SSH login attempts with user root.

2020-07-28T19:17:09.277033+02:00  sshd[2057]: Failed password for invalid user misumi from 106.13.150.200 port 50936 ssh2

BF attempts

2020-07-14T07:42:37.445693+02:00  sshd[26395]: Failed password for invalid user nano from 106.13.15.122 port 53818 ssh2

Jun 30 17:23:56 onepixel sshd[2665230]: Invalid user support from 106.13.150.200 port 38628
Jun 30 17:23:56 onepixel sshd[2665230]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.150.200 
Jun 30 17:23:56 onepixel sshd[2665230]: Invalid user support from 106.13.150.200 port 38628
Jun 30 17:23:58 onepixel sshd[2665230]: Failed password for invalid user support from 106.13.150.200 port 38628 ssh2
Jun 30 17:26:25 onepixel sshd[2666597]: Invalid user rstudio from 106.13.150.200 port 42706

Jun 28 22:48:06 onepixel sshd[1372562]: Invalid user bar from 106.13.150.200 port 41296
Jun 28 22:48:06 onepixel sshd[1372562]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.150.200 
Jun 28 22:48:06 onepixel sshd[1372562]: Invalid user bar from 106.13.150.200 port 41296
Jun 28 22:48:07 onepixel sshd[1372562]: Failed password for invalid user bar from 106.13.150.200 port 41296 ssh2
Jun 28 22:51:39 onepixel sshd[1374397]: Invalid user mona from 106.13.150.200 port 59940

Jun 28 04:37:40 game-panel sshd[28991]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.150.200
Jun 28 04:37:42 game-panel sshd[28991]: Failed password for invalid user max from 106.13.150.200 port 48474 ssh2
Jun 28 04:41:06 game-panel sshd[29269]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.150.200

Jun 23 13:54:02 NG-HHDC-SVS-001 sshd[2554]: Invalid user ts3bot from 106.13.15.122
...

Jun  9 00:38:29 web1 sshd\[31595\]: Invalid user admin from 106.13.15.242
Jun  9 00:38:29 web1 sshd\[31595\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.15.242
Jun  9 00:38:31 web1 sshd\[31595\]: Failed password for invalid user admin from 106.13.15.242 port 60026 ssh2
Jun  9 00:42:09 web1 sshd\[32242\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.15.242  user=sync
Jun  9 00:42:10 web1 sshd\[32242\]: Failed password for sync from 106.13.15.242 port 53106 ssh2

20 attempts against mh-ssh on echoip

20 attempts against mh-ssh on cloud

serveres are UTC -0400
Lines containing failures of 106.13.15.242
May 31 21:10:28 tux2 sshd[31321]: Failed password for r.r from 106.13.15.242 port 43542 ssh2
May 31 21:10:28 tux2 sshd[31321]: Received disconnect from 106.13.15.242 port 43542:11: Bye Bye [preauth]
May 31 21:10:28 tux2 sshd[31321]: Disconnected from authenticating user r.r 106.13.15.242 port 43542 [preauth]
May 31 21:30:47 tux2 sshd[32400]: Failed password for r.r from 106.13.15.242 port 33452 ssh2
May 31 21:30:48 tux2 sshd[32400]: Received disconnect from 106.13.15.242 port 33452:11: Bye Bye [preauth]
May 31 21:30:48 tux2 sshd[32400]: Disconnected from authenticating user r.r 106.13.15.242 port 33452 [preauth]
May 31 21:34:46 tux2 sshd[32627]: Failed password for r.r from 106.13.15.242 port 53554 ssh2
May 31 21:34:46 tux2 sshd[32627]: Received disconnect from 106.13.15.242 port 53554:11: Bye Bye [preauth]
May 31 21:34:46 tux2 sshd[32627]: Disconnected from authenticating user r.r 106.13.15.242 port 53554........
------------------------------

prod8
...

