[2020-09-07 16:00:42] NOTICE[1194] chan_sip.c: Registration from '"60003" ' failed for '103.145.13.118:5813' - Wrong password
[2020-09-07 16:00:42] SECURITY[1233] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-09-07T16:00:42.065-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="60003",SessionID="0x7f2ddc144af8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/103.145.13.118/5813",Challenge="643ee4c1",ReceivedChallenge="643ee4c1",ReceivedHash="7608e1c3bc8cad3cc1cfef0200a0791b"
[2020-09-07 16:00:42] NOTICE[1194] chan_sip.c: Registration from '"60003" ' failed for '103.145.13.118:5813' - Wrong password
[2020-09-07 16:00:42] SECURITY[1233] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-09-07T16:00:42.214-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="60003",SessionID="0x7f2ddc3ee718",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IP
...

[2020-09-07 06:26:13] NOTICE[1194] chan_sip.c: Registration from '"50002" ' failed for '103.145.13.118:5112' - Wrong password
[2020-09-07 06:26:13] SECURITY[1233] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-09-07T06:26:13.608-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="50002",SessionID="0x7f2ddcbdd678",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/103.145.13.118/5112",Challenge="4a9cc7b3",ReceivedChallenge="4a9cc7b3",ReceivedHash="6abeac5e2009c3ff6a3b6328bf4d8eab"
[2020-09-07 06:26:13] NOTICE[1194] chan_sip.c: Registration from '"50002" ' failed for '103.145.13.118:5112' - Wrong password
[2020-09-07 06:26:13] SECURITY[1233] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-09-07T06:26:13.618-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="50002",SessionID="0x7f2ddc23cbb8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IP
...

[2020-08-29 17:06:54] NOTICE[1185] chan_sip.c: Registration from '"70002" ' failed for '103.145.13.118:6425' - Wrong password
[2020-08-29 17:06:54] SECURITY[1203] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-08-29T17:06:54.906-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="70002",SessionID="0x7f10c405a408",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/103.145.13.118/6425",Challenge="2c0c354f",ReceivedChallenge="2c0c354f",ReceivedHash="d7c72c4e17234be00a4d2a8acde78474"
[2020-08-29 17:06:55] NOTICE[1185] chan_sip.c: Registration from '"70002" ' failed for '103.145.13.118:6425' - Wrong password
[2020-08-29 17:06:55] SECURITY[1203] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-08-29T17:06:55.123-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="70002",SessionID="0x7f10c4286a78",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IP
...

[2020-08-24 04:27:51] NOTICE[1185] chan_sip.c: Registration from '"806" ' failed for '103.145.13.118:5977' - Wrong password
[2020-08-24 04:27:51] SECURITY[1203] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-08-24T04:27:51.767-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="806",SessionID="0x7f10c4709548",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/103.145.13.118/5977",Challenge="18ce23df",ReceivedChallenge="18ce23df",ReceivedHash="50dc3cd902b434b3113e10a7fe333bb9"
[2020-08-24 04:27:51] NOTICE[1185] chan_sip.c: Registration from '"806" ' failed for '103.145.13.118:5977' - Wrong password
[2020-08-24 04:27:51] SECURITY[1203] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-08-24T04:27:51.820-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="806",SessionID="0x7f10c41590f8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/103.1
...

SSH login attempts with user root.

Automatic report - Banned IP Access

Port Scan

TCP ports : 443

Severity: Medium
TypeMisc: Attack
Category: Dshield
Source: 103.145.13.149 : 42748

ET DROP Dshield Block Listed Source group 1 - port: 5060 proto: sip cat: Misc Attackbytes: 452

ET DROP Dshield Block Listed Source group 1 - port: 5060 proto: sip cat: Misc Attackbytes: 461

ET DROP Dshield Block Listed Source group 1 - port: 5038 proto: tcp cat: Misc Attackbytes: 60

ET DROP Dshield Block Listed Source group 1 - port: 5038 proto: tcp cat: Misc Attackbytes: 60

ET CINS Active Threat Intelligence Poor Reputation IP group 95 - port: 5038 proto: tcp cat: Misc Attackbytes: 60

103.145.13.229 was recorded 6 times by 4 hosts attempting to connect to the following ports: 5060. Incident counter (4h, 24h, all-time): 6, 33, 646

ET SCAN Sipvicious Scan - port: 5060 proto: sip cat: Attempted Information Leakbytes: 462

Trying ports that it shouldn't be.

 UDP 103.145.13.193:5140 -> port 5060, len 417

Port scan denied

UDP port : 5060

UDP port : 5060

Dec  2 08:59:48 ns382633 sshd\[12516\]: Invalid user klidies from 58.56.187.83 port 56045
Dec  2 08:59:48 ns382633 sshd\[12516\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.56.187.83
Dec  2 08:59:51 ns382633 sshd\[12516\]: Failed password for invalid user klidies from 58.56.187.83 port 56045 ssh2
Dec  2 09:15:41 ns382633 sshd\[16106\]: Invalid user rudziah from 58.56.187.83 port 54123
Dec  2 09:15:41 ns382633 sshd\[16106\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.56.187.83

" "

Dec  2 09:49:22 vps666546 sshd\[7391\]: Invalid user siggy from 118.24.71.83 port 33066
Dec  2 09:49:22 vps666546 sshd\[7391\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.24.71.83
Dec  2 09:49:24 vps666546 sshd\[7391\]: Failed password for invalid user siggy from 118.24.71.83 port 33066 ssh2
Dec  2 09:55:30 vps666546 sshd\[7680\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.24.71.83  user=root
Dec  2 09:55:32 vps666546 sshd\[7680\]: Failed password for root from 118.24.71.83 port 34466 ssh2
...

