Mar  7 04:33:34 Server1 sshd[30625]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.225.19.178  user=r.r
Mar  7 04:33:36 Server1 sshd[30625]: Failed password for r.r from 64.225.19.178 port 46536 ssh2
Mar  7 04:33:36 Server1 sshd[30625]: Received disconnect from 64.225.19.178 port 46536:11: Bye Bye [preauth]
Mar  7 04:33:36 Server1 sshd[30625]: Disconnected from authenticating user r.r 64.225.19.178 port 46536 [preauth]
Mar  7 04:48:42 Server1 sshd[30821]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.225.19.178  user=r.r


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=64.225.19.178

Mar  7 01:46:53 lnxweb62 sshd[7385]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.112.20.32
Mar  7 01:46:55 lnxweb62 sshd[7385]: Failed password for invalid user dorpsplatform-limbricht from 42.112.20.32 port 42710 ssh2
Mar  7 01:51:15 lnxweb62 sshd[9399]: Failed password for mysql from 42.112.20.32 port 40484 ssh2

SSH auth scanning - multiple failed logins

Mar  6 18:53:17 tdfoods sshd\[2161\]: Invalid user bot from 182.74.133.117
Mar  6 18:53:17 tdfoods sshd\[2161\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.74.133.117
Mar  6 18:53:19 tdfoods sshd\[2161\]: Failed password for invalid user bot from 182.74.133.117 port 54664 ssh2
Mar  6 18:58:48 tdfoods sshd\[2624\]: Invalid user hosting from 182.74.133.117
Mar  6 18:58:48 tdfoods sshd\[2624\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.74.133.117

" "

2020-03-06 H=\(RQE8lfM\) \[156.96.56.164\] F=\<**REMOVED****REMOVED****REMOVED**_perl@**REMOVED**.de\> rejected RCPT \: relay not permitted
2020-03-06 H=\(bWCNBks8lj\) \[156.96.56.164\] F=\<**REMOVED****REMOVED****REMOVED**_perl@**REMOVED**.de\> rejected RCPT \: relay not permitted
2020-03-06 H=\(YsDY3xaO\) \[156.96.56.164\] F=\<**REMOVED****REMOVED****REMOVED**_perl@**REMOVED**.de\> rejected RCPT \: relay not permitted

(sshd) Failed SSH login from 142.93.212.131 (IN/India/-): 2 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Mar  7 02:45:56 ubnt-55d23 sshd[24317]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.212.131  user=root
Mar  7 02:45:58 ubnt-55d23 sshd[24317]: Failed password for root from 142.93.212.131 port 39536 ssh2

Unauthorized connection attempt from IP address 36.68.52.233 on Port 445(SMB)

2020-03-06T23:55:54.063777shield sshd\[7420\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.131.224.81  user=root
2020-03-06T23:55:55.806357shield sshd\[7420\]: Failed password for root from 104.131.224.81 port 52285 ssh2
2020-03-07T00:00:26.874330shield sshd\[8252\]: Invalid user ts3server1 from 104.131.224.81 port 60605
2020-03-07T00:00:26.879527shield sshd\[8252\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.131.224.81
2020-03-07T00:00:28.961605shield sshd\[8252\]: Failed password for invalid user ts3server1 from 104.131.224.81 port 60605 ssh2

" "

Mar  7 05:49:45 dev0-dcde-rnet sshd[23060]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.67.69
Mar  7 05:49:47 dev0-dcde-rnet sshd[23060]: Failed password for invalid user 123QWEASD789 from 51.75.67.69 port 60036 ssh2
Mar  7 05:58:56 dev0-dcde-rnet sshd[23082]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.67.69

CMS (WordPress or Joomla) login attempt.

Unauthorized connection attempt from IP address 113.160.182.5 on Port 445(SMB)

Mar  6 23:53:33 *** sshd[30087]: User root from 40.73.78.233 not allowed because not listed in AllowUsers

$f2bV_matches