Sep 21 09:22:47 dignus sshd[2034]: Invalid user chris from 168.232.152.254 port 51616
Sep 21 09:22:47 dignus sshd[2034]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=168.232.152.254
Sep 21 09:22:49 dignus sshd[2034]: Failed password for invalid user chris from 168.232.152.254 port 51616 ssh2
Sep 21 09:26:30 dignus sshd[2625]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=168.232.152.254  user=root
Sep 21 09:26:33 dignus sshd[2625]: Failed password for root from 168.232.152.254 port 47654 ssh2
...

2020-09-21 04:23:49,305 fail2ban.actions: WARNING [ssh] Ban 168.232.152.254

Sep 17 23:47:40 propaganda sshd[5618]: Connection from 168.232.152.254 port 47690 on 10.0.0.161 port 22 rdomain ""
Sep 17 23:47:40 propaganda sshd[5618]: Connection closed by 168.232.152.254 port 47690 [preauth]

2020-09-17T16:42:09.195033linuxbox-skyline sshd[1112]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=168.232.152.254  user=root
2020-09-17T16:42:11.425929linuxbox-skyline sshd[1112]: Failed password for root from 168.232.152.254 port 45842 ssh2
...

Sep  1 14:26:04 vps sshd[27428]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=168.232.152.254 
Sep  1 14:26:06 vps sshd[27428]: Failed password for invalid user cie from 168.232.152.254 port 42162 ssh2
Sep  1 14:33:44 vps sshd[27733]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=168.232.152.254 
...

Aug 31 05:09:44 web1 sshd\[27305\]: Invalid user roy from 168.232.152.254
Aug 31 05:09:44 web1 sshd\[27305\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=168.232.152.254
Aug 31 05:09:46 web1 sshd\[27305\]: Failed password for invalid user roy from 168.232.152.254 port 39050 ssh2
Aug 31 05:13:23 web1 sshd\[27605\]: Invalid user tom from 168.232.152.254
Aug 31 05:13:23 web1 sshd\[27605\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=168.232.152.254

Aug 31 06:25:29 meumeu sshd[690045]: Invalid user giaou from 168.232.152.254 port 45600
Aug 31 06:25:29 meumeu sshd[690045]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=168.232.152.254 
Aug 31 06:25:29 meumeu sshd[690045]: Invalid user giaou from 168.232.152.254 port 45600
Aug 31 06:25:30 meumeu sshd[690045]: Failed password for invalid user giaou from 168.232.152.254 port 45600 ssh2
Aug 31 06:28:12 meumeu sshd[690123]: Invalid user nadmin from 168.232.152.254 port 54800
Aug 31 06:28:12 meumeu sshd[690123]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=168.232.152.254 
Aug 31 06:28:12 meumeu sshd[690123]: Invalid user nadmin from 168.232.152.254 port 54800
Aug 31 06:28:13 meumeu sshd[690123]: Failed password for invalid user nadmin from 168.232.152.254 port 54800 ssh2
Aug 31 06:30:50 meumeu sshd[690255]: Invalid user admin from 168.232.152.254 port 36016
...

*Port Scan* detected from 168.232.152.254 (BR/Brazil/Rio Grande do Norte/Mossoró/254customer-152-232-168.tcm10.com.br). 4 hits in the last 110 seconds

Automatic report - Banned IP Access

(mod_security) mod_security (id:920350) triggered by 168.232.15.74 (BR/-/-): 1 in the last 600 secs; Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: 2020/08/09 22:24:57 [error] 346090#0: *37543 [client 168.232.15.74] ModSecurity: Access denied with code 406 (phase 2). Matched "Operator `Rx' with parameter `^[\d.:]+$' against variable `REQUEST_HEADERS:Host'  [redacted] [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "718"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [redacted] [severity "4"] [ver "OWASP_CRS/3.3.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [redacted] [uri "/"] [unique_id "159700469720.880984"] [ref "o0,18v21,18"], client: 168.232.15.74, [redacted] request: "GET / HTTP/1.1" [redacted]

Automatic report - Banned IP Access

Unauthorized connection attempt detected from IP address 168.232.15.182 to port 23

Automatic report - Banned IP Access

2020-06-02T20:16:54.691535ns386461 sshd\[3562\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=168.232.152.242  user=root
2020-06-02T20:16:56.374567ns386461 sshd\[3562\]: Failed password for root from 168.232.152.242 port 53696 ssh2
2020-06-02T20:20:05.364168ns386461 sshd\[6417\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=168.232.152.242  user=root
2020-06-02T20:20:07.600099ns386461 sshd\[6417\]: Failed password for root from 168.232.152.242 port 36954 ssh2
2020-06-02T20:21:59.995991ns386461 sshd\[8105\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=168.232.152.242  user=root
...

2020-05-2422:28:521jcxEq-00038Z-2P\<=info@whatsup2013.chH=\(localhost\)[41.41.132.26]:39382P=esmtpsaX=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256CV=noA=dovecot_login:info@whatsup2013.chS=2080id=5451E7B4BF6B4407DBDE972FEB579798@whatsup2013.chT="I'llresidenearwheneversomeoneisgoingtoturntheirownbackonyou"fortwentyoneguns24@gmail.com2020-05-2422:30:311jcxGR-0003Ij-G5\<=info@whatsup2013.chH=net-93-144-81-223.cust.vodafonedsl.it\(localhost\)[93.144.81.223]:50493P=esmtpsaX=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256CV=noA=dovecot_login:info@whatsup2013.chS=2036id=C6C375262DF9D695494C05BD79491F87@whatsup2013.chT="I'mabletodemonstratejusthowarealgirlcanreallylove"forsum1help825@gmail.com2020-05-2422:30:481jcxGi-0003Jl-1T\<=info@whatsup2013.chH=\(localhost\)[123.16.254.205]:33376P=esmtpsaX=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256CV=noA=dovecot_login:info@whatsup2013.chS=2022id=C2C7712229FDD2914D4801B97D12A961@whatsup2013.chT="Iwouldliketofindapersonforatrulyseriouspartnership"fornga114691@gmail.com2020-05-2422:29:521jcxFn

Jun 25 10:26:35 firewall sshd[15526]: Invalid user pi from 37.18.40.167
Jun 25 10:26:37 firewall sshd[15526]: Failed password for invalid user pi from 37.18.40.167 port 27587 ssh2
Jun 25 10:27:36 firewall sshd[15570]: Invalid user postgres from 37.18.40.167
...

