Nov 10 22:31:37 hpm sshd\[15350\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.246.5.115  user=root
Nov 10 22:31:39 hpm sshd\[15350\]: Failed password for root from 218.246.5.115 port 34184 ssh2
Nov 10 22:36:21 hpm sshd\[15720\]: Invalid user wwwrun from 218.246.5.115
Nov 10 22:36:21 hpm sshd\[15720\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.246.5.115
Nov 10 22:36:23 hpm sshd\[15720\]: Failed password for invalid user wwwrun from 218.246.5.115 port 43710 ssh2

Nov 10 22:23:26 auw2 sshd\[32382\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.220.135.10  user=mysql
Nov 10 22:23:27 auw2 sshd\[32382\]: Failed password for mysql from 177.220.135.10 port 62177 ssh2
Nov 10 22:28:18 auw2 sshd\[32741\]: Invalid user subramanian from 177.220.135.10
Nov 10 22:28:18 auw2 sshd\[32741\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.220.135.10
Nov 10 22:28:20 auw2 sshd\[32741\]: Failed password for invalid user subramanian from 177.220.135.10 port 45665 ssh2

SSH-bruteforce attempts

11/11/2019-03:45:56.245979 185.176.27.190 Protocol: 6 ET DROP Dshield Block Listed Source group 1

Invalid user barikian from 118.25.189.123 port 55092

Failed password for root from 222.186.190.17 port 14813 ssh2
pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.190.17  user=root
Failed password for root from 222.186.190.17 port 60990 ssh2
Failed password for root from 222.186.190.17 port 60990 ssh2
Failed password for root from 222.186.190.17 port 60990 ssh2

Nov 10 19:32:14 newdogma sshd[24950]: Invalid user grygiel from 40.73.59.46 port 49906
Nov 10 19:32:14 newdogma sshd[24950]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=40.73.59.46
Nov 10 19:32:16 newdogma sshd[24950]: Failed password for invalid user grygiel from 40.73.59.46 port 49906 ssh2
Nov 10 19:32:16 newdogma sshd[24950]: Received disconnect from 40.73.59.46 port 49906:11: Bye Bye [preauth]
Nov 10 19:32:16 newdogma sshd[24950]: Disconnected from 40.73.59.46 port 49906 [preauth]
Nov 10 19:50:52 newdogma sshd[25031]: Invalid user needles from 40.73.59.46 port 45584
Nov 10 19:50:52 newdogma sshd[25031]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=40.73.59.46
Nov 10 19:50:54 newdogma sshd[25031]: Failed password for invalid user needles from 40.73.59.46 port 45584 ssh2
Nov 10 19:50:54 newdogma sshd[25031]: Received disconnect from 40.73.59.46 port 45584:11: Bye Bye [preauth]
Nov 1........
-------------------------------

65.39.133.8 - - \[11/Nov/2019:09:24:11 +0100\] "POST /wp-login.php HTTP/1.0" 200 10546 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"
65.39.133.8 - - \[11/Nov/2019:09:24:13 +0100\] "POST /wp-login.php HTTP/1.0" 200 10371 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"
65.39.133.8 - - \[11/Nov/2019:09:24:16 +0100\] "POST /wp-login.php HTTP/1.0" 200 10366 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"

Nov 11 07:24:04 xeon sshd[13498]: Failed password for invalid user operator from 178.128.21.38 port 52684 ssh2

11/11/2019-08:15:02.536432 52.41.158.217 Protocol: 6 SURICATA TLS invalid record/traffic

Lines containing failures of 49.235.134.224
Nov 11 06:47:38 nxxxxxxx sshd[9136]: Invalid user lheureux from 49.235.134.224 port 59318
Nov 11 06:47:38 nxxxxxxx sshd[9136]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.235.134.224
Nov 11 06:47:40 nxxxxxxx sshd[9136]: Failed password for invalid user lheureux from 49.235.134.224 port 59318 ssh2
Nov 11 06:47:41 nxxxxxxx sshd[9136]: Received disconnect from 49.235.134.224 port 59318:11: Bye Bye [preauth]
Nov 11 06:47:41 nxxxxxxx sshd[9136]: Disconnected from invalid user lheureux 49.235.134.224 port 59318 [preauth]
Nov 11 06:51:47 nxxxxxxx sshd[9581]: Invalid user charlotte from 49.235.134.224 port 60026
Nov 11 06:51:47 nxxxxxxx sshd[9581]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.235.134.224


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=49.235.134.224

Nov 11 07:21:47 ms-srv sshd[31436]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.237.55
Nov 11 07:21:49 ms-srv sshd[31436]: Failed password for invalid user lofti from 134.209.237.55 port 33104 ssh2

Nov 11 09:45:14 nextcloud sshd\[31730\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.68.177.209  user=root
Nov 11 09:45:16 nextcloud sshd\[31730\]: Failed password for root from 180.68.177.209 port 42664 ssh2
Nov 11 09:51:49 nextcloud sshd\[8502\]: Invalid user sabatella from 180.68.177.209
Nov 11 09:51:49 nextcloud sshd\[8502\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.68.177.209
...

Nov 11 08:48:22 webserver postfix/smtpd\[374\]: NOQUEUE: reject: RCPT from unknown\[193.32.160.151\]: 454 4.7.1 \: Relay access denied\; from=\<4l9id4q4xob0@tatspirtprom.ru\> to=\ proto=ESMTP helo=\<\[193.32.160.151\]\>
Nov 11 08:48:22 webserver postfix/smtpd\[374\]: NOQUEUE: reject: RCPT from unknown\[193.32.160.151\]: 454 4.7.1 \: Relay access denied\; from=\<4l9id4q4xob0@tatspirtprom.ru\> to=\ proto=ESMTP helo=\<\[193.32.160.151\]\>
Nov 11 08:48:22 webserver postfix/smtpd\[374\]: NOQUEUE: reject: RCPT from unknown\[193.32.160.151\]: 454 4.7.1 \: Relay access denied\; from=\<4l9id4q4xob0@tatspirtprom.ru\> to=\ proto=ESMTP helo=\<\[193.32.160.151\]\>
Nov 11 08:48:22 webserver postfix/smtpd\[374\]: NOQUEUE: reject: RCPT from unknown\[193.32.160.151\]: 454 4.7.1 \: Relay access denied\; from=\<4l9id4q4xob0
...

Automatic report - Port Scan Attack