May  3 04:57:57 NPSTNNYC01T sshd[17573]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.136.137.227
May  3 04:57:59 NPSTNNYC01T sshd[17573]: Failed password for invalid user administrator from 152.136.137.227 port 53384 ssh2
May  3 05:02:45 NPSTNNYC01T sshd[17944]: Failed password for root from 152.136.137.227 port 50146 ssh2
...

May  3 12:34:47 host sshd[48744]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.229.15.228  user=root
May  3 12:34:49 host sshd[48744]: Failed password for root from 111.229.15.228 port 40866 ssh2
...

"XSS Attack Detected via libinjection - Matched Data: XSS data found within ARGS_NAMES:

C1,WP GET /suche/wp-login.php

Invalid user bitbucket from 114.33.203.69 port 60701

May  3 11:54:28 santamaria sshd\[14460\]: Invalid user panda from 161.35.0.47
May  3 11:54:28 santamaria sshd\[14460\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.35.0.47
May  3 11:54:30 santamaria sshd\[14460\]: Failed password for invalid user panda from 161.35.0.47 port 43734 ssh2
...

SSH Brute-Forcing (server2)

Invalid user resolve from 119.4.225.31 port 37354

Lines containing failures of 128.199.200.117
May  2 06:05:45 kmh-vmh-001-fsn07 sshd[17002]: Invalid user prashant from 128.199.200.117 port 56518
May  2 06:05:45 kmh-vmh-001-fsn07 sshd[17002]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.200.117 
May  2 06:05:47 kmh-vmh-001-fsn07 sshd[17002]: Failed password for invalid user prashant from 128.199.200.117 port 56518 ssh2
May  2 06:05:48 kmh-vmh-001-fsn07 sshd[17002]: Received disconnect from 128.199.200.117 port 56518:11: Bye Bye [preauth]
May  2 06:05:48 kmh-vmh-001-fsn07 sshd[17002]: Disconnected from invalid user prashant 128.199.200.117 port 56518 [preauth]
May  2 06:15:28 kmh-vmh-001-fsn07 sshd[19792]: Invalid user postgres from 128.199.200.117 port 33086
May  2 06:15:28 kmh-vmh-001-fsn07 sshd[19792]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.200.117 


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=12

May  3 12:11:24 legacy sshd[20707]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.199.192
May  3 12:11:26 legacy sshd[20707]: Failed password for invalid user wfp from 167.71.199.192 port 46658 ssh2
May  3 12:12:48 legacy sshd[20733]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.199.192
...

May  3 09:36:28 scw-6657dc sshd[32550]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.196.74.23
May  3 09:36:28 scw-6657dc sshd[32550]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.196.74.23
May  3 09:36:31 scw-6657dc sshd[32550]: Failed password for invalid user deploy from 5.196.74.23 port 33102 ssh2
...

May  3 12:02:37 * sshd[544]: Failed password for root from 51.75.121.252 port 55300 ssh2

(imapd) Failed IMAP login from 189.59.5.91 (BR/Brazil/prpsolucoes.static.gvt.net.br): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: May  3 14:36:20 ir1 dovecot[264309]: imap-login: Disconnected (auth failed, 1 attempts in 5 secs): user=, method=PLAIN, rip=189.59.5.91, lip=5.63.12.44, TLS: Connection closed, session=

Trying ports that it shouldn't be.

May  3 12:16:04 legacy sshd[20865]: Failed password for root from 51.38.225.124 port 43922 ssh2
May  3 12:20:12 legacy sshd[21039]: Failed password for root from 51.38.225.124 port 49796 ssh2
May  3 12:24:31 legacy sshd[21212]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.225.124
...