\[2019-09-09 13:09:33\] NOTICE\[1827\] chan_sip.c: Registration from '\' failed for '185.93.2.107:4031' - Wrong password
\[2019-09-09 13:09:33\] SECURITY\[1849\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-09-09T13:09:33.268-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="1800",SessionID="0x7fd9a8585a18",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/185.93.2.107/59211",Challenge="49d12a56",ReceivedChallenge="49d12a56",ReceivedHash="534ce75d07e1010d0067cdbf4825c60d"
\[2019-09-09 13:09:47\] NOTICE\[1827\] chan_sip.c: Registration from '\' failed for '185.93.2.107:4005' - Wrong password
\[2019-09-09 13:09:47\] SECURITY\[1849\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-09-09T13:09:47.809-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="1801",SessionID="0x7fd9a84259e8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/185.93.2.107/5

Probing for paths and vulnerable files.

...

Automatic report - Port Scan Attack

Potential Directory Traversal Attempt.

Potential Directory Traversal Attempt.

email spam

$f2bV_matches

IP Ban Report :  
 https://help-dysk.pl/wordpress-firewall-plugins/ip/185.93.240.50/ 
 
 PL - 1H : (141)  
 Protection Against DDoS WordPress plugin :  
 "odzyskiwanie danych help-dysk" 
 IP Address Ranges by Country : PL 
 NAME ASN : ASN199341 
 
 IP : 185.93.240.50 
 
 CIDR : 185.93.240.0/23 
 
 PREFIX COUNT : 2 
 
 UNIQUE IP COUNT : 768 
 
 
 ATTACKS DETECTED ASN199341 :  
  1H - 1 
  3H - 1 
  6H - 1 
 12H - 1 
 24H - 1 
 
 DateTime : 2019-11-04 15:33:27 
 
 INFO : Server 403 - Looking for resource vulnerabilities Detected and Blocked by ADMIN  - data recovery

/wp-content/themes/satoshi/upload-file.php

Trying to authenticate to my phone servers....

\[2019-09-07 18:57:27\] NOTICE\[1827\] chan_sip.c: Registration from '\' failed for '185.93.2.120:3095' - Wrong password
\[2019-09-07 18:57:27\] SECURITY\[1849\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-09-07T18:57:27.712-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="1047",SessionID="0x7fd9a81ef8c8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/185.93.2.120/58698",Challenge="71844197",ReceivedChallenge="71844197",ReceivedHash="1c7abb35a691e3cdc27d9f139e78bd08"
\[2019-09-07 18:57:59\] NOTICE\[1827\] chan_sip.c: Registration from '\' failed for '185.93.2.120:3176' - Wrong password
\[2019-09-07 18:57:59\] SECURITY\[1849\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-09-07T18:57:59.694-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="6035",SessionID="0x7fd9a8123cd8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/185.93.2.120/6

\[2019-09-06 11:15:44\] NOTICE\[1827\] chan_sip.c: Registration from '\' failed for '185.93.2.120:3102' - Wrong password
\[2019-09-06 11:15:44\] SECURITY\[1849\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-09-06T11:15:44.759-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="7714",SessionID="0x7fd9a8123d68",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/185.93.2.120/50116",Challenge="6825abcd",ReceivedChallenge="6825abcd",ReceivedHash="5acd617ecf318337a02562fcf997f51f"
\[2019-09-06 11:16:18\] NOTICE\[1827\] chan_sip.c: Registration from '\' failed for '185.93.2.120:3075' - Wrong password
\[2019-09-06 11:16:18\] SECURITY\[1849\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-09-06T11:16:18.542-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="8872",SessionID="0x7fd9a8197648",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/185.93.2.120/6

\[2019-09-06 09:27:14\] NOTICE\[1827\] chan_sip.c: Registration from '\' failed for '185.93.2.120:3170' - Wrong password
\[2019-09-06 09:27:14\] SECURITY\[1849\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-09-06T09:27:14.146-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="7024",SessionID="0x7fd9a8197648",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/185.93.2.120/61665",Challenge="6853dd65",ReceivedChallenge="6853dd65",ReceivedHash="f4ded4212337ca2b549e3bcafe663712"
\[2019-09-06 09:27:47\] NOTICE\[1827\] chan_sip.c: Registration from '\' failed for '185.93.2.120:3070' - Wrong password
\[2019-09-06 09:27:47\] SECURITY\[1849\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-09-06T09:27:47.778-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="6460",SessionID="0x7fd9a8197648",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/185.93.2.120/5

\[2019-09-04 02:43:07\] NOTICE\[1829\] chan_sip.c: Registration from '\' failed for '185.93.2.120:3197' - Wrong password
\[2019-09-04 02:43:07\] SECURITY\[1837\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-09-04T02:43:07.461-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="4896",SessionID="0x7f7b30086e68",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/185.93.2.120/61027",Challenge="36963853",ReceivedChallenge="36963853",ReceivedHash="e3e82f2ca29ae53dc7530b9229408cc8"
\[2019-09-04 02:43:40\] NOTICE\[1829\] chan_sip.c: Registration from '\' failed for '185.93.2.120:3076' - Wrong password
\[2019-09-04 02:43:40\] SECURITY\[1837\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-09-04T02:43:40.203-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="3626",SessionID="0x7f7b30086e68",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/185.93.2.120/5

