(sshd) Failed SSH login from 61.182.232.38 (CN/China/-): 3 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD

Jun  4 14:01:23 web01 sshd[3514]: Failed password for root from 61.182.232.38 port 56710 ssh2
...

Invalid user hrishabh from 61.182.232.38 port 50606

May 20 16:23:30 lukav-desktop sshd\[30098\]: Invalid user zxu from 61.182.232.38
May 20 16:23:30 lukav-desktop sshd\[30098\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.182.232.38
May 20 16:23:32 lukav-desktop sshd\[30098\]: Failed password for invalid user zxu from 61.182.232.38 port 41590 ssh2
May 20 16:28:41 lukav-desktop sshd\[30164\]: Invalid user tow from 61.182.232.38
May 20 16:28:41 lukav-desktop sshd\[30164\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.182.232.38

May 13 05:49:52 server sshd[62174]: Failed password for invalid user sysman from 61.182.232.38 port 47216 ssh2
May 13 06:09:18 server sshd[11540]: Failed password for invalid user web from 61.182.232.38 port 59282 ssh2
May 13 06:13:49 server sshd[14710]: Failed password for invalid user asif from 61.182.232.38 port 54078 ssh2

(sshd) Failed SSH login from 61.182.232.38 (CN/China/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: May 12 10:55:29 amsweb01 sshd[2042]: Invalid user mcedit from 61.182.232.38 port 49502
May 12 10:55:31 amsweb01 sshd[2042]: Failed password for invalid user mcedit from 61.182.232.38 port 49502 ssh2
May 12 11:09:37 amsweb01 sshd[3042]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.182.232.38  user=root
May 12 11:09:39 amsweb01 sshd[3042]: Failed password for root from 61.182.232.38 port 46628 ssh2
May 12 11:13:41 amsweb01 sshd[3278]: Invalid user sanchez from 61.182.232.38 port 33572

May 10 00:24:08 cloud sshd[2663]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.182.232.38 
May 10 00:24:11 cloud sshd[2663]: Failed password for invalid user postgres from 61.182.232.38 port 48124 ssh2

Invalid user me from 61.182.232.38 port 51222

Apr 22 10:41:11 l03 sshd[6860]: Invalid user test from 61.182.232.38 port 55658
...

(sshd) Failed SSH login from 61.182.232.38 (CN/China/-): 5 in the last 3600 secs

2020-03-27T19:52:50.657019ionos.janbro.de sshd[1725]: Invalid user pmn from 61.182.232.38 port 46262
2020-03-27T19:52:52.952150ionos.janbro.de sshd[1725]: Failed password for invalid user pmn from 61.182.232.38 port 46262 ssh2
2020-03-27T19:54:47.263895ionos.janbro.de sshd[1748]: Invalid user bdy from 61.182.232.38 port 51112
2020-03-27T19:54:47.424071ionos.janbro.de sshd[1748]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.182.232.38
2020-03-27T19:54:47.263895ionos.janbro.de sshd[1748]: Invalid user bdy from 61.182.232.38 port 51112
2020-03-27T19:54:49.302566ionos.janbro.de sshd[1748]: Failed password for invalid user bdy from 61.182.232.38 port 51112 ssh2
2020-03-27T19:56:41.531369ionos.janbro.de sshd[1764]: Invalid user urr from 61.182.232.38 port 55958
2020-03-27T19:56:41.842579ionos.janbro.de sshd[1764]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.182.232.38
2020-03-27T19:56:41.531369ionos.
...

Mar 18 23:27:05 server sshd\[7717\]: Failed password for root from 61.182.232.38 port 34712 ssh2
Mar 19 08:51:23 server sshd\[19372\]: Invalid user temp from 61.182.232.38
Mar 19 08:51:23 server sshd\[19372\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.182.232.38 
Mar 19 08:51:25 server sshd\[19372\]: Failed password for invalid user temp from 61.182.232.38 port 58192 ssh2
Mar 19 09:09:23 server sshd\[23562\]: Invalid user docker from 61.182.232.38
...

