Sep 12 00:07:35 mail.srvfarm.net postfix/smtps/smtpd[4172573]: warning: unknown[103.237.56.69]: SASL PLAIN authentication failed: 
Sep 12 00:07:35 mail.srvfarm.net postfix/smtps/smtpd[4172573]: lost connection after AUTH from unknown[103.237.56.69]
Sep 12 00:10:21 mail.srvfarm.net postfix/smtps/smtpd[4004716]: warning: unknown[103.237.56.69]: SASL PLAIN authentication failed: 
Sep 12 00:10:21 mail.srvfarm.net postfix/smtps/smtpd[4004716]: lost connection after AUTH from unknown[103.237.56.69]
Sep 12 00:13:38 mail.srvfarm.net postfix/smtpd[4032472]: warning: unknown[103.237.56.69]: SASL PLAIN authentication failed:

Sep 12 00:07:35 mail.srvfarm.net postfix/smtps/smtpd[4172573]: warning: unknown[103.237.56.69]: SASL PLAIN authentication failed: 
Sep 12 00:07:35 mail.srvfarm.net postfix/smtps/smtpd[4172573]: lost connection after AUTH from unknown[103.237.56.69]
Sep 12 00:10:21 mail.srvfarm.net postfix/smtps/smtpd[4004716]: warning: unknown[103.237.56.69]: SASL PLAIN authentication failed: 
Sep 12 00:10:21 mail.srvfarm.net postfix/smtps/smtpd[4004716]: lost connection after AUTH from unknown[103.237.56.69]
Sep 12 00:13:38 mail.srvfarm.net postfix/smtpd[4032472]: warning: unknown[103.237.56.69]: SASL PLAIN authentication failed:

SMTP Attack

Unauthorized SMTP/IMAP/POP3 connection attempt

Unauthorized SMTP/IMAP/POP3 connection attempt

Unauthorized SMTP/IMAP/POP3 connection attempt

Sep 12 18:38:14 mail.srvfarm.net postfix/smtps/smtpd[547063]: warning: unknown[103.237.56.242]: SASL PLAIN authentication failed: 
Sep 12 18:38:15 mail.srvfarm.net postfix/smtps/smtpd[547063]: lost connection after AUTH from unknown[103.237.56.242]
Sep 12 18:39:01 mail.srvfarm.net postfix/smtps/smtpd[547979]: warning: unknown[103.237.56.242]: SASL PLAIN authentication failed: 
Sep 12 18:39:01 mail.srvfarm.net postfix/smtps/smtpd[547979]: lost connection after AUTH from unknown[103.237.56.242]
Sep 12 18:47:39 mail.srvfarm.net postfix/smtpd[550123]: warning: unknown[103.237.56.242]: SASL PLAIN authentication failed:

Sep 12 02:58:11 mail.srvfarm.net postfix/smtpd[25997]: warning: unknown[103.237.56.38]: SASL PLAIN authentication failed: 
Sep 12 02:58:12 mail.srvfarm.net postfix/smtpd[25997]: lost connection after AUTH from unknown[103.237.56.38]
Sep 12 03:05:39 mail.srvfarm.net postfix/smtps/smtpd[26711]: warning: unknown[103.237.56.38]: SASL PLAIN authentication failed: 
Sep 12 03:05:39 mail.srvfarm.net postfix/smtps/smtpd[26711]: lost connection after AUTH from unknown[103.237.56.38]
Sep 12 03:07:15 mail.srvfarm.net postfix/smtpd[42438]: warning: unknown[103.237.56.38]: SASL PLAIN authentication failed:

Sep 12 02:58:11 mail.srvfarm.net postfix/smtpd[25997]: warning: unknown[103.237.56.38]: SASL PLAIN authentication failed: 
Sep 12 02:58:12 mail.srvfarm.net postfix/smtpd[25997]: lost connection after AUTH from unknown[103.237.56.38]
Sep 12 03:05:39 mail.srvfarm.net postfix/smtps/smtpd[26711]: warning: unknown[103.237.56.38]: SASL PLAIN authentication failed: 
Sep 12 03:05:39 mail.srvfarm.net postfix/smtps/smtpd[26711]: lost connection after AUTH from unknown[103.237.56.38]
Sep 12 03:07:15 mail.srvfarm.net postfix/smtpd[42438]: warning: unknown[103.237.56.38]: SASL PLAIN authentication failed:

