Jun  6 06:13:43 debian-2gb-nbg1-2 kernel: \[13675573.796878\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=181.23.199.31 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=42 ID=9786 PROTO=TCP SPT=38525 DPT=23 WINDOW=34415 RES=0x00 SYN URGP=0

(mod_security) mod_security (id:218420) triggered by 45.153.241.224 (DE/Germany/-): 5 in the last 3600 secs

Triggered by Fail2Ban at Ares web server

"Restricted File Access Attempt - Matched Data: /.env found within REQUEST_FILENAME: /.env"

Jun  6 08:18:06 pve1 sshd[31963]: Failed password for root from 49.236.195.150 port 51778 ssh2
...

 TCP (SYN) 198.108.67.18:49612 -> port 22, len 44

Automatic report - Banned IP Access

Jun  6 07:42:34 dns1 sshd[8322]: Failed password for root from 37.49.224.171 port 53486 ssh2
Jun  6 07:42:54 dns1 sshd[8345]: Failed password for root from 37.49.224.171 port 57336 ssh2

Jun  6 04:24:53 web8 sshd\[25321\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.36.163.141  user=root
Jun  6 04:24:55 web8 sshd\[25321\]: Failed password for root from 54.36.163.141 port 55462 ssh2
Jun  6 04:28:15 web8 sshd\[27083\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.36.163.141  user=root
Jun  6 04:28:17 web8 sshd\[27083\]: Failed password for root from 54.36.163.141 port 58732 ssh2
Jun  6 04:31:48 web8 sshd\[28973\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.36.163.141  user=root

Jun  5 20:20:15 eddieflores sshd\[20915\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.19.145  user=root
Jun  5 20:20:17 eddieflores sshd\[20915\]: Failed password for root from 106.13.19.145 port 55818 ssh2
Jun  5 20:22:49 eddieflores sshd\[21063\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.19.145  user=root
Jun  5 20:22:51 eddieflores sshd\[21063\]: Failed password for root from 106.13.19.145 port 58970 ssh2
Jun  5 20:25:28 eddieflores sshd\[21239\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.19.145  user=root

Jun  6 12:26:39 lnxmail61 sshd[32476]: Failed password for root from 129.204.139.26 port 44786 ssh2
Jun  6 12:29:25 lnxmail61 sshd[322]: Failed password for root from 129.204.139.26 port 46396 ssh2

Jun  6 08:33:58 fhem-rasp sshd[16924]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.185.130.101  user=root
Jun  6 08:34:00 fhem-rasp sshd[16924]: Failed password for root from 146.185.130.101 port 36752 ssh2
...

1 attack on Zyxel CVE-2017-18368 URLs like:
107.170.245.41 - - [06/Jun/2020:00:36:59 +0100] "POST /cgi-bin/ViewLog.asp HTTP/1.1" 403 9

(sshd) Failed SSH login from 195.84.49.20 (SE/Sweden/20.0-24.49.84.195.host.songnetworks.se): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Jun  6 10:34:54 amsweb01 sshd[21257]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.84.49.20  user=root
Jun  6 10:34:56 amsweb01 sshd[21257]: Failed password for root from 195.84.49.20 port 44284 ssh2
Jun  6 10:43:46 amsweb01 sshd[22575]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.84.49.20  user=root
Jun  6 10:43:48 amsweb01 sshd[22575]: Failed password for root from 195.84.49.20 port 44840 ssh2
Jun  6 10:46:48 amsweb01 sshd[23000]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.84.49.20  user=root

Jun  6 02:06:34 ws22vmsma01 sshd[41637]: Failed password for root from 113.125.13.14 port 50144 ssh2
...