Dec 10 16:09:30  exim[25872]: [1\71] 1ieh8i-0006jI-AH H=server2.webwebmail.info [144.172.64.111] F= rejected after DATA: This message scored 21.7 spam points.

proto=tcp  .  spt=34039  .  dpt=25  .     (Listed on    MailSpike (spam wave plus L3-L5) also unsubscore and rbldns-ru)     (786)

Dec 10 15:37:50 root sshd[26624]: Failed password for root from 120.131.6.144 port 64768 ssh2
Dec 10 15:53:31 root sshd[26936]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.131.6.144 
Dec 10 15:53:34 root sshd[26936]: Failed password for invalid user act from 120.131.6.144 port 54112 ssh2
...

Dec 10 05:22:07 hanapaa sshd\[8299\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.34.184.214  user=root
Dec 10 05:22:09 hanapaa sshd\[8299\]: Failed password for root from 190.34.184.214 port 33540 ssh2
Dec 10 05:26:15 hanapaa sshd\[8723\]: Invalid user admin9 from 190.34.184.214
Dec 10 05:26:15 hanapaa sshd\[8723\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.34.184.214
Dec 10 05:26:16 hanapaa sshd\[8723\]: Failed password for invalid user admin9 from 190.34.184.214 port 41656 ssh2

[Tue Dec 10 21:53:29.438865 2019] [:error] [pid 14562:tid 140241981646592] [client 103.27.248.32:44712] [client 103.27.248.32] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "python-requests" at REQUEST_HEADERS:User-Agent. [file "/etc/modsecurity/owasp-modsecurity-crs-3.2.0/rules/REQUEST-913-SCANNER-DETECTION.conf"] [line "147"] [id "913101"] [msg "Found User-Agent associated with scripting/generic HTTP client"] [data "Matched Data: python-requests found within REQUEST_HEADERS:User-Agent: python-requests/2.9.1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.2.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-scripting"] [tag "OWASP_CRS"] [tag "OWASP_CRS/AUTOMATION/SCRIPTING"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [tag "paranoia-level/2"] [hostname "karangploso.jatim.bmkg.go.id"] [uri "/recordings/index.php"] [unique_id "Xe@xaVsqNZ0nXL33544zZwAAAEg"]
...

Triggered by Fail2Ban at Vostok web server

Dec 10 21:43:18 vibhu-HP-Z238-Microtower-Workstation sshd\[30483\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.175.183  user=root
Dec 10 21:43:20 vibhu-HP-Z238-Microtower-Workstation sshd\[30483\]: Failed password for root from 222.186.175.183 port 10368 ssh2
Dec 10 21:43:38 vibhu-HP-Z238-Microtower-Workstation sshd\[30500\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.175.183  user=root
Dec 10 21:43:40 vibhu-HP-Z238-Microtower-Workstation sshd\[30500\]: Failed password for root from 222.186.175.183 port 24498 ssh2
Dec 10 21:44:05 vibhu-HP-Z238-Microtower-Workstation sshd\[30514\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.175.183  user=root
...

Dec 10 16:28:59 cp sshd[23400]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.150.70.20
Dec 10 16:28:59 cp sshd[23400]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.150.70.20

2019-12-10T15:26:04.114139abusebot-5.cloudsearch.cf sshd\[23877\]: Invalid user hp from 220.94.205.234 port 58208

Dec 10 16:47:47 h2177944 sshd\[12739\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.85.42.175  user=root
Dec 10 16:47:50 h2177944 sshd\[12739\]: Failed password for root from 112.85.42.175 port 51871 ssh2
Dec 10 16:47:54 h2177944 sshd\[12739\]: Failed password for root from 112.85.42.175 port 51871 ssh2
Dec 10 16:47:57 h2177944 sshd\[12739\]: Failed password for root from 112.85.42.175 port 51871 ssh2
...

Dec 10 16:56:17 cvbnet sshd[22505]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=207.154.206.212 
Dec 10 16:56:19 cvbnet sshd[22505]: Failed password for invalid user guest6 from 207.154.206.212 port 47480 ssh2
...

2019-12-10T15:35:56.479032abusebot-8.cloudsearch.cf sshd\[20605\]: Invalid user apple from 106.12.84.115 port 33290

Dec 10 15:07:38 web8 sshd\[5118\]: Invalid user filecoupon from 165.22.61.82
Dec 10 15:07:38 web8 sshd\[5118\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.61.82
Dec 10 15:07:39 web8 sshd\[5118\]: Failed password for invalid user filecoupon from 165.22.61.82 port 58926 ssh2
Dec 10 15:14:35 web8 sshd\[8579\]: Invalid user johnstad from 165.22.61.82
Dec 10 15:14:35 web8 sshd\[8579\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.61.82

Dec 10 15:17:09 localhost sshd\[7216\]: Invalid user baritone from 58.87.92.153 port 44004
Dec 10 15:17:09 localhost sshd\[7216\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.87.92.153
Dec 10 15:17:11 localhost sshd\[7216\]: Failed password for invalid user baritone from 58.87.92.153 port 44004 ssh2
Dec 10 15:24:52 localhost sshd\[7493\]: Invalid user findley from 58.87.92.153 port 39974
Dec 10 15:24:52 localhost sshd\[7493\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.87.92.153
...

--- report ---
Dec 10 12:25:53 sshd: Connection from 218.92.0.148 port 50445
Dec 10 12:25:56 sshd: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.148  user=root
Dec 10 12:25:58 sshd: Failed password for root from 218.92.0.148 port 50445 ssh2
Dec 10 12:26:00 sshd: Received disconnect from 218.92.0.148: 11:  [preauth]