Jan 28 22:52:58 pi sshd[30640]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=145.239.82.11 
Jan 28 22:53:00 pi sshd[30640]: Failed password for invalid user umaprasad from 145.239.82.11 port 35088 ssh2

web-1 [ssh] SSH Attack

Mar 13 17:23:05 v22019038103785759 sshd\[31781\]: Invalid user ts3server from 111.231.113.109 port 48182
Mar 13 17:23:05 v22019038103785759 sshd\[31781\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.113.109
Mar 13 17:23:07 v22019038103785759 sshd\[31781\]: Failed password for invalid user ts3server from 111.231.113.109 port 48182 ssh2
Mar 13 17:29:55 v22019038103785759 sshd\[32139\]: Invalid user ftp_test from 111.231.113.109 port 51462
Mar 13 17:29:55 v22019038103785759 sshd\[32139\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.113.109
...

Honeypot attack, port: 445, PTR: pool-77-222-117-53.is74.ru.

Honeypot attack, port: 445, PTR: PTR record not found

Mar 13 15:10:27 serwer sshd\[14162\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.124.253.203  user=root
Mar 13 15:10:28 serwer sshd\[14162\]: Failed password for root from 125.124.253.203 port 36928 ssh2
Mar 13 15:13:43 serwer sshd\[14757\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.124.253.203  user=root
...

Mar 13 09:46:06 firewall sshd[9715]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=140.246.225.169
Mar 13 09:46:06 firewall sshd[9715]: Invalid user tsadmin from 140.246.225.169
Mar 13 09:46:09 firewall sshd[9715]: Failed password for invalid user tsadmin from 140.246.225.169 port 36204 ssh2
...

Mar 13 18:05:09 haigwepa sshd[24767]: Failed password for root from 140.143.200.251 port 59376 ssh2
...

*Port Scan* detected from 144.34.248.219 (US/United States/144.34.248.219.16clouds.com). 4 hits in the last 165 seconds

IP Ban Report :  
 https://help-dysk.pl/wordpress-firewall-plugins/ip/85.18.106.213/ 
 
 IT - 1H : (54)  
 Protection Against DDoS WordPress plugin :  
 "odzyskiwanie danych help-dysk" 
 IP Address Ranges by Country : IT 
 NAME ASN : ASN12874 
 
 IP : 85.18.106.213 
 
 CIDR : 85.18.0.0/17 
 
 PREFIX COUNT : 94 
 
 UNIQUE IP COUNT : 3612160 
 
 
 ATTACKS DETECTED ASN12874 :  
  1H - 2 
  3H - 14 
  6H - 14 
 12H - 14 
 24H - 14 
 
 DateTime : 2020-03-13 13:46:10 
 
 INFO :  HACK ! - Looking for resource vulnerabilities Scan Detected and Blocked by ADMIN  - data recovery

Jan 17 20:30:14 pi sshd[14305]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=147.102.101.238 
Jan 17 20:30:16 pi sshd[14305]: Failed password for invalid user sharp from 147.102.101.238 port 59020 ssh2

(imapd) Failed IMAP login from 185.221.253.95 (AL/Albania/ptr.abcom.al): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Mar 13 16:16:20 ir1 dovecot[4133960]: imap-login: Disconnected (auth failed, 1 attempts in 4 secs): user=, method=PLAIN, rip=185.221.253.95, lip=5.63.12.44, TLS, session=

Jan 20 09:49:15 pi sshd[5037]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=144.91.106.159 
Jan 20 09:49:17 pi sshd[5037]: Failed password for invalid user brian from 144.91.106.159 port 53236 ssh2

[ssh] SSH attack

Unauthorized connection attempt from IP address 157.32.153.28 on Port 445(SMB)