Unauthorized connection attempt detected from IP address 156.96.45.178 to port 3389

proto=tcp  .  spt=49476  .  dpt=25  .     Found on 156.96.0.0/16     Spamhaus DROP (Dont Route Or Peer)       (202)

SPAM spoofing

IP 156.96.45.237 attacked honeypot on port: 23 at 8/15/2020 8:53:50 PM

Aug  2 17:33:16 mail postfix/smtpd[58573]: warning: unknown[156.96.45.198]: SASL LOGIN authentication failed: generic failure
Aug  2 17:33:17 mail postfix/smtpd[58573]: warning: unknown[156.96.45.198]: SASL LOGIN authentication failed: generic failure
Aug  2 17:33:17 mail postfix/smtpd[58573]: warning: unknown[156.96.45.198]: SASL LOGIN authentication failed: generic failure
...

Aug  1 17:42:39 mail postfix/smtpd[37657]: warning: unknown[156.96.45.198]: SASL LOGIN authentication failed: generic failure
Aug  1 17:42:39 mail postfix/smtpd[37657]: warning: unknown[156.96.45.198]: SASL LOGIN authentication failed: generic failure
Aug  1 17:42:39 mail postfix/smtpd[37657]: warning: unknown[156.96.45.198]: SASL LOGIN authentication failed: generic failure
...

Aug  1 11:31:07 mail postfix/smtpd[34318]: warning: unknown[156.96.45.198]: SASL LOGIN authentication failed: generic failure
Aug  1 11:31:07 mail postfix/smtpd[34318]: warning: unknown[156.96.45.198]: SASL LOGIN authentication failed: generic failure
Aug  1 11:31:07 mail postfix/smtpd[34318]: warning: unknown[156.96.45.198]: SASL LOGIN authentication failed: generic failure
...

Jul 30 15:58:54 mail postfix/smtpd[120421]: warning: unknown[156.96.45.198]: SASL LOGIN authentication failed: generic failure
Jul 30 15:58:54 mail postfix/smtpd[120421]: warning: unknown[156.96.45.198]: SASL LOGIN authentication failed: generic failure
Jul 30 15:58:54 mail postfix/smtpd[120421]: warning: unknown[156.96.45.198]: SASL LOGIN authentication failed: generic failure
...

[2020-05-11 11:38:57] NOTICE[1157][C-000031bf] chan_sip.c: Call from '' (156.96.45.247:65227) to extension '011441977879416' rejected because extension not found in context 'public'.
[2020-05-11 11:38:57] SECURITY[1173] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-05-11T11:38:57.145-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="011441977879416",SessionID="0x7f5f107b3898",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/156.96.45.247/65227",ACLName="no_extension_match"
[2020-05-11 11:40:01] NOTICE[1157][C-000031c3] chan_sip.c: Call from '' (156.96.45.247:55767) to extension '9011441977879416' rejected because extension not found in context 'public'.
[2020-05-11 11:40:01] SECURITY[1173] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-05-11T11:40:01.801-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="9011441977879416",SessionID="0x7f5f100266a8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UD
...

[2020-05-08 22:46:07] NOTICE[1157][C-00001c62] chan_sip.c: Call from '' (156.96.45.247:58030) to extension '+441977879416' rejected because extension not found in context 'public'.
[2020-05-08 22:46:07] SECURITY[1173] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-05-08T22:46:07.070-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="+441977879416",SessionID="0x7f5f100266a8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/156.96.45.247/58030",ACLName="no_extension_match"
[2020-05-08 22:47:25] NOTICE[1157][C-00001c63] chan_sip.c: Call from '' (156.96.45.247:63232) to extension '011441977879416' rejected because extension not found in context 'public'.
[2020-05-08 22:47:25] SECURITY[1173] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-05-08T22:47:25.836-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="011441977879416",SessionID="0x7f5f100266a8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/156.
...

[2020-05-08 18:23:45] NOTICE[1157][C-00001ae3] chan_sip.c: Call from '' (156.96.45.247:53829) to extension '+441977879416' rejected because extension not found in context 'public'.
[2020-05-08 18:23:45] SECURITY[1173] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-05-08T18:23:45.740-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="+441977879416",SessionID="0x7f5f107b3898",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/156.96.45.247/53829",ACLName="no_extension_match"
[2020-05-08 18:25:05] NOTICE[1157][C-00001ae5] chan_sip.c: Call from '' (156.96.45.247:61682) to extension '011441977879416' rejected because extension not found in context 'public'.
[2020-05-08 18:25:05] SECURITY[1173] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-05-08T18:25:05.378-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="011441977879416",SessionID="0x7f5f106f5588",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/156.
...

