firewall-block, port(s): 445/tcp

SSH Brute Force, server-1 sshd[31349]: Failed password for invalid user eki from 61.28.233.85 port 50004 ssh2

Aug  6 23:25:38 lumpi kernel: INPUT:DROP:SPAMHAUS_EDROP:IN=eth0 OUT= MAC=52:54:a2:01:a5:04:d2:74:7f:6e:37:e3:08:00 SRC=81.22.45.148 DST=172.31.1.100 LEN=40 TOS=0x00 PREC=0x00 TTL=244 ID=40784 PROTO=TCP SPT=52666 DPT=9887 WINDOW=1024 RES=0x00 SYN URGP=0 
...

Aug  6 23:50:22 bouncer sshd\[10485\]: Invalid user elasticsearch from 164.68.108.34 port 45136
Aug  6 23:50:22 bouncer sshd\[10485\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.68.108.34 
Aug  6 23:50:25 bouncer sshd\[10485\]: Failed password for invalid user elasticsearch from 164.68.108.34 port 45136 ssh2
...

3389BruteforceFW23

firewall-block, port(s): 5903/tcp

Aug  7 03:02:31 vibhu-HP-Z238-Microtower-Workstation sshd\[17592\]: Invalid user admin from 1.217.98.44
Aug  7 03:02:31 vibhu-HP-Z238-Microtower-Workstation sshd\[17592\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.217.98.44
Aug  7 03:02:33 vibhu-HP-Z238-Microtower-Workstation sshd\[17592\]: Failed password for invalid user admin from 1.217.98.44 port 46670 ssh2
Aug  7 03:07:43 vibhu-HP-Z238-Microtower-Workstation sshd\[17707\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.217.98.44  user=root
Aug  7 03:07:45 vibhu-HP-Z238-Microtower-Workstation sshd\[17707\]: Failed password for root from 1.217.98.44 port 41864 ssh2
...

firewall-block, port(s): 8182/tcp

failed_logins

Aug  6 21:36:49 tux-35-217 sshd\[14378\]: Invalid user user from 178.128.215.16 port 59578
Aug  6 21:36:49 tux-35-217 sshd\[14378\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.215.16
Aug  6 21:36:52 tux-35-217 sshd\[14378\]: Failed password for invalid user user from 178.128.215.16 port 59578 ssh2
Aug  6 21:41:42 tux-35-217 sshd\[14395\]: Invalid user sfarris from 178.128.215.16 port 53962
Aug  6 21:41:42 tux-35-217 sshd\[14395\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.215.16
...

2019-08-06T21:50:13.422640abusebot-8.cloudsearch.cf sshd\[7810\]: Invalid user maja from 47.188.154.94 port 57345

X-Originating-IP: [80.248.181.42]
Received: from 10.214.173.215  (EHLO mail1.workcircle.net) (80.248.181.42)
  by mta4209.mail.gq1.yahoo.com with SMTP; Tue, 06 Aug 2019 10:52:07 +0000
Received: from cvsadmin by mail1.workcircle.net with local (Exim 4.77)
	(envelope-from )
	id 1hux4Y-0007Dy-KC
	for cemalkaraatli@yahoo.com; Tue, 06 Aug 2019 11:52:06 +0100
From: WorkCircle 
Reply-to: help@workcircle.com
Subject: 4  Great new jobs in Turkey for you!
Mime-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: 7bit

@LucianNitescu Personal Honeypot Network <<<>>> Donate at paypal.me/LNitescu <<<>>> 2019-08-06 21:12:46,224 INFO [shellcode_manager] (103.66.79.245) no match, writing hexdump (cc4271b64fe06edccba4149eb014dc29 :1881051) - MS17010 (EternalBlue)

Aug  6 21:44:51 localhost sshd\[31872\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.243.117.67  user=root
Aug  6 21:44:53 localhost sshd\[31872\]: Failed password for root from 118.243.117.67 port 44600 ssh2
Aug  6 21:50:14 localhost sshd\[32011\]: Invalid user nc from 118.243.117.67 port 54448
Aug  6 21:50:14 localhost sshd\[32011\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.243.117.67
Aug  6 21:50:16 localhost sshd\[32011\]: Failed password for invalid user nc from 118.243.117.67 port 54448 ssh2
...

Aug  6 23:50:13 host sshd\[5410\]: Invalid user od from 106.12.132.3 port 39314
Aug  6 23:50:13 host sshd\[5410\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.132.3
...