Jun 18 13:30:06 mail.srvfarm.net postfix/smtps/smtpd[1465073]: warning: unknown[186.216.71.242]: SASL PLAIN authentication failed: 
Jun 18 13:30:06 mail.srvfarm.net postfix/smtps/smtpd[1465073]: lost connection after AUTH from unknown[186.216.71.242]
Jun 18 13:33:57 mail.srvfarm.net postfix/smtps/smtpd[1469500]: warning: unknown[186.216.71.242]: SASL PLAIN authentication failed: 
Jun 18 13:33:58 mail.srvfarm.net postfix/smtps/smtpd[1469500]: lost connection after AUTH from unknown[186.216.71.242]
Jun 18 13:36:58 mail.srvfarm.net postfix/smtps/smtpd[1467936]: warning: unknown[186.216.71.242]: SASL PLAIN authentication failed:

Brute force attempt

Brute force attempt

Aug 11 13:59:22 mail.srvfarm.net postfix/smtpd[2367395]: warning: unknown[186.216.71.122]: SASL PLAIN authentication failed: 
Aug 11 13:59:22 mail.srvfarm.net postfix/smtpd[2367395]: lost connection after AUTH from unknown[186.216.71.122]
Aug 11 13:59:40 mail.srvfarm.net postfix/smtps/smtpd[2367011]: warning: unknown[186.216.71.122]: SASL PLAIN authentication failed: 
Aug 11 13:59:41 mail.srvfarm.net postfix/smtps/smtpd[2367011]: lost connection after AUTH from unknown[186.216.71.122]
Aug 11 14:03:18 mail.srvfarm.net postfix/smtps/smtpd[2364251]: warning: unknown[186.216.71.122]: SASL PLAIN authentication failed:

(smtpauth) Failed SMTP AUTH login from 186.216.71.64 (BR/Brazil/186-216-71-64.uni-wr.mastercabo.com.br): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 2020-08-02 08:23:00 plain authenticator failed for ([186.216.71.64]) [186.216.71.64]: 535 Incorrect authentication data (set_id=info@mobarezco.com)

failed_logins

SSH invalid-user multiple login try

Jul 10 14:16:58 xeon postfix/smtpd[8972]: warning: unknown[186.216.71.126]: SASL PLAIN authentication failed: authentication failure

SSH invalid-user multiple login try

SSH invalid-user multiple login try

Jun 25 22:32:51 mail.srvfarm.net postfix/smtps/smtpd[2075110]: warning: unknown[186.216.71.217]: SASL PLAIN authentication failed: 
Jun 25 22:32:52 mail.srvfarm.net postfix/smtps/smtpd[2075110]: lost connection after AUTH from unknown[186.216.71.217]
Jun 25 22:37:53 mail.srvfarm.net postfix/smtpd[2075974]: warning: unknown[186.216.71.217]: SASL PLAIN authentication failed: 
Jun 25 22:37:53 mail.srvfarm.net postfix/smtpd[2075974]: lost connection after AUTH from unknown[186.216.71.217]
Jun 25 22:40:20 mail.srvfarm.net postfix/smtpd[2071449]: warning: unknown[186.216.71.217]: SASL PLAIN authentication failed:

Jun 18 13:34:24 mail.srvfarm.net postfix/smtps/smtpd[1466889]: warning: unknown[186.216.71.30]: SASL PLAIN authentication failed: 
Jun 18 13:34:25 mail.srvfarm.net postfix/smtps/smtpd[1466889]: lost connection after AUTH from unknown[186.216.71.30]
Jun 18 13:41:26 mail.srvfarm.net postfix/smtpd[1469105]: warning: unknown[186.216.71.30]: SASL PLAIN authentication failed: 
Jun 18 13:41:26 mail.srvfarm.net postfix/smtpd[1469105]: lost connection after AUTH from unknown[186.216.71.30]
Jun 18 13:43:22 mail.srvfarm.net postfix/smtps/smtpd[1471061]: warning: unknown[186.216.71.30]: SASL PLAIN authentication failed:

