Threat Management Alert 1: Attempted Administrator Privilege Gain. Signature ET EXPLOIT MVPower DVR Shell UCE. From: 73.176.242.136:33454, to: 192.168.4.99:80, protocol: TCP

2020-09-07T12:22:33.807046abusebot-2.cloudsearch.cf sshd[3365]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=tor-exit.critical.cat  user=root
2020-09-07T12:22:35.605553abusebot-2.cloudsearch.cf sshd[3365]: Failed password for root from 46.182.106.190 port 39590 ssh2
2020-09-07T12:22:38.046458abusebot-2.cloudsearch.cf sshd[3365]: Failed password for root from 46.182.106.190 port 39590 ssh2
2020-09-07T12:22:33.807046abusebot-2.cloudsearch.cf sshd[3365]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=tor-exit.critical.cat  user=root
2020-09-07T12:22:35.605553abusebot-2.cloudsearch.cf sshd[3365]: Failed password for root from 46.182.106.190 port 39590 ssh2
2020-09-07T12:22:38.046458abusebot-2.cloudsearch.cf sshd[3365]: Failed password for root from 46.182.106.190 port 39590 ssh2
2020-09-07T12:22:33.807046abusebot-2.cloudsearch.cf sshd[3365]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0
...

[2020-09-07 08:21:45] NOTICE[1194] chan_sip.c: Registration from '' failed for '51.195.7.14:61767' - Wrong password
[2020-09-07 08:21:45] SECURITY[1233] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-09-07T08:21:45.823-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="131",SessionID="0x7f2ddc332e38",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/51.195.7.14/61767",Challenge="6aebd5a9",ReceivedChallenge="6aebd5a9",ReceivedHash="2800fe009e4e64d9bd95a3d2cfceceaf"
[2020-09-07 08:22:02] NOTICE[1194] chan_sip.c: Registration from '' failed for '51.195.7.14:55250' - Wrong password
[2020-09-07 08:22:02] SECURITY[1233] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-09-07T08:22:02.810-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="93000",SessionID="0x7f2ddc52c198",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/51.195.7.14/55250",
...

Sep  7 12:36:18 nextcloud sshd\[9425\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.187.54.45  user=root
Sep  7 12:36:20 nextcloud sshd\[9425\]: Failed password for root from 37.187.54.45 port 44988 ssh2
Sep  7 12:39:47 nextcloud sshd\[12371\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.187.54.45  user=root

Sep  7 04:39:56 hurricane sshd[23671]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.52.90.84  user=r.r
Sep  7 04:39:57 hurricane sshd[23671]: Failed password for r.r from 106.52.90.84 port 34554 ssh2
Sep  7 04:39:58 hurricane sshd[23671]: Received disconnect from 106.52.90.84 port 34554:11: Bye Bye [preauth]
Sep  7 04:39:58 hurricane sshd[23671]: Disconnected from 106.52.90.84 port 34554 [preauth]
Sep  7 04:52:36 hurricane sshd[23722]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.52.90.84  user=r.r
Sep  7 04:52:38 hurricane sshd[23722]: Failed password for r.r from 106.52.90.84 port 45038 ssh2
Sep  7 04:52:38 hurricane sshd[23722]: Received disconnect from 106.52.90.84 port 45038:11: Bye Bye [preauth]
Sep  7 04:52:38 hurricane sshd[23722]: Disconnected from 106.52.90.84 port 45038 [preauth]
Sep  7 04:56:10 hurricane sshd[23736]: pam_unix(sshd:auth): authentication failure; logn........
-------------------------------

Icarus honeypot on github

167.71.224.156 - - [06/Sep/2020:10:54:47 -0600] "GET /wp-login.php HTTP/1.1" 301 480 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
...

Honeypot attack, port: 445, PTR: 200.84.250-201.dyn.dsl.cantv.net.

