Sep 14 18:02:51 mail.srvfarm.net postfix/smtpd[2071338]: warning: unknown[177.54.251.157]: SASL PLAIN authentication failed: 
Sep 14 18:02:51 mail.srvfarm.net postfix/smtpd[2071338]: lost connection after AUTH from unknown[177.54.251.157]
Sep 14 18:04:49 mail.srvfarm.net postfix/smtpd[2056973]: warning: unknown[177.54.251.157]: SASL PLAIN authentication failed: 
Sep 14 18:04:50 mail.srvfarm.net postfix/smtpd[2056973]: lost connection after AUTH from unknown[177.54.251.157]
Sep 14 18:09:10 mail.srvfarm.net postfix/smtpd[2071338]: warning: unknown[177.54.251.157]: SASL PLAIN authentication failed:

Sep 14 18:02:51 mail.srvfarm.net postfix/smtpd[2071338]: warning: unknown[177.54.251.157]: SASL PLAIN authentication failed: 
Sep 14 18:02:51 mail.srvfarm.net postfix/smtpd[2071338]: lost connection after AUTH from unknown[177.54.251.157]
Sep 14 18:04:49 mail.srvfarm.net postfix/smtpd[2056973]: warning: unknown[177.54.251.157]: SASL PLAIN authentication failed: 
Sep 14 18:04:50 mail.srvfarm.net postfix/smtpd[2056973]: lost connection after AUTH from unknown[177.54.251.157]
Sep 14 18:09:10 mail.srvfarm.net postfix/smtpd[2071338]: warning: unknown[177.54.251.157]: SASL PLAIN authentication failed:

Sep 14 18:02:51 mail.srvfarm.net postfix/smtpd[2071338]: warning: unknown[177.54.251.157]: SASL PLAIN authentication failed: 
Sep 14 18:02:51 mail.srvfarm.net postfix/smtpd[2071338]: lost connection after AUTH from unknown[177.54.251.157]
Sep 14 18:04:49 mail.srvfarm.net postfix/smtpd[2056973]: warning: unknown[177.54.251.157]: SASL PLAIN authentication failed: 
Sep 14 18:04:50 mail.srvfarm.net postfix/smtpd[2056973]: lost connection after AUTH from unknown[177.54.251.157]
Sep 14 18:09:10 mail.srvfarm.net postfix/smtpd[2071338]: warning: unknown[177.54.251.157]: SASL PLAIN authentication failed:

Aug 16 05:17:18 mail.srvfarm.net postfix/smtps/smtpd[1888391]: warning: unknown[177.54.251.17]: SASL PLAIN authentication failed: 
Aug 16 05:17:18 mail.srvfarm.net postfix/smtps/smtpd[1888391]: lost connection after AUTH from unknown[177.54.251.17]
Aug 16 05:18:18 mail.srvfarm.net postfix/smtps/smtpd[1887810]: warning: unknown[177.54.251.17]: SASL PLAIN authentication failed: 
Aug 16 05:18:20 mail.srvfarm.net postfix/smtps/smtpd[1887810]: lost connection after AUTH from unknown[177.54.251.17]
Aug 16 05:20:45 mail.srvfarm.net postfix/smtpd[1888510]: warning: unknown[177.54.251.17]: SASL PLAIN authentication failed:

Aug 16 06:20:45 mail.srvfarm.net postfix/smtpd[1924790]: warning: unknown[177.54.251.214]: SASL PLAIN authentication failed: 
Aug 16 06:20:45 mail.srvfarm.net postfix/smtpd[1924785]: warning: unknown[177.54.251.214]: SASL PLAIN authentication failed: 
Aug 16 06:20:45 mail.srvfarm.net postfix/smtpd[1924785]: lost connection after AUTH from unknown[177.54.251.214]
Aug 16 06:20:46 mail.srvfarm.net postfix/smtpd[1924790]: lost connection after AUTH from unknown[177.54.251.214]
Aug 16 06:29:48 mail.srvfarm.net postfix/smtpd[1913728]: warning: unknown[177.54.251.214]: SASL PLAIN authentication failed:

Aug 16 05:32:26 mail.srvfarm.net postfix/smtps/smtpd[1888715]: warning: unknown[177.54.251.16]: SASL PLAIN authentication failed: 
Aug 16 05:32:27 mail.srvfarm.net postfix/smtps/smtpd[1888715]: lost connection after AUTH from unknown[177.54.251.16]
Aug 16 05:36:54 mail.srvfarm.net postfix/smtpd[1888511]: warning: unknown[177.54.251.16]: SASL PLAIN authentication failed: 
Aug 16 05:36:54 mail.srvfarm.net postfix/smtpd[1888511]: lost connection after AUTH from unknown[177.54.251.16]
Aug 16 05:37:09 mail.srvfarm.net postfix/smtps/smtpd[1890605]: warning: unknown[177.54.251.16]: SASL PLAIN authentication failed:

"SMTP brute force auth login attempt."

