Sep 16 23:09:53 web1 postfix/smtpd[22894]: warning: unknown[141.98.80.80]: SASL PLAIN authentication failed: authentication failure
...

Sep 14 18:32:50 mail postfix/smtpd\[6688\]: warning: unknown\[141.98.80.80\]: SASL PLAIN authentication failed: \
Sep 14 19:04:08 mail postfix/smtpd\[7435\]: warning: unknown\[141.98.80.80\]: SASL PLAIN authentication failed: \
Sep 14 19:04:15 mail postfix/smtpd\[7435\]: warning: unknown\[141.98.80.80\]: SASL PLAIN authentication failed: \
Sep 14 19:23:03 mail postfix/smtpd\[7899\]: warning: unknown\[141.98.80.80\]: SASL PLAIN authentication failed: \

Sep 14 00:21:15 s1 postfix/submission/smtpd\[21563\]: warning: unknown\[141.98.80.80\]: SASL PLAIN authentication failed:
Sep 14 00:21:22 s1 postfix/submission/smtpd\[21563\]: warning: unknown\[141.98.80.80\]: SASL PLAIN authentication failed:
Sep 14 00:21:37 s1 postfix/submission/smtpd\[21563\]: warning: unknown\[141.98.80.80\]: SASL PLAIN authentication failed:
Sep 14 00:21:44 s1 postfix/submission/smtpd\[22479\]: warning: unknown\[141.98.80.80\]: SASL PLAIN authentication failed:
Sep 14 00:21:45 s1 postfix/submission/smtpd\[21563\]: warning: unknown\[141.98.80.80\]: SASL PLAIN authentication failed:
Sep 14 00:22:06 s1 postfix/submission/smtpd\[22479\]: warning: unknown\[141.98.80.80\]: SASL PLAIN authentication failed:
Sep 14 00:22:11 s1 postfix/submission/smtpd\[22475\]: warning: unknown\[141.98.80.80\]: SASL PLAIN authentication failed:
Sep 14 00:22:31 s1 postfix/submission/smtpd\[22475\]: warning: unknown\[141.98.80.80\]: SASL PLAIN authentication failed:
Sep 14 00:22:31 s1 postfix/submission/smtpd\[215

Sep 12 13:04:28 ncomp postfix/smtpd[3726]: warning: unknown[141.98.80.80]: SASL PLAIN authentication failed:
Sep 12 13:04:39 ncomp postfix/smtpd[3726]: warning: unknown[141.98.80.80]: SASL PLAIN authentication failed:
Sep 12 13:40:40 ncomp postfix/smtpd[4354]: warning: unknown[141.98.80.80]: SASL PLAIN authentication failed:

Sep 11 21:30:21 mail postfix/smtpd\[17518\]: warning: unknown\[141.98.80.80\]: SASL PLAIN authentication failed: \
Sep 11 21:30:31 mail postfix/smtpd\[18142\]: warning: unknown\[141.98.80.80\]: SASL PLAIN authentication failed: \
Sep 11 22:01:30 mail postfix/smtpd\[17395\]: warning: unknown\[141.98.80.80\]: SASL PLAIN authentication failed: \
Sep 11 22:01:39 mail postfix/smtpd\[13803\]: warning: unknown\[141.98.80.80\]: SASL PLAIN authentication failed: \

Sep 11 01:28:23 vmanager6029 postfix/smtpd\[32289\]: warning: unknown\[141.98.80.80\]: SASL PLAIN authentication failed:
Sep 11 01:28:42 vmanager6029 postfix/smtpd\[32289\]: warning: unknown\[141.98.80.80\]: SASL PLAIN authentication failed:

Sep 10 03:14:10 mail postfix/smtpd\[18325\]: warning: unknown\[141.98.80.80\]: SASL PLAIN authentication failed: \
Sep 10 03:14:23 mail postfix/smtpd\[18325\]: warning: unknown\[141.98.80.80\]: SASL PLAIN authentication failed: \
Sep 10 04:02:10 mail postfix/smtpd\[18988\]: warning: unknown\[141.98.80.80\]: SASL PLAIN authentication failed: \
Sep 10 04:02:18 mail postfix/smtpd\[20587\]: warning: unknown\[141.98.80.80\]: SASL PLAIN authentication failed: \

