Aug  9 19:55:55 serwer sshd\[24007\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.67.197.65  user=root
Aug  9 19:55:57 serwer sshd\[24007\]: Failed password for root from 111.67.197.65 port 36830 ssh2
Aug  9 19:59:07 serwer sshd\[24248\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.67.197.65  user=root
...

2020-07-24T21:54:06.627303linuxbox-skyline sshd[12995]: Invalid user wtq from 111.67.197.65 port 38080
...

Invalid user baumann from 111.67.197.65 port 50604

Brute-force attempt banned

2020-06-03T12:22:02.956651shield sshd\[5769\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.67.197.173  user=root
2020-06-03T12:22:04.501927shield sshd\[5769\]: Failed password for root from 111.67.197.173 port 33424 ssh2
2020-06-03T12:23:16.018120shield sshd\[6001\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.67.197.173  user=root
2020-06-03T12:23:17.720204shield sshd\[6001\]: Failed password for root from 111.67.197.173 port 45988 ssh2
2020-06-03T12:24:32.373439shield sshd\[6149\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.67.197.173  user=root

(sshd) Failed SSH login from 111.67.197.173 (CN/China/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: May 26 07:58:32 srv sshd[12788]: Invalid user whobraun from 111.67.197.173 port 45436
May 26 07:58:34 srv sshd[12788]: Failed password for invalid user whobraun from 111.67.197.173 port 45436 ssh2
May 26 08:03:38 srv sshd[12974]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.67.197.173  user=root
May 26 08:03:40 srv sshd[12974]: Failed password for root from 111.67.197.173 port 33226 ssh2
May 26 08:06:15 srv sshd[13086]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.67.197.173  user=root

May  9 00:29:05 ns382633 sshd\[30109\]: Invalid user oracle from 111.67.197.82 port 46606
May  9 00:29:05 ns382633 sshd\[30109\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.67.197.82
May  9 00:29:07 ns382633 sshd\[30109\]: Failed password for invalid user oracle from 111.67.197.82 port 46606 ssh2
May  9 00:59:29 ns382633 sshd\[3042\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.67.197.82  user=root
May  9 00:59:32 ns382633 sshd\[3042\]: Failed password for root from 111.67.197.82 port 41868 ssh2

2020-05-02T05:33:02.741220linuxbox-skyline sshd[115441]: Invalid user jorge from 111.67.197.82 port 36288
...

Apr 11 21:30:36 vps sshd[5140]: Failed password for root from 111.67.197.183 port 53412 ssh2
Apr 11 21:44:02 vps sshd[5821]: Failed password for root from 111.67.197.183 port 33530 ssh2
...

Apr 10 04:33:27 localhost sshd[83007]: Invalid user ubuntu from 111.67.197.16 port 41380
Apr 10 04:33:27 localhost sshd[83007]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.67.197.16
Apr 10 04:33:27 localhost sshd[83007]: Invalid user ubuntu from 111.67.197.16 port 41380
Apr 10 04:33:29 localhost sshd[83007]: Failed password for invalid user ubuntu from 111.67.197.16 port 41380 ssh2
Apr 10 04:37:38 localhost sshd[83472]: Invalid user vbox from 111.67.197.16 port 54290
...

Apr  8 15:38:09 localhost sshd\[25661\]: Invalid user test from 111.67.197.16
Apr  8 15:38:09 localhost sshd\[25661\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.67.197.16
Apr  8 15:38:11 localhost sshd\[25661\]: Failed password for invalid user test from 111.67.197.16 port 49428 ssh2
Apr  8 15:42:04 localhost sshd\[25944\]: Invalid user ts2 from 111.67.197.16
Apr  8 15:42:04 localhost sshd\[25944\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.67.197.16
...

Mar 25 22:22:52 santamaria sshd\[24441\]: Invalid user user02 from 111.67.197.188
Mar 25 22:22:52 santamaria sshd\[24441\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.67.197.188
Mar 25 22:22:54 santamaria sshd\[24441\]: Failed password for invalid user user02 from 111.67.197.188 port 52894 ssh2
...

Dec  8 10:04:13 woltan sshd[20407]: Failed password for invalid user barolet from 111.67.197.14 port 54670 ssh2

Feb 20 19:19:45 kapalua sshd\[31706\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.67.197.155  user=root
Feb 20 19:19:48 kapalua sshd\[31706\]: Failed password for root from 111.67.197.155 port 60738 ssh2
Feb 20 19:23:17 kapalua sshd\[31982\]: Invalid user test from 111.67.197.155
Feb 20 19:23:17 kapalua sshd\[31982\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.67.197.155
Feb 20 19:23:19 kapalua sshd\[31982\]: Failed password for invalid user test from 111.67.197.155 port 50202 ssh2

2020-02-18T07:25:13.8894621495-001 sshd[5738]: Invalid user tomcat7 from 111.67.197.155 port 41896
2020-02-18T07:25:13.8925771495-001 sshd[5738]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.67.197.155
2020-02-18T07:25:13.8894621495-001 sshd[5738]: Invalid user tomcat7 from 111.67.197.155 port 41896
2020-02-18T07:25:15.8486491495-001 sshd[5738]: Failed password for invalid user tomcat7 from 111.67.197.155 port 41896 ssh2
2020-02-18T07:41:30.8147951495-001 sshd[6659]: Invalid user oracle from 111.67.197.155 port 57182
2020-02-18T07:41:30.8185451495-001 sshd[6659]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.67.197.155
2020-02-18T07:41:30.8147951495-001 sshd[6659]: Invalid user oracle from 111.67.197.155 port 57182
2020-02-18T07:41:31.8967261495-001 sshd[6659]: Failed password for invalid user oracle from 111.67.197.155 port 57182 ssh2
2020-02-18T07:44:51.5203941495-001 sshd[6850........
------------------------------

