Sep  6 00:16:23 yabzik sshd[5066]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.190.32
Sep  6 00:16:25 yabzik sshd[5066]: Failed password for invalid user test2 from 206.189.190.32 port 52940 ssh2
Sep  6 00:20:40 yabzik sshd[6702]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.190.32

Sep  1 17:54:26 aiointranet sshd\[1373\]: Invalid user firebird from 206.189.190.32
Sep  1 17:54:26 aiointranet sshd\[1373\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.190.32
Sep  1 17:54:27 aiointranet sshd\[1373\]: Failed password for invalid user firebird from 206.189.190.32 port 39504 ssh2
Sep  1 17:58:22 aiointranet sshd\[1743\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.190.32  user=postfix
Sep  1 17:58:24 aiointranet sshd\[1743\]: Failed password for postfix from 206.189.190.32 port 54730 ssh2

[ssh] SSH attack

Aug 13 14:29:27 vps200512 sshd\[5102\]: Invalid user amavis from 206.189.190.32
Aug 13 14:29:27 vps200512 sshd\[5102\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.190.32
Aug 13 14:29:29 vps200512 sshd\[5102\]: Failed password for invalid user amavis from 206.189.190.32 port 57886 ssh2
Aug 13 14:34:16 vps200512 sshd\[5205\]: Invalid user areyes from 206.189.190.32
Aug 13 14:34:16 vps200512 sshd\[5205\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.190.32

Aug  9 01:48:20 vpn01 sshd\[17539\]: Invalid user rust from 206.189.190.32
Aug  9 01:48:20 vpn01 sshd\[17539\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.190.32
Aug  9 01:48:22 vpn01 sshd\[17539\]: Failed password for invalid user rust from 206.189.190.32 port 48986 ssh2

Aug  8 14:42:19 mail sshd\[5399\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.190.32  user=root
Aug  8 14:42:22 mail sshd\[5399\]: Failed password for root from 206.189.190.32 port 54178 ssh2
...

Aug  6 21:24:13 vps65 sshd\[28880\]: Invalid user tamara from 206.189.190.32 port 59136
Aug  6 21:24:13 vps65 sshd\[28880\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.190.32
...

$f2bV_matches

Jul 20 16:55:49 vps200512 sshd\[7184\]: Invalid user temp from 206.189.190.32
Jul 20 16:55:49 vps200512 sshd\[7184\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.190.32
Jul 20 16:55:52 vps200512 sshd\[7184\]: Failed password for invalid user temp from 206.189.190.32 port 58458 ssh2
Jul 20 17:00:27 vps200512 sshd\[7264\]: Invalid user guest from 206.189.190.32
Jul 20 17:00:27 vps200512 sshd\[7264\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.190.32

Jul 15 07:26:19 ip-172-31-1-72 sshd\[14769\]: Invalid user revista from 206.189.190.32
Jul 15 07:26:19 ip-172-31-1-72 sshd\[14769\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.190.32
Jul 15 07:26:21 ip-172-31-1-72 sshd\[14769\]: Failed password for invalid user revista from 206.189.190.32 port 50374 ssh2
Jul 15 07:30:46 ip-172-31-1-72 sshd\[14860\]: Invalid user jenkins from 206.189.190.32
Jul 15 07:30:46 ip-172-31-1-72 sshd\[14860\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.190.32

Triggered by Fail2Ban at Ares web server

Invalid user oracle from 206.189.190.27 port 49968

>20 unauthorized SSH connections

Port scan on 2 port(s): 4243 4244

Jun 16 19:26:12 master sshd[13991]: Failed password for invalid user student01 from 206.189.190.28 port 59074 ssh2
Jun 16 19:31:11 master sshd[14419]: Failed password for root from 206.189.190.28 port 50736 ssh2
Jun 16 19:34:13 master sshd[14427]: Failed password for root from 206.189.190.28 port 51880 ssh2
Jun 16 19:37:24 master sshd[14433]: Failed password for invalid user bun from 206.189.190.28 port 53020 ssh2

Invalid user aebi from 206.189.190.28 port 49414

SSH brute force

2020-04-05T23:43:14.182446Z e59a82af6bd5 New connection: 206.189.190.187:48716 (172.17.0.4:2222) [session: e59a82af6bd5]
2020-04-05T23:50:25.100488Z d370bfef3e72 New connection: 206.189.190.187:51034 (172.17.0.4:2222) [session: d370bfef3e72]

SSH login attempts.

k+ssh-bruteforce

Mar 21 09:40:57 vps691689 sshd[12767]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.190.187
Mar 21 09:41:00 vps691689 sshd[12767]: Failed password for invalid user uftp from 206.189.190.187 port 49614 ssh2
...

$f2bV_matches

Feb 17 08:26:34 plusreed sshd[23655]: Invalid user test from 206.189.190.187
Feb 17 08:26:34 plusreed sshd[23655]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.190.187
Feb 17 08:26:34 plusreed sshd[23655]: Invalid user test from 206.189.190.187
Feb 17 08:26:36 plusreed sshd[23655]: Failed password for invalid user test from 206.189.190.187 port 42560 ssh2
Feb 17 08:39:17 plusreed sshd[27162]: Invalid user ts from 206.189.190.187
...

Feb 14 23:26:06 MK-Soft-VM8 sshd[17803]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.190.187 
Feb 14 23:26:07 MK-Soft-VM8 sshd[17803]: Failed password for invalid user jenkins from 206.189.190.187 port 56138 ssh2
...

