Failed password for root from 162.247.74.213 port 43716 ssh2
Failed password for root from 162.247.74.213 port 43716 ssh2
Failed password for root from 162.247.74.213 port 43716 ssh2
Failed password for root from 162.247.74.213 port 43716 ssh2
Failed password for root from 162.247.74.213 port 43716 ssh2

Sep  5 07:32:29 mavik sshd[26723]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.46.244.194
Sep  5 07:32:31 mavik sshd[26723]: Failed password for invalid user maven from 121.46.244.194 port 28408 ssh2
Sep  5 07:35:58 mavik sshd[26926]: Invalid user odoo from 121.46.244.194
Sep  5 07:35:58 mavik sshd[26926]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.46.244.194
Sep  5 07:36:00 mavik sshd[26926]: Failed password for invalid user odoo from 121.46.244.194 port 48471 ssh2
...

Sep  4 18:50:18 mellenthin postfix/smtpd[30865]: NOQUEUE: reject: RCPT from unknown[196.151.225.171]: 554 5.7.1 Service unavailable; Client host [196.151.225.171] blocked using zen.spamhaus.org; https://www.spamhaus.org/query/ip/196.151.225.171; from= to= proto=ESMTP helo=<[196.157.161.154]>

Sep  4 20:47:53 eddieflores sshd\[31045\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=141.98.10.213  user=root
Sep  4 20:47:55 eddieflores sshd\[31045\]: Failed password for root from 141.98.10.213 port 39343 ssh2
Sep  4 20:48:26 eddieflores sshd\[31115\]: Invalid user admin from 141.98.10.213
Sep  4 20:48:26 eddieflores sshd\[31115\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=141.98.10.213
Sep  4 20:48:28 eddieflores sshd\[31115\]: Failed password for invalid user admin from 141.98.10.213 port 42353 ssh2

Honeypot attack, port: 445, PTR: static.vnpt.vn.

 TCP (SYN) 61.219.11.153:63988 -> port 8080, len 44

Sep  4 20:47:49 eddieflores sshd\[31040\]: Invalid user Administrator from 141.98.10.212
Sep  4 20:47:49 eddieflores sshd\[31040\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=141.98.10.212
Sep  4 20:47:51 eddieflores sshd\[31040\]: Failed password for invalid user Administrator from 141.98.10.212 port 36351 ssh2
Sep  4 20:48:21 eddieflores sshd\[31110\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=141.98.10.212  user=root
Sep  4 20:48:22 eddieflores sshd\[31110\]: Failed password for root from 141.98.10.212 port 35351 ssh2

firewall-block, port(s): 23/tcp

Invalid user vbox from 61.133.122.19 port 21912

Sep  5 06:35:17 ip-172-31-16-56 sshd\[13950\]: Invalid user cc from 186.147.160.189\
Sep  5 06:35:18 ip-172-31-16-56 sshd\[13950\]: Failed password for invalid user cc from 186.147.160.189 port 32778 ssh2\
Sep  5 06:38:30 ip-172-31-16-56 sshd\[14035\]: Invalid user hst from 186.147.160.189\
Sep  5 06:38:32 ip-172-31-16-56 sshd\[14035\]: Failed password for invalid user hst from 186.147.160.189 port 52498 ssh2\
Sep  5 06:41:40 ip-172-31-16-56 sshd\[14141\]: Invalid user magda from 186.147.160.189\

[2020-09-04 14:16:15] NOTICE[1194][C-000006b8] chan_sip.c: Call from '' (62.173.149.88:56458) to extension '145501148943147001' rejected because extension not found in context 'public'.
[2020-09-04 14:16:15] SECURITY[1233] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-09-04T14:16:15.574-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="145501148943147001",SessionID="0x7f2ddc036c38",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/62.173.149.88/56458",ACLName="no_extension_match"
[2020-09-04 14:16:50] NOTICE[1194][C-000006bb] chan_sip.c: Call from '' (62.173.149.88:57680) to extension '145601148943147001' rejected because extension not found in context 'public'.
[2020-09-04 14:16:50] SECURITY[1233] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-09-04T14:16:50.942-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="145601148943147001",SessionID="0x7f2ddc1b7848",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddres
...

187.189.51.117 (MX/Mexico/-), 5 distributed sshd attacks on account [root] in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_DISTATTACK; Logs: Sep  4 18:47:25 server5 sshd[28369]: Failed password for root from 187.189.51.117 port 42627 ssh2
Sep  4 18:53:05 server5 sshd[32235]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.90.233.35  user=root
Sep  4 18:48:30 server5 sshd[29022]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.50.223.112  user=root
Sep  4 18:48:32 server5 sshd[29022]: Failed password for root from 218.50.223.112 port 60362 ssh2
Sep  4 18:51:19 server5 sshd[30940]: Failed password for root from 88.156.122.72 port 54208 ssh2

IP Addresses Blocked:

(smtpauth) Failed SMTP AUTH login from 45.142.120.117 (RU/Russia/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SMTPAUTH; Logs: 2020-09-05 02:41:07 dovecot_login authenticator failed for (User) [45.142.120.117]:25416: 535 Incorrect authentication data (set_id=moraes@xeoserver.com)
2020-09-05 02:41:18 dovecot_login authenticator failed for (User) [45.142.120.117]:45446: 535 Incorrect authentication data (set_id=moraes@xeoserver.com)
2020-09-05 02:41:19 dovecot_login authenticator failed for (User) [45.142.120.117]:19166: 535 Incorrect authentication data (set_id=moraes@xeoserver.com)
2020-09-05 02:41:20 dovecot_login authenticator failed for (User) [45.142.120.117]:61100: 535 Incorrect authentication data (set_id=moraes@xeoserver.com)
2020-09-05 02:41:29 dovecot_login authenticator failed for (User) [45.142.120.117]:22020: 535 Incorrect authentication data (set_id=moraes@xeoserver.com)

Sep  5 04:13:38 rush sshd[2658]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=171.15.17.161
Sep  5 04:13:41 rush sshd[2658]: Failed password for invalid user zhangyong from 171.15.17.161 port 5502 ssh2
Sep  5 04:17:46 rush sshd[2758]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=171.15.17.161
...

Sep  5 08:32:16 home sshd[789933]: Invalid user payingit from 195.54.160.180 port 41555
Sep  5 08:32:16 home sshd[789933]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.54.160.180 
Sep  5 08:32:16 home sshd[789933]: Invalid user payingit from 195.54.160.180 port 41555
Sep  5 08:32:18 home sshd[789933]: Failed password for invalid user payingit from 195.54.160.180 port 41555 ssh2
Sep  5 08:32:20 home sshd[789936]: Invalid user pi from 195.54.160.180 port 52420
...