Nov 23 07:31:36 smtp postfix/smtpd[11844]: NOQUEUE: reject: RCPT from camp.yarkaci.com[188.213.212.56]: 554 5.7.1 Service unavailable; Client host [188.213.212.56] blocked using zen.spamhaus.org; https://www.spamhaus.org/sbl/query/SBLCSS; from= to= proto=ESMTP helo=
...

Nov 23 09:29:08 server sshd\[11613\]: Invalid user yongjiang from 104.248.121.67
Nov 23 09:29:08 server sshd\[11613\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.121.67 
Nov 23 09:29:10 server sshd\[11613\]: Failed password for invalid user yongjiang from 104.248.121.67 port 45170 ssh2
Nov 23 09:51:03 server sshd\[17268\]: Invalid user mayte from 104.248.121.67
Nov 23 09:51:03 server sshd\[17268\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.121.67 
...

2019-11-23T07:35:08.640288shield sshd\[16517\]: Invalid user aneisa from 114.67.70.94 port 46644
2019-11-23T07:35:08.644595shield sshd\[16517\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.67.70.94
2019-11-23T07:35:10.475159shield sshd\[16517\]: Failed password for invalid user aneisa from 114.67.70.94 port 46644 ssh2
2019-11-23T07:40:26.023826shield sshd\[17887\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.67.70.94  user=root
2019-11-23T07:40:28.040023shield sshd\[17887\]: Failed password for root from 114.67.70.94 port 52032 ssh2

Automatic report - Port Scan Attack

Nov 19 14:15:41 w sshd[17642]: reveeclipse mapping checking getaddrinfo for dsl-189-181-208-123-dyn.prod-infinhostnameum.com.mx [189.181.208.123] failed - POSSIBLE BREAK-IN ATTEMPT!
Nov 19 14:15:41 w sshd[17642]: Invalid user focus from 189.181.208.123
Nov 19 14:15:41 w sshd[17642]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.181.208.123 
Nov 19 14:15:44 w sshd[17642]: Failed password for invalid user focus from 189.181.208.123 port 9492 ssh2
Nov 19 14:15:44 w sshd[17642]: Received disconnect from 189.181.208.123: 11: Bye Bye [preauth]
Nov 19 14:31:26 w sshd[17720]: reveeclipse mapping checking getaddrinfo for dsl-189-181-208-123-dyn.prod-infinhostnameum.com.mx [189.181.208.123] failed - POSSIBLE BREAK-IN ATTEMPT!
Nov 19 14:31:26 w sshd[17720]: Invalid user kuboi from 189.181.208.123
Nov 19 14:31:26 w sshd[17720]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.181.208.123 
Nov 1........
-------------------------------

Nov 23 07:27:41 h2177944 kernel: \[7365834.915717\] \[UFW BLOCK\] IN=venet0 OUT= MAC= SRC=94.216.111.186 DST=85.214.117.9 LEN=52 TOS=0x00 PREC=0x00 TTL=118 ID=16525 DF PROTO=TCP SPT=57989 DPT=10537 WINDOW=8192 RES=0x00 SYN URGP=0 
Nov 23 07:27:41 h2177944 kernel: \[7365834.927034\] \[UFW BLOCK\] IN=venet0 OUT= MAC= SRC=94.216.111.186 DST=85.214.117.9 LEN=52 TOS=0x00 PREC=0x00 TTL=118 ID=16550 DF PROTO=TCP SPT=58006 DPT=12747 WINDOW=8192 RES=0x00 SYN URGP=0 
Nov 23 07:27:41 h2177944 kernel: \[7365834.943150\] \[UFW BLOCK\] IN=venet0 OUT= MAC= SRC=94.216.111.186 DST=85.214.117.9 LEN=52 TOS=0x00 PREC=0x00 TTL=118 ID=16567 DF PROTO=TCP SPT=58022 DPT=1 WINDOW=8192 RES=0x00 SYN URGP=0 
Nov 23 07:27:44 h2177944 kernel: \[7365837.911460\] \[UFW BLOCK\] IN=venet0 OUT= MAC= SRC=94.216.111.186 DST=85.214.117.9 LEN=52 TOS=0x00 PREC=0x00 TTL=118 ID=17349 DF PROTO=TCP SPT=57989 DPT=10537 WINDOW=8192 RES=0x00 SYN URGP=0 
Nov 23 07:27:44 h2177944 kernel: \[7365837.931175\] \[UFW BLOCK\] IN=venet0 OUT= MAC= SRC=94.216.111.186

Nov 23 10:03:19 sauna sshd[184689]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.211.24.187
Nov 23 10:03:21 sauna sshd[184689]: Failed password for invalid user user from 129.211.24.187 port 41176 ssh2
...

Nov 23 09:34:00 mail postfix/smtpd[14161]: warning: unknown[78.128.113.123]: SASL PLAIN authentication failed: 
Nov 23 09:34:07 mail postfix/smtpd[14161]: warning: unknown[78.128.113.123]: SASL PLAIN authentication failed: 
Nov 23 09:34:10 mail postfix/smtpd[15126]: warning: unknown[78.128.113.123]: SASL PLAIN authentication failed:

Nov 23 08:28:23 * sshd[26715]: Failed password for root from 49.88.112.115 port 55839 ssh2

Nov 23 09:21:38 sd-53420 sshd\[15782\]: User root from 139.199.45.83 not allowed because none of user's groups are listed in AllowGroups
Nov 23 09:21:38 sd-53420 sshd\[15782\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.199.45.83  user=root
Nov 23 09:21:40 sd-53420 sshd\[15782\]: Failed password for invalid user root from 139.199.45.83 port 53934 ssh2
Nov 23 09:25:47 sd-53420 sshd\[16832\]: Invalid user home from 139.199.45.83
Nov 23 09:25:47 sd-53420 sshd\[16832\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.199.45.83
...

Brute force attempt

Nov 23 08:50:47 SilenceServices sshd[24272]: Failed password for root from 46.105.110.79 port 57878 ssh2
Nov 23 08:54:08 SilenceServices sshd[25209]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.105.110.79
Nov 23 08:54:10 SilenceServices sshd[25209]: Failed password for invalid user jenchen from 46.105.110.79 port 36954 ssh2

Nov 23 08:57:29 localhost sshd\[1124\]: Invalid user idc!\#%\&\( from 210.126.1.36 port 45736
Nov 23 08:57:29 localhost sshd\[1124\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.126.1.36
Nov 23 08:57:31 localhost sshd\[1124\]: Failed password for invalid user idc!\#%\&\( from 210.126.1.36 port 45736 ssh2

Nov 23 08:50:16 lnxweb61 sshd[24235]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.166.159.56

Automatic report - Port Scan Attack