20/7/9@00:37:28: FAIL: Alarm-Network address from=129.205.210.174
...

2020-04-1522:21:391jOoXS-0007CB-UV\<=info@whatsup2013.chH=045-238-121-202.provecom.com.br\(localhost\)[45.238.121.202]:50128P=esmtpsaX=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256CV=noA=dovecot_login:info@whatsup2013.chS=3230id=2da8782b200bded2f5b00655a1666c6053a673c0@whatsup2013.chT="YouhavenewlikefromKalysta"forallenwaits77@gmail.comwellsrodney22@gmail.com2020-04-1522:20:581jOoWn-00077H-O0\<=info@whatsup2013.chH=\(localhost\)[129.205.29.86]:43401P=esmtpsaX=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256CV=noA=dovecot_login:info@whatsup2013.chS=3146id=04b082585378ad5e7d8375262df9c0eccf253481ae@whatsup2013.chT="fromSharyntomckaywayne492"formckaywayne492@ggmail.comlavell902@gmail.com2020-04-1522:21:471jOoXa-0007Ce-NA\<=info@whatsup2013.chH=\(localhost\)[113.173.98.46]:50799P=esmtpsaX=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256CV=noA=dovecot_login:info@whatsup2013.chS=3094id=a4e82b414a61b447649a6c3f34e0d9f5d63cedc627@whatsup2013.chT="NewlikereceivedfromPhilomena"forlabmpb@yahoo.combacher420bill@gmail.com2020-04-1522:22:281jO

suspicious action Mon, 24 Feb 2020 01:44:41 -0300

$f2bV_matches

[munged]::80 129.205.24.167 - - [04/Jan/2020:05:49:24 +0100] "POST /[munged]: HTTP/1.1" 200 3861 "http://[munged]:/[munged]:" "Mozilla/5.0 (Windows NT 6.1; rv:60.0) Gecko/20100101 Firefox/60.0"
[munged]::80 129.205.24.167 - - [04/Jan/2020:05:49:25 +0100] "POST /[munged]: HTTP/1.1" 200 3860 "http://[munged]:/[munged]:" "Mozilla/5.0 (Windows NT 6.1; rv:60.0) Gecko/20100101 Firefox/60.0"
[munged]::80 129.205.24.167 - - [04/Jan/2020:05:49:26 +0100] "POST /[munged]: HTTP/1.1" 200 3860 "http://[munged]:/[munged]:" "Mozilla/5.0 (Windows NT 6.1; rv:60.0) Gecko/20100101 Firefox/60.0"
[munged]::80 129.205.24.167 - - [04/Jan/2020:05:49:27 +0100] "POST /[munged]: HTTP/1.1" 200 3860 "http://[munged]:/[munged]:" "Mozilla/5.0 (Windows NT 6.1; rv:60.0) Gecko/20100101 Firefox/60.0"
[munged]::80 129.205.24.167 - - [04/Jan/2020:05:49:28 +0100] "POST /[munged]: HTTP/1.1" 200 3860 "http://[munged]:/[munged]:" "Mozilla/5.0 (Windows NT 6.1; rv:60.0) Gecko/20100101 Firefox/60.0"
[munged]::80 129.205.24.167 - - [04/Jan/2020:05:49:30

(imapd) Failed IMAP login from 129.205.24.119 (UG/Uganda/-): 1 in the last 3600 secs

Apr 18 21:16:18 yesfletchmain sshd\[24473\]: Invalid user mysql2 from 129.205.208.21 port 22018
Apr 18 21:16:18 yesfletchmain sshd\[24473\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.205.208.21
Apr 18 21:16:21 yesfletchmain sshd\[24473\]: Failed password for invalid user mysql2 from 129.205.208.21 port 22018 ssh2
Apr 18 21:22:59 yesfletchmain sshd\[24739\]: Invalid user temp1 from 129.205.208.21 port 3000
Apr 18 21:22:59 yesfletchmain sshd\[24739\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.205.208.21
...

