(sshd) Failed SSH login from 23.253.56.94 (US/United States/fairhaven.tbxdev.com): 3 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Apr 13 20:33:51 andromeda sshd[8738]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.253.56.94  user=root
Apr 13 20:33:53 andromeda sshd[8738]: Failed password for root from 23.253.56.94 port 51505 ssh2
Apr 13 20:46:43 andromeda sshd[9562]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.253.56.94  user=root

Apr 13 22:12:42 srv01 sshd[5954]: Invalid user direccion from 115.146.126.209 port 48650
Apr 13 22:12:42 srv01 sshd[5954]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.146.126.209
Apr 13 22:12:42 srv01 sshd[5954]: Invalid user direccion from 115.146.126.209 port 48650
Apr 13 22:12:45 srv01 sshd[5954]: Failed password for invalid user direccion from 115.146.126.209 port 48650 ssh2
Apr 13 22:18:06 srv01 sshd[6251]: Invalid user service from 115.146.126.209 port 58414
...

Port scan detected on ports: 1433[TCP], 1433[TCP], 65529[TCP]

Invalid user tester from 178.149.154.193 port 49728

20/4/13@15:26:57: FAIL: Alarm-Network address from=62.90.101.92
...

Apr 13 21:34:24 sshgateway sshd\[13658\]: Invalid user pro from 103.10.30.204
Apr 13 21:34:24 sshgateway sshd\[13658\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.10.30.204
Apr 13 21:34:26 sshgateway sshd\[13658\]: Failed password for invalid user pro from 103.10.30.204 port 53258 ssh2

2020-04-13T23:05:26.412128abusebot-3.cloudsearch.cf sshd[20443]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.227.77.120  user=root
2020-04-13T23:05:28.639319abusebot-3.cloudsearch.cf sshd[20443]: Failed password for root from 165.227.77.120 port 60305 ssh2
2020-04-13T23:10:23.884329abusebot-3.cloudsearch.cf sshd[20702]: Invalid user user from 165.227.77.120 port 45891
2020-04-13T23:10:23.889628abusebot-3.cloudsearch.cf sshd[20702]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.227.77.120
2020-04-13T23:10:23.884329abusebot-3.cloudsearch.cf sshd[20702]: Invalid user user from 165.227.77.120 port 45891
2020-04-13T23:10:25.554857abusebot-3.cloudsearch.cf sshd[20702]: Failed password for invalid user user from 165.227.77.120 port 45891 ssh2
2020-04-13T23:13:38.985266abusebot-3.cloudsearch.cf sshd[20869]: Invalid user ndaniels from 165.227.77.120 port 49504
...

Apr 14 00:33:32 minden010 sshd[22055]: Failed password for root from 222.186.15.158 port 19930 ssh2
Apr 14 00:33:34 minden010 sshd[22055]: Failed password for root from 222.186.15.158 port 19930 ssh2
Apr 14 00:33:36 minden010 sshd[22055]: Failed password for root from 222.186.15.158 port 19930 ssh2
...

20 attempts against mh-ssh on cloud

2020-04-13T18:41:25.241419shield sshd\[7329\]: Invalid user apache from 140.143.245.30 port 60990
2020-04-13T18:41:25.246801shield sshd\[7329\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=140.143.245.30
2020-04-13T18:41:27.445873shield sshd\[7329\]: Failed password for invalid user apache from 140.143.245.30 port 60990 ssh2
2020-04-13T18:45:07.271232shield sshd\[8331\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=140.143.245.30  user=root
2020-04-13T18:45:09.947045shield sshd\[8331\]: Failed password for root from 140.143.245.30 port 50882 ssh2

(pop3d) Failed POP3 login from 188.159.170.25 (IR/Iran/adsl-188-159-170-25.sabanet.ir): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Apr 13 21:43:37 ir1 dovecot[566034]: pop3-login: Disconnected (auth failed, 1 attempts in 2 secs): user=, method=PLAIN, rip=188.159.170.25, lip=5.63.12.44, session=

port scan and connect, tcp 1433 (ms-sql-s)

Apr 13 20:05:46 vlre-nyc-1 sshd\[20464\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=163.172.127.251  user=root
Apr 13 20:05:48 vlre-nyc-1 sshd\[20464\]: Failed password for root from 163.172.127.251 port 54650 ssh2
Apr 13 20:08:17 vlre-nyc-1 sshd\[20559\]: Invalid user FIELD from 163.172.127.251
Apr 13 20:08:17 vlre-nyc-1 sshd\[20559\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=163.172.127.251
Apr 13 20:08:19 vlre-nyc-1 sshd\[20559\]: Failed password for invalid user FIELD from 163.172.127.251 port 44874 ssh2
...

SSH Brute Force

Apr 14 06:02:17 itv-usvr-02 sshd[25119]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.175.183  user=root
Apr 14 06:02:19 itv-usvr-02 sshd[25119]: Failed password for root from 222.186.175.183 port 50510 ssh2
Apr 14 06:02:32 itv-usvr-02 sshd[25119]: error: maximum authentication attempts exceeded for root from 222.186.175.183 port 50510 ssh2 [preauth]
Apr 14 06:02:17 itv-usvr-02 sshd[25119]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.175.183  user=root
Apr 14 06:02:19 itv-usvr-02 sshd[25119]: Failed password for root from 222.186.175.183 port 50510 ssh2
Apr 14 06:02:32 itv-usvr-02 sshd[25119]: error: maximum authentication attempts exceeded for root from 222.186.175.183 port 50510 ssh2 [preauth]