Bruteforce detected by fail2ban

Jun 16 14:30:22 onepixel sshd[1395555]: Failed password for invalid user xtra from 59.167.122.246 port 21147 ssh2
Jun 16 14:33:26 onepixel sshd[1396002]: Invalid user ftp from 59.167.122.246 port 18751
Jun 16 14:33:26 onepixel sshd[1396002]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=59.167.122.246 
Jun 16 14:33:26 onepixel sshd[1396002]: Invalid user ftp from 59.167.122.246 port 18751
Jun 16 14:33:28 onepixel sshd[1396002]: Failed password for invalid user ftp from 59.167.122.246 port 18751 ssh2

Jun 16 21:17:11 abendstille sshd\[32315\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.215  user=root
Jun 16 21:17:14 abendstille sshd\[32315\]: Failed password for root from 218.92.0.215 port 25788 ssh2
Jun 16 21:17:19 abendstille sshd\[32495\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.215  user=root
Jun 16 21:17:21 abendstille sshd\[32495\]: Failed password for root from 218.92.0.215 port 52635 ssh2
Jun 16 21:17:23 abendstille sshd\[32495\]: Failed password for root from 218.92.0.215 port 52635 ssh2
...

2020-06-16T20:19:21.342155n23.at sshd[932]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.99.6.184  user=root
2020-06-16T20:19:23.219019n23.at sshd[932]: Failed password for root from 138.99.6.184 port 41466 ssh2
2020-06-16T20:22:51.456879n23.at sshd[4255]: Invalid user lf from 138.99.6.184 port 35526
...

Jun 16 10:59:40 web1 sshd[1193]: Failed password for r.r from 35.204.192.108 port 47042 ssh2
Jun 16 10:59:40 web1 sshd[1193]: Received disconnect from 35.204.192.108: 11: Bye Bye [preauth]
Jun 16 11:03:04 web1 sshd[1631]: Failed password for r.r from 35.204.192.108 port 54084 ssh2
Jun 16 11:03:04 web1 sshd[1631]: Received disconnect from 35.204.192.108: 11: Bye Bye [preauth]
Jun 16 11:06:28 web1 sshd[2058]: Failed password for r.r from 35.204.192.108 port 58506 ssh2
Jun 16 11:06:28 web1 sshd[2058]: Received disconnect from 35.204.192.108: 11: Bye Bye [preauth]
Jun 16 11:09:48 web1 sshd[2203]: Failed password for r.r from 35.204.192.108 port 34708 ssh2
Jun 16 11:09:48 web1 sshd[2203]: Received disconnect from 35.204.192.108: 11: Bye Bye [preauth]
Jun 16 11:13:06 web1 sshd[2657]: Failed password for r.r from 35.204.192.108 port 39154 ssh2
Jun 16 11:13:06 web1 sshd[2657]: Received disconnect from 35.204.192.108: 11: Bye Bye [preauth]
Jun 16 11:16:25 web1 sshd[3090]: Invali........
-------------------------------

(imapd) Failed IMAP login from 113.161.36.115 (VN/Vietnam/static.vnpt.vn): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Jun 16 16:47:07 ir1 dovecot[2885757]: imap-login: Disconnected (auth failed, 1 attempts in 5 secs): user=, method=PLAIN, rip=113.161.36.115, lip=5.63.12.44, TLS, session=

Unauthorized connection attempt from IP address 46.32.96.43 on Port 445(SMB)

2020-06-16T14:15:32.293107sd-86998 sshd[9939]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.206.44.101  user=root
2020-06-16T14:15:34.429261sd-86998 sshd[9939]: Failed password for root from 123.206.44.101 port 57446 ssh2
2020-06-16T14:17:00.154567sd-86998 sshd[10097]: Invalid user pyuser from 123.206.44.101 port 45526
2020-06-16T14:17:00.156861sd-86998 sshd[10097]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.206.44.101
2020-06-16T14:17:00.154567sd-86998 sshd[10097]: Invalid user pyuser from 123.206.44.101 port 45526
2020-06-16T14:17:01.705448sd-86998 sshd[10097]: Failed password for invalid user pyuser from 123.206.44.101 port 45526 ssh2
...

Brute force password guessing

Cowrie Honeypot: 10 unauthorised SSH/Telnet login attempts between 2020-06-16T16:13:48Z and 2020-06-16T16:48:01Z

2020-06-16T14:11:39.568495amanda2.illicoweb.com sshd\[29942\]: Invalid user jiangtao from 134.175.216.112 port 33842
2020-06-16T14:11:39.572145amanda2.illicoweb.com sshd\[29942\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.175.216.112
2020-06-16T14:11:42.054608amanda2.illicoweb.com sshd\[29942\]: Failed password for invalid user jiangtao from 134.175.216.112 port 33842 ssh2
2020-06-16T14:16:46.101987amanda2.illicoweb.com sshd\[30090\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.175.216.112  user=root
2020-06-16T14:16:48.062668amanda2.illicoweb.com sshd\[30090\]: Failed password for root from 134.175.216.112 port 58486 ssh2
...

Unauthorized connection attempt from IP address 203.187.238.188 on Port 445(SMB)

Jun 16 21:10:16 srv-ubuntu-dev3 sshd[10352]: Invalid user eam from 107.170.254.146
Jun 16 21:10:16 srv-ubuntu-dev3 sshd[10352]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.170.254.146
Jun 16 21:10:16 srv-ubuntu-dev3 sshd[10352]: Invalid user eam from 107.170.254.146
Jun 16 21:10:18 srv-ubuntu-dev3 sshd[10352]: Failed password for invalid user eam from 107.170.254.146 port 45838 ssh2
Jun 16 21:13:08 srv-ubuntu-dev3 sshd[10782]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.170.254.146  user=root
Jun 16 21:13:09 srv-ubuntu-dev3 sshd[10782]: Failed password for root from 107.170.254.146 port 45428 ssh2
Jun 16 21:16:06 srv-ubuntu-dev3 sshd[11296]: Invalid user mig from 107.170.254.146
Jun 16 21:16:06 srv-ubuntu-dev3 sshd[11296]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.170.254.146
Jun 16 21:16:06 srv-ubuntu-dev3 sshd[11296]: Invalid user mig from 
...

ssh intrusion attempt

Repeated RDP login failures. Last user: administrator