Dec  7 09:52:52 localhost sshd\[108472\]: Invalid user \#\#\#\#\#\#\#\# from 35.199.154.128 port 56940
Dec  7 09:52:52 localhost sshd\[108472\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=35.199.154.128
Dec  7 09:52:54 localhost sshd\[108472\]: Failed password for invalid user \#\#\#\#\#\#\#\# from 35.199.154.128 port 56940 ssh2
Dec  7 09:58:52 localhost sshd\[108645\]: Invalid user admin12345678 from 35.199.154.128 port 38376
Dec  7 09:58:52 localhost sshd\[108645\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=35.199.154.128
...

UTC: 2019-12-06 port: 23/tcp

51.75.200.210 - - \[07/Dec/2019:13:00:04 +0100\] "POST /wp-login.php HTTP/1.0" 200 7656 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"
51.75.200.210 - - \[07/Dec/2019:13:00:05 +0100\] "POST /wp-login.php HTTP/1.0" 200 7486 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"
51.75.200.210 - - \[07/Dec/2019:13:00:05 +0100\] "POST /wp-login.php HTTP/1.0" 200 7480 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"

Port Scan

Dec  7 13:47:28 vps666546 sshd\[29908\]: Invalid user grunfeld from 222.161.56.248 port 51915
Dec  7 13:47:29 vps666546 sshd\[29908\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.161.56.248
Dec  7 13:47:30 vps666546 sshd\[29908\]: Failed password for invalid user grunfeld from 222.161.56.248 port 51915 ssh2
Dec  7 13:54:54 vps666546 sshd\[30102\]: Invalid user webmaster from 222.161.56.248 port 54741
Dec  7 13:54:54 vps666546 sshd\[30102\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.161.56.248
...

pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=89.248.173.102  user=root
Failed password for root from 89.248.173.102 port 48566 ssh2
Invalid user manavella from 89.248.173.102 port 58956
pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=89.248.173.102
Failed password for invalid user manavella from 89.248.173.102 port 58956 ssh2

Lines containing failures of 95.141.45.248
Dec  6 20:15:06 mellenthin sshd[25545]: Invalid user backups from 95.141.45.248 port 58820
Dec  6 20:15:06 mellenthin sshd[25545]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=95.141.45.248
Dec  6 20:15:08 mellenthin sshd[25545]: Failed password for invalid user backups from 95.141.45.248 port 58820 ssh2
Dec  6 20:15:11 mellenthin sshd[25545]: Received disconnect from 95.141.45.248 port 58820:11: Bye Bye [preauth]
Dec  6 20:15:11 mellenthin sshd[25545]: Disconnected from invalid user backups 95.141.45.248 port 58820 [preauth]
Dec  6 20:37:13 mellenthin sshd[27545]: Connection closed by 95.141.45.248 port 42186 [preauth]
Dec  6 20:45:17 mellenthin sshd[27936]: Did not receive identification string from 95.141.45.248 port 47760
Dec  6 20:53:17 mellenthin sshd[28181]: Did not receive identification string from 95.141.45.248 port 53332
Dec  6 21:01:31 mellenthin sshd[28551]: Connection clos........
------------------------------

2019-12-07T11:32:47.482426abusebot-3.cloudsearch.cf sshd\[10550\]: Invalid user oguz from 39.98.116.207 port 41868

7078/tcp 33893/tcp 6665/tcp...
[2019-10-06/12-07]9952pkt,4932pt.(tcp)

"SSH brute force auth login attempt."

firewall-block, port(s): 2018/tcp, 22222/tcp, 23212/tcp, 55555/tcp

Dec  7 13:35:20 ArkNodeAT sshd\[2171\]: Invalid user chaaban from 197.156.132.172
Dec  7 13:35:20 ArkNodeAT sshd\[2171\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=197.156.132.172
Dec  7 13:35:22 ArkNodeAT sshd\[2171\]: Failed password for invalid user chaaban from 197.156.132.172 port 50377 ssh2

2019-12-07T07:25:16.218957stark.klein-stark.info postfix/smtpd\[10655\]: NOQUEUE: reject: RCPT from careful.jcnovel.com\[63.81.87.135\]: 554 5.7.1 \: Relay access denied\; from=\ to=\ proto=ESMTP helo=\
...

Dec  7 07:25:03 grey postfix/smtpd\[16701\]: NOQUEUE: reject: RCPT from unknown\[23.228.73.171\]: 554 5.7.1 Service unavailable\; Client host \[23.228.73.171\] blocked using bl.spamcop.net\; Blocked - see https://www.spamcop.net/bl.shtml\?23.228.73.171\; from=\ to=\ proto=SMTP helo=\
...

Dec  7 13:21:12 vps647732 sshd[9059]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=220.158.216.129
Dec  7 13:21:14 vps647732 sshd[9059]: Failed password for invalid user hailes from 220.158.216.129 port 60050 ssh2
...