Dec 16 06:51:04 microserver sshd[3696]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.240.125.195  user=root
Dec 16 06:51:06 microserver sshd[3696]: Failed password for root from 43.240.125.195 port 60106 ssh2
Dec 16 06:58:34 microserver sshd[4698]: Invalid user ttve from 43.240.125.195 port 53090
Dec 16 06:58:34 microserver sshd[4698]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.240.125.195
Dec 16 06:58:36 microserver sshd[4698]: Failed password for invalid user ttve from 43.240.125.195 port 53090 ssh2
Dec 16 07:11:37 microserver sshd[6882]: Invalid user asterisk from 43.240.125.195 port 39046
Dec 16 07:11:37 microserver sshd[6882]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.240.125.195
Dec 16 07:11:39 microserver sshd[6882]: Failed password for invalid user asterisk from 43.240.125.195 port 39046 ssh2
Dec 16 07:18:05 microserver sshd[7768]: Invalid user webmaster from 4

Dec 16 07:29:54 grey postfix/smtpd\[10632\]: NOQUEUE: reject: RCPT from unknown\[49.81.95.239\]: 554 5.7.1 Service unavailable\; Client host \[49.81.95.239\] blocked using truncate.gbudb.net\; http://www.gbudb.com/truncate/ \[49.81.95.239\]\; from=\ to=\ proto=ESMTP helo=\
...

2019-12-16T06:23:19.283152shield sshd\[13852\]: Invalid user ching from 121.164.57.27 port 45044
2019-12-16T06:23:19.288093shield sshd\[13852\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.164.57.27
2019-12-16T06:23:21.517770shield sshd\[13852\]: Failed password for invalid user ching from 121.164.57.27 port 45044 ssh2
2019-12-16T06:30:01.701485shield sshd\[16083\]: Invalid user backup from 121.164.57.27 port 52718
2019-12-16T06:30:01.705761shield sshd\[16083\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.164.57.27

firewall-block, port(s): 51370/tcp

Dec 16 02:10:37 ny01 sshd[15140]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.209.174.92
Dec 16 02:10:38 ny01 sshd[15140]: Failed password for invalid user obeidat from 200.209.174.92 port 46874 ssh2
Dec 16 02:16:19 ny01 sshd[15815]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.209.174.92

(smtpauth) Failed SMTP AUTH login from 185.208.211.90 (US/United States/-): 5 in the last 3600 secs

Dec 16 06:23:22 zeus sshd[895]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.65.152.201 
Dec 16 06:23:24 zeus sshd[895]: Failed password for invalid user ro0t from 159.65.152.201 port 50962 ssh2
Dec 16 06:29:33 zeus sshd[1113]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.65.152.201 
Dec 16 06:29:35 zeus sshd[1113]: Failed password for invalid user nfinity from 159.65.152.201 port 57456 ssh2

Dec 15 20:57:31 wbs sshd\[10319\]: Invalid user backes from 149.202.206.206
Dec 15 20:57:31 wbs sshd\[10319\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ns3034894.ip-149-202-206.eu
Dec 15 20:57:34 wbs sshd\[10319\]: Failed password for invalid user backes from 149.202.206.206 port 59892 ssh2
Dec 15 21:03:11 wbs sshd\[10852\]: Invalid user kunjira from 149.202.206.206
Dec 15 21:03:11 wbs sshd\[10852\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ns3034894.ip-149-202-206.eu

Dec 16 07:43:38 nextcloud sshd\[25853\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.175.217  user=root
Dec 16 07:43:41 nextcloud sshd\[25853\]: Failed password for root from 222.186.175.217 port 33104 ssh2
Dec 16 07:43:44 nextcloud sshd\[25853\]: Failed password for root from 222.186.175.217 port 33104 ssh2
...

SSH Brute-Forcing (server2)

Dec 16 07:30:01 debian-2gb-nbg1-2 kernel: \[130587.249377\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=175.119.91.146 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=50 ID=54403 PROTO=TCP SPT=24470 DPT=23 WINDOW=11181 RES=0x00 SYN URGP=0

Host Scan

Dec 16 01:23:51 ny01 sshd[9042]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=101.91.208.117
Dec 16 01:23:53 ny01 sshd[9042]: Failed password for invalid user wangyu1980 from 101.91.208.117 port 51040 ssh2
Dec 16 01:30:07 ny01 sshd[10238]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=101.91.208.117

DATE:2019-12-16 07:29:35, IP:85.113.136.31, PORT:1433 MSSQL brute force auth on honeypot server (honey-neo-dc)

firewall-block, port(s): 23/tcp