Dec  5 01:21:35 wbs sshd\[7469\]: Invalid user sinusbot7 from 35.205.47.34
Dec  5 01:21:35 wbs sshd\[7469\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.47.205.35.bc.googleusercontent.com
Dec  5 01:21:37 wbs sshd\[7469\]: Failed password for invalid user sinusbot7 from 35.205.47.34 port 56566 ssh2
Dec  5 01:27:44 wbs sshd\[8066\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.47.205.35.bc.googleusercontent.com  user=root
Dec  5 01:27:46 wbs sshd\[8066\]: Failed password for root from 35.205.47.34 port 39912 ssh2

Dec  4 00:50:37 giraffe sshd[19849]: Invalid user ogden from 178.128.20.4
Dec  4 00:50:37 giraffe sshd[19849]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.20.4
Dec  4 00:50:39 giraffe sshd[19849]: Failed password for invalid user ogden from 178.128.20.4 port 44428 ssh2
Dec  4 00:50:39 giraffe sshd[19849]: Received disconnect from 178.128.20.4 port 44428:11: Bye Bye [preauth]
Dec  4 00:50:39 giraffe sshd[19849]: Disconnected from 178.128.20.4 port 44428 [preauth]
Dec  4 00:58:53 giraffe sshd[20128]: Invalid user jocteur from 178.128.20.4
Dec  4 00:58:53 giraffe sshd[20128]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.20.4
Dec  4 00:58:55 giraffe sshd[20128]: Failed password for invalid user jocteur from 178.128.20.4 port 44906 ssh2
Dec  4 00:58:55 giraffe sshd[20128]: Received disconnect from 178.128.20.4 port 44906:11: Bye Bye [preauth]
Dec  4 00:58:55 giraffe sshd[20........
-------------------------------

05.12.2019 11:05:53 Connection to port 8041 blocked by firewall

2019-12-05T11:10:40.692431abusebot-4.cloudsearch.cf sshd\[13589\]: Invalid user pw from 164.132.225.250 port 45344

MultiHost/MultiPort Probe, Scan, Hack -

Dec  5 12:09:52 vmanager6029 sshd\[14969\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.227.187.185  user=backup
Dec  5 12:09:55 vmanager6029 sshd\[14969\]: Failed password for backup from 165.227.187.185 port 39548 ssh2
Dec  5 12:18:26 vmanager6029 sshd\[15180\]: Invalid user mckinsey from 165.227.187.185 port 40692
Dec  5 12:18:26 vmanager6029 sshd\[15180\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.227.187.185

Dec  5 07:26:50 server postfix/smtpd[14278]: NOQUEUE: reject: RCPT from sown.wokoro.com[217.112.142.60]: 554 5.7.1 Service unavailable; Client host [217.112.142.60] blocked using zen.spamhaus.org; https://www.spamhaus.org/sbl/query/SBLCSS; from= to= proto=ESMTP helo=

[ThuDec0507:26:46.8278912019][:error][pid429:tid47011388753664][client203.195.229.145:4587][client203.195.229.145]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch"\(\?:\\\\\\\\\(chr\?\\\\\\\\\(\?[0-9]{1\,3}\?\\\\\\\\\)\|\?=\?f\(\?:open\|write\)\?\\\\\\\\\(\|\\\\\\\\b\(\?:passthru\|serialize\|php_uname\|phpinfo\|shell_exec\|preg_\\\\\\\\w \|mysql_query\|exec\|eval\|base64_decode\|decode_base64\|rot13\|base64_url_decode\|gz\(\?:inflate\|decode\|uncompress\)\|strrev\|zlib_\\\\\\\\w \)\\\\\\\\b\?\(\?..."atARGS:widgetConfig[code].[file"/usr/local/apache.ea3/conf/modsec_rules/10_asl_rules.conf"][line"767"][id"340095"][rev"53"][msg"Atomicorp.comWAFRules:AttackBlocked-PHPfunctioninArgument-thismaybeanattack."][data"die\(@md5\,ARGS:widgetConfig[code]"][severity"CRITICAL"][hostname"148.251.104.86"][uri"/index.php"][unique_id"XeijJr6bEKgXVLV3gBnAEAAAAgw"][ThuDec0507:26:47.5166132019][:error][pid429:tid47011388753664][client203.195.229.145:4587][client203.195.229.145]ModSecurity:Accessdeni

12/05/2019-04:41:29.783384 78.128.112.114 Protocol: 6 ET SCAN NMAP -sS window 1024

Dec  5 14:44:09 hosting sshd[15871]: Invalid user user from 59.36.75.227 port 53814
...

Dec  5 08:03:48 sshd: Connection from 94.191.8.232 port 55550
Dec  5 08:03:50 sshd: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.191.8.232  user=root
Dec  5 08:03:52 sshd: Failed password for root from 94.191.8.232 port 55550 ssh2
Dec  5 08:03:52 sshd: Received disconnect from 94.191.8.232: 11: Bye Bye [preauth]

Dec  5 06:14:42 sanyalnet-cloud-vps3 sshd[23467]: Connection from 217.61.20.216 port 44356 on 45.62.248.66 port 22
Dec  5 06:14:44 sanyalnet-cloud-vps3 sshd[23467]: Address 217.61.20.216 maps to host216-20-61-217.static.arubacloud.com, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!
Dec  5 06:14:44 sanyalnet-cloud-vps3 sshd[23467]: User r.r from 217.61.20.216 not allowed because not listed in AllowUsers
Dec  5 06:14:44 sanyalnet-cloud-vps3 sshd[23467]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.61.20.216  user=r.r
Dec  5 06:14:46 sanyalnet-cloud-vps3 sshd[23467]: Failed none for invalid user r.r from 217.61.20.216 port 44356 ssh2
Dec  5 06:14:48 sanyalnet-cloud-vps3 sshd[23467]: Failed password for invalid user r.r from 217.61.20.216 port 44356 ssh2
Dec  5 06:14:48 sanyalnet-cloud-vps3 sshd[23467]: Connection closed by 217.61.20.216 [preauth]
Dec  5 06:14:48 sanyalnet-cloud-vps3 sshd[23467]: PAM 1 m........
-------------------------------

ssh brute force

Unauthorised access (Dec  5) SRC=115.73.192.185 LEN=48 TTL=109 ID=6433 DF TCP DPT=445 WINDOW=8192 SYN 
Unauthorised access (Dec  5) SRC=115.73.192.185 LEN=48 TTL=109 ID=20988 DF TCP DPT=445 WINDOW=8192 SYN

TCP Port Scanning