Sep  6 11:23:39 * sshd[20246]: Failed password for root from 112.85.42.74 port 22857 ssh2

Sep  6 12:30:06 vps639187 sshd\[8013\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.85.42.181  user=root
Sep  6 12:30:08 vps639187 sshd\[8013\]: Failed password for root from 112.85.42.181 port 21414 ssh2
Sep  6 12:30:12 vps639187 sshd\[8013\]: Failed password for root from 112.85.42.181 port 21414 ssh2
...

(From edingershock362@gmail.com) Hello!

I am a freelancer who's designed and improved hundreds of websites over the past decade. I'd like the opportunity to discuss with you how I can help you upgrade your site or build you a new one that will provide all the modern features that a website should have, as well as an effortlessly beautiful user-interface. This can all be done at a very affordable price.

I am an expert in WordPress and experienced in many other web platforms and shopping carts. If you're not familiar with it, then I'd like to show you how easy it is to develop your site on a platform that gives you an incredible number of features. In addition to the modern features that make the most business processes easier, I can also include some elements that your site needs to make it more user-friendly and profitable.

I would like to send you my portfolio of work from previous clients and include how the profitability of those businesses increased after the improvements that I made to their web

Honeypot attack, port: 445, PTR: PTR record not found

 TCP (SYN) 34.96.223.183:37172 -> port 23, len 44

18072/tcp 1124/tcp 26030/tcp...
[2020-07-06/09-05]195pkt,72pt.(tcp)

2020-09-05T20:06:59.844340correo.[domain] sshd[1849]: Failed password for root from 113.119.135.147 port 8500 ssh2 2020-09-05T20:09:52.035774correo.[domain] sshd[2141]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.119.135.147 user=root 2020-09-05T20:09:54.095736correo.[domain] sshd[2141]: Failed password for root from 113.119.135.147 port 8501 ssh2 ...

Wordpress_xmlrpc_attack

Lines containing failures of 94.237.76.134
Sep  4 14:13:31 dns01 sshd[7571]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.237.76.134  user=r.r
Sep  4 14:13:32 dns01 sshd[7571]: Failed password for r.r from 94.237.76.134 port 45324 ssh2
Sep  4 14:13:33 dns01 sshd[7571]: Received disconnect from 94.237.76.134 port 45324:11: Bye Bye [preauth]
Sep  4 14:13:33 dns01 sshd[7571]: Disconnected from authenticating user r.r 94.237.76.134 port 45324 [preauth]
Sep  4 14:33:00 dns01 sshd[11460]: Invalid user lina from 94.237.76.134 port 46330
Sep  4 14:33:00 dns01 sshd[11460]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.237.76.134
Sep  4 14:33:02 dns01 sshd[11460]: Failed password for invalid user lina from 94.237.76.134 port 46330 ssh2
Sep  4 14:33:03 dns01 sshd[11460]: Received disconnect from 94.237.76.134 port 46330:11: Bye Bye [preauth]
Sep  4 14:33:03 dns01 sshd[11460]: Disconnected fro........
------------------------------

reported through recidive - multiple failed attempts(SSH)

2020-09-06T10:26:14.199489centos sshd[23453]: Failed password for root from 222.124.17.227 port 57706 ssh2
2020-09-06T10:29:17.960713centos sshd[23622]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.124.17.227  user=root
2020-09-06T10:29:20.133481centos sshd[23622]: Failed password for root from 222.124.17.227 port 44162 ssh2
...

xmlrpc attack

Failed password for invalid user mysql from 121.165.66.226 port 56966 ssh2

2020-09-05 UTC: (4x) - guest(2x),root(2x)

Sep  6 10:14:33 root sshd[30217]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.125.70.22 
...