Honeypot attack, port: 445, PTR: host-156.196.188.244-static.tedata.net.

Oct  3 **REMOVED** dovecot: imap-login: Disconnected \(auth failed, 1 attempts in 7 secs\): user=\, method=PLAIN, rip=61.185.139.72, lip=**REMOVED**, TLS, session=\
Oct  3 **REMOVED** dovecot: imap-login: Disconnected \(auth failed, 1 attempts in 6 secs\): user=\, method=PLAIN, rip=61.185.139.72, lip=**REMOVED**, TLS, session=\
Oct  3 **REMOVED** dovecot: imap-login: Disconnected \(auth failed, 1 attempts in 5 secs\): user=\, method=PLAIN, rip=61.185.139.72, lip=**REMOVED**, TLS, session=\

Oct  2 00:08:50 mail01 postfix/postscreen[12956]: CONNECT from [45.64.139.181]:54715 to [94.130.181.95]:25
Oct  2 00:08:50 mail01 postfix/dnsblog[12957]: addr 45.64.139.181 listed by domain bl.blocklist.de as 127.0.0.9
Oct  2 00:08:50 mail01 postfix/dnsblog[12959]: addr 45.64.139.181 listed by domain zen.spamhaus.org as 127.0.0.3
Oct  2 00:08:50 mail01 postfix/dnsblog[12959]: addr 45.64.139.181 listed by domain zen.spamhaus.org as 127.0.0.11
Oct  2 00:08:50 mail01 postfix/dnsblog[12959]: addr 45.64.139.181 listed by domain zen.spamhaus.org as 127.0.0.4
Oct  2 00:08:50 mail01 postfix/dnsblog[12958]: addr 45.64.139.181 listed by domain ix.dnsbl.xxxxxx.net as 127.0.0.2
Oct  2 00:08:50 mail01 postfix/postscreen[12956]: PREGREET 20 after 0.79 from [45.64.139.181]:54715: EHLO luserverglass.hostname

Oct  2 00:08:50 mail01 postfix/postscreen[12956]: DNSBL rank 5 for [45.64.139.181]:54715
Oct x@x
Oct x@x
Oct  2 00:08:52 mail01 postfix/postscreen[12956]: HANGUP after 2 from [45.........
-------------------------------

Sep 30 22:52:56 rama sshd[931727]: Invalid user hadoop from 118.201.138.94
Sep 30 22:52:56 rama sshd[931727]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.201.138.94 
Sep 30 22:52:58 rama sshd[931727]: Failed password for invalid user hadoop from 118.201.138.94 port 47266 ssh2
Sep 30 22:52:59 rama sshd[931727]: Received disconnect from 118.201.138.94: 11: Bye Bye [preauth]
Oct  1 00:15:16 rama sshd[981251]: Invalid user dan from 118.201.138.94
Oct  1 00:15:16 rama sshd[981251]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.201.138.94 
Oct  1 00:15:18 rama sshd[981251]: Failed password for invalid user dan from 118.201.138.94 port 37212 ssh2
Oct  1 00:15:19 rama sshd[981251]: Received disconnect from 118.201.138.94: 11: Bye Bye [preauth]
Oct  1 00:15:55 rama sshd[981445]: Invalid user tomcat from 118.201.138.94
Oct  1 00:15:55 rama sshd[981445]: pam_unix(sshd:auth): authenticatio........
-------------------------------

Unauthorised access (Oct  3) SRC=110.253.16.64 LEN=40 TTL=50 ID=19589 TCP DPT=8080 WINDOW=62723 SYN 
Unauthorised access (Oct  3) SRC=110.253.16.64 LEN=40 TTL=50 ID=3360 TCP DPT=8080 WINDOW=62723 SYN

WordPress login Brute force / Web App Attack on client site.

Automatic report - Port Scan Attack

Port scan

Lines containing failures of 106.12.96.226
Oct  1 14:54:06 shared02 sshd[24427]: Invalid user graske from 106.12.96.226 port 40200
Oct  1 14:54:06 shared02 sshd[24427]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.96.226
Oct  1 14:54:08 shared02 sshd[24427]: Failed password for invalid user graske from 106.12.96.226 port 40200 ssh2
Oct  1 14:54:09 shared02 sshd[24427]: Received disconnect from 106.12.96.226 port 40200:11: Bye Bye [preauth]
Oct  1 14:54:09 shared02 sshd[24427]: Disconnected from invalid user graske 106.12.96.226 port 40200 [preauth]


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=106.12.96.226

Oct  3 23:45:08 markkoudstaal sshd[30832]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=79.137.86.43
Oct  3 23:45:11 markkoudstaal sshd[30832]: Failed password for invalid user ftpuser from 79.137.86.43 port 60542 ssh2
Oct  3 23:48:49 markkoudstaal sshd[31139]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=79.137.86.43

Oct  3 12:09:23 tdfoods sshd\[2322\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.15.101  user=root
Oct  3 12:09:26 tdfoods sshd\[2322\]: Failed password for root from 222.186.15.101 port 51601 ssh2
Oct  3 12:09:27 tdfoods sshd\[2322\]: Failed password for root from 222.186.15.101 port 51601 ssh2
Oct  3 12:09:29 tdfoods sshd\[2322\]: Failed password for root from 222.186.15.101 port 51601 ssh2
Oct  3 12:18:05 tdfoods sshd\[3093\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.15.101  user=root

Automatic report - Port Scan

Oct  3 15:52:25 localhost kernel: [3870164.060382] iptables_INPUT_denied: IN=eth0 OUT= MAC=f2:3c:91:84:83:95:84:78:ac:57:aa:c1:08:00 SRC=190.14.39.120 DST=[mungedIP2] LEN=40 TOS=0x08 PREC=0x20 TTL=84 ID=49083 DF PROTO=TCP SPT=59399 DPT=22 SEQ=1007349692 ACK=0 WINDOW=29200 RES=0x00 SYN URGP=0 
Oct  3 16:43:33 localhost kernel: [3873232.385241] iptables_INPUT_denied: IN=eth0 OUT= MAC=f2:3c:91:84:83:95:84:78:ac:57:a8:41:08:00 SRC=190.14.39.120 DST=[mungedIP2] LEN=40 TOS=0x08 PREC=0x20 TTL=85 ID=46577 DF PROTO=TCP SPT=65437 DPT=22 SEQ=397748118 ACK=0 WINDOW=29200 RES=0x00 SYN URGP=0 
Oct  3 16:52:24 localhost kernel: [3873763.037055] iptables_INPUT_denied: IN=eth0 OUT= MAC=f2:3c:91:84:83:95:84:78:ac:57:a8:41:08:00 SRC=190.14.39.120 DST=[mungedIP2] LEN=40 TOS=0x00 PREC=0x00 TTL=65 ID=11162 DF PROTO=TCP SPT=54519 DPT=22 SEQ=1620691768 ACK=0 WINDOW=29200 RES=0x00 SYN URGP=0

Oct  4 00:27:03 localhost sshd\[11436\]: Invalid user apache2 from 157.230.240.213 port 42955
Oct  4 00:27:03 localhost sshd\[11436\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.230.240.213
Oct  4 00:27:05 localhost sshd\[11436\]: Failed password for invalid user apache2 from 157.230.240.213 port 42955 ssh2

Honeypot attack, port: 445, PTR: static-71-32-16-186.telecel.com.py.