Jun  9 12:45:33 master sshd[13236]: Failed password for root from 111.231.238.83 port 58068 ssh2

Suspicious access to SMTP/POP/IMAP services.

Jun  9 12:32:17 ArkNodeAT sshd\[5004\]: Invalid user xieyuan from 200.54.170.198
Jun  9 12:32:17 ArkNodeAT sshd\[5004\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.54.170.198
Jun  9 12:32:19 ArkNodeAT sshd\[5004\]: Failed password for invalid user xieyuan from 200.54.170.198 port 48340 ssh2

Jun  9 07:56:57 OPSO sshd\[25056\]: Invalid user aratest from 43.240.247.234 port 55760
Jun  9 07:56:57 OPSO sshd\[25056\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.240.247.234
Jun  9 07:57:00 OPSO sshd\[25056\]: Failed password for invalid user aratest from 43.240.247.234 port 55760 ssh2
Jun  9 08:01:39 OPSO sshd\[25594\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.240.247.234  user=root
Jun  9 08:01:42 OPSO sshd\[25594\]: Failed password for root from 43.240.247.234 port 50994 ssh2

Jun  8 23:47:48 Tower sshd[4292]: Connection from 201.68.43.189 port 64588 on 192.168.10.220 port 22 rdomain ""
Jun  8 23:47:49 Tower sshd[4292]: Invalid user r00t from 201.68.43.189 port 64588
Jun  8 23:47:49 Tower sshd[4292]: error: Could not get shadow information for NOUSER
Jun  8 23:47:49 Tower sshd[4292]: Failed password for invalid user r00t from 201.68.43.189 port 64588 ssh2
Jun  8 23:47:50 Tower sshd[4292]: Connection closed by invalid user r00t 201.68.43.189 port 64588 [preauth]

Jun  9 07:00:44 ny01 sshd[14523]: Failed password for root from 222.186.15.18 port 38909 ssh2
Jun  9 07:05:02 ny01 sshd[15088]: Failed password for root from 222.186.15.18 port 54188 ssh2

[Tue Jun 09 17:54:55.160034 2020] [:error] [pid 11009:tid 140152349382400] [client 178.154.200.101:51382] [client 178.154.200.101] ModSecurity: Access denied with code 403 (phase 2). Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/modsecurity/owasp-modsecurity-crs-3.2.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "696"] [id "920350"] [msg "Host header is a numeric IP address"] [data "103.27.207.197"] [severity "WARNING"] [ver "OWASP_CRS/3.2.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/IP_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "103.27.207.197"] [uri "/"] [unique_id "Xt9qf59C5edbGv14HPWBsAAAAfE"]
...

Jun  9 11:38:31 abendstille sshd\[24847\]: Invalid user apache from 218.29.188.139
Jun  9 11:38:31 abendstille sshd\[24847\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.29.188.139
Jun  9 11:38:33 abendstille sshd\[24847\]: Failed password for invalid user apache from 218.29.188.139 port 56028 ssh2
Jun  9 11:40:43 abendstille sshd\[26973\]: Invalid user stuttgart from 218.29.188.139
Jun  9 11:40:43 abendstille sshd\[26973\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.29.188.139
...

2020-06-08 22:44:14.290514-0500  localhost smtpd[40102]: NOQUEUE: reject: RCPT from unknown[185.77.0.18]: 554 5.7.1 Service unavailable; Client host [185.77.0.18] blocked using zen.spamhaus.org; https://www.spamhaus.org/query/ip/185.77.0.18 / https://www.spamhaus.org/sbl/query/SBLCSS; from= to= proto=ESMTP helo=<[185.77.0.18]>

Fail2Ban Ban Triggered (2)

Automatic report - Port Scan Attack

Jun  9 13:25:47 server sshd[23548]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.202.161.108
Jun  9 13:25:49 server sshd[23548]: Failed password for invalid user admin from 85.202.161.108 port 55580 ssh2
Jun  9 13:29:49 server sshd[23802]: Failed password for root from 85.202.161.108 port 50550 ssh2
...

Jun  9 12:02:16 hosting sshd[907]: Invalid user hm from 138.68.178.64 port 58452
...

Jun  9 06:36:08 vps647732 sshd[28333]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.118.7.153
Jun  9 06:36:10 vps647732 sshd[28333]: Failed password for invalid user jmago from 114.118.7.153 port 47832 ssh2
...

20/6/8@23:48:01: FAIL: Alarm-Network address from=36.81.7.84
...