May 15 16:17:30 vps647732 sshd[8122]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.34.131.57
May 15 16:17:32 vps647732 sshd[8122]: Failed password for invalid user admin from 193.34.131.57 port 60681 ssh2
...

Automatic report BANNED IP

May 15 14:34:29 s1 sshd\[24989\]: Invalid user ubuntu from 168.232.167.58 port 55564
May 15 14:34:29 s1 sshd\[24989\]: Failed password for invalid user ubuntu from 168.232.167.58 port 55564 ssh2
May 15 14:36:11 s1 sshd\[27723\]: Invalid user tester from 168.232.167.58 port 49876
May 15 14:36:11 s1 sshd\[27723\]: Failed password for invalid user tester from 168.232.167.58 port 49876 ssh2
May 15 14:37:47 s1 sshd\[29641\]: Invalid user admins from 168.232.167.58 port 44184
May 15 14:37:47 s1 sshd\[29641\]: Failed password for invalid user admins from 168.232.167.58 port 44184 ssh2
...

2020-05-15T14:37:59.407366abusebot-3.cloudsearch.cf sshd[11109]: Invalid user 1234 from 141.98.81.81 port 53926
2020-05-15T14:37:59.412770abusebot-3.cloudsearch.cf sshd[11109]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=141.98.81.81
2020-05-15T14:37:59.407366abusebot-3.cloudsearch.cf sshd[11109]: Invalid user 1234 from 141.98.81.81 port 53926
2020-05-15T14:38:00.682568abusebot-3.cloudsearch.cf sshd[11109]: Failed password for invalid user 1234 from 141.98.81.81 port 53926 ssh2
2020-05-15T14:38:34.004131abusebot-3.cloudsearch.cf sshd[11199]: Invalid user user from 141.98.81.81 port 41364
2020-05-15T14:38:34.012432abusebot-3.cloudsearch.cf sshd[11199]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=141.98.81.81
2020-05-15T14:38:34.004131abusebot-3.cloudsearch.cf sshd[11199]: Invalid user user from 141.98.81.81 port 41364
2020-05-15T14:38:35.753989abusebot-3.cloudsearch.cf sshd[11199]: Failed password fo
...

May 15 16:39:39 relay dovecot: imap-login: Disconnected: Inactivity \(auth failed, 1 attempts in 180 secs\): user=\, method=PLAIN, rip=185.22.142.197, lip=176.9.177.164, session=\
May 15 16:39:41 relay dovecot: imap-login: Disconnected: Inactivity \(auth failed, 1 attempts in 180 secs\): user=\, method=PLAIN, rip=185.22.142.197, lip=176.9.177.164, session=\
May 15 16:40:03 relay dovecot: imap-login: Disconnected: Inactivity \(auth failed, 1 attempts in 180 secs\): user=\, method=PLAIN, rip=185.22.142.197, lip=176.9.177.164, session=\<4M0mv7Cl/Mu5Fo7F\>
May 15 16:45:12 relay dovecot: imap-login: Disconnected: Inactivity \(auth failed, 1 attempts in 180 secs\): user=\, method=PLAIN, rip=185.22.142.197, lip=176.9.177.164, session=\<7wmZ0bClCp65Fo7F\>
May 15 16:45:14 relay dovecot: imap-login: Disconnected: Inactivity \(auth failed, 1 attempts in 180
...

(eximsyntax) Exim syntax errors from 14.252.203.143 (VN/Vietnam/static.vnpt.vn): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 2020-05-15 16:55:38 SMTP call from [14.252.203.143] dropped: too many syntax or protocol errors (last command was "?\034?\032?\027?\031?\034?\033?\030?\032?\026?\016?\r?\v?\f?	?")

W 31101,/var/log/nginx/access.log,-,-

2020-05-15T12:21:49.606708shield sshd\[26563\]: Invalid user alejo from 178.59.96.141 port 48608
2020-05-15T12:21:49.615810shield sshd\[26563\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=178-96-141.static.cyta.gr
2020-05-15T12:21:51.963259shield sshd\[26563\]: Failed password for invalid user alejo from 178.59.96.141 port 48608 ssh2
2020-05-15T12:26:01.438704shield sshd\[27653\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=178-96-141.static.cyta.gr  user=root
2020-05-15T12:26:03.379837shield sshd\[27653\]: Failed password for root from 178.59.96.141 port 56012 ssh2

May 15 13:26:14 l02a sshd[17447]: Invalid user lab from 212.237.28.69
May 15 13:26:14 l02a sshd[17447]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.237.28.69 
May 15 13:26:14 l02a sshd[17447]: Invalid user lab from 212.237.28.69
May 15 13:26:16 l02a sshd[17447]: Failed password for invalid user lab from 212.237.28.69 port 44624 ssh2

SQL Injection in QueryString parameter: 2" or (1,2)=(select*from(select name_const(CHAR(111,108,111,108,111,115,104,101,114),1),name_const(CHAR(111,108,111,108,111,115,104,101,114),1))a) -- "x"="x

Lines containing failures of 156.215.138.247
May 13 13:31:53 shared11 sshd[4080]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.215.138.247  user=r.r
May 13 13:31:55 shared11 sshd[4080]: Failed password for r.r from 156.215.138.247 port 56026 ssh2
May 13 13:31:55 shared11 sshd[4080]: Received disconnect from 156.215.138.247 port 56026:11: Bye Bye [preauth]
May 13 13:31:55 shared11 sshd[4080]: Disconnected from authenticating user r.r 156.215.138.247 port 56026 [preauth]
May 13 13:39:12 shared11 sshd[7051]: Invalid user user from 156.215.138.247 port 49894
May 13 13:39:12 shared11 sshd[7051]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.215.138.247


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=156.215.138.247

web-1 [ssh_2] SSH Attack

May 15 14:50:46 OPSO sshd\[26651\]: Invalid user fiona from 187.0.160.130 port 37358
May 15 14:50:46 OPSO sshd\[26651\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.0.160.130
May 15 14:50:47 OPSO sshd\[26651\]: Failed password for invalid user fiona from 187.0.160.130 port 37358 ssh2
May 15 14:52:44 OPSO sshd\[27186\]: Invalid user greg from 187.0.160.130 port 58730
May 15 14:52:44 OPSO sshd\[27186\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.0.160.130

May 15 17:02:41 sso sshd[11893]: Failed password for root from 95.141.193.7 port 22686 ssh2
...

" "