lfd: (smtpauth) Failed SMTP AUTH login from 37.49.230.103 (-): 5 in the last 3600 secs - Sat Sep  1 16:54:15 2018

lfd: (smtpauth) Failed SMTP AUTH login from 37.49.230.103 (-): 5 in the last 3600 secs - Sat Sep  1 16:54:15 2018

lfd: (smtpauth) Failed SMTP AUTH login from 37.49.230.103 (-): 5 in the last 3600 secs - Sat Sep  1 16:54:15 2018

Port Scan: Events[1] countPorts[1]: 22 ..

\[2019-12-30 15:34:20\] SECURITY\[2857\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-12-30T15:34:20.986-0500",Severity="Error",Service="SIP",EventVersion="1",AccountID="9011390237920793",SessionID="0x7f0fb467eb08",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.230.103/5060",ACLName="no_extension_match"
\[2019-12-30 15:34:33\] SECURITY\[2857\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-12-30T15:34:33.145-0500",Severity="Error",Service="SIP",EventVersion="1",AccountID="390237920793",SessionID="0x7f0fb48c2048",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.230.103/5060",ACLName="no_extension_match"
\[2019-12-30 15:34:44\] SECURITY\[2857\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-12-30T15:34:44.971-0500",Severity="Error",Service="SIP",EventVersion="1",AccountID="1011390237920793",SessionID="0x7f0fb4a5a908",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.230.103/5060",ACLName="no_extensi

Bible

2020-10-13T06:44:21.356144news0 auth[956]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=admin rhost=37.49.230.238
2020-10-13T06:44:25.395781news0 dovecot[21131]: pop3-login: Aborted login (auth failed, 1 attempts in 4 secs): user=, method=PLAIN, rip=37.49.230.238, lip=95.111.246.42, session=
2020-10-13T06:44:28.401407news0 auth[956]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=admin rhost=37.49.230.238
...

2020-10-13T06:44:21.356144news0 auth[956]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=admin rhost=37.49.230.238
2020-10-13T06:44:25.395781news0 dovecot[21131]: pop3-login: Aborted login (auth failed, 1 attempts in 4 secs): user=, method=PLAIN, rip=37.49.230.238, lip=95.111.246.42, session=
2020-10-13T06:44:28.401407news0 auth[956]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=admin rhost=37.49.230.238
...

Dovecot Invalid User Login Attempt.

"AmooT";tag=3533393765393339313363340132313832313335333935

\[2020-10-02 15:01:13\] SECURITY\[6939\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-10-02T15:01:13.624+0200",Severity="Error",Service="SIP",EventVersion="2",AccountID="100",SessionID="0x7f0ffea08d88",LocalAddress="IPV4/UDP/204.8.216.89/5060",RemoteAddress="IPV4/UDP/37.49.230.126/5862",Challenge="096f171f",ReceivedChallenge="096f171f",ReceivedHash="b099bdfad5869da4ae2114a56a2b4299"
\[2020-10-02 15:01:13\] SECURITY\[6939\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-10-02T15:01:13.759+0200",Severity="Error",Service="SIP",EventVersion="2",AccountID="100",SessionID="0x7f0ffeab8148",LocalAddress="IPV4/UDP/204.8.216.89/5060",RemoteAddress="IPV4/UDP/37.49.230.126/5862",Challenge="233a417c",ReceivedChallenge="233a417c",ReceivedHash="0017581d14759d4b5ad3a404ed924131"
\[2020-10-02 15:01:13\] SECURITY\[6939\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-10-02T15:01:13.783+0200",Severity="Error",Service="SIP",EventVersion="2",Accoun
...

