Received: from mail-wm1-x343.google.com (mail-wm1-x343.google.com [2a00:1450:4864:20::343])
Received: by mail-wm1-x343.google.com with SMTP id u2so2828433wmc.3
Message-ID: <5EA2C4F75FF03936E17056F5957EDEC2C588DEA6@unknown>
From: "Beauty Olgoka"   lp.olga88@gmail.com
Aloha my new mate, I hope, you very well feel yourself? I for the first time write the similar letter. I slightly I test excitement! My name Olga. I write you from a city Ulyanovsk. It large a city in the European part RU. To me31 years. I positive and easy in dialogue the girl. Still I courageous because be I shy, I never have not made the decision to write this letter. I ask you to give me pair of minutes of your time!........

Sep 14 18:49:58 www sshd[5413]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.35.148.75  user=r.r
Sep 14 18:50:00 www sshd[5413]: Failed password for r.r from 161.35.148.75 port 49190 ssh2
Sep 14 18:50:00 www sshd[5413]: Received disconnect from 161.35.148.75: 11: Bye Bye [preauth]
Sep 14 18:55:05 www sshd[5655]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.35.148.75  user=r.r
Sep 14 18:55:06 www sshd[5655]: Failed password for r.r from 161.35.148.75 port 47038 ssh2
Sep 14 18:55:06 www sshd[5655]: Received disconnect from 161.35.148.75: 11: Bye Bye [preauth]
Sep 14 18:59:17 www sshd[5837]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.35.148.75  user=r.r
Sep 14 18:59:18 www sshd[5837]: Failed password for r.r from 161.35.148.75 port 36576 ssh2
Sep 14 18:59:18 www sshd[5837]: Received disconnect from 161.35.148.75: 11: Bye Bye [preaut........
-------------------------------

1600102727 - 09/14/2020 23:58:47 Host: 60.243.120.74/60.243.120.74 Port: 8080 TCP Blocked
...

Lines containing failures of 115.79.40.188 (max 1000)
Sep 14 17:49:25 localhost sshd[7359]: User r.r from 115.79.40.188 not allowed because listed in DenyUsers
Sep 14 17:49:25 localhost sshd[7359]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.79.40.188  user=r.r
Sep 14 17:49:27 localhost sshd[7359]: Failed password for invalid user r.r from 115.79.40.188 port 7402 ssh2
Sep 14 17:49:29 localhost sshd[7359]: Received disconnect from 115.79.40.188 port 7402:11: Bye Bye [preauth]
Sep 14 17:49:29 localhost sshd[7359]: Disconnected from invalid user r.r 115.79.40.188 port 7402 [preauth]
Sep 14 17:59:20 localhost sshd[14933]: User r.r from 115.79.40.188 not allowed because listed in DenyUsers
Sep 14 17:59:20 localhost sshd[14933]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.79.40.188  user=r.r


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=115.79.40.188

Cluster member 178.17.174.160 (MD/Republic of Moldova/Chișinău Municipality/Chisinau/kiv.hlex.pw/[AS43289 I.C.S. Trabia-Network S.R.L.]) said, TEMPDENY 124.158.164.146, Reason:[(sshd) Failed SSH login from 124.158.164.146 (ID/Indonesia/Banten/Tangerang/-/[AS9341 PT INDONESIA COMNETS PLUS]): 1 in the last 3600 secs]; Ports: *; Direction: inout; Trigger: LF_CLUSTER; Logs:

Sep 15 11:59:43 l02a sshd[11852]: Invalid user centos from 178.32.76.150
Sep 15 11:59:43 l02a sshd[11852]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.32.76.150 
Sep 15 11:59:43 l02a sshd[11852]: Invalid user centos from 178.32.76.150
Sep 15 11:59:45 l02a sshd[11852]: Failed password for invalid user centos from 178.32.76.150 port 58334 ssh2

Unauthorized SMTP/IMAP/POP3 connection attempt

Cowrie Honeypot: 3 unauthorised SSH/Telnet login attempts between 2020-09-15T14:36:34Z and 2020-09-15T14:47:09Z

Sep 15 14:32:27 prod4 sshd\[20031\]: Failed password for root from 61.133.232.254 port 16392 ssh2
Sep 15 14:36:25 prod4 sshd\[21931\]: Invalid user sshadm from 61.133.232.254
Sep 15 14:36:27 prod4 sshd\[21931\]: Failed password for invalid user sshadm from 61.133.232.254 port 29151 ssh2
...

Time:     Tue Sep 15 17:44:07 2020 +0200
IP:       139.59.67.82 (IN/India/-)
Failures: 5 (sshd)
Interval: 3600 seconds
Blocked:  Permanent Block [LF_SSHD]

Log entries:

Sep 15 17:22:35 mail-01 sshd[15629]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.67.82  user=root
Sep 15 17:22:37 mail-01 sshd[15629]: Failed password for root from 139.59.67.82 port 46154 ssh2
Sep 15 17:39:11 mail-01 sshd[16393]: Invalid user selena from 139.59.67.82 port 42446
Sep 15 17:39:13 mail-01 sshd[16393]: Failed password for invalid user selena from 139.59.67.82 port 42446 ssh2
Sep 15 17:44:03 mail-01 sshd[16644]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.67.82  user=root

2020-09-14T14:14:04.808306morrigan.ad5gb.com sshd[2023054]: Disconnected from authenticating user root 35.226.225.113 port 59836 [preauth]

Sep 15 17:01:47 vpn01 sshd[6436]: Failed password for root from 83.167.87.198 port 48500 ssh2
...

fail2ban

Sep 15 03:22:10 mockhub sshd[30054]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.163.237 
Sep 15 03:22:10 mockhub sshd[30054]: Invalid user adm from 122.51.163.237 port 37662
Sep 15 03:22:13 mockhub sshd[30054]: Failed password for invalid user adm from 122.51.163.237 port 37662 ssh2
...

2020-09-15T17:22:29.245054ns386461 sshd\[4710\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=209.65.68.190  user=root
2020-09-15T17:22:31.528128ns386461 sshd\[4710\]: Failed password for root from 209.65.68.190 port 39490 ssh2
2020-09-15T17:32:57.069887ns386461 sshd\[14151\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=209.65.68.190  user=root
2020-09-15T17:32:59.234571ns386461 sshd\[14151\]: Failed password for root from 209.65.68.190 port 47543 ssh2
2020-09-15T17:36:50.132364ns386461 sshd\[17724\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=209.65.68.190  user=root
...

prod6
...