<6 unauthorized SSH connections

Automatic report - XMLRPC Attack

Jun  4 06:35:17 abendstille sshd\[30457\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=220.88.1.208  user=root
Jun  4 06:35:20 abendstille sshd\[30457\]: Failed password for root from 220.88.1.208 port 42345 ssh2
Jun  4 06:38:00 abendstille sshd\[720\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=220.88.1.208  user=root
Jun  4 06:38:03 abendstille sshd\[720\]: Failed password for root from 220.88.1.208 port 34156 ssh2
Jun  4 06:40:45 abendstille sshd\[3354\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=220.88.1.208  user=root
...

ET DROP Dshield Block Listed Source group 1 - port: 5983 proto: TCP cat: Misc Attack

(imapd) Failed IMAP login from 37.210.144.25 (QA/Qatar/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Jun  4 08:21:33 ir1 dovecot[2885757]: imap-login: Disconnected (auth failed, 1 attempts in 2 secs): user=, method=PLAIN, rip=37.210.144.25, lip=5.63.12.44, TLS, session=

2020-06-04 08:54:34 auth_plain authenticator failed for (User) [45.143.223.11]: 535 Incorrect authentication data (set_id=chen@lavrinenko.info,)
2020-06-04 08:54:34 auth_plain authenticator failed for (User) [45.143.223.11]: 535 Incorrect authentication data (set_id=chen@lavrinenko.info,)
...

Jun  4 05:51:43 vserver sshd\[18943\]: Failed password for root from 109.173.40.60 port 56446 ssh2Jun  4 05:54:55 vserver sshd\[18997\]: Failed password for root from 109.173.40.60 port 59150 ssh2Jun  4 05:58:13 vserver sshd\[19041\]: Failed password for root from 109.173.40.60 port 33610 ssh2Jun  4 06:01:34 vserver sshd\[19072\]: Failed password for root from 109.173.40.60 port 36306 ssh2
...

Jun  4 08:08:21 inter-technics sshd[17277]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.135.10.211  user=root
Jun  4 08:08:23 inter-technics sshd[17277]: Failed password for root from 193.135.10.211 port 50090 ssh2
Jun  4 08:11:36 inter-technics sshd[17601]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.135.10.211  user=root
Jun  4 08:11:38 inter-technics sshd[17601]: Failed password for root from 193.135.10.211 port 53562 ssh2
Jun  4 08:14:55 inter-technics sshd[17762]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.135.10.211  user=root
Jun  4 08:14:57 inter-technics sshd[17762]: Failed password for root from 193.135.10.211 port 57034 ssh2
...

Jun  4 10:39:46 vps sshd[317803]: Failed password for root from 112.85.42.178 port 44641 ssh2
Jun  4 10:39:49 vps sshd[317803]: Failed password for root from 112.85.42.178 port 44641 ssh2
Jun  4 10:39:52 vps sshd[317803]: Failed password for root from 112.85.42.178 port 44641 ssh2
Jun  4 10:39:56 vps sshd[317803]: Failed password for root from 112.85.42.178 port 44641 ssh2
Jun  4 10:40:00 vps sshd[317803]: Failed password for root from 112.85.42.178 port 44641 ssh2
...

multiple disguised scraping from this ISP Ranges

Jun  4 06:26:10 tuxlinux sshd[60053]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.55.72.69  user=root
Jun  4 06:26:13 tuxlinux sshd[60053]: Failed password for root from 45.55.72.69 port 44400 ssh2
Jun  4 06:26:10 tuxlinux sshd[60053]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.55.72.69  user=root
Jun  4 06:26:13 tuxlinux sshd[60053]: Failed password for root from 45.55.72.69 port 44400 ssh2
Jun  4 06:41:52 tuxlinux sshd[63387]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.55.72.69  user=root
...

From devolvidos@primeiroeunico.live Thu Jun 04 00:52:13 2020
Received: from primemx3.primeiroeunico.live ([194.26.149.170]:46535)

IP blocked

Jun  4 13:14:06 gw1 sshd[30451]: Failed password for root from 112.220.238.3 port 46728 ssh2
...

(smtpauth) Failed SMTP AUTH login from 170.238.78.119 (BR/Brazil/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 2020-06-04 08:22:50 plain authenticator failed for ([170.238.78.119]) [170.238.78.119]: 535 Incorrect authentication data (set_id=training@nazeranyekta.com)