Apr  4 06:49:25 legacy sshd[14536]: Failed password for root from 218.92.0.148 port 31169 ssh2
Apr  4 06:49:29 legacy sshd[14536]: Failed password for root from 218.92.0.148 port 31169 ssh2
Apr  4 06:49:32 legacy sshd[14536]: Failed password for root from 218.92.0.148 port 31169 ssh2
Apr  4 06:49:39 legacy sshd[14536]: error: maximum authentication attempts exceeded for root from 218.92.0.148 port 31169 ssh2 [preauth]
...

2020-04-04T03:50:10.460691abusebot-4.cloudsearch.cf sshd[11038]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=ip212.ip-46-105-148.eu  user=root
2020-04-04T03:50:12.888486abusebot-4.cloudsearch.cf sshd[11038]: Failed password for root from 46.105.148.212 port 46116 ssh2
2020-04-04T03:55:11.655641abusebot-4.cloudsearch.cf sshd[11368]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=ip212.ip-46-105-148.eu  user=root
2020-04-04T03:55:13.760821abusebot-4.cloudsearch.cf sshd[11368]: Failed password for root from 46.105.148.212 port 45796 ssh2
2020-04-04T03:58:52.993687abusebot-4.cloudsearch.cf sshd[11740]: Invalid user dingming from 46.105.148.212 port 56318
2020-04-04T03:58:52.999930abusebot-4.cloudsearch.cf sshd[11740]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=ip212.ip-46-105-148.eu
2020-04-04T03:58:52.993687abusebot-4.cloudsearch.cf sshd[11740]: Invalid user di
...

Apr  4 05:59:07 * sshd[27131]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.254.114.105
Apr  4 05:59:09 * sshd[27131]: Failed password for invalid user test from 51.254.114.105 port 50658 ssh2

2020-04-04T04:10:44.789470shield sshd\[21563\]: Invalid user zhangzhiyong from 106.13.234.197 port 53330
2020-04-04T04:10:44.792744shield sshd\[21563\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.234.197
2020-04-04T04:10:46.611359shield sshd\[21563\]: Failed password for invalid user zhangzhiyong from 106.13.234.197 port 53330 ssh2
2020-04-04T04:19:30.555541shield sshd\[23547\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.234.197  user=root
2020-04-04T04:19:32.249006shield sshd\[23547\]: Failed password for root from 106.13.234.197 port 49638 ssh2

Apr  3 20:39:54 archiv sshd[23583]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.25.141.132  user=r.r
Apr  3 20:39:56 archiv sshd[23583]: Failed password for r.r from 118.25.141.132 port 50918 ssh2
Apr  3 20:39:56 archiv sshd[23583]: Received disconnect from 118.25.141.132 port 50918:11: Bye Bye [preauth]
Apr  3 20:39:56 archiv sshd[23583]: Disconnected from 118.25.141.132 port 50918 [preauth]
Apr  3 20:55:31 archiv sshd[23820]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.25.141.132  user=r.r
Apr  3 20:55:33 archiv sshd[23820]: Failed password for r.r from 118.25.141.132 port 32922 ssh2
Apr  3 20:55:33 archiv sshd[23820]: Received disconnect from 118.25.141.132 port 32922:11: Bye Bye [preauth]
Apr  3 20:55:33 archiv sshd[23820]: Disconnected from 118.25.141.132 port 32922 [preauth]
Apr  3 21:00:51 archiv sshd[23915]: pam_unix(sshd:auth): authentication failure; logname= uid=0 ........
-------------------------------

ssh bruteforce

Apr  4 06:12:52 eventyay sshd[15994]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.144.79.157
Apr  4 06:12:53 eventyay sshd[15994]: Failed password for invalid user admin from 190.144.79.157 port 60314 ssh2
Apr  4 06:17:36 eventyay sshd[16146]: Failed password for root from 190.144.79.157 port 44058 ssh2
...

Apr  4 06:52:14 server sshd\[24323\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.4.217.96  user=root
Apr  4 06:52:17 server sshd\[24323\]: Failed password for root from 103.4.217.96 port 42260 ssh2
Apr  4 06:58:54 server sshd\[25785\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.4.217.96  user=root
Apr  4 06:58:56 server sshd\[25785\]: Failed password for root from 103.4.217.96 port 41870 ssh2
Apr  4 07:10:05 server sshd\[28425\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.4.217.96  user=root
...

Apr  4 06:11:14 pve sshd[4815]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.225.194.75 
Apr  4 06:11:16 pve sshd[4815]: Failed password for invalid user test_mpi from 43.225.194.75 port 52616 ssh2
Apr  4 06:15:15 pve sshd[5415]: Failed password for root from 43.225.194.75 port 56088 ssh2

Brute force attack against VPN service

2020-04-03 22:58:44 H=(OlczDkCxW5) [114.231.8.105]:3344 I=[192.147.25.65]:25 F= rejected RCPT <1761573796@qq.com>: RBL: found in thrukfz5b56tq6xao6odgdyjrq.zen.dq.spamhaus.net (127.0.0.11, 127.0.0.4, 127.0.0.3) (https://www.spamhaus.org/sbl/query/SBLCSS)
2020-04-03 22:58:51 dovecot_login authenticator failed for (bFygJhWIB) [114.231.8.105]:1627 I=[192.147.25.65]:25: 535 Incorrect authentication data (set_id=abuse@lerctr.org)
2020-04-03 22:59:01 dovecot_login authenticator failed for (RSQ6ej) [114.231.8.105]:4302 I=[192.147.25.65]:25: 535 Incorrect authentication data (set_id=abuse@lerctr.org)
...

Tried sshing with brute force.

Port Scanning Detected

Apr  3 20:54:48 mockhub sshd[9085]: Failed password for root from 67.205.135.127 port 52968 ssh2
...

Apr  3 23:54:06 ny01 sshd[18695]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.65.144.36
Apr  3 23:54:07 ny01 sshd[18695]: Failed password for invalid user xueyue from 159.65.144.36 port 36418 ssh2
Apr  3 23:58:26 ny01 sshd[19619]: Failed password for root from 159.65.144.36 port 45780 ssh2