Sep  6 03:20:15 tux-35-217 sshd\[6268\]: Invalid user support from 165.22.78.120 port 40332
Sep  6 03:20:15 tux-35-217 sshd\[6268\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.78.120
Sep  6 03:20:17 tux-35-217 sshd\[6268\]: Failed password for invalid user support from 165.22.78.120 port 40332 ssh2
Sep  6 03:24:18 tux-35-217 sshd\[6292\]: Invalid user teste from 165.22.78.120 port 54504
Sep  6 03:24:18 tux-35-217 sshd\[6292\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.78.120
...

Unauthorised access (Sep  5) SRC=84.55.90.177 LEN=40 TTL=56 ID=1807 TCP DPT=23 WINDOW=32798 SYN

Unauthorized connection attempt from IP address 186.10.30.219 on Port 445(SMB)

kp-sea2-01 recorded 2 login violations from 199.229.221.132 and was blocked at 2019-09-05 23:54:25. 199.229.221.132 has been blocked on 0 previous occasions. 199.229.221.132's first attempt was recorded at 2019-09-05 23:54:25

Port Scan: TCP/445

Automatic report - Port Scan Attack

Sep  5 22:36:14 SilenceServices sshd[23983]: Failed password for www-data from 107.131.126.71 port 44602 ssh2
Sep  5 22:40:09 SilenceServices sshd[25549]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.131.126.71
Sep  5 22:40:12 SilenceServices sshd[25549]: Failed password for invalid user suporte from 107.131.126.71 port 60534 ssh2

Sep  6 05:02:55 yabzik sshd[10684]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.86.199
Sep  6 05:02:57 yabzik sshd[10684]: Failed password for invalid user test123 from 106.13.86.199 port 57340 ssh2
Sep  6 05:06:10 yabzik sshd[11766]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.86.199

\[2019-09-05 20:56:49\] NOTICE\[1829\] chan_sip.c: Registration from '"530" \' failed for '77.247.110.68:6050' - Wrong password
\[2019-09-05 20:56:49\] SECURITY\[1837\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-09-05T20:56:49.498-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="530",SessionID="0x7f7b30db7498",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/77.247.110.68/6050",Challenge="1fef44dd",ReceivedChallenge="1fef44dd",ReceivedHash="ba1cf55c82e220d6a2481114a33833cb"
\[2019-09-05 20:56:49\] NOTICE\[1829\] chan_sip.c: Registration from '"530" \' failed for '77.247.110.68:6050' - Wrong password
\[2019-09-05 20:56:49\] SECURITY\[1837\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-09-05T20:56:49.602-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="530",SessionID="0x7f7b302cefa8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/77.2

2019-09-05T21:02:35.171085centos sshd\[11603\]: Invalid user minecraft from 14.63.221.108 port 43791
2019-09-05T21:02:35.177953centos sshd\[11603\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.63.221.108
2019-09-05T21:02:37.504512centos sshd\[11603\]: Failed password for invalid user minecraft from 14.63.221.108 port 43791 ssh2

WordPress login Brute force / Web App Attack on client site.

Sep  5 23:27:41 hb sshd\[13129\]: Invalid user test2 from 58.150.46.6
Sep  5 23:27:41 hb sshd\[13129\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.150.46.6
Sep  5 23:27:44 hb sshd\[13129\]: Failed password for invalid user test2 from 58.150.46.6 port 42258 ssh2
Sep  5 23:32:12 hb sshd\[13484\]: Invalid user vbox123 from 58.150.46.6
Sep  5 23:32:12 hb sshd\[13484\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.150.46.6

2019-08-30T06:55:34.751507wiz-ks3 sshd[17353]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.141  user=root
2019-08-30T06:55:36.278947wiz-ks3 sshd[17353]: Failed password for root from 218.92.0.141 port 16017 ssh2
...

port scan and connect, tcp 8080 (http-proxy)

2019-09-04 17:57:41,673 fail2ban.actions        [8379]: NOTICE  [postfix] Ban 139.162.99.243
...