Brute Force through SSH

Unauthorized connection attempt from IP address 177.39.138.237 on Port 445(SMB)

Nov 26 16:42:58 minden010 sshd[20441]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.251.67.78
Nov 26 16:43:00 minden010 sshd[20441]: Failed password for invalid user macey from 106.251.67.78 port 38950 ssh2
Nov 26 16:46:37 minden010 sshd[21641]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.251.67.78
...

Nov 26 15:36:57 h2177944 sshd\[15243\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.225.151.8  user=root
Nov 26 15:36:58 h2177944 sshd\[15243\]: Failed password for root from 23.225.151.8 port 60524 ssh2
Nov 26 15:41:27 h2177944 sshd\[15478\]: Invalid user bjang from 23.225.151.8 port 39750
Nov 26 15:41:27 h2177944 sshd\[15478\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.225.151.8
...

Brute force attempt

IP Ban Report :  
 https://help-dysk.pl/wordpress-firewall-plugins/ip/201.222.70.167/ 
 
 BO - 1H : (12)  
 Protection Against DDoS WordPress plugin :  
 "odzyskiwanie danych help-dysk" 
 IP Address Ranges by Country : BO 
 NAME ASN : ASN25620 
 
 IP : 201.222.70.167 
 
 CIDR : 201.222.64.0/21 
 
 PREFIX COUNT : 104 
 
 UNIQUE IP COUNT : 163840 
 
 
 ATTACKS DETECTED ASN25620 :  
  1H - 1 
  3H - 1 
  6H - 3 
 12H - 7 
 24H - 7 
 
 DateTime : 2019-11-26 18:22:31 
 
 INFO : Port Scan TELNET Detected and Blocked by ADMIN  - data recovery

Nov 26 15:41:07 vmanager6029 sshd\[23864\]: Invalid user steffane from 36.41.174.139 port 33920
Nov 26 15:41:07 vmanager6029 sshd\[23864\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.41.174.139
Nov 26 15:41:09 vmanager6029 sshd\[23864\]: Failed password for invalid user steffane from 36.41.174.139 port 33920 ssh2

2019-11-26T13:00:43.742896ns547587 sshd\[32419\]: Invalid user guest from 164.132.53.185 port 42754
2019-11-26T13:00:43.748136ns547587 sshd\[32419\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=mail.scd.ovh
2019-11-26T13:00:45.794032ns547587 sshd\[32419\]: Failed password for invalid user guest from 164.132.53.185 port 42754 ssh2
2019-11-26T13:06:28.652419ns547587 sshd\[2149\]: Invalid user sicher from 164.132.53.185 port 50754
...

Nov 26 11:48:02 server sshd\[26886\]: Failed password for invalid user fang from 27.154.225.186 port 32806 ssh2
Nov 26 19:24:08 server sshd\[8512\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.154.225.186  user=root
Nov 26 19:24:09 server sshd\[8512\]: Failed password for root from 27.154.225.186 port 60612 ssh2
Nov 26 19:33:14 server sshd\[10843\]: Invalid user reply from 27.154.225.186
Nov 26 19:33:14 server sshd\[10843\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.154.225.186 
...

Connection by 62.210.77.54 on port: 2002 got caught by honeypot at 11/26/2019 5:28:05 PM

Nov 26 15:41:11 smtp postfix/smtpd[15476]: NOQUEUE: reject: RCPT from health.yarkaci.com[188.213.212.63]: 554 5.7.1 Service unavailable; Client host [188.213.212.63] blocked using zen.spamhaus.org; from= to= proto=ESMTP helo=
...

Nov 26 17:50:39 cp sshd[18231]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.195.117.212

Nov 26 18:32:54 legacy sshd[23100]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.234.199.232
Nov 26 18:32:56 legacy sshd[23100]: Failed password for invalid user dovecot from 49.234.199.232 port 42480 ssh2
Nov 26 18:39:51 legacy sshd[23318]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.234.199.232
...

11/26/2019-13:52:51.343328 185.176.27.118 Protocol: 6 ET SCAN NMAP -sS window 1024

ET CINS Active Threat Intelligence Poor Reputation IP group 71 - port: 9989 proto: TCP cat: Misc Attack