Mar 31 20:56:50 mail.srvfarm.net postfix/smtpd[733010]: warning: unknown[195.231.3.188]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Mar 31 20:56:50 mail.srvfarm.net postfix/smtpd[733010]: lost connection after AUTH from unknown[195.231.3.188]
Mar 31 20:58:01 mail.srvfarm.net postfix/smtpd[736671]: lost connection after CONNECT from unknown[195.231.3.188]
Mar 31 21:04:12 mail.srvfarm.net postfix/smtpd[733104]: warning: unknown[195.231.3.188]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Mar 31 21:04:12 mail.srvfarm.net postfix/smtpd[733104]: lost connection after AUTH from unknown[195.231.3.188]

[2020-03-31 16:09:16] NOTICE[1148][C-00019a31] chan_sip.c: Call from '' (103.145.12.14:62437) to extension '01146406820579' rejected because extension not found in context 'public'.
[2020-03-31 16:09:16] SECURITY[1163] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-03-31T16:09:16.009-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="01146406820579",SessionID="0x7fd82c530768",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/103.145.12.14/62437",ACLName="no_extension_match"
[2020-03-31 16:09:16] NOTICE[1148][C-00019a32] chan_sip.c: Call from '' (103.145.12.14:49322) to extension '+46406820579' rejected because extension not found in context 'public'.
[2020-03-31 16:09:16] SECURITY[1163] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-03-31T16:09:16.819-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="+46406820579",SessionID="0x7fd82c43c848",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/103.145.
...

Mar 31 22:13:28 srv01 postfix/smtpd\[1018\]: warning: unknown\[46.38.145.6\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Mar 31 22:14:40 srv01 postfix/smtpd\[1018\]: warning: unknown\[46.38.145.6\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Mar 31 22:15:54 srv01 postfix/smtpd\[25259\]: warning: unknown\[46.38.145.6\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Mar 31 22:17:07 srv01 postfix/smtpd\[3256\]: warning: unknown\[46.38.145.6\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Mar 31 22:18:20 srv01 postfix/smtpd\[3256\]: warning: unknown\[46.38.145.6\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
...

20/3/31@08:28:02: FAIL: Alarm-Network address from=222.124.32.97
...

[MK-Root1] Blocked by UFW

Mar 31 20:57:44 vmd48417 sshd[15228]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.153.68

Email Spam

Mar 31 15:27:57 elektron postfix/smtpd\[11299\]: NOQUEUE: reject: RCPT from unknown\[180.124.7.226\]: 450 4.7.1 Client host rejected: cannot find your hostname, \[180.124.7.226\]\; from=\ to=\ proto=ESMTP helo=\
Mar 31 15:28:31 elektron postfix/smtpd\[11299\]: NOQUEUE: reject: RCPT from unknown\[180.124.7.226\]: 450 4.7.1 Client host rejected: cannot find your hostname, \[180.124.7.226\]\; from=\ to=\ proto=ESMTP helo=\
Mar 31 15:29:03 elektron postfix/smtpd\[11299\]: NOQUEUE: reject: RCPT from unknown\[180.124.7.226\]: 450 4.7.1 Client host rejected: cannot find your hostname, \[180.124.7.226\]\; from=\ to=\ proto=ESMTP helo=\
Mar 31 15:29:36 elektron postfix/smtpd\[11299\]: NOQUEUE: reject: RCPT from unknown\[180.124.7.226\]: 450 4.7.1 Client host rejected: cannot find your hostname, \[180.124.7.226\]\; from=\

Honeypot attack, port: 445, PTR: 1-162-15-203.dynamic-ip.hinet.net.

(sshd) Failed SSH login from 195.182.129.173 (RU/Russia/ip-195-182-129-173.clients.cmk.ru): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Mar 31 17:46:37 amsweb01 sshd[18059]: Failed password for root from 195.182.129.173 port 50852 ssh2
Mar 31 18:05:03 amsweb01 sshd[20747]: Invalid user pty from 195.182.129.173 port 59718
Mar 31 18:05:05 amsweb01 sshd[20747]: Failed password for invalid user pty from 195.182.129.173 port 59718 ssh2
Mar 31 18:12:27 amsweb01 sshd[21517]: Failed password for root from 195.182.129.173 port 64935 ssh2
Mar 31 18:19:36 amsweb01 sshd[22189]: Failed password for root from 195.182.129.173 port 51661 ssh2

159.65.69.32 - - [31/Mar/2020:21:19:21 +0200] "GET /wp-login.php HTTP/1.1" 200 6463 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
159.65.69.32 - - [31/Mar/2020:21:19:24 +0200] "POST /wp-login.php HTTP/1.1" 200 7362 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
159.65.69.32 - - [31/Mar/2020:21:19:30 +0200] "POST /xmlrpc.php HTTP/1.1" 200 427 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"

Mar 31 13:19:50 ws12vmsma01 sshd[23764]: Failed password for invalid user lu from 1.201.140.126 port 47376 ssh2
Mar 31 13:27:01 ws12vmsma01 sshd[24867]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.201.140.126  user=root
Mar 31 13:27:03 ws12vmsma01 sshd[24867]: Failed password for root from 1.201.140.126 port 53981 ssh2
...

Mar 31 20:52:20 srv-ubuntu-dev3 sshd[20799]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.166.129.156  user=root
Mar 31 20:52:22 srv-ubuntu-dev3 sshd[20799]: Failed password for root from 46.166.129.156 port 48268 ssh2
Mar 31 20:52:24 srv-ubuntu-dev3 sshd[20799]: Failed password for root from 46.166.129.156 port 48268 ssh2
Mar 31 20:52:20 srv-ubuntu-dev3 sshd[20799]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.166.129.156  user=root
Mar 31 20:52:22 srv-ubuntu-dev3 sshd[20799]: Failed password for root from 46.166.129.156 port 48268 ssh2
Mar 31 20:52:24 srv-ubuntu-dev3 sshd[20799]: Failed password for root from 46.166.129.156 port 48268 ssh2
Mar 31 20:52:20 srv-ubuntu-dev3 sshd[20799]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.166.129.156  user=root
Mar 31 20:52:22 srv-ubuntu-dev3 sshd[20799]: Failed password for root from 46.166.129.156 port 4826
...

Unauthorized connection attempt detected from IP address 189.103.228.239 to port 81

Honeypot attack, port: 445, PTR: 180-177-105-148.dynamic.kbronet.com.tw.