serveres are UTC -0400
Lines containing failures of 106.13.15.242
May 31 21:10:28 tux2 sshd[31321]: Failed password for r.r from 106.13.15.242 port 43542 ssh2
May 31 21:10:28 tux2 sshd[31321]: Received disconnect from 106.13.15.242 port 43542:11: Bye Bye [preauth]
May 31 21:10:28 tux2 sshd[31321]: Disconnected from authenticating user r.r 106.13.15.242 port 43542 [preauth]
May 31 21:30:47 tux2 sshd[32400]: Failed password for r.r from 106.13.15.242 port 33452 ssh2
May 31 21:30:48 tux2 sshd[32400]: Received disconnect from 106.13.15.242 port 33452:11: Bye Bye [preauth]
May 31 21:30:48 tux2 sshd[32400]: Disconnected from authenticating user r.r 106.13.15.242 port 33452 [preauth]
May 31 21:34:46 tux2 sshd[32627]: Failed password for r.r from 106.13.15.242 port 53554 ssh2
May 31 21:34:46 tux2 sshd[32627]: Received disconnect from 106.13.15.242 port 53554:11: Bye Bye [preauth]
May 31 21:34:46 tux2 sshd[32627]: Disconnected from authenticating user r.r 106.13.15.242 port 53554........
------------------------------

serveres are UTC -0400
Lines containing failures of 106.13.15.242
May 31 21:10:28 tux2 sshd[31321]: Failed password for r.r from 106.13.15.242 port 43542 ssh2
May 31 21:10:28 tux2 sshd[31321]: Received disconnect from 106.13.15.242 port 43542:11: Bye Bye [preauth]
May 31 21:10:28 tux2 sshd[31321]: Disconnected from authenticating user r.r 106.13.15.242 port 43542 [preauth]
May 31 21:30:47 tux2 sshd[32400]: Failed password for r.r from 106.13.15.242 port 33452 ssh2
May 31 21:30:48 tux2 sshd[32400]: Received disconnect from 106.13.15.242 port 33452:11: Bye Bye [preauth]
May 31 21:30:48 tux2 sshd[32400]: Disconnected from authenticating user r.r 106.13.15.242 port 33452 [preauth]
May 31 21:34:46 tux2 sshd[32627]: Failed password for r.r from 106.13.15.242 port 53554 ssh2
May 31 21:34:46 tux2 sshd[32627]: Received disconnect from 106.13.15.242 port 53554:11: Bye Bye [preauth]
May 31 21:34:46 tux2 sshd[32627]: Disconnected from authenticating user r.r 106.13.15.242 port 53554........
------------------------------

Fail2Ban - SSH Bruteforce Attempt

Aug 22 00:09:20 ip106 sshd[4109]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.200.60.74 
Aug 22 00:09:21 ip106 sshd[4109]: Failed password for invalid user sdtd from 113.200.60.74 port 52148 ssh2
...

(mod_security) mod_security (id:210492) triggered by 165.232.42.108 (GB/United Kingdom/-): 5 in the last 3600 secs

Aug 21 23:24:44 cosmoit sshd[2631]: Failed password for root from 58.210.128.130 port 12374 ssh2

Aug 21 18:40:04 ny01 sshd[1062]: Failed password for root from 222.186.180.41 port 7880 ssh2
Aug 21 18:40:18 ny01 sshd[1062]: error: maximum authentication attempts exceeded for root from 222.186.180.41 port 7880 ssh2 [preauth]
Aug 21 18:40:24 ny01 sshd[1105]: Failed password for root from 222.186.180.41 port 10810 ssh2

[N10.H1.VM1] Port Scanner Detected Blocked by UFW

2020-08-22 00:08:51 dovecot_login authenticator failed for \(\[78.128.113.118\]\) \[78.128.113.118\]: 535 Incorrect authentication data \(set_id=info@nopcommerce.it\)
2020-08-22 00:08:58 dovecot_login authenticator failed for \(\[78.128.113.118\]\) \[78.128.113.118\]: 535 Incorrect authentication data
2020-08-22 00:09:07 dovecot_login authenticator failed for \(\[78.128.113.118\]\) \[78.128.113.118\]: 535 Incorrect authentication data
2020-08-22 00:09:11 dovecot_login authenticator failed for \(\[78.128.113.118\]\) \[78.128.113.118\]: 535 Incorrect authentication data
2020-08-22 00:09:23 dovecot_login authenticator failed for \(\[78.128.113.118\]\) \[78.128.113.118\]: 535 Incorrect authentication data

Invalid user hw from 140.86.12.31 port 51294

2020-08-21T22:11:33.927124vps-d63064a2 sshd[94599]: Invalid user vyos from 138.68.92.121 port 59382
2020-08-21T22:11:35.972764vps-d63064a2 sshd[94599]: Failed password for invalid user vyos from 138.68.92.121 port 59382 ssh2
2020-08-21T22:14:36.914118vps-d63064a2 sshd[94630]: Invalid user traffic from 138.68.92.121 port 42438
2020-08-21T22:14:36.923048vps-d63064a2 sshd[94630]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.92.121
2020-08-21T22:14:36.914118vps-d63064a2 sshd[94630]: Invalid user traffic from 138.68.92.121 port 42438
2020-08-21T22:14:39.415418vps-d63064a2 sshd[94630]: Failed password for invalid user traffic from 138.68.92.121 port 42438 ssh2
...

