Dec  3 07:50:58 marvibiene sshd[17261]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.175.183  user=root
Dec  3 07:51:00 marvibiene sshd[17261]: Failed password for root from 222.186.175.183 port 63534 ssh2
Dec  3 07:51:04 marvibiene sshd[17261]: Failed password for root from 222.186.175.183 port 63534 ssh2
Dec  3 07:50:58 marvibiene sshd[17261]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.175.183  user=root
Dec  3 07:51:00 marvibiene sshd[17261]: Failed password for root from 222.186.175.183 port 63534 ssh2
Dec  3 07:51:04 marvibiene sshd[17261]: Failed password for root from 222.186.175.183 port 63534 ssh2
...

Port 22 Scan, PTR: None

Lines containing failures of 106.54.204.251
Dec  1 19:43:41 metroid sshd[23524]: Invalid user spam from 106.54.204.251 port 33308
Dec  1 19:43:41 metroid sshd[23524]: Received disconnect from 106.54.204.251 port 33308:11: Bye Bye [preauth]
Dec  1 19:43:41 metroid sshd[23524]: Disconnected from invalid user spam 106.54.204.251 port 33308 [preauth]


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=106.54.204.251

Dec  2 21:47:25 hanapaa sshd\[15078\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.65.9.28  user=root
Dec  2 21:47:26 hanapaa sshd\[15078\]: Failed password for root from 159.65.9.28 port 60096 ssh2
Dec  2 21:54:36 hanapaa sshd\[15717\]: Invalid user jv from 159.65.9.28
Dec  2 21:54:36 hanapaa sshd\[15717\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.65.9.28
Dec  2 21:54:38 hanapaa sshd\[15717\]: Failed password for invalid user jv from 159.65.9.28 port 56746 ssh2

SSH bruteforce

Dec  2 21:55:30 sachi sshd\[21613\]: Invalid user nalini from 49.234.99.246
Dec  2 21:55:30 sachi sshd\[21613\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.234.99.246
Dec  2 21:55:32 sachi sshd\[21613\]: Failed password for invalid user nalini from 49.234.99.246 port 55222 ssh2
Dec  2 22:02:11 sachi sshd\[22279\]: Invalid user vc from 49.234.99.246
Dec  2 22:02:11 sachi sshd\[22279\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.234.99.246

(From bishopbethWeb@gmail.com) Hello there! 

Would you'd be interested in building a mobile app for your business? I'm a mobile app developer that can design and program on any platform (Android, iOs) for an affordable price. There are various types of apps that can help your business, whether in terms of marketing, business efficiency, or both. If you already have some ideas, I would love to hear about them to help you more on how we can make them all possible. 

I have many ideas of my own that I'd really like to share with you of things that have worked really well for my other clients. If you're interested in building an app, or getting more information about it, then I'd love to give you a free consultation. Kindly reply to let me know when you'd like to be contacted. I hope to speak with you soon!h 

Best regards,
Beth Bishop

port scan and connect, tcp 1433 (ms-sql-s)

12/03/2019-01:28:47.161677 190.217.106.74 Protocol: 6 ET SCAN Suspicious inbound to MSSQL port 1433

Port 22 Scan, PTR: 158.169.69.34.bc.googleusercontent.com.

Dec  3 07:16:40 localhost sshd\[77333\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.218.209.239  user=root
Dec  3 07:16:42 localhost sshd\[77333\]: Failed password for root from 58.218.209.239 port 47912 ssh2
Dec  3 07:23:25 localhost sshd\[77539\]: Invalid user ubuntu from 58.218.209.239 port 56454
Dec  3 07:23:25 localhost sshd\[77539\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.218.209.239
Dec  3 07:23:27 localhost sshd\[77539\]: Failed password for invalid user ubuntu from 58.218.209.239 port 56454 ssh2
...

<6 unauthorized SSH connections

Dec  3 09:32:46 server sshd\[3927\]: User root from 112.85.42.189 not allowed because listed in DenyUsers
Dec  3 09:32:47 server sshd\[3927\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.85.42.189  user=root
Dec  3 09:32:49 server sshd\[3927\]: Failed password for invalid user root from 112.85.42.189 port 57275 ssh2
Dec  3 09:32:52 server sshd\[3927\]: Failed password for invalid user root from 112.85.42.189 port 57275 ssh2
Dec  3 09:32:54 server sshd\[3927\]: Failed password for invalid user root from 112.85.42.189 port 57275 ssh2

Dec  3 08:30:19 localhost sshd\[4805\]: Invalid user admin5 from 144.217.84.164 port 53196
Dec  3 08:30:19 localhost sshd\[4805\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=144.217.84.164
Dec  3 08:30:21 localhost sshd\[4805\]: Failed password for invalid user admin5 from 144.217.84.164 port 53196 ssh2

pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.131  user=root
Failed password for root from 218.92.0.131 port 61622 ssh2
Failed password for root from 218.92.0.131 port 61622 ssh2
Failed password for root from 218.92.0.131 port 61622 ssh2
Failed password for root from 218.92.0.131 port 61622 ssh2