Feb 17 10:26:25 tuxlinux sshd[2473]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.54.48.29  user=root
Feb 17 10:26:26 tuxlinux sshd[2473]: Failed password for root from 106.54.48.29 port 38498 ssh2
Feb 17 10:26:25 tuxlinux sshd[2473]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.54.48.29  user=root
Feb 17 10:26:26 tuxlinux sshd[2473]: Failed password for root from 106.54.48.29 port 38498 ssh2
Feb 17 10:40:34 tuxlinux sshd[2791]: Invalid user guy from 106.54.48.29 port 38258
...

MultiHost/MultiPort Probe, Scan, Hack -

SSH login attempts.

21 attempts against mh-ssh on cloud

[2020-02-17 07:03:16] NOTICE[1148][C-00009eab] chan_sip.c: Call from '' (185.53.88.29:5070) to extension '972595897084' rejected because extension not found in context 'public'.
[2020-02-17 07:03:16] SECURITY[1163] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-02-17T07:03:16.215-0500",Severity="Error",Service="SIP",EventVersion="1",AccountID="972595897084",SessionID="0x7fd82c80d368",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/185.53.88.29/5070",ACLName="no_extension_match"
[2020-02-17 07:03:59] NOTICE[1148][C-00009eac] chan_sip.c: Call from '' (185.53.88.29:5070) to extension '972595897084' rejected because extension not found in context 'public'.
[2020-02-17 07:03:59] SECURITY[1163] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-02-17T07:03:59.375-0500",Severity="Error",Service="SIP",EventVersion="1",AccountID="972595897084",SessionID="0x7fd82c80d368",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/185.53.88.29/5070"
...

Honeypot attack, port: 445, PTR: static.vnpt.vn.

SSH login attempts.

(From virginia.mitchell228@gmail.com) Hello there!

I'm a freelance web designer seeking new clients who are open to new ideas in web design to boost their sales. I saw what you were trying to do with your site, I'd like to share a few helpful and effective ideas on how to you can improve your approach on the online market. I am also able integrate features that can help your website run the business for both you and your clients. 

In my 12 years of experience in web design and development, I've seen cases where upgrades on the user-interface of a website helped attract more clients and consequently gave a significant amount of business growth.

If you'd like to be more familiar with the work I do, I'll send you my portfolio of designs from my past clients. I'll also give you a free consultation via a phone call, so I can share with you some expert design advice and to also know about your ideas as well. Please let me know about the best time to give you a call. Talk to you soon!

Best regards,
Virgin

IP was detected trying to Brute-Force SSH, FTP, Web Apps, Port-Scan or Hacking.

Feb 17 12:51:30 debian-2gb-nbg1-2 kernel: \[4199508.877293\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=92.118.37.99 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=247 ID=4622 PROTO=TCP SPT=52101 DPT=2085 WINDOW=1024 RES=0x00 SYN URGP=0

Feb 17 03:38:43 mockhub sshd[6301]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=77.43.74.58
Feb 17 03:38:45 mockhub sshd[6301]: Failed password for invalid user upload from 77.43.74.58 port 44942 ssh2
...

[Mon Feb 17 11:54:54.845875 2020] [:error] [pid 11648:tid 140577572148992] [client 203.78.117.6:37689] [client 203.78.117.6] ModSecurity: Access denied with code 403 (phase 4). Pattern match "^5\\\\d{2}$" at RESPONSE_STATUS. [file "/etc/modsecurity/owasp-modsecurity-crs-3.2.0/rules/RESPONSE-950-DATA-LEAKAGES.conf"] [line "118"] [id "950100"] [msg "The Application Returned a 500-Level Status Code"] [data "Matched Data: 500 found within RESPONSE_STATUS: 500"] [severity "ERROR"] [ver "OWASP_CRS/3.2.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-disclosure"] [tag "WASCTC/WASC-13"] [tag "OWASP_TOP_10/A6"] [tag "PCI/6.5.6"] [tag "paranoia-level/2"] [hostname "karangploso.jatim.bmkg.go.id"] [uri "/index.php/profil/meteorologi/prakiraan-meteorologi/563-prakiraan-cuaca-banyuwangi/555557447-prakiraan-cuaca-wisata-di-kabupaten-banyuwangi-antara-lain-pulau-tabuhan-pantai-boom-pantai-plekung-pantai-pulau-merah-pantai-teluk-hijau-air-terjun-lider-dan-lembah-
...

Unauthorized connection attempt from IP address 36.67.235.11 on Port 445(SMB)

MultiHost/MultiPort Probe, Scan, Hack -

2020-02-05T11:12:57.106Z CLOSE host=112.85.42.180 port=19162 fd=4 time=20.015 bytes=9
...