Jan  8 14:03:59 nextcloud sshd\[21617\]: Invalid user ojj from 200.29.100.5
Jan  8 14:03:59 nextcloud sshd\[21617\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.29.100.5
Jan  8 14:04:01 nextcloud sshd\[21617\]: Failed password for invalid user ojj from 200.29.100.5 port 45020 ssh2
...

Lines containing failures of 37.223.166.133
Jan  8 13:46:25 shared09 sshd[13444]: Invalid user al from 37.223.166.133 port 55158
Jan  8 13:46:25 shared09 sshd[13444]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.223.166.133
Jan  8 13:46:27 shared09 sshd[13444]: Failed password for invalid user al from 37.223.166.133 port 55158 ssh2
Jan  8 13:46:27 shared09 sshd[13444]: Received disconnect from 37.223.166.133 port 55158:11: Bye Bye [preauth]
Jan  8 13:46:27 shared09 sshd[13444]: Disconnected from invalid user al 37.223.166.133 port 55158 [preauth]


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=37.223.166.133

Microsoft Windows Terminal server RDP over non-standard port attempt

Automatic report - Banned IP Access

2020-01-08T13:39:42.498443matrix.arvenenaske.de sshd[729884]: Invalid user feered from 123.54.233.228 port 51054
2020-01-08T13:39:42.506087matrix.arvenenaske.de sshd[729884]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.54.233.228 user=feered
2020-01-08T13:39:42.506765matrix.arvenenaske.de sshd[729884]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.54.233.228
2020-01-08T13:39:42.498443matrix.arvenenaske.de sshd[729884]: Invalid user feered from 123.54.233.228 port 51054
2020-01-08T13:39:44.269616matrix.arvenenaske.de sshd[729884]: Failed password for invalid user feered from 123.54.233.228 port 51054 ssh2
2020-01-08T13:41:41.952375matrix.arvenenaske.de sshd[729890]: Invalid user ted from 123.54.233.228 port 34430
2020-01-08T13:41:41.958919matrix.arvenenaske.de sshd[729890]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.54.233.228 user=t........
------------------------------

Jan  8 04:51:45 wbs sshd\[4102\]: Invalid user nyx from 128.199.47.148
Jan  8 04:51:45 wbs sshd\[4102\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.47.148
Jan  8 04:51:46 wbs sshd\[4102\]: Failed password for invalid user nyx from 128.199.47.148 port 55154 ssh2
Jan  8 04:58:35 wbs sshd\[4699\]: Invalid user Administrator from 128.199.47.148
Jan  8 04:58:35 wbs sshd\[4699\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.47.148

2020-01-08 07:03:26 dovecot_login authenticator failed for (bjhui) [106.112.89.37]:49939 I=[192.147.25.65]:25: 535 Incorrect authentication data (set_id=limin@lerctr.org)
2020-01-08 07:03:34 dovecot_login authenticator failed for (dnqhh) [106.112.89.37]:49939 I=[192.147.25.65]:25: 535 Incorrect authentication data (set_id=limin@lerctr.org)
2020-01-08 07:03:46 dovecot_login authenticator failed for (wcqyk) [106.112.89.37]:49939 I=[192.147.25.65]:25: 535 Incorrect authentication data (set_id=limin@lerctr.org)
...

Lines containing failures of 37.76.141.211
Jan  8 13:46:10 shared05 sshd[14482]: Invalid user admin from 37.76.141.211 port 47372
Jan  8 13:46:11 shared05 sshd[14482]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.76.141.211
Jan  8 13:46:13 shared05 sshd[14482]: Failed password for invalid user admin from 37.76.141.211 port 47372 ssh2


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=37.76.141.211

Jan 8 15:45:46 *host* sshd\[31602\]: Unable to negotiate with 112.85.42.176 port 8166: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1 \[preauth\] ...

Jan  8 21:02:49 bacztwo courieresmtpd[31438]: error,relay=::ffff:79.133.200.146,from=,to=: 511 Blacklisted by zen.spamhaus.org
Jan  8 21:03:05 bacztwo courieresmtpd[31438]: error,relay=::ffff:79.133.200.146,from=,to=: 511 Blacklisted by zen.spamhaus.org
Jan  8 21:03:38 bacztwo courieresmtpd[31438]: error,relay=::ffff:79.133.200.146,from=,to=: 511 Blacklisted by zen.spamhaus.org
Jan  8 21:04:25 bacztwo courieresmtpd[8856]: error,relay=::ffff:79.133.200.146,from=,to=: 511 Blacklisted by zen.spamhaus.org
Jan  8 21:04:42 bacztwo courieresmtpd[8856]: error,relay=::ffff:79.133.200.146,from=,to=: 511 Blacklisted by zen.spamhaus.org
...

Automatic report - Port Scan Attack

Jan  8 15:04:31 grey postfix/smtpd\[12562\]: NOQUEUE: reject: RCPT from wandering.swingthelamp.com\[69.94.158.122\]: 554 5.7.1 Service unavailable\; Client host \[69.94.158.122\] blocked using truncate.gbudb.net\; http://www.gbudb.com/truncate/ \[69.94.158.122\]\; from=\ to=\ proto=ESMTP helo=\
...

Jan  8 13:04:12 unicornsoft sshd\[9684\]: User root from 27.61.166.184 not allowed because not listed in AllowUsers
Jan  8 13:04:12 unicornsoft sshd\[9684\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.61.166.184  user=root
Jan  8 13:04:14 unicornsoft sshd\[9684\]: Failed password for invalid user root from 27.61.166.184 port 12700 ssh2

Automated report (2020-01-08T13:04:29+00:00). Scraper detected at this address.

Jan  8 14:03:17 tor-proxy-06 sshd\[10773\]: Connection closed by 81.4.150.134 port 49554 \[preauth\]
Jan  8 14:03:49 tor-proxy-06 sshd\[10769\]: Invalid user aigneis from 81.4.150.134 port 48599
Jan  8 14:03:55 tor-proxy-06 sshd\[10771\]: Invalid user aigneis from 81.4.150.134 port 48956
...