Automatic report - Port Scan Attack

Dec  4 12:57:21 vtv3 sshd[4195]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.169.216.233 
Dec  4 12:57:23 vtv3 sshd[4195]: Failed password for invalid user nian from 192.169.216.233 port 57087 ssh2
Dec  4 13:05:36 vtv3 sshd[8201]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.169.216.233 
Dec  4 13:17:16 vtv3 sshd[13507]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.169.216.233 
Dec  4 13:17:18 vtv3 sshd[13507]: Failed password for invalid user mysql from 192.169.216.233 port 34113 ssh2
Dec  4 13:25:49 vtv3 sshd[17588]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.169.216.233 
Dec  4 13:37:35 vtv3 sshd[23107]: Failed password for www-data from 192.169.216.233 port 51628 ssh2
Dec  4 13:43:29 vtv3 sshd[25757]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.169.216.233 
Dec  4 13:43:

Dec  4 20:28:10 * sshd[14899]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=109.248.11.161
Dec  4 20:28:13 * sshd[14899]: Failed password for invalid user dorota from 109.248.11.161 port 50384 ssh2

Automatic report - Banned IP Access

Dec  4 19:22:03 localhost sshd\[70630\]: Invalid user choong from 81.45.56.199 port 42414
Dec  4 19:22:03 localhost sshd\[70630\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.45.56.199
Dec  4 19:22:05 localhost sshd\[70630\]: Failed password for invalid user choong from 81.45.56.199 port 42414 ssh2
Dec  4 19:28:06 localhost sshd\[70798\]: Invalid user 123456 from 81.45.56.199 port 52952
Dec  4 19:28:06 localhost sshd\[70798\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.45.56.199
...

Dec  4 20:43:27 vps647732 sshd[4782]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.89.235.61
Dec  4 20:43:29 vps647732 sshd[4782]: Failed password for invalid user admin from 159.89.235.61 port 48404 ssh2
...

12/04/2019-19:53:48.503035 77.247.108.77 Protocol: 6 ET CINS Active Threat Intelligence Poor Reputation IP group 74

proto=tcp  .  spt=35122  .  dpt=25  .     (Found on   Blocklist de  Dec 03)     (322)

2019-12-04T20:28:17.116886+01:00 lumpi kernel: [777652.077410] INPUT:DROP:SPAMHAUS_EDROP:IN=eth0 OUT= MAC=52:54:a2:01:a5:04:d2:74:7f:6e:37:e3:08:00 SRC=81.22.45.95 DST=78.46.199.189 LEN=40 TOS=0x00 PREC=0x00 TTL=244 ID=40484 PROTO=TCP SPT=41205 DPT=3346 WINDOW=1024 RES=0x00 SYN URGP=0 
...

Received: from localhost (5.9.36.180) by ExchangeServer.*.* (10.0.7.78) with Microsoft SMTP Server id 14.3.468.0; Wed, 4 Dec 2019 
11:01:** +0100
Received: by localhost (Postfix, from userid 0)            id B2E2EA*****; Wed,  4 Dec 2019 04:00:** -0500 (EST)
To: <*@*.de>
Subject: Der Einweisungsprozess ist obligatorisch #DE1D22H11788Z*..*
From: DeutscheBank  
MIME-Version: 1.0
Content-Type: text/html; charset="UTF-8"
Date: Wed, 4 Dec 2019 04:00:* -0500
Return-Path: root@localhost

Dec  2 11:59:26 newdogma sshd[2267]: Invalid user zebra from 41.80.35.78 port 36400
Dec  2 11:59:26 newdogma sshd[2267]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=41.80.35.78
Dec  2 11:59:28 newdogma sshd[2267]: Failed password for invalid user zebra from 41.80.35.78 port 36400 ssh2
Dec  2 11:59:28 newdogma sshd[2267]: Received disconnect from 41.80.35.78 port 36400:11: Bye Bye [preauth]
Dec  2 11:59:28 newdogma sshd[2267]: Disconnected from 41.80.35.78 port 36400 [preauth]
Dec  2 12:11:36 newdogma sshd[2455]: Invalid user endah from 41.80.35.78 port 55098
Dec  2 12:11:36 newdogma sshd[2455]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=41.80.35.78
Dec  2 12:11:38 newdogma sshd[2455]: Failed password for invalid user endah from 41.80.35.78 port 55098 ssh2
Dec  2 12:11:38 newdogma sshd[2455]: Received disconnect from 41.80.35.78 port 55098:11: Bye Bye [preauth]
Dec  2 12:11:38 newdog........
-------------------------------

Dec  4 19:14:25 server sshd\[30518\]: Invalid user lindseth from 111.231.66.135
Dec  4 19:14:25 server sshd\[30518\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.66.135 
Dec  4 19:14:27 server sshd\[30518\]: Failed password for invalid user lindseth from 111.231.66.135 port 58124 ssh2
Dec  4 19:25:28 server sshd\[1544\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.66.135  user=root
Dec  4 19:25:31 server sshd\[1544\]: Failed password for root from 111.231.66.135 port 38206 ssh2
...

[DoS attack: FIN Scan] attack packets in last 20 sec from ip [13.227.218.17], Tuesday, Dec 03,2019 22:58:25

2019-12-04T19:03:05.522648abusebot-5.cloudsearch.cf sshd\[31225\]: Invalid user lee from 181.44.68.66 port 48875

Dec  4 20:11:48 MK-Soft-Root2 sshd[20216]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=163.172.204.185 
Dec  4 20:11:50 MK-Soft-Root2 sshd[20216]: Failed password for invalid user achuth from 163.172.204.185 port 52557 ssh2
...