[2020-09-04 11:57:02] NOTICE[1194] chan_sip.c: Registration from '' failed for '185.147.215.8:51867' - Wrong password
[2020-09-04 11:57:02] SECURITY[1233] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-09-04T11:57:02.247-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="6046",SessionID="0x7f2ddc1178e8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/185.147.215.8/51867",Challenge="52fc5cf6",ReceivedChallenge="52fc5cf6",ReceivedHash="e638b212d69e9107bd91f00f631020c9"
[2020-09-04 11:57:41] NOTICE[1194] chan_sip.c: Registration from '' failed for '185.147.215.8:64093' - Wrong password
[2020-09-04 11:57:41] SECURITY[1233] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-09-04T11:57:41.666-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="2964",SessionID="0x7f2ddc1b7848",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/185.147.215.8
...

Sep  4 10:32:44 master sshd[3351]: Failed password for invalid user ftp1 from 118.69.71.106 port 45411 ssh2

ET DROP Dshield Block Listed Source group 1 - port: 33391 proto: tcp cat: Misc Attackbytes: 60

Sep  4 09:21:48 mail sshd\[5180\]: Invalid user joaquim from 176.106.132.131
...

Honeypot attack, port: 445, PTR: PTR record not found

Sep  3 19:47:52 srv01 postfix/smtpd\[25076\]: warning: unknown\[117.69.154.5\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Sep  3 19:51:18 srv01 postfix/smtpd\[308\]: warning: unknown\[117.69.154.5\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Sep  3 19:54:45 srv01 postfix/smtpd\[775\]: warning: unknown\[117.69.154.5\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Sep  3 19:54:57 srv01 postfix/smtpd\[775\]: warning: unknown\[117.69.154.5\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Sep  3 19:55:13 srv01 postfix/smtpd\[775\]: warning: unknown\[117.69.154.5\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
...

2020-09-04 18:08:40 dovecot_login authenticator failed for \(User\) \[45.142.120.166\]: 535 Incorrect authentication data \(set_id=staging2@no-server.de\)
2020-09-04 18:08:51 dovecot_login authenticator failed for \(User\) \[45.142.120.166\]: 535 Incorrect authentication data \(set_id=staging2@no-server.de\)
2020-09-04 18:09:12 dovecot_login authenticator failed for \(User\) \[45.142.120.166\]: 535 Incorrect authentication data \(set_id=88888888@no-server.de\)
2020-09-04 18:09:26 dovecot_login authenticator failed for \(User\) \[45.142.120.166\]: 535 Incorrect authentication data \(set_id=88888888@no-server.de\)
2020-09-04 18:09:46 dovecot_login authenticator failed for \(User\) \[45.142.120.166\]: 535 Incorrect authentication data \(set_id=ryp@no-server.de\)
2020-09-04 18:09:48 dovecot_login authenticator failed for \(User\) \[45.142.120.166\]: 535 Incorrect authentication data \(set_id=ryp@no-server.de\)
2020-09-04 18:10:21 dovecot_login authenticator failed for \(User\) \[45.142.120
...

Sep  4 18:06:08 v22019038103785759 sshd\[32120\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.173.154  user=root
Sep  4 18:06:10 v22019038103785759 sshd\[32120\]: Failed password for root from 222.186.173.154 port 34160 ssh2
Sep  4 18:06:13 v22019038103785759 sshd\[32120\]: Failed password for root from 222.186.173.154 port 34160 ssh2
Sep  4 18:06:16 v22019038103785759 sshd\[32120\]: Failed password for root from 222.186.173.154 port 34160 ssh2
Sep  4 18:06:20 v22019038103785759 sshd\[32120\]: Failed password for root from 222.186.173.154 port 34160 ssh2
...

20/9/3@15:35:26: FAIL: Alarm-Network address from=36.89.21.177
20/9/3@15:35:27: FAIL: Alarm-Network address from=36.89.21.177
...

fail2ban - Attack against Apache (too many 404s)

Sep  3 18:46:34 mellenthin postfix/smtpd[20681]: NOQUEUE: reject: RCPT from unknown[177.248.205.218]: 554 5.7.1 Service unavailable; Client host [177.248.205.218] blocked using zen.spamhaus.org; https://www.spamhaus.org/query/ip/177.248.205.218; from= to= proto=ESMTP helo=<177.248.205.218-clientes-zap-izzi.mx>

141.98.252.163 (GB/United Kingdom/-), 5 distributed sshd attacks on account [root] in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_DISTATTACK; Logs: Sep  4 10:44:55 server2 sshd[9654]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=141.98.252.163  user=root
Sep  4 10:44:57 server2 sshd[9654]: Failed password for root from 141.98.252.163 port 47914 ssh2
Sep  4 10:57:31 server2 sshd[17751]: Failed password for root from 187.16.96.35 port 58624 ssh2
Sep  4 10:59:30 server2 sshd[18748]: Failed password for root from 185.220.103.9 port 43400 ssh2
Sep  4 10:46:08 server2 sshd[10584]: Failed password for root from 195.154.179.3 port 35744 ssh2

IP Addresses Blocked:

Sep  4 09:39:44 h2646465 sshd[28981]: Invalid user 01 from 106.13.226.112
Sep  4 09:39:44 h2646465 sshd[28981]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.226.112
Sep  4 09:39:44 h2646465 sshd[28981]: Invalid user 01 from 106.13.226.112
Sep  4 09:39:45 h2646465 sshd[28981]: Failed password for invalid user 01 from 106.13.226.112 port 40028 ssh2
Sep  4 09:45:29 h2646465 sshd[30266]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.226.112  user=root
Sep  4 09:45:32 h2646465 sshd[30266]: Failed password for root from 106.13.226.112 port 57834 ssh2
Sep  4 09:46:23 h2646465 sshd[30320]: Invalid user administrator from 106.13.226.112
Sep  4 09:46:23 h2646465 sshd[30320]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.226.112
Sep  4 09:46:23 h2646465 sshd[30320]: Invalid user administrator from 106.13.226.112
Sep  4 09:46:24 h2646465 sshd[30320]: Failed password for inval

2020-09-04T18:17:22+0200 Failed SSH Authentication/Brute Force Attack. (Server 9)

20/9/3@12:46:37: FAIL: Alarm-Intrusion address from=201.211.77.225
...