[2020-09-16 17:11:19] NOTICE[1239] chan_sip.c: Registration from '"138"' failed for '195.206.107.154:6085' - Wrong password
[2020-09-16 17:11:19] SECURITY[1264] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-09-16T17:11:19.507-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="138",SessionID="0x7f4d480d6c18",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/195.206.107.154/6085",Challenge="09451f9c",ReceivedChallenge="09451f9c",ReceivedHash="eb89dedf189c146f799bff821edc1d8d"
[2020-09-16 17:16:03] NOTICE[1239] chan_sip.c: Registration from '"139"' failed for '195.206.107.154:15253' - Wrong password
[2020-09-16 17:16:03] SECURITY[1264] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-09-16T17:16:03.338-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="139",SessionID="0x7f4d480d6c18",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/195
...

Unauthorized connection attempt from IP address 160.178.254.157 on Port 445(SMB)

(sshd) Failed SSH login from 181.129.14.218 (CO/Colombia/adsl-181-129-14-218.une.net.co): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Sep 17 18:39:07 amsweb01 sshd[20887]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.129.14.218  user=root
Sep 17 18:39:08 amsweb01 sshd[20887]: Failed password for root from 181.129.14.218 port 63070 ssh2
Sep 17 18:42:01 amsweb01 sshd[21334]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.129.14.218  user=root
Sep 17 18:42:03 amsweb01 sshd[21334]: Failed password for root from 181.129.14.218 port 15173 ssh2
Sep 17 18:44:19 amsweb01 sshd[21892]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.129.14.218  user=root

Sep 17 14:53:36 Ubuntu-1404-trusty-64-minimal sshd\[24750\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=140.143.39.177  user=root
Sep 17 14:53:37 Ubuntu-1404-trusty-64-minimal sshd\[24750\]: Failed password for root from 140.143.39.177 port 24153 ssh2
Sep 17 15:06:24 Ubuntu-1404-trusty-64-minimal sshd\[30606\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=140.143.39.177  user=root
Sep 17 15:06:27 Ubuntu-1404-trusty-64-minimal sshd\[30606\]: Failed password for root from 140.143.39.177 port 49195 ssh2
Sep 17 15:10:45 Ubuntu-1404-trusty-64-minimal sshd\[6700\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=140.143.39.177  user=root

Sep 17 16:31:54 marvibiene sshd[23867]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.204.204.72  user=root
Sep 17 16:31:56 marvibiene sshd[23867]: Failed password for root from 111.204.204.72 port 59037 ssh2
Sep 17 16:40:35 marvibiene sshd[23962]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.204.204.72  user=root
Sep 17 16:40:37 marvibiene sshd[23962]: Failed password for root from 111.204.204.72 port 42324 ssh2

Listed on    zen-spamhaus   / proto=6  .  srcport=23958  .  dstport=1433  .     (1107)

Honeypot attack, port: 445, PTR: PTR record not found

2020-09-17T05:19:38.1609091495-001 sshd[58242]: Failed password for root from 106.12.201.16 port 52928 ssh2
2020-09-17T05:24:05.4570921495-001 sshd[58411]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.201.16  user=root
2020-09-17T05:24:07.7138971495-001 sshd[58411]: Failed password for root from 106.12.201.16 port 58044 ssh2
2020-09-17T05:28:36.7506271495-001 sshd[58620]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.201.16  user=root
2020-09-17T05:28:39.5425861495-001 sshd[58620]: Failed password for root from 106.12.201.16 port 34936 ssh2
2020-09-17T05:33:06.7111611495-001 sshd[58795]: Invalid user pollo from 106.12.201.16 port 40054
...

Honeypot attack, port: 445, PTR: 145.255.5.101.static.ufanet.ru.

Cluster member 178.17.174.160 (MD/Republic of Moldova/Chișinău Municipality/Chisinau/kiv.hlex.pw/[AS43289 I.C.S. Trabia-Network S.R.L.]) said, TEMPDENY 51.81.238.115, Reason:[(sshd) Failed SSH login from 51.81.238.115 (US/United States/-/-/ip115.ip-51-81-238.us/[AS16276 OVH SAS]): 1 in the last 3600 secs]; Ports: *; Direction: inout; Trigger: LF_CLUSTER; Logs:

Sep 17 18:39:59 minden010 sshd[6230]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.95.6.110
Sep 17 18:40:01 minden010 sshd[6230]: Failed password for invalid user user from 192.95.6.110 port 43619 ssh2
Sep 17 18:43:51 minden010 sshd[7453]: Failed password for root from 192.95.6.110 port 48482 ssh2
...

Fail2Ban Ban Triggered
Wordpress Attack Attempt

2020-09-17T20:20:06.628671afi-git.jinr.ru sshd[20347]: Failed password for root from 222.186.175.216 port 54674 ssh2
2020-09-17T20:20:11.421393afi-git.jinr.ru sshd[20347]: Failed password for root from 222.186.175.216 port 54674 ssh2
2020-09-17T20:20:14.714834afi-git.jinr.ru sshd[20347]: Failed password for root from 222.186.175.216 port 54674 ssh2
2020-09-17T20:20:14.714957afi-git.jinr.ru sshd[20347]: error: maximum authentication attempts exceeded for root from 222.186.175.216 port 54674 ssh2 [preauth]
2020-09-17T20:20:14.714972afi-git.jinr.ru sshd[20347]: Disconnecting: Too many authentication failures [preauth]
...

Hits on port : 23

Sep 17 12:13:38 lanister sshd[18039]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.130.242  user=root
Sep 17 12:13:40 lanister sshd[18039]: Failed password for root from 51.38.130.242 port 55940 ssh2
Sep 17 12:17:44 lanister sshd[18107]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.130.242  user=root
Sep 17 12:17:47 lanister sshd[18107]: Failed password for root from 51.38.130.242 port 39562 ssh2