Sep  7 11:18:19 mail.srvfarm.net postfix/smtps/smtpd[1026495]: warning: unknown[103.237.56.23]: SASL PLAIN authentication failed: 
Sep  7 11:18:19 mail.srvfarm.net postfix/smtps/smtpd[1026495]: lost connection after AUTH from unknown[103.237.56.23]
Sep  7 11:24:23 mail.srvfarm.net postfix/smtpd[1028455]: warning: unknown[103.237.56.23]: SASL PLAIN authentication failed: 
Sep  7 11:24:23 mail.srvfarm.net postfix/smtpd[1028455]: lost connection after AUTH from unknown[103.237.56.23]
Sep  7 11:26:59 mail.srvfarm.net postfix/smtpd[1028455]: warning: unknown[103.237.56.23]: SASL PLAIN authentication failed:

Sep  7 11:18:19 mail.srvfarm.net postfix/smtps/smtpd[1026495]: warning: unknown[103.237.56.23]: SASL PLAIN authentication failed: 
Sep  7 11:18:19 mail.srvfarm.net postfix/smtps/smtpd[1026495]: lost connection after AUTH from unknown[103.237.56.23]
Sep  7 11:24:23 mail.srvfarm.net postfix/smtpd[1028455]: warning: unknown[103.237.56.23]: SASL PLAIN authentication failed: 
Sep  7 11:24:23 mail.srvfarm.net postfix/smtpd[1028455]: lost connection after AUTH from unknown[103.237.56.23]
Sep  7 11:26:59 mail.srvfarm.net postfix/smtpd[1028455]: warning: unknown[103.237.56.23]: SASL PLAIN authentication failed:

(smtpauth) Failed SMTP AUTH login from 103.237.56.215 (IN/India/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 2020-08-31 01:02:13 plain authenticator failed for ([103.237.56.215]) [103.237.56.215]: 535 Incorrect authentication data (set_id=info)

Aug 27 12:20:10 mail.srvfarm.net postfix/smtps/smtpd[1538101]: warning: unknown[103.237.56.216]: SASL PLAIN authentication failed: 
Aug 27 12:20:10 mail.srvfarm.net postfix/smtps/smtpd[1538101]: lost connection after AUTH from unknown[103.237.56.216]
Aug 27 12:27:43 mail.srvfarm.net postfix/smtpd[1525591]: warning: unknown[103.237.56.216]: SASL PLAIN authentication failed: 
Aug 27 12:27:43 mail.srvfarm.net postfix/smtpd[1525591]: lost connection after AUTH from unknown[103.237.56.216]
Aug 27 12:29:45 mail.srvfarm.net postfix/smtps/smtpd[1541116]: warning: unknown[103.237.56.216]: SASL PLAIN authentication failed:

Aug 27 05:34:42 mail.srvfarm.net postfix/smtps/smtpd[1355069]: warning: unknown[103.237.56.213]: SASL PLAIN authentication failed: 
Aug 27 05:34:42 mail.srvfarm.net postfix/smtps/smtpd[1355069]: lost connection after AUTH from unknown[103.237.56.213]
Aug 27 05:43:54 mail.srvfarm.net postfix/smtps/smtpd[1361620]: warning: unknown[103.237.56.213]: SASL PLAIN authentication failed: 
Aug 27 05:43:54 mail.srvfarm.net postfix/smtps/smtpd[1361620]: lost connection after AUTH from unknown[103.237.56.213]
Aug 27 05:44:04 mail.srvfarm.net postfix/smtpd[1362102]: warning: unknown[103.237.56.213]: SASL PLAIN authentication failed:

