Apr  1 01:03:29 debian-2gb-nbg1-2 kernel: \[7954860.758385\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=185.211.245.202 DST=195.201.40.59 LEN=60 TOS=0x00 PREC=0x00 TTL=55 ID=36788 DF PROTO=TCP SPT=15036 DPT=3128 WINDOW=65535 RES=0x00 SYN URGP=0

May  7 15:34:17 ns1 sshd[1600]: Failed password for root from 185.211.245.201 port 26562 ssh2
May  7 15:34:17 ns1 sshd[1601]: Failed password for root from 185.211.245.201 port 26560 ssh2

Jan 22 15:21:19 WHD8 postfix/smtpd\[27182\]: warning: unknown\[185.211.245.170\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jan 22 15:21:26 WHD8 postfix/smtpd\[27182\]: warning: unknown\[185.211.245.170\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jan 22 15:35:01 WHD8 postfix/smtpd\[30847\]: warning: unknown\[185.211.245.170\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jan 22 15:35:08 WHD8 postfix/smtpd\[27241\]: warning: unknown\[185.211.245.170\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jan 22 15:52:49 WHD8 postfix/smtpd\[39327\]: warning: unknown\[185.211.245.170\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jan 22 15:52:56 WHD8 postfix/smtpd\[39327\]: warning: unknown\[185.211.245.170\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jan 22 15:56:17 WHD8 postfix/smtpd\[39327\]: warning: unknown\[185.211.245.170\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jan 22 15:56:24 WHD8 postfix/smtpd\[39453\]: warning: unknown\[185.211.245.170\]: SASL LOGIN auth
...

firewall-block, port(s): 22/tcp

May  5 11:27:51 mellenthin sshd[31293]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.211.245.201  user=root
May  5 11:27:51 mellenthin sshd[31294]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.211.245.201  user=root

Mar 28 23:40:51 mail postfix/smtpd\[6706\]: warning: unknown\[185.211.245.198\]: SASL PLAIN authentication failed: \
Mar 28 23:40:58 mail postfix/smtpd\[7299\]: warning: unknown\[185.211.245.198\]: SASL PLAIN authentication failed: \
Mar 28 23:42:36 mail postfix/smtpd\[7299\]: warning: unknown\[185.211.245.198\]: SASL PLAIN authentication failed: \
Mar 29 00:32:32 mail postfix/smtpd\[8792\]: warning: unknown\[185.211.245.198\]: SASL PLAIN authentication failed: \
Mar 29 00:32:32 mail postfix/smtpd\[8868\]: warning: unknown\[185.211.245.198\]: SASL PLAIN authentication failed: \
Mar 29 00:32:32 mail postfix/smtpd\[8833\]: warning: unknown\[185.211.245.198\]: SASL PLAIN authentication failed: \

2020-03-26 13:41:45 dovecot_plain authenticator failed for \(swim.diverseenvironment.com.\) \[185.211.245.198\]: 535 Incorrect authentication data \(set_id=admin@no-server.de\)
2020-03-26 13:41:45 dovecot_plain authenticator failed for \(swim.diverseenvironment.com.\) \[185.211.245.198\]: 535 Incorrect authentication data \(set_id=admin@no-server.de\)
2020-03-26 13:41:51 dovecot_plain authenticator failed for \(swim.diverseenvironment.com.\) \[185.211.245.198\]: 535 Incorrect authentication data \(set_id=admin\)
2020-03-26 13:41:52 dovecot_plain authenticator failed for \(swim.diverseenvironment.com.\) \[185.211.245.198\]: 535 Incorrect authentication data \(set_id=admin\)
2020-03-26 13:47:42 dovecot_plain authenticator failed for \(swim.diverseenvironment.com.\) \[185.211.245.198\]: 535 Incorrect authentication data \(set_id=admin@no-server.de\)
2020-03-26 13:47:42 dovecot_plain authenticator failed for \(swim.diverseenvironment.com.\) \[185.211.245.198\]: 535 Incorrect authentication
...

