2020-06-08T22:59:15.799830linuxbox-skyline sshd[240882]: Invalid user center from 180.167.195.167 port 21566
...

2020-06-08 22:44:14.290514-0500  localhost smtpd[40102]: NOQUEUE: reject: RCPT from unknown[185.77.0.18]: 554 5.7.1 Service unavailable; Client host [185.77.0.18] blocked using zen.spamhaus.org; https://www.spamhaus.org/query/ip/185.77.0.18 / https://www.spamhaus.org/sbl/query/SBLCSS; from= to= proto=ESMTP helo=<[185.77.0.18]>

Invalid user admin from 212.64.14.185 port 57539

Jun  9 12:53:52 MainVPS sshd[7595]: Invalid user angel2019 from 123.207.251.54 port 43020
Jun  9 12:53:52 MainVPS sshd[7595]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.207.251.54
Jun  9 12:53:52 MainVPS sshd[7595]: Invalid user angel2019 from 123.207.251.54 port 43020
Jun  9 12:53:53 MainVPS sshd[7595]: Failed password for invalid user angel2019 from 123.207.251.54 port 43020 ssh2
Jun  9 12:54:30 MainVPS sshd[8305]: Invalid user beta from 123.207.251.54 port 51062
...

Automatic report - Port Scan Attack

Jun  9 12:59:11 server sshd[13400]: Failed none for root from 112.85.42.178 port 56842 ssh2
Jun  9 12:59:13 server sshd[13400]: Failed password for root from 112.85.42.178 port 56842 ssh2
Jun  9 12:59:18 server sshd[13400]: Failed password for root from 112.85.42.178 port 56842 ssh2

[portscan] Port scan

Jun  9 00:04:18 web1 sshd\[27226\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.186.170.83  user=root
Jun  9 00:04:20 web1 sshd\[27226\]: Failed password for root from 190.186.170.83 port 60794 ssh2
Jun  9 00:14:02 web1 sshd\[28380\]: Invalid user admin from 190.186.170.83
Jun  9 00:14:02 web1 sshd\[28380\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.186.170.83
Jun  9 00:14:05 web1 sshd\[28380\]: Failed password for invalid user admin from 190.186.170.83 port 33780 ssh2

Unauthorized IMAP connection attempt

8443/tcp 7547/tcp 27017/tcp...
[2020-04-09/06-09]33pkt,15pt.(tcp),2pt.(udp)

Jun  9 06:21:40 ny01 sshd[7846]: Failed password for root from 49.88.112.113 port 59334 ssh2
Jun  9 06:21:42 ny01 sshd[7846]: Failed password for root from 49.88.112.113 port 59334 ssh2
Jun  9 06:21:43 ny01 sshd[7846]: Failed password for root from 49.88.112.113 port 59334 ssh2

Jun  9 11:17:26 ajax sshd[30068]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=69.251.82.109 
Jun  9 11:17:28 ajax sshd[30068]: Failed password for invalid user n from 69.251.82.109 port 59062 ssh2

SSH login attempts.

2020-06-09T05:38:52.422279amanda2.illicoweb.com sshd\[9594\]: Invalid user ga from 89.250.148.154 port 60478
2020-06-09T05:38:52.427921amanda2.illicoweb.com sshd\[9594\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=89.250.148.154
2020-06-09T05:38:54.296129amanda2.illicoweb.com sshd\[9594\]: Failed password for invalid user ga from 89.250.148.154 port 60478 ssh2
2020-06-09T05:48:33.223165amanda2.illicoweb.com sshd\[10199\]: Invalid user devserver from 89.250.148.154 port 33324
2020-06-09T05:48:33.544564amanda2.illicoweb.com sshd\[10199\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=89.250.148.154
...

[Tue Jun 09 17:54:55.160034 2020] [:error] [pid 11009:tid 140152349382400] [client 178.154.200.101:51382] [client 178.154.200.101] ModSecurity: Access denied with code 403 (phase 2). Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/modsecurity/owasp-modsecurity-crs-3.2.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "696"] [id "920350"] [msg "Host header is a numeric IP address"] [data "103.27.207.197"] [severity "WARNING"] [ver "OWASP_CRS/3.2.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/IP_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "103.27.207.197"] [uri "/"] [unique_id "Xt9qf59C5edbGv14HPWBsAAAAfE"]
...