2020-06-06T13:31:44.018280beta postfix/smtpd[5741]: warning: unknown[193.56.28.146]: SASL LOGIN authentication failed: authentication failure
2020-06-06T13:31:44.304320beta postfix/smtpd[5741]: warning: unknown[193.56.28.146]: SASL LOGIN authentication failed: authentication failure
2020-06-06T13:31:46.690650beta postfix/smtpd[5741]: warning: unknown[193.56.28.146]: SASL LOGIN authentication failed: authentication failure
...

193.56.28.146 did not issue MAIL/EXPN/VRFY/ETRN

2020-05-31 23:26:51 dovecot_login authenticator failed for \(User\) \[193.56.28.146\]: 535 Incorrect authentication data \(set_id=testing1@ift.org.ua\)2020-05-31 23:26:57 dovecot_login authenticator failed for \(User\) \[193.56.28.146\]: 535 Incorrect authentication data \(set_id=testing1@ift.org.ua\)2020-05-31 23:27:07 dovecot_login authenticator failed for \(User\) \[193.56.28.146\]: 535 Incorrect authentication data \(set_id=testing1@ift.org.ua\)
...

May 28 16:33:39 srv01 postfix/smtpd\[19558\]: warning: unknown\[193.56.28.146\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
May 28 16:33:45 srv01 postfix/smtpd\[19558\]: warning: unknown\[193.56.28.146\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
May 28 16:33:55 srv01 postfix/smtpd\[19558\]: warning: unknown\[193.56.28.146\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
May 28 16:36:07 srv01 postfix/smtpd\[636\]: warning: unknown\[193.56.28.146\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
May 28 16:36:13 srv01 postfix/smtpd\[636\]: warning: unknown\[193.56.28.146\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
...

2020-05-28 00:11:41 dovecot_login authenticator failed for \(User\) \[193.56.28.146\]: 535 Incorrect authentication data \(set_id=shop3@ift.org.ua\)2020-05-28 00:11:47 dovecot_login authenticator failed for \(User\) \[193.56.28.146\]: 535 Incorrect authentication data \(set_id=shop3@ift.org.ua\)2020-05-28 00:11:57 dovecot_login authenticator failed for \(User\) \[193.56.28.146\]: 535 Incorrect authentication data \(set_id=shop3@ift.org.ua\)
...

SASL broute force

May 20 11:47:34 srv01 postfix/smtpd[28114]: warning: unknown[193.56.28.146]: SASL LOGIN authentication failed: authentication failure
May 20 11:47:34 srv01 postfix/smtpd[28114]: warning: unknown[193.56.28.146]: SASL LOGIN authentication failed: authentication failure
May 20 11:47:35 srv01 postfix/smtpd[28114]: warning: unknown[193.56.28.146]: SASL LOGIN authentication failed: authentication failure
...

Dec 09 02:18:59 nameserver1.wifi6.mx postfix/smtpd[29849]: disconnect from unknown[193.56.28.205]
Dec 08 02:19:07 postfix/smtpd[29844]: connect from unknown[193.56.28.205]
Dec 08 02:19:07  postfix/smtpd[29844]: lost connection after EHLO from unknown[193.56.28.205]
Dec 08 02:19:07  postfix/smtpd[29844]: disconnect from unknown[193.56.28.205]
Dec 08 02:19:11  postfix/smtpd[29849]: connect from unknown[193.56.28.205]
Dec 08 02:19:12  postfix/smtpd[29849]: lost connection after EHLO from unknown[193.56.28.205]
Dec 08 02:19:12  postfix/smtpd[29849]: disconnect from unknown[193.56.28.205]

dovecot.log:Aug 19 04:24:55 pop3-login: Info: Disconnected (auth failed	 1 attempts in 19 secs): user=	 method=PLAIN	 rip=193.56.28.232	
dovecot.log:Aug 19 04:25:13 pop3-login: Info: Disconnected (auth failed	 1 attempts in 18 secs): user=	 method=PLAIN	 rip=193.56.28.232	
dovecot.log:Aug 19 04:25:32 pop3-login: Info: Disconnected (auth failed	 1 attempts in 19 secs): user=	 method=PLAIN	 rip=193.56.28.232	
dovecot.log:Aug 19 04:25:51 pop3-login: Info: Disconnected (auth failed	 1 attempts in 19 secs): user=	 method=PLAIN	 rip=193.56.28.232	
dovecot.log:Aug 19 04:26:10 pop3-login: Info: Disconnected (auth failed	 1 attempts in 19 secs): user=	 method=PLAIN	 rip=193.56.28.232	
dovecot.log:Aug 19 04:26:30 pop3-login: Info: Disconnected (auth failed	 1 attempts in 20 secs): user=	 method=PLAIN	 rip=193.56.28.232	
dovecot.log:Aug 19 04:26:49 pop3-login: Info: Disconnected (auth failed	 1 attempts in 19 secs): user=	 method=PLAIN	 rip=193.56.28.232