Automatic report - Banned IP Access

2020-03-01 04:01:01 H=(gmail.com) [156.96.45.176]:55780 I=[192.147.25.65]:25 F= rejected RCPT : RBL: found in thrukfz5b56tq6xao6odgdyjrq.zen.dq.spamhaus.net (127.0.0.3, 127.0.0.10, 127.0.0.2, 127.0.0.4, 127.0.0.9) (https://www.spamhaus.org/sbl/query/SBL461359)
2020-03-01 04:01:01 H=(gmail.com) [156.96.45.176]:55744 I=[192.147.25.65]:25 F= rejected RCPT : RBL: found in thrukfz5b56tq6xao6odgdyjrq.zen.dq.spamhaus.net (127.0.0.10, 127.0.0.3, 127.0.0.4, 127.0.0.9, 127.0.0.2) (https://www.spamhaus.org/sbl/query/SBLCSS)
2020-03-01 04:01:01 H=(gmail.com) [156.96.45.176]:55777 I=[192.147.25.65]:25 F= rejected RCPT : RBL: found in thrukfz5b56tq6xao6odgdyjrq.zen.dq.spamhaus.net (127.0.0.4, 127.0.0.10, 127.0.0.2, 127.0.0.3, 127.0.0.9) (https://www.spamhaus.org/query/ip/156.96.45.176)
...

Feb 28 11:17:49 our-server-hostname postfix/smtpd[18044]: connect from unknown[156.96.45.176]
Feb 28 11:17:49 our-server-hostname postfix/smtpd[18204]: connect from unknown[156.96.45.176]
Feb 28 11:17:49 our-server-hostname postfix/smtpd[18507]: connect from unknown[156.96.45.176]
Feb 28 11:17:49 our-server-hostname postfix/smtpd[18110]: connect from unknown[156.96.45.176]
Feb 28 11:17:49 our-server-hostname postfix/smtpd[18509]: connect from unknown[156.96.45.176]
Feb x@x
Feb x@x
Feb x@x
Feb x@x
Feb 28 11:17:50 our-server-hostname postfix/smtpd[18044]: disconnect from unknown[156.96.45.176]
Feb 28 11:17:50 our-server-hostname postfix/smtpd[18507]: disconnect from unknown[156.96.45.176]
Feb 28 11:17:50 our-server-hostname postfix/smtpd[18204]: disconnect from unknown[156.96.45.176]
Feb x@x
Feb 28 11:17:50 our-server-hostname postfix/smtpd[18110]: disconnect from unknown[156.96.45.176]
Feb 28 11:17:50 our-server-hostname postfix/smtpd[18509]: disconnect from unknown[156.........
-------------------------------

Postfix SMTP rejection

Automatically reported by fail2ban report script (powermetal_old)

Sep605:39:07server2kernel:Firewall:\*TCP_INBlocked\*IN=eth0OUT=MAC=00:16:3e:3f:7a:43:52:54:00:a2:7f:43:08:00SRC=94.102.53.112DST=136.243.224.57LEN=40TOS=0x00PREC=0x00TTL=249ID=57372PROTO=TCPSPT=54264DPT=48514WINDOW=1024RES=0x00SYNURGP=0Sep605:39:21server2kernel:Firewall:\*TCP_INBlocked\*IN=eth0OUT=MAC=00:16:3e:3f:7a:43:52:54:00:a2:7f:43:08:00SRC=94.102.53.112DST=136.243.224.51LEN=40TOS=0x00PREC=0x00TTL=249ID=56208PROTO=TCPSPT=54264DPT=47431WINDOW=1024RES=0x00SYNURGP=0Sep605:39:24server2kernel:Firewall:\*TCP_INBlocked\*IN=eth0OUT=MAC=00:16:3e:3f:7a:43:52:54:00:a2:7f:43:08:00SRC=94.102.53.112DST=136.243.224.57LEN=40TOS=0x00PREC=0x00TTL=249ID=24382PROTO=TCPSPT=54264DPT=48906WINDOW=1024RES=0x00SYNURGP=0Sep605:39:31server2kernel:Firewall:\*TCP_INBlocked\*IN=eth0OUT=MAC=00:16:3e:3f:7a:43:52:54:00:a2:7f:43:08:00SRC=94.102.53.112DST=136.243.224.53LEN=40TOS=0x00PREC=0x00TTL=249ID=41730PROTO=TCPSPT=54264DPT=47417WINDOW=1024RES=0x00SYNURGP=0Sep605:39:37server2kernel:Firewall:\*TCP_INBlocked\*IN=eth0OUT=MAC=00:16:3e:3f:7