2019-09-09 13:26:00 fixed_plain authenticator failed for \(\[141.98.80.80\]\) \[141.98.80.80\]: 535 Incorrect authentication data \(set_id=chris@thepuddles.net.nz\)
2019-09-09 13:26:05 fixed_plain authenticator failed for \(\[141.98.80.80\]\) \[141.98.80.80\]: 535 Incorrect authentication data \(set_id=chris\)
2019-09-09 14:48:15 fixed_plain authenticator failed for \(\[141.98.80.80\]\) \[141.98.80.80\]: 535 Incorrect authentication data \(set_id=hobo@thepuddles.net.nz\)
...

2019-09-0812:14:28dovecot_plainauthenticatorfailedfor\([141.98.80.80]\)[141.98.80.80]:52962:535Incorrectauthenticationdata\(set_id=alice@tpgs.ch\)2019-09-0812:14:36dovecot_plainauthenticatorfailedfor\([141.98.80.80]\)[141.98.80.80]:33408:535Incorrectauthenticationdata\(set_id=alice\)2019-09-0812:27:37dovecot_plainauthenticatorfailedfor\([141.98.80.80]\)[141.98.80.80]:8480:535Incorrectauthenticationdata\(set_id=giorgio@modesti.it\)2019-09-0812:27:45dovecot_plainauthenticatorfailedfor\([141.98.80.80]\)[141.98.80.80]:43308:535Incorrectauthenticationdata\(set_id=giorgio\)2019-09-0812:43:26dovecot_plainauthenticatorfailedfor\([141.98.80.80]\)[141.98.80.80]:21596:535Incorrectauthenticationdata\(set_id=aurelia@helcom.net\)2019-09-0812:43:34dovecot_plainauthenticatorfailedfor\([141.98.80.80]\)[141.98.80.80]:37078:535Incorrectauthenticationdata\(set_id=aurelia\)2019-09-0813:08:12dovecot_plainauthenticatorfailedfor\([141.98.80.80]\)[141.98.80.80]:27706:535Incorrectauthenticationdata\(set_id=dimlailildimlailil@panyluz.c

Sep  7 20:06:15 georgia postfix/smtpd[5751]: connect from unknown[141.98.80.80]
Sep  7 20:06:17 georgia postfix/smtpd[5751]: warning: unknown[141.98.80.80]: SASL PLAIN authentication failed: authentication failure
Sep  7 20:06:17 georgia postfix/smtpd[5751]: lost connection after AUTH from unknown[141.98.80.80]
Sep  7 20:06:17 georgia postfix/smtpd[5751]: disconnect from unknown[141.98.80.80] ehlo=1 auth=0/1 commands=1/2
Sep  7 20:06:17 georgia postfix/smtpd[6532]: connect from unknown[141.98.80.80]
Sep  7 20:06:18 georgia postfix/smtpd[6532]: warning: unknown[141.98.80.80]: SASL PLAIN authentication failed: authentication failure
Sep  7 20:06:19 georgia postfix/smtpd[6532]: lost connection after AUTH from unknown[141.98.80.80]
Sep  7 20:06:19 georgia postfix/smtpd[6532]: disconnect from unknown[141.98.80.80] ehlo=1 auth=0/1 commands=1/2
Sep  7 20:07:31 georgia postfix/smtpd[5751]: connect from unknown[141.98.80.80]
Sep  7 20:07:32 georgia postfix/smtpd[5751]: warning: ........
-------------------------------

Oct 13 20:36:42 mail postfix/smtpd\[2755\]: warning: unknown\[141.98.80.73\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6\
Oct 13 21:07:45 mail postfix/smtpd\[3739\]: warning: unknown\[141.98.80.73\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6\
Oct 13 21:08:05 mail postfix/smtpd\[3743\]: warning: unknown\[141.98.80.73\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6\
Oct 13 21:08:21 mail postfix/smtpd\[3743\]: warning: unknown\[141.98.80.73\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6\

Oct 13 12:10:32 mail postfix/smtpd\[17486\]: warning: unknown\[141.98.80.73\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6\
Oct 13 12:10:52 mail postfix/smtpd\[17603\]: warning: unknown\[141.98.80.73\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6\
Oct 13 12:11:11 mail postfix/smtpd\[17486\]: warning: unknown\[141.98.80.73\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6\
Oct 13 12:42:04 mail postfix/smtpd\[18268\]: warning: unknown\[141.98.80.73\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6\

