The IP address [37.49.230.49] experienced 5 failed attempts when attempting to log into Mail Server running on DS716 within 5 minutes, and was blocked at Mon May 18 10:37:47 2020.

Bible

2020-10-13T06:44:21.356144news0 auth[956]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=admin rhost=37.49.230.238
2020-10-13T06:44:25.395781news0 dovecot[21131]: pop3-login: Aborted login (auth failed, 1 attempts in 4 secs): user=, method=PLAIN, rip=37.49.230.238, lip=95.111.246.42, session=
2020-10-13T06:44:28.401407news0 auth[956]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=admin rhost=37.49.230.238
...

2020-10-13T06:44:21.356144news0 auth[956]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=admin rhost=37.49.230.238
2020-10-13T06:44:25.395781news0 dovecot[21131]: pop3-login: Aborted login (auth failed, 1 attempts in 4 secs): user=, method=PLAIN, rip=37.49.230.238, lip=95.111.246.42, session=
2020-10-13T06:44:28.401407news0 auth[956]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=admin rhost=37.49.230.238
...

Dovecot Invalid User Login Attempt.

"AmooT";tag=3533393765393339313363340132313832313335333935

\[2020-10-02 15:01:13\] SECURITY\[6939\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-10-02T15:01:13.624+0200",Severity="Error",Service="SIP",EventVersion="2",AccountID="100",SessionID="0x7f0ffea08d88",LocalAddress="IPV4/UDP/204.8.216.89/5060",RemoteAddress="IPV4/UDP/37.49.230.126/5862",Challenge="096f171f",ReceivedChallenge="096f171f",ReceivedHash="b099bdfad5869da4ae2114a56a2b4299"
\[2020-10-02 15:01:13\] SECURITY\[6939\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-10-02T15:01:13.759+0200",Severity="Error",Service="SIP",EventVersion="2",AccountID="100",SessionID="0x7f0ffeab8148",LocalAddress="IPV4/UDP/204.8.216.89/5060",RemoteAddress="IPV4/UDP/37.49.230.126/5862",Challenge="233a417c",ReceivedChallenge="233a417c",ReceivedHash="0017581d14759d4b5ad3a404ed924131"
\[2020-10-02 15:01:13\] SECURITY\[6939\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-10-02T15:01:13.783+0200",Severity="Error",Service="SIP",EventVersion="2",Accoun
...

\[2020-10-02 15:01:13\] SECURITY\[6939\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-10-02T15:01:13.624+0200",Severity="Error",Service="SIP",EventVersion="2",AccountID="100",SessionID="0x7f0ffea08d88",LocalAddress="IPV4/UDP/204.8.216.89/5060",RemoteAddress="IPV4/UDP/37.49.230.126/5862",Challenge="096f171f",ReceivedChallenge="096f171f",ReceivedHash="b099bdfad5869da4ae2114a56a2b4299"
\[2020-10-02 15:01:13\] SECURITY\[6939\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-10-02T15:01:13.759+0200",Severity="Error",Service="SIP",EventVersion="2",AccountID="100",SessionID="0x7f0ffeab8148",LocalAddress="IPV4/UDP/204.8.216.89/5060",RemoteAddress="IPV4/UDP/37.49.230.126/5862",Challenge="233a417c",ReceivedChallenge="233a417c",ReceivedHash="0017581d14759d4b5ad3a404ed924131"
\[2020-10-02 15:01:13\] SECURITY\[6939\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-10-02T15:01:13.783+0200",Severity="Error",Service="SIP",EventVersion="2",Accoun
...

[N1.H1.VM1] Port Scanner Detected Blocked by UFW

SIP Server BruteForce Attack

[2020-09-30 18:00:12] NOTICE[1159][C-0000421d] chan_sip.c: Call from '' (37.49.230.201:64644) to extension '12526890745' rejected because extension not found in context 'public'.
[2020-09-30 18:00:12] SECURITY[1198] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-09-30T18:00:12.866-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="12526890745",SessionID="0x7fcaa045f8f8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.230.201/64644",ACLName="no_extension_match"
[2020-09-30 18:00:26] NOTICE[1159][C-0000421f] chan_sip.c: Call from '' (37.49.230.201:57391) to extension '712526890745' rejected because extension not found in context 'public'.
[2020-09-30 18:00:26] SECURITY[1198] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-09-30T18:00:26.237-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="712526890745",SessionID="0x7fcaa04d8d08",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.230.201/
...

[2020-09-30 18:00:12] NOTICE[1159][C-0000421d] chan_sip.c: Call from '' (37.49.230.201:64644) to extension '12526890745' rejected because extension not found in context 'public'.
[2020-09-30 18:00:12] SECURITY[1198] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-09-30T18:00:12.866-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="12526890745",SessionID="0x7fcaa045f8f8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.230.201/64644",ACLName="no_extension_match"
[2020-09-30 18:00:26] NOTICE[1159][C-0000421f] chan_sip.c: Call from '' (37.49.230.201:57391) to extension '712526890745' rejected because extension not found in context 'public'.
[2020-09-30 18:00:26] SECURITY[1198] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-09-30T18:00:26.237-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="712526890745",SessionID="0x7fcaa04d8d08",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.230.201/
...