2020-03-18T18:13:29.641312randservbullet-proofcloud-66.localdomain sshd[11605]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.182.232.38  user=root
2020-03-18T18:13:31.493636randservbullet-proofcloud-66.localdomain sshd[11605]: Failed password for root from 61.182.232.38 port 51350 ssh2
2020-03-18T18:34:07.518565randservbullet-proofcloud-66.localdomain sshd[11694]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.182.232.38  user=root
2020-03-18T18:34:09.662012randservbullet-proofcloud-66.localdomain sshd[11694]: Failed password for root from 61.182.232.38 port 58714 ssh2
...

SSH bruteforce (Triggered fail2ban)

Mar  6 00:21:23 Tower sshd[15020]: Connection from 61.182.232.38 port 58356 on 192.168.10.220 port 22 rdomain ""
Mar  6 00:21:24 Tower sshd[15020]: Invalid user ftptest from 61.182.232.38 port 58356
Mar  6 00:21:24 Tower sshd[15020]: error: Could not get shadow information for NOUSER
Mar  6 00:21:24 Tower sshd[15020]: Failed password for invalid user ftptest from 61.182.232.38 port 58356 ssh2
Mar  6 00:21:25 Tower sshd[15020]: Received disconnect from 61.182.232.38 port 58356:11: Bye Bye [preauth]
Mar  6 00:21:25 Tower sshd[15020]: Disconnected from invalid user ftptest 61.182.232.38 port 58356 [preauth]

2019-12-03 17:57:06 auth_login authenticator failed for (localhost.localdomain) [77.40.3.89]: 535 Incorrect authentication data (set_id=billing@polypics.ru)
2019-12-03 18:54:29 auth_login authenticator failed for (localhost.localdomain) [77.40.3.89]: 535 Incorrect authentication data (set_id=membership@legion-td.ru)
...

Dec  3 15:25:22 icecube postfix/smtpd[38325]: NOQUEUE: reject: RCPT from decision.redconnekt.top[37.59.183.34]: 554 5.7.1 Service unavailable; Client host [37.59.183.34] blocked using zen.spamhaus.org; https://www.spamhaus.org/query/ip/37.59.183.34 / https://www.spamhaus.org/sbl/query/SBLCSS; from= to= proto=ESMTP helo=

Dec  3 21:28:00 OPSO sshd\[13508\]: Invalid user yuinaho from 80.211.95.201 port 60346
Dec  3 21:28:00 OPSO sshd\[13508\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.95.201
Dec  3 21:28:03 OPSO sshd\[13508\]: Failed password for invalid user yuinaho from 80.211.95.201 port 60346 ssh2
Dec  3 21:33:19 OPSO sshd\[15049\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.95.201  user=daemon
Dec  3 21:33:20 OPSO sshd\[15049\]: Failed password for daemon from 80.211.95.201 port 43240 ssh2

2019-12-03 06:11:12 server sshd[30364]: Failed password for invalid user root from 91.121.205.83 port 36110 ssh2

fail2ban honeypot

HTTP contact form spam

Dec  2 06:25:17 sanyalnet-cloud-vps3 sshd[19158]: Connection from 24.239.97.43 port 34120 on 45.62.248.66 port 22
Dec  2 06:25:17 sanyalnet-cloud-vps3 sshd[19158]: Did not receive identification string from 24.239.97.43
Dec  2 06:26:00 sanyalnet-cloud-vps3 sshd[19195]: Connection from 24.239.97.43 port 36582 on 45.62.248.66 port 22
Dec  2 06:26:11 sanyalnet-cloud-vps3 sshd[19195]: Invalid user se from 24.239.97.43
Dec  2 06:26:11 sanyalnet-cloud-vps3 sshd[19195]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=dynamic-acs-24-239-97-43.zoominternet.net 
Dec  2 06:26:13 sanyalnet-cloud-vps3 sshd[19195]: Failed password for invalid user se from 24.239.97.43 port 36582 ssh2
Dec  2 06:26:13 sanyalnet-cloud-vps3 sshd[19195]: Received disconnect from 24.239.97.43: 11: Bye Bye [preauth]
Dec  2 06:27:08 sanyalnet-cloud-vps3 sshd[19228]: Connection from 24.239.97.43 port 38508 on 45.62.248.66 port 22
Dec  2 06:27:15 sanyalnet-cloud-vps3 ssh........
-------------------------------