Jun 25 10:19:12 NPSTNNYC01T sshd[2576]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=132.248.28.117
Jun 25 10:19:14 NPSTNNYC01T sshd[2576]: Failed password for invalid user ttr from 132.248.28.117 port 49020 ssh2
Jun 25 10:22:49 NPSTNNYC01T sshd[2764]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=132.248.28.117
...

2020-06-25T14:59:49.637029shield sshd\[17891\]: Invalid user guest from 140.143.133.168 port 38300
2020-06-25T14:59:49.639621shield sshd\[17891\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=140.143.133.168
2020-06-25T14:59:51.238034shield sshd\[17891\]: Failed password for invalid user guest from 140.143.133.168 port 38300 ssh2
2020-06-25T15:00:39.477631shield sshd\[18039\]: Invalid user guest from 140.143.133.168 port 60308
2020-06-25T15:00:39.481368shield sshd\[18039\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=140.143.133.168

2020-06-25T17:42:05.719438lavrinenko.info sshd[2813]: Failed password for invalid user wangzhe from 134.175.249.204 port 46286 ssh2
2020-06-25T17:46:38.821092lavrinenko.info sshd[3022]: Invalid user sysadmin from 134.175.249.204 port 44896
2020-06-25T17:46:38.827380lavrinenko.info sshd[3022]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.175.249.204
2020-06-25T17:46:38.821092lavrinenko.info sshd[3022]: Invalid user sysadmin from 134.175.249.204 port 44896
2020-06-25T17:46:41.504598lavrinenko.info sshd[3022]: Failed password for invalid user sysadmin from 134.175.249.204 port 44896 ssh2
...

2020-06-25T14:31:53+0200 Failed SSH Authentication/Brute Force Attack. (Server 4)

DATE:2020-06-25 14:26:28, IP:189.4.105.33, PORT:telnet Telnet brute force auth on honeypot server (epe-honey1-hq)

Jun 25 19:35:26 gw1 sshd[28011]: Failed password for root from 222.186.30.59 port 12355 ssh2
...

Cowrie Honeypot: 10 unauthorised SSH/Telnet login attempts between 2020-06-25T14:02:09Z and 2020-06-25T15:13:17Z

Jun 25 14:24:42 eventyay sshd[2732]: Failed password for root from 139.59.254.93 port 43810 ssh2
Jun 25 14:26:08 eventyay sshd[2785]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.254.93
Jun 25 14:26:10 eventyay sshd[2785]: Failed password for invalid user willy from 139.59.254.93 port 55344 ssh2
...

[2020-06-25 08:18:47] NOTICE[1273][C-0000488f] chan_sip.c: Call from '' (185.53.88.37:5070) to extension '9011972594771385' rejected because extension not found in context 'public'.
[2020-06-25 08:18:47] SECURITY[1288] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-06-25T08:18:47.020-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="9011972594771385",SessionID="0x7f31c054cb28",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/185.53.88.37/5070",ACLName="no_extension_match"
[2020-06-25 08:26:06] NOTICE[1273][C-000048ae] chan_sip.c: Call from '' (185.53.88.37:5070) to extension '+972594771385' rejected because extension not found in context 'public'.
[2020-06-25 08:26:06] SECURITY[1288] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-06-25T08:26:06.830-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="+972594771385",SessionID="0x7f31c054cb28",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/185.53.8
...

unauthorized connection attempt

2020-06-25T16:27:48.228497sd-86998 sshd[41334]: Invalid user openuser from 51.38.189.138 port 52864
2020-06-25T16:27:48.233874sd-86998 sshd[41334]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.ip-51-38-189.eu
2020-06-25T16:27:48.228497sd-86998 sshd[41334]: Invalid user openuser from 51.38.189.138 port 52864
2020-06-25T16:27:50.449809sd-86998 sshd[41334]: Failed password for invalid user openuser from 51.38.189.138 port 52864 ssh2
2020-06-25T16:30:57.862759sd-86998 sshd[41827]: Invalid user lyc from 51.38.189.138 port 52608
...

Jun 25 16:22:16 web01.agentur-b-2.de postfix/smtpd[2658583]: warning: unknown[78.128.113.116]: SASL PLAIN authentication failed: 
Jun 25 16:22:16 web01.agentur-b-2.de postfix/smtpd[2658583]: lost connection after AUTH from unknown[78.128.113.116]
Jun 25 16:22:21 web01.agentur-b-2.de postfix/smtpd[2658583]: lost connection after AUTH from unknown[78.128.113.116]
Jun 25 16:22:26 web01.agentur-b-2.de postfix/smtpd[2661519]: lost connection after AUTH from unknown[78.128.113.116]
Jun 25 16:22:31 web01.agentur-b-2.de postfix/smtpd[2658583]: lost connection after AUTH from unknown[78.128.113.116]

2020-06-25T14:32:36+0200 Failed SSH Authentication/Brute Force Attack. (Server 4)

Daily spam