Aug 4 18:01:17 *hidden* postfix/postscreen[25528]: DNSBL rank 8 for [37.49.230.109]:58755

Bible

2020-10-13T06:44:21.356144news0 auth[956]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=admin rhost=37.49.230.238
2020-10-13T06:44:25.395781news0 dovecot[21131]: pop3-login: Aborted login (auth failed, 1 attempts in 4 secs): user=, method=PLAIN, rip=37.49.230.238, lip=95.111.246.42, session=
2020-10-13T06:44:28.401407news0 auth[956]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=admin rhost=37.49.230.238
...

2020-10-13T06:44:21.356144news0 auth[956]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=admin rhost=37.49.230.238
2020-10-13T06:44:25.395781news0 dovecot[21131]: pop3-login: Aborted login (auth failed, 1 attempts in 4 secs): user=, method=PLAIN, rip=37.49.230.238, lip=95.111.246.42, session=
2020-10-13T06:44:28.401407news0 auth[956]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=admin rhost=37.49.230.238
...

Dovecot Invalid User Login Attempt.

"AmooT";tag=3533393765393339313363340132313832313335333935

\[2020-10-02 15:01:13\] SECURITY\[6939\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-10-02T15:01:13.624+0200",Severity="Error",Service="SIP",EventVersion="2",AccountID="100",SessionID="0x7f0ffea08d88",LocalAddress="IPV4/UDP/204.8.216.89/5060",RemoteAddress="IPV4/UDP/37.49.230.126/5862",Challenge="096f171f",ReceivedChallenge="096f171f",ReceivedHash="b099bdfad5869da4ae2114a56a2b4299"
\[2020-10-02 15:01:13\] SECURITY\[6939\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-10-02T15:01:13.759+0200",Severity="Error",Service="SIP",EventVersion="2",AccountID="100",SessionID="0x7f0ffeab8148",LocalAddress="IPV4/UDP/204.8.216.89/5060",RemoteAddress="IPV4/UDP/37.49.230.126/5862",Challenge="233a417c",ReceivedChallenge="233a417c",ReceivedHash="0017581d14759d4b5ad3a404ed924131"
\[2020-10-02 15:01:13\] SECURITY\[6939\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-10-02T15:01:13.783+0200",Severity="Error",Service="SIP",EventVersion="2",Accoun
...

\[2020-10-02 15:01:13\] SECURITY\[6939\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-10-02T15:01:13.624+0200",Severity="Error",Service="SIP",EventVersion="2",AccountID="100",SessionID="0x7f0ffea08d88",LocalAddress="IPV4/UDP/204.8.216.89/5060",RemoteAddress="IPV4/UDP/37.49.230.126/5862",Challenge="096f171f",ReceivedChallenge="096f171f",ReceivedHash="b099bdfad5869da4ae2114a56a2b4299"
\[2020-10-02 15:01:13\] SECURITY\[6939\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-10-02T15:01:13.759+0200",Severity="Error",Service="SIP",EventVersion="2",AccountID="100",SessionID="0x7f0ffeab8148",LocalAddress="IPV4/UDP/204.8.216.89/5060",RemoteAddress="IPV4/UDP/37.49.230.126/5862",Challenge="233a417c",ReceivedChallenge="233a417c",ReceivedHash="0017581d14759d4b5ad3a404ed924131"
\[2020-10-02 15:01:13\] SECURITY\[6939\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-10-02T15:01:13.783+0200",Severity="Error",Service="SIP",EventVersion="2",Accoun
...

[N1.H1.VM1] Port Scanner Detected Blocked by UFW

SIP Server BruteForce Attack

[2020-09-30 18:00:12] NOTICE[1159][C-0000421d] chan_sip.c: Call from '' (37.49.230.201:64644) to extension '12526890745' rejected because extension not found in context 'public'.
[2020-09-30 18:00:12] SECURITY[1198] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-09-30T18:00:12.866-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="12526890745",SessionID="0x7fcaa045f8f8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.230.201/64644",ACLName="no_extension_match"
[2020-09-30 18:00:26] NOTICE[1159][C-0000421f] chan_sip.c: Call from '' (37.49.230.201:57391) to extension '712526890745' rejected because extension not found in context 'public'.
[2020-09-30 18:00:26] SECURITY[1198] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-09-30T18:00:26.237-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="712526890745",SessionID="0x7fcaa04d8d08",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.230.201/
...

[2020-09-30 18:00:12] NOTICE[1159][C-0000421d] chan_sip.c: Call from '' (37.49.230.201:64644) to extension '12526890745' rejected because extension not found in context 'public'.
[2020-09-30 18:00:12] SECURITY[1198] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-09-30T18:00:12.866-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="12526890745",SessionID="0x7fcaa045f8f8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.230.201/64644",ACLName="no_extension_match"
[2020-09-30 18:00:26] NOTICE[1159][C-0000421f] chan_sip.c: Call from '' (37.49.230.201:57391) to extension '712526890745' rejected because extension not found in context 'public'.
[2020-09-30 18:00:26] SECURITY[1198] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-09-30T18:00:26.237-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="712526890745",SessionID="0x7fcaa04d8d08",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.230.201/
...

