9 sshd\[6311\]: Invalid user hertzberg from 60.190.114.82
Dec 19 04:30:20 web9 sshd\[6311\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=60.190.114.82
Dec 19 04:30:22 web9 sshd\[6311\]: Failed password for invalid user hertzberg from 60.190.114.82 port 46505 ssh2
Dec 19 04:38:40 web9 sshd\[7690\]: Invalid user sbkaplan from 60.190.114.82
Dec 19 04:38:40 web9 sshd\[7690\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=60.190.114.82

Dec 19 10:39:02 linuxvps sshd\[60167\]: Invalid user test from 170.210.214.50
Dec 19 10:39:02 linuxvps sshd\[60167\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=170.210.214.50
Dec 19 10:39:04 linuxvps sshd\[60167\]: Failed password for invalid user test from 170.210.214.50 port 34258 ssh2
Dec 19 10:44:30 linuxvps sshd\[63792\]: Invalid user euell from 170.210.214.50
Dec 19 10:44:30 linuxvps sshd\[63792\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=170.210.214.50

Dec 19 15:26:57 h2177944 kernel: \[9640582.550970\] \[UFW BLOCK\] IN=venet0 OUT= MAC= SRC=185.176.27.6 DST=85.214.117.9 LEN=40 TOS=0x00 PREC=0x00 TTL=248 ID=40961 PROTO=TCP SPT=58822 DPT=64066 WINDOW=1024 RES=0x00 SYN URGP=0 
Dec 19 15:57:17 h2177944 kernel: \[9642402.332047\] \[UFW BLOCK\] IN=venet0 OUT= MAC= SRC=185.176.27.6 DST=85.214.117.9 LEN=40 TOS=0x00 PREC=0x00 TTL=248 ID=57809 PROTO=TCP SPT=58822 DPT=42801 WINDOW=1024 RES=0x00 SYN URGP=0 
Dec 19 16:02:31 h2177944 kernel: \[9642716.484054\] \[UFW BLOCK\] IN=venet0 OUT= MAC= SRC=185.176.27.6 DST=85.214.117.9 LEN=40 TOS=0x00 PREC=0x00 TTL=248 ID=47564 PROTO=TCP SPT=58822 DPT=5032 WINDOW=1024 RES=0x00 SYN URGP=0 
Dec 19 16:06:01 h2177944 kernel: \[9642926.607833\] \[UFW BLOCK\] IN=venet0 OUT= MAC= SRC=185.176.27.6 DST=85.214.117.9 LEN=40 TOS=0x00 PREC=0x00 TTL=248 ID=25346 PROTO=TCP SPT=58822 DPT=60787 WINDOW=1024 RES=0x00 SYN URGP=0 
Dec 19 16:07:44 h2177944 kernel: \[9643029.468955\] \[UFW BLOCK\] IN=venet0 OUT= MAC= SRC=185.176.27.6 DST=85.214.117.9 L

Lines containing failures of 217.112.142.185
Dec 19 15:23:15 shared01 postfix/smtpd[23598]: connect from servant.yobaat.com[217.112.142.185]
Dec 19 15:23:15 shared01 policyd-spf[32452]: prepend Received-SPF: Pass (mailfrom) identhostnamey=mailfrom; client-ip=217.112.142.185; helo=servant.moveincool.com; envelope-from=x@x
Dec x@x
Dec 19 15:23:15 shared01 postfix/smtpd[23598]: disconnect from servant.yobaat.com[217.112.142.185] ehlo=1 mail=1 rcpt=0/1 data=0/1 quhostname=1 commands=3/5
Dec 19 15:26:54 shared01 postfix/smtpd[27638]: connect from servant.yobaat.com[217.112.142.185]
Dec 19 15:26:55 shared01 policyd-spf[985]: prepend Received-SPF: Pass (mailfrom) identhostnamey=mailfrom; client-ip=217.112.142.185; helo=servant.moveincool.com; envelope-from=x@x
Dec x@x
Dec 19 15:26:55 shared01 postfix/smtpd[27638]: disconnect from servant.yobaat.com[217.112.142.185] ehlo=1 mail=1 rcpt=0/1 data=0/1 quhostname=1 commands=3/5
Dec 19 15:27:40 shared01 postfix/smtpd[27638]: connect f........
------------------------------