spam (f2b h2)

37.49.230.249 has been banned for [spam]
...

smtp brute force login

(smtpauth) Failed SMTP AUTH login from 37.49.230.249 (NL/Netherlands/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 2020-05-10 11:35:31 login authenticator failed for (EZhMMb) [37.49.230.249]: 535 Incorrect authentication data (set_id=shipping@shahdineh.com)

Bible

2020-10-13T06:44:21.356144news0 auth[956]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=admin rhost=37.49.230.238
2020-10-13T06:44:25.395781news0 dovecot[21131]: pop3-login: Aborted login (auth failed, 1 attempts in 4 secs): user=, method=PLAIN, rip=37.49.230.238, lip=95.111.246.42, session=
2020-10-13T06:44:28.401407news0 auth[956]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=admin rhost=37.49.230.238
...

2020-10-13T06:44:21.356144news0 auth[956]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=admin rhost=37.49.230.238
2020-10-13T06:44:25.395781news0 dovecot[21131]: pop3-login: Aborted login (auth failed, 1 attempts in 4 secs): user=, method=PLAIN, rip=37.49.230.238, lip=95.111.246.42, session=
2020-10-13T06:44:28.401407news0 auth[956]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=admin rhost=37.49.230.238
...

Dovecot Invalid User Login Attempt.

"AmooT";tag=3533393765393339313363340132313832313335333935

\[2020-10-02 15:01:13\] SECURITY\[6939\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-10-02T15:01:13.624+0200",Severity="Error",Service="SIP",EventVersion="2",AccountID="100",SessionID="0x7f0ffea08d88",LocalAddress="IPV4/UDP/204.8.216.89/5060",RemoteAddress="IPV4/UDP/37.49.230.126/5862",Challenge="096f171f",ReceivedChallenge="096f171f",ReceivedHash="b099bdfad5869da4ae2114a56a2b4299"
\[2020-10-02 15:01:13\] SECURITY\[6939\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-10-02T15:01:13.759+0200",Severity="Error",Service="SIP",EventVersion="2",AccountID="100",SessionID="0x7f0ffeab8148",LocalAddress="IPV4/UDP/204.8.216.89/5060",RemoteAddress="IPV4/UDP/37.49.230.126/5862",Challenge="233a417c",ReceivedChallenge="233a417c",ReceivedHash="0017581d14759d4b5ad3a404ed924131"
\[2020-10-02 15:01:13\] SECURITY\[6939\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-10-02T15:01:13.783+0200",Severity="Error",Service="SIP",EventVersion="2",Accoun
...

\[2020-10-02 15:01:13\] SECURITY\[6939\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-10-02T15:01:13.624+0200",Severity="Error",Service="SIP",EventVersion="2",AccountID="100",SessionID="0x7f0ffea08d88",LocalAddress="IPV4/UDP/204.8.216.89/5060",RemoteAddress="IPV4/UDP/37.49.230.126/5862",Challenge="096f171f",ReceivedChallenge="096f171f",ReceivedHash="b099bdfad5869da4ae2114a56a2b4299"
\[2020-10-02 15:01:13\] SECURITY\[6939\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-10-02T15:01:13.759+0200",Severity="Error",Service="SIP",EventVersion="2",AccountID="100",SessionID="0x7f0ffeab8148",LocalAddress="IPV4/UDP/204.8.216.89/5060",RemoteAddress="IPV4/UDP/37.49.230.126/5862",Challenge="233a417c",ReceivedChallenge="233a417c",ReceivedHash="0017581d14759d4b5ad3a404ed924131"
\[2020-10-02 15:01:13\] SECURITY\[6939\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-10-02T15:01:13.783+0200",Severity="Error",Service="SIP",EventVersion="2",Accoun
...

[N1.H1.VM1] Port Scanner Detected Blocked by UFW

SIP Server BruteForce Attack

[2020-09-30 18:00:12] NOTICE[1159][C-0000421d] chan_sip.c: Call from '' (37.49.230.201:64644) to extension '12526890745' rejected because extension not found in context 'public'.
[2020-09-30 18:00:12] SECURITY[1198] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-09-30T18:00:12.866-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="12526890745",SessionID="0x7fcaa045f8f8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.230.201/64644",ACLName="no_extension_match"
[2020-09-30 18:00:26] NOTICE[1159][C-0000421f] chan_sip.c: Call from '' (37.49.230.201:57391) to extension '712526890745' rejected because extension not found in context 'public'.
[2020-09-30 18:00:26] SECURITY[1198] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-09-30T18:00:26.237-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="712526890745",SessionID="0x7fcaa04d8d08",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.230.201/
...

[2020-09-30 18:00:12] NOTICE[1159][C-0000421d] chan_sip.c: Call from '' (37.49.230.201:64644) to extension '12526890745' rejected because extension not found in context 'public'.
[2020-09-30 18:00:12] SECURITY[1198] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-09-30T18:00:12.866-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="12526890745",SessionID="0x7fcaa045f8f8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.230.201/64644",ACLName="no_extension_match"
[2020-09-30 18:00:26] NOTICE[1159][C-0000421f] chan_sip.c: Call from '' (37.49.230.201:57391) to extension '712526890745' rejected because extension not found in context 'public'.
[2020-09-30 18:00:26] SECURITY[1198] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-09-30T18:00:26.237-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="712526890745",SessionID="0x7fcaa04d8d08",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.230.201/
...

