Sep 25 05:49:08 srv206 sshd[5302]: Invalid user bart from 117.50.94.229
...

Mar 28 14:48:19 vtv3 sshd\[1755\]: Invalid user ew from 152.136.95.118 port 45904
Mar 28 14:48:19 vtv3 sshd\[1755\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.136.95.118
Mar 28 14:48:21 vtv3 sshd\[1755\]: Failed password for invalid user ew from 152.136.95.118 port 45904 ssh2
Mar 28 14:56:03 vtv3 sshd\[5055\]: Invalid user test from 152.136.95.118 port 53668
Mar 28 14:56:03 vtv3 sshd\[5055\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.136.95.118
Apr 15 18:03:49 vtv3 sshd\[27198\]: Invalid user postgres from 152.136.95.118 port 58584
Apr 15 18:03:49 vtv3 sshd\[27198\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.136.95.118
Apr 15 18:03:51 vtv3 sshd\[27198\]: Failed password for invalid user postgres from 152.136.95.118 port 58584 ssh2
Apr 15 18:11:06 vtv3 sshd\[31143\]: Invalid user gmodserver from 152.136.95.118 port 52756
Apr 15 18:11:06 vtv3 sshd\[31143\

Scanning and Vuln Attempts

Sep 24 23:42:04 sachi sshd\[4276\]: Invalid user smmsp from 181.30.27.11
Sep 24 23:42:04 sachi sshd\[4276\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.30.27.11
Sep 24 23:42:06 sachi sshd\[4276\]: Failed password for invalid user smmsp from 181.30.27.11 port 42249 ssh2
Sep 24 23:47:39 sachi sshd\[4733\]: Invalid user ubnt from 181.30.27.11
Sep 24 23:47:39 sachi sshd\[4733\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.30.27.11

Sep 23 15:48:32 srv00 sshd[50751]: fatal: Unable to negotiate whostnameh 54.37.235.126 port 56758: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
Sep 23 15:49:23 srv00 sshd[50755]: fatal: Unable to negotiate whostnameh 54.37.235.126 port 32848: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
Sep 23 15:50:15 srv00 sshd[50773]: fatal: Unable to negotiate whostnameh 54.37.235.126 port 37162: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]
Sep 23 15:51:06 srv00 sshd[50781]: fatal: Unable to negotiate whostnameh 54.37.235.126 port 41478: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-gro........
------------------------------

Sep 25 03:19:12 Tower sshd[12935]: Connection from 142.93.201.168 port 34723 on 192.168.10.220 port 22
Sep 25 03:19:12 Tower sshd[12935]: Invalid user test from 142.93.201.168 port 34723
Sep 25 03:19:12 Tower sshd[12935]: error: Could not get shadow information for NOUSER
Sep 25 03:19:12 Tower sshd[12935]: Failed password for invalid user test from 142.93.201.168 port 34723 ssh2
Sep 25 03:19:12 Tower sshd[12935]: Received disconnect from 142.93.201.168 port 34723:11: Bye Bye [preauth]
Sep 25 03:19:12 Tower sshd[12935]: Disconnected from invalid user test 142.93.201.168 port 34723 [preauth]

Attacks websites by trying to access known vulnerables of plugins, brute-force of backends or probing of administrative tools

Sep 25 06:34:07 tux-35-217 sshd\[19442\]: Invalid user x from 91.121.112.93 port 47568
Sep 25 06:34:07 tux-35-217 sshd\[19442\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.112.93
Sep 25 06:34:09 tux-35-217 sshd\[19442\]: Failed password for invalid user x from 91.121.112.93 port 47568 ssh2
Sep 25 06:34:58 tux-35-217 sshd\[19455\]: Invalid user x from 91.121.112.93 port 34110
Sep 25 06:34:58 tux-35-217 sshd\[19455\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.112.93
...

Sep 25 08:02:20 bouncer sshd\[5029\]: Invalid user Guest from 118.36.139.75 port 60146
Sep 25 08:02:20 bouncer sshd\[5029\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.36.139.75 
Sep 25 08:02:22 bouncer sshd\[5029\]: Failed password for invalid user Guest from 118.36.139.75 port 60146 ssh2
...

port scan and connect, tcp 5000 (upnp)

\[2019-09-25 05:59:03\] NOTICE\[1970\] chan_sip.c: Registration from '\' failed for '62.210.141.84:49551' - Wrong password
\[2019-09-25 05:59:03\] SECURITY\[1978\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-09-25T05:59:03.263-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="1200075",SessionID="0x7f9b345a1f18",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/62.210.141.84/49551",Challenge="62ff5136",ReceivedChallenge="62ff5136",ReceivedHash="a779b6f6e8d24bdea34ef05581e13578"
\[2019-09-25 06:05:37\] NOTICE\[1970\] chan_sip.c: Registration from '\' failed for '62.210.141.84:54601' - Wrong password
\[2019-09-25 06:05:37\] SECURITY\[1978\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-09-25T06:05:37.482-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="1200076",SessionID="0x7f9b3402de58",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/U

Sep 25 02:52:23 ny01 sshd[12932]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=223.202.201.138
Sep 25 02:52:25 ny01 sshd[12932]: Failed password for invalid user oy from 223.202.201.138 port 49892 ssh2
Sep 25 03:01:40 ny01 sshd[14996]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=223.202.201.138

Scanning and Vuln Attempts

Unauthorized IMAP connection attempt

SSH/22 MH Probe, BF, Hack -