2020-03-28 22:23:53 server sshd[79865]: Failed password for invalid user ammin from 124.115.173.253 port 5351 ssh2

[PY]  (sshd) Failed SSH login from 92.46.40.110 (KZ/Kazakhstan/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Mar 31 04:34:44 svr sshd[104074]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.46.40.110  user=root
Mar 31 04:34:45 svr sshd[104074]: Failed password for root from 92.46.40.110 port 43268 ssh2
Mar 31 04:45:02 svr sshd[107830]: Invalid user test from 92.46.40.110 port 55408
Mar 31 04:45:04 svr sshd[107830]: Failed password for invalid user test from 92.46.40.110 port 55408 ssh2
Mar 31 04:49:22 svr sshd[109323]: Invalid user user from 92.46.40.110 port 34002

Mar 31 08:32:09 [HOSTNAME] sshd[8468]: User **removed** from 103.126.56.22 not allowed because not listed in AllowUsers
Mar 31 08:32:09 [HOSTNAME] sshd[8468]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.126.56.22  user=**removed**
Mar 31 08:32:11 [HOSTNAME] sshd[8468]: Failed password for invalid user **removed** from 103.126.56.22 port 47160 ssh2
...

Mar 31 11:29:00 relay dovecot: imap-login: Disconnected: Inactivity \(auth failed, 1 attempts in 180 secs\): user=\, method=PLAIN, rip=185.22.142.132, lip=176.9.177.164, session=\<7gLrJyOiiuS5Fo6E\>
Mar 31 11:29:02 relay dovecot: imap-login: Disconnected: Inactivity \(auth failed, 1 attempts in 180 secs\): user=\, method=PLAIN, rip=185.22.142.132, lip=176.9.177.164, session=\
Mar 31 11:29:25 relay dovecot: imap-login: Disconnected: Inactivity \(auth failed, 1 attempts in 180 secs\): user=\, method=PLAIN, rip=185.22.142.132, lip=176.9.177.164, session=\<5d5dKSOiHIO5Fo6E\>
Mar 31 11:34:35 relay dovecot: imap-login: Disconnected: Inactivity \(auth failed, 1 attempts in 180 secs\): user=\, method=PLAIN, rip=185.22.142.132, lip=176.9.177.164, session=\
Mar 31 11:34:37 relay dovecot: imap-login: Disconnected: Inactivity \(auth failed, 1 attempts in 180
...

Mar 31 11:54:49 markkoudstaal sshd[29643]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.17.44.207
Mar 31 11:54:51 markkoudstaal sshd[29643]: Failed password for invalid user xw from 46.17.44.207 port 55033 ssh2
Mar 31 11:58:40 markkoudstaal sshd[30177]: Failed password for root from 46.17.44.207 port 32960 ssh2

US_DigitalOcean,_<177>1585631420 [1:2402000:5497] ET DROP Dshield Block Listed Source group 1 [Classification: Misc Attack] [Priority: 2]:  {TCP} 192.241.238.20:52370

fail2ban

2020-03-31T03:31:57.751351linuxbox-skyline sshd[114901]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.140.114.196  user=root
2020-03-31T03:31:59.555900linuxbox-skyline sshd[114901]: Failed password for root from 123.140.114.196 port 57300 ssh2
...

1,10-10/02 [bc01/m67] PostRequest-Spammer scoring: luanda

Mar 31 07:17:37 master sshd[11601]: Failed password for root from 139.59.161.78 port 54010 ssh2
Mar 31 07:24:18 master sshd[11623]: Failed password for root from 139.59.161.78 port 47900 ssh2
Mar 31 07:27:48 master sshd[11639]: Failed password for root from 139.59.161.78 port 61083 ssh2
Mar 31 07:31:33 master sshd[11670]: Failed password for root from 139.59.161.78 port 19105 ssh2
Mar 31 07:35:13 master sshd[11690]: Failed password for root from 139.59.161.78 port 32214 ssh2
Mar 31 07:38:59 master sshd[11712]: Failed password for root from 139.59.161.78 port 45315 ssh2
Mar 31 07:42:39 master sshd[11730]: Failed password for root from 139.59.161.78 port 58414 ssh2
Mar 31 07:46:10 master sshd[11761]: Failed password for root from 139.59.161.78 port 16564 ssh2
Mar 31 07:49:50 master sshd[11783]: Failed password for invalid user weixiaoxian from 139.59.161.78 port 29733 ssh2
Mar 31 07:53:22 master sshd[11805]: Failed password for invalid user admin from 139.59.161.78 port 42880 ssh2

Mar 31 10:04:30 DAAP sshd[26345]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=151.80.83.249  user=root
Mar 31 10:04:33 DAAP sshd[26345]: Failed password for root from 151.80.83.249 port 42226 ssh2
Mar 31 10:07:15 DAAP sshd[26351]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=151.80.83.249  user=root
Mar 31 10:07:17 DAAP sshd[26351]: Failed password for root from 151.80.83.249 port 36166 ssh2
Mar 31 10:09:58 DAAP sshd[26436]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=151.80.83.249  user=root
Mar 31 10:10:00 DAAP sshd[26436]: Failed password for root from 151.80.83.249 port 58332 ssh2
...

port scan and connect, tcp 80 (http)

Mar 31 09:32:12 vlre-nyc-1 sshd\[1805\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=140.206.186.10  user=root
Mar 31 09:32:14 vlre-nyc-1 sshd\[1805\]: Failed password for root from 140.206.186.10 port 60326 ssh2
Mar 31 09:40:27 vlre-nyc-1 sshd\[2068\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=140.206.186.10  user=lxd
Mar 31 09:40:29 vlre-nyc-1 sshd\[2068\]: Failed password for lxd from 140.206.186.10 port 59010 ssh2
Mar 31 09:42:00 vlre-nyc-1 sshd\[2101\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=140.206.186.10  user=root
...

Unauthorized connection attempt detected from IP address 186.109.218.234 to port 23

$f2bV_matches | Triggered by Fail2Ban at Vostok web server