Jun  2 14:03:15 mellenthin sshd[20937]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.24.132.222  user=root
Jun  2 14:03:17 mellenthin sshd[20937]: Failed password for invalid user root from 175.24.132.222 port 55180 ssh2

2020-06-02T18:37:57.872775ns386461 sshd\[10467\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=v118-27-20-122.tkzi.static.cnode.io  user=root
2020-06-02T18:37:59.513582ns386461 sshd\[10467\]: Failed password for root from 118.27.20.122 port 51192 ssh2
2020-06-02T18:46:53.083239ns386461 sshd\[18204\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=v118-27-20-122.tkzi.static.cnode.io  user=root
2020-06-02T18:46:54.638575ns386461 sshd\[18204\]: Failed password for root from 118.27.20.122 port 54380 ssh2
2020-06-02T18:50:40.765060ns386461 sshd\[21885\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=v118-27-20-122.tkzi.static.cnode.io  user=root
...

trying to access non-authorized port

May 27 14:10:39 v2202003116398111542 sshd[8181]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.155.22.165  user=bin

2020-06-02T17:19:28.917420mail.broermann.family sshd[31330]: Failed password for root from 165.227.203.162 port 59906 ssh2
2020-06-02T17:22:50.926154mail.broermann.family sshd[31620]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.227.203.162  user=root
2020-06-02T17:22:52.832325mail.broermann.family sshd[31620]: Failed password for root from 165.227.203.162 port 36566 ssh2
2020-06-02T17:26:15.161088mail.broermann.family sshd[32025]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.227.203.162  user=root
2020-06-02T17:26:17.875923mail.broermann.family sshd[32025]: Failed password for root from 165.227.203.162 port 41446 ssh2
...

Jun  2 19:22:04 server sshd[27065]: Failed none for root from 112.85.42.178 port 59437 ssh2
Jun  2 19:22:06 server sshd[27065]: Failed password for root from 112.85.42.178 port 59437 ssh2
Jun  2 19:22:09 server sshd[27065]: Failed password for root from 112.85.42.178 port 59437 ssh2

Automatic report - Port Scan Attack

May 24 15:10:58 v2202003116398111542 sshd[17425]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.69.184  user=root

Lines containing failures of 178.153.101.43
Jun  2 13:57:56 myhost sshd[11337]: User r.r from 178.153.101.43 not allowed because not listed in AllowUsers
Jun  2 13:57:56 myhost sshd[11337]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.153.101.43  user=r.r
Jun  2 13:57:58 myhost sshd[11337]: Failed password for invalid user r.r from 178.153.101.43 port 56528 ssh2
Jun  2 13:57:58 myhost sshd[11337]: Received disconnect from 178.153.101.43 port 56528:11: Bye Bye [preauth]
Jun  2 13:57:58 myhost sshd[11337]: Disconnected from invalid user r.r 178.153.101.43 port 56528 [preauth]
Jun  2 14:07:09 myhost sshd[11436]: User r.r from 178.153.101.43 not allowed because not listed in AllowUsers
Jun  2 14:07:09 myhost sshd[11436]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.153.101.43  user=r.r


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=178.153.101.43

(sshd) Failed SSH login from 118.25.144.49 (CN/China/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Jun  2 19:32:21 s1 sshd[5381]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.25.144.49  user=root
Jun  2 19:32:22 s1 sshd[5381]: Failed password for root from 118.25.144.49 port 33776 ssh2
Jun  2 19:37:22 s1 sshd[5550]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.25.144.49  user=root
Jun  2 19:37:25 s1 sshd[5550]: Failed password for root from 118.25.144.49 port 36204 ssh2
Jun  2 19:41:08 s1 sshd[5663]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.25.144.49  user=root

Malicious Traffic/Form Submission

" "

ssh intrusion attempt

DATE:2020-06-02 18:17:19, IP:183.109.79.253, PORT:ssh SSH brute force auth (docker-dc)

2020-06-02 06:55:29.368597-0500  localhost smtpd[76742]: NOQUEUE: reject: RCPT from unknown[168.121.149.0]: 554 5.7.1 Service unavailable; Client host [168.121.149.0] blocked using zen.spamhaus.org; https://www.spamhaus.org/query/ip/168.121.149.0; from= to= proto=ESMTP helo=<[168.121.149.0]>