Oct 6 07:23:56 *hidden* postfix/postscreen[49386]: DNSBL rank 3 for [193.56.28.237]:57440

(cpanel) Failed cPanel login from 193.56.28.29 (GB/United Kingdom/-): 5 in the last 3600 secs

Oct 6 07:23:56 *hidden* postfix/postscreen[49386]: DNSBL rank 3 for [193.56.28.237]:57440

(cpanel) Failed cPanel login from 193.56.28.29 (GB/United Kingdom/-): 5 in the last 3600 secs

Port scan denied

Port scan denied

Port scan denied

Oct  4 22:22:56 h2779839 postfix/smtpd[13429]: warning: unknown[193.56.28.122]: SASL LOGIN authentication failed: authentication failure
Oct  4 22:23:17 h2779839 postfix/smtpd[13429]: warning: unknown[193.56.28.122]: SASL LOGIN authentication failed: authentication failure
Oct  4 22:26:27 h2779839 postfix/smtpd[13429]: warning: unknown[193.56.28.122]: SASL LOGIN authentication failed: authentication failure
Oct  4 22:27:19 h2779839 postfix/smtpd[13429]: warning: unknown[193.56.28.122]: SASL LOGIN authentication failed: authentication failure
Oct  4 22:27:20 h2779839 postfix/smtpd[13429]: warning: unknown[193.56.28.122]: SASL LOGIN authentication failed: authentication failure
...

Rude login attack (13 tries in 1d)

Oct  4 07:01:10 h2779839 postfix/smtpd[389]: warning: unknown[193.56.28.122]: SASL LOGIN authentication failed: authentication failure
Oct  4 07:01:50 h2779839 postfix/smtpd[389]: warning: unknown[193.56.28.122]: SASL LOGIN authentication failed: authentication failure
Oct  4 07:01:52 h2779839 postfix/smtpd[389]: warning: unknown[193.56.28.122]: SASL LOGIN authentication failed: authentication failure
Oct  4 07:02:07 h2779839 postfix/smtpd[389]: warning: unknown[193.56.28.122]: SASL LOGIN authentication failed: authentication failure
Oct  4 07:02:07 h2779839 postfix/smtpd[389]: warning: unknown[193.56.28.122]: SASL LOGIN authentication failed: authentication failure
...

Rude login attack (8 tries in 1d)

Oct  4 07:01:10 h2779839 postfix/smtpd[389]: warning: unknown[193.56.28.122]: SASL LOGIN authentication failed: authentication failure
Oct  4 07:01:50 h2779839 postfix/smtpd[389]: warning: unknown[193.56.28.122]: SASL LOGIN authentication failed: authentication failure
Oct  4 07:01:52 h2779839 postfix/smtpd[389]: warning: unknown[193.56.28.122]: SASL LOGIN authentication failed: authentication failure
Oct  4 07:02:07 h2779839 postfix/smtpd[389]: warning: unknown[193.56.28.122]: SASL LOGIN authentication failed: authentication failure
Oct  4 07:02:07 h2779839 postfix/smtpd[389]: warning: unknown[193.56.28.122]: SASL LOGIN authentication failed: authentication failure
...

Oct  4 08:12:26 mx postfix/postscreen\[15389\]: PREGREET 11 after 0.09 from \[193.56.28.193\]:50428: EHLO User

...

May 28 11:35:54 cdc sshd[26081]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.175.46.170  user=root
May 28 11:35:56 cdc sshd[26081]: Failed password for invalid user root from 202.175.46.170 port 45538 ssh2

SSH login attempts.

Unauthorized connection attempt detected from IP address 198.108.66.217 to port 2095

May 28 12:51:25 abendstille sshd\[18346\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.50.249.92  user=root
May 28 12:51:27 abendstille sshd\[18346\]: Failed password for root from 92.50.249.92 port 59070 ssh2
May 28 12:55:05 abendstille sshd\[21885\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.50.249.92  user=root
May 28 12:55:08 abendstille sshd\[21885\]: Failed password for root from 92.50.249.92 port 33576 ssh2
May 28 12:58:52 abendstille sshd\[25809\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.50.249.92  user=root
...