Sep  7 08:18:57 NPSTNNYC01T sshd[31511]: Failed password for root from 218.92.0.145 port 20004 ssh2
Sep  7 08:19:11 NPSTNNYC01T sshd[31511]: error: maximum authentication attempts exceeded for root from 218.92.0.145 port 20004 ssh2 [preauth]
Sep  7 08:19:19 NPSTNNYC01T sshd[31532]: Failed password for root from 218.92.0.145 port 30432 ssh2
...

Sep  7 10:52:00 ns382633 sshd\[19205\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.22.212.99  user=root
Sep  7 10:52:02 ns382633 sshd\[19205\]: Failed password for root from 123.22.212.99 port 64323 ssh2
Sep  7 11:02:07 ns382633 sshd\[21020\]: Invalid user kosmos from 123.22.212.99 port 58254
Sep  7 11:02:07 ns382633 sshd\[21020\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.22.212.99
Sep  7 11:02:10 ns382633 sshd\[21020\]: Failed password for invalid user kosmos from 123.22.212.99 port 58254 ssh2

2020-09-07T10:42:13.925509shield sshd\[20232\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=141.98.9.162  user=operator
2020-09-07T10:42:16.277997shield sshd\[20232\]: Failed password for operator from 141.98.9.162 port 34754 ssh2
2020-09-07T10:42:36.052129shield sshd\[20363\]: Invalid user support from 141.98.9.162 port 45368
2020-09-07T10:42:36.061141shield sshd\[20363\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=141.98.9.162
2020-09-07T10:42:38.236990shield sshd\[20363\]: Failed password for invalid user support from 141.98.9.162 port 45368 ssh2

2020-09-07 14:19:12 dovecot_login authenticator failed for \(ip-113-120.4vendeta.com.\) \[78.128.113.120\]: 535 Incorrect authentication data \(set_id=spamzorbadoo@no-server.de\)
2020-09-07 14:19:19 dovecot_login authenticator failed for \(ip-113-120.4vendeta.com.\) \[78.128.113.120\]: 535 Incorrect authentication data
2020-09-07 14:26:33 dovecot_login authenticator failed for \(ip-113-120.4vendeta.com.\) \[78.128.113.120\]: 535 Incorrect authentication data \(set_id=admin777@no-server.de\)
2020-09-07 14:26:40 dovecot_login authenticator failed for \(ip-113-120.4vendeta.com.\) \[78.128.113.120\]: 535 Incorrect authentication data
2020-09-07 14:28:46 dovecot_login authenticator failed for \(ip-113-120.4vendeta.com.\) \[78.128.113.120\]: 535 Incorrect authentication data \(set_id=admin111@no-server.de\)
...

Sep  7 14:43:43 galaxy event: galaxy/lswi: smtp: osaka@uni-potsdam.de [212.70.149.20] authentication failure using internet password
Sep  7 14:44:08 galaxy event: galaxy/lswi: smtp: ors@uni-potsdam.de [212.70.149.20] authentication failure using internet password
Sep  7 14:44:33 galaxy event: galaxy/lswi: smtp: optima@uni-potsdam.de [212.70.149.20] authentication failure using internet password
Sep  7 14:44:59 galaxy event: galaxy/lswi: smtp: onlinelearning@uni-potsdam.de [212.70.149.20] authentication failure using internet password
Sep  7 14:45:25 galaxy event: galaxy/lswi: smtp: onedrive@uni-potsdam.de [212.70.149.20] authentication failure using internet password
...

Sep  7 14:27:43 pve1 sshd[808]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.227.255.4 
Sep  7 14:27:45 pve1 sshd[808]: Failed password for invalid user support from 45.227.255.4 port 48749 ssh2
...

Sep  7 14:20:29 vpn01 sshd[4661]: Failed password for root from 222.186.30.35 port 33805 ssh2
Sep  7 14:20:31 vpn01 sshd[4661]: Failed password for root from 222.186.30.35 port 33805 ssh2
...