Sep  3 09:33:03 ncomp sshd[24511]: Invalid user ali from 51.15.126.127 port 38844
Sep  3 09:33:03 ncomp sshd[24511]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.15.126.127
Sep  3 09:33:03 ncomp sshd[24511]: Invalid user ali from 51.15.126.127 port 38844
Sep  3 09:33:05 ncomp sshd[24511]: Failed password for invalid user ali from 51.15.126.127 port 38844 ssh2

Automatic report - XMLRPC Attack

(sshd) Failed SSH login from 172.81.241.92 (CN/China/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Sep  2 22:31:04 server sshd[21384]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=172.81.241.92  user=root
Sep  2 22:31:06 server sshd[21384]: Failed password for root from 172.81.241.92 port 58246 ssh2
Sep  2 22:39:11 server sshd[23923]: Invalid user postgres from 172.81.241.92 port 55070
Sep  2 22:39:13 server sshd[23923]: Failed password for invalid user postgres from 172.81.241.92 port 55070 ssh2
Sep  2 22:41:40 server sshd[24617]: Invalid user mary from 172.81.241.92 port 56360

Icarus honeypot on github

Sep  3 18:03:04 marvibiene sshd[6566]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.220.102.244  user=root
Sep  3 18:03:06 marvibiene sshd[6566]: Failed password for root from 185.220.102.244 port 26810 ssh2
Sep  3 18:03:09 marvibiene sshd[6566]: Failed password for root from 185.220.102.244 port 26810 ssh2
Sep  3 18:03:04 marvibiene sshd[6566]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.220.102.244  user=root
Sep  3 18:03:06 marvibiene sshd[6566]: Failed password for root from 185.220.102.244 port 26810 ssh2
Sep  3 18:03:09 marvibiene sshd[6566]: Failed password for root from 185.220.102.244 port 26810 ssh2

Sep  2 09:02:29 XXX sshd[2976]: Did not receive identification string from 185.239.242.195
Sep  2 09:03:33 XXX sshd[2977]: reveeclipse mapping checking getaddrinfo for scl-00196.mails--servers.org [185.239.242.195] failed - POSSIBLE BREAK-IN ATTEMPT!
Sep  2 09:03:33 XXX sshd[2977]: User r.r from 185.239.242.195 not allowed because none of user's groups are listed in AllowGroups
Sep  2 09:03:33 XXX sshd[2977]: Received disconnect from 185.239.242.195: 11: Normal Shutdown, Thank you for playing [preauth]
Sep  2 09:04:32 XXX sshd[3305]: reveeclipse mapping checking getaddrinfo for scl-00196.mails--servers.org [185.239.242.195] failed - POSSIBLE BREAK-IN ATTEMPT!
Sep  2 09:04:32 XXX sshd[3305]: User r.r from 185.239.242.195 not allowed because none of user's groups are listed in AllowGroups
Sep  2 09:04:32 XXX sshd[3305]: Received disconnect from 185.239.242.195: 11: Normal Shutdown, Thank you for playing [preauth]
Sep  2 09:05:32 XXX sshd[3492]: reveeclipse mapping checkin........
-------------------------------

Sep  3 16:02:09 gospond sshd[29580]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.158.36 
Sep  3 16:02:09 gospond sshd[29580]: Invalid user dz from 180.76.158.36 port 48358
Sep  3 16:02:10 gospond sshd[29580]: Failed password for invalid user dz from 180.76.158.36 port 48358 ssh2
...

Sep  3 19:53:46 OPSO sshd\[13230\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.88.112.117  user=root
Sep  3 19:53:48 OPSO sshd\[13230\]: Failed password for root from 49.88.112.117 port 60403 ssh2
Sep  3 19:53:50 OPSO sshd\[13230\]: Failed password for root from 49.88.112.117 port 60403 ssh2
Sep  3 19:53:53 OPSO sshd\[13230\]: Failed password for root from 49.88.112.117 port 60403 ssh2
Sep  3 19:55:00 OPSO sshd\[13252\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.88.112.117  user=root

Invalid user admin from 175.24.72.167 port 51261

port scan and connect, tcp 80 (http)

web-1 [ssh] SSH Attack

[2020-09-03 14:10:59] NOTICE[1194] chan_sip.c: Registration from '"104" ' failed for '108.62.121.180:5094' - Wrong password
[2020-09-03 14:10:59] SECURITY[1233] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-09-03T14:10:59.614-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="104",SessionID="0x7f2ddc023af8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/108.62.121.180/5094",Challenge="28e7e39a",ReceivedChallenge="28e7e39a",ReceivedHash="8eafc90611c91e013aa4e4be2bf418df"
[2020-09-03 14:10:59] NOTICE[1194] chan_sip.c: Registration from '"104" ' failed for '108.62.121.180:5094' - Wrong password
[2020-09-03 14:10:59] SECURITY[1233] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-09-03T14:10:59.713-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="104",SessionID="0x7f2ddc00cc78",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/108.6
...

Sep  2 18:33:23 v22019038103785759 sshd\[31193\]: Invalid user admin from 193.112.27.122 port 50848
Sep  2 18:33:23 v22019038103785759 sshd\[31193\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.112.27.122
Sep  2 18:33:25 v22019038103785759 sshd\[31193\]: Failed password for invalid user admin from 193.112.27.122 port 50848 ssh2
Sep  2 18:42:08 v22019038103785759 sshd\[31947\]: Invalid user sig from 193.112.27.122 port 33466
Sep  2 18:42:08 v22019038103785759 sshd\[31947\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.112.27.122
...

[portscan] Port scan

Sep  3 12:19:17 jane sshd[10567]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.207.78.83 
Sep  3 12:19:19 jane sshd[10567]: Failed password for invalid user vic from 123.207.78.83 port 41972 ssh2
...