Nov 10 09:26:15 odroid64 sshd\[20142\]: Invalid user hadoop from 94.237.76.61
Nov 10 09:26:15 odroid64 sshd\[20142\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.237.76.61
...

Oct 17 03:43:57 newdogma sshd[9033]: Invalid user minecraft from 94.237.76.61 port 46738
Oct 17 03:43:57 newdogma sshd[9033]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.237.76.61
Oct 17 03:44:00 newdogma sshd[9033]: Failed password for invalid user minecraft from 94.237.76.61 port 46738 ssh2
Oct 17 03:44:00 newdogma sshd[9033]: Received disconnect from 94.237.76.61 port 46738:11: Bye Bye [preauth]
Oct 17 03:44:00 newdogma sshd[9033]: Disconnected from 94.237.76.61 port 46738 [preauth]
Oct 17 03:59:59 newdogma sshd[9158]: Invalid user samuel from 94.237.76.61 port 34882
Oct 17 03:59:59 newdogma sshd[9158]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.237.76.61
Oct 17 04:00:01 newdogma sshd[9158]: Failed password for invalid user samuel from 94.237.76.61 port 34882 ssh2
Oct 17 04:00:01 newdogma sshd[9158]: Received disconnect from 94.237.76.61 port 34882:11: Bye Bye [preauth]
Oct........
-------------------------------

Lines containing failures of 94.237.76.134
Sep  4 14:13:31 dns01 sshd[7571]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.237.76.134  user=r.r
Sep  4 14:13:32 dns01 sshd[7571]: Failed password for r.r from 94.237.76.134 port 45324 ssh2
Sep  4 14:13:33 dns01 sshd[7571]: Received disconnect from 94.237.76.134 port 45324:11: Bye Bye [preauth]
Sep  4 14:13:33 dns01 sshd[7571]: Disconnected from authenticating user r.r 94.237.76.134 port 45324 [preauth]
Sep  4 14:33:00 dns01 sshd[11460]: Invalid user lina from 94.237.76.134 port 46330
Sep  4 14:33:00 dns01 sshd[11460]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.237.76.134
Sep  4 14:33:02 dns01 sshd[11460]: Failed password for invalid user lina from 94.237.76.134 port 46330 ssh2
Sep  4 14:33:03 dns01 sshd[11460]: Received disconnect from 94.237.76.134 port 46330:11: Bye Bye [preauth]
Sep  4 14:33:03 dns01 sshd[11460]: Disconnected fro........
------------------------------

Lines containing failures of 94.237.76.134
Sep  4 14:13:31 dns01 sshd[7571]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.237.76.134  user=r.r
Sep  4 14:13:32 dns01 sshd[7571]: Failed password for r.r from 94.237.76.134 port 45324 ssh2
Sep  4 14:13:33 dns01 sshd[7571]: Received disconnect from 94.237.76.134 port 45324:11: Bye Bye [preauth]
Sep  4 14:13:33 dns01 sshd[7571]: Disconnected from authenticating user r.r 94.237.76.134 port 45324 [preauth]
Sep  4 14:33:00 dns01 sshd[11460]: Invalid user lina from 94.237.76.134 port 46330
Sep  4 14:33:00 dns01 sshd[11460]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.237.76.134
Sep  4 14:33:02 dns01 sshd[11460]: Failed password for invalid user lina from 94.237.76.134 port 46330 ssh2
Sep  4 14:33:03 dns01 sshd[11460]: Received disconnect from 94.237.76.134 port 46330:11: Bye Bye [preauth]
Sep  4 14:33:03 dns01 sshd[11460]: Disconnected fro........
------------------------------

Oct 15 14:17:05 markkoudstaal sshd[7254]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.237.76.100
Oct 15 14:17:07 markkoudstaal sshd[7254]: Failed password for invalid user english from 94.237.76.100 port 42546 ssh2
Oct 15 14:21:43 markkoudstaal sshd[7658]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.237.76.100