2020-03-24 05:12:58 dovecot_plain authenticator failed for \(\[185.211.245.198\]\) \[185.211.245.198\]: 535 Incorrect authentication data \(set_id=btce@german-hoeffner.net\)
2020-03-24 05:12:58 dovecot_plain authenticator failed for \(\[185.211.245.198\]\) \[185.211.245.198\]: 535 Incorrect authentication data \(set_id=btce@german-hoeffner.net\)
2020-03-24 05:13:05 dovecot_plain authenticator failed for \(\[185.211.245.198\]\) \[185.211.245.198\]: 535 Incorrect authentication data \(set_id=btce\)
2020-03-24 05:13:05 dovecot_plain authenticator failed for \(\[185.211.245.198\]\) \[185.211.245.198\]: 535 Incorrect authentication data \(set_id=btce\)
2020-03-24 05:18:33 dovecot_plain authenticator failed for \(\[185.211.245.198\]\) \[185.211.245.198\]: 535 Incorrect authentication data \(set_id=craze@no-server.de\)
...

Mar 22 23:08:24 s1 postfix/submission/smtpd\[31200\]: warning: unknown\[185.211.245.198\]: SASL PLAIN authentication failed:
Mar 22 23:08:24 s1 postfix/submission/smtpd\[31201\]: warning: unknown\[185.211.245.198\]: SASL PLAIN authentication failed:
Mar 22 23:08:24 s1 postfix/submission/smtpd\[31202\]: warning: unknown\[185.211.245.198\]: SASL PLAIN authentication failed:
Mar 22 23:08:31 s1 postfix/submission/smtpd\[31202\]: warning: unknown\[185.211.245.198\]: SASL PLAIN authentication failed:
Mar 22 23:08:31 s1 postfix/submission/smtpd\[31201\]: warning: unknown\[185.211.245.198\]: SASL PLAIN authentication failed:
Mar 22 23:08:31 s1 postfix/submission/smtpd\[31200\]: warning: unknown\[185.211.245.198\]: SASL PLAIN authentication failed:
Mar 22 23:10:40 s1 postfix/submission/smtpd\[31201\]: warning: unknown\[185.211.245.198\]: SASL PLAIN authentication failed:
Mar 22 23:10:40 s1 postfix/submission/smtpd\[31202\]: warning: unknown\[185.211.245.198\]: SASL PLAIN authentication failed:
Mar 22 23:10:47 s1 postf

2020-03-21 15:38:59 dovecot_plain authenticator failed for \(swim.diverseenvironment.com.\) \[185.211.245.198\]: 535 Incorrect authentication data \(set_id=mailbox@no-server.de\)
2020-03-21 15:39:06 dovecot_plain authenticator failed for \(swim.diverseenvironment.com.\) \[185.211.245.198\]: 535 Incorrect authentication data \(set_id=mailbox\)
2020-03-21 15:39:22 dovecot_plain authenticator failed for \(swim.diverseenvironment.com.\) \[185.211.245.198\]: 535 Incorrect authentication data
2020-03-21 15:39:37 dovecot_plain authenticator failed for \(swim.diverseenvironment.com.\) \[185.211.245.198\]: 535 Incorrect authentication data
2020-03-21 15:39:38 dovecot_plain authenticator failed for \(swim.diverseenvironment.com.\) \[185.211.245.198\]: 535 Incorrect authentication data
...

2020-03-21 07:08:18 dovecot_plain authenticator failed for \(swim.diverseenvironment.com.\) \[185.211.245.198\]: 535 Incorrect authentication data \(set_id=administracion@no-server.de\)
2020-03-21 07:08:24 dovecot_plain authenticator failed for \(swim.diverseenvironment.com.\) \[185.211.245.198\]: 535 Incorrect authentication data \(set_id=administracion\)
2020-03-21 07:08:37 dovecot_plain authenticator failed for \(swim.diverseenvironment.com.\) \[185.211.245.198\]: 535 Incorrect authentication data
2020-03-21 07:08:53 dovecot_plain authenticator failed for \(swim.diverseenvironment.com.\) \[185.211.245.198\]: 535 Incorrect authentication data
2020-03-21 07:08:54 dovecot_plain authenticator failed for \(swim.diverseenvironment.com.\) \[185.211.245.198\]: 535 Incorrect authentication data
...

