Jun  2 07:29:45 Tower sshd[12866]: refused connect from 118.241.177.99 (118.241.177.99)
Jun  2 08:52:25 Tower sshd[12866]: Connection from 218.92.0.184 port 8841 on 192.168.10.220 port 22 rdomain ""
Jun  2 08:54:09 Tower sshd[12866]: error: kex_exchange_identification: read: Connection reset by peer
Jun  2 19:44:16 Tower sshd[12866]: refused connect from 49.232.135.14 (49.232.135.14)
Jun  2 23:51:50 Tower sshd[12866]: Connection from 52.172.8.181 port 40256 on 192.168.10.220 port 22 rdomain ""
Jun  2 23:51:56 Tower sshd[12866]: Failed password for root from 52.172.8.181 port 40256 ssh2
Jun  2 23:51:56 Tower sshd[12866]: Received disconnect from 52.172.8.181 port 40256:11: Bye Bye [preauth]
Jun  2 23:51:56 Tower sshd[12866]: Disconnected from authenticating user root 52.172.8.181 port 40256 [preauth]

php WP PHPmyadamin ABUSE blocked for 12h

...

$f2bV_matches | Triggered by Fail2Ban at Vostok web server

Jun  3 06:04:27 srv-ubuntu-dev3 sshd[90122]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.255.131.142  user=root
Jun  3 06:04:29 srv-ubuntu-dev3 sshd[90122]: Failed password for root from 116.255.131.142 port 60398 ssh2
Jun  3 06:06:47 srv-ubuntu-dev3 sshd[90518]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.255.131.142  user=root
Jun  3 06:06:49 srv-ubuntu-dev3 sshd[90518]: Failed password for root from 116.255.131.142 port 39812 ssh2
Jun  3 06:09:12 srv-ubuntu-dev3 sshd[90871]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.255.131.142  user=root
Jun  3 06:09:15 srv-ubuntu-dev3 sshd[90871]: Failed password for root from 116.255.131.142 port 47458 ssh2
Jun  3 06:11:52 srv-ubuntu-dev3 sshd[91307]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.255.131.142  user=root
Jun  3 06:11:53 srv-ubuntu-dev3 sshd[91
...

SSH/22 MH Probe, BF, Hack -

$f2bV_matches

Jun  3 10:58:46 vps sshd[46782]: Failed password for root from 218.92.0.172 port 13534 ssh2
Jun  3 10:58:50 vps sshd[46782]: Failed password for root from 218.92.0.172 port 13534 ssh2
Jun  3 10:58:52 vps sshd[46782]: Failed password for root from 218.92.0.172 port 13534 ssh2
Jun  3 10:58:55 vps sshd[46782]: Failed password for root from 218.92.0.172 port 13534 ssh2
Jun  3 10:58:58 vps sshd[46782]: Failed password for root from 218.92.0.172 port 13534 ssh2
...

2020-06-03T03:52:27.933896abusebot-4.cloudsearch.cf sshd[5295]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=tor-exit-13.zbau.f3netze.de  user=sshd
2020-06-03T03:52:30.400399abusebot-4.cloudsearch.cf sshd[5295]: Failed password for sshd from 185.220.100.240 port 5120 ssh2
2020-06-03T03:52:32.779244abusebot-4.cloudsearch.cf sshd[5295]: Failed password for sshd from 185.220.100.240 port 5120 ssh2
2020-06-03T03:52:27.933896abusebot-4.cloudsearch.cf sshd[5295]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=tor-exit-13.zbau.f3netze.de  user=sshd
2020-06-03T03:52:30.400399abusebot-4.cloudsearch.cf sshd[5295]: Failed password for sshd from 185.220.100.240 port 5120 ssh2
2020-06-03T03:52:32.779244abusebot-4.cloudsearch.cf sshd[5295]: Failed password for sshd from 185.220.100.240 port 5120 ssh2
2020-06-03T03:52:27.933896abusebot-4.cloudsearch.cf sshd[5295]: pam_unix(sshd:auth): authentication failure; logname= 
...

Jun  3 06:43:35 lukav-desktop sshd\[16313\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.249.168.102  user=root
Jun  3 06:43:37 lukav-desktop sshd\[16313\]: Failed password for root from 167.249.168.102 port 27529 ssh2
Jun  3 06:47:40 lukav-desktop sshd\[16370\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.249.168.102  user=root
Jun  3 06:47:41 lukav-desktop sshd\[16370\]: Failed password for root from 167.249.168.102 port 14796 ssh2
Jun  3 06:51:46 lukav-desktop sshd\[16429\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.249.168.102  user=root

CMS (WordPress or Joomla) login attempt.

Jun  3 09:57:01 sso sshd[6748]: Failed password for root from 176.31.105.136 port 39062 ssh2
...

Dovecot Invalid User Login Attempt.

Amazon Phishing Email (2)

Return-Path: 
Received: from source:[157.7.184.35] helo:m5.valueserver.jp
Date: 3 Jun 2020 05:04:48 +0900
Message-ID: <2_____l@m5.valueserver.jp>
Subject: ご注意ください！Αmazonアカウント:_____@_____異常ログイン
X-PHP-Originating-Script: 11403:xcxc.php
From: Amazoｎ.co.jp 
Reply-To: root@m5.valueserver.jp


https://usid-3294.mixh.jp/
150.95.54.134
https://account-update.amazon.co.jp.usid-9836.mixh.jp/
150.95.52.72

Dovecot Invalid User Login Attempt.