Aug  7 13:53:12 mail.srvfarm.net postfix/smtpd[3376329]: warning: unknown[181.114.208.194]: SASL PLAIN authentication failed: 
Aug  7 13:53:13 mail.srvfarm.net postfix/smtpd[3376329]: lost connection after AUTH from unknown[181.114.208.194]
Aug  7 13:54:41 mail.srvfarm.net postfix/smtpd[3377211]: warning: unknown[181.114.208.194]: SASL PLAIN authentication failed: 
Aug  7 13:54:41 mail.srvfarm.net postfix/smtpd[3377211]: lost connection after AUTH from unknown[181.114.208.194]
Aug  7 14:00:31 mail.srvfarm.net postfix/smtpd[3380755]: warning: unknown[181.114.208.194]: SASL PLAIN authentication failed:

Sep 15 18:28:52 mail.srvfarm.net postfix/smtpd[2805938]: warning: unknown[181.114.208.137]: SASL PLAIN authentication failed: 
Sep 15 18:28:56 mail.srvfarm.net postfix/smtpd[2805938]: lost connection after AUTH from unknown[181.114.208.137]
Sep 15 18:31:48 mail.srvfarm.net postfix/smtpd[2805902]: warning: unknown[181.114.208.137]: SASL PLAIN authentication failed: 
Sep 15 18:31:48 mail.srvfarm.net postfix/smtpd[2805902]: lost connection after AUTH from unknown[181.114.208.137]
Sep 15 18:31:59 mail.srvfarm.net postfix/smtps/smtpd[2819938]: warning: unknown[181.114.208.137]: SASL PLAIN authentication failed:

Sep 16 17:46:51 mail.srvfarm.net postfix/smtps/smtpd[3579390]: warning: unknown[181.114.208.27]: SASL PLAIN authentication failed: 
Sep 16 17:46:52 mail.srvfarm.net postfix/smtps/smtpd[3579390]: lost connection after AUTH from unknown[181.114.208.27]
Sep 16 17:49:36 mail.srvfarm.net postfix/smtps/smtpd[3580299]: warning: unknown[181.114.208.27]: SASL PLAIN authentication failed: 
Sep 16 17:49:39 mail.srvfarm.net postfix/smtps/smtpd[3580299]: lost connection after AUTH from unknown[181.114.208.27]
Sep 16 17:53:11 mail.srvfarm.net postfix/smtps/smtpd[3580300]: warning: unknown[181.114.208.27]: SASL PLAIN authentication failed:

Sep 15 20:12:59 mail.srvfarm.net postfix/smtpd[2850756]: warning: unknown[181.114.208.214]: SASL PLAIN authentication failed: 
Sep 15 20:13:04 mail.srvfarm.net postfix/smtpd[2850756]: lost connection after AUTH from unknown[181.114.208.214]
Sep 15 20:13:53 mail.srvfarm.net postfix/smtps/smtpd[2851795]: warning: unknown[181.114.208.214]: SASL PLAIN authentication failed: 
Sep 15 20:13:54 mail.srvfarm.net postfix/smtps/smtpd[2851795]: lost connection after AUTH from unknown[181.114.208.214]
Sep 15 20:17:41 mail.srvfarm.net postfix/smtpd[2856499]: warning: unknown[181.114.208.214]: SASL PLAIN authentication failed:

Sep 15 18:29:16 mail.srvfarm.net postfix/smtps/smtpd[2818215]: warning: unknown[181.114.208.27]: SASL PLAIN authentication failed: 
Sep 15 18:29:18 mail.srvfarm.net postfix/smtps/smtpd[2818215]: lost connection after AUTH from unknown[181.114.208.27]
Sep 15 18:34:50 mail.srvfarm.net postfix/smtpd[2820538]: warning: unknown[181.114.208.27]: SASL PLAIN authentication failed: 
Sep 15 18:34:51 mail.srvfarm.net postfix/smtpd[2820538]: lost connection after AUTH from unknown[181.114.208.27]
Sep 15 18:39:13 mail.srvfarm.net postfix/smtpd[2825416]: warning: unknown[181.114.208.27]: SASL PLAIN authentication failed:

