(sshd) Failed SSH login from 37.49.226.173 (NL/Netherlands/-): 2 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Jun  8 00:59:20 ubnt-55d23 sshd[30852]: Did not receive identification string from 37.49.226.173 port 50204
Jun  8 00:59:30 ubnt-55d23 sshd[30853]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.49.226.173  user=root

Jun  7 22:37:47 PorscheCustomer sshd[20999]: Failed password for root from 180.76.117.138 port 50142 ssh2
Jun  7 22:41:53 PorscheCustomer sshd[21226]: Failed password for root from 180.76.117.138 port 49544 ssh2
...

Jun  8 01:58:21 root sshd[6273]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=84.204.209.221  user=root
Jun  8 01:58:23 root sshd[6273]: Failed password for root from 84.204.209.221 port 41346 ssh2
...

Multiport scan : 17 ports scanned 900 1503 1720 2077 2181 2427 3529 4070 5672 7170 8004 8881 9870 13720 25565 31416 50200

Jun  8 01:02:55 home sshd[6674]: Failed password for root from 112.85.42.172 port 50827 ssh2
Jun  8 01:03:07 home sshd[6674]: error: maximum authentication attempts exceeded for root from 112.85.42.172 port 50827 ssh2 [preauth]
Jun  8 01:03:16 home sshd[6701]: Failed password for root from 112.85.42.172 port 14862 ssh2
...

Jun  8 00:53:51 legacy sshd[1252]: Failed password for root from 192.141.68.18 port 41127 ssh2
Jun  8 00:56:51 legacy sshd[1362]: Failed password for root from 192.141.68.18 port 33839 ssh2
...

Jun  8 00:51:00 sso sshd[3808]: Failed password for root from 58.87.78.80 port 56052 ssh2
...

Unauthorized connection attempt detected from IP address 125.107.137.179 to port 23

[2020-06-07 19:04:54] NOTICE[1288][C-000016f5] chan_sip.c: Call from '' (185.53.88.41:60460) to extension '8810972597147567' rejected because extension not found in context 'public'.
[2020-06-07 19:04:54] SECURITY[1303] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-06-07T19:04:54.123-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="8810972597147567",SessionID="0x7f4d742d3bb8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/185.53.88.41/60460",ACLName="no_extension_match"
[2020-06-07 19:05:33] NOTICE[1288][C-000016f7] chan_sip.c: Call from '' (185.53.88.41:63117) to extension '7810972597147567' rejected because extension not found in context 'public'.
[2020-06-07 19:05:33] SECURITY[1303] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-06-07T19:05:33.276-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="7810972597147567",SessionID="0x7f4d742d3bb8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP
...

SSH bruteforce

This client attempted to login to an administrator account on a Website, or abused from another resource.

Jun  7 23:14:39 ift sshd\[17655\]: Failed password for root from 168.90.89.35 port 55918 ssh2Jun  7 23:17:05 ift sshd\[18242\]: Failed password for root from 168.90.89.35 port 45006 ssh2Jun  7 23:19:22 ift sshd\[18577\]: Failed password for root from 168.90.89.35 port 34051 ssh2Jun  7 23:21:46 ift sshd\[19058\]: Failed password for root from 168.90.89.35 port 51344 ssh2Jun  7 23:24:13 ift sshd\[19315\]: Failed password for root from 168.90.89.35 port 40417 ssh2
...

 TCP (SYN) 71.189.93.102:63017 -> port 23, len 40

Unauthorised connection attempt detected at AUO MAIN. System is sshd. Protected by AUO Stack Web Application Firewall (WAF)

Bruteforce detected by fail2ban