[2020-09-30 18:00:12] NOTICE[1159][C-0000421d] chan_sip.c: Call from '' (37.49.230.201:64644) to extension '12526890745' rejected because extension not found in context 'public'.
[2020-09-30 18:00:12] SECURITY[1198] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-09-30T18:00:12.866-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="12526890745",SessionID="0x7fcaa045f8f8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.230.201/64644",ACLName="no_extension_match"
[2020-09-30 18:00:26] NOTICE[1159][C-0000421f] chan_sip.c: Call from '' (37.49.230.201:57391) to extension '712526890745' rejected because extension not found in context 'public'.
[2020-09-30 18:00:26] SECURITY[1198] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-09-30T18:00:26.237-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="712526890745",SessionID="0x7fcaa04d8d08",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.230.201/
...

Hellooo

Hellooo

Sep 28 15:49:19 : SSH login attempts with invalid user

May  1 22:47:56 santamaria sshd\[11118\]: Invalid user jobs from 223.197.125.10
May  1 22:47:56 santamaria sshd\[11118\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=223.197.125.10
May  1 22:47:57 santamaria sshd\[11118\]: Failed password for invalid user jobs from 223.197.125.10 port 41340 ssh2
...

SSH brute-force attempt

2020-05-01T21:06:25.807313shield sshd\[32582\]: Invalid user alvaro from 5.9.78.82 port 46873
2020-05-01T21:06:25.812071shield sshd\[32582\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=static.82.78.9.5.clients.your-server.de
2020-05-01T21:06:27.914133shield sshd\[32582\]: Failed password for invalid user alvaro from 5.9.78.82 port 46873 ssh2
2020-05-01T21:11:35.476338shield sshd\[837\]: Invalid user vinod from 5.9.78.82 port 16793
2020-05-01T21:11:35.480100shield sshd\[837\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=static.82.78.9.5.clients.your-server.de

May  1 18:23:56 firewall sshd[19085]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.166.246.46
May  1 18:23:56 firewall sshd[19085]: Invalid user janine from 188.166.246.46
May  1 18:23:59 firewall sshd[19085]: Failed password for invalid user janine from 188.166.246.46 port 47696 ssh2
...

proto=tcp  .  spt=44577  .  dpt=25  .     Found on   Dark List de      (378)

May  1 22:09:30 lock-38 sshd[1797307]: Failed password for root from 58.16.187.26 port 54664 ssh2
May  1 22:09:30 lock-38 sshd[1797307]: Disconnected from authenticating user root 58.16.187.26 port 54664 [preauth]
May  1 22:13:37 lock-38 sshd[1797419]: Failed password for root from 58.16.187.26 port 58748 ssh2
May  1 22:13:38 lock-38 sshd[1797419]: Disconnected from authenticating user root 58.16.187.26 port 58748 [preauth]
May  1 22:14:54 lock-38 sshd[1797440]: Failed password for root from 58.16.187.26 port 42554 ssh2
...

port scan and connect, tcp 80 (http)

prod8
...

May  1 23:14:33 markkoudstaal sshd[24056]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.219.172.224
May  1 23:14:34 markkoudstaal sshd[24056]: Failed password for invalid user joseph from 182.219.172.224 port 57840 ssh2
May  1 23:19:35 markkoudstaal sshd[25030]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.219.172.224

2020-05-01T20:07:09.995129dmca.cloudsearch.cf sshd[16253]: Invalid user kda from 45.248.69.28 port 46338
2020-05-01T20:07:10.001148dmca.cloudsearch.cf sshd[16253]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.248.69.28
2020-05-01T20:07:09.995129dmca.cloudsearch.cf sshd[16253]: Invalid user kda from 45.248.69.28 port 46338
2020-05-01T20:07:11.923474dmca.cloudsearch.cf sshd[16253]: Failed password for invalid user kda from 45.248.69.28 port 46338 ssh2
2020-05-01T20:14:35.227963dmca.cloudsearch.cf sshd[16825]: Invalid user user from 45.248.69.28 port 45124
2020-05-01T20:14:35.233674dmca.cloudsearch.cf sshd[16825]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.248.69.28
2020-05-01T20:14:35.227963dmca.cloudsearch.cf sshd[16825]: Invalid user user from 45.248.69.28 port 45124
2020-05-01T20:14:37.050615dmca.cloudsearch.cf sshd[16825]: Failed password for invalid user user from 45.248.69.28 port 45124 ss
...

May  1 23:25:35 vps sshd[140294]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=209.105.243.145  user=root
May  1 23:25:37 vps sshd[140294]: Failed password for root from 209.105.243.145 port 54875 ssh2
May  1 23:29:35 vps sshd[156989]: Invalid user tmp from 209.105.243.145 port 32932
May  1 23:29:35 vps sshd[156989]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=209.105.243.145
May  1 23:29:37 vps sshd[156989]: Failed password for invalid user tmp from 209.105.243.145 port 32932 ssh2
...

May  1 22:14:42 host sshd[42735]: Invalid user elisabetta from 118.193.35.33 port 37706
...

no

May  1 23:34:54 santamaria sshd\[11925\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.42.7  user=root
May  1 23:34:56 santamaria sshd\[11925\]: Failed password for root from 222.186.42.7 port 19804 ssh2
May  1 23:35:02 santamaria sshd\[11927\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.42.7  user=root
...

Automatic report - Port Scan Attack