SIP/5060 Probe, BF, Hack -

Nov 14 10:04:51 odroid64 sshd\[10088\]: User root from 159.89.175.48 not allowed because not listed in AllowUsers
Nov 14 10:04:51 odroid64 sshd\[10088\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.89.175.48  user=root
Nov 26 06:43:20 odroid64 sshd\[16651\]: Invalid user ching from 159.89.175.48
Nov 26 06:43:20 odroid64 sshd\[16651\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.89.175.48
...

Honeypot attack, port: 445, PTR: ns508154.ip-192-99-32.net.

Mar  5 22:13:01 lukav-desktop sshd\[13130\]: Invalid user admin from 118.70.233.163
Mar  5 22:13:01 lukav-desktop sshd\[13130\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.70.233.163
Mar  5 22:13:03 lukav-desktop sshd\[13130\]: Failed password for invalid user admin from 118.70.233.163 port 59624 ssh2
Mar  5 22:18:02 lukav-desktop sshd\[22479\]: Invalid user deploy from 118.70.233.163
Mar  5 22:18:02 lukav-desktop sshd\[22479\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.70.233.163

suspicious action Thu, 05 Mar 2020 10:31:44 -0300

(sshd) Failed SSH login from 89.173.45.89 (SK/Slovakia/chello089173045089.chello.sk): 2 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Mar  5 22:41:16 ubnt-55d23 sshd[29293]: Invalid user cpanellogin from 89.173.45.89 port 46704
Mar  5 22:41:18 ubnt-55d23 sshd[29293]: Failed password for invalid user cpanellogin from 89.173.45.89 port 46704 ssh2

Unauthorized connection attempt from IP address 196.204.197.67 on Port 445(SMB)

Mar  5 11:59:14 pixelmemory sshd[14285]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.235.12.159
Mar  5 11:59:16 pixelmemory sshd[14285]: Failed password for invalid user mysql from 49.235.12.159 port 37658 ssh2
Mar  5 12:03:18 pixelmemory sshd[16187]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.235.12.159
...

Honeypot attack, port: 81, PTR: PTR record not found

Mar  5 22:36:36 server sshd\[19317\]: Invalid user user from 5.182.26.22
Mar  5 22:36:36 server sshd\[19317\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.182.26.22 
Mar  5 22:36:39 server sshd\[19317\]: Failed password for invalid user user from 5.182.26.22 port 47532 ssh2
Mar  5 22:49:34 server sshd\[21658\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.182.26.22  user=apache
Mar  5 22:49:36 server sshd\[21658\]: Failed password for apache from 5.182.26.22 port 55008 ssh2
...

Honeypot attack, port: 81, PTR: 62-128.206.104.serverhubrdns.in-addr.arpa.

Mar  5 21:02:56 v22018076622670303 sshd\[25293\]: Invalid user redmine from 46.0.203.166 port 46886
Mar  5 21:02:56 v22018076622670303 sshd\[25293\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.0.203.166
Mar  5 21:02:58 v22018076622670303 sshd\[25293\]: Failed password for invalid user redmine from 46.0.203.166 port 46886 ssh2
...

From: ғᴏxɴᴇᴡs  - spamvertising fraud

Unsolicited bulk spam - Received: from smtp-outgoing.laposte.net (160.92.124.106) Worldline France hosting

Spam link lnkd.in = 108.174.10.10 LinkedIn Corporation – blacklisted - phishing redirect:
-	mjinina.xyz = 217.61.122.96 Aruba S.p.a.
-	clicks-bb.com = 207.142.0.180 Webhosting.Net

Mar  5 14:31:20 MK-Soft-VM3 sshd[30712]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.149.229.108 
Mar  5 14:31:22 MK-Soft-VM3 sshd[30712]: Failed password for invalid user alex from 61.149.229.108 port 60475 ssh2
...

Nov 27 02:18:40 odroid64 sshd\[4350\]: Invalid user web from 160.16.111.215
Nov 27 02:18:40 odroid64 sshd\[4350\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=160.16.111.215
...