Return-Path: 
Received: from mail-pl1-x642.google.com ([IPv6:2607:f8b0:4864:20::642])
	by resimta-po-33v.sys.comcast.net with ESMTP
	id CqkokUJQKq7VyCqn3k1cPA; Mon, 31 Aug 2020 20:52:33 +0000
From: "Membership Reminder" 
Subject: Notification: Your membership service not yet confirmed, we tried
 to bill you automatically

NETFLIX

Something went wrong

We have been notified that you questioned a Netflix charge for the payment method we have on file and have terminated your membership.

We would like you to come back. If you change your mind, just restart your membership to enjoy the best TV shows and movies without interruption.

Restart Now 

Apr 12 08:27:18  sshd\[3288\]: User root from 119.29.199.150 not allowed because not listed in AllowUsersApr 12 08:27:21  sshd\[3288\]: Failed password for invalid user root from 119.29.199.150 port 44356 ssh2
...

SSH Brute-Force reported by Fail2Ban

Apr 12 09:58:51 ns382633 sshd\[8308\]: Invalid user incoming from 104.131.249.57 port 49994
Apr 12 09:58:51 ns382633 sshd\[8308\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.131.249.57
Apr 12 09:58:53 ns382633 sshd\[8308\]: Failed password for invalid user incoming from 104.131.249.57 port 49994 ssh2
Apr 12 10:04:16 ns382633 sshd\[9350\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.131.249.57  user=root
Apr 12 10:04:19 ns382633 sshd\[9350\]: Failed password for root from 104.131.249.57 port 54185 ssh2

Invalid user eshop from 180.168.201.126 port 36405

prod8
...

[portscan] udp/1900 [ssdp]
*(RWIN=-)(04121035)

Brute force attempt

Apr 12 10:06:40 ourumov-web sshd\[30781\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.219.3.139  user=root
Apr 12 10:06:42 ourumov-web sshd\[30781\]: Failed password for root from 46.219.3.139 port 45580 ssh2
Apr 12 10:08:00 ourumov-web sshd\[31045\]: Invalid user test from 46.219.3.139 port 33590
...

Apr 12 10:59:05 host01 sshd[25999]: Failed password for root from 50.227.195.3 port 52746 ssh2
Apr 12 11:02:48 host01 sshd[26719]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=50.227.195.3 
Apr 12 11:02:49 host01 sshd[26719]: Failed password for invalid user home from 50.227.195.3 port 60048 ssh2
...

Apr 12 10:50:15 server sshd[27914]: Failed password for invalid user mkamau from 8.14.149.127 port 39061 ssh2
Apr 12 11:00:04 server sshd[29737]: Failed password for invalid user zangrando from 8.14.149.127 port 61569 ssh2
Apr 12 11:04:12 server sshd[30443]: Failed password for invalid user nkinyanjui from 8.14.149.127 port 38990 ssh2

prod3
...

B: Abusive ssh attack

Apr 12 11:39:17 meumeu sshd[20462]: Failed password for root from 141.98.81.83 port 44653 ssh2
Apr 12 11:39:50 meumeu sshd[20551]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=141.98.81.83 
Apr 12 11:39:52 meumeu sshd[20551]: Failed password for invalid user guest from 141.98.81.83 port 34323 ssh2
...

Triggered by Fail2Ban at Ares web server

Apr 12 09:21:17 xeon sshd[28244]: Failed password for root from 217.138.76.66 port 53843 ssh2