2020-10-11 20:00:28 dovecot_login authenticator failed for \(\[141.98.80.72\]\) \[141.98.80.72\]: 535 Incorrect authentication data \(set_id=ben@benjaminhauck.com\)
2020-10-11 20:00:36 dovecot_login authenticator failed for \(\[141.98.80.72\]\) \[141.98.80.72\]: 535 Incorrect authentication data
2020-10-11 20:00:45 dovecot_login authenticator failed for \(\[141.98.80.72\]\) \[141.98.80.72\]: 535 Incorrect authentication data
2020-10-11 20:00:51 dovecot_login authenticator failed for \(\[141.98.80.72\]\) \[141.98.80.72\]: 535 Incorrect authentication data
2020-10-11 20:01:03 dovecot_login authenticator failed for \(\[141.98.80.72\]\) \[141.98.80.72\]: 535 Incorrect authentication data
...

Fail2Ban Ban Triggered

Brute Force attack - banned by Fail2Ban

[H1.VM1] Blocked by UFW

port scan hacking

Tried to scan TCP Port but the Antivirus refused. More than 20 times within a few months.

\x03 400 0 "-" "-"

Found on   Binary Defense     / proto=6  .  srcport=65528  .  dstport=53 DNS  .     (757)

Exim brute force attack (multiple auth failures).

UTC 10/08/2020 18:12:24 - 83 - Security Services - Alert - 141.98.80.22, 65534, X1 - xxx.xxx.xxx.xxx, 8651, X1 - tcp - TCP scanned port list, 8691, 8611, 8671, 8601, 8661, 8641, 8681, 8631, 8621, 8651 - Probable port scan detected

Oct  8 17:35:05 relay postfix/smtpd\[8860\]: warning: unknown\[141.98.80.190\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Oct  8 17:35:26 relay postfix/smtpd\[4144\]: warning: unknown\[141.98.80.190\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Oct  8 17:40:26 relay postfix/smtpd\[5072\]: warning: unknown\[141.98.80.190\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Oct  8 17:40:45 relay postfix/smtpd\[4145\]: warning: unknown\[141.98.80.190\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Oct  8 17:46:12 relay postfix/smtpd\[8861\]: warning: unknown\[141.98.80.190\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
...

scans 10 times in preceeding hours on the ports (in chronological order) 8601 8611 8621 8631 8641 8651 8661 8671 8681 8691

tcp port scan

proto=tcp  .  spt=33925  .  dpt=25  .     (Listed on    truncate-gbudb also unsubscore and rbldns-ru)     (686)

Unauthorized connection attempt from IP address 111.93.214.78 on Port 445(SMB)

Oct  9 11:41:21 ny01 sshd[28382]: Failed password for root from 222.186.52.86 port 64989 ssh2
Oct  9 11:46:19 ny01 sshd[28827]: Failed password for root from 222.186.52.86 port 36302 ssh2

Oct  9 19:41:42 master sshd[30322]: Failed password for root from 139.59.59.194 port 43300 ssh2
Oct  9 19:50:47 master sshd[30343]: Failed password for root from 139.59.59.194 port 52042 ssh2
Oct  9 19:55:01 master sshd[30351]: Failed password for root from 139.59.59.194 port 35532 ssh2
Oct  9 19:59:28 master sshd[30361]: Failed password for root from 139.59.59.194 port 47258 ssh2
Oct  9 20:03:51 master sshd[30673]: Failed password for root from 139.59.59.194 port 58980 ssh2
Oct  9 20:08:06 master sshd[30681]: Failed password for root from 139.59.59.194 port 42476 ssh2
Oct  9 20:12:33 master sshd[30691]: Failed password for root from 139.59.59.194 port 54198 ssh2
Oct  9 20:17:03 master sshd[30708]: Failed password for root from 139.59.59.194 port 37694 ssh2
Oct  9 20:21:26 master sshd[30719]: Failed password for root from 139.59.59.194 port 49416 ssh2
Oct  9 20:25:42 master sshd[30727]: Failed password for root from 139.59.59.194 port 32906 ssh2
Oct  9 20:30:00 master sshd[30737]: Failed password for root fro

