Oct 29 11:38:11 ms-srv sshd[27820]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=197.44.212.186
Oct 29 11:38:13 ms-srv sshd[27820]: Failed password for invalid user admin from 197.44.212.186 port 59698 ssh2

10/29/2019-10:08:22.246858 45.82.153.35 Protocol: 6 ET SCAN NMAP -sS window 1024

Oct 29 15:10:00 cp sshd[18033]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.89.169.109

Oct 29 10:57:55 firewall sshd[13184]: Invalid user render from 219.92.16.81
Oct 29 10:57:57 firewall sshd[13184]: Failed password for invalid user render from 219.92.16.81 port 52311 ssh2
Oct 29 11:03:08 firewall sshd[13299]: Invalid user teamspeak3 from 219.92.16.81
...

Automatic report - XMLRPC Attack

IP Ban Report :  
 https://help-dysk.pl/wordpress-firewall-plugins/ip/117.81.189.60/ 
 
 CN - 1H : (772)  
 Protection Against DDoS WordPress plugin :  
 "odzyskiwanie danych help-dysk" 
 IP Address Ranges by Country : CN 
 NAME ASN : ASN4134 
 
 IP : 117.81.189.60 
 
 CIDR : 117.81.128.0/18 
 
 PREFIX COUNT : 5430 
 
 UNIQUE IP COUNT : 106919680 
 
 
 ATTACKS DETECTED ASN4134 :  
  1H - 13 
  3H - 49 
  6H - 81 
 12H - 170 
 24H - 309 
 
 DateTime : 2019-10-29 12:38:25 
 
 INFO : Port Scan TELNET Detected and Blocked by ADMIN  - data recovery

Port Scan

These are people / users who try to send programs for data capture (spy), see examples below, there are no limits:

From helen2rc@gmail.com Mon Oct 28 10:01:58 2019
Received: from mail-vs1-f67.google.com ([209.85.217.67]:39248)
(envelope-from )
Sender: helen2rc@gmail.com
From: helen brown 
Message-ID: 
Subject: hello

2019-10-29T15:38:53.061806scmdmz1 sshd\[15165\]: Invalid user raleigh from 58.87.75.178 port 58430
2019-10-29T15:38:53.064331scmdmz1 sshd\[15165\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.87.75.178
2019-10-29T15:38:54.925397scmdmz1 sshd\[15165\]: Failed password for invalid user raleigh from 58.87.75.178 port 58430 ssh2
...

Oct 29 15:09:59 [host] sshd[11230]: Invalid user console from 121.204.164.111
Oct 29 15:09:59 [host] sshd[11230]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.204.164.111
Oct 29 15:10:02 [host] sshd[11230]: Failed password for invalid user console from 121.204.164.111 port 53560 ssh2

Oct 29 15:20:59 SilenceServices sshd[31028]: Failed password for root from 51.77.148.87 port 60504 ssh2
Oct 29 15:25:03 SilenceServices sshd[2889]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.77.148.87
Oct 29 15:25:05 SilenceServices sshd[2889]: Failed password for invalid user test from 51.77.148.87 port 43262 ssh2

Invalid user nagios from 222.128.11.26 port 49236

Oct 29 14:15:53 server sshd\[29180\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=v150-95-186-200.a0ed.g.tyo1.static.cnode.io  user=root
Oct 29 14:15:55 server sshd\[29180\]: Failed password for root from 150.95.186.200 port 55330 ssh2
Oct 29 14:37:57 server sshd\[1625\]: Invalid user test1 from 150.95.186.200
Oct 29 14:37:57 server sshd\[1625\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=v150-95-186-200.a0ed.g.tyo1.static.cnode.io 
Oct 29 14:37:59 server sshd\[1625\]: Failed password for invalid user test1 from 150.95.186.200 port 44838 ssh2
...

Oct 29 11:36:51   TCP Attack: SRC=2001:067c:1360:8001:0000:0000:0000:0017 DST=[Masked] LEN=1500 TC=0 HOPLIMIT=54 FLOWLBL=294938 PROTO=TCP SPT=80 DPT=53340 WINDOW=234 RES=0x00 ACK URGP=0

WordPress wp-login brute force :: 41.226.28.41 0.092 BYPASS [29/Oct/2019:13:25:06  0000] [censored_4] "POST /wp-login.php HTTP/1.1" 200 1525 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"