(pop3d) Failed POP3 login from 162.213.38.67 (US/United States/host-67-38.213.162.cloudsigma.net): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Aug  6 01:07:25 ir1 dovecot[3110802]: pop3-login: Aborted login (auth failed, 1 attempts in 2 secs): user=, method=PLAIN, rip=162.213.38.67, lip=5.63.12.44, session=

Aug  5 22:13:54 Ubuntu-1404-trusty-64-minimal sshd\[1055\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=132.232.68.138  user=root
Aug  5 22:13:56 Ubuntu-1404-trusty-64-minimal sshd\[1055\]: Failed password for root from 132.232.68.138 port 57416 ssh2
Aug  5 22:28:49 Ubuntu-1404-trusty-64-minimal sshd\[9688\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=132.232.68.138  user=root
Aug  5 22:28:51 Ubuntu-1404-trusty-64-minimal sshd\[9688\]: Failed password for root from 132.232.68.138 port 45608 ssh2
Aug  5 22:38:27 Ubuntu-1404-trusty-64-minimal sshd\[18204\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=132.232.68.138  user=root

(sshd) Failed SSH login from 188.131.141.28 (CN/China/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Aug  6 01:34:44 amsweb01 sshd[19827]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.131.141.28  user=root
Aug  6 01:34:45 amsweb01 sshd[19827]: Failed password for root from 188.131.141.28 port 56656 ssh2
Aug  6 01:39:18 amsweb01 sshd[20457]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.131.141.28  user=root
Aug  6 01:39:20 amsweb01 sshd[20457]: Failed password for root from 188.131.141.28 port 58950 ssh2
Aug  6 01:42:30 amsweb01 sshd[20930]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.131.141.28  user=root

Aug  5 22:38:26 debian-2gb-nbg1-2 kernel: \[18918365.380374\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=114.33.149.24 DST=195.201.40.59 LEN=44 TOS=0x00 PREC=0x00 TTL=51 ID=43254 PROTO=TCP SPT=58749 DPT=23 WINDOW=65125 RES=0x00 SYN URGP=0

Connection to SSH Honeypot - Detected by HoneypotDB

Aug  5 23:11:18 ip-172-31-61-156 sshd[17394]: Failed password for root from 119.90.61.10 port 35356 ssh2
Aug  5 23:15:28 ip-172-31-61-156 sshd[17617]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.90.61.10  user=root
Aug  5 23:15:30 ip-172-31-61-156 sshd[17617]: Failed password for root from 119.90.61.10 port 41496 ssh2
Aug  5 23:19:34 ip-172-31-61-156 sshd[17804]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.90.61.10  user=root
Aug  5 23:19:37 ip-172-31-61-156 sshd[17804]: Failed password for root from 119.90.61.10 port 47634 ssh2
...

SSH Brute Force

Aug  5 13:35:11 pixelmemory sshd[3929404]: Failed password for root from 112.172.147.34 port 19145 ssh2
Aug  5 13:36:42 pixelmemory sshd[3933618]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.172.147.34  user=root
Aug  5 13:36:43 pixelmemory sshd[3933618]: Failed password for root from 112.172.147.34 port 42023 ssh2
Aug  5 13:38:13 pixelmemory sshd[3938501]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.172.147.34  user=root
Aug  5 13:38:15 pixelmemory sshd[3938501]: Failed password for root from 112.172.147.34 port 64899 ssh2
...

Virus

Aug  5 19:15:00 ws24vmsma01 sshd[64820]: Failed password for root from 142.93.34.237 port 44270 ssh2
...

Aug  4 07:50:22 server770 sshd[8735]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.126.105.190  user=r.r
Aug  4 07:50:24 server770 sshd[8735]: Failed password for r.r from 118.126.105.190 port 42846 ssh2
Aug  4 07:50:24 server770 sshd[8735]: Received disconnect from 118.126.105.190 port 42846:11: Bye Bye [preauth]
Aug  4 07:50:24 server770 sshd[8735]: Disconnected from 118.126.105.190 port 42846 [preauth]
Aug  4 08:08:34 server770 sshd[8934]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.126.105.190  user=r.r
Aug  4 08:08:35 server770 sshd[8934]: Failed password for r.r from 118.126.105.190 port 47534 ssh2
Aug  4 08:08:35 server770 sshd[8934]: Received disconnect from 118.126.105.190 port 47534:11: Bye Bye [preauth]
Aug  4 08:08:35 server770 sshd[8934]: Disconnected from 118.126.105.190 port 47534 [preauth]
Aug  4 08:12:01 server770 sshd[9136]: pam_unix(sshd:auth): authenticatio........
-------------------------------

40.121.150.84 - - [05/Aug/2020:22:37:39 +0200] "GET /../login/ HTTP/1.1" 400 3655 "-" "Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"

Attempted Brute Force (dovecot)

Aug  6 00:41:15 marvibiene sshd[26642]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=87.251.122.178 
Aug  6 00:41:17 marvibiene sshd[26642]: Failed password for invalid user Welcome7 from 87.251.122.178 port 41916 ssh2

Aug  5 22:28:37 vserver sshd\[16123\]: Invalid user !@\#$!@\#$ from 212.95.137.164Aug  5 22:28:39 vserver sshd\[16123\]: Failed password for invalid user !@\#$!@\#$ from 212.95.137.164 port 53460 ssh2Aug  5 22:37:59 vserver sshd\[16219\]: Invalid user paSsWoRD from 212.95.137.164Aug  5 22:38:00 vserver sshd\[16219\]: Failed password for invalid user paSsWoRD from 212.95.137.164 port 36002 ssh2
...