Mar 24 06:15:14 dcd-gentoo sshd[9441]: User root from 218.92.0.199 not allowed because none of user's groups are listed in AllowGroups
Mar 24 06:15:20 dcd-gentoo sshd[9441]: error: PAM: Authentication failure for illegal user root from 218.92.0.199
Mar 24 06:15:14 dcd-gentoo sshd[9441]: User root from 218.92.0.199 not allowed because none of user's groups are listed in AllowGroups
Mar 24 06:15:20 dcd-gentoo sshd[9441]: error: PAM: Authentication failure for illegal user root from 218.92.0.199
Mar 24 06:15:14 dcd-gentoo sshd[9441]: User root from 218.92.0.199 not allowed because none of user's groups are listed in AllowGroups
Mar 24 06:15:20 dcd-gentoo sshd[9441]: error: PAM: Authentication failure for illegal user root from 218.92.0.199
Mar 24 06:15:20 dcd-gentoo sshd[9441]: Failed keyboard-interactive/pam for invalid user root from 218.92.0.199 port 38394 ssh2
...

Mar 24 05:23:27 haigwepa sshd[12578]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.29.177.149 
Mar 24 05:23:29 haigwepa sshd[12578]: Failed password for invalid user kq from 14.29.177.149 port 58459 ssh2
...

Mar 24 04:40:27 ns382633 sshd\[28549\]: Invalid user infowarelab from 122.51.137.21 port 5796
Mar 24 04:40:27 ns382633 sshd\[28549\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.137.21
Mar 24 04:40:29 ns382633 sshd\[28549\]: Failed password for invalid user infowarelab from 122.51.137.21 port 5796 ssh2
Mar 24 04:59:17 ns382633 sshd\[31522\]: Invalid user mongo from 122.51.137.21 port 15648
Mar 24 04:59:17 ns382633 sshd\[31522\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.137.21

[Tue Mar 24 10:59:03.629462 2020] [:error] [pid 1202:tid 139752733951744] [client 69.171.251.20:54088] [client 69.171.251.20] ModSecurity: Access denied with code 403 (phase 2). Match of "eq 0" against "&REQUEST_HEADERS:Transfer-Encoding" required. [file "/etc/modsecurity/owasp-modsecurity-crs-3.2.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "202"] [id "920171"] [msg "GET or HEAD Request with Transfer-Encoding."] [data "1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.2.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "karangploso.jatim.bmkg.go.id"] [uri "/TableFilter/system-v95.css"] [unique_id "XnmFh9rAlgUVOjKqiZRlsAAAAAE"]
...

Mar 24 04:58:08  exim[22236]: [1\31] 1jGaha-0005me-IQ H=(144.78.87.109.triolan.net) [109.87.78.144] F= rejected after DATA: This message scored 103.5 spam points.

I found the "200.220.202.13" which attacked to my server in my log.

Mar 23 23:58:40 Tower sshd[1443]: Connection from 182.61.136.53 port 44164 on 192.168.10.220 port 22 rdomain ""
Mar 23 23:58:43 Tower sshd[1443]: Invalid user xf from 182.61.136.53 port 44164
Mar 23 23:58:43 Tower sshd[1443]: error: Could not get shadow information for NOUSER
Mar 23 23:58:43 Tower sshd[1443]: Failed password for invalid user xf from 182.61.136.53 port 44164 ssh2
Mar 23 23:58:43 Tower sshd[1443]: Received disconnect from 182.61.136.53 port 44164:11: Bye Bye [preauth]
Mar 23 23:58:43 Tower sshd[1443]: Disconnected from invalid user xf 182.61.136.53 port 44164 [preauth]

1585022330 - 03/24/2020 04:58:50 Host: 61.223.136.207/61.223.136.207 Port: 445 TCP Blocked

$f2bV_matches

Mar 24 04:58:38 srv206 sshd[19480]: Invalid user kurokawa from 140.143.130.52
...

2020-03-24T04:59:31.831420shield sshd\[27958\]: Invalid user couch from 91.82.219.162 port 54624
2020-03-24T04:59:31.838860shield sshd\[27958\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.82.219.162
2020-03-24T04:59:34.115363shield sshd\[27958\]: Failed password for invalid user couch from 91.82.219.162 port 54624 ssh2
2020-03-24T05:05:06.464985shield sshd\[29426\]: Invalid user cosinus from 91.82.219.162 port 42128
2020-03-24T05:05:06.474942shield sshd\[29426\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.82.219.162

" "

SSH Brute-Force Attack

Mar 24 05:53:18 vpn01 sshd[19135]: Failed password for root from 185.220.100.240 port 7294 ssh2
Mar 24 05:53:29 vpn01 sshd[19135]: error: maximum authentication attempts exceeded for root from 185.220.100.240 port 7294 ssh2 [preauth]
...

Mar 24 04:49:18 h2646465 sshd[10768]: Invalid user gzx from 188.165.24.200
Mar 24 04:49:18 h2646465 sshd[10768]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.165.24.200
Mar 24 04:49:18 h2646465 sshd[10768]: Invalid user gzx from 188.165.24.200
Mar 24 04:49:19 h2646465 sshd[10768]: Failed password for invalid user gzx from 188.165.24.200 port 59552 ssh2
Mar 24 04:55:11 h2646465 sshd[12990]: Invalid user nagios from 188.165.24.200
Mar 24 04:55:11 h2646465 sshd[12990]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.165.24.200
Mar 24 04:55:11 h2646465 sshd[12990]: Invalid user nagios from 188.165.24.200
Mar 24 04:55:14 h2646465 sshd[12990]: Failed password for invalid user nagios from 188.165.24.200 port 60206 ssh2
Mar 24 04:58:39 h2646465 sshd[13764]: Invalid user iryl from 188.165.24.200
...