[01/May/2020:01:02:01 -0400] "GET / HTTP/1.1" Chrome 52.0 UA

May  2 20:09:02 mail sshd[26569]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.60.213 
May  2 20:09:04 mail sshd[26569]: Failed password for invalid user louis from 111.231.60.213 port 49028 ssh2
...

May  2 21:36:50 localhost sshd\[392\]: Invalid user arul from 203.57.71.114
May  2 21:36:50 localhost sshd\[392\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.57.71.114
May  2 21:36:52 localhost sshd\[392\]: Failed password for invalid user arul from 203.57.71.114 port 59132 ssh2
May  2 21:40:29 localhost sshd\[726\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.57.71.114  user=root
May  2 21:40:30 localhost sshd\[726\]: Failed password for root from 203.57.71.114 port 47594 ssh2
...

(imapd) Failed IMAP login from 219.93.121.22 (MY/Malaysia/san-121-22.tm.net.my): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: May  2 21:41:17 ir1 dovecot[264309]: imap-login: Disconnected (auth failed, 1 attempts in 12 secs): user=, method=PLAIN, rip=219.93.121.22, lip=5.63.12.44, session=

Honeypot attack, port: 445, PTR: PTR record not found

May  2 20:48:21 tuxlinux sshd[18090]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=140.143.224.23  user=root
May  2 20:48:23 tuxlinux sshd[18090]: Failed password for root from 140.143.224.23 port 56544 ssh2
May  2 20:48:21 tuxlinux sshd[18090]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=140.143.224.23  user=root
May  2 20:48:23 tuxlinux sshd[18090]: Failed password for root from 140.143.224.23 port 56544 ssh2
May  2 21:04:45 tuxlinux sshd[18441]: Invalid user tmu from 140.143.224.23 port 47774
...

Brute force attempt

May  2 15:50:23 h1946882 sshd[19541]: pam_unix(sshd:auth): authenticati=
on failure; logname=3D uid=3D0 euid=3D0 tty=3Dssh ruser=3D rhost=3D134.=
209.152.114=20
May  2 15:50:25 h1946882 sshd[19541]: Failed password for invalid user =
praktikant from 134.209.152.114 port 58696 ssh2
May  2 15:50:25 h1946882 sshd[19541]: Received disconnect from 134.209.=
152.114: 11: Bye Bye [preauth]
May  2 15:55:02 h1946882 sshd[19564]: pam_unix(sshd:auth): authenticati=
on failure; logname=3D uid=3D0 euid=3D0 tty=3Dssh ruser=3D rhost=3D134.=
209.152.114=20


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=134.209.152.114

failed_logins

2020-05-02 21:44:31 dovecot_login authenticator failed for \(\[185.50.149.11\]\) \[185.50.149.11\]: 535 Incorrect authentication data \(set_id=postmaster@nophost.com\)
2020-05-02 21:44:40 dovecot_login authenticator failed for \(\[185.50.149.11\]\) \[185.50.149.11\]: 535 Incorrect authentication data
2020-05-02 21:44:50 dovecot_login authenticator failed for \(\[185.50.149.11\]\) \[185.50.149.11\]: 535 Incorrect authentication data
2020-05-02 21:44:56 dovecot_login authenticator failed for \(\[185.50.149.11\]\) \[185.50.149.11\]: 535 Incorrect authentication data
2020-05-02 21:45:08 dovecot_login authenticator failed for \(\[185.50.149.11\]\) \[185.50.149.11\]: 535 Incorrect authentication data

May  2 11:41:57 r.ca sshd[21410]: Failed password for invalid user gian from 210.203.22.138 port 54700 ssh2

May  2 21:31:51 ns381471 sshd[26912]: Failed password for root from 123.206.174.21 port 35915 ssh2

firewall-block, port(s): 27323/tcp

Invalid user aziz from 123.31.45.35 port 53958

Suspicious access to SMTP/POP/IMAP services.