Nov  4 18:44:44 php1 sshd\[4686\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.199.100.81  user=root
Nov  4 18:44:45 php1 sshd\[4686\]: Failed password for root from 139.199.100.81 port 34814 ssh2
Nov  4 18:53:45 php1 sshd\[6064\]: Invalid user stas from 139.199.100.81
Nov  4 18:53:45 php1 sshd\[6064\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.199.100.81
Nov  4 18:53:47 php1 sshd\[6064\]: Failed password for invalid user stas from 139.199.100.81 port 46118 ssh2

2019-11-05T06:46:48.466105scmdmz1 sshd\[4249\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.65.174.81  user=root
2019-11-05T06:46:50.086441scmdmz1 sshd\[4249\]: Failed password for root from 159.65.174.81 port 42764 ssh2
2019-11-05T06:52:06.031162scmdmz1 sshd\[4611\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.65.174.81  user=root
...

SSH login attempt

IP Ban Report :  
 https://help-dysk.pl/wordpress-firewall-plugins/ip/79.25.165.147/ 
 
 IT - 1H : (103)  
 Protection Against DDoS WordPress plugin :  
 "odzyskiwanie danych help-dysk" 
 IP Address Ranges by Country : IT 
 NAME ASN : ASN3269 
 
 IP : 79.25.165.147 
 
 CIDR : 79.24.0.0/15 
 
 PREFIX COUNT : 550 
 
 UNIQUE IP COUNT : 19507712 
 
 
 ATTACKS DETECTED ASN3269 :  
  1H - 2 
  3H - 6 
  6H - 15 
 12H - 36 
 24H - 64 
 
 DateTime : 2019-11-05 05:53:23 
 
 INFO :  HACK ! - Looking for resource vulnerabilities Scan Detected and Blocked by ADMIN  - data recovery

Nov  5 05:59:10 webserver postfix/smtpd\[895\]: NOQUEUE: reject: RCPT from unknown\[193.32.160.150\]: 454 4.7.1 \: Relay access denied\; from=\<76frcr33rg6c@rudan.cz\> to=\ proto=ESMTP helo=\<\[193.32.160.151\]\>
Nov  5 05:59:10 webserver postfix/smtpd\[895\]: NOQUEUE: reject: RCPT from unknown\[193.32.160.150\]: 454 4.7.1 \: Relay access denied\; from=\<76frcr33rg6c@rudan.cz\> to=\ proto=ESMTP helo=\<\[193.32.160.151\]\>
Nov  5 05:59:10 webserver postfix/smtpd\[895\]: NOQUEUE: reject: RCPT from unknown\[193.32.160.150\]: 454 4.7.1 \: Relay access denied\; from=\<76frcr33rg6c@rudan.cz\> to=\ proto=ESMTP helo=\<\[193.32.160.151\]\>
Nov  5 05:59:10 webserver postfix/smtpd\[895\]: NOQUEUE: reject: RCPT from unknown\[193.32.160.150\]: 454 4.7.1 \: Relay access denied\; from=\<76frcr33rg6c@rudan.cz\> to=\

Portscan or hack attempt detected by psad/fwsnort

Nov  5 05:27:57 h2040555 sshd[15646]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.175.229.28  user=r.r
Nov  5 05:27:59 h2040555 sshd[15646]: Failed password for r.r from 134.175.229.28 port 53468 ssh2
Nov  5 05:27:59 h2040555 sshd[15646]: Received disconnect from 134.175.229.28: 11: Bye Bye [preauth]
Nov  5 05:50:23 h2040555 sshd[15903]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.175.229.28  user=r.r
Nov  5 05:50:25 h2040555 sshd[15903]: Failed password for r.r from 134.175.229.28 port 59350 ssh2
Nov  5 05:50:25 h2040555 sshd[15903]: Received disconnect from 134.175.229.28: 11: Bye Bye [preauth]
Nov  5 05:55:06 h2040555 sshd[15947]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.175.229.28  user=r.r
Nov  5 05:55:08 h2040555 sshd[15947]: Failed password for r.r from 134.175.229.28 port 39506 ssh2
Nov  5 05:55:09 h2040555 sshd[15947........
-------------------------------

no

Nov  5 06:25:57 [host] sshd[30690]: Invalid user duane from 113.140.75.205
Nov  5 06:25:57 [host] sshd[30690]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.140.75.205
Nov  5 06:25:59 [host] sshd[30690]: Failed password for invalid user duane from 113.140.75.205 port 52884 ssh2

2019-11-05T05:24:36.632066abusebot.cloudsearch.cf sshd\[32262\]: Invalid user ftpuser from 51.254.93.77 port 34860

Nov  5 05:56:39 MK-Soft-VM3 sshd[18073]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.191.60.199 
Nov  5 05:56:42 MK-Soft-VM3 sshd[18073]: Failed password for invalid user proftpd from 94.191.60.199 port 54686 ssh2
...

Automatic report - SSH Brute-Force Attack

Unauthorised access (Nov  5) SRC=103.81.13.67 LEN=52 TTL=119 ID=30175 DF TCP DPT=445 WINDOW=8192 SYN

Nov  5 06:52:44 vps01 sshd[8434]: Failed password for root from 193.70.114.154 port 49564 ssh2

Nov  5 12:27:14 webhost01 sshd[32337]: Failed password for root from 200.169.223.98 port 36068 ssh2
...