MultiHost/MultiPort Probe, Scan, Hack -

Unauthorized connection attempt detected from IP address 42.117.54.61 to port 445

Dec 23 05:07:36 web9 sshd\[10099\]: Invalid user melger from 206.189.202.165
Dec 23 05:07:36 web9 sshd\[10099\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.202.165
Dec 23 05:07:39 web9 sshd\[10099\]: Failed password for invalid user melger from 206.189.202.165 port 56598 ssh2
Dec 23 05:13:37 web9 sshd\[10957\]: Invalid user michaelmau from 206.189.202.165
Dec 23 05:13:37 web9 sshd\[10957\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.202.165

Dec 23 16:56:51 MK-Soft-VM7 sshd[29468]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.99.155.36 
Dec 23 16:56:53 MK-Soft-VM7 sshd[29468]: Failed password for invalid user test from 167.99.155.36 port 54280 ssh2
...

Dec 23 14:55:48 flomail dovecot: imap-login: Disconnected (auth failed, 1 attempts in 12 secs): user=, method=PLAIN, rip=41.139.230.99, lip=10.140.194.78, TLS: Disconnected, session=

Dec 23 16:57:49 minden010 sshd[27764]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.244.179.6
Dec 23 16:57:50 minden010 sshd[27764]: Failed password for invalid user ubnt from 80.244.179.6 port 52294 ssh2
Dec 23 17:03:07 minden010 sshd[30154]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.244.179.6
...

2019-12-23T15:58:57.815085shield sshd\[9215\]: Invalid user zamarian from 139.219.100.94 port 37638
2019-12-23T15:58:57.819676shield sshd\[9215\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.219.100.94
2019-12-23T15:58:59.353912shield sshd\[9215\]: Failed password for invalid user zamarian from 139.219.100.94 port 37638 ssh2
2019-12-23T16:04:40.720069shield sshd\[11000\]: Invalid user ppppp from 139.219.100.94 port 59598
2019-12-23T16:04:40.724156shield sshd\[11000\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.219.100.94

Dec 23 16:56:27 sd-53420 sshd\[7958\]: Invalid user debortoli from 130.61.83.71
Dec 23 16:56:27 sd-53420 sshd\[7958\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=130.61.83.71
Dec 23 16:56:29 sd-53420 sshd\[7958\]: Failed password for invalid user debortoli from 130.61.83.71 port 59677 ssh2
Dec 23 17:01:38 sd-53420 sshd\[9942\]: User root from 130.61.83.71 not allowed because none of user's groups are listed in AllowGroups
Dec 23 17:01:38 sd-53420 sshd\[9942\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=130.61.83.71  user=root
...

Dec 23 20:34:22 debian-2gb-nbg1-2 kernel: \[782406.547113\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=66.240.219.146 DST=195.201.40.59 LEN=44 TOS=0x10 PREC=0x00 TTL=110 ID=12701 PROTO=TCP SPT=26200 DPT=8442 WINDOW=21765 RES=0x00 SYN URGP=0

Dec 23 16:58:03 nextcloud sshd\[15395\]: Invalid user jasper from 106.12.78.199
Dec 23 16:58:03 nextcloud sshd\[15395\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.78.199
Dec 23 16:58:05 nextcloud sshd\[15395\]: Failed password for invalid user jasper from 106.12.78.199 port 44178 ssh2
...

MultiHost/MultiPort Probe, Scan, Hack -

Unauthorised access (Dec 23) SRC=211.181.237.104 LEN=52 TTL=114 ID=1427 DF TCP DPT=445 WINDOW=8192 SYN

SSH Brute Force

ET SCAN Sipvicious Scan - port: 5060 proto: UDP cat: Attempted Information Leak

Dec 23 13:02:36 ldap01vmsma01 sshd[44916]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.87.120.53
Dec 23 13:02:38 ldap01vmsma01 sshd[44916]: Failed password for invalid user guillan from 58.87.120.53 port 37942 ssh2
...