1580656160 - 02/02/2020 16:09:20 Host: 118.70.68.113/118.70.68.113 Port: 445 TCP Blocked

Apr 27 12:05:40 ms-srv sshd[56901]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.22.239.226
Apr 27 12:05:41 ms-srv sshd[56901]: Failed password for invalid user demo from 195.22.239.226 port 33840 ssh2

Honeypot attack, port: 445, PTR: mail.t-d-ural.ru.

Jan 12 20:27:31 ms-srv sshd[34057]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.211.154.194  user=root
Jan 12 20:27:34 ms-srv sshd[34057]: Failed password for invalid user root from 195.211.154.194 port 35314 ssh2

Sep  9 20:06:42 ms-srv sshd[9965]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.224.138.61
Sep  9 20:06:44 ms-srv sshd[9965]: Failed password for invalid user test from 195.224.138.61 port 56734 ssh2

Jan 15 05:30:54 ms-srv sshd[58887]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.24.207.199
Jan 15 05:30:56 ms-srv sshd[58887]: Failed password for invalid user dc++ from 195.24.207.199 port 48640 ssh2

Mar 28 22:52:57 ms-srv sshd[39561]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.209.126.22
Mar 28 22:53:00 ms-srv sshd[39561]: Failed password for invalid user fax from 195.209.126.22 port 54528 ssh2

said was american express I don't have them

Received: from p-mtain004.msg.pkvw.co.charter.net ([107.14.70.244])
          by dnvrco-fep18.email.rr.com
          (InterMail vM.8.04.03.24 201-2389-100-172-20151028) with ESMTP
          id <20200201215534.LWXZ6766.dnvrco-fep18.email.rr.com@p-mtain004.msg.pkvw.co.charter.net>
          for ;
          Sat, 1 Feb 2020 21:55:34 +0000
Received: from p-impout001.msg.pkvw.co.charter.net ([47.43.26.140])
          by p-mtain004.msg.pkvw.co.charter.net
          (InterMail vM.9.01.00.037.1 201-2473-137-122-172) with ESMTP
          id <20200201215534.JTUR29926.p-mtain004.msg.pkvw.co.charter.net@p-impout001.msg.pkvw.co.charter.net>
          for ;
          Sat, 1 Feb 2020 21:55:34 +0000
Received: from [45.147.228.34] ([172.89.142.49])

2020-02-02T17:11:17.625992scmdmz1 sshd[26602]: Invalid user postgres from 106.12.59.23 port 45650
2020-02-02T17:11:17.628876scmdmz1 sshd[26602]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.59.23
2020-02-02T17:11:17.625992scmdmz1 sshd[26602]: Invalid user postgres from 106.12.59.23 port 45650
2020-02-02T17:11:19.907828scmdmz1 sshd[26602]: Failed password for invalid user postgres from 106.12.59.23 port 45650 ssh2
2020-02-02T17:14:34.880837scmdmz1 sshd[26854]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.59.23  user=admin
2020-02-02T17:14:36.537968scmdmz1 sshd[26854]: Failed password for admin from 106.12.59.23 port 36676 ssh2
...

$f2bV_matches

Honeypot attack, port: 81, PTR: PTR record not found

Unauthorized connection attempt detected from IP address 180.178.59.181 to port 1433 [J]

Jan 23 12:40:13 ms-srv sshd[33676]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.24.198.17
Jan 23 12:40:14 ms-srv sshd[33676]: Failed password for invalid user steam from 195.24.198.17 port 45918 ssh2

DATE:2020-02-02 16:09:04, IP:200.41.117.82, PORT:1433 MSSQL brute force auth on honeypot server (honey-neo-dc)

Honeypot attack, port: 445, PTR: mx-ll-183.89.190-204.dynamic.3bb.in.th.