Sep 15 20:12:59 mail.srvfarm.net postfix/smtpd[2850756]: warning: unknown[181.114.208.214]: SASL PLAIN authentication failed: 
Sep 15 20:13:04 mail.srvfarm.net postfix/smtpd[2850756]: lost connection after AUTH from unknown[181.114.208.214]
Sep 15 20:13:53 mail.srvfarm.net postfix/smtps/smtpd[2851795]: warning: unknown[181.114.208.214]: SASL PLAIN authentication failed: 
Sep 15 20:13:54 mail.srvfarm.net postfix/smtps/smtpd[2851795]: lost connection after AUTH from unknown[181.114.208.214]
Sep 15 20:17:41 mail.srvfarm.net postfix/smtpd[2856499]: warning: unknown[181.114.208.214]: SASL PLAIN authentication failed:

(smtpauth) Failed SMTP AUTH login from 181.114.208.114 (AR/Argentina/host-208-114.adc.net.ar): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 2020-09-13 21:27:38 plain authenticator failed for ([181.114.208.114]) [181.114.208.114]: 535 Incorrect authentication data (set_id=int)

(smtpauth) Failed SMTP AUTH login from 181.114.208.114 (AR/Argentina/host-208-114.adc.net.ar): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 2020-09-13 21:27:38 plain authenticator failed for ([181.114.208.114]) [181.114.208.114]: 535 Incorrect authentication data (set_id=int)

(smtpauth) Failed SMTP AUTH login from 181.114.208.114 (AR/Argentina/host-208-114.adc.net.ar): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 2020-09-13 21:27:38 plain authenticator failed for ([181.114.208.114]) [181.114.208.114]: 535 Incorrect authentication data (set_id=int)

Sep 12 18:01:37 mail.srvfarm.net postfix/smtpd[531353]: warning: unknown[181.114.208.50]: SASL PLAIN authentication failed: 
Sep 12 18:01:38 mail.srvfarm.net postfix/smtpd[531353]: lost connection after AUTH from unknown[181.114.208.50]
Sep 12 18:03:57 mail.srvfarm.net postfix/smtps/smtpd[530836]: warning: unknown[181.114.208.50]: SASL PLAIN authentication failed: 
Sep 12 18:03:58 mail.srvfarm.net postfix/smtps/smtpd[530836]: lost connection after AUTH from unknown[181.114.208.50]
Sep 12 18:07:48 mail.srvfarm.net postfix/smtps/smtpd[530836]: warning: unknown[181.114.208.50]: SASL PLAIN authentication failed:

Sep 12 18:01:37 mail.srvfarm.net postfix/smtpd[531353]: warning: unknown[181.114.208.50]: SASL PLAIN authentication failed: 
Sep 12 18:01:38 mail.srvfarm.net postfix/smtpd[531353]: lost connection after AUTH from unknown[181.114.208.50]
Sep 12 18:03:57 mail.srvfarm.net postfix/smtps/smtpd[530836]: warning: unknown[181.114.208.50]: SASL PLAIN authentication failed: 
Sep 12 18:03:58 mail.srvfarm.net postfix/smtps/smtpd[530836]: lost connection after AUTH from unknown[181.114.208.50]
Sep 12 18:07:48 mail.srvfarm.net postfix/smtps/smtpd[530836]: warning: unknown[181.114.208.50]: SASL PLAIN authentication failed:

(smtpauth) Failed SMTP AUTH login from 181.114.208.102 (AR/Argentina/host-208-102.adc.net.ar): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 2020-09-09 21:22:11 plain authenticator failed for ([181.114.208.102]) [181.114.208.102]: 535 Incorrect authentication data (set_id=info)

(smtpauth) Failed SMTP AUTH login from 181.114.208.102 (AR/Argentina/host-208-102.adc.net.ar): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 2020-09-09 21:22:11 plain authenticator failed for ([181.114.208.102]) [181.114.208.102]: 535 Incorrect authentication data (set_id=info)

(smtpauth) Failed SMTP AUTH login from 181.114.208.102 (AR/Argentina/host-208-102.adc.net.ar): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 2020-09-09 21:22:11 plain authenticator failed for ([181.114.208.102]) [181.114.208.102]: 535 Incorrect authentication data (set_id=info)

SASL PLAIN auth failed: ruser=...

SASL PLAIN auth failed: ruser=...

Jan 10 05:53:07 grey postfix/smtpd\[821\]: NOQUEUE: reject: RCPT from 2-226-12-12.ip178.fastwebnet.it\[2.226.12.12\]: 554 5.7.1 Service unavailable\; Client host \[2.226.12.12\] blocked using bl.spamcop.net\; Blocked - see https://www.spamcop.net/bl.shtml\?2.226.12.12\; from=\ to=\ proto=ESMTP helo=\<2-226-12-12.ip178.fastwebnet.it\>
...