Fail2Ban - SMTP Bruteforce Attempt

2020-03-20 08:11:17 dovecot_plain authenticator failed for \(swim.diverseenvironment.com.\) \[185.211.245.198\]: 535 Incorrect authentication data \(set_id=test@no-server.de\)
2020-03-20 08:11:24 dovecot_plain authenticator failed for \(swim.diverseenvironment.com.\) \[185.211.245.198\]: 535 Incorrect authentication data \(set_id=test\)
2020-03-20 08:11:37 dovecot_plain authenticator failed for \(swim.diverseenvironment.com.\) \[185.211.245.198\]: 535 Incorrect authentication data
2020-03-20 08:11:45 dovecot_plain authenticator failed for \(swim.diverseenvironment.com.\) \[185.211.245.198\]: 535 Incorrect authentication data
2020-03-20 08:11:52 dovecot_plain authenticator failed for \(swim.diverseenvironment.com.\) \[185.211.245.198\]: 535 Incorrect authentication data
...

Mar 18 05:43:27 mail.srvfarm.net postfix/smtpd[1316381]: warning: unknown[185.211.245.170]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Mar 18 05:43:27 mail.srvfarm.net postfix/smtpd[1316381]: lost connection after AUTH from unknown[185.211.245.170]
Mar 18 05:43:34 mail.srvfarm.net postfix/smtpd[1314108]: warning: unknown[185.211.245.170]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Mar 18 05:43:34 mail.srvfarm.net postfix/smtpd[1314108]: lost connection after AUTH from unknown[185.211.245.170]
Mar 18 05:43:35 mail.srvfarm.net postfix/smtpd[1298079]: warning: unknown[185.211.245.170]: SASL LOGIN authentication failed: UGFzc3dvcmQ6

Mar 16 20:42:35 mail postfix/smtpd\[11208\]: warning: unknown\[185.211.245.198\]: SASL PLAIN authentication failed: \
Mar 16 20:42:35 mail postfix/smtpd\[11262\]: warning: unknown\[185.211.245.198\]: SASL PLAIN authentication failed: \
Mar 16 20:42:35 mail postfix/smtpd\[11263\]: warning: unknown\[185.211.245.198\]: SASL PLAIN authentication failed: \
Mar 16 21:27:14 mail postfix/smtpd\[12147\]: warning: unknown\[185.211.245.198\]: SASL PLAIN authentication failed: \

2020-03-14 05:53:37 dovecot_plain authenticator failed for \(swim.diverseenvironment.com.\) \[185.211.245.198\]: 535 Incorrect authentication data \(set_id=info@no-server.de\)
2020-03-14 05:53:43 dovecot_plain authenticator failed for \(swim.diverseenvironment.com.\) \[185.211.245.198\]: 535 Incorrect authentication data \(set_id=info\)
2020-03-14 06:02:57 dovecot_plain authenticator failed for \(swim.diverseenvironment.com.\) \[185.211.245.198\]: 535 Incorrect authentication data \(set_id=info@no-server.de\)
2020-03-14 06:03:04 dovecot_plain authenticator failed for \(swim.diverseenvironment.com.\) \[185.211.245.198\]: 535 Incorrect authentication data \(set_id=info\)
2020-03-14 06:03:05 dovecot_plain authenticator failed for \(swim.diverseenvironment.com.\) \[185.211.245.198\]: 535 Incorrect authentication data \(set_id=info@no-server.de\)
...

May  3 21:55:41 jane sshd[3791]: Failed password for root from 159.89.163.38 port 47038 ssh2
...

