\[2019-12-30 16:52:06\] NOTICE\[2839\] chan_sip.c: Registration from '\' failed for '85.203.15.121:64383' - Wrong password
\[2019-12-30 16:52:06\] SECURITY\[2857\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-12-30T16:52:06.875-0500",Severity="Error",Service="SIP",EventVersion="2",AccountID="3682",SessionID="0x7f0fb48c2048",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/85.203.15.121/64383",Challenge="0d73e352",ReceivedChallenge="0d73e352",ReceivedHash="bf19357e73c27e2b2d9e0dd509ec4543"
\[2019-12-30 16:58:36\] NOTICE\[2839\] chan_sip.c: Registration from '\' failed for '85.203.15.121:62782' - Wrong password
\[2019-12-30 16:58:36\] SECURITY\[2857\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-12-30T16:58:36.514-0500",Severity="Error",Service="SIP",EventVersion="2",AccountID="1538",SessionID="0x7f0fb48c2048",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/85.203.15

\[2019-12-29 16:25:28\] NOTICE\[2839\] chan_sip.c: Registration from '\' failed for '85.203.15.121:54762' - Wrong password
\[2019-12-29 16:25:28\] SECURITY\[2857\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-12-29T16:25:28.513-0500",Severity="Error",Service="SIP",EventVersion="2",AccountID="949",SessionID="0x7f0fb4ca4128",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/85.203.15.121/54762",Challenge="26d33412",ReceivedChallenge="26d33412",ReceivedHash="56db22e8febe780f1f8e789e9eb41c12"
\[2019-12-29 16:26:17\] NOTICE\[2839\] chan_sip.c: Registration from '\' failed for '85.203.15.121:64886' - Wrong password
\[2019-12-29 16:26:17\] SECURITY\[2857\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-12-29T16:26:17.165-0500",Severity="Error",Service="SIP",EventVersion="2",AccountID="1539",SessionID="0x7f0fb51e7428",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/85.203.15.1

\[2019-12-28 15:45:02\] NOTICE\[2839\] chan_sip.c: Registration from '\' failed for '85.203.15.121:64025' - Wrong password
\[2019-12-28 15:45:02\] SECURITY\[2857\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-12-28T15:45:02.668-0500",Severity="Error",Service="SIP",EventVersion="2",AccountID="3684",SessionID="0x7f0fb41816e8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/85.203.15.121/64025",Challenge="491386a0",ReceivedChallenge="491386a0",ReceivedHash="815e395cac85586c24717cc966477e80"
\[2019-12-28 15:46:48\] NOTICE\[2839\] chan_sip.c: Registration from '\' failed for '85.203.15.121:53156' - Wrong password
\[2019-12-28 15:46:48\] SECURITY\[2857\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-12-28T15:46:48.076-0500",Severity="Error",Service="SIP",EventVersion="2",AccountID="1165",SessionID="0x7f0fb4a47618",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/85.203.15

\[2019-12-25 12:06:51\] NOTICE\[2839\] chan_sip.c: Registration from '\' failed for '85.203.15.121:61666' - Wrong password
\[2019-12-25 12:06:51\] SECURITY\[2857\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-12-25T12:06:51.582-0500",Severity="Error",Service="SIP",EventVersion="2",AccountID="1779",SessionID="0x7f0fb4a5a908",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/85.203.15.121/61666",Challenge="19bb2604",ReceivedChallenge="19bb2604",ReceivedHash="554d79b05ee40850fa5446bc8c2bac7e"
\[2019-12-25 12:08:42\] NOTICE\[2839\] chan_sip.c: Registration from '\' failed for '85.203.15.121:51869' - Wrong password
\[2019-12-25 12:08:42\] SECURITY\[2857\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-12-25T12:08:42.652-0500",Severity="Error",Service="SIP",EventVersion="2",AccountID="1434",SessionID="0x7f0fb45e9848",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/85.203.15

\[2019-12-25 07:12:08\] NOTICE\[2839\] chan_sip.c: Registration from '\' failed for '85.203.15.121:65267' - Wrong password
\[2019-12-25 07:12:08\] SECURITY\[2857\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-12-25T07:12:08.592-0500",Severity="Error",Service="SIP",EventVersion="2",AccountID="3021",SessionID="0x7f0fb499d728",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/85.203.15.121/65267",Challenge="3ad96bda",ReceivedChallenge="3ad96bda",ReceivedHash="fe82fe3fd4b146ab1e072a677d389705"
\[2019-12-25 07:18:32\] NOTICE\[2839\] chan_sip.c: Registration from '\' failed for '85.203.15.121:62950' - Wrong password
\[2019-12-25 07:18:32\] SECURITY\[2857\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-12-25T07:18:32.207-0500",Severity="Error",Service="SIP",EventVersion="2",AccountID="3616",SessionID="0x7f0fb4100798",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/85.203.15

Unauthorized connection attempt detected from IP address 171.229.166.87 to port 445

Dec 17 00:32:52 cumulus sshd[21625]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.71.174  user=r.r
Dec 17 00:32:54 cumulus sshd[21625]: Failed password for r.r from 51.38.71.174 port 46460 ssh2
Dec 17 00:32:54 cumulus sshd[21625]: Received disconnect from 51.38.71.174 port 46460:11: Bye Bye [preauth]
Dec 17 00:32:54 cumulus sshd[21625]: Disconnected from 51.38.71.174 port 46460 [preauth]
Dec 17 00:41:45 cumulus sshd[22297]: Invalid user vengohechea from 51.38.71.174 port 58248
Dec 17 00:41:45 cumulus sshd[22297]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.71.174
Dec 17 00:41:47 cumulus sshd[22297]: Failed password for invalid user vengohechea from 51.38.71.174 port 58248 ssh2
Dec 17 00:41:47 cumulus sshd[22297]: Received disconnect from 51.38.71.174 port 58248:11: Bye Bye [preauth]
Dec 17 00:41:47 cumulus sshd[22297]: Disconnected from 51.38.71.174 port 58248 [preauth]


