Mar  8 06:53:14 srv01 sshd[21918]: Invalid user com from 41.222.249.236 port 33349
Mar  8 06:53:14 srv01 sshd[21918]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=41.222.249.236
Mar  8 06:53:14 srv01 sshd[21918]: Invalid user com from 41.222.249.236 port 33349
Mar  8 06:53:16 srv01 sshd[21918]: Failed password for invalid user com from 41.222.249.236 port 33349 ssh2
Mar  8 06:59:26 srv01 sshd[22299]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=41.222.249.236  user=root
Mar  8 06:59:28 srv01 sshd[22299]: Failed password for root from 41.222.249.236 port 45611 ssh2
...

Mar  8 05:57:48 * sshd[11049]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=77.202.192.113

Mar  8 08:39:49 server sshd\[25182\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=161-115-132-5.ftth.glasoperator.nl  user=root
Mar  8 08:39:50 server sshd\[25182\]: Failed password for root from 5.132.115.161 port 37242 ssh2
Mar  8 08:45:20 server sshd\[26574\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=161-115-132-5.ftth.glasoperator.nl  user=root
Mar  8 08:45:23 server sshd\[26574\]: Failed password for root from 5.132.115.161 port 53668 ssh2
Mar  8 08:47:38 server sshd\[26795\]: Invalid user ramon from 5.132.115.161
Mar  8 08:47:38 server sshd\[26795\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=161-115-132-5.ftth.glasoperator.nl 
...

Mar  8 06:37:43 lnxweb61 sshd[16229]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=145.239.198.218
Mar  8 06:37:45 lnxweb61 sshd[16229]: Failed password for invalid user zhoumin from 145.239.198.218 port 51706 ssh2
Mar  8 06:44:33 lnxweb61 sshd[22164]: Failed password for root from 145.239.198.218 port 36292 ssh2

Mar  6 19:36:36 euve59663 sshd[7673]: reveeclipse mapping checking getaddri=
nfo for 66.42.43.150.vultr.com [66.42.43.150] failed - POSSIBLE BREAK-I=
N ATTEMPT!
Mar  6 19:36:36 euve59663 sshd[7673]: pam_unix(sshd:auth): authenticati=
on failure; logname=3D uid=3D0 euid=3D0 tty=3Dssh ruser=3D rhost=3D66.4=
2.43.150  user=3Dr.r
Mar  6 19:36:38 euve59663 sshd[7673]: Failed password for r.r from 66.=
42.43.150 port 33894 ssh2
Mar  6 19:36:39 euve59663 sshd[7673]: Received disconnect from 66.42.43=
.150: 11: Bye Bye [preauth]
Mar  6 19:44:52 euve59663 sshd[7730]: reveeclipse mapping checking getaddri=
nfo for 66.42.43.150.vultr.com [66.42.43.150] failed - POSSIBLE BREAK-I=
N ATTEMPT!
Mar  6 19:44:52 euve59663 sshd[7730]: Invalid user sarvub from 66.42.43=
.150
Mar  6 19:44:52 euve59663 sshd[7730]: pam_unix(sshd:auth): authenticati=
on failure; logname=3D uid=3D0 euid=3D0 tty=3Dssh ruser=3D rhost=3D66.4=
2.43.150=20
Mar  6 19:44:53 euve59663 sshd[7730]: Failed password for in........
-------------------------------

Mar  8 07:11:43 grey postfix/smtpd\[21418\]: NOQUEUE: reject: RCPT from unknown\[45.117.77.28\]: 554 5.7.1 Service unavailable\; Client host \[45.117.77.28\] blocked using truncate.gbudb.net\; http://www.gbudb.com/truncate/ \[45.117.77.28\]\; from=\ to=\ proto=ESMTP helo=\
...

Mar  8 11:51:42 areeb-Workstation sshd[15182]: Failed password for root from 222.186.15.158 port 50610 ssh2
Mar  8 11:51:46 areeb-Workstation sshd[15182]: Failed password for root from 222.186.15.158 port 50610 ssh2
...

Mar  8 01:25:15 NPSTNNYC01T sshd[30248]: Failed password for root from 222.186.173.215 port 17338 ssh2
Mar  8 01:25:30 NPSTNNYC01T sshd[30248]: Failed password for root from 222.186.173.215 port 17338 ssh2
Mar  8 01:25:30 NPSTNNYC01T sshd[30248]: error: maximum authentication attempts exceeded for root from 222.186.173.215 port 17338 ssh2 [preauth]
...

Honeypot attack, port: 5555, PTR: cpe-172-113-245-96.socal.res.rr.com.

Automatic report - SSH Brute-Force Attack

03/07/2020-23:57:24.515251 78.128.112.38 Protocol: 6 ET SCAN NMAP -sS window 1024

Mar  7 20:02:55 php1 sshd\[18565\]: Invalid user postgres from 117.28.254.77
Mar  7 20:02:55 php1 sshd\[18565\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.28.254.77
Mar  7 20:02:57 php1 sshd\[18565\]: Failed password for invalid user postgres from 117.28.254.77 port 38180 ssh2
Mar  7 20:07:00 php1 sshd\[18942\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.28.254.77  user=keithamemiya
Mar  7 20:07:02 php1 sshd\[18942\]: Failed password for keithamemiya from 117.28.254.77 port 51175 ssh2

Mar  8 07:27:46 dcd-gentoo sshd[18164]: Invalid user admin from 37.123.136.188 port 36248
Mar  8 07:27:48 dcd-gentoo sshd[18164]: error: PAM: Authentication failure for illegal user admin from 37.123.136.188
Mar  8 07:27:46 dcd-gentoo sshd[18164]: Invalid user admin from 37.123.136.188 port 36248
Mar  8 07:27:48 dcd-gentoo sshd[18164]: error: PAM: Authentication failure for illegal user admin from 37.123.136.188
Mar  8 07:27:46 dcd-gentoo sshd[18164]: Invalid user admin from 37.123.136.188 port 36248
Mar  8 07:27:48 dcd-gentoo sshd[18164]: error: PAM: Authentication failure for illegal user admin from 37.123.136.188
Mar  8 07:27:48 dcd-gentoo sshd[18164]: Failed keyboard-interactive/pam for invalid user admin from 37.123.136.188 port 36248 ssh2
...

CMS (WordPress or Joomla) login attempt.

Mar  8 07:11:35 [host] kernel: [277704.378936] [UF
Mar  8 07:12:18 [host] kernel: [277747.683263] [UF
Mar  8 07:14:17 [host] kernel: [277866.157516] [UF
Mar  8 07:16:49 [host] kernel: [278018.743107] [UF
Mar  8 07:19:06 [host] kernel: [278155.368756] [UF
Mar  8 07:19:39 [host] kernel: [278187.763238] [UF