Oct 14 18:41:07 kapalua sshd\[15078\]: Invalid user delinia from 94.237.76.100
Oct 14 18:41:07 kapalua sshd\[15078\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=94-237-76-100.sg-sin1.upcloud.host
Oct 14 18:41:09 kapalua sshd\[15078\]: Failed password for invalid user delinia from 94.237.76.100 port 56380 ssh2
Oct 14 18:45:35 kapalua sshd\[15456\]: Invalid user voipcat526202 from 94.237.76.100
Oct 14 18:45:35 kapalua sshd\[15456\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=94-237-76-100.sg-sin1.upcloud.host

Email rejected due to spam filtering

Mar  4 14:27:42 sd-53420 sshd\[4486\]: Invalid user protect from 186.179.103.118
Mar  4 14:27:42 sd-53420 sshd\[4486\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.179.103.118
Mar  4 14:27:45 sd-53420 sshd\[4486\]: Failed password for invalid user protect from 186.179.103.118 port 39489 ssh2
Mar  4 14:37:38 sd-53420 sshd\[5308\]: Invalid user lab from 186.179.103.118
Mar  4 14:37:38 sd-53420 sshd\[5308\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.179.103.118
...

[Wed Mar 04 11:50:35.641450 2020] [:error] [pid 29022:tid 140579572803328] [client 23.83.89.6:42358] [client 23.83.89.6] ModSecurity: Access denied with code 403 (phase 1). Match of "within %{tx.allowed_http_versions}" against "REQUEST_PROTOCOL" required. [file "/etc/modsecurity/owasp-modsecurity-crs-3.2.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "972"] [id "920430"] [msg "HTTP protocol version is not allowed by policy"] [data "HTTP/1.0"] [severity "CRITICAL"] [ver "OWASP_CRS/3.2.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "OWASP_CRS/POLICY/PROTOCOL_NOT_ALLOWED"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A6"] [tag "PCI/6.5.10"] [hostname "staklim-malang.info"] [uri "/"] [unique_id "Xl8zm6Bo3EW5af1RNirqYQAAAKY"]
...

Mar  4 13:34:27 MK-Soft-VM3 sshd[6668]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.112.1.26 
Mar  4 13:34:29 MK-Soft-VM3 sshd[6668]: Failed password for invalid user fmnet from 193.112.1.26 port 53212 ssh2
...

Automatic report - Banned IP Access

2020-03-04T08:40:55.040560xentho-1 sshd[254277]: Failed password for root from 222.186.175.163 port 33970 ssh2
2020-03-04T08:40:48.810768xentho-1 sshd[254277]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.175.163  user=root
2020-03-04T08:40:50.904911xentho-1 sshd[254277]: Failed password for root from 222.186.175.163 port 33970 ssh2
2020-03-04T08:40:55.040560xentho-1 sshd[254277]: Failed password for root from 222.186.175.163 port 33970 ssh2
2020-03-04T08:41:00.032424xentho-1 sshd[254277]: Failed password for root from 222.186.175.163 port 33970 ssh2
2020-03-04T08:40:48.810768xentho-1 sshd[254277]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.175.163  user=root
2020-03-04T08:40:50.904911xentho-1 sshd[254277]: Failed password for root from 222.186.175.163 port 33970 ssh2
2020-03-04T08:40:55.040560xentho-1 sshd[254277]: Failed password for root from 222.186.175.163 port 33970 ssh2
2020-0
...

Mar  4 14:42:08 v22018076622670303 sshd\[5889\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.180.6  user=root
Mar  4 14:42:10 v22018076622670303 sshd\[5889\]: Failed password for root from 222.186.180.6 port 32986 ssh2
Mar  4 14:42:13 v22018076622670303 sshd\[5889\]: Failed password for root from 222.186.180.6 port 32986 ssh2
...

