Time:     Mon Apr  6 02:44:24 2020 -0300
IP:       139.189.253.40 (CN/China/-)
Failures: 15 (ftpd)
Interval: 3600 seconds
Blocked:  Permanent Block

Apr  2 02:24:48 ns392434 sshd[17716]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.140.80.174  user=root
Apr  2 02:24:49 ns392434 sshd[17716]: Failed password for root from 113.140.80.174 port 45792 ssh2
Apr  2 02:27:30 ns392434 sshd[18044]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.140.80.174  user=root
Apr  2 02:27:31 ns392434 sshd[18044]: Failed password for root from 113.140.80.174 port 1461 ssh2
Apr  2 02:29:10 ns392434 sshd[18250]: Invalid user gxm from 113.140.80.174 port 14836
Apr  2 02:29:10 ns392434 sshd[18250]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.140.80.174
Apr  2 02:29:10 ns392434 sshd[18250]: Invalid user gxm from 113.140.80.174 port 14836
Apr  2 02:29:12 ns392434 sshd[18250]: Failed password for invalid user gxm from 113.140.80.174 port 14836 ssh2
Apr  2 02:30:51 ns392434 sshd[18442]: Invalid user paarth from 113.140.80.174 port 28386

SpamScore above: 10.0

Apr  6 05:22:30 vps58358 sshd\[4570\]: Invalid user P@s5word12 from 222.80.196.16Apr  6 05:22:31 vps58358 sshd\[4570\]: Failed password for invalid user P@s5word12 from 222.80.196.16 port 35480 ssh2Apr  6 05:26:15 vps58358 sshd\[4623\]: Invalid user !QAZ12345!QAZ from 222.80.196.16Apr  6 05:26:17 vps58358 sshd\[4623\]: Failed password for invalid user !QAZ12345!QAZ from 222.80.196.16 port 32880 ssh2Apr  6 05:29:46 vps58358 sshd\[4662\]: Invalid user !@\#$%\^@qwerty from 222.80.196.16Apr  6 05:29:48 vps58358 sshd\[4662\]: Failed password for invalid user !@\#$%\^@qwerty from 222.80.196.16 port 56030 ssh2
...

2020-04-06T09:40:51.572930  sshd[5372]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.241.235.11  user=root
2020-04-06T09:40:53.876135  sshd[5372]: Failed password for root from 192.241.235.11 port 55106 ssh2
2020-04-06T09:54:58.890071  sshd[5656]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.241.235.11  user=root
2020-04-06T09:55:00.806492  sshd[5656]: Failed password for root from 192.241.235.11 port 54772 ssh2
...

Automatic report - Port Scan Attack

Bruteforce detected by fail2ban

Apr  6 05:47:21 markkoudstaal sshd[12835]: Failed password for root from 106.12.177.51 port 54984 ssh2
Apr  6 05:50:52 markkoudstaal sshd[13342]: Failed password for root from 106.12.177.51 port 35246 ssh2

Apr  6 08:35:38 freya sshd[23845]: Disconnected from authenticating user root 115.68.187.150 port 37890 [preauth]
Apr  6 08:37:40 freya sshd[24155]: Invalid user admin from 115.68.187.150 port 47951
Apr  6 08:37:41 freya sshd[24155]: Disconnected from invalid user admin 115.68.187.150 port 47951 [preauth]
Apr  6 08:39:42 freya sshd[24526]: Invalid user postgres from 115.68.187.150 port 58016
Apr  6 08:39:43 freya sshd[24526]: Disconnected from invalid user postgres 115.68.187.150 port 58016 [preauth]
...

Received: from host31.axxesslocal.co.za ([154.0.171.132]:41596)
	by sg3plcpnl0224.prod.sin3.secureserver.net with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)
	(Exim 4.92)
	(envelope-from )
	id 1jKU29-00DPFk-TA

ET DROP Dshield Block Listed Source group 1 - port: 7299 proto: TCP cat: Misc Attack

Apr  6 09:19:22 h2829583 sshd[26073]: Failed password for root from 134.175.204.181 port 41518 ssh2

Apr  6 07:09:14 raspberrypi sshd\[19839\]: Invalid user phion from 94.237.52.222Apr  6 07:09:17 raspberrypi sshd\[19839\]: Failed password for invalid user phion from 94.237.52.222 port 45044 ssh2Apr  6 07:11:00 raspberrypi sshd\[21030\]: Invalid user zabbix from 94.237.52.222
...

RDP Bruteforce

$f2bV_matches