Dec  2 23:50:13 localhost sshd\[31331\]: Invalid user test from 177.128.104.207
Dec  2 23:50:13 localhost sshd\[31331\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.128.104.207
Dec  2 23:50:15 localhost sshd\[31331\]: Failed password for invalid user test from 177.128.104.207 port 34960 ssh2
Dec  2 23:56:46 localhost sshd\[31572\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.128.104.207  user=root
Dec  2 23:56:48 localhost sshd\[31572\]: Failed password for root from 177.128.104.207 port 40723 ssh2
...

/var/log/messages:Dec  2 03:37:19 sanyalnet-cloud-vps audispd: node=sanyalnet-cloud-vps.freeddns.org type=CRYPTO_SESSION msg=audhostname(1575257839.169:5792): pid=1134 uid=0 auid=4294967295 ses=4294967295 msg='op=start direction=from-server cipher=aes256-ctr ksize=256 mac=hmac-sha1 pfs=ecdh-sha2-nistp256 spid=1138 suid=74 rport=36762 laddr=104.167.106.93 lport=22  exe="/usr/sbin/sshd" hostname=? addr=121.244.27.222 terminal=? res=success'
/var/log/messages:Dec  2 03:37:19 sanyalnet-cloud-vps audispd: node=sanyalnet-cloud-vps.freeddns.org type=CRYPTO_SESSION msg=audhostname(1575257839.173:5793): pid=1134 uid=0 auid=4294967295 ses=4294967295 msg='op=start direction=from-client cipher=aes256-ctr ksize=256 mac=hmac-sha1 pfs=ecdh-sha2-nistp256 spid=1138 suid=74 rport=36762 laddr=104.167.106.93 lport=22  exe="/usr/sbin/sshd" hostname=? addr=121.244.27.222 terminal=? res=success'
/var/log/messages:Dec  2 03:37:20 sanyalnet-cloud-vps fail2ban.filter[1442]: INFO [sshd] Found 121........
-------------------------------

port scan and connect, tcp 1433 (ms-sql-s)

12/02/2019-22:34:16.037606 159.203.201.227 Protocol: 6 ET DROP Dshield Block Listed Source group 1

Dec  2 23:37:42 sbg01 sshd[12964]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.178.87.219
Dec  2 23:37:44 sbg01 sshd[12964]: Failed password for invalid user admin from 5.178.87.219 port 53316 ssh2
Dec  2 23:42:59 sbg01 sshd[13038]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.178.87.219

Dec  2 12:38:39 hanapaa sshd\[25310\]: Invalid user dagert from 31.27.38.242
Dec  2 12:38:39 hanapaa sshd\[25310\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=net-31-27-38-242.cust.vodafonedsl.it
Dec  2 12:38:41 hanapaa sshd\[25310\]: Failed password for invalid user dagert from 31.27.38.242 port 57658 ssh2
Dec  2 12:44:36 hanapaa sshd\[25977\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=net-31-27-38-242.cust.vodafonedsl.it  user=root
Dec  2 12:44:38 hanapaa sshd\[25977\]: Failed password for root from 31.27.38.242 port 41504 ssh2

\[2019-12-02 17:49:26\] NOTICE\[2754\] chan_sip.c: Registration from '"3000" \' failed for '75.102.27.106:5079' - Wrong password
\[2019-12-02 17:49:26\] SECURITY\[2765\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-12-02T17:49:26.006-0500",Severity="Error",Service="SIP",EventVersion="2",AccountID="3000",SessionID="0x7f26c493cc68",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/75.102.27.106/5079",Challenge="28d13915",ReceivedChallenge="28d13915",ReceivedHash="1ff2e56a78739300318af4e105ec108a"
\[2019-12-02 17:57:02\] NOTICE\[2754\] chan_sip.c: Registration from '"3000" \' failed for '75.102.27.106:5125' - Wrong password
\[2019-12-02 17:57:02\] SECURITY\[2765\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-12-02T17:57:02.835-0500",Severity="Error",Service="SIP",EventVersion="2",AccountID="3000",SessionID="0x7f26c42c7f08",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UD

SSH bruteforce

SSH authentication failure x 6 reported by Fail2Ban
...

[ssh] SSH attack

Dec  2 21:34:36 *** sshd[16663]: Invalid user delat from 128.199.145.205

Dec  3 04:34:44 vibhu-HP-Z238-Microtower-Workstation sshd\[5028\]: Invalid user zohri from 51.254.32.102
Dec  3 04:34:44 vibhu-HP-Z238-Microtower-Workstation sshd\[5028\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.254.32.102
Dec  3 04:34:46 vibhu-HP-Z238-Microtower-Workstation sshd\[5028\]: Failed password for invalid user zohri from 51.254.32.102 port 42784 ssh2
Dec  3 04:40:12 vibhu-HP-Z238-Microtower-Workstation sshd\[6383\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.254.32.102  user=root
Dec  3 04:40:14 vibhu-HP-Z238-Microtower-Workstation sshd\[6383\]: Failed password for root from 51.254.32.102 port 54638 ssh2
...

Dec  2 22:34:12 srv206 sshd[25662]: Invalid user pigliucci from 213.82.114.206
Dec  2 22:34:12 srv206 sshd[25662]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=host206-114-static.82-213-b.business.telecomitalia.it
Dec  2 22:34:12 srv206 sshd[25662]: Invalid user pigliucci from 213.82.114.206
Dec  2 22:34:13 srv206 sshd[25662]: Failed password for invalid user pigliucci from 213.82.114.206 port 41878 ssh2
...

Dec  2 23:36:21 vpn01 sshd[15535]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.236.239.60
Dec  2 23:36:24 vpn01 sshd[15535]: Failed password for invalid user admin from 104.236.239.60 port 38468 ssh2
...

Dec  2 23:38:58 eventyay sshd[30323]: Failed password for root from 112.85.42.177 port 28445 ssh2
Dec  2 23:39:12 eventyay sshd[30323]: error: maximum authentication attempts exceeded for root from 112.85.42.177 port 28445 ssh2 [preauth]
Dec  2 23:39:19 eventyay sshd[30331]: Failed password for root from 112.85.42.177 port 63325 ssh2
...