Sep  7 19:26:00 scw-focused-cartwright sshd[30118]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.202.195.1
Sep  7 19:26:03 scw-focused-cartwright sshd[30118]: Failed password for invalid user user from 31.202.195.1 port 49052 ssh2

Honeypot attack, port: 81, PTR: PTR record not found

Sep  7 19:33:58 srv-ubuntu-dev3 sshd[120712]: Invalid user postgres from 52.152.235.76
Sep  7 19:33:58 srv-ubuntu-dev3 sshd[120711]: Invalid user oracle from 52.152.235.76
Sep  7 19:33:58 srv-ubuntu-dev3 sshd[120716]: Invalid user centos from 52.152.235.76
Sep  7 19:33:58 srv-ubuntu-dev3 sshd[120715]: Invalid user ec2-user from 52.152.235.76
Sep  7 19:33:58 srv-ubuntu-dev3 sshd[120713]: Invalid user ubuntu from 52.152.235.76
...

[2020-09-07 20:35:52] NOTICE[1194] chan_sip.c: Registration from '"1040"' failed for '212.83.163.170:8767' - Wrong password
[2020-09-07 20:35:52] SECURITY[1233] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-09-07T20:35:52.435-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="1040",SessionID="0x7f2ddce0c1b8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/212.83.163.170/8767",Challenge="57a1c494",ReceivedChallenge="57a1c494",ReceivedHash="7d6afbed88a559789a67a68713f41f38"
[2020-09-07 20:38:14] NOTICE[1194] chan_sip.c: Registration from '"1045"' failed for '212.83.163.170:9019' - Wrong password
[2020-09-07 20:38:14] SECURITY[1233] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-09-07T20:38:14.493-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="1045",SessionID="0x7f2ddc0da798",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/2
...

Automatic report - XMLRPC Attack

Icarus honeypot on github

(sshd) Failed SSH login from 107.189.11.163 (US/United States/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Sep  8 03:42:10 vps sshd[26816]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.189.11.163  user=root
Sep  8 03:42:12 vps sshd[26816]: Failed password for root from 107.189.11.163 port 36614 ssh2
Sep  8 03:42:14 vps sshd[26816]: Failed password for root from 107.189.11.163 port 36614 ssh2
Sep  8 03:42:16 vps sshd[26816]: Failed password for root from 107.189.11.163 port 36614 ssh2
Sep  8 03:42:19 vps sshd[26816]: Failed password for root from 107.189.11.163 port 36614 ssh2

DATE:2020-09-07 18:49:22, IP:111.229.240.129, PORT:6379 REDIS brute force auth on honeypot server (epe-honey1-hq)

Lines containing failures of 128.199.87.167
Sep  7 05:30:04 www sshd[17671]: Invalid user oracle from 128.199.87.167 port 49250
Sep  7 05:30:04 www sshd[17671]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.87.167
Sep  7 05:30:06 www sshd[17671]: Failed password for invalid user oracle from 128.199.87.167 port 49250 ssh2
Sep  7 05:30:06 www sshd[17671]: Received disconnect from 128.199.87.167 port 49250:11: Bye Bye [preauth]
Sep  7 05:30:06 www sshd[17671]: Disconnected from invalid user oracle 128.199.87.167 port 49250 [preauth]
Sep  7 05:39:23 www sshd[19763]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.87.167  user=r.r
Sep  7 05:39:25 www sshd[19763]: Failed password for r.r from 128.199.87.167 port 52140 ssh2
Sep  7 05:39:26 www sshd[19763]: Received disconnect from 128.199.87.167 port 52140:11: Bye Bye [preauth]
Sep  7 05:39:26 www sshd[19763]: Disconnected from aut........
------------------------------

2020-09-07T20:43:59.7649351495-001 sshd[53765]: Invalid user bow from 106.51.80.198 port 44932
2020-09-07T20:44:01.3813731495-001 sshd[53765]: Failed password for invalid user bow from 106.51.80.198 port 44932 ssh2
2020-09-07T20:47:07.7704781495-001 sshd[53886]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.51.80.198  user=root
2020-09-07T20:47:09.8603251495-001 sshd[53886]: Failed password for root from 106.51.80.198 port 34268 ssh2
2020-09-07T20:50:09.0169771495-001 sshd[53999]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.51.80.198  user=root
2020-09-07T20:50:11.2868301495-001 sshd[53999]: Failed password for root from 106.51.80.198 port 51826 ssh2
...

Sep  8 00:24:47 plg sshd[12061]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.91.159.46  user=root
Sep  8 00:24:50 plg sshd[12061]: Failed password for invalid user root from 51.91.159.46 port 52212 ssh2
Sep  8 00:28:02 plg sshd[12093]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.91.159.46 
Sep  8 00:28:04 plg sshd[12093]: Failed password for invalid user martin from 51.91.159.46 port 57324 ssh2
Sep  8 00:31:26 plg sshd[12124]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.91.159.46  user=root
Sep  8 00:31:28 plg sshd[12124]: Failed password for invalid user root from 51.91.159.46 port 34272 ssh2
...

Sep  8 01:01:23 sip sshd[19964]: Failed password for root from 179.56.106.227 port 34276 ssh2
Sep  8 01:01:24 sip sshd[19972]: Failed password for root from 179.56.106.227 port 34484 ssh2

(sshd) Failed SSH login from 103.140.83.18 (BD/Bangladesh/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Sep  7 12:17:27 server sshd[7264]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.140.83.18  user=root
Sep  7 12:17:28 server sshd[7264]: Failed password for root from 103.140.83.18 port 59810 ssh2
Sep  7 12:46:35 server sshd[25584]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.140.83.18  user=root
Sep  7 12:46:36 server sshd[25584]: Failed password for root from 103.140.83.18 port 48836 ssh2
Sep  7 12:50:37 server sshd[29095]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.140.83.18  user=root

Trolling for resource vulnerabilities

k+ssh-bruteforce