TCP (SYN) 51.75.249.70:55031 -> port 3389, len 44

Jun  3 07:53:38 legacy sshd[30966]: Failed password for root from 104.248.209.204 port 57624 ssh2
Jun  3 07:57:08 legacy sshd[31104]: Failed password for root from 104.248.209.204 port 33436 ssh2
...

Distributed brute force attack

Jun  3 08:16:29 ucs sshd\[26030\]: Invalid user admin from 141.98.81.84 port 42789
Jun  3 08:16:50 ucs sshd\[2585\]: Invalid user Admin from 141.98.81.84 port 46255
Jun  3 08:17:42 ucs sshd\[2792\]: Invalid user admin from 141.98.81.84 port 42063
...

Jun  3 08:34:08 pkdns2 sshd\[49780\]: Failed password for root from 49.88.112.60 port 57768 ssh2Jun  3 08:34:11 pkdns2 sshd\[49780\]: Failed password for root from 49.88.112.60 port 57768 ssh2Jun  3 08:34:13 pkdns2 sshd\[49780\]: Failed password for root from 49.88.112.60 port 57768 ssh2Jun  3 08:35:05 pkdns2 sshd\[49823\]: Failed password for root from 49.88.112.60 port 26902 ssh2Jun  3 08:35:08 pkdns2 sshd\[49823\]: Failed password for root from 49.88.112.60 port 26902 ssh2Jun  3 08:35:10 pkdns2 sshd\[49823\]: Failed password for root from 49.88.112.60 port 26902 ssh2
...

Jun  3 06:57:10 debian kernel: [59195.301248] [UFW BLOCK] IN=eth0 OUT= MAC=52:54:00:be:e4:65:08:e8:4f:6e:48:0c:08:00 SRC=162.243.142.136 DST=89.252.131.35 LEN=40 TOS=0x00 PREC=0x00 TTL=240 ID=54321 PROTO=TCP SPT=38164 DPT=2455 WINDOW=65535 RES=0x00 SYN URGP=0

Jun  3 01:43:25 ny01 sshd[12547]: Failed password for root from 192.81.208.44 port 54857 ssh2
Jun  3 01:46:23 ny01 sshd[12902]: Failed password for root from 192.81.208.44 port 51766 ssh2

Registration form abuse

Jun  3 08:07:21 ArkNodeAT sshd\[32058\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.209.0.100  user=root
Jun  3 08:07:21 ArkNodeAT sshd\[32057\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.209.0.100  user=root
Jun  3 08:07:23 ArkNodeAT sshd\[32058\]: Failed password for root from 85.209.0.100 port 51272 ssh2

(imapd) Failed IMAP login from 72.230.102.130 (US/United States/cpe-72-230-102-130.twcny.res.rr.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Jun  3 08:26:40 ir1 dovecot[2885757]: imap-login: Disconnected (auth failed, 1 attempts in 2 secs): user=, method=PLAIN, rip=72.230.102.130, lip=5.63.12.44, session=

167.71.209.115 - - [03/Jun/2020:05:56:21 +0200] "GET /wp-login.php HTTP/1.1" 200 6614 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
167.71.209.115 - - [03/Jun/2020:05:56:23 +0200] "POST /wp-login.php HTTP/1.1" 200 6919 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
167.71.209.115 - - [03/Jun/2020:05:56:25 +0200] "POST /xmlrpc.php HTTP/1.1" 200 427 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"

Jun  2 19:46:48 php1 sshd\[29921\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.227.236.60  user=root
Jun  2 19:46:50 php1 sshd\[29921\]: Failed password for root from 125.227.236.60 port 59918 ssh2
Jun  2 19:50:08 php1 sshd\[30188\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.227.236.60  user=root
Jun  2 19:50:11 php1 sshd\[30188\]: Failed password for root from 125.227.236.60 port 58190 ssh2
Jun  2 19:53:36 php1 sshd\[30435\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.227.236.60  user=root

Jun  3 06:59:32 jane sshd[13224]: Failed password for root from 111.10.43.201 port 37767 ssh2
...

Jun  3 00:53:43 firewall sshd[28130]: Failed password for root from 103.81.84.10 port 60986 ssh2
Jun  3 00:56:57 firewall sshd[28262]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.81.84.10  user=root
Jun  3 00:56:59 firewall sshd[28262]: Failed password for root from 103.81.84.10 port 50214 ssh2
...

Dovecot Invalid User Login Attempt.