Automatic report - XMLRPC Attack

Jan 10 01:50:44 server sshd\[8247\]: Failed password for root from 211.43.196.26 port 49123 ssh2
Jan 10 07:51:55 server sshd\[2262\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.43.196.26  user=root
Jan 10 07:51:57 server sshd\[2262\]: Failed password for root from 211.43.196.26 port 34984 ssh2
Jan 10 07:52:47 server sshd\[2421\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.43.196.26  user=root
Jan 10 07:52:50 server sshd\[2421\]: Failed password for root from 211.43.196.26 port 54437 ssh2
...

Jan  7 22:49:35 kmh-wmh-002-nbg03 sshd[21719]: Invalid user sammy from 87.148.46.220 port 43532
Jan  7 22:49:35 kmh-wmh-002-nbg03 sshd[21719]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=87.148.46.220
Jan  7 22:49:37 kmh-wmh-002-nbg03 sshd[21719]: Failed password for invalid user sammy from 87.148.46.220 port 43532 ssh2
Jan  7 22:49:37 kmh-wmh-002-nbg03 sshd[21719]: Received disconnect from 87.148.46.220 port 43532:11: Bye Bye [preauth]
Jan  7 22:49:37 kmh-wmh-002-nbg03 sshd[21719]: Disconnected from 87.148.46.220 port 43532 [preauth]
Jan  7 22:53:33 kmh-wmh-002-nbg03 sshd[22148]: Invalid user diego from 87.148.46.220 port 43714
Jan  7 22:53:33 kmh-wmh-002-nbg03 sshd[22148]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=87.148.46.220
Jan  7 22:53:35 kmh-wmh-002-nbg03 sshd[22148]: Failed password for invalid user diego from 87.148.46.220 port 43714 ssh2


........
-----------------------------------------------
https://www.bl

01/10/2020-09:23:38.366622 159.203.201.80 Protocol: 6 ET DROP Dshield Block Listed Source group 1

Unauthorised access (Jan 10) SRC=66.181.161.37 LEN=52 TTL=114 ID=10395 DF TCP DPT=445 WINDOW=8192 SYN

SSH Brute-Forcing (server1)

Jan  9 20:40:26 eddieflores sshd\[8331\]: Invalid user tsalarian from 106.13.233.178
Jan  9 20:40:26 eddieflores sshd\[8331\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.233.178
Jan  9 20:40:27 eddieflores sshd\[8331\]: Failed password for invalid user tsalarian from 106.13.233.178 port 56842 ssh2
Jan  9 20:43:52 eddieflores sshd\[8651\]: Invalid user yati from 106.13.233.178
Jan  9 20:43:52 eddieflores sshd\[8651\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.233.178

1578631971 - 01/10/2020 05:52:51 Host: 169.255.77.212/169.255.77.212 Port: 445 TCP Blocked

Jan 10 05:52:07 MK-Soft-Root2 sshd[16218]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.138.76.66 
Jan 10 05:52:08 MK-Soft-Root2 sshd[16218]: Failed password for invalid user qxg from 217.138.76.66 port 39990 ssh2
...

ssh brute force

Jan  6 07:37:15 iago sshd[9747]: Invalid user chef from 20.185.108.250
Jan  6 07:37:15 iago sshd[9747]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.185.108.250 


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=20.185.108.250

Jan 10 05:49:31 legacy sshd[23212]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.207.11.12
Jan 10 05:49:33 legacy sshd[23212]: Failed password for invalid user ekain from 103.207.11.12 port 55388 ssh2
Jan 10 05:53:07 legacy sshd[23465]: Failed password for root from 103.207.11.12 port 58126 ssh2
...

Jan 10 05:53:04 debian-2gb-nbg1-2 kernel: \[891295.383074\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=14.102.2.21 DST=195.201.40.59 LEN=52 TOS=0x00 PREC=0x00 TTL=117 ID=30579 DF PROTO=TCP SPT=58017 DPT=1433 WINDOW=8192 RES=0x00 SYN URGP=0

Jan 10 05:52:07 grey postfix/smtpd\[821\]: NOQUEUE: reject: RCPT from unknown\[49.88.65.107\]: 554 5.7.1 Service unavailable\; Client host \[49.88.65.107\] blocked using truncate.gbudb.net\; http://www.gbudb.com/truncate/ \[49.88.65.107\]\; from=\ to=\ proto=ESMTP helo=\
...