502. On Jun 7 2020 experienced a Brute Force SSH login attempt -> 98 unique times by 5.135.185.27.

 TCP (SYN) 78.128.113.42:48404 -> port 4347, len 44

Jun  7 22:13:23 ns382633 sshd\[29879\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.16.138  user=root
Jun  7 22:13:25 ns382633 sshd\[29879\]: Failed password for root from 51.75.16.138 port 46758 ssh2
Jun  7 22:23:23 ns382633 sshd\[31625\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.16.138  user=root
Jun  7 22:23:25 ns382633 sshd\[31625\]: Failed password for root from 51.75.16.138 port 54372 ssh2
Jun  7 22:27:05 ns382633 sshd\[32408\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.16.138  user=root

Jun  7 22:19:44 ns382633 sshd\[30859\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.40.147  user=root
Jun  7 22:19:46 ns382633 sshd\[30859\]: Failed password for root from 165.22.40.147 port 41140 ssh2
Jun  7 22:24:00 ns382633 sshd\[31641\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.40.147  user=root
Jun  7 22:24:02 ns382633 sshd\[31641\]: Failed password for root from 165.22.40.147 port 56726 ssh2
Jun  7 22:26:54 ns382633 sshd\[32337\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.40.147  user=root

Jun  7 23:59:36 abendstille sshd\[8955\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.175.215  user=root
Jun  7 23:59:39 abendstille sshd\[8955\]: Failed password for root from 222.186.175.215 port 52004 ssh2
Jun  7 23:59:41 abendstille sshd\[8955\]: Failed password for root from 222.186.175.215 port 52004 ssh2
Jun  7 23:59:42 abendstille sshd\[9004\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.175.215  user=root
Jun  7 23:59:44 abendstille sshd\[9004\]: Failed password for root from 222.186.175.215 port 61268 ssh2
...

Lines containing failures of 167.172.241.235
Jun  6 13:51:30 neweola sshd[25325]: Did not receive identification string from 167.172.241.235 port 44454
Jun  6 13:51:42 neweola sshd[25332]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.172.241.235  user=r.r
Jun  6 13:51:44 neweola sshd[25332]: Failed password for r.r from 167.172.241.235 port 40616 ssh2
Jun  6 13:51:46 neweola sshd[25332]: Received disconnect from 167.172.241.235 port 40616:11: Normal Shutdown, Thank you for playing [preauth]
Jun  6 13:51:46 neweola sshd[25332]: Disconnected from authenticating user r.r 167.172.241.235 port 40616 [preauth]
Jun  6 13:52:01 neweola sshd[25337]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.172.241.235  user=r.r
Jun  6 13:52:03 neweola sshd[25337]: Failed password for r.r from 167.172.241.235 port 49768 ssh2
Jun  6 13:52:05 neweola sshd[25337]: Received disconnect from 167.172.241.235........
------------------------------

Jun  7 23:02:33 [host] sshd[26735]: pam_unix(sshd:
Jun  7 23:02:35 [host] sshd[26735]: Failed passwor
Jun  7 23:08:32 [host] sshd[26906]: pam_unix(sshd:

Jun  7 22:26:23 plex sshd[962]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.41.57.249  user=root
Jun  7 22:26:26 plex sshd[962]: Failed password for root from 115.41.57.249 port 60112 ssh2

Jun  7 22:58:24 relay postfix/smtpd\[32762\]: warning: unknown\[141.98.80.153\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jun  7 22:58:42 relay postfix/smtpd\[6701\]: warning: unknown\[141.98.80.153\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jun  7 23:07:00 relay postfix/smtpd\[3016\]: warning: unknown\[141.98.80.153\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jun  7 23:07:18 relay postfix/smtpd\[3016\]: warning: unknown\[141.98.80.153\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jun  7 23:07:39 relay postfix/smtpd\[32762\]: warning: unknown\[141.98.80.153\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
...

Jun  7 22:26:53 ns3164893 sshd[22496]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.10.186  user=root
Jun  7 22:26:56 ns3164893 sshd[22496]: Failed password for root from 139.59.10.186 port 57730 ssh2
...

2020-06-07 18:08:45,046 fail2ban.actions        [508]: NOTICE  [wordpress-beatrice-main] Ban 103.63.109.32
2020-06-07 18:24:50,056 fail2ban.actions        [508]: NOTICE  [wordpress-beatrice-main] Ban 103.63.109.32
2020-06-07 23:27:11,086 fail2ban.actions        [508]: NOTICE  [wordpress-beatrice-main] Ban 103.63.109.32
...

Automatic report - Port Scan Attack

2020-06-07 dovecot_plain authenticator failed for \(ip-113-106.4vendeta.com.\) \[78.128.113.106\]: 535 Incorrect authentication data \(set_id=milagro@**REMOVED**.org\)
2020-06-07 dovecot_plain authenticator failed for \(ip-113-106.4vendeta.com.\) \[78.128.113.106\]: 535 Incorrect authentication data
2020-06-07 dovecot_plain authenticator failed for \(ip-113-106.4vendeta.com.\) \[78.128.113.106\]: 535 Incorrect authentication data

(imapd) Failed IMAP login from 101.255.9.105 (ID/Indonesia/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Jun  8 00:56:16 ir1 dovecot[2885757]: imap-login: Disconnected (auth failed, 1 attempts in 2 secs): user=, method=PLAIN, rip=101.255.9.105, lip=5.63.12.44, TLS, session=<1mBKToSnuKJl/wlp>

Jun  7 23:47:24 pornomens sshd\[27467\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.123.177.150  user=root
Jun  7 23:47:26 pornomens sshd\[27467\]: Failed password for root from 181.123.177.150 port 2889 ssh2
Jun  8 00:02:34 pornomens sshd\[27674\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.123.177.150  user=root
...