Jun  8 05:31:58 mail.srvfarm.net postfix/smtpd[671307]: warning: unknown[186.216.71.57]: SASL PLAIN authentication failed: 
Jun  8 05:31:59 mail.srvfarm.net postfix/smtpd[671307]: lost connection after AUTH from unknown[186.216.71.57]
Jun  8 05:34:39 mail.srvfarm.net postfix/smtpd[673035]: warning: unknown[186.216.71.57]: SASL PLAIN authentication failed: 
Jun  8 05:34:40 mail.srvfarm.net postfix/smtpd[673035]: lost connection after AUTH from unknown[186.216.71.57]
Jun  8 05:35:01 mail.srvfarm.net postfix/smtps/smtpd[671665]: warning: unknown[186.216.71.57]: SASL PLAIN authentication failed:

Jun  8 05:30:53 mail.srvfarm.net postfix/smtpd[673035]: warning: unknown[186.216.71.107]: SASL PLAIN authentication failed: 
Jun  8 05:30:53 mail.srvfarm.net postfix/smtpd[673035]: lost connection after AUTH from unknown[186.216.71.107]
Jun  8 05:39:04 mail.srvfarm.net postfix/smtps/smtpd[671665]: lost connection after CONNECT from unknown[186.216.71.107]
Jun  8 05:39:57 mail.srvfarm.net postfix/smtpd[673035]: warning: unknown[186.216.71.107]: SASL PLAIN authentication failed: 
Jun  8 05:39:58 mail.srvfarm.net postfix/smtpd[673035]: lost connection after AUTH from unknown[186.216.71.107]

Jun  5 15:19:31 mail.srvfarm.net postfix/smtps/smtpd[3110631]: warning: unknown[186.216.71.26]: SASL PLAIN authentication failed: 
Jun  5 15:19:32 mail.srvfarm.net postfix/smtps/smtpd[3110631]: lost connection after AUTH from unknown[186.216.71.26]
Jun  5 15:25:25 mail.srvfarm.net postfix/smtps/smtpd[3108732]: warning: unknown[186.216.71.26]: SASL PLAIN authentication failed: 
Jun  5 15:25:25 mail.srvfarm.net postfix/smtps/smtpd[3108732]: lost connection after AUTH from unknown[186.216.71.26]
Jun  5 15:29:14 mail.srvfarm.net postfix/smtpd[3109485]: warning: unknown[186.216.71.26]: SASL PLAIN authentication failed:

Jun  5 14:48:38 mail.srvfarm.net postfix/smtpd[3095007]: warning: unknown[186.216.71.50]: SASL PLAIN authentication failed: 
Jun  5 14:48:38 mail.srvfarm.net postfix/smtpd[3095007]: lost connection after AUTH from unknown[186.216.71.50]
Jun  5 14:55:01 mail.srvfarm.net postfix/smtps/smtpd[3094396]: warning: unknown[186.216.71.50]: SASL PLAIN authentication failed: 
Jun  5 14:55:01 mail.srvfarm.net postfix/smtps/smtpd[3094396]: lost connection after AUTH from unknown[186.216.71.50]
Jun  5 14:57:10 mail.srvfarm.net postfix/smtpd[3093305]: warning: unknown[186.216.71.50]: SASL PLAIN authentication failed:

Jun 14 08:16:06 eventyay sshd[2348]: Failed password for root from 49.88.112.73 port 12878 ssh2
Jun 14 08:16:08 eventyay sshd[2348]: Failed password for root from 49.88.112.73 port 12878 ssh2
Jun 14 08:16:10 eventyay sshd[2348]: Failed password for root from 49.88.112.73 port 12878 ssh2
...

 TCP (SYN) 85.209.0.100:59240 -> port 22, len 60

Jun 14 08:47:47 srv01 postfix/smtpd\[5037\]: warning: unknown\[87.246.7.66\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jun 14 08:47:55 srv01 postfix/smtpd\[18048\]: warning: unknown\[87.246.7.66\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jun 14 08:47:56 srv01 postfix/smtpd\[11636\]: warning: unknown\[87.246.7.66\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jun 14 08:47:56 srv01 postfix/smtpd\[23606\]: warning: unknown\[87.246.7.66\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jun 14 08:48:19 srv01 postfix/smtpd\[23606\]: warning: unknown\[87.246.7.66\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
...

