(imapd) Failed IMAP login from 62.99.80.170 (ES/Spain/170.62-99-80.static.clientes.euskaltel.es): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Apr  8 17:11:12 ir1 dovecot[566034]: imap-login: Disconnected (auth failed, 1 attempts in 4 secs): user=, method=PLAIN, rip=62.99.80.170, lip=5.63.12.44, TLS, session=

Apr  8 16:43:16 silence02 sshd[14883]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.55.182.232
Apr  8 16:43:18 silence02 sshd[14883]: Failed password for invalid user postgres from 45.55.182.232 port 60468 ssh2
Apr  8 16:48:26 silence02 sshd[15367]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.55.182.232

Apr  8 14:22:13 localhost sshd[90388]: Invalid user deploy from 62.122.156.74 port 53934
Apr  8 14:22:13 localhost sshd[90388]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.122.156.74
Apr  8 14:22:13 localhost sshd[90388]: Invalid user deploy from 62.122.156.74 port 53934
Apr  8 14:22:15 localhost sshd[90388]: Failed password for invalid user deploy from 62.122.156.74 port 53934 ssh2
Apr  8 14:29:49 localhost sshd[91137]: Invalid user smkim from 62.122.156.74 port 34812
...

Apr  8 11:38:41 firewall sshd[20098]: Invalid user noah from 139.59.12.65
Apr  8 11:38:43 firewall sshd[20098]: Failed password for invalid user noah from 139.59.12.65 port 58074 ssh2
Apr  8 11:48:12 firewall sshd[20539]: Invalid user test from 139.59.12.65
...

Apr  8 15:13:40 ourumov-web sshd\[30012\]: Invalid user umesh from 14.116.208.72 port 41727
Apr  8 15:13:40 ourumov-web sshd\[30012\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.116.208.72
Apr  8 15:13:42 ourumov-web sshd\[30012\]: Failed password for invalid user umesh from 14.116.208.72 port 41727 ssh2
...

DATE:2020-04-08 14:41:18, IP:36.224.170.198, PORT:1433 MSSQL brute force auth on honeypot server (honey-neo-dc)

2020-04-08T13:20:56.165735shield sshd\[15072\]: Invalid user admin from 157.230.127.240 port 54034
2020-04-08T13:20:56.169312shield sshd\[15072\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.230.127.240
2020-04-08T13:20:58.152583shield sshd\[15072\]: Failed password for invalid user admin from 157.230.127.240 port 54034 ssh2
2020-04-08T13:24:37.205255shield sshd\[16319\]: Invalid user ubuntu from 157.230.127.240 port 35580
2020-04-08T13:24:37.209530shield sshd\[16319\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.230.127.240

1586349698 - 04/08/2020 14:41:38 Host: 85.76.118.223/85.76.118.223 Port: 445 TCP Blocked

2020-04-08T15:46:28.021819vps773228.ovh.net sshd[13164]: Failed password for root from 132.232.172.159 port 59657 ssh2
2020-04-08T15:49:03.160513vps773228.ovh.net sshd[14114]: Invalid user ftpuser from 132.232.172.159 port 26734
2020-04-08T15:49:03.171036vps773228.ovh.net sshd[14114]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=132.232.172.159
2020-04-08T15:49:03.160513vps773228.ovh.net sshd[14114]: Invalid user ftpuser from 132.232.172.159 port 26734
2020-04-08T15:49:05.751432vps773228.ovh.net sshd[14114]: Failed password for invalid user ftpuser from 132.232.172.159 port 26734 ssh2
...

/var/log/apache/pucorp.org.log:194.32.119.178 - - [08/Apr/2020:14:37:44 +0200] "POST /?attachment_id=204 HTTP/1.1" 200 13804 "-" "Opera/8.54 (Windows NT 5.1; U; pl)"
/var/log/apache/pucorp.org.log:194.32.119.178 - - [08/Apr/2020:14:37:44 +0200] "POST /?attachment_id=204&rYuL%3D4583%20AND%201%3D1%20UNION%20ALL%20SELECT%201%2CNULL%2C%27%3Cscript%3Ealert%28%22XSS%22%29%3C%2Fscript%3E%27%2Ctable_name%20FROM%20information_schema.tables%20WHERE%202%3E1--%2F%2A%2A%2F%3B%20EXEC%20xp_cmdshell%28%27cat%20..%2F..%2F..%2Fetc%2Fpasswd%27%29%23 HTTP/1.1" 200 14651 "-" "Opera/8.54 (Windows NT 5.1; U; pl)"
/var/log/apache/pucorp.org.log:194.32.119.178 - - [08/Apr/2020:14:37:45 +0200] "GET /?attachment_id=204 HTTP/1.1" 200 13804 "-" "Opera/8.54 (Windows NT 5.1; U; pl)"
/var/log/apache/pucorp.org.log:194.32.119.178 - - [08/Apr/2020:14:37:45 +0200] "POST /?attachment_id=204 HTTP/1.1" 200 69467 "-" "Opera/8.54 (Windows NT 5.1; U; pl)"
/var/log/apache/pucorp.org.log:194.32.119.178 - - [08/A........
-------------------------------

Apr  8 17:46:23 server sshd[9515]: Failed password for root from 222.186.31.166 port 58231 ssh2
Apr  8 17:46:28 server sshd[9515]: Failed password for root from 222.186.31.166 port 58231 ssh2
Apr  8 17:46:30 server sshd[9515]: Failed password for root from 222.186.31.166 port 58231 ssh2

Lines containing failures of 185.88.179.189
Apr  8 14:17:56 icinga sshd[15666]: Invalid user user from 185.88.179.189 port 48496
Apr  8 14:17:56 icinga sshd[15666]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.88.179.189
Apr  8 14:17:58 icinga sshd[15666]: Failed password for invalid user user from 185.88.179.189 port 48496 ssh2
Apr  8 14:17:58 icinga sshd[15666]: Received disconnect from 185.88.179.189 port 48496:11: Bye Bye [preauth]
Apr  8 14:17:58 icinga sshd[15666]: Disconnected from invalid user user 185.88.179.189 port 48496 [preauth]
Apr  8 14:37:20 icinga sshd[20851]: Invalid user jake from 185.88.179.189 port 47514
Apr  8 14:37:20 icinga sshd[20851]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.88.179.189


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=185.88.179.189

Apr  8 14:57:33 xeon sshd[38836]: Failed password for invalid user testuser from 104.210.63.107 port 34010 ssh2

SSH bruteforce (Triggered fail2ban)

(sshd) Failed SSH login from 195.154.112.212 (FR/France/-/-/195-154-112-212.rev.poneytelecom.eu/[AS12876 Online S.a.s.]): 1 in the last 3600 secs