Aug 15 00:40:56 mail.srvfarm.net postfix/smtpd[910663]: warning: unknown[177.54.251.122]: SASL PLAIN authentication failed: 
Aug 15 00:40:57 mail.srvfarm.net postfix/smtpd[910663]: lost connection after AUTH from unknown[177.54.251.122]
Aug 15 00:43:35 mail.srvfarm.net postfix/smtpd[910644]: warning: unknown[177.54.251.122]: SASL PLAIN authentication failed: 
Aug 15 00:43:36 mail.srvfarm.net postfix/smtpd[910644]: lost connection after AUTH from unknown[177.54.251.122]
Aug 15 00:48:25 mail.srvfarm.net postfix/smtps/smtpd[913774]: warning: unknown[177.54.251.122]: SASL PLAIN authentication failed:

2020-08-14 18:38 SMTP:25 IP autobanned - 2 attempts  a day

(smtpauth) Failed SMTP AUTH login from 177.54.251.223 (BR/Brazil/223.reverso.251.54.177): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 2020-08-13 08:18:47 plain authenticator failed for ([177.54.251.223]) [177.54.251.223]: 535 Incorrect authentication data (set_id=nasr)

Aug 11 05:43:27 mail.srvfarm.net postfix/smtps/smtpd[2166059]: warning: unknown[177.54.251.106]: SASL PLAIN authentication failed: 
Aug 11 05:43:28 mail.srvfarm.net postfix/smtps/smtpd[2166059]: lost connection after AUTH from unknown[177.54.251.106]
Aug 11 05:47:06 mail.srvfarm.net postfix/smtps/smtpd[2165060]: warning: unknown[177.54.251.106]: SASL PLAIN authentication failed: 
Aug 11 05:47:07 mail.srvfarm.net postfix/smtps/smtpd[2165060]: lost connection after AUTH from unknown[177.54.251.106]
Aug 11 05:53:21 mail.srvfarm.net postfix/smtps/smtpd[2164177]: warning: unknown[177.54.251.106]: SASL PLAIN authentication failed:

Aug 11 05:38:56 mail.srvfarm.net postfix/smtpd[2161874]: warning: unknown[177.54.251.206]: SASL PLAIN authentication failed: 
Aug 11 05:38:57 mail.srvfarm.net postfix/smtpd[2161874]: lost connection after AUTH from unknown[177.54.251.206]
Aug 11 05:39:05 mail.srvfarm.net postfix/smtpd[2163449]: warning: unknown[177.54.251.206]: SASL PLAIN authentication failed: 
Aug 11 05:39:05 mail.srvfarm.net postfix/smtpd[2163449]: lost connection after AUTH from unknown[177.54.251.206]
Aug 11 05:43:51 mail.srvfarm.net postfix/smtps/smtpd[2164177]: warning: unknown[177.54.251.206]: SASL PLAIN authentication failed:

Mail/25/465/587-993/995 Probe, Reject, BadAuth, Hack, SPAM -

Aug 10 05:14:12 mail.srvfarm.net postfix/smtpd[1310407]: warning: unknown[177.54.251.106]: SASL PLAIN authentication failed: 
Aug 10 05:14:13 mail.srvfarm.net postfix/smtpd[1310407]: lost connection after AUTH from unknown[177.54.251.106]
Aug 10 05:17:32 mail.srvfarm.net postfix/smtps/smtpd[1297686]: warning: unknown[177.54.251.106]: SASL PLAIN authentication failed: 
Aug 10 05:17:33 mail.srvfarm.net postfix/smtps/smtpd[1297686]: lost connection after AUTH from unknown[177.54.251.106]
Aug 10 05:19:11 mail.srvfarm.net postfix/smtpd[1310399]: warning: unknown[177.54.251.106]: SASL PLAIN authentication failed:

Jun 21 15:08:24 master sshd[14292]: Failed password for root from 106.54.121.117 port 42410 ssh2

Jun 16 17:19:25 WHD8 dovecot: imap-login: Disconnected \(auth failed, 1 attempts in 7 secs\): user=\, method=PLAIN, rip=183.89.212.196, lip=10.64.89.208, session=\
Jun 17 02:20:52 WHD8 dovecot: imap-login: Disconnected \(auth failed, 1 attempts in 5 secs\): user=\, method=PLAIN, rip=183.89.212.196, lip=10.64.89.208, TLS, session=\
Jun 18 02:45:33 WHD8 dovecot: imap-login: Disconnected \(auth failed, 1 attempts in 4 secs\): user=\, method=PLAIN, rip=183.89.212.196, lip=10.64.89.208, TLS, session=\
Jun 19 06:43:29 WHD8 dovecot: imap-login: Disconnected \(auth failed, 1 attempts in 4 secs\): user=\, method=PLAIN, rip=183.89.212.196, lip=10.64.89.208, TLS: Disconnected, session=\<+/SWiGiohKq3WdTE\>
Jun 20 11:56:08 WHD8 dovecot: imap-login: Disconnected \(auth failed, 1 attempts in 10 secs\): user=\

Honeypot attack, port: 445, PTR: 62.193.5.104.dpi.ir.

