Unauthorized connection attempt detected from IP address 113.175.216.163 to port 445

Dec 21 07:25:26 grey postfix/smtpd\[12341\]: NOQUEUE: reject: RCPT from unknown\[223.73.84.242\]: 554 5.7.1 Service unavailable\; Client host \[223.73.84.242\] blocked using truncate.gbudb.net\; http://www.gbudb.com/truncate/ \[223.73.84.242\]\; from=\ to=\ proto=ESMTP helo=\
...

Dec 21 13:31:27 server sshd\[29079\]: Invalid user mcwhinnie from 81.31.204.9
Dec 21 13:31:27 server sshd\[29079\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.31.204.9 
Dec 21 13:31:29 server sshd\[29079\]: Failed password for invalid user mcwhinnie from 81.31.204.9 port 56120 ssh2
Dec 21 13:40:28 server sshd\[31450\]: Invalid user hspark from 81.31.204.9
Dec 21 13:40:28 server sshd\[31450\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.31.204.9 
...

Dec 20 07:29:40 m1 sshd[29775]: Invalid user zabbix from 106.13.191.19
Dec 20 07:29:41 m1 sshd[29775]: Failed password for invalid user zabbix from 106.13.191.19 port 40788 ssh2
Dec 20 07:41:13 m1 sshd[2489]: Failed password for r.r from 106.13.191.19 port 37064 ssh2


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=106.13.191.19

Dec 21 10:41:08 unicornsoft sshd\[30409\]: Invalid user test from 188.166.34.129
Dec 21 10:41:08 unicornsoft sshd\[30409\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.166.34.129
Dec 21 10:41:10 unicornsoft sshd\[30409\]: Failed password for invalid user test from 188.166.34.129 port 40568 ssh2

Automatic report - Port Scan Attack

Unauthorized connection attempt detected from IP address 183.64.215.47 to port 4899

Dec 21 06:18:50 linuxvps sshd\[12602\]: Invalid user test@123 from 82.165.76.56
Dec 21 06:18:50 linuxvps sshd\[12602\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.165.76.56
Dec 21 06:18:52 linuxvps sshd\[12602\]: Failed password for invalid user test@123 from 82.165.76.56 port 45286 ssh2
Dec 21 06:24:06 linuxvps sshd\[16001\]: Invalid user Dallas from 82.165.76.56
Dec 21 06:24:06 linuxvps sshd\[16001\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.165.76.56

Dec 21 11:21:40 server2 sshd\[16881\]: User root from 58.210.180.190 not allowed because not listed in AllowUsers
Dec 21 11:21:42 server2 sshd\[16883\]: Invalid user DUP from 58.210.180.190
Dec 21 11:21:44 server2 sshd\[16885\]: User root from 58.210.180.190 not allowed because not listed in AllowUsers
Dec 21 11:21:46 server2 sshd\[16889\]: User bin from 58.210.180.190 not allowed because not listed in AllowUsers
Dec 21 11:21:50 server2 sshd\[16891\]: User bin from 58.210.180.190 not allowed because not listed in AllowUsers
Dec 21 11:21:54 server2 sshd\[16893\]: User root from 58.210.180.190 not allowed because not listed in AllowUsers

Dec 21 01:15:41 wbs sshd\[8241\]: Invalid user mahzad from 210.5.88.19
Dec 21 01:15:41 wbs sshd\[8241\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.5.88.19
Dec 21 01:15:44 wbs sshd\[8241\]: Failed password for invalid user mahzad from 210.5.88.19 port 55247 ssh2
Dec 21 01:22:13 wbs sshd\[8911\]: Invalid user 12 from 210.5.88.19
Dec 21 01:22:13 wbs sshd\[8911\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.5.88.19

Attempt to attack host OS, exploiting network vulnerabilities, on 21-12-2019 06:25:14.

Dec 21 12:41:32 ns3042688 sshd\[26388\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.138  user=root
Dec 21 12:41:34 ns3042688 sshd\[26388\]: Failed password for root from 218.92.0.138 port 53340 ssh2
Dec 21 12:41:50 ns3042688 sshd\[26388\]: Failed password for root from 218.92.0.138 port 53340 ssh2
Dec 21 12:41:58 ns3042688 sshd\[26579\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.138  user=root
Dec 21 12:42:00 ns3042688 sshd\[26579\]: Failed password for root from 218.92.0.138 port 31139 ssh2
...

$f2bV_matches

Dec 21 05:07:13 vtv3 sshd[9992]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.99.233.205 
Dec 21 05:07:15 vtv3 sshd[9992]: Failed password for invalid user klossner from 167.99.233.205 port 34592 ssh2
Dec 21 05:14:03 vtv3 sshd[12836]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.99.233.205 
Dec 21 05:29:19 vtv3 sshd[19631]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.99.233.205 
Dec 21 05:29:21 vtv3 sshd[19631]: Failed password for invalid user guest from 167.99.233.205 port 48878 ssh2
Dec 21 05:34:59 vtv3 sshd[22156]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.99.233.205 
Dec 21 05:46:09 vtv3 sshd[27601]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.99.233.205 
Dec 21 05:46:11 vtv3 sshd[27601]: Failed password for invalid user admin from 167.99.233.205 port 38512 ssh2
Dec 21

Dec 21 01:24:53 web1 postfix/smtpd[10119]: warning: unknown[45.224.107.99]: SASL PLAIN authentication failed: authentication failure
...