Mar  7 23:39:50 vps647732 sshd[25924]: Failed password for root from 61.177.172.128 port 35231 ssh2
Mar  7 23:40:03 vps647732 sshd[25924]: error: maximum authentication attempts exceeded for root from 61.177.172.128 port 35231 ssh2 [preauth]
...

firewall-block, port(s): 47808/tcp

Mar  8 03:49:12 gw1 sshd[6481]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.2.4.99
Mar  8 03:49:14 gw1 sshd[6481]: Failed password for invalid user centos from 106.2.4.99 port 37706 ssh2
...

Sat Mar  7 15:10:44 2020 - Child process 400129 handling connection
Sat Mar  7 15:10:44 2020 - New connection from: 183.80.230.208:54663
Sat Mar  7 15:10:44 2020 - Sending data to client: [Login: ]
Sat Mar  7 15:11:15 2020 - Child aborting
Sat Mar  7 15:11:15 2020 - Reporting IP address: 183.80.230.208 - mflag: 0

Mar  7 12:20:34 hpm sshd\[24814\]: Invalid user bs from 138.197.221.114
Mar  7 12:20:34 hpm sshd\[24814\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.221.114
Mar  7 12:20:35 hpm sshd\[24814\]: Failed password for invalid user bs from 138.197.221.114 port 59304 ssh2
Mar  7 12:25:59 hpm sshd\[25217\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.221.114  user=root
Mar  7 12:26:01 hpm sshd\[25217\]: Failed password for root from 138.197.221.114 port 49840 ssh2

Mar  7 23:57:17 sso sshd[1681]: Failed password for root from 112.85.42.180 port 63991 ssh2
Mar  7 23:57:28 sso sshd[1681]: Failed password for root from 112.85.42.180 port 63991 ssh2
...

firewall-block, port(s): 8081/udp

MultiHost/MultiPort Probe, Scan, Hack -

(imapd) Failed IMAP login from 91.183.149.230 (BE/Belgium/230.149-183-91.adsl-static.isp.belgacom.be): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Mar  8 01:39:31 ir1 dovecot[4133960]: imap-login: Disconnected (auth failed, 1 attempts in 4 secs): user=, method=PLAIN, rip=91.183.149.230, lip=5.63.12.44, TLS, session=

firewall-block, port(s): 97/tcp, 1080/tcp, 1453/tcp, 11520/tcp, 50550/tcp

2020-03-07T23:05:29.619191vps751288.ovh.net sshd\[20525\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.203  user=root
2020-03-07T23:05:32.078183vps751288.ovh.net sshd\[20525\]: Failed password for root from 218.92.0.203 port 42222 ssh2
2020-03-07T23:05:33.871847vps751288.ovh.net sshd\[20525\]: Failed password for root from 218.92.0.203 port 42222 ssh2
2020-03-07T23:05:35.610366vps751288.ovh.net sshd\[20525\]: Failed password for root from 218.92.0.203 port 42222 ssh2
2020-03-07T23:10:11.049879vps751288.ovh.net sshd\[20561\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.203  user=root

Lines containing failures of 119.235.30.89
Mar  3 07:02:39 keyhelp sshd[30950]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.235.30.89  user=r.r
Mar  3 07:02:41 keyhelp sshd[30950]: Failed password for r.r from 119.235.30.89 port 36448 ssh2
Mar  3 07:02:51 keyhelp sshd[30950]: Received disconnect from 119.235.30.89 port 36448:11: Normal Shutdown [preauth]
Mar  3 07:02:51 keyhelp sshd[30950]: Disconnected from authenticating user r.r 119.235.30.89 port 36448 [preauth]
Mar  3 07:10:21 keyhelp sshd[32596]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.235.30.89  user=mysql
Mar  3 07:10:23 keyhelp sshd[32596]: Failed password for mysql from 119.235.30.89 port 46650 ssh2
Mar  3 07:10:23 keyhelp sshd[32596]: Received disconnect from 119.235.30.89 port 46650:11: Normal Shutdown [preauth]
Mar  3 07:10:23 keyhelp sshd[32596]: Disconnected from authenticating user mysql 119.235.30.89 port ........
------------------------------

20 attempts against mh-ssh on cloud

Port probing on unauthorized port 445

172.223.195.154 - - [07/Mar/2020:23:09:58 +0100] "GET /awstats.pl?lang=en&output=main HTTP/1.0" 404 280 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36,gzip(gfe)"