Nov  3 01:29:37 h2570396 sshd[27159]: Failed password for r.r from 167.86.76.145 port 40144 ssh2
Nov  3 01:29:37 h2570396 sshd[27159]: Received disconnect from 167.86.76.145: 11: Bye Bye [preauth]
Nov  3 01:47:17 h2570396 sshd[27414]: Failed password for r.r from 167.86.76.145 port 41380 ssh2
Nov  3 01:47:17 h2570396 sshd[27414]: Received disconnect from 167.86.76.145: 11: Bye Bye [preauth]
Nov  3 01:50:50 h2570396 sshd[27477]: Failed password for r.r from 167.86.76.145 port 52168 ssh2
Nov  3 01:50:50 h2570396 sshd[27477]: Received disconnect from 167.86.76.145: 11: Bye Bye [preauth]
Nov  3 01:54:23 h2570396 sshd[27509]: Failed password for invalid user mntner from 167.86.76.145 port 34726 ssh2
Nov  3 01:54:23 h2570396 sshd[27509]: Received disconnect from 167.86.76.145: 11: Bye Bye [preauth]
Nov  3 01:57:54 h2570396 sshd[27570]: Failed password for invalid user tz from 167.86.76.145 port 45540 ssh2
Nov  3 01:57:54 h2570396 sshd[27570]: Received disconnect from 167.86.7........
-------------------------------

Nov  3 05:37:22 srv01 sshd[31876]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.125.66.234  user=root
Nov  3 05:37:24 srv01 sshd[31876]: Failed password for root from 111.125.66.234 port 50698 ssh2
Nov  3 05:41:20 srv01 sshd[32064]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.125.66.234  user=root
Nov  3 05:41:22 srv01 sshd[32064]: Failed password for root from 111.125.66.234 port 33610 ssh2
Nov  3 05:45:25 srv01 sshd[32382]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.125.66.234  user=root
Nov  3 05:45:27 srv01 sshd[32382]: Failed password for root from 111.125.66.234 port 44766 ssh2
...

\[2019-11-03 01:05:09\] NOTICE\[2601\] chan_sip.c: Registration from '\' failed for '81.171.85.138:54721' - Wrong password
\[2019-11-03 01:05:09\] SECURITY\[2634\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-11-03T01:05:09.165-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="923",SessionID="0x7fdf2c003608",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/81.171.85.138/54721",Challenge="016409b0",ReceivedChallenge="016409b0",ReceivedHash="042f57a4ff02f18854c097661244eb45"
\[2019-11-03 01:06:09\] NOTICE\[2601\] chan_sip.c: Registration from '\' failed for '81.171.85.138:65299' - Wrong password
\[2019-11-03 01:06:09\] SECURITY\[2634\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-11-03T01:06:09.849-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="976",SessionID="0x7fdf2c364088",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/81.171.85.138

Automatic report - Banned IP Access

(sshd) Failed SSH login from 61.250.149.222 (KR/South Korea/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Nov  3 04:43:36 server2 sshd[21667]: Invalid user do from 61.250.149.222 port 14054
Nov  3 04:43:38 server2 sshd[21667]: Failed password for invalid user do from 61.250.149.222 port 14054 ssh2
Nov  3 04:51:16 server2 sshd[21912]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.250.149.222  user=root
Nov  3 04:51:18 server2 sshd[21912]: Failed password for root from 61.250.149.222 port 11427 ssh2
Nov  3 04:57:37 server2 sshd[22077]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.250.149.222  user=root

Nov  3 00:25:46 server sshd[2216]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.129.143.156  user=r.r
Nov  3 00:25:48 server sshd[2216]: Failed password for r.r from 212.129.143.156 port 40107 ssh2
Nov  3 00:25:48 server sshd[2216]: Received disconnect from 212.129.143.156: 11: Bye Bye [preauth]
Nov  3 00:41:59 server sshd[2525]: Failed password for invalid user 123 from 212.129.143.156 port 59766 ssh2
Nov  3 00:42:01 server sshd[2525]: Received disconnect from 212.129.143.156: 11: Bye Bye [preauth]
Nov  3 00:46:54 server sshd[2617]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.129.143.156  user=r.r
Nov  3 00:46:56 server sshd[2617]: Failed password for r.r from 212.129.143.156 port 50729 ssh2
Nov  3 00:46:57 server sshd[2617]: Received disconnect from 212.129.143.156: 11: Bye Bye [preauth]
Nov  3 00:51:31 server sshd[2722]: pam_unix(sshd:auth): authentication failure; logname=........
-------------------------------

