Dec 24 00:01:34 markkoudstaal sshd[22079]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.78.255.123
Dec 24 00:01:36 markkoudstaal sshd[22079]: Failed password for invalid user tessy from 80.78.255.123 port 56610 ssh2
Dec 24 00:04:52 markkoudstaal sshd[22326]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.78.255.123

Automatic report - SSH Brute-Force Attack

Dec 23 19:53:55 firewall sshd[24627]: Failed password for root from 222.186.173.154 port 6474 ssh2
Dec 23 19:54:07 firewall sshd[24627]: error: maximum authentication attempts exceeded for root from 222.186.173.154 port 6474 ssh2 [preauth]
Dec 23 19:54:07 firewall sshd[24627]: Disconnecting: Too many authentication failures [preauth]
...

Dec 23 22:13:41 xxx sshd[3374]: Invalid user admin from 5.1.81.135
Dec 23 22:13:43 xxx sshd[3374]: Failed password for invalid user admin from 5.1.81.135 port 46140 ssh2
Dec 23 23:16:29 xxx sshd[7679]: Invalid user ks from 5.1.81.135
Dec 23 23:16:31 xxx sshd[7679]: Failed password for invalid user ks from 5.1.81.135 port 46574 ssh2
Dec 23 23:36:18 xxx sshd[8824]: Invalid user ashutosh from 5.1.81.135


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=5.1.81.135

Dec 23 22:42:36 hcbbdb sshd\[10667\]: Invalid user sasha from 186.153.138.2
Dec 23 22:42:36 hcbbdb sshd\[10667\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.153.138.2
Dec 23 22:42:39 hcbbdb sshd\[10667\]: Failed password for invalid user sasha from 186.153.138.2 port 42462 ssh2
Dec 23 22:49:15 hcbbdb sshd\[11342\]: Invalid user souren from 186.153.138.2
Dec 23 22:49:15 hcbbdb sshd\[11342\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.153.138.2

Automatic report - Banned IP Access

12/23/2019-18:14:47.048014 89.248.172.85 Protocol: 6 ET DROP Dshield Block Listed Source group 1

Dec 23 23:48:52 nextcloud sshd\[618\]: Invalid user webmaster from 49.234.67.23
Dec 23 23:48:52 nextcloud sshd\[618\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.234.67.23
Dec 23 23:48:54 nextcloud sshd\[618\]: Failed password for invalid user webmaster from 49.234.67.23 port 53530 ssh2
...

Dec 23 23:05:55 www_kotimaassa_fi sshd[9854]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.238.65
Dec 23 23:05:57 www_kotimaassa_fi sshd[9854]: Failed password for invalid user cible from 106.13.238.65 port 46718 ssh2
...

Dec 23 23:20:14 web01 postfix/smtpd[30055]: connect from simple.yobaat.com[217.112.142.130]
Dec 23 23:20:14 web01 policyd-spf[30058]: None; identhostnamey=helo; client-ip=217.112.142.130; helo=simple.thomasdukeman.com; envelope-from=x@x
Dec 23 23:20:14 web01 policyd-spf[30058]: Pass; identhostnamey=mailfrom; client-ip=217.112.142.130; helo=simple.thomasdukeman.com; envelope-from=x@x
Dec x@x
Dec 23 23:20:14 web01 postfix/smtpd[30055]: disconnect from simple.yobaat.com[217.112.142.130]
Dec 23 23:21:58 web01 postfix/smtpd[29953]: connect from simple.yobaat.com[217.112.142.130]
Dec 23 23:21:58 web01 policyd-spf[29955]: None; identhostnamey=helo; client-ip=217.112.142.130; helo=simple.thomasdukeman.com; envelope-from=x@x
Dec 23 23:21:58 web01 policyd-spf[29955]: Pass; identhostnamey=mailfrom; client-ip=217.112.142.130; helo=simple.thomasdukeman.com; envelope-from=x@x
Dec x@x
Dec 23 23:21:59 web01 postfix/smtpd[29953]: disconnect from simple.yobaat.com[217.112.142.130]
Dec 23........
-------------------------------

27.115.124.6 - - [23/Dec/2019:23:48:52 +0100] "GET / HTTP/1.0" 403 141 "-" "-"
27.115.124.6 - - [23/Dec/2019:23:49:03 +0100] "GET / HTTP/1.0" 403 3132 "-" "-"
27.115.124.6 - - [23/Dec/2019:23:49:03 +0100] "GET /nmaplowercheck1577141342 HTTP/1.1" 403 3132 "-" "Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)"
27.115.124.6 - - [23/Dec/2019:23:49:04 +0100] "GET / HTTP/1.1" 403 3132 "-" "-"
27.115.124.6 - - [23/Dec/2019:23:49:04 +0100] "GET /HNAP1 HTTP/1.1" 403 3132 "-" "Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)"
...

Dec 24 02:10:43 gw1 sshd[4073]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.67.197.109
Dec 24 02:10:46 gw1 sshd[4073]: Failed password for invalid user guest from 194.67.197.109 port 37116 ssh2
...

\[2019-12-23 18:08:40\] NOTICE\[2839\] chan_sip.c: Registration from '"704"\' failed for '212.129.30.110:5263' - Wrong password
\[2019-12-23 18:08:40\] SECURITY\[2857\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-12-23T18:08:40.775-0500",Severity="Error",Service="SIP",EventVersion="2",AccountID="704",SessionID="0x7f0fb40aad28",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/212.129.30.110/5263",Challenge="630cb213",ReceivedChallenge="630cb213",ReceivedHash="86e93070005420c3e68651c40747466a"
\[2019-12-23 18:08:43\] NOTICE\[2839\] chan_sip.c: Registration from '"705"\' failed for '212.129.30.110:5320' - Wrong password
\[2019-12-23 18:08:43\] SECURITY\[2857\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-12-23T18:08:43.435-0500",Severity="Error",Service="SIP",EventVersion="2",AccountID="705",SessionID="0x7f0fb4a5a908",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/212

Automatic report - Port Scan Attack

Dec 24 00:11:07 debian-2gb-nbg1-2 kernel: \[795410.838964\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=185.175.93.14 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=17486 PROTO=TCP SPT=53628 DPT=6418 WINDOW=1024 RES=0x00 SYN URGP=0