Apr 23 21:12:40 yesfletchmain sshd\[24809\]: Invalid user informix from 129.205.208.23 port 22498
Apr 23 21:12:40 yesfletchmain sshd\[24809\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.205.208.23
Apr 23 21:12:42 yesfletchmain sshd\[24809\]: Failed password for invalid user informix from 129.205.208.23 port 22498 ssh2
Apr 23 21:16:27 yesfletchmain sshd\[24890\]: Invalid user ezequiel from 129.205.208.23 port 29625
Apr 23 21:16:27 yesfletchmain sshd\[24890\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.205.208.23
...

email spam

IMAP brute force
...

(imapd) Failed IMAP login from 129.205.201.27 (BW/Botswana/-): 1 in the last 3600 secs

Jan 23 15:15:28 motanud sshd\[21702\]: Invalid user oracle from 129.205.208.20 port 19106
Jan 23 15:15:28 motanud sshd\[21702\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.205.208.20
Jan 23 15:15:31 motanud sshd\[21702\]: Failed password for invalid user oracle from 129.205.208.20 port 19106 ssh2
Mar  4 07:02:42 motanud sshd\[7359\]: Invalid user jt from 129.205.208.20 port 7616
Mar  4 07:02:42 motanud sshd\[7359\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.205.208.20
Mar  4 07:02:44 motanud sshd\[7359\]: Failed password for invalid user jt from 129.205.208.20 port 7616 ssh2
Mar  4 07:35:40 motanud sshd\[9071\]: Invalid user z from 129.205.208.20 port 1089
Mar  4 07:35:40 motanud sshd\[9071\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.205.208.20
Mar  4 07:35:42 motanud sshd\[9071\]: Failed password for invalid user z from 129.205.208.20 port 1089 ssh2

Jan 23 15:25:03 motanud sshd\[22063\]: Invalid user wmaina from 129.205.208.21 port 31267
Jan 23 15:25:03 motanud sshd\[22063\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.205.208.21
Jan 23 15:25:05 motanud sshd\[22063\]: Failed password for invalid user wmaina from 129.205.208.21 port 31267 ssh2
Mar  4 07:20:56 motanud sshd\[8200\]: Invalid user ftpadmin from 129.205.208.21 port 9310
Mar  4 07:20:56 motanud sshd\[8200\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.205.208.21
Mar  4 07:20:58 motanud sshd\[8200\]: Failed password for invalid user ftpadmin from 129.205.208.21 port 9310 ssh2

Jan 23 15:20:48 motanud sshd\[21879\]: Invalid user test1 from 129.205.208.22 port 10659
Jan 23 15:20:48 motanud sshd\[21879\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.205.208.22
Jan 23 15:20:49 motanud sshd\[21879\]: Failed password for invalid user test1 from 129.205.208.22 port 10659 ssh2
Mar  4 07:28:17 motanud sshd\[8624\]: Invalid user td from 129.205.208.22 port 26699
Mar  4 07:28:17 motanud sshd\[8624\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.205.208.22
Mar  4 07:28:19 motanud sshd\[8624\]: Failed password for invalid user td from 129.205.208.22 port 26699 ssh2

Jan 23 15:34:00 motanud sshd\[22510\]: Invalid user rafael from 129.205.208.23 port 22230
Jan 23 15:34:00 motanud sshd\[22510\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.205.208.23
Jan 23 15:34:01 motanud sshd\[22510\]: Failed password for invalid user rafael from 129.205.208.23 port 22230 ssh2
Mar  4 07:13:35 motanud sshd\[7767\]: Invalid user hn from 129.205.208.23 port 27528
Mar  4 07:13:35 motanud sshd\[7767\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.205.208.23
Mar  4 07:13:37 motanud sshd\[7767\]: Failed password for invalid user hn from 129.205.208.23 port 27528 ssh2

WINDHUNDGANG.DE 167.99.105.11 \[02/Oct/2019:14:28:40 +0200\] "POST /xmlrpc.php HTTP/1.1" 200 4394 "-" "Mozilla/5.0 \(Windows NT 10.0\; Win64\; x64\) AppleWebKit/537.36 \(KHTML, like Gecko\) Chrome/60.0.3112.113 Safari/537.36"
windhundgang.de 167.99.105.11 \[02/Oct/2019:14:28:40 +0200\] "POST /xmlrpc.php HTTP/1.1" 200 4394 "-" "Mozilla/5.0 \(Windows NT 10.0\; Win64\; x64\) AppleWebKit/537.36 \(KHTML, like Gecko\) Chrome/60.0.3112.113 Safari/537.36"