[2020-09-30 18:00:12] NOTICE[1159][C-0000421d] chan_sip.c: Call from '' (37.49.230.201:64644) to extension '12526890745' rejected because extension not found in context 'public'.
[2020-09-30 18:00:12] SECURITY[1198] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-09-30T18:00:12.866-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="12526890745",SessionID="0x7fcaa045f8f8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.230.201/64644",ACLName="no_extension_match"
[2020-09-30 18:00:26] NOTICE[1159][C-0000421f] chan_sip.c: Call from '' (37.49.230.201:57391) to extension '712526890745' rejected because extension not found in context 'public'.
[2020-09-30 18:00:26] SECURITY[1198] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-09-30T18:00:26.237-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="712526890745",SessionID="0x7fcaa04d8d08",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.230.201/
...

Hellooo

Hellooo

Sep 28 15:49:19 : SSH login attempts with invalid user

Sep  3 21:31:01 web9 sshd\[17129\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.131.228.31  user=root
Sep  3 21:31:03 web9 sshd\[17129\]: Failed password for root from 188.131.228.31 port 60658 ssh2
Sep  3 21:38:03 web9 sshd\[18614\]: Invalid user kms from 188.131.228.31
Sep  3 21:38:03 web9 sshd\[18614\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.131.228.31
Sep  3 21:38:05 web9 sshd\[18614\]: Failed password for invalid user kms from 188.131.228.31 port 48948 ssh2

Sep  4 07:03:46 www sshd\[26233\]: Invalid user mario from 211.138.181.202
Sep  4 07:03:46 www sshd\[26233\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.138.181.202
Sep  4 07:03:48 www sshd\[26233\]: Failed password for invalid user mario from 211.138.181.202 port 58246 ssh2
...

Too many connections or unauthorized access detected from Arctic banned ip

leo_www

Sep  4 05:16:44 minden010 sshd[18016]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=74.141.132.233
Sep  4 05:16:46 minden010 sshd[18016]: Failed password for invalid user tomcat from 74.141.132.233 port 42866 ssh2
Sep  4 05:24:26 minden010 sshd[20629]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=74.141.132.233
...

Sep  4 09:37:20 vps647732 sshd[26568]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.65.247.180
Sep  4 09:37:22 vps647732 sshd[26568]: Failed password for invalid user jira from 159.65.247.180 port 45766 ssh2
...

B: /wp-login.php attack

Sep  4 10:20:34 vps691689 sshd[28700]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.59.227
Sep  4 10:20:36 vps691689 sshd[28700]: Failed password for invalid user bing from 206.189.59.227 port 50236 ssh2
Sep  4 10:24:32 vps691689 sshd[28746]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.59.227
...

Sep  4 03:38:58 hcbbdb sshd\[21639\]: Invalid user julianne from 167.114.185.237
Sep  4 03:38:58 hcbbdb sshd\[21639\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=237.ip-167-114-185.net
Sep  4 03:39:00 hcbbdb sshd\[21639\]: Failed password for invalid user julianne from 167.114.185.237 port 57456 ssh2
Sep  4 03:42:46 hcbbdb sshd\[22113\]: Invalid user ned from 167.114.185.237
Sep  4 03:42:46 hcbbdb sshd\[22113\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=237.ip-167-114-185.net

Automatic report - Banned IP Access

Sep  3 19:34:04 kapalua sshd\[8056\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.213.162  user=root
Sep  3 19:34:06 kapalua sshd\[8056\]: Failed password for root from 106.12.213.162 port 45538 ssh2
Sep  3 19:40:01 kapalua sshd\[8814\]: Invalid user tempo from 106.12.213.162
Sep  3 19:40:01 kapalua sshd\[8814\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.213.162
Sep  3 19:40:03 kapalua sshd\[8814\]: Failed password for invalid user tempo from 106.12.213.162 port 33524 ssh2

Sep  4 08:58:19 dev0-dcde-rnet sshd[13402]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.18.139.201
Sep  4 08:58:21 dev0-dcde-rnet sshd[13402]: Failed password for invalid user hamoelet from 182.18.139.201 port 56844 ssh2
Sep  4 09:02:53 dev0-dcde-rnet sshd[13432]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.18.139.201

Sep  4 08:54:03 fr01 sshd[4135]: Invalid user guinness from 113.125.19.85
Sep  4 08:54:03 fr01 sshd[4135]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.125.19.85
Sep  4 08:54:03 fr01 sshd[4135]: Invalid user guinness from 113.125.19.85
Sep  4 08:54:06 fr01 sshd[4135]: Failed password for invalid user guinness from 113.125.19.85 port 38244 ssh2
...

Sep  3 20:36:39 lcdev sshd\[24460\]: Invalid user test from 201.182.33.150
Sep  3 20:36:39 lcdev sshd\[24460\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.182.33.150
Sep  3 20:36:40 lcdev sshd\[24460\]: Failed password for invalid user test from 201.182.33.150 port 42668 ssh2
Sep  3 20:42:06 lcdev sshd\[25119\]: Invalid user wordpress from 201.182.33.150
Sep  3 20:42:06 lcdev sshd\[25119\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=201.182.33.150

23/tcp 23/tcp 23/tcp...
[2019-08-17/09-04]4pkt,1pt.(tcp)