2020-05-03T11:58:40.158653abusebot-6.cloudsearch.cf sshd[5393]: Invalid user oracle from 106.13.203.171 port 2354
2020-05-03T11:58:40.165515abusebot-6.cloudsearch.cf sshd[5393]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.203.171
2020-05-03T11:58:40.158653abusebot-6.cloudsearch.cf sshd[5393]: Invalid user oracle from 106.13.203.171 port 2354
2020-05-03T11:58:41.904466abusebot-6.cloudsearch.cf sshd[5393]: Failed password for invalid user oracle from 106.13.203.171 port 2354 ssh2
2020-05-03T12:05:20.333116abusebot-6.cloudsearch.cf sshd[5744]: Invalid user jenkins from 106.13.203.171 port 5182
2020-05-03T12:05:20.339718abusebot-6.cloudsearch.cf sshd[5744]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.203.171
2020-05-03T12:05:20.333116abusebot-6.cloudsearch.cf sshd[5744]: Invalid user jenkins from 106.13.203.171 port 5182
2020-05-03T12:05:22.991965abusebot-6.cloudsearch.cf sshd[5744]: Faile
...

2020-05-03T17:10:41.048570abusebot-3.cloudsearch.cf sshd[17661]: Invalid user nishtha from 49.233.147.108 port 34780
2020-05-03T17:10:41.057033abusebot-3.cloudsearch.cf sshd[17661]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.233.147.108
2020-05-03T17:10:41.048570abusebot-3.cloudsearch.cf sshd[17661]: Invalid user nishtha from 49.233.147.108 port 34780
2020-05-03T17:10:43.862621abusebot-3.cloudsearch.cf sshd[17661]: Failed password for invalid user nishtha from 49.233.147.108 port 34780 ssh2
2020-05-03T17:20:28.359447abusebot-3.cloudsearch.cf sshd[18184]: Invalid user vd from 49.233.147.108 port 53602
2020-05-03T17:20:28.372502abusebot-3.cloudsearch.cf sshd[18184]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.233.147.108
2020-05-03T17:20:28.359447abusebot-3.cloudsearch.cf sshd[18184]: Invalid user vd from 49.233.147.108 port 53602
2020-05-03T17:20:30.094561abusebot-3.cloudsearch.cf sshd[18184]:
...

May  3 21:29:27 DAAP sshd[5462]: Invalid user hao from 101.89.201.250 port 45030
May  3 21:29:27 DAAP sshd[5462]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=101.89.201.250
May  3 21:29:27 DAAP sshd[5462]: Invalid user hao from 101.89.201.250 port 45030
May  3 21:29:29 DAAP sshd[5462]: Failed password for invalid user hao from 101.89.201.250 port 45030 ssh2
May  3 21:31:32 DAAP sshd[5516]: Invalid user mcc from 101.89.201.250 port 42004
...

Unauthorized IMAP connection attempt

Trolling for resource vulnerabilities

SSH brutforce

Too many connections or unauthorized access detected from Arctic banned ip

05/03/2020-14:05:29.978419 210.13.93.59 Protocol: 6 ET SCAN Suspicious inbound to MSSQL port 1433

...

May  3 20:15:54 server sshd[7146]: Failed password for invalid user 123 from 51.178.29.191 port 36046 ssh2
May  3 20:19:36 server sshd[7450]: Failed password for invalid user info from 51.178.29.191 port 45780 ssh2
May  3 20:23:16 server sshd[7838]: Failed password for root from 51.178.29.191 port 55514 ssh2

May  3 21:03:18 minden010 sshd[19997]: Failed password for root from 222.186.180.6 port 43950 ssh2
May  3 21:03:21 minden010 sshd[19997]: Failed password for root from 222.186.180.6 port 43950 ssh2
May  3 21:03:31 minden010 sshd[19997]: error: maximum authentication attempts exceeded for root from 222.186.180.6 port 43950 ssh2 [preauth]
...

(pop3d) Failed POP3 login from 5.250.114.42 (IR/Iran/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: May  3 16:35:23 ir1 dovecot[264309]: pop3-login: Aborted login (auth failed, 1 attempts in 2 secs): user=, method=PLAIN, rip=5.250.114.42, lip=5.63.12.44, session=

May  3 14:52:46 plex sshd[24472]: Invalid user john from 129.28.192.71 port 54448

May  3 21:24:10 [host] sshd[21544]: Invalid user m
May  3 21:24:10 [host] sshd[21544]: pam_unix(sshd:
May  3 21:24:12 [host] sshd[21544]: Failed passwor