Dec  5 05:31:42 firewall sshd[10497]: Failed password for root from 222.186.180.223 port 2630 ssh2
Dec  5 05:31:56 firewall sshd[10497]: error: maximum authentication attempts exceeded for root from 222.186.180.223 port 2630 ssh2 [preauth]
Dec  5 05:31:56 firewall sshd[10497]: Disconnecting: Too many authentication failures [preauth]
...

Dec  4 21:51:38 eddieflores sshd\[24794\]: Invalid user lashonda from 201.38.172.76
Dec  4 21:51:38 eddieflores sshd\[24794\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=cs-201-38-172-76.embratelcloud.com.br
Dec  4 21:51:40 eddieflores sshd\[24794\]: Failed password for invalid user lashonda from 201.38.172.76 port 44732 ssh2
Dec  4 21:59:45 eddieflores sshd\[25510\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=cs-201-38-172-76.embratelcloud.com.br  user=root
Dec  4 21:59:47 eddieflores sshd\[25510\]: Failed password for root from 201.38.172.76 port 46530 ssh2

2019-12-05T08:06:39.527556abusebot-7.cloudsearch.cf sshd\[21846\]: Invalid user bbbbbb from 173.241.21.82 port 45962

Dec  5 07:30:04 lnxweb61 sshd[31820]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.172.172.118

SSH Brute Force

2019-12-05T08:08:42.724027abusebot-3.cloudsearch.cf sshd\[21787\]: Invalid user schumm from 106.13.22.60 port 59690

Dec  5 09:05:29 sso sshd[5556]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.90.43.106
Dec  5 09:05:32 sso sshd[5556]: Failed password for invalid user sansano from 119.90.43.106 port 2744 ssh2
...

Dec  5 08:33:57 sso sshd[1473]: Failed password for root from 51.38.176.147 port 58361 ssh2
...

web-1 [ssh] SSH Attack

Dec  5 07:30:05 relay postfix/smtpd\[11776\]: NOQUEUE: reject: RCPT from unknown\[181.41.216.137\]: 554 5.7.1 \: Relay access denied\; from=\<4b5ovw2yb9vdqavp@elektro72.ru\> to=\ proto=ESMTP helo=\<\[181.41.216.131\]\>
Dec  5 07:30:05 relay postfix/smtpd\[11776\]: NOQUEUE: reject: RCPT from unknown\[181.41.216.137\]: 554 5.7.1 \: Relay access denied\; from=\<4b5ovw2yb9vdqavp@elektro72.ru\> to=\ proto=ESMTP helo=\<\[181.41.216.131\]\>
Dec  5 07:30:05 relay postfix/smtpd\[11776\]: NOQUEUE: reject: RCPT from unknown\[181.41.216.137\]: 554 5.7.1 \: Relay access denied\; from=\<4b5ovw2yb9vdqavp@elektro72.ru\> to=\ proto=ESMTP helo=\<\[181.41.216.131\]\>
Dec  5 07:30:05 relay postfix/smtpd\[11776\]: NOQUEUE: reject: RCPT from unknown\[181.41.216.137\]: 554 5.7.1 \: Relay access denied\; fro
...

Dec  5 10:42:53 microserver sshd[36799]: Invalid user kodituwakku from 118.25.25.207 port 33544
Dec  5 10:42:53 microserver sshd[36799]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.25.25.207
Dec  5 10:42:54 microserver sshd[36799]: Failed password for invalid user kodituwakku from 118.25.25.207 port 33544 ssh2
Dec  5 10:51:44 microserver sshd[38236]: Invalid user 2 from 118.25.25.207 port 41414
Dec  5 10:51:44 microserver sshd[38236]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.25.25.207
Dec  5 11:13:13 microserver sshd[42189]: Invalid user tiny from 118.25.25.207 port 36490
Dec  5 11:13:13 microserver sshd[42189]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.25.25.207
Dec  5 11:13:15 microserver sshd[42189]: Failed password for invalid user tiny from 118.25.25.207 port 36490 ssh2
Dec  5 11:19:54 microserver sshd[43183]: pam_unix(sshd:auth): authentication failure; log

Automatic report - XMLRPC Attack

Dec  5 08:10:27 mail sshd[19293]: Failed password for daemon from 172.81.253.233 port 50222 ssh2
Dec  5 08:18:49 mail sshd[21283]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=172.81.253.233 
Dec  5 08:18:51 mail sshd[21283]: Failed password for invalid user nave from 172.81.253.233 port 55542 ssh2

firewall-block, port(s): 1049/tcp

SSH-bruteforce attempts