CloudCIX Reconnaissance Scan Detected, PTR: dynamic-roo--177.39.130.208.brava.inf.br.

CloudCIX Reconnaissance Scan Detected, PTR: 63.165.150.203.sta.inet.co.th.

2019-10-06T05:03:11.007036abusebot-5.cloudsearch.cf sshd\[6923\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.16.140  user=root

*Port Scan* detected from 80.211.231.187 (IT/Italy/host187-231-211-80.serverdedicati.aruba.it). 4 hits in the last 10 seconds

2019-10-05 22:54:06 H=(176-197-103-58.goodline.info) [176.197.103.58]:49323 I=[192.147.25.65]:25 F= rejected RCPT : RBL: found in thrukfz5b56tq6xao6odgdyjrq.zen.dq.spamhaus.net (127.0.0.3, 127.0.0.4) (https://www.spamhaus.org/sbl/query/SBLCSS)
2019-10-05 22:54:06 H=(176-197-103-58.goodline.info) [176.197.103.58]:49323 I=[192.147.25.65]:25 F= rejected RCPT : RBL: found in thrukfz5b56tq6xao6odgdyjrq.zen.dq.spamhaus.net (127.0.0.3, 127.0.0.4) (https://www.spamhaus.org/sbl/query/SBLCSS)
2019-10-05 22:54:06 H=(176-197-103-58.goodline.info) [176.197.103.58]:49323 I=[192.147.25.65]:25 F= rejected RCPT : RBL: found in thrukfz5b56tq6xao6odgdyjrq.zen.dq.spamhaus.net (127.0.0.3, 127.0.0.4) (https://www.spamhaus.org/sbl/query/SBLCSS)
...

Oct  6 04:59:20 mail kernel: [1714492.478934] [UFW BLOCK] IN=eth0 OUT= MAC=fa:16:3e:d3:64:42:4c:5e:0c:c9:30:5f:08:00 SRC=185.176.27.178 DST=185.101.93.72 LEN=40 TOS=0x00 PREC=0x00 TTL=240 ID=28991 PROTO=TCP SPT=47805 DPT=9960 WINDOW=1024 RES=0x00 SYN URGP=0 
Oct  6 05:03:04 mail kernel: [1714716.299363] [UFW BLOCK] IN=eth0 OUT= MAC=fa:16:3e:d3:64:42:4c:5e:0c:c9:30:5f:08:00 SRC=185.176.27.178 DST=185.101.93.72 LEN=40 TOS=0x00 PREC=0x00 TTL=240 ID=48780 PROTO=TCP SPT=47805 DPT=56042 WINDOW=1024 RES=0x00 SYN URGP=0 
Oct  6 05:06:41 mail kernel: [1714932.931844] [UFW BLOCK] IN=eth0 OUT= MAC=fa:16:3e:d3:64:42:4c:5e:0c:c9:30:5f:08:00 SRC=185.176.27.178 DST=185.101.93.72 LEN=40 TOS=0x00 PREC=0x00 TTL=240 ID=28618 PROTO=TCP SPT=47805 DPT=14148 WINDOW=1024 RES=0x00 SYN URGP=0 
Oct  6 05:07:54 mail kernel: [1715006.265169] [UFW BLOCK] IN=eth0 OUT= MAC=fa:16:3e:d3:64:42:4c:5e:0c:c9:30:5f:08:00 SRC=185.176.27.178 DST=185.101.93.72 LEN=40 TOS=0x00 PREC=0x00 TTL=240 ID=61420 PROTO=TCP SPT=47805 DPT=11399 WINDOW=1024 RES=0x

Oct  6 06:45:52 www sshd\[23114\]: Failed password for root from 31.179.144.190 port 53213 ssh2Oct  6 06:49:48 www sshd\[23324\]: Failed password for root from 31.179.144.190 port 44960 ssh2Oct  6 06:53:52 www sshd\[23488\]: Failed password for root from 31.179.144.190 port 36703 ssh2
...

Oct  6 04:11:49 www_kotimaassa_fi sshd[9732]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.90.89.90
Oct  6 04:11:52 www_kotimaassa_fi sshd[9732]: Failed password for invalid user !qa@ws#ed from 119.90.89.90 port 43398 ssh2
...

Brute force attempt

CloudCIX Reconnaissance Scan Detected, PTR: 224.223.86.116.starhub.net.sg.

Oct  6 06:51:58 microserver sshd[37253]: Invalid user Admin2020 from 129.28.142.81 port 42896
Oct  6 06:51:58 microserver sshd[37253]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.28.142.81
Oct  6 06:52:00 microserver sshd[37253]: Failed password for invalid user Admin2020 from 129.28.142.81 port 42896 ssh2
Oct  6 06:58:37 microserver sshd[38043]: Invalid user bgt54rfvcde3 from 129.28.142.81 port 41958
Oct  6 06:58:37 microserver sshd[38043]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.28.142.81
Oct  6 07:08:40 microserver sshd[39448]: Invalid user WINDOWS@123 from 129.28.142.81 port 40518
Oct  6 07:08:40 microserver sshd[39448]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.28.142.81
Oct  6 07:08:42 microserver sshd[39448]: Failed password for invalid user WINDOWS@123 from 129.28.142.81 port 40518 ssh2
Oct  6 07:12:08 microserver sshd[40078]: Invalid user Peugeot@123 fr

2019-10-06T11:59:01.123657enmeeting.mahidol.ac.th sshd\[11083\]: User root from 222.186.42.117 not allowed because not listed in AllowUsers
2019-10-06T11:59:01.506134enmeeting.mahidol.ac.th sshd\[11083\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.42.117  user=root
2019-10-06T11:59:03.415168enmeeting.mahidol.ac.th sshd\[11083\]: Failed password for invalid user root from 222.186.42.117 port 55168 ssh2
...

Oct  6 05:53:15 vpn01 sshd[2497]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.93.218.204
Oct  6 05:53:16 vpn01 sshd[2497]: Failed password for invalid user action from 85.93.218.204 port 48074 ssh2
...

Oct  6 05:09:13 thevastnessof sshd[17319]: Failed password for root from 178.150.216.229 port 58862 ssh2
...

Oct  4 07:42:44 microserver sshd[36306]: Failed none for root from 222.186.173.183 port 10422 ssh2
Oct  4 07:42:45 microserver sshd[36306]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.173.183  user=root
Oct  4 07:42:48 microserver sshd[36306]: Failed password for root from 222.186.173.183 port 10422 ssh2
Oct  4 07:42:52 microserver sshd[36306]: Failed password for root from 222.186.173.183 port 10422 ssh2
Oct  4 07:42:56 microserver sshd[36306]: Failed password for root from 222.186.173.183 port 10422 ssh2
Oct  4 11:32:00 microserver sshd[2112]: Failed none for root from 222.186.173.183 port 53162 ssh2
Oct  4 11:32:01 microserver sshd[2112]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.173.183  user=root
Oct  4 11:32:04 microserver sshd[2112]: Failed password for root from 222.186.173.183 port 53162 ssh2
Oct  4 11:32:08 microserver sshd[2112]: Failed password for root from 222.186.173.183 port 53162 ssh2
Oct