\[2020-10-02 15:01:13\] SECURITY\[6939\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-10-02T15:01:13.624+0200",Severity="Error",Service="SIP",EventVersion="2",AccountID="100",SessionID="0x7f0ffea08d88",LocalAddress="IPV4/UDP/204.8.216.89/5060",RemoteAddress="IPV4/UDP/37.49.230.126/5862",Challenge="096f171f",ReceivedChallenge="096f171f",ReceivedHash="b099bdfad5869da4ae2114a56a2b4299"
\[2020-10-02 15:01:13\] SECURITY\[6939\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-10-02T15:01:13.759+0200",Severity="Error",Service="SIP",EventVersion="2",AccountID="100",SessionID="0x7f0ffeab8148",LocalAddress="IPV4/UDP/204.8.216.89/5060",RemoteAddress="IPV4/UDP/37.49.230.126/5862",Challenge="233a417c",ReceivedChallenge="233a417c",ReceivedHash="0017581d14759d4b5ad3a404ed924131"
\[2020-10-02 15:01:13\] SECURITY\[6939\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-10-02T15:01:13.783+0200",Severity="Error",Service="SIP",EventVersion="2",Accoun
...

[N1.H1.VM1] Port Scanner Detected Blocked by UFW

SIP Server BruteForce Attack

[2020-09-30 18:00:12] NOTICE[1159][C-0000421d] chan_sip.c: Call from '' (37.49.230.201:64644) to extension '12526890745' rejected because extension not found in context 'public'.
[2020-09-30 18:00:12] SECURITY[1198] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-09-30T18:00:12.866-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="12526890745",SessionID="0x7fcaa045f8f8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.230.201/64644",ACLName="no_extension_match"
[2020-09-30 18:00:26] NOTICE[1159][C-0000421f] chan_sip.c: Call from '' (37.49.230.201:57391) to extension '712526890745' rejected because extension not found in context 'public'.
[2020-09-30 18:00:26] SECURITY[1198] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-09-30T18:00:26.237-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="712526890745",SessionID="0x7fcaa04d8d08",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.230.201/
...

[2020-09-30 18:00:12] NOTICE[1159][C-0000421d] chan_sip.c: Call from '' (37.49.230.201:64644) to extension '12526890745' rejected because extension not found in context 'public'.
[2020-09-30 18:00:12] SECURITY[1198] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-09-30T18:00:12.866-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="12526890745",SessionID="0x7fcaa045f8f8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.230.201/64644",ACLName="no_extension_match"
[2020-09-30 18:00:26] NOTICE[1159][C-0000421f] chan_sip.c: Call from '' (37.49.230.201:57391) to extension '712526890745' rejected because extension not found in context 'public'.
[2020-09-30 18:00:26] SECURITY[1198] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-09-30T18:00:26.237-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="712526890745",SessionID="0x7fcaa04d8d08",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.230.201/
...

[2020-09-30 18:00:12] NOTICE[1159][C-0000421d] chan_sip.c: Call from '' (37.49.230.201:64644) to extension '12526890745' rejected because extension not found in context 'public'.
[2020-09-30 18:00:12] SECURITY[1198] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-09-30T18:00:12.866-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="12526890745",SessionID="0x7fcaa045f8f8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.230.201/64644",ACLName="no_extension_match"
[2020-09-30 18:00:26] NOTICE[1159][C-0000421f] chan_sip.c: Call from '' (37.49.230.201:57391) to extension '712526890745' rejected because extension not found in context 'public'.
[2020-09-30 18:00:26] SECURITY[1198] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-09-30T18:00:26.237-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="712526890745",SessionID="0x7fcaa04d8d08",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.230.201/
...

Hellooo

Hellooo

Sep 28 15:49:19 : SSH login attempts with invalid user

SpamScore above: 10.0

Sendgrid 168.245.72.205 From: "Home Depot!!"  - malware links + header:
crepeguysindy.info
go.darcyprio.com
go.altakagenw.com
www.expenseplan.com
u17355174.ct.sendgrid.net
sendgrid.net
cherishyourvows.info

[Tue Jul 07 06:52:20 2020] - Syn Flood From IP: 82.120.66.246 Port: 64652

Jul 14 21:23:21 santamaria sshd\[3084\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.15.158  user=root
Jul 14 21:23:23 santamaria sshd\[3084\]: Failed password for root from 222.186.15.158 port 45664 ssh2
Jul 14 21:23:29 santamaria sshd\[3087\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.15.158  user=root
...