Aug 17 05:06:51 mail.srvfarm.net postfix/smtpd[2584332]: warning: unknown[103.237.56.148]: SASL PLAIN authentication failed: 
Aug 17 05:06:51 mail.srvfarm.net postfix/smtpd[2584332]: lost connection after AUTH from unknown[103.237.56.148]
Aug 17 05:10:13 mail.srvfarm.net postfix/smtpd[2584780]: warning: unknown[103.237.56.148]: SASL PLAIN authentication failed: 
Aug 17 05:10:13 mail.srvfarm.net postfix/smtpd[2584780]: lost connection after AUTH from unknown[103.237.56.148]
Aug 17 05:16:26 mail.srvfarm.net postfix/smtpd[2597247]: warning: unknown[103.237.56.148]: SASL PLAIN authentication failed:

Aug 16 05:15:10 mail.srvfarm.net postfix/smtps/smtpd[1874176]: warning: unknown[103.237.56.88]: SASL PLAIN authentication failed: 
Aug 16 05:15:11 mail.srvfarm.net postfix/smtps/smtpd[1874176]: lost connection after AUTH from unknown[103.237.56.88]
Aug 16 05:19:23 mail.srvfarm.net postfix/smtpd[1875198]: warning: unknown[103.237.56.88]: SASL PLAIN authentication failed: 
Aug 16 05:19:23 mail.srvfarm.net postfix/smtpd[1875198]: lost connection after AUTH from unknown[103.237.56.88]
Aug 16 05:22:26 mail.srvfarm.net postfix/smtpd[1874513]: warning: unknown[103.237.56.88]: SASL PLAIN authentication failed:

Aug 16 05:12:51 mail.srvfarm.net postfix/smtpd[1874513]: warning: unknown[103.237.56.148]: SASL PLAIN authentication failed: 
Aug 16 05:12:52 mail.srvfarm.net postfix/smtpd[1874513]: lost connection after AUTH from unknown[103.237.56.148]
Aug 16 05:15:53 mail.srvfarm.net postfix/smtps/smtpd[1872718]: warning: unknown[103.237.56.148]: SASL PLAIN authentication failed: 
Aug 16 05:15:53 mail.srvfarm.net postfix/smtps/smtpd[1872718]: lost connection after AUTH from unknown[103.237.56.148]
Aug 16 05:22:46 mail.srvfarm.net postfix/smtpd[1887708]: warning: unknown[103.237.56.148]: SASL PLAIN authentication failed:

2020-06-10 05:52:54,217 fail2ban.actions        [937]: NOTICE  [sshd] Ban 167.172.195.227
2020-06-10 06:28:42,616 fail2ban.actions        [937]: NOTICE  [sshd] Ban 167.172.195.227
2020-06-10 07:03:55,814 fail2ban.actions        [937]: NOTICE  [sshd] Ban 167.172.195.227
2020-06-10 07:39:57,410 fail2ban.actions        [937]: NOTICE  [sshd] Ban 167.172.195.227
2020-06-10 08:16:45,807 fail2ban.actions        [937]: NOTICE  [sshd] Ban 167.172.195.227
...

Jun 10 06:19:21 onepixel sshd[149903]: Failed password for invalid user com!@ from 193.112.191.228 port 35332 ssh2
Jun 10 06:23:04 onepixel sshd[150357]: Invalid user webpouyan from 193.112.191.228 port 51544
Jun 10 06:23:04 onepixel sshd[150357]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.112.191.228 
Jun 10 06:23:04 onepixel sshd[150357]: Invalid user webpouyan from 193.112.191.228 port 51544
Jun 10 06:23:06 onepixel sshd[150357]: Failed password for invalid user webpouyan from 193.112.191.228 port 51544 ssh2

Jun  9 22:11:01 server sshd[20155]: Failed password for invalid user honey from 144.172.73.38 port 59844 ssh2
Jun  9 22:11:05 server sshd[20155]: Received disconnect from 144.172.73.38: 11: PECL/ssh2 (hxxp://pecl.php.net/packages/ssh2) [preauth]
Jun  9 22:11:07 server sshd[20157]: Failed password for invalid user admin from 144.172.73.38 port 33088 ssh2
Jun  9 22:11:12 server sshd[20157]: Received disconnect from 144.172.73.38: 11: PECL/ssh2 (hxxp://pecl.php.net/packages/ssh2) [preauth]
Jun  9 22:11:13 server sshd[20161]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=144.172.73.38  user=r.r
Jun  9 22:11:15 server sshd[20161]: Failed password for r.r from 144.172.73.38 port 34356 ssh2
Jun  9 22:11:17 server sshd[20163]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=144.172.73.38  user=r.r
Jun  9 22:11:17 server sshd[20161]: Received disconnect from 144.172.73.38: 11: PECL/ssh2 (hxxp://pec........
-------------------------------