[2020-09-30 18:00:12] NOTICE[1159][C-0000421d] chan_sip.c: Call from '' (37.49.230.201:64644) to extension '12526890745' rejected because extension not found in context 'public'.
[2020-09-30 18:00:12] SECURITY[1198] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-09-30T18:00:12.866-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="12526890745",SessionID="0x7fcaa045f8f8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.230.201/64644",ACLName="no_extension_match"
[2020-09-30 18:00:26] NOTICE[1159][C-0000421f] chan_sip.c: Call from '' (37.49.230.201:57391) to extension '712526890745' rejected because extension not found in context 'public'.
[2020-09-30 18:00:26] SECURITY[1198] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-09-30T18:00:26.237-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="712526890745",SessionID="0x7fcaa04d8d08",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.230.201/
...

Hellooo

Hellooo

Sep 28 15:49:19 : SSH login attempts with invalid user

Port scan denied

Oct 11 06:57:59 server sshd[21109]: Failed password for root from 185.91.142.202 port 50960 ssh2
Oct 11 07:15:08 server sshd[30742]: Failed password for root from 185.91.142.202 port 33812 ssh2
Oct 11 07:18:37 server sshd[312]: Failed password for invalid user nagios from 185.91.142.202 port 34762 ssh2

 TCP (SYN) 45.129.33.5:42797 -> port 20220, len 44

(sshd) Failed SSH login from 190.145.192.106 (CO/Colombia/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Oct 10 22:57:17 jbs1 sshd[24334]: Invalid user customer from 190.145.192.106
Oct 10 22:57:17 jbs1 sshd[24334]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.145.192.106 
Oct 10 22:57:19 jbs1 sshd[24334]: Failed password for invalid user customer from 190.145.192.106 port 35574 ssh2
Oct 10 23:06:47 jbs1 sshd[26878]: Invalid user grid from 190.145.192.106
Oct 10 23:06:47 jbs1 sshd[26878]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.145.192.106

Unauthorized connection attempt detected from IP address 222.186.42.57 to port 22 [T]

Oct 11 00:08:21 ip-172-31-16-56 sshd\[7049\]: Failed password for root from 125.124.179.36 port 42350 ssh2\
Oct 11 00:11:37 ip-172-31-16-56 sshd\[7166\]: Failed password for root from 125.124.179.36 port 39488 ssh2\
Oct 11 00:14:49 ip-172-31-16-56 sshd\[7219\]: Invalid user temp from 125.124.179.36\
Oct 11 00:14:51 ip-172-31-16-56 sshd\[7219\]: Failed password for invalid user temp from 125.124.179.36 port 36608 ssh2\
Oct 11 00:18:15 ip-172-31-16-56 sshd\[7267\]: Invalid user kusum from 125.124.179.36\

Oct 11 06:35:54 ajax sshd[22680]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.54.160.180 
Oct 11 06:35:56 ajax sshd[22680]: Failed password for invalid user system from 195.54.160.180 port 14992 ssh2

Oct 10 23:14:59 ws22vmsma01 sshd[161136]: Failed password for root from 49.247.20.23 port 53236 ssh2
...

2020-10-11T08:42:22.563069lavrinenko.info sshd[23719]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=93.64.5.34
2020-10-11T08:42:22.551534lavrinenko.info sshd[23719]: Invalid user test from 93.64.5.34 port 2810
2020-10-11T08:42:24.381574lavrinenko.info sshd[23719]: Failed password for invalid user test from 93.64.5.34 port 2810 ssh2
2020-10-11T08:45:46.911782lavrinenko.info sshd[23962]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=93.64.5.34  user=root
2020-10-11T08:45:49.402741lavrinenko.info sshd[23962]: Failed password for root from 93.64.5.34 port 46743 ssh2
...

prod8
...

Unauthorised access (Oct 10) SRC=211.50.54.124 LEN=40 TTL=242 ID=42584 DF TCP DPT=23 WINDOW=14600 SYN

Oct 11 08:04:54 OPSO sshd\[28361\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.177.172.61  user=root
Oct 11 08:04:56 OPSO sshd\[28361\]: Failed password for root from 61.177.172.61 port 42416 ssh2
Oct 11 08:04:59 OPSO sshd\[28361\]: Failed password for root from 61.177.172.61 port 42416 ssh2
Oct 11 08:05:04 OPSO sshd\[28361\]: Failed password for root from 61.177.172.61 port 42416 ssh2
Oct 11 08:05:09 OPSO sshd\[28361\]: Failed password for root from 61.177.172.61 port 42416 ssh2

Oct 11 07:55:18 inter-technics sshd[3664]: Invalid user user from 141.98.9.165 port 42181
Oct 11 07:55:18 inter-technics sshd[3664]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=141.98.9.165
Oct 11 07:55:18 inter-technics sshd[3664]: Invalid user user from 141.98.9.165 port 42181
Oct 11 07:55:19 inter-technics sshd[3664]: Failed password for invalid user user from 141.98.9.165 port 42181 ssh2
Oct 11 07:55:40 inter-technics sshd[3703]: Invalid user guest from 141.98.9.165 port 46411
...

Oct 11 07:55:22 inter-technics sshd[3666]: Invalid user admin from 141.98.9.166 port 39975
Oct 11 07:55:22 inter-technics sshd[3666]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=141.98.9.166
Oct 11 07:55:22 inter-technics sshd[3666]: Invalid user admin from 141.98.9.166 port 39975
Oct 11 07:55:24 inter-technics sshd[3666]: Failed password for invalid user admin from 141.98.9.166 port 39975 ssh2
Oct 11 07:55:43 inter-technics sshd[3726]: Invalid user ubnt from 141.98.9.166 port 42725
...

srv02 DDoS Malware Target(80:http) ..