Jun  6 00:10:59 abendstille sshd\[11655\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.210.114.58  user=root
Jun  6 00:11:01 abendstille sshd\[11655\]: Failed password for root from 62.210.114.58 port 36924 ssh2
Jun  6 00:14:09 abendstille sshd\[15038\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.210.114.58  user=root
Jun  6 00:14:11 abendstille sshd\[15038\]: Failed password for root from 62.210.114.58 port 38966 ssh2
Jun  6 00:17:12 abendstille sshd\[18185\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.210.114.58  user=root
...

From bounce-35cd4d53be0cb40ec1d4b79cbb1257a1@smtplw-13.com Fri Jun 05 17:24:02 2020
Received: from smtp124t7f72.saaspmta0001.correio.biz ([179.188.7.72]:34460)

Jun  6 04:25:42 prod4 sshd\[14358\]: Failed password for root from 188.153.218.82 port 57410 ssh2
Jun  6 04:29:20 prod4 sshd\[15873\]: Failed password for root from 188.153.218.82 port 33200 ssh2
Jun  6 04:32:49 prod4 sshd\[17402\]: Failed password for root from 188.153.218.82 port 37230 ssh2
...

Jun  5 22:09:54 mx sshd[32032]: Failed password for root from 60.164.250.12 port 43179 ssh2

Honeypot attack, port: 445, PTR: PTR record not found

Jun  5 17:57:31 Tower sshd[43095]: Connection from 91.121.211.59 port 58498 on 192.168.10.220 port 22 rdomain ""
Jun  5 17:57:32 Tower sshd[43095]: Failed password for root from 91.121.211.59 port 58498 ssh2
Jun  5 17:57:32 Tower sshd[43095]: Received disconnect from 91.121.211.59 port 58498:11: Bye Bye [preauth]
Jun  5 17:57:32 Tower sshd[43095]: Disconnected from authenticating user root 91.121.211.59 port 58498 [preauth]

Jun  4 23:16:45 v11 sshd[628]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.88.164.216  user=r.r
Jun  4 23:16:47 v11 sshd[628]: Failed password for r.r from 113.88.164.216 port 52336 ssh2
Jun  4 23:16:47 v11 sshd[628]: Received disconnect from 113.88.164.216 port 52336:11: Bye Bye [preauth]
Jun  4 23:16:47 v11 sshd[628]: Disconnected from 113.88.164.216 port 52336 [preauth]
Jun  4 23:19:47 v11 sshd[802]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.88.164.216  user=r.r
Jun  4 23:19:49 v11 sshd[802]: Failed password for r.r from 113.88.164.216 port 46978 ssh2
Jun  4 23:19:50 v11 sshd[802]: Received disconnect from 113.88.164.216 port 46978:11: Bye Bye [preauth]
Jun  4 23:19:50 v11 sshd[802]: Disconnected from 113.88.164.216 port 46978 [preauth]
Jun  4 23:21:07 v11 sshd[847]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.88.164.216  u........
-------------------------------

[2020-06-05 22:40:16] NOTICE[1288] chan_sip.c: Registration from '' failed for '62.171.144.195:57366' - Wrong password
[2020-06-05 22:40:16] SECURITY[1303] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-06-05T22:40:16.180-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="tototo",SessionID="0x7f4d7403c148",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/62.171.144.195/57366",Challenge="7234398d",ReceivedChallenge="7234398d",ReceivedHash="824a23a5256c3a9e4759be501d5b0de8"
[2020-06-05 22:41:40] NOTICE[1288] chan_sip.c: Registration from '' failed for '62.171.144.195:36100' - Wrong password
...

prod8
...

20 attempts against mh-misbehave-ban on sonic

Ssh brute force

(pop3d) Failed POP3 login from 104.245.32.232 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Jun  6 00:54:17 ir1 dovecot[2885757]: pop3-login: Aborted login (auth failed, 1 attempts in 2 secs): user=, method=PLAIN, rip=104.245.32.232, lip=5.63.12.44, session=

Honeypot attack, port: 81, PTR: PTR record not found

Scanned 3 times in the last 24 hours on port 22

Honeypot attack, port: 81, PTR: host214.170-51-27.claro.com.py.