Oct  2 17:36:39 vps639187 sshd\[13119\]: Invalid user virl from 157.245.135.156 port 45614
Oct  2 17:36:39 vps639187 sshd\[13119\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.135.156
Oct  2 17:36:41 vps639187 sshd\[13119\]: Failed password for invalid user virl from 157.245.135.156 port 45614 ssh2
...

Lines containing failures of 170.83.198.240 (max 1000)
Oct  1 22:33:44 HOSTNAME sshd[22226]: Did not receive identification string from 170.83.198.240 port 18375
Oct  1 22:33:48 HOSTNAME sshd[22230]: Address 170.83.198.240 maps to 170-83-198-240.starnetbandalarga.com.br, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!
Oct  1 22:33:48 HOSTNAME sshd[22230]: Invalid user avanthi from 170.83.198.240 port 18421
Oct  1 22:33:48 HOSTNAME sshd[22230]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=170.83.198.240
Oct  1 22:33:50 HOSTNAME sshd[22230]: Failed password for invalid user avanthi from 170.83.198.240 port 18421 ssh2


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=170.83.198.240

2020-10-02T13:05:08.4373711495-001 sshd[3313]: Invalid user vpnuser1 from 103.76.175.130 port 41044
2020-10-02T13:05:08.4484681495-001 sshd[3313]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.76.175.130
2020-10-02T13:05:08.4373711495-001 sshd[3313]: Invalid user vpnuser1 from 103.76.175.130 port 41044
2020-10-02T13:05:10.2475081495-001 sshd[3313]: Failed password for invalid user vpnuser1 from 103.76.175.130 port 41044 ssh2
2020-10-02T13:09:20.2470591495-001 sshd[3496]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.76.175.130  user=root
2020-10-02T13:09:22.6426971495-001 sshd[3496]: Failed password for root from 103.76.175.130 port 47130 ssh2
...

Oct  2 19:29:29 ajax sshd[20576]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.57.122.209 
Oct  2 19:29:31 ajax sshd[20576]: Failed password for invalid user muie from 2.57.122.209 port 60148 ssh2

Excessive crawling : exceed crawl-delay defined in robots.txt

SCAN: Host Sweep CloudCIX Reconnaissance Scan Detected, PTR: PTR record not found

MultiHost/MultiPort Probe, Scan, Hack -

Oct  2 18:21:05 ip106 sshd[22211]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.141.221 
Oct  2 18:21:07 ip106 sshd[22211]: Failed password for invalid user master from 180.76.141.221 port 47180 ssh2
...

Oct  2 13:59:00 inter-technics sshd[12283]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.233.185.157  user=root
Oct  2 13:59:02 inter-technics sshd[12283]: Failed password for root from 49.233.185.157 port 43374 ssh2
Oct  2 14:03:10 inter-technics sshd[12529]: Invalid user glenn from 49.233.185.157 port 60128
Oct  2 14:03:10 inter-technics sshd[12529]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.233.185.157
Oct  2 14:03:10 inter-technics sshd[12529]: Invalid user glenn from 49.233.185.157 port 60128
Oct  2 14:03:12 inter-technics sshd[12529]: Failed password for invalid user glenn from 49.233.185.157 port 60128 ssh2
...

Oct  2 21:09:26 gw1 sshd[13229]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.230.42.76
Oct  2 21:09:28 gw1 sshd[13229]: Failed password for invalid user mc2 from 157.230.42.76 port 37479 ssh2
...

2020-10-02 04:05:57.692272-0500  localhost smtpd[17887]: NOQUEUE: reject: RCPT from unknown[193.106.175.55]: 554 5.7.1 Service unavailable; Client host [193.106.175.55] blocked using zen.spamhaus.org; https://www.spamhaus.org/sbl/query/SBL495727; from= to= proto=ESMTP helo=

TCP ports : 1723 / 3128 / 3389

SSH BruteForce Attack

 TCP (SYN) 89.163.148.157:20310 -> port 23, len 44

$f2bV_matches