Sender claiming to be from bank using sendgrid.net email servers for phishing attempt:

Return-Path: alexandre.r@globedreamers.com
X-hMailServer-ExternalAccount: pop.netaddress.com
X-Vipre-Scanned: 2A831E9D01505A2A831FEA-TDI
X-USANET-Received: from nm11.cms.usa.net [127.0.0.1] by nm11.cms.usa.net via mtad (C8.MAIN.4.17E)  with ESMTP id 919yHuTL39328M11; Fri, 21 Aug 2020 19:11:54 -0000
Return-Path: 
X-USANET-GWS2-Tagid: UNKN
X-USANET-GWS2-MailFromDnsResult: DnsFound
X-USANET-GWS2-Security: TLSv1.2;ECDHE-RSA-AES256-GCM-SHA384
Received: from wrqvnzzk.outbound-mail.sendgrid.net [149.72.46.225] by nm11.cms.usa.net via smtad (C8.MAIN.4.26V)  with ESMTPS id XID221yHuTL30685X11 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384); Fri, 21 Aug 2020 19:11:54 -0000
X-USANET-Source: 149.72.46.225   IN   bounces+2B15170893-0aea-aleks.k+3Dusa.net@sendgrid.net wrqvnzzk.outbound-mail.sendgrid.net TLS
X-USANET-MsgId: XID221yHuTL30685X11

Lines containing failures of 167.71.226.130
Aug 20 22:47:28 rancher sshd[32207]: Invalid user class from 167.71.226.130 port 51680
Aug 20 22:47:28 rancher sshd[32207]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.226.130
Aug 20 22:47:30 rancher sshd[32207]: Failed password for invalid user class from 167.71.226.130 port 51680 ssh2
Aug 20 22:47:31 rancher sshd[32207]: Received disconnect from 167.71.226.130 port 51680:11: Bye Bye [preauth]
Aug 20 22:47:31 rancher sshd[32207]: Disconnected from invalid user class 167.71.226.130 port 51680 [preauth]
Aug 20 22:50:19 rancher sshd[32319]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.226.130  user=r.r
Aug 20 22:50:22 rancher sshd[32319]: Failed password for r.r from 167.71.226.130 port 58454 ssh2
Aug 20 22:50:23 rancher sshd[32319]: Received disconnect from 167.71.226.130 port 58454:11: Bye Bye [preauth]
Aug 20 22:50:23 rancher s........
------------------------------

Port Scan detected!
...

Automatic report - Banned IP Access

Invalid user composer from 167.71.162.16 port 58534

[2020-08-21 18:12:52] NOTICE[1185][C-000043b6] chan_sip.c: Call from '' (156.96.117.183:54442) to extension '01148221530669' rejected because extension not found in context 'public'.
[2020-08-21 18:12:52] SECURITY[1203] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-08-21T18:12:52.767-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="01148221530669",SessionID="0x7f10c4157908",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/156.96.117.183/54442",ACLName="no_extension_match"
[2020-08-21 18:13:08] NOTICE[1185][C-000043b8] chan_sip.c: Call from '' (156.96.117.183:54005) to extension '901146812410465' rejected because extension not found in context 'public'.
[2020-08-21 18:13:08] SECURITY[1203] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-08-21T18:13:08.643-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="901146812410465",SessionID="0x7f10c43f67a8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP
...

Aug 21 23:19:19 h2427292 sshd\[12064\]: Invalid user mongodb from 119.28.68.135
Aug 21 23:19:19 h2427292 sshd\[12064\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.28.68.135 
Aug 21 23:19:21 h2427292 sshd\[12064\]: Failed password for invalid user mongodb from 119.28.68.135 port 36814 ssh2
...