May 28 06:31:45 master sshd[30893]: Failed password for root from 201.203.21.239 port 46596 ssh2
May 28 06:41:31 master sshd[30920]: Failed password for root from 201.203.21.239 port 54184 ssh2
May 28 06:45:20 master sshd[30945]: Failed password for invalid user admin from 201.203.21.239 port 57423 ssh2
May 28 06:49:09 master sshd[30955]: Failed password for root from 201.203.21.239 port 60658 ssh2
May 28 06:52:50 master sshd[30963]: Failed password for root from 201.203.21.239 port 35652 ssh2
May 28 06:56:42 master sshd[30975]: Failed password for invalid user hat from 201.203.21.239 port 38884 ssh2
May 28 07:00:27 master sshd[31001]: Failed password for invalid user guest from 201.203.21.239 port 42141 ssh2
May 28 07:04:16 master sshd[31014]: Failed password for root from 201.203.21.239 port 45373 ssh2
May 28 07:08:02 master sshd[31024]: Failed password for invalid user taddio from 201.203.21.239 port 48603 ssh2

May 28 05:52:27 debian-2gb-nbg1-2 kernel: \[12896739.233979\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=110.154.125.225 DST=195.201.40.59 LEN=44 TOS=0x00 PREC=0x00 TTL=240 ID=62698 PROTO=TCP SPT=9216 DPT=1433 WINDOW=1024 RES=0x00 SYN URGP=0

May 28 06:59:09 firewall sshd[1194]: Failed password for root from 157.230.31.236 port 36794 ssh2
May 28 07:02:33 firewall sshd[1391]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.230.31.236  user=root
May 28 07:02:35 firewall sshd[1391]: Failed password for root from 157.230.31.236 port 42944 ssh2
...

$f2bV_matches | Triggered by Fail2Ban at Vostok web server

May 28 03:33:58 ws24vmsma01 sshd[64868]: Failed password for root from 52.52.225.53 port 38005 ssh2
May 28 03:49:34 ws24vmsma01 sshd[48537]: Failed password for root from 52.52.225.53 port 48133 ssh2
...

May 28 10:35:26 jumpserver sshd[27036]: Failed password for invalid user test from 121.101.133.192 port 38290 ssh2
May 28 10:39:37 jumpserver sshd[27071]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.101.133.192  user=root
May 28 10:39:39 jumpserver sshd[27071]: Failed password for root from 121.101.133.192 port 40174 ssh2
...

SSH login attempts.

May 28 10:33:44 localhost sshd\[24374\]: Invalid user test1 from 46.101.224.184
May 28 10:33:44 localhost sshd\[24374\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.101.224.184
May 28 10:33:46 localhost sshd\[24374\]: Failed password for invalid user test1 from 46.101.224.184 port 60384 ssh2
May 28 10:41:05 localhost sshd\[25118\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.101.224.184  user=root
May 28 10:41:08 localhost sshd\[25118\]: Failed password for root from 46.101.224.184 port 36848 ssh2
...

89.253.231.58 - - [28/May/2020:02:59:52 +0200] "GET /wp-login.php HTTP/1.1" 200 6702 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
89.253.231.58 - - [28/May/2020:02:59:53 +0200] "POST /wp-login.php HTTP/1.1" 200 6973 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
89.253.231.58 - - [28/May/2020:05:52:51 +0200] "GET /wp-login.php HTTP/1.1" 200 6614 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"

SSH fail RA

May 28 15:33:08 itv-usvr-01 sshd[29411]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.191.42.78  user=root
May 28 15:33:10 itv-usvr-01 sshd[29411]: Failed password for root from 94.191.42.78 port 58442 ssh2
May 28 15:36:27 itv-usvr-01 sshd[29512]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.191.42.78  user=root
May 28 15:36:29 itv-usvr-01 sshd[29512]: Failed password for root from 94.191.42.78 port 33572 ssh2
May 28 15:39:29 itv-usvr-01 sshd[29761]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.191.42.78  user=root
May 28 15:39:31 itv-usvr-01 sshd[29761]: Failed password for root from 94.191.42.78 port 36924 ssh2