\[2019-09-02 19:30:53\] NOTICE\[1829\] chan_sip.c: Registration from '\' failed for '185.93.2.120:3001' - Wrong password
\[2019-09-02 19:30:53\] SECURITY\[1837\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-09-02T19:30:53.099-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="4621",SessionID="0x7f7b30db7498",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/185.93.2.120/59516",Challenge="4f908abc",ReceivedChallenge="4f908abc",ReceivedHash="21c975d3d2029079bddc033db70ed959"
\[2019-09-02 19:31:26\] NOTICE\[1829\] chan_sip.c: Registration from '\' failed for '185.93.2.120:3126' - Wrong password
\[2019-09-02 19:31:26\] SECURITY\[1837\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-09-02T19:31:26.015-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="9209",SessionID="0x7f7b30133f58",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/185.93.2.120/5

Jul 12 10:38:24 vps691689 sshd[28724]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.89.19.147
Jul 12 10:38:25 vps691689 sshd[28724]: Failed password for invalid user oracle from 51.89.19.147 port 53620 ssh2
...

11.07.2019 23:54:06 Connection to port 6379 blocked by firewall

Jul 12 10:23:29 legacy sshd[2279]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=24.44.24.139
Jul 12 10:23:31 legacy sshd[2279]: Failed password for invalid user designer from 24.44.24.139 port 50694 ssh2
Jul 12 10:30:07 legacy sshd[2445]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=24.44.24.139
...

[portscan] Port scan

Jul 12 10:46:52 mail sshd\[3075\]: Invalid user db2inst2 from 106.12.214.21 port 60128
Jul 12 10:46:52 mail sshd\[3075\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.214.21
Jul 12 10:46:54 mail sshd\[3075\]: Failed password for invalid user db2inst2 from 106.12.214.21 port 60128 ssh2
Jul 12 10:52:18 mail sshd\[4125\]: Invalid user mis from 106.12.214.21 port 52206
Jul 12 10:52:18 mail sshd\[4125\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.214.21

12.07.2019 01:53:24 - Wordpress fail 
Detected by ELinOX-ALM

Jul 12 13:42:23 vibhu-HP-Z238-Microtower-Workstation sshd\[22779\]: Invalid user support from 140.143.53.145
Jul 12 13:42:23 vibhu-HP-Z238-Microtower-Workstation sshd\[22779\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=140.143.53.145
Jul 12 13:42:25 vibhu-HP-Z238-Microtower-Workstation sshd\[22779\]: Failed password for invalid user support from 140.143.53.145 port 18304 ssh2
Jul 12 13:48:44 vibhu-HP-Z238-Microtower-Workstation sshd\[24021\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=140.143.53.145  user=root
Jul 12 13:48:46 vibhu-HP-Z238-Microtower-Workstation sshd\[24021\]: Failed password for root from 140.143.53.145 port 11211 ssh2
...

Jul 12 09:52:37 SilenceServices sshd[3091]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.35.101.107
Jul 12 09:52:39 SilenceServices sshd[3091]: Failed password for invalid user guest from 121.35.101.107 port 6218 ssh2
Jul 12 09:56:37 SilenceServices sshd[5799]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.35.101.107

@LucianNitescu Personal Honeypot Network <<<>>> Donate at paypal.me/LNitescu <<<>>> 2019-07-11 23:41:01,527 INFO [amun_request_handler] PortScan Detected on Port: 445 (91.194.163.228)

Automated report - ssh fail2ban:
Jul 12 10:38:55 authentication failure 
Jul 12 10:38:57 wrong password, user=panda, port=54536, ssh2
Jul 12 10:44:01 authentication failure

Jul 12 10:49:39 eventyay sshd[13652]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.89.194.149
Jul 12 10:49:41 eventyay sshd[13652]: Failed password for invalid user common from 159.89.194.149 port 36724 ssh2
Jul 12 10:55:32 eventyay sshd[15191]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.89.194.149
...

[portscan] tcp/22 [SSH]
*(RWIN=52484)(07121009)

$f2bV_matches

Jul 12 10:42:22 OPSO sshd\[14285\]: Invalid user kevin from 193.112.213.48 port 44874
Jul 12 10:42:22 OPSO sshd\[14285\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.112.213.48
Jul 12 10:42:24 OPSO sshd\[14285\]: Failed password for invalid user kevin from 193.112.213.48 port 44874 ssh2
Jul 12 10:45:14 OPSO sshd\[14598\]: Invalid user rw from 193.112.213.48 port 43760
Jul 12 10:45:14 OPSO sshd\[14598\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.112.213.48

Jul 12 03:58:00 aat-srv002 sshd[7759]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.236.221
Jul 12 03:58:02 aat-srv002 sshd[7759]: Failed password for invalid user servidor from 51.38.236.221 port 37324 ssh2
Jul 12 04:02:54 aat-srv002 sshd[7944]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.236.221
Jul 12 04:02:55 aat-srv002 sshd[7944]: Failed password for invalid user upload from 51.38.236.221 port 39528 ssh2
...