ssh failed login

IMAP brute force
...

Oct 10 08:42:44 Tower sshd[2078]: Connection from 37.139.24.204 port 54484 on 192.168.10.220 port 22
Oct 10 08:42:57 Tower sshd[2078]: Failed password for root from 37.139.24.204 port 54484 ssh2
Oct 10 08:42:57 Tower sshd[2078]: Received disconnect from 37.139.24.204 port 54484:11: Bye Bye [preauth]
Oct 10 08:42:57 Tower sshd[2078]: Disconnected from authenticating user root 37.139.24.204 port 54484 [preauth]

Oct 10 20:16:48 hosting sshd[27209]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=netup.yugt.ru  user=root
Oct 10 20:16:50 hosting sshd[27209]: Failed password for root from 193.169.39.254 port 41862 ssh2
Oct 10 20:20:53 hosting sshd[27475]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=www.yugt.ru  user=root
Oct 10 20:20:55 hosting sshd[27475]: Failed password for root from 193.169.39.254 port 51082 ssh2
...

2019-10-10T11:51:36.888157abusebot-6.cloudsearch.cf sshd\[13429\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.247.37.191  user=root

Oct 10 16:33:40 MK-Soft-Root1 sshd[29714]: Failed password for root from 120.92.133.32 port 43822 ssh2
...

Oct 10 06:46:57 auw2 sshd\[15826\]: Invalid user P@\$\$word111 from 117.50.20.112
Oct 10 06:46:57 auw2 sshd\[15826\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.50.20.112
Oct 10 06:46:59 auw2 sshd\[15826\]: Failed password for invalid user P@\$\$word111 from 117.50.20.112 port 40270 ssh2
Oct 10 06:51:14 auw2 sshd\[16160\]: Invalid user Hospital2017 from 117.50.20.112
Oct 10 06:51:14 auw2 sshd\[16160\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.50.20.112

Oct  6 01:53:27 v2hgb sshd[17734]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.109.58  user=r.r
Oct  6 01:53:29 v2hgb sshd[17734]: Failed password for r.r from 182.61.109.58 port 56286 ssh2
Oct  6 01:53:30 v2hgb sshd[17734]: Received disconnect from 182.61.109.58 port 56286:11: Bye Bye [preauth]
Oct  6 01:53:30 v2hgb sshd[17734]: Disconnected from 182.61.109.58 port 56286 [preauth]
Oct  6 01:56:13 v2hgb sshd[17855]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.109.58  user=r.r
Oct  6 01:56:15 v2hgb sshd[17855]: Failed password for r.r from 182.61.109.58 port 48256 ssh2
Oct  6 01:56:15 v2hgb sshd[17855]: Received disconnect from 182.61.109.58 port 48256:11: Bye Bye [preauth]
Oct  6 01:56:15 v2hgb sshd[17855]: Disconnected from 182.61.109.58 port 48256 [preauth]
Oct  6 01:57:49 v2hgb sshd[17926]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ru........
-------------------------------

Oct 10 03:20:42 web1 sshd\[10569\]: Invalid user P@\$\$w0rt3@1 from 159.203.160.221
Oct 10 03:20:42 web1 sshd\[10569\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.203.160.221
Oct 10 03:20:44 web1 sshd\[10569\]: Failed password for invalid user P@\$\$w0rt3@1 from 159.203.160.221 port 47144 ssh2
Oct 10 03:24:38 web1 sshd\[10870\]: Invalid user July@2017 from 159.203.160.221
Oct 10 03:24:38 web1 sshd\[10870\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.203.160.221

Received: from smtphub10.us.aosmd.com (10.10.10.88) by Nugget.us.aosmd.com
 (172.16.20.10) with Microsoft SMTP Server (TLS) id 14.3.439.0; Thu, 10 Oct
 2019 09:54:37 -0700
Received: from Pickup by smtphub10.us.aosmd.com with Microsoft SMTP Server id
 14.3.439.0; Thu, 10 Oct 2019 16:54:34 +0000
X-GFI-METKTSID: 33f1c7e1-3f10-4eb1-a095-5d0116673e37
X-GFI-METKTSIG: GBRbdzNhBLWj3pl6JwYlSAlZqa7lDYWftvWlRTAy5pwOo/G5WTdUdFt7Rh/ue4wFVaFD3NbmoMVG86ooD0o3FztBsM4rtQaoUKE+4AiB7EVbhwO3WVe83T7gcwsGlVyAbNrGplpIJVt8FF3dXc6kFDNiuOKc6Z8nprm4eZOwSaI=
x-gfi-rh: from 77.49.165.66.dsl.dyn.forthnet.gr (77.49.165.66) by smtphub10.us.aosmd.com (10.10.10.88)
 with Microsoft SMTP Server id 14.3.439.0; Thu, 10 Oct 2019 09:54:33 -0700
Message-ID: 
Date: Thu, 10 Oct 2019 21:54:24 +0200
From: 
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.23) Gecko/20110922 Thunderbird/3.1.15
MIME-Version: 1.0
To: 
Subject: Your account was under attack! Change your access data! - [Detected by **SpamRazer**]
Return-Path: dan.brownlee@us.aosmd.com
X-GFI-SMTP-Submission: 1
X-GFI-SMTP-HelloDomain: 77.49.165.66.dsl.dyn.forthnet.gr
X-GFI-SMTP-RemoteIP: 77.49.165.66
X-GFIME-MASPAM: SPAM
X-GFIME-BLOCK-REASON: Message was found to be spam: (100%) Sender has spammy reputation,
X-GFI-MOVETOJUNK: 1
Old-Message-ID: <5D9F8C70.9060102@us.aosmd.com>
X-MS-Exchange-Organization-AuthSource: smtphub10.us.aosmd.com
X-MS-Exchange-Organization-AuthAs: Anonymous
X-MS-Exchange-Organization-SCL: 9
Content-type: text/plain;
	charset="UTF-8"
Content-transfer-encoding: 7bit


This was an extortion email sent to me from your IP address

Automatic report - Port Scan Attack

Automatic report - XMLRPC Attack

Oct 10 15:47:50 dedicated sshd[5949]: Invalid user Chase@2017 from 134.209.155.167 port 50668

Oct 10 18:34:55 root sshd[26974]: Failed password for root from 42.157.129.158 port 39360 ssh2
Oct 10 18:41:02 root sshd[27073]: Failed password for root from 42.157.129.158 port 45506 ssh2
...

Automatic report - Port Scan

RDP over non-standard port attempt