Mar  4 13:53:42 MK-Soft-Root1 sshd[5533]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.170.214.154 
Mar  4 13:53:44 MK-Soft-Root1 sshd[5533]: Failed password for invalid user isa from 81.170.214.154 port 34816 ssh2
...

Brute-force attempt banned

Mar  4 13:46:27 web01.agentur-b-2.de postfix/smtpd[187531]: NOQUEUE: reject: RCPT from unknown[185.143.223.161]: 554 5.7.1 Service unavailable; Client host [185.143.223.161] blocked using zen.spamhaus.org; https://www.spamhaus.org/sbl/query/SBL420772 / https://www.spamhaus.org/sbl/query/SBL442610 / https://www.spamhaus.org/sbl/query/SBLCSS; from=<8tfer3l33geay9w@prihodko.com> to= proto=ESMTP helo=<[185.143.223.170]>
Mar  4 13:46:27 web01.agentur-b-2.de postfix/smtpd[187531]: NOQUEUE: reject: RCPT from unknown[185.143.223.161]: 554 5.7.1 Service unavailable; Client host [185.143.223.161] blocked using zen.spamhaus.org; https://www.spamhaus.org/sbl/query/SBL420772 / https://www.spamhaus.org/sbl/query/SBL442610 / https://www.spamhaus.org/sbl/query/SBLCSS; from=<8tfer3l33geay9w@prihodko.com> to= proto=ESMTP helo=<[185.143.223.170]>
Mar  4 13:46:27 web01.agentur-b-2.de postfix/smtpd[187531]: NOQUEUE: reject: RCPT from unknown[185.143.223.161]: 554 5.7.1 Service unavailable; Clie

spam

Mar  4 03:01:37 wbs sshd\[25861\]: Invalid user cyril from 51.38.239.50
Mar  4 03:01:37 wbs sshd\[25861\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=50.ip-51-38-239.eu
Mar  4 03:01:40 wbs sshd\[25861\]: Failed password for invalid user cyril from 51.38.239.50 port 48386 ssh2
Mar  4 03:10:26 wbs sshd\[26670\]: Invalid user sai from 51.38.239.50
Mar  4 03:10:26 wbs sshd\[26670\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=50.ip-51-38-239.eu

2020-03-04T11:12:18.966451vps751288.ovh.net sshd\[20038\]: Invalid user dev from 117.50.63.247 port 34172
2020-03-04T11:12:18.976408vps751288.ovh.net sshd\[20038\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.50.63.247
2020-03-04T11:12:21.331649vps751288.ovh.net sshd\[20038\]: Failed password for invalid user dev from 117.50.63.247 port 34172 ssh2
2020-03-04T11:21:15.761950vps751288.ovh.net sshd\[20095\]: Invalid user odoo from 117.50.63.247 port 32908
2020-03-04T11:21:15.770012vps751288.ovh.net sshd\[20095\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.50.63.247

RDP Brute-Force (Grieskirchen RZ1)

Receiving 1000's of email every day for months. Appear to be using a word list to create email addresses (random word)@mydomain...  Also using random characters in the senders name using correct domain names: 2dzd5ioyjod2b@lulucoffee.co.uk, s5yx0sbnjiumvp6@galatasaray.com, 2v5a9qyn3oqktv6@central-marketer.com

Event:	rejected rejected
User:	-remote-
Domain:	
From Address:	s5yx0sbnjiumvp6@galatasaray.com
Sender:	
Sent Time:	Mar 4, 2020, 6:02:06 AM
Sender Host:	185.143.223.160
Sender IP:	185.143.223.160
Authentication:	unauthorized
Spam Score:	0
Recipient:	delusional@MYDOMAIN
Delivered To:	
Router:	reject
Transport:	**rejected**
Out Time:	Mar 4, 2020, 6:02:06 AM
ID:	1j9N6e-0008Qm-mF
Delivery Host:	185.143.223.160
Delivery IP:	185.143.223.160
Size:	0 bytes
Result:	No Such User Here