Jun 14 06:53:47 meumeu sshd[464364]: Invalid user zabbix from 180.76.57.58 port 34488
Jun 14 06:53:47 meumeu sshd[464364]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.57.58 
Jun 14 06:53:47 meumeu sshd[464364]: Invalid user zabbix from 180.76.57.58 port 34488
Jun 14 06:53:49 meumeu sshd[464364]: Failed password for invalid user zabbix from 180.76.57.58 port 34488 ssh2
Jun 14 06:55:34 meumeu sshd[464505]: Invalid user cinder from 180.76.57.58 port 51960
Jun 14 06:55:34 meumeu sshd[464505]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.57.58 
Jun 14 06:55:34 meumeu sshd[464505]: Invalid user cinder from 180.76.57.58 port 51960
Jun 14 06:55:36 meumeu sshd[464505]: Failed password for invalid user cinder from 180.76.57.58 port 51960 ssh2
Jun 14 06:57:28 meumeu sshd[464656]: Invalid user aws-user from 180.76.57.58 port 41196
...

Fail2Ban - SSH Bruteforce Attempt

Jun 14 03:37:17 dns1 sshd[28383]: Failed password for root from 222.186.52.78 port 53469 ssh2
Jun 14 03:37:21 dns1 sshd[28383]: Failed password for root from 222.186.52.78 port 53469 ssh2
Jun 14 03:37:24 dns1 sshd[28383]: Failed password for root from 222.186.52.78 port 53469 ssh2

Too many connections or unauthorized access detected from Arctic banned ip

Jun 14 05:42:48 localhost sshd\[15005\]: Invalid user laur from 60.50.29.149 port 42882
Jun 14 05:42:48 localhost sshd\[15005\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=60.50.29.149
Jun 14 05:42:50 localhost sshd\[15005\]: Failed password for invalid user laur from 60.50.29.149 port 42882 ssh2
...

Jun 14 06:07:36 gestao sshd[1811]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.37.26 
Jun 14 06:07:38 gestao sshd[1811]: Failed password for invalid user idempiere from 122.51.37.26 port 46908 ssh2
Jun 14 06:10:32 gestao sshd[1941]: Failed password for root from 122.51.37.26 port 50502 ssh2
...

$f2bV_matches | Triggered by Fail2Ban at Vostok web server

Jun 14 09:03:23 lukav-desktop sshd\[21820\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=140.246.124.36  user=mongodb
Jun 14 09:03:26 lukav-desktop sshd\[21820\]: Failed password for mongodb from 140.246.124.36 port 36346 ssh2
Jun 14 09:06:59 lukav-desktop sshd\[4442\]: Invalid user IEIeMerge from 140.246.124.36
Jun 14 09:06:59 lukav-desktop sshd\[4442\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=140.246.124.36
Jun 14 09:07:01 lukav-desktop sshd\[4442\]: Failed password for invalid user IEIeMerge from 140.246.124.36 port 37288 ssh2

Jun 14 06:18:12 jumpserver sshd[76829]: Invalid user acct from 118.45.130.170 port 40341
Jun 14 06:18:14 jumpserver sshd[76829]: Failed password for invalid user acct from 118.45.130.170 port 40341 ssh2
Jun 14 06:21:42 jumpserver sshd[76855]: Invalid user nexus from 118.45.130.170 port 37620
...

Jun 14 00:50:05 firewall sshd[31504]: Failed password for invalid user postgres from 138.68.105.194 port 33454 ssh2
Jun 14 00:53:30 firewall sshd[31609]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.105.194  user=root
Jun 14 00:53:32 firewall sshd[31609]: Failed password for root from 138.68.105.194 port 33910 ssh2
...

Lines containing failures of 200.69.234.168
Jun 10 13:28:49 penfold sshd[16381]: Invalid user yf from 200.69.234.168 port 51120
Jun 10 13:28:49 penfold sshd[16381]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.69.234.168 
Jun 10 13:28:50 penfold sshd[16381]: Failed password for invalid user yf from 200.69.234.168 port 51120 ssh2
Jun 10 13:28:51 penfold sshd[16381]: Received disconnect from 200.69.234.168 port 51120:11: Bye Bye [preauth]
Jun 10 13:28:51 penfold sshd[16381]: Disconnected from invalid user yf 200.69.234.168 port 51120 [preauth]
Jun 10 13:43:00 penfold sshd[18047]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.69.234.168  user=r.r
Jun 10 13:43:01 penfold sshd[18047]: Failed password for r.r from 200.69.234.168 port 37550 ssh2
Jun 10 13:43:02 penfold sshd[18047]: Received disconnect from 200.69.234.168 port 37550:11: Bye Bye [preauth]
Jun 10 13:43:02 penfold sshd[1804........
------------------------------

Automatic report - XMLRPC Attack