Dec  1 22:49:55 tdfoods sshd\[21027\]: Invalid user manchini from 138.197.5.191
Dec  1 22:49:55 tdfoods sshd\[21027\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.5.191
Dec  1 22:49:57 tdfoods sshd\[21027\]: Failed password for invalid user manchini from 138.197.5.191 port 57184 ssh2
Dec  1 22:55:35 tdfoods sshd\[21676\]: Invalid user gdm from 138.197.5.191
Dec  1 22:55:35 tdfoods sshd\[21676\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.5.191

TCP Port Scanning

2019-12-02T09:54:54.594793scmdmz1 sshd\[19319\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.85.42.185  user=root
2019-12-02T09:54:56.394818scmdmz1 sshd\[19319\]: Failed password for root from 112.85.42.185 port 43859 ssh2
2019-12-02T09:54:58.374294scmdmz1 sshd\[19319\]: Failed password for root from 112.85.42.185 port 43859 ssh2
...

Dec  2 04:03:45 ny01 sshd[32734]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.66.207.67
Dec  2 04:03:48 ny01 sshd[32734]: Failed password for invalid user teamspeak from 180.66.207.67 port 58396 ssh2
Dec  2 04:10:11 ny01 sshd[913]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.66.207.67

2019-12-02T08:33:38.469395  sshd[10530]: Invalid user kareenhalli from 176.31.162.82 port 40410
2019-12-02T08:33:38.481566  sshd[10530]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=176.31.162.82
2019-12-02T08:33:38.469395  sshd[10530]: Invalid user kareenhalli from 176.31.162.82 port 40410
2019-12-02T08:33:40.558557  sshd[10530]: Failed password for invalid user kareenhalli from 176.31.162.82 port 40410 ssh2
2019-12-02T08:38:51.685652  sshd[10629]: Invalid user test from 176.31.162.82 port 51950
...

Dec  2 14:19:46 vibhu-HP-Z238-Microtower-Workstation sshd\[23890\]: Invalid user yoyo from 77.60.37.105
Dec  2 14:19:46 vibhu-HP-Z238-Microtower-Workstation sshd\[23890\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=77.60.37.105
Dec  2 14:19:48 vibhu-HP-Z238-Microtower-Workstation sshd\[23890\]: Failed password for invalid user yoyo from 77.60.37.105 port 40444 ssh2
Dec  2 14:25:19 vibhu-HP-Z238-Microtower-Workstation sshd\[25204\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=77.60.37.105  user=root
Dec  2 14:25:21 vibhu-HP-Z238-Microtower-Workstation sshd\[25204\]: Failed password for root from 77.60.37.105 port 36701 ssh2
...

Dec  1 23:07:35 eddieflores sshd\[4566\]: Invalid user operator from 82.64.129.178
Dec  1 23:07:35 eddieflores sshd\[4566\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=82-64-129-178.subs.proxad.net
Dec  1 23:07:37 eddieflores sshd\[4566\]: Failed password for invalid user operator from 82.64.129.178 port 56590 ssh2
Dec  1 23:13:55 eddieflores sshd\[5548\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=82-64-129-178.subs.proxad.net  user=root
Dec  1 23:13:57 eddieflores sshd\[5548\]: Failed password for root from 82.64.129.178 port 40360 ssh2

Dec  2 03:55:19 TORMINT sshd\[31592\]: Invalid user muto from 118.89.135.215
Dec  2 03:55:19 TORMINT sshd\[31592\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.89.135.215
Dec  2 03:55:21 TORMINT sshd\[31592\]: Failed password for invalid user muto from 118.89.135.215 port 47910 ssh2
...

Dec  2 10:07:15 vps691689 sshd[11919]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.77.201.36
Dec  2 10:07:16 vps691689 sshd[11919]: Failed password for invalid user suhian from 51.77.201.36 port 34342 ssh2
Dec  2 10:13:20 vps691689 sshd[12119]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.77.201.36
...

Dec  1 22:47:32 hanapaa sshd\[14146\]: Invalid user ricoh from 182.61.130.121
Dec  1 22:47:32 hanapaa sshd\[14146\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.130.121
Dec  1 22:47:34 hanapaa sshd\[14146\]: Failed password for invalid user ricoh from 182.61.130.121 port 32696 ssh2
Dec  1 22:55:27 hanapaa sshd\[3830\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.130.121  user=root
Dec  1 22:55:29 hanapaa sshd\[3830\]: Failed password for root from 182.61.130.121 port 37929 ssh2

2019-12-02T08:55:25.970819abusebot-5.cloudsearch.cf sshd\[27205\]: Invalid user den from 198.211.110.133 port 33898

SMB Server BruteForce Attack