Dec 15 08:41:55 sauna sshd[119794]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.90.40
Dec 15 08:41:57 sauna sshd[119794]: Failed password for invalid user swenberg from 139.59.90.40 port 20809 ssh2
...

port scan and connect, tcp 1433 (ms-sql-s)

Dec 15 12:20:46 hell sshd[20657]: Failed password for root from 46.175.243.9 port 42100 ssh2
Dec 15 12:28:34 hell sshd[22226]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.175.243.9
...

2019-12-15T13:26:37.250487scmdmz1 sshd\[19704\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.175.212  user=root
2019-12-15T13:26:39.081906scmdmz1 sshd\[19704\]: Failed password for root from 222.186.175.212 port 57402 ssh2
2019-12-15T13:26:41.916908scmdmz1 sshd\[19704\]: Failed password for root from 222.186.175.212 port 57402 ssh2
...

Scanning

WordPress login Brute force / Web App Attack on client site.

2019-12-15T07:18:48.543811struts4.enskede.local sshd\[20048\]: Invalid user geschaft from 54.39.145.31 port 34554
2019-12-15T07:18:48.552573struts4.enskede.local sshd\[20048\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.ip-54-39-145.net
2019-12-15T07:18:51.393729struts4.enskede.local sshd\[20048\]: Failed password for invalid user geschaft from 54.39.145.31 port 34554 ssh2
2019-12-15T07:23:52.157384struts4.enskede.local sshd\[20073\]: Invalid user souheil from 54.39.145.31 port 42508
2019-12-15T07:23:52.164006struts4.enskede.local sshd\[20073\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.ip-54-39-145.net
...

firewall-block, port(s): 37493/tcp

Dec 15 02:14:18 php1 sshd\[19470\]: Invalid user jessica from 51.15.84.255
Dec 15 02:14:18 php1 sshd\[19470\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.15.84.255
Dec 15 02:14:20 php1 sshd\[19470\]: Failed password for invalid user jessica from 51.15.84.255 port 43700 ssh2
Dec 15 02:20:28 php1 sshd\[20139\]: Invalid user test from 51.15.84.255
Dec 15 02:20:28 php1 sshd\[20139\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.15.84.255

Dec 15 02:04:55 wbs sshd\[17315\]: Invalid user prebe from 106.12.48.216
Dec 15 02:04:55 wbs sshd\[17315\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.48.216
Dec 15 02:04:57 wbs sshd\[17315\]: Failed password for invalid user prebe from 106.12.48.216 port 48130 ssh2
Dec 15 02:13:47 wbs sshd\[18275\]: Invalid user oberkirch from 106.12.48.216
Dec 15 02:13:47 wbs sshd\[18275\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.48.216

Honeypot attack, port: 23, PTR: 187-11-154-211.dsl.telesp.net.br.

WordPress wp-login brute force :: 178.128.90.9 0.244 - [15/Dec/2019:08:51:53  0000] [censored_1] "POST /wp-login.php HTTP/1.1" 200 1807 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" "HTTP/1.1"

Dec 15 07:24:56  exim[23796]: [1\51] 1igNKm-0006Bo-Dj H=base.vidyad.com (base.alibash.com) [63.81.87.89] F= rejected after DATA: This message scored 101.1 spam points.

Dec 15 11:28:10 meumeu sshd[24198]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.200.66.164 
Dec 15 11:28:12 meumeu sshd[24198]: Failed password for invalid user guest from 42.200.66.164 port 56090 ssh2
Dec 15 11:34:16 meumeu sshd[25091]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.200.66.164 
...

Honeypot attack, port: 445, PTR: localhost.