Dec  3 20:17:39 hcbbdb sshd\[27985\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.180.223  user=root
Dec  3 20:17:41 hcbbdb sshd\[27985\]: Failed password for root from 222.186.180.223 port 2970 ssh2
Dec  3 20:17:51 hcbbdb sshd\[27985\]: Failed password for root from 222.186.180.223 port 2970 ssh2
Dec  3 20:17:54 hcbbdb sshd\[27985\]: Failed password for root from 222.186.180.223 port 2970 ssh2
Dec  3 20:17:57 hcbbdb sshd\[28053\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.180.223  user=root

2019-12-03T20:31:48.235171  sshd[21096]: Invalid user pezzullo from 144.217.214.100 port 40204
2019-12-03T20:31:48.250220  sshd[21096]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=144.217.214.100
2019-12-03T20:31:48.235171  sshd[21096]: Invalid user pezzullo from 144.217.214.100 port 40204
2019-12-03T20:31:50.380658  sshd[21096]: Failed password for invalid user pezzullo from 144.217.214.100 port 40204 ssh2
2019-12-03T20:39:49.344835  sshd[21229]: Invalid user dicky from 144.217.214.100 port 48536
...

Dec  3 16:26:44 master sshd[32487]: Failed password for root from 120.132.114.103 port 49148 ssh2
Dec  3 16:40:07 master sshd[32507]: Failed password for invalid user zygmunt from 120.132.114.103 port 48790 ssh2
Dec  3 16:48:56 master sshd[32529]: Failed password for games from 120.132.114.103 port 58038 ssh2
Dec  3 16:57:26 master sshd[32531]: Failed password for invalid user selent from 120.132.114.103 port 38412 ssh2
Dec  3 17:07:48 master sshd[32550]: Failed password for root from 120.132.114.103 port 48104 ssh2
Dec  3 17:16:32 master sshd[32571]: Failed password for invalid user usuario from 120.132.114.103 port 56606 ssh2

Scanning random ports - tries to find possible vulnerable services

Triggered by Fail2Ban at Ares web server

Dec  3 20:53:31 mail sshd[32444]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.179.111 
Dec  3 20:53:32 mail sshd[32444]: Failed password for invalid user akovacs from 138.197.179.111 port 34476 ssh2
Dec  3 20:59:02 mail sshd[2901]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.179.111

Dec  3 16:32:58 vps666546 sshd\[12703\]: Invalid user shomita from 66.70.189.93 port 35098
Dec  3 16:32:58 vps666546 sshd\[12703\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=66.70.189.93
Dec  3 16:33:00 vps666546 sshd\[12703\]: Failed password for invalid user shomita from 66.70.189.93 port 35098 ssh2
Dec  3 16:38:52 vps666546 sshd\[12889\]: Invalid user breton123 from 66.70.189.93 port 47256
Dec  3 16:38:52 vps666546 sshd\[12889\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=66.70.189.93
...

Dec  3 09:53:38 sachi sshd\[16327\]: Invalid user gdm from 202.175.46.170
Dec  3 09:53:38 sachi sshd\[16327\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=z46l170.static.ctm.net
Dec  3 09:53:40 sachi sshd\[16327\]: Failed password for invalid user gdm from 202.175.46.170 port 36258 ssh2
Dec  3 09:59:20 sachi sshd\[16880\]: Invalid user tomcat from 202.175.46.170
Dec  3 09:59:20 sachi sshd\[16880\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=z46l170.static.ctm.net