abcdata-sys.de:80 109.70.100.39 - - [05/Sep/2020:18:54:34 +0200] "POST /xmlrpc.php HTTP/1.0" 301 497 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36"
www.goldgier.de 109.70.100.39 [05/Sep/2020:18:54:35 +0200] "POST /xmlrpc.php HTTP/1.0" 200 3899 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36"

Sep  5 22:58:44 onepixel sshd[2021404]: Failed password for root from 101.71.51.192 port 43847 ssh2
Sep  5 23:01:41 onepixel sshd[2021867]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=101.71.51.192  user=root
Sep  5 23:01:43 onepixel sshd[2021867]: Failed password for root from 101.71.51.192 port 35375 ssh2
Sep  5 23:04:41 onepixel sshd[2022337]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=101.71.51.192  user=root
Sep  5 23:04:44 onepixel sshd[2022337]: Failed password for root from 101.71.51.192 port 55138 ssh2

Automatic report - Port Scan Attack

Port Scan: TCP/443

2375/tcp 6930/tcp 4331/tcp...
[2020-08-25/09-06]12pkt,11pt.(tcp),1pt.(udp)

2020-09-06T01:12:38.116499centos sshd[25976]: Failed password for root from 39.115.113.146 port 24006 ssh2
2020-09-06T01:16:14.067359centos sshd[26162]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=39.115.113.146  user=root
2020-09-06T01:16:16.460030centos sshd[26162]: Failed password for root from 39.115.113.146 port 28961 ssh2
...

Sep  6 06:29:22 sso sshd[27532]: Failed password for root from 106.12.74.23 port 36004 ssh2
...

Lines containing failures of 103.87.28.153
Sep  1 03:33:36 newdogma sshd[1000]: Invalid user prasad from 103.87.28.153 port 48706
Sep  1 03:33:36 newdogma sshd[1000]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.87.28.153 
Sep  1 03:33:38 newdogma sshd[1000]: Failed password for invalid user prasad from 103.87.28.153 port 48706 ssh2
Sep  1 03:33:40 newdogma sshd[1000]: Received disconnect from 103.87.28.153 port 48706:11: Bye Bye [preauth]
Sep  1 03:33:40 newdogma sshd[1000]: Disconnected from invalid user prasad 103.87.28.153 port 48706 [preauth]
Sep  1 03:48:45 newdogma sshd[5849]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.87.28.153  user=r.r
Sep  1 03:48:48 newdogma sshd[5849]: Failed password for r.r from 103.87.28.153 port 39584 ssh2
Sep  1 03:48:49 newdogma sshd[5849]: Received disconnect from 103.87.28.153 port 39584:11: Bye Bye [preauth]
Sep  1 03:48:49 newdogma sshd[........
------------------------------

2020-09-06T00:09:27.9659921495-001 sshd[21741]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=p54b4eca4.dip0.t-ipconnect.de  user=root
2020-09-06T00:09:29.5690761495-001 sshd[21741]: Failed password for root from 84.180.236.164 port 34924 ssh2
2020-09-06T00:12:55.4966661495-001 sshd[21882]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=p54b4eca4.dip0.t-ipconnect.de  user=root
2020-09-06T00:12:57.3205851495-001 sshd[21882]: Failed password for root from 84.180.236.164 port 46371 ssh2
2020-09-06T00:16:25.3998781495-001 sshd[22020]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=p54b4eca4.dip0.t-ipconnect.de  user=root
2020-09-06T00:16:27.7207501495-001 sshd[22020]: Failed password for root from 84.180.236.164 port 54135 ssh2
...

srv02 Mass scanning activity detected Target: 9200  ..

RDP brute force attack detected by fail2ban

...

Sep  6 06:38:07 marvibiene sshd[2828]: Failed password for root from 222.186.175.163 port 56906 ssh2
Sep  6 06:38:10 marvibiene sshd[2828]: Failed password for root from 222.186.175.163 port 56906 ssh2