Feb  6 02:31:52 hpm sshd\[19253\]: Invalid user ikj from 114.67.66.172
Feb  6 02:31:52 hpm sshd\[19253\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.67.66.172
Feb  6 02:31:54 hpm sshd\[19253\]: Failed password for invalid user ikj from 114.67.66.172 port 46810 ssh2
Feb  6 02:39:04 hpm sshd\[20278\]: Invalid user xhg from 114.67.66.172
Feb  6 02:39:04 hpm sshd\[20278\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.67.66.172

ThinkPHP Remote Code Execution Vulnerability, PTR: PTR record not found

80.82.77.245 was recorded 20 times by 12 hosts attempting to connect to the following ports: 497,445,158. Incident counter (4h, 24h, all-time): 20, 121, 19957

Feb  6 11:52:03 server sshd\[20165\]: Invalid user zeu from 111.231.202.159
Feb  6 11:52:03 server sshd\[20165\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.202.159 
Feb  6 11:52:05 server sshd\[20165\]: Failed password for invalid user zeu from 111.231.202.159 port 33792 ssh2
Feb  6 12:08:31 server sshd\[22971\]: Invalid user mz from 111.231.202.159
Feb  6 12:08:31 server sshd\[22971\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.202.159 
...

Feb  6 12:42:29 ns382633 sshd\[6153\]: Invalid user infra from 112.218.29.190 port 15369
Feb  6 12:42:29 ns382633 sshd\[6153\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.218.29.190
Feb  6 12:42:32 ns382633 sshd\[6153\]: Failed password for invalid user infra from 112.218.29.190 port 15369 ssh2
Feb  6 13:33:39 ns382633 sshd\[14832\]: Invalid user admin from 112.218.29.190 port 15369
Feb  6 13:33:39 ns382633 sshd\[14832\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.218.29.190

Honeypot attack, port: 81, PTR: dynamic-ip-adsl.viettel.vn.

Feb  6 04:49:25 ms-srv sshd[57710]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.209.0.22  user=root
Feb  6 04:49:27 ms-srv sshd[57710]: Failed password for invalid user root from 85.209.0.22 port 54044 ssh2

firewall-block, port(s): 445/tcp

Feb  6 05:50:11 grey postfix/smtpd\[27443\]: NOQUEUE: reject: RCPT from ec2-63-34-41-27.eu-west-1.compute.amazonaws.com\[63.34.41.27\]: 554 5.7.1 Service unavailable\; Client host \[63.34.41.27\] blocked using dul.dnsbl.sorbs.net\; Dynamic IP Addresses See: http://www.sorbs.net/lookup.shtml\?63.34.41.27\; from=\ to=\ proto=ESMTP helo=\
...

Feb  6 04:50:00 ws26vmsma01 sshd[55917]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.147.193.18
Feb  6 04:50:02 ws26vmsma01 sshd[55917]: Failed password for invalid user onu from 202.147.193.18 port 59232 ssh2
...

scans 3 times in preceeding hours on the ports (in chronological order) 5061 5062 5069

Feb  6 05:15:26 mockhub sshd[7010]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.225.124.50
Feb  6 05:15:28 mockhub sshd[7010]: Failed password for invalid user bjj from 103.225.124.50 port 59317 ssh2
...

Unauthorized connection attempt detected from IP address 84.1.45.168 to port 81 [J]

SMB Server BruteForce Attack

Feb  6 06:13:32 firewall sshd[6280]: Invalid user tow from 178.62.0.215
Feb  6 06:13:34 firewall sshd[6280]: Failed password for invalid user tow from 178.62.0.215 port 53784 ssh2
Feb  6 06:16:54 firewall sshd[6462]: Invalid user yvl from 178.62.0.215
...