Jun  7 22:58:55 srv-ubuntu-dev3 sshd[34648]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.152.204.42  user=root
Jun  7 22:58:58 srv-ubuntu-dev3 sshd[34648]: Failed password for root from 122.152.204.42 port 41422 ssh2
Jun  7 23:01:08 srv-ubuntu-dev3 sshd[35027]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.152.204.42  user=root
Jun  7 23:01:10 srv-ubuntu-dev3 sshd[35027]: Failed password for root from 122.152.204.42 port 37912 ssh2
Jun  7 23:03:18 srv-ubuntu-dev3 sshd[35335]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.152.204.42  user=root
Jun  7 23:03:21 srv-ubuntu-dev3 sshd[35335]: Failed password for root from 122.152.204.42 port 34400 ssh2
Jun  7 23:05:25 srv-ubuntu-dev3 sshd[35636]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.152.204.42  user=root
Jun  7 23:05:27 srv-ubuntu-dev3 sshd[35636]: F
...

Jun  7 20:28:30 scw-6657dc sshd[31096]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.17.94.69  user=root
Jun  7 20:28:30 scw-6657dc sshd[31096]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.17.94.69  user=root
Jun  7 20:28:33 scw-6657dc sshd[31096]: Failed password for root from 134.17.94.69 port 5053 ssh2
...

(From bellm1233@gmail.com) Hi there!

I'm a freelance online marketer who's seeking new clients interested in getting more traffic to their websites. Can you please help me out a bit? I'd like to speak to the person in your company who is in charge on managing the website, and I would really appreciate it if you could forward this message to them and have them respond to me. 

If you're in need of SEO, I can assist you for a cheap cost. I've been a freelance search engine optimization specialist for 10 years and can get your site up where you need it to be. Boosting your ranking in search engines can progressively increase the amount of traffic you get in your site. Even just having high placements on Google alone for specific keywords relating to your business can really boost your sales. I'd like to help your company progress to the next level. 

Please write back to let me know if you're interested and I'll provide you with a free consultation and pricing on my services. I hope to speak with you soon

2020-06-07T20:26:21.569586shield sshd\[337\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.47.90.197  user=root
2020-06-07T20:26:23.270607shield sshd\[337\]: Failed password for root from 119.47.90.197 port 58782 ssh2
2020-06-07T20:28:04.231852shield sshd\[733\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.47.90.197  user=root
2020-06-07T20:28:06.404773shield sshd\[733\]: Failed password for root from 119.47.90.197 port 54648 ssh2
2020-06-07T20:29:45.068687shield sshd\[1111\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.47.90.197  user=root

[Sun Jun 07 14:07:17.542111 2020] [:error] [pid 19185] [client 195.37.190.77:44924] [client 195.37.190.77] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "170.249.239.98"] [uri "/dns-query"] [unique_id "Xt0s1XZAH6Ffb1GN3yeaegAAAAQ"]

Jun  7 22:28:28 andromeda sshd\[10613\]: Invalid user admin from 103.83.246.165 port 54679
Jun  7 22:28:29 andromeda sshd\[10613\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.83.246.165
Jun  7 22:28:30 andromeda sshd\[10613\]: Failed password for invalid user admin from 103.83.246.165 port 54679 ssh2

Jun  7 22:41:47 piServer sshd[27673]: Failed password for root from 222.240.223.85 port 45249 ssh2
Jun  7 22:46:29 piServer sshd[28060]: Failed password for root from 222.240.223.85 port 41685 ssh2
...

Jun  8 03:24:19 webhost01 sshd[18324]: Failed password for root from 111.231.71.1 port 59688 ssh2
...

Jun  7 22:23:14 legacy sshd[27515]: Failed password for root from 116.196.73.159 port 44702 ssh2
Jun  7 22:25:38 legacy sshd[27606]: Failed password for root from 116.196.73.159 port 57340 ssh2
...

Jun  7 22:56:59 piServer sshd[29096]: Failed password for root from 112.85.42.89 port 63417 ssh2
Jun  7 22:57:03 piServer sshd[29096]: Failed password for root from 112.85.42.89 port 63417 ssh2
Jun  7 22:57:07 piServer sshd[29096]: Failed password for root from 112.85.42.89 port 63417 ssh2
...

Jun  7 22:38:37 PorscheCustomer sshd[21028]: Failed password for root from 114.98.225.210 port 49654 ssh2
Jun  7 22:41:16 PorscheCustomer sshd[21202]: Failed password for root from 114.98.225.210 port 42071 ssh2
...

xmlrpc attack

Port Scan detected!
...

Port Scan detected!
...

Jun  7 22:44:15 debian-2gb-nbg1-2 kernel: \[13821398.358983\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=87.251.74.18 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=245 ID=10294 PROTO=TCP SPT=53913 DPT=5589 WINDOW=1024 RES=0x00 SYN URGP=0