May  2 19:41:08 v22019038103785759 sshd\[19336\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.189.172  user=root
May  2 19:41:10 v22019038103785759 sshd\[19336\]: Failed password for root from 106.13.189.172 port 46766 ssh2
May  2 19:49:47 v22019038103785759 sshd\[19837\]: Invalid user dev from 106.13.189.172 port 49954
May  2 19:49:47 v22019038103785759 sshd\[19837\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.189.172
May  2 19:49:49 v22019038103785759 sshd\[19837\]: Failed password for invalid user dev from 106.13.189.172 port 49954 ssh2
...

May  2 23:02:51 lukav-desktop sshd\[23441\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.197.52  user=root
May  2 23:02:53 lukav-desktop sshd\[23441\]: Failed password for root from 106.12.197.52 port 59610 ssh2
May  2 23:07:27 lukav-desktop sshd\[26991\]: Invalid user member from 106.12.197.52
May  2 23:07:27 lukav-desktop sshd\[26991\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.197.52
May  2 23:07:29 lukav-desktop sshd\[26991\]: Failed password for invalid user member from 106.12.197.52 port 32820 ssh2

May  2 14:54:00 r.ca sshd[26791]: Failed password for invalid user eirik from 193.219.55.186 port 44890 ssh2

40.76.40.117 - - \[02/May/2020:22:23:31 +0200\] "POST //wp-login.php HTTP/1.0" 200 6848 "https://die-netzialisten.de//wp-login.php" "Mozilla/5.0 \(Windows NT 10.0\; Win64\; x64\) AppleWebKit/537.36 \(KHTML, like Gecko\) Chrome/79.0 Safari/537.36"
40.76.40.117 - - \[02/May/2020:22:23:32 +0200\] "POST //wp-login.php HTTP/1.0" 200 6848 "https://die-netzialisten.de//wp-login.php" "Mozilla/5.0 \(Windows NT 10.0\; Win64\; x64\) AppleWebKit/537.36 \(KHTML, like Gecko\) Chrome/79.0 Safari/537.36"
40.76.40.117 - - \[02/May/2020:22:23:33 +0200\] "POST //wp-login.php HTTP/1.0" 200 6848 "https://die-netzialisten.de//wp-login.php" "Mozilla/5.0 \(Windows NT 10.0\; Win64\; x64\) AppleWebKit/537.36 \(KHTML, like Gecko\) Chrome/79.0 Safari/537.36"

Icarus honeypot on github

May  2 21:41:00 v22019038103785759 sshd\[26812\]: Invalid user admin from 51.178.82.80 port 37648
May  2 21:41:00 v22019038103785759 sshd\[26812\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.178.82.80
May  2 21:41:01 v22019038103785759 sshd\[26812\]: Failed password for invalid user admin from 51.178.82.80 port 37648 ssh2
May  2 21:47:14 v22019038103785759 sshd\[27218\]: Invalid user dj from 51.178.82.80 port 48800
May  2 21:47:14 v22019038103785759 sshd\[27218\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.178.82.80
...

2020-05-02 22:02:51 dovecot_login authenticator failed for \(\[185.50.149.10\]\) \[185.50.149.10\]: 535 Incorrect authentication data \(set_id=commerciale@opso.it\)
2020-05-02 22:03:01 dovecot_login authenticator failed for \(\[185.50.149.10\]\) \[185.50.149.10\]: 535 Incorrect authentication data
2020-05-02 22:03:13 dovecot_login authenticator failed for \(\[185.50.149.10\]\) \[185.50.149.10\]: 535 Incorrect authentication data
2020-05-02 22:03:21 dovecot_login authenticator failed for \(\[185.50.149.10\]\) \[185.50.149.10\]: 535 Incorrect authentication data
2020-05-02 22:03:35 dovecot_login authenticator failed for \(\[185.50.149.10\]\) \[185.50.149.10\]: 535 Incorrect authentication data

SSH login attempts.

(imapd) Failed IMAP login from 219.93.121.22 (MY/Malaysia/san-121-22.tm.net.my): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: May  2 21:41:17 ir1 dovecot[264309]: imap-login: Disconnected (auth failed, 1 attempts in 12 secs): user=, method=PLAIN, rip=219.93.121.22, lip=5.63.12.44, session=

(sshd) Failed SSH login from 51.255.168.152 (FR/France/152.ip-51-255-168.eu): 5 in the last 3600 secs

May  2 21:39:44 vps sshd[793318]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=126.ip-137-74-198.eu
May  2 21:39:47 vps sshd[793318]: Failed password for invalid user postgres from 137.74.198.126 port 57554 ssh2
May  2 21:44:26 vps sshd[817036]: Invalid user user from 137.74.198.126 port 39812
May  2 21:44:26 vps sshd[817036]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=126.ip-137-74-198.eu
May  2 21:44:29 vps sshd[817036]: Failed password for invalid user user from 137.74.198.126 port 39812 ssh2
...

May  2 17:14:32 [host] sshd[28057]: pam_unix(sshd:
May  2 17:14:33 [host] sshd[28057]: Failed passwor
May  2 17:22:46 [host] sshd[28344]: Invalid user b

May  2 21:36:50 localhost sshd\[392\]: Invalid user arul from 203.57.71.114
May  2 21:36:50 localhost sshd\[392\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.57.71.114
May  2 21:36:52 localhost sshd\[392\]: Failed password for invalid user arul from 203.57.71.114 port 59132 ssh2
May  2 21:40:29 localhost sshd\[726\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.57.71.114  user=root
May  2 21:40:30 localhost sshd\[726\]: Failed password for root from 203.57.71.114 port 47594 ssh2
...

SSH Brute Force

May  2 17:26:49 prod4 sshd\[12240\]: Invalid user ftp_user from 109.244.101.155
May  2 17:26:52 prod4 sshd\[12240\]: Failed password for invalid user ftp_user from 109.244.101.155 port 54368 ssh2
May  2 17:29:02 prod4 sshd\[12802\]: Failed password for root from 109.244.101.155 port 48458 ssh2
...