*Port Scan* detected from 51.38.64.8 (GB/United Kingdom/England/Purfleet/vps-8e40a385.vps.ovh.net). 4 hits in the last 40 seconds

Aug  6 16:45:50 ns41 sshd[28986]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.245.181.2

X-Sender-IP: 40.83.144.143
X-SID-PRA: CUUZYYGT@LBTVSXNPX.COM
X-SID-Result: NONE
X-MS-Exchange-Organization-PCL: 2
X-Microsoft-Antispam: BCL:0;
X-Forefront-Antispam-Report:
CIP:40.83.144.143;CTRY:US;LANG:en;SCL:0;SRV:;IPV:NLI;SFV:NSPM;H:tevmtstvmtaggwp21.com;PTR:InfoDomainNonexistent;CAT:NONE;SFTY:;SFS:;DIR:INB;SFP:;
X-OriginatorOrg: outlook.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 06 Aug 2020 11:08:38.0504
(UTC)

 TCP (SYN) 216.218.206.89:42994 -> port 23, len 40

1596720149 - 08/06/2020 15:22:29 Host: 219.147.76.9/219.147.76.9 Port: 445 TCP Blocked

 TCP (SYN) 45.227.254.30:47314 -> port 15704, len 44

Aug  6 18:24:54 ovpn sshd\[10032\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.244.139.186  user=root
Aug  6 18:24:56 ovpn sshd\[10032\]: Failed password for root from 222.244.139.186 port 28950 ssh2
Aug  6 18:34:33 ovpn sshd\[16019\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.244.139.186  user=root
Aug  6 18:34:35 ovpn sshd\[16019\]: Failed password for root from 222.244.139.186 port 43772 ssh2
Aug  6 18:48:50 ovpn sshd\[27323\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.244.139.186  user=root

Too many connections or unauthorized access detected from Arctic banned ip

Coordinated SSH brute-force attack from different IPs. pam_unix(sshd:auth): user=root

Lines containing failures of 157.245.241.122
/var/log/mail.err:Aug  6 15:13:55 server01 postfix/smtpd[29717]: warning: hostname bizcloud-aviationminingsolutoins.com does not resolve to address 157.245.241.122: Name or service not known
/var/log/apache/pucorp.org.log:Aug  6 15:13:55 server01 postfix/smtpd[29717]: warning: hostname bizcloud-aviationminingsolutoins.com does not resolve to address 157.245.241.122: Name or service not known
/var/log/apache/pucorp.org.log:Aug  6 15:13:55 server01 postfix/smtpd[29717]: connect from unknown[157.245.241.122]
/var/log/apache/pucorp.org.log:Aug x@x
/var/log/apache/pucorp.org.log:Aug x@x
/var/log/apache/pucorp.org.log:Aug  6 15:13:56 server01 postfix/policy-spf[29725]: : Policy action=550 Please see hxxp://www.openspf.org/Why?s=mfrom;id=fax.73295964%40drumondco.com;ip=157.245.241.122;r=server01.2800km.de
/var/log/apache/pucorp.org.log:Aug x@x
/var/log/apache/pucorp.org.log:Aug  6 15:13:56 server01 postfix/smtpd[29717]: disconnect fr........
------------------------------

Aug  6 16:22:00 mertcangokgoz-v4-main kernel: [337058.640354] [UFW BLOCK] IN=eth0 OUT= MAC=96:00:00:5a:6b:04:d2:74:7f:6e:37:e3:08:00 SRC=122.138.29.153 DST=94.130.96.165 LEN=40 TOS=0x00 PREC=0x00 TTL=43 ID=12548 PROTO=TCP SPT=64626 DPT=23 WINDOW=38893 RES=0x00 SYN URGP=0

Aug  6 16:55:58 eventyay sshd[8886]: Failed password for root from 139.155.79.24 port 35226 ssh2
Aug  6 16:58:37 eventyay sshd[8954]: Failed password for root from 139.155.79.24 port 60058 ssh2
...

Aug  6 15:09:25 ovpn sshd\[29554\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.10.222  user=root
Aug  6 15:09:28 ovpn sshd\[29554\]: Failed password for root from 122.51.10.222 port 46314 ssh2
Aug  6 15:16:34 ovpn sshd\[32136\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.10.222  user=root
Aug  6 15:16:36 ovpn sshd\[32136\]: Failed password for root from 122.51.10.222 port 57086 ssh2
Aug  6 15:22:23 ovpn sshd\[2100\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.10.222  user=root

Cowrie Honeypot: 3 unauthorised SSH/Telnet login attempts between 2020-08-06T16:16:49Z and 2020-08-06T16:25:18Z

 UDP 80.82.77.212:59969 -> port 17, len 130