11/03/2019-00:34:39.291428 218.92.0.190 Protocol: 6 ET SCAN Potential SSH Scan

Automatic report - Banned IP Access

Nov  3 04:57:29 MK-Soft-VM5 sshd[31309]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.52.121.64 
Nov  3 04:57:31 MK-Soft-VM5 sshd[31309]: Failed password for invalid user student from 106.52.121.64 port 52842 ssh2
...

Nov  3 04:44:27 hcbbdb sshd\[29182\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=207.107.67.67  user=root
Nov  3 04:44:30 hcbbdb sshd\[29182\]: Failed password for root from 207.107.67.67 port 49220 ssh2
Nov  3 04:48:27 hcbbdb sshd\[29567\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=207.107.67.67  user=root
Nov  3 04:48:29 hcbbdb sshd\[29567\]: Failed password for root from 207.107.67.67 port 59170 ssh2
Nov  3 04:52:26 hcbbdb sshd\[29982\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=207.107.67.67  user=root

Nov  2 23:57:19 bilbo sshd[29834]: User root from 191-246-3-41.3g.claro.net.br not allowed because not listed in AllowUsers
Nov  2 23:57:21 bilbo sshd[29836]: User root from 191-246-3-41.3g.claro.net.br not allowed because not listed in AllowUsers
Nov  2 23:57:23 bilbo sshd[29838]: Invalid user ubnt from 191.246.3.41
Nov  2 23:57:25 bilbo sshd[29840]: User root from 191-246-3-41.3g.claro.net.br not allowed because not listed in AllowUsers
...

Nov  2 19:13:00 auw2 sshd\[24055\]: Invalid user P@\$\$w0rd123@ from 165.227.210.71
Nov  2 19:13:00 auw2 sshd\[24055\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.227.210.71
Nov  2 19:13:02 auw2 sshd\[24055\]: Failed password for invalid user P@\$\$w0rd123@ from 165.227.210.71 port 50752 ssh2
Nov  2 19:16:48 auw2 sshd\[24370\]: Invalid user sniper!@ from 165.227.210.71
Nov  2 19:16:48 auw2 sshd\[24370\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.227.210.71

Nov  3 05:58:29 minden010 sshd[32576]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.149.124
Nov  3 05:58:31 minden010 sshd[32576]: Failed password for invalid user discovery from 157.245.149.124 port 58166 ssh2
Nov  3 06:02:42 minden010 sshd[4080]: Failed password for root from 157.245.149.124 port 40744 ssh2
...

Nov  3 04:47:41 mxgate1 postfix/postscreen[32036]: CONNECT from [139.228.137.218]:63441 to [176.31.12.44]:25
Nov  3 04:47:41 mxgate1 postfix/dnsblog[32041]: addr 139.228.137.218 listed by domain zen.spamhaus.org as 127.0.0.11
Nov  3 04:47:41 mxgate1 postfix/dnsblog[32041]: addr 139.228.137.218 listed by domain zen.spamhaus.org as 127.0.0.4
Nov  3 04:47:41 mxgate1 postfix/dnsblog[32037]: addr 139.228.137.218 listed by domain cbl.abuseat.org as 127.0.0.2
Nov  3 04:47:41 mxgate1 postfix/dnsblog[32040]: addr 139.228.137.218 listed by domain ix.dnsbl.xxxxxx.net as 127.0.0.2
Nov  3 04:47:41 mxgate1 postfix/dnsblog[32038]: addr 139.228.137.218 listed by domain b.barracudacentral.org as 127.0.0.2
Nov  3 04:47:47 mxgate1 postfix/postscreen[32036]: DNSBL rank 5 for [139.228.137.218]:63441
Nov x@x
Nov  3 04:47:48 mxgate1 postfix/postscreen[32036]: HANGUP after 1.2 from [139.228.137.218]:63441 in tests after SMTP handshake
Nov  3 04:47:48 mxgate1 postfix/postscreen[32036]: DISCONNE........
-------------------------------

port scan and connect, tcp 23 (telnet)