Apr  5 07:19:25 server1 sshd\[21854\]: Invalid user 8 from 106.12.217.180
Apr  5 07:19:25 server1 sshd\[21854\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.217.180 
Apr  5 07:19:27 server1 sshd\[21854\]: Failed password for invalid user 8 from 106.12.217.180 port 40452 ssh2
Apr  5 07:22:58 server1 sshd\[22763\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.217.180  user=root
Apr  5 07:23:00 server1 sshd\[22763\]: Failed password for root from 106.12.217.180 port 56326 ssh2
...

Apr  5 16:50:32 hosting sshd[7731]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=90.162.244.87  user=root
Apr  5 16:50:34 hosting sshd[7731]: Failed password for root from 90.162.244.87 port 51582 ssh2
...

Unauthorized SSH login attempts

Automatic report - XMLRPC Attack

2020-04-05 07:44:46 H=(gHYd2yL8uB) [185.36.81.39]:61441 I=[192.147.25.65]:25 F= rejected RCPT : Sender verify failed
2020-04-05 07:44:50 dovecot_login authenticator failed for (rtYMgtT7H) [185.36.81.39]:61974 I=[192.147.25.65]:25: 535 Incorrect authentication data (set_id=mhogan@lerctr.org)
2020-04-05 07:44:57 dovecot_login authenticator failed for (RLtQbdpYx) [185.36.81.39]:63338 I=[192.147.25.65]:25: 535 Incorrect authentication data (set_id=mhogan@lerctr.org)
...

04/05/2020-09:53:41.901376 51.77.108.92 Protocol: 6 ET SCAN Potential SSH Scan

Sent UK TV licence scam email:
X-TM-Received-SPF: Pass (domain of rsfqktmk-ejvwj1xi-9dnw@telenet-ops.be 
	designates 195.130.137.88 as permitted sender) client-ip=195.130.137.88; 
	envelope-from=rsfqktmk-ejvwj1xi-9dnw@telenet-ops.be; 
	helo=michel.telenet-ops.be
X-TM-Authentication-Results: dkim=pass; No processed signatures and verification is not enforced
X-TM-AS-ERS: 195.130.137.88-127.9.0.1
X-TMASE-Version: StarCloud-1.3-8.5.1020-25336.006

Hyperlinks in email http://www.tvlicensing-3kyjh.securityassistants.com/

Unauthorized connection attempt from IP address 180.183.250.13 on Port 445(SMB)

Apr  5 14:35:17 DAAP sshd[6873]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.64.126.103  user=root
Apr  5 14:35:19 DAAP sshd[6873]: Failed password for root from 45.64.126.103 port 48220 ssh2
Apr  5 14:40:05 DAAP sshd[7047]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.64.126.103  user=root
Apr  5 14:40:06 DAAP sshd[7047]: Failed password for root from 45.64.126.103 port 60156 ssh2
Apr  5 14:44:53 DAAP sshd[7161]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.64.126.103  user=root
Apr  5 14:44:55 DAAP sshd[7161]: Failed password for root from 45.64.126.103 port 43846 ssh2
...

(imapd) Failed IMAP login from 183.89.215.47 (TH/Thailand/mx-ll-183.89.215-47.dynamic.3bb.in.th): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Apr  5 17:14:56 ir1 dovecot[566034]: imap-login: Disconnected (auth failed, 1 attempts in 14 secs): user=, method=PLAIN, rip=183.89.215.47, lip=5.63.12.44, TLS: Connection closed, session=

2020-04-05T13:18:38.485578shield sshd\[32692\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.82.137.35  user=root
2020-04-05T13:18:40.545737shield sshd\[32692\]: Failed password for root from 45.82.137.35 port 52956 ssh2
2020-04-05T13:23:03.851124shield sshd\[1215\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.82.137.35  user=root
2020-04-05T13:23:06.624003shield sshd\[1215\]: Failed password for root from 45.82.137.35 port 35692 ssh2
2020-04-05T13:27:16.253228shield sshd\[2054\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.82.137.35  user=root

xmlrpc attack

Apr  5 15:47:58 freya sshd[22909]: Invalid user zimbra from 125.133.19.221 port 43253
Apr  5 15:47:58 freya sshd[22909]: Disconnected from invalid user zimbra 125.133.19.221 port 43253 [preauth]
Apr  5 15:50:23 freya sshd[23307]: Invalid user john from 125.133.19.221 port 53250
Apr  5 15:50:23 freya sshd[23307]: Disconnected from invalid user john 125.133.19.221 port 53250 [preauth]
Apr  5 15:52:46 freya sshd[23666]: Invalid user oracle from 125.133.19.221 port 35025
...

Unauthorized connection attempt from IP address 36.22.182.26 on Port 445(SMB)

Attempt to attack host OS, exploiting network vulnerabilities, on 05-04-2020 13:45:08.