Apr  6 06:37:02 localhost sshd[1913]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.212.211.164  user=root
Apr  6 06:37:03 localhost sshd[1913]: Failed password for root from 103.212.211.164 port 41088 ssh2
...

Apr  6 06:25:12 eventyay sshd[30852]: Failed password for root from 185.98.114.69 port 39288 ssh2
Apr  6 06:29:02 eventyay sshd[31102]: Failed password for root from 185.98.114.69 port 40382 ssh2
...

SSH Authentication Attempts Exceeded

Apr  6 08:49:33 MainVPS sshd[3754]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=209.141.41.96  user=root
Apr  6 08:49:36 MainVPS sshd[3754]: Failed password for root from 209.141.41.96 port 47208 ssh2
Apr  6 08:52:47 MainVPS sshd[10416]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=209.141.41.96  user=root
Apr  6 08:52:50 MainVPS sshd[10416]: Failed password for root from 209.141.41.96 port 51652 ssh2
Apr  6 08:55:57 MainVPS sshd[16579]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=209.141.41.96  user=root
Apr  6 08:55:59 MainVPS sshd[16579]: Failed password for root from 209.141.41.96 port 56098 ssh2
...

SSH bruteforce

SSH invalid-user multiple login attempts

Apr  6 06:48:56 mail sshd[15959]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.236.244.98  user=root
Apr  6 06:48:58 mail sshd[15959]: Failed password for root from 104.236.244.98 port 52394 ssh2
...

Apr  6 05:49:46 h2421860 postfix/postscreen[28508]: CONNECT from [217.112.142.240]:50012 to [85.214.119.52]:25
Apr  6 05:49:46 h2421860 postfix/dnsblog[28510]: addr 217.112.142.240 listed by domain b.barracudacentral.org as 127.0.0.2
Apr  6 05:49:46 h2421860 postfix/dnsblog[28511]: addr 217.112.142.240 listed by domain Unknown.trblspam.com as 104.247.81.103
Apr  6 05:49:52 h2421860 postfix/postscreen[28508]: DNSBL rank 3 for [217.112.142.240]:50012
Apr x@x
Apr  6 05:49:52 h2421860 postfix/postscreen[28508]: DISCONNECT [217.112.142.240]:50012


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=217.112.142.240

Attempt to attack host OS, exploiting network vulnerabilities, on 06-04-2020 04:55:09.

20/4/5@23:54:44: FAIL: Alarm-Intrusion address from=81.105.223.91
...

(pop3d) Failed POP3 login from 156.96.60.152 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Apr  6 08:24:41 ir1 dovecot[566034]: pop3-login: Disconnected (auth failed, 1 attempts in 2 secs): user=, method=PLAIN, rip=156.96.60.152, lip=5.63.12.44, session=

1586145282 - 04/06/2020 05:54:42 Host: 1.55.94.244/1.55.94.244 Port: 445 TCP Blocked

Apr  6 05:51:00 santamaria sshd\[26925\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=150.109.102.119  user=root
Apr  6 05:51:02 santamaria sshd\[26925\]: Failed password for root from 150.109.102.119 port 34820 ssh2
Apr  6 05:54:59 santamaria sshd\[26975\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=150.109.102.119  user=root
...

Apr  6 07:33:38 vmd48417 sshd[2722]: Failed password for root from 181.48.28.13 port 33240 ssh2

Apr  6 03:58:05 ws26vmsma01 sshd[65948]: Failed password for root from 180.76.165.48 port 55470 ssh2
...