[Tue Jun 30 14:45:02 2020] - Syn Flood From IP: 58.186.126.37 Port: 6901

Jul 14 20:27:51 odroid64 sshd\[25506\]: Invalid user 123 from 52.149.134.171
Jul 14 20:27:51 odroid64 sshd\[25506\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.149.134.171
...

SSH Brute Force

Jul 14 20:23:19 srv-ubuntu-dev3 sshd[65471]: Invalid user alex from 45.126.252.218
Jul 14 20:23:19 srv-ubuntu-dev3 sshd[65471]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.126.252.218
Jul 14 20:23:19 srv-ubuntu-dev3 sshd[65471]: Invalid user alex from 45.126.252.218
Jul 14 20:23:21 srv-ubuntu-dev3 sshd[65471]: Failed password for invalid user alex from 45.126.252.218 port 46742 ssh2
Jul 14 20:25:40 srv-ubuntu-dev3 sshd[65894]: Invalid user everton from 45.126.252.218
Jul 14 20:25:40 srv-ubuntu-dev3 sshd[65894]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.126.252.218
Jul 14 20:25:40 srv-ubuntu-dev3 sshd[65894]: Invalid user everton from 45.126.252.218
Jul 14 20:25:42 srv-ubuntu-dev3 sshd[65894]: Failed password for invalid user everton from 45.126.252.218 port 53808 ssh2
Jul 14 20:28:03 srv-ubuntu-dev3 sshd[66367]: Invalid user lwz from 45.126.252.218
...

Jul 14 12:39:37 pi sshd[1263]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.40.216.246 
Jul 14 12:39:39 pi sshd[1263]: Failed password for invalid user 123 from 104.40.216.246 port 40254 ssh2

Jul 14 21:30:31 * sshd[24632]: Failed password for root from 222.186.180.130 port 27555 ssh2
Jul 14 21:30:33 * sshd[24632]: Failed password for root from 222.186.180.130 port 27555 ssh2

Jul 14 19:03:00 plex-server sshd[882047]: Invalid user ts2 from 51.77.146.170 port 42682
Jul 14 19:03:00 plex-server sshd[882047]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.77.146.170 
Jul 14 19:03:00 plex-server sshd[882047]: Invalid user ts2 from 51.77.146.170 port 42682
Jul 14 19:03:02 plex-server sshd[882047]: Failed password for invalid user ts2 from 51.77.146.170 port 42682 ssh2
Jul 14 19:06:07 plex-server sshd[883035]: Invalid user rsl from 51.77.146.170 port 40472
...

Honeypot attack, port: 81, PTR: 189-69-219-153.dial-up.telesp.net.br.

$f2bV_matches

2020-07-14T18:28:03.200810randservbullet-proofcloud-66.localdomain sshd[26709]: Invalid user 123 from 52.146.35.191 port 56446
2020-07-14T18:28:03.204884randservbullet-proofcloud-66.localdomain sshd[26709]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.146.35.191
2020-07-14T18:28:03.200810randservbullet-proofcloud-66.localdomain sshd[26709]: Invalid user 123 from 52.146.35.191 port 56446
2020-07-14T18:28:05.102187randservbullet-proofcloud-66.localdomain sshd[26709]: Failed password for invalid user 123 from 52.146.35.191 port 56446 ssh2
...

Jul 14 09:11:49 sachi sshd\[12448\]: Invalid user xuwei from 119.252.143.6
Jul 14 09:11:49 sachi sshd\[12448\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.252.143.6
Jul 14 09:11:51 sachi sshd\[12448\]: Failed password for invalid user xuwei from 119.252.143.6 port 49537 ssh2
Jul 14 09:14:57 sachi sshd\[12678\]: Invalid user fox from 119.252.143.6
Jul 14 09:14:57 sachi sshd\[12678\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.252.143.6