Jun 21 08:53:13 ns382633 sshd\[28026\]: Invalid user administrator from 88.98.254.133 port 50958
Jun 21 08:53:13 ns382633 sshd\[28026\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=88.98.254.133
Jun 21 08:53:16 ns382633 sshd\[28026\]: Failed password for invalid user administrator from 88.98.254.133 port 50958 ssh2
Jun 21 08:57:01 ns382633 sshd\[28825\]: Invalid user admin from 88.98.254.133 port 57676
Jun 21 08:57:01 ns382633 sshd\[28825\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=88.98.254.133

Jun 21 09:14:11 v22019038103785759 sshd\[15049\]: Invalid user yiyuan from 37.152.177.25 port 47988
Jun 21 09:14:11 v22019038103785759 sshd\[15049\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.152.177.25
Jun 21 09:14:13 v22019038103785759 sshd\[15049\]: Failed password for invalid user yiyuan from 37.152.177.25 port 47988 ssh2
Jun 21 09:23:18 v22019038103785759 sshd\[15530\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.152.177.25  user=root
Jun 21 09:23:20 v22019038103785759 sshd\[15530\]: Failed password for root from 37.152.177.25 port 60786 ssh2
...

Attacks websites by trying to access known vulnerables of plugins, brute-force of backends or probing of administrative tools

Jun 21 06:42:54 srv-ubuntu-dev3 sshd[45567]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=35.199.73.100  user=root
Jun 21 06:42:57 srv-ubuntu-dev3 sshd[45567]: Failed password for root from 35.199.73.100 port 38672 ssh2
Jun 21 06:46:40 srv-ubuntu-dev3 sshd[46284]: Invalid user ginger from 35.199.73.100
Jun 21 06:46:40 srv-ubuntu-dev3 sshd[46284]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=35.199.73.100
Jun 21 06:46:40 srv-ubuntu-dev3 sshd[46284]: Invalid user ginger from 35.199.73.100
Jun 21 06:46:42 srv-ubuntu-dev3 sshd[46284]: Failed password for invalid user ginger from 35.199.73.100 port 38664 ssh2
Jun 21 06:50:35 srv-ubuntu-dev3 sshd[46936]: Invalid user original from 35.199.73.100
Jun 21 06:50:35 srv-ubuntu-dev3 sshd[46936]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=35.199.73.100
Jun 21 06:50:35 srv-ubuntu-dev3 sshd[46936]: Invalid user original fr
...

Port probing on unauthorized port 23

Jun 21 05:54:22 srv01 postfix/smtpd\[29056\]: warning: unknown\[111.72.196.22\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jun 21 05:54:33 srv01 postfix/smtpd\[29056\]: warning: unknown\[111.72.196.22\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jun 21 05:54:49 srv01 postfix/smtpd\[29056\]: warning: unknown\[111.72.196.22\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jun 21 05:55:07 srv01 postfix/smtpd\[29056\]: warning: unknown\[111.72.196.22\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jun 21 05:55:18 srv01 postfix/smtpd\[29056\]: warning: unknown\[111.72.196.22\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
...

Unauthorized connection attempt detected from IP address 192.35.168.215 to port 8913

2020-06-21 07:28:30 auth_plain authenticator failed for (User) [46.38.145.253]: 535 Incorrect authentication data (set_id=acessoainformacao@csmailer.org)
2020-06-21 07:29:14 auth_plain authenticator failed for (User) [46.38.145.253]: 535 Incorrect authentication data (set_id=casino@csmailer.org)
2020-06-21 07:30:02 auth_plain authenticator failed for (User) [46.38.145.253]: 535 Incorrect authentication data (set_id=multistore3@csmailer.org)
2020-06-21 07:30:48 auth_plain authenticator failed for (User) [46.38.145.253]: 535 Incorrect authentication data (set_id=xxgk@csmailer.org)
2020-06-21 07:31:37 auth_plain authenticator failed for (User) [46.38.145.253]: 535 Incorrect authentication data (set_id=personaltravelagents@csmailer.org)
...

(pop3d) Failed POP3 login from 18.188.82.51 (US/United States/ec2-18-188-82-51.us-east-2.compute.amazonaws.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Jun 21 08:24:32 ir1 dovecot[2885757]: pop3-login: Disconnected (auth failed, 1 attempts in 2 secs): user=, method=PLAIN, rip=18.188.82.51, lip=5.63.12.44, session=

Jun 21 08:59:24 ns381471 sshd[31522]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.4.108.78
Jun 21 08:59:25 ns381471 sshd[31522]: Failed password for invalid user john from 81.4.108.78 port 33924 ssh2

Jun 21 06:47:00 eventyay sshd[28551]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.140.6.20
Jun 21 06:47:03 eventyay sshd[28551]: Failed password for invalid user ole from 222.140.6.20 port 35158 ssh2
Jun 21 06:49:07 eventyay sshd[28668]: Failed password for root from 222.140.6.20 port 34134 ssh2
...

2020-06-21T06:57:05+0000 Failed SSH Authentication/Brute Force Attack. (Server 6)

Invalid user dados from 107.170.249.6 port 42305

Invalid user runner from 51.83.75.97 port 32868

Jun 21 07:41:08 odroid64 sshd\[31141\]: Invalid user cvs from 189.168.192.63
Jun 21 07:41:08 odroid64 sshd\[31141\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.168.192.63
...