........
-------------------------------

Honeypot attack, port: 445, PTR: PTR record not found

Honeypot attack, port: 445, PTR: PTR record not found

Dec 18 12:37:41 vtv3 sshd[22140]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.103.17 
Dec 18 12:37:43 vtv3 sshd[22140]: Failed password for invalid user ryter from 80.211.103.17 port 51832 ssh2
Dec 18 12:43:24 vtv3 sshd[24938]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.103.17 
Dec 18 12:54:30 vtv3 sshd[30250]: Failed password for root from 80.211.103.17 port 38352 ssh2
Dec 18 13:00:22 vtv3 sshd[1003]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.103.17 
Dec 18 13:00:24 vtv3 sshd[1003]: Failed password for invalid user migaud from 80.211.103.17 port 43230 ssh2
Dec 18 13:11:33 vtv3 sshd[6016]: Failed password for root from 80.211.103.17 port 53020 ssh2
Dec 18 13:17:05 vtv3 sshd[8544]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.211.103.17 
Dec 18 13:17:08 vtv3 sshd[8544]: Failed password for invalid user www from

12/18/2019-06:01:45.520323 185.175.93.17 Protocol: 6 ET SCAN NMAP -sS window 1024

2019-12-18 00:26:24 dovecot_login authenticator failed for (kyxczto.com) [113.14.131.26]:58107 I=[192.147.25.65]:25: 535 Incorrect authentication data (set_id=ler@lerctr.org)
2019-12-18 00:26:35 dovecot_login authenticator failed for (kyxczto.com) [113.14.131.26]:58536 I=[192.147.25.65]:25: 535 Incorrect authentication data (set_id=ler@lerctr.org)
2019-12-18 00:26:48 dovecot_login authenticator failed for (kyxczto.com) [113.14.131.26]:59333 I=[192.147.25.65]:25: 535 Incorrect authentication data (set_id=ler@lerctr.org)
...

$f2bV_matches_ltvn

Dec 18 05:51:15 ws12vmsma01 sshd[32842]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=static-33-8-26-46.ipcom.comunitel.net 
Dec 18 05:51:15 ws12vmsma01 sshd[32842]: Invalid user dayaneni from 46.26.8.33
Dec 18 05:51:16 ws12vmsma01 sshd[32842]: Failed password for invalid user dayaneni from 46.26.8.33 port 4153 ssh2
...

Dec 18 00:37:55 web1 sshd\[20725\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=170.210.214.50  user=root
Dec 18 00:37:57 web1 sshd\[20725\]: Failed password for root from 170.210.214.50 port 41946 ssh2
Dec 18 00:43:25 web1 sshd\[21349\]: Invalid user mia from 170.210.214.50
Dec 18 00:43:25 web1 sshd\[21349\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=170.210.214.50
Dec 18 00:43:27 web1 sshd\[21349\]: Failed password for invalid user mia from 170.210.214.50 port 39852 ssh2

Dec 18 11:28:16 sip sshd[29149]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.223.34.141
Dec 18 11:28:18 sip sshd[29149]: Failed password for invalid user activista from 115.223.34.141 port 45891 ssh2
Dec 18 11:37:16 sip sshd[29220]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.223.34.141

Lines containing failures of 180.76.102.226
Dec 16 09:14:19 kmh-vmh-001-fsn03 sshd[14520]: Invalid user wwting from 180.76.102.226 port 46484
Dec 16 09:14:19 kmh-vmh-001-fsn03 sshd[14520]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.102.226 
Dec 16 09:14:21 kmh-vmh-001-fsn03 sshd[14520]: Failed password for invalid user wwting from 180.76.102.226 port 46484 ssh2
Dec 16 09:14:22 kmh-vmh-001-fsn03 sshd[14520]: Received disconnect from 180.76.102.226 port 46484:11: Bye Bye [preauth]
Dec 16 09:14:22 kmh-vmh-001-fsn03 sshd[14520]: Disconnected from invalid user wwting 180.76.102.226 port 46484 [preauth]
Dec 16 09:29:12 kmh-vmh-001-fsn03 sshd[23257]: Invalid user telefony from 180.76.102.226 port 38242
Dec 16 09:29:12 kmh-vmh-001-fsn03 sshd[23257]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.102.226 
Dec 16 09:29:14 kmh-vmh-001-fsn03 sshd[23257]: Failed password for invalid us........
------------------------------

Invalid user ssh from 221.2.158.54 port 38990
pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.2.158.54
Failed password for invalid user ssh from 221.2.158.54 port 38990 ssh2
Invalid user akai from 221.2.158.54 port 39924
pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.2.158.54

Dec 18 10:32:03 localhost sshd[56795]: Failed password for root from 104.236.175.127 port 45432 ssh2
Dec 18 10:38:06 localhost sshd[56897]: Failed password for invalid user velnor from 104.236.175.127 port 35200 ssh2
Dec 18 10:43:11 localhost sshd[57072]: Failed password for root from 104.236.175.127 port 43940 ssh2

Dec 18 10:15:41 vpn01 sshd[15128]: Failed password for root from 134.175.41.71 port 36112 ssh2
...