Jun 27 14:45:45 Host-KLAX-C dovecot: imap-login: Disconnected (auth failed, 1 attempts in 2 secs): user=, method=PLAIN, rip=2001:e68:5051:53d3:12be:f5ff:fe29:d018, lip=2a04:bdc7:100:28::2, TLS, session=<8BDR6BapSoEgAQ5oUFFT0xK+9f/+KdAY>
...

web-1 [ssh] SSH Attack

Mar 17 01:40:50 sso sshd[3031]: Failed password for root from 218.92.0.212 port 50628 ssh2
Mar 17 01:40:54 sso sshd[3031]: Failed password for root from 218.92.0.212 port 50628 ssh2
...

Mar 16 00:02:50 nxxxxxxx sshd[26759]: Failed password for r.r from 198.50.229.116 port 35712 ssh2
Mar 16 00:26:31 nxxxxxxx sshd[29516]: Invalid user cpanelconnecttrack from 198.50.229.116
Mar 16 00:26:33 nxxxxxxx sshd[29516]: Failed password for invalid user cpanelconnecttrack from 198.50.229.116 port 33618 ssh2


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=198.50.229.116

2020-03-17 01:24:20 dovecot_login authenticator failed for \(\[45.133.99.2\]\) \[45.133.99.2\]: 535 Incorrect authentication data \(set_id=adminrus@no-server.de\)
2020-03-17 01:24:31 dovecot_login authenticator failed for \(\[45.133.99.2\]\) \[45.133.99.2\]: 535 Incorrect authentication data
2020-03-17 01:24:43 dovecot_login authenticator failed for \(\[45.133.99.2\]\) \[45.133.99.2\]: 535 Incorrect authentication data
2020-03-17 01:24:51 dovecot_login authenticator failed for \(\[45.133.99.2\]\) \[45.133.99.2\]: 535 Incorrect authentication data
2020-03-17 01:25:07 dovecot_login authenticator failed for \(\[45.133.99.2\]\) \[45.133.99.2\]: 535 Incorrect authentication data
...

firewall-block, port(s): 23/tcp

Mar 17 01:27:56 roki sshd[4377]: Invalid user yaohuachao from 212.92.250.91
Mar 17 01:27:56 roki sshd[4377]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.92.250.91
Mar 17 01:27:57 roki sshd[4377]: Failed password for invalid user yaohuachao from 212.92.250.91 port 59052 ssh2
Mar 17 01:37:16 roki sshd[5022]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.92.250.91  user=root
Mar 17 01:37:18 roki sshd[5022]: Failed password for root from 212.92.250.91 port 58960 ssh2
...

1584404480 - 03/17/2020 01:21:20 Host: 185.142.236.35/185.142.236.35 Port: 7 UDP Blocked
...

Unauthorized IMAP connection attempt

firewall-block, port(s): 53/tcp, 128/tcp, 443/tcp, 468/tcp, 587/tcp, 1287/tcp, 3561/tcp, 3640/tcp, 3682/tcp, 3997/tcp, 4138/tcp, 4262/tcp, 4332/tcp, 4337/tcp, 4399/tcp, 4494/tcp, 4591/tcp, 4915/tcp, 6482/tcp, 6629/tcp, 6642/tcp, 6750/tcp, 6846/tcp, 6912/tcp, 6925/tcp, 7042/tcp, 7168/tcp, 7504/tcp, 7562/tcp, 7747/tcp, 8201/tcp, 8323/tcp, 8350/tcp, 8366/tcp, 8624/tcp, 8981/tcp, 9186/tcp, 9463/tcp

Mar 17 00:29:56 SilenceServices sshd[28900]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.77.200.101
Mar 17 00:29:59 SilenceServices sshd[28900]: Failed password for invalid user lms from 51.77.200.101 port 42342 ssh2
Mar 17 00:39:04 SilenceServices sshd[26022]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.77.200.101

SSH / Telnet Brute Force Attempts on Honeypot

Mar 17 01:26:03 vpn01 sshd[18382]: Failed password for root from 222.186.30.187 port 47334 ssh2
...

20/3/16@19:39:13: FAIL: Alarm-Network address from=197.232.65.112
20/3/16@19:39:14: FAIL: Alarm-Network address from=197.232.65.112
...

Scanning unused Default website or suspicious access to valid sites from IP marked as abusive

Mar 16 23:34:36 game-panel sshd[28481]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.102.54
Mar 16 23:34:38 game-panel sshd[28481]: Failed password for invalid user dspace from 106.12.102.54 port 40252 ssh2
Mar 16 23:38:15 game-panel sshd[28597]: Failed password for root from 106.12.102.54 port 48838 ssh2