Autoban   195.55.95.94 AUTH/CONNECT

Spam trapped

SSH brutforce

Oct  6 18:23:47 mxgate1 sshd[3977]: Invalid user pi from 87.202.138.143 port 47108
Oct  6 18:23:47 mxgate1 sshd[3979]: Invalid user pi from 87.202.138.143 port 47110
Oct  6 18:23:47 mxgate1 sshd[3977]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=87.202.138.143
Oct  6 18:23:47 mxgate1 sshd[3979]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=87.202.138.143


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=87.202.138.143

Oct  9 20:16:04 dev0-dcde-rnet sshd[15870]: Failed password for root from 23.247.33.61 port 34298 ssh2
Oct  9 20:19:52 dev0-dcde-rnet sshd[15890]: Failed password for root from 23.247.33.61 port 46812 ssh2

2019-10-09T12:19:33.1627571495-001 sshd\[50615\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.217.223.143  user=root
2019-10-09T12:19:34.9046931495-001 sshd\[50615\]: Failed password for root from 139.217.223.143 port 59370 ssh2
2019-10-09T13:22:47.5387311495-001 sshd\[55271\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.217.223.143  user=root
2019-10-09T13:22:49.4658251495-001 sshd\[55271\]: Failed password for root from 139.217.223.143 port 53156 ssh2
2019-10-09T13:27:28.1224271495-001 sshd\[55821\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.217.223.143  user=root
2019-10-09T13:27:30.2903221495-001 sshd\[55821\]: Failed password for root from 139.217.223.143 port 33112 ssh2
...

Oct  9 09:39:02 eddieflores sshd\[21532\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.210.175.63  user=root
Oct  9 09:39:04 eddieflores sshd\[21532\]: Failed password for root from 210.210.175.63 port 54520 ssh2
Oct  9 09:43:12 eddieflores sshd\[21869\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.210.175.63  user=root
Oct  9 09:43:14 eddieflores sshd\[21869\]: Failed password for root from 210.210.175.63 port 36996 ssh2
Oct  9 09:47:23 eddieflores sshd\[22181\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.210.175.63  user=root

2019-10-09 13:29:03,645 fail2ban.actions        \[1778\]: NOTICE  \[sshd\] Ban 110.164.72.34
2019-10-09 14:06:58,396 fail2ban.actions        \[1778\]: NOTICE  \[sshd\] Ban 110.164.72.34
2019-10-09 14:45:33,636 fail2ban.actions        \[1778\]: NOTICE  \[sshd\] Ban 110.164.72.34
2019-10-09 15:24:12,271 fail2ban.actions        \[1778\]: NOTICE  \[sshd\] Ban 110.164.72.34
2019-10-09 16:02:43,190 fail2ban.actions        \[1778\]: NOTICE  \[sshd\] Ban 110.164.72.34
...

Honeypot hit.

2019-10-10T02:04:08.440494enmeeting.mahidol.ac.th sshd\[20048\]: User root from 150.117.122.44 not allowed because not listed in AllowUsers
2019-10-10T02:04:08.567366enmeeting.mahidol.ac.th sshd\[20048\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=150.117.122.44  user=root
2019-10-10T02:04:10.308106enmeeting.mahidol.ac.th sshd\[20048\]: Failed password for invalid user root from 150.117.122.44 port 35054 ssh2
...

(From amucioabogados610@mail.com) Dearest in mind, 
 
I would like to introduce myself for the first time. My name is Barrister David Gomez Gonzalez, the personal lawyer to my late client. 
Who worked as a private businessman in the international field. In 2012, my client succumbed to an unfortunate car accident. My client was single and childless. 
He left a fortune worth $12,500,000.00 Dollars in a bank in Spain. The bank sent me message that I have to introduce a beneficiary or the money in their bank will be confiscate. My purpose of contacting you is to make you the Next of Kin. 
My late client left no will, I as his personal lawyer, was commissioned by the Spanish Bank to search for relatives to whom the money left behind could be paid to. I have been looking for his relatives for the past 3 months continuously without success. Now I explain why I need your support, I have decided to make a citizen of the same country with my late client the Next of Kin. 
 
I hereby ask you if you will give me yo