CMS (WordPress or Joomla) login attempt.

Apr  6 06:50:12 server sshd\[22062\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.32.215.160  user=root
Apr  6 06:50:14 server sshd\[22062\]: Failed password for root from 152.32.215.160 port 39014 ssh2
Apr  6 07:05:33 server sshd\[25956\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.32.215.160  user=root
Apr  6 07:05:36 server sshd\[25956\]: Failed password for root from 152.32.215.160 port 41222 ssh2
Apr  6 07:15:06 server sshd\[28240\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.32.215.160  user=root
...

" "

Apr  6 05:47:09 ks10 sshd[2784936]: Failed password for root from 45.14.150.51 port 42340 ssh2
...

Apr  6 06:44:11 vps sshd[984490]: Failed password for root from 222.186.175.150 port 16594 ssh2
Apr  6 06:44:14 vps sshd[984490]: Failed password for root from 222.186.175.150 port 16594 ssh2
Apr  6 06:44:20 vps sshd[984490]: Failed password for root from 222.186.175.150 port 16594 ssh2
Apr  6 06:44:23 vps sshd[984490]: Failed password for root from 222.186.175.150 port 16594 ssh2
Apr  6 06:44:26 vps sshd[984490]: Failed password for root from 222.186.175.150 port 16594 ssh2
...

Apr  6 06:00:38 vps333114 sshd[26837]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=imap.vtigermail.com  user=root
Apr  6 06:00:40 vps333114 sshd[26837]: Failed password for root from 67.205.153.16 port 59610 ssh2
...

Apr  6 11:04:33 webhost01 sshd[17298]: Failed password for root from 61.177.172.128 port 60870 ssh2
Apr  6 11:04:37 webhost01 sshd[17298]: Failed password for root from 61.177.172.128 port 60870 ssh2
...

2020-04-06T04:24:27.199353shield sshd\[22693\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.71.59  user=root
2020-04-06T04:24:29.764607shield sshd\[22693\]: Failed password for root from 64.227.71.59 port 33378 ssh2
2020-04-06T04:28:04.982893shield sshd\[23184\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.71.59  user=root
2020-04-06T04:28:07.006048shield sshd\[23184\]: Failed password for root from 64.227.71.59 port 45398 ssh2
2020-04-06T04:31:44.871932shield sshd\[23792\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.71.59  user=root

(imapd) Failed IMAP login from 183.89.214.82 (TH/Thailand/mx-ll-183.89.214-82.dynamic.3bb.in.th): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Apr  6 08:25:53 ir1 dovecot[566034]: imap-login: Disconnected (auth failed, 1 attempts in 9 secs): user=, method=PLAIN, rip=183.89.214.82, lip=5.63.12.44, session=

fail2ban -- 198.211.122.197
...

Apr  6 06:19:26 ourumov-web sshd\[1182\]: Invalid user admin from 123.30.154.184 port 45020
Apr  6 06:19:26 ourumov-web sshd\[1182\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.30.154.184
Apr  6 06:19:28 ourumov-web sshd\[1182\]: Failed password for invalid user admin from 123.30.154.184 port 45020 ssh2
...

ssh brute force

leo_www

Apr  6 05:54:01 dcd-gentoo sshd[660]: Invalid user informix from 99.156.96.51 port 35960
Apr  6 05:56:04 dcd-gentoo sshd[737]: Invalid user jboss from 99.156.96.51 port 56230
Apr  6 05:58:06 dcd-gentoo sshd[800]: User root from 99.156.96.51 not allowed because none of user's groups are listed in AllowGroups
...

Apr  6 09:24:57 gw1 sshd[10941]: Failed password for root from 222.186.42.136 port 42377 ssh2
Apr  6 09:25:00 gw1 sshd[10941]: Failed password for root from 222.186.42.136 port 42377 ssh2
...