Oct  2 04:26:23 kapalua sshd\[32702\]: Invalid user ubnt from 23.99.81.127
Oct  2 04:26:23 kapalua sshd\[32702\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.99.81.127
Oct  2 04:26:25 kapalua sshd\[32702\]: Failed password for invalid user ubnt from 23.99.81.127 port 58816 ssh2
Oct  2 04:29:37 kapalua sshd\[526\]: Invalid user 1415926 from 23.99.81.127
Oct  2 04:29:37 kapalua sshd\[526\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.99.81.127

Oct  2 21:53:47 ns37 sshd[8160]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.137.8.222

Oct  2 14:27:48 MK-Soft-VM4 sshd[22480]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.155.238.121 
Oct  2 14:27:50 MK-Soft-VM4 sshd[22480]: Failed password for invalid user jboss from 61.155.238.121 port 50285 ssh2
...

SSH Brute-Force reported by Fail2Ban

Oct  2 10:33:04 sachi sshd\[4592\]: Invalid user supervisor from 119.60.255.90
Oct  2 10:33:04 sachi sshd\[4592\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.60.255.90
Oct  2 10:33:06 sachi sshd\[4592\]: Failed password for invalid user supervisor from 119.60.255.90 port 36400 ssh2
Oct  2 10:36:37 sachi sshd\[4878\]: Invalid user ts3 from 119.60.255.90
Oct  2 10:36:37 sachi sshd\[4878\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.60.255.90

Autoban   170.0.125.196 AUTH/CONNECT

Oct  2 14:28:22 cp sshd[2212]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.122.148.186

Oct  2 19:51:50 localhost sshd\[23610\]: Invalid user lth from 37.59.58.142 port 33882
Oct  2 19:51:50 localhost sshd\[23610\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.59.58.142
Oct  2 19:51:52 localhost sshd\[23610\]: Failed password for invalid user lth from 37.59.58.142 port 33882 ssh2

\[2019-10-02 13:10:00\] NOTICE\[1948\] chan_sip.c: Registration from '\' failed for '77.247.110.201:64982' - Wrong password
\[2019-10-02 13:10:00\] SECURITY\[2006\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-10-02T13:10:00.594-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="58000036",SessionID="0x7f1e1c10d4f8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/77.247.110.201/64982",Challenge="7a999b87",ReceivedChallenge="7a999b87",ReceivedHash="905e9f3323ac6def6796a5ff095a32ea"
\[2019-10-02 13:10:34\] NOTICE\[1948\] chan_sip.c: Registration from '\' failed for '77.247.110.201:55228' - Wrong password
\[2019-10-02 13:10:34\] SECURITY\[2006\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-10-02T13:10:34.365-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="58000039",SessionID="0x7f1e1c10d4f8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/77.247

[portscan] Port scan

Automatic report - Port Scan Attack

Oct  2 14:23:53 OPSO sshd\[27178\]: Invalid user 123123 from 139.59.41.6 port 49498
Oct  2 14:23:53 OPSO sshd\[27178\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.41.6
Oct  2 14:23:55 OPSO sshd\[27178\]: Failed password for invalid user 123123 from 139.59.41.6 port 49498 ssh2
Oct  2 14:28:22 OPSO sshd\[28044\]: Invalid user 1111 from 139.59.41.6 port 32866
Oct  2 14:28:22 OPSO sshd\[28044\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.41.6

Oct  2 19:45:30 localhost sshd\[23161\]: Invalid user tremblay from 103.129.220.214 port 50779
Oct  2 19:45:30 localhost sshd\[23161\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.129.220.214
Oct  2 19:45:33 localhost sshd\[23161\]: Failed password for invalid user tremblay from 103.129.220.214 port 50779 ssh2
...

Oct  2 22:23:52 localhost sshd\[6341\]: Invalid user testing from 123.31.32.150 port 34660
Oct  2 22:23:52 localhost sshd\[6341\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.31.32.150
Oct  2 22:23:54 localhost sshd\[6341\]: Failed password for invalid user testing from 123.31.32.150 port 34660 ssh2