Jun 21 17:56:16 OPSO sshd\[11822\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.3.249  user=root
Jun 21 17:56:18 OPSO sshd\[11822\]: Failed password for root from 222.186.3.249 port 28048 ssh2
Jun 21 17:56:21 OPSO sshd\[11822\]: Failed password for root from 222.186.3.249 port 28048 ssh2
Jun 21 17:56:24 OPSO sshd\[11822\]: Failed password for root from 222.186.3.249 port 28048 ssh2
Jun 21 18:00:16 OPSO sshd\[12606\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.3.249  user=root

2020-06-21T12:53:27.295021homeassistant sshd[21009]: Invalid user admin from 198.98.53.133 port 53132
2020-06-21T12:53:27.310764homeassistant sshd[21009]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=198.98.53.133
...

2020-06-21T14:14:16.8936701240 sshd\[9349\]: Invalid user xuy from 198.245.53.163 port 41382
2020-06-21T14:14:16.8974781240 sshd\[9349\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=198.245.53.163
2020-06-21T14:14:18.3434421240 sshd\[9349\]: Failed password for invalid user xuy from 198.245.53.163 port 41382 ssh2
...

 TCP (SYN) 185.153.196.2:42301 -> port 10036, len 44

Jun 21 17:46:58 plex sshd[7809]: Invalid user www from 51.222.48.59 port 46076
Jun 21 17:46:58 plex sshd[7809]: Invalid user www from 51.222.48.59 port 46076
Jun 21 17:46:58 plex sshd[7809]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.222.48.59
Jun 21 17:46:58 plex sshd[7809]: Invalid user www from 51.222.48.59 port 46076
Jun 21 17:47:00 plex sshd[7809]: Failed password for invalid user www from 51.222.48.59 port 46076 ssh2

Jun 21 17:35:59 nextcloud sshd\[29191\]: Invalid user jjh from 218.2.204.119
Jun 21 17:35:59 nextcloud sshd\[29191\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.2.204.119
Jun 21 17:36:01 nextcloud sshd\[29191\]: Failed password for invalid user jjh from 218.2.204.119 port 44326 ssh2

DATE:2020-06-21 16:14:34, IP:51.75.195.25, PORT:ssh SSH brute force auth (docker-dc)

Honeypot attack, port: 445, PTR: flix-132-255-109-198.flixtelecom.net.br.

2020-06-21T22:16:16.375555billing sshd[31193]: Invalid user sonarr from 165.22.215.192 port 33462
2020-06-21T22:16:18.616818billing sshd[31193]: Failed password for invalid user sonarr from 165.22.215.192 port 33462 ssh2
2020-06-21T22:20:38.696278billing sshd[7772]: Invalid user jenkins from 165.22.215.192 port 59776
...

Jun 21 14:13:40 srv1 postfix/smtpd[27421]: warning: unknown[119.96.127.218]: SASL LOGIN authentication failed: authentication failure
Jun 21 14:13:43 srv1 postfix/smtpd[27422]: warning: unknown[119.96.127.218]: SASL LOGIN authentication failed: authentication failure
Jun 21 14:13:44 srv1 postfix/smtpd[27428]: warning: unknown[119.96.127.218]: SASL LOGIN authentication failed: authentication failure
Jun 21 14:13:45 srv1 postfix/smtpd[27422]: warning: unknown[119.96.127.218]: SASL LOGIN authentication failed: authentication failure
Jun 21 14:13:47 srv1 postfix/smtpd[27428]: warning: unknown[119.96.127.218]: SASL LOGIN authentication failed: authentication failure
...

Jun 21 17:39:43 abendstille sshd\[1799\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.175.163  user=root
Jun 21 17:39:46 abendstille sshd\[1799\]: Failed password for root from 222.186.175.163 port 14690 ssh2
Jun 21 17:39:49 abendstille sshd\[1799\]: Failed password for root from 222.186.175.163 port 14690 ssh2
Jun 21 17:39:52 abendstille sshd\[1799\]: Failed password for root from 222.186.175.163 port 14690 ssh2
Jun 21 17:39:56 abendstille sshd\[1799\]: Failed password for root from 222.186.175.163 port 14690 ssh2
...

Jun 21 16:22:00 server sshd[32199]: Failed password for invalid user gts from 167.114.114.193 port 35528 ssh2
Jun 21 16:23:43 server sshd[33574]: Failed password for invalid user mmx from 167.114.114.193 port 33502 ssh2
Jun 21 16:25:30 server sshd[35047]: Failed password for invalid user sherlock from 167.114.114.193 port 59710 ssh2