(imapd) Failed IMAP login from 189.59.5.91 (BR/Brazil/prpsolucoes.static.gvt.net.br): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Jun 10 08:22:30 ir1 dovecot[2885757]: imap-login: Disconnected (auth failed, 1 attempts in 6 secs): user=, method=PLAIN, rip=189.59.5.91, lip=5.63.12.44, TLS: Connection closed, session=

2020-06-10T07:14:32.777458amanda2.illicoweb.com sshd\[20982\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.ip-51-79-55.net  user=root
2020-06-10T07:14:34.197958amanda2.illicoweb.com sshd\[20982\]: Failed password for root from 51.79.55.183 port 53704 ssh2
2020-06-10T07:20:51.546088amanda2.illicoweb.com sshd\[21172\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.ip-51-79-55.net  user=root
2020-06-10T07:20:53.748659amanda2.illicoweb.com sshd\[21172\]: Failed password for root from 51.79.55.183 port 37060 ssh2
2020-06-10T07:24:24.019099amanda2.illicoweb.com sshd\[21541\]: Invalid user Juhana from 51.79.55.183 port 40986
2020-06-10T07:24:24.022958amanda2.illicoweb.com sshd\[21541\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.ip-51-79-55.net
...

2020-06-10T05:09:47+0000 Failed SSH Authentication/Brute Force Attack. (Server 6)

Jun 10 06:02:34 hell sshd[6622]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=108.183.151.208
Jun 10 06:02:36 hell sshd[6622]: Failed password for invalid user solaris from 108.183.151.208 port 40544 ssh2
...

Automatic report - Banned IP Access

SSH login attempts.

Jun 10 05:53:13 rush sshd[31611]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.65.15
Jun 10 05:53:16 rush sshd[31611]: Failed password for invalid user elasticsearch from 91.121.65.15 port 32950 ssh2
Jun 10 05:55:55 rush sshd[31660]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.121.65.15
...

Jun 10 08:49:36 jane sshd[3549]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.235.183.62 
Jun 10 08:49:39 jane sshd[3549]: Failed password for invalid user newyork from 49.235.183.62 port 38638 ssh2
...

Jun 10 07:31:50 fhem-rasp sshd[17916]: Invalid user qwerty from 37.152.182.193 port 53230
...

Jun 10 05:59:39 Ubuntu-1404-trusty-64-minimal sshd\[12837\]: Invalid user csgoserver from 134.122.50.93
Jun 10 05:59:39 Ubuntu-1404-trusty-64-minimal sshd\[12837\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.122.50.93
Jun 10 05:59:41 Ubuntu-1404-trusty-64-minimal sshd\[12837\]: Failed password for invalid user csgoserver from 134.122.50.93 port 36770 ssh2
Jun 10 06:05:07 Ubuntu-1404-trusty-64-minimal sshd\[17831\]: Invalid user stackato from 134.122.50.93
Jun 10 06:05:07 Ubuntu-1404-trusty-64-minimal sshd\[17831\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.122.50.93

$f2bV_matches

Jun 10 08:09:00 ns382633 sshd\[20948\]: Invalid user adrien from 189.18.243.210 port 55011
Jun 10 08:09:00 ns382633 sshd\[20948\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.18.243.210
Jun 10 08:09:02 ns382633 sshd\[20948\]: Failed password for invalid user adrien from 189.18.243.210 port 55011 ssh2
Jun 10 08:14:20 ns382633 sshd\[21869\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.18.243.210  user=root
Jun 10 08:14:22 ns382633 sshd\[21869\]: Failed password for root from 189.18.243.210 port 54700 ssh2