Jan 18 03:40:16 ws12vmsma01 sshd[49242]: Invalid user pham from 206.189.190.187
Jan 18 03:40:18 ws12vmsma01 sshd[49242]: Failed password for invalid user pham from 206.189.190.187 port 43060 ssh2
Jan 18 03:41:39 ws12vmsma01 sshd[49442]: Invalid user tom from 206.189.190.187
...

Dec 31 02:17:39 plusreed sshd[21018]: Invalid user web from 206.189.190.187
...

[2020-03-30 08:23:32] NOTICE[1148][C-00018f80] chan_sip.c: Call from '' (185.53.88.49:5070) to extension '1011972595897084' rejected because extension not found in context 'public'.
[2020-03-30 08:23:32] SECURITY[1163] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-03-30T08:23:32.925-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="1011972595897084",SessionID="0x7fd82c4bd548",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/185.53.88.49/5070",ACLName="no_extension_match"
[2020-03-30 08:27:50] NOTICE[1148][C-00018f85] chan_sip.c: Call from '' (185.53.88.49:5071) to extension '7011972595897084' rejected because extension not found in context 'public'.
[2020-03-30 08:27:50] SECURITY[1163] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-03-30T08:27:50.128-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="7011972595897084",SessionID="0x7fd82c530768",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/18
...

Honeypot attack, port: 81, PTR: 88.113.146.83.in-addr.suttk.ru.

Mar 30 10:16:45 our-server-hostname postfix/smtpd[23834]: connect from unknown[87.251.87.254]
Mar 30 10:21:47 our-server-hostname postfix/smtpd[23834]: servereout after EHLO from unknown[87.251.87.254]
Mar 30 10:21:47 our-server-hostname postfix/smtpd[23834]: disconnect from unknown[87.251.87.254]
Mar 30 10:33:55 our-server-hostname postfix/smtpd[26741]: connect from unknown[87.251.87.254]
Mar 30 10:34:34 our-server-hostname postfix/smtpd[26995]: connect from unknown[87.251.87.254]
Mar 30 10:38:56 our-server-hostname postfix/smtpd[26741]: servereout after CONNECT from unknown[87.251.87.254]
Mar 30 10:38:56 our-server-hostname postfix/smtpd[26741]: disconnect from unknown[87.251.87.254]
Mar 30 10:41:48 our-server-hostname postfix/smtpd[26847]: connect from unknown[87.251.87.254]
Mar 30 10:43:41 our-server-hostname postfix/smtpd[26995]: SSL_accept error from unknown[87.251.87.254]: -1
Mar 30 10:43:41 our-server-hostname postfix/smtpd[26995]: lost connection after STARTTLS........
-------------------------------

Automatic report - Port Scan Attack

page scraping or bad UA

Mar 30 14:42:35 host01 sshd[20974]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.21.191.253 
Mar 30 14:42:37 host01 sshd[20974]: Failed password for invalid user wenyuhui from 112.21.191.253 port 57000 ssh2
Mar 30 14:46:01 host01 sshd[21471]: Failed password for root from 112.21.191.253 port 43043 ssh2
...

Attempted connection to port 5555.

Lines containing failures of 102.65.174.235
Mar 30 07:56:43 siirappi sshd[4015]: Invalid user jzw from 102.65.174.235 port 47219
Mar 30 07:56:43 siirappi sshd[4015]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=102.65.174.235 
Mar 30 07:56:46 siirappi sshd[4015]: Failed password for invalid user jzw from 102.65.174.235 port 47219 ssh2
Mar 30 07:56:49 siirappi sshd[4015]: Received disconnect from 102.65.174.235 port 47219:11: Bye Bye [preauth]
Mar 30 07:56:49 siirappi sshd[4015]: Disconnected from invalid user jzw 102.65.174.235 port 47219 [preauth]
Mar 30 08:08:30 siirappi sshd[4197]: Invalid user vie from 102.65.174.235 port 33276
Mar 30 08:08:30 siirappi sshd[4197]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=102.65.174.235 
Mar 30 08:08:32 siirappi sshd[4197]: Failed password for invalid user vie from 102.65.174.235 port 33276 ssh2


........
-----------------------------------------------
https://www.blocklist.de/en/vie

Attempted connection to port 8080.

Mar 30 14:13:37 ns382633 sshd\[16782\]: Invalid user ro from 125.88.169.233 port 35192
Mar 30 14:13:37 ns382633 sshd\[16782\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.88.169.233
Mar 30 14:13:39 ns382633 sshd\[16782\]: Failed password for invalid user ro from 125.88.169.233 port 35192 ssh2
Mar 30 14:45:57 ns382633 sshd\[25346\]: Invalid user timson from 125.88.169.233 port 59499
Mar 30 14:45:57 ns382633 sshd\[25346\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.88.169.233

20/3/29@23:48:31: FAIL: IoT-Telnet address from=89.122.146.23
...

Mar 30 05:39:27 OPSO sshd\[20493\]: Invalid user qcu from 27.223.5.206 port 2073
Mar 30 05:39:27 OPSO sshd\[20493\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.223.5.206
Mar 30 05:39:29 OPSO sshd\[20493\]: Failed password for invalid user qcu from 27.223.5.206 port 2073 ssh2
Mar 30 05:48:01 OPSO sshd\[23305\]: Invalid user ylw from 27.223.5.206 port 2075
Mar 30 05:48:01 OPSO sshd\[23305\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.223.5.206

SpamScore above: 10.0

Honeypot attack, port: 445, PTR: PTR record not found

Brute force SMTP login attempted.
...