(smtpauth) Failed SMTP AUTH login from 210.16.88.244 (IN/India/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 2020-06-12 08:20:44 plain authenticator failed for ([210.16.88.244]) [210.16.88.244]: 535 Incorrect authentication data (set_id=marketin@toliddaru.ir)

210.16.88.244 (IN/India/-), 5 distributed smtpauth attacks on account [ichelle.bradleym] in the last 3600 secs

Sep  7 13:10:07 mail.srvfarm.net postfix/smtpd[1058629]: warning: unknown[210.16.88.122]: SASL PLAIN authentication failed: 
Sep  7 13:10:07 mail.srvfarm.net postfix/smtpd[1058629]: lost connection after AUTH from unknown[210.16.88.122]
Sep  7 13:11:33 mail.srvfarm.net postfix/smtpd[1053353]: warning: unknown[210.16.88.122]: SASL PLAIN authentication failed: 
Sep  7 13:11:34 mail.srvfarm.net postfix/smtpd[1053353]: lost connection after AUTH from unknown[210.16.88.122]
Sep  7 13:14:27 mail.srvfarm.net postfix/smtpd[1072432]: warning: unknown[210.16.88.122]: SASL PLAIN authentication failed:

Sep  7 13:10:07 mail.srvfarm.net postfix/smtpd[1058629]: warning: unknown[210.16.88.122]: SASL PLAIN authentication failed: 
Sep  7 13:10:07 mail.srvfarm.net postfix/smtpd[1058629]: lost connection after AUTH from unknown[210.16.88.122]
Sep  7 13:11:33 mail.srvfarm.net postfix/smtpd[1053353]: warning: unknown[210.16.88.122]: SASL PLAIN authentication failed: 
Sep  7 13:11:34 mail.srvfarm.net postfix/smtpd[1053353]: lost connection after AUTH from unknown[210.16.88.122]
Sep  7 13:14:27 mail.srvfarm.net postfix/smtpd[1072432]: warning: unknown[210.16.88.122]: SASL PLAIN authentication failed:

Sep  7 13:10:07 mail.srvfarm.net postfix/smtpd[1058629]: warning: unknown[210.16.88.122]: SASL PLAIN authentication failed: 
Sep  7 13:10:07 mail.srvfarm.net postfix/smtpd[1058629]: lost connection after AUTH from unknown[210.16.88.122]
Sep  7 13:11:33 mail.srvfarm.net postfix/smtpd[1053353]: warning: unknown[210.16.88.122]: SASL PLAIN authentication failed: 
Sep  7 13:11:34 mail.srvfarm.net postfix/smtpd[1053353]: lost connection after AUTH from unknown[210.16.88.122]
Sep  7 13:14:27 mail.srvfarm.net postfix/smtpd[1072432]: warning: unknown[210.16.88.122]: SASL PLAIN authentication failed:

Aug 27 08:45:51 mail.srvfarm.net postfix/smtps/smtpd[1433546]: warning: unknown[210.16.88.130]: SASL PLAIN authentication failed: 
Aug 27 08:45:51 mail.srvfarm.net postfix/smtps/smtpd[1433546]: lost connection after AUTH from unknown[210.16.88.130]
Aug 27 08:51:39 mail.srvfarm.net postfix/smtps/smtpd[1434623]: warning: unknown[210.16.88.130]: SASL PLAIN authentication failed: 
Aug 27 08:51:39 mail.srvfarm.net postfix/smtps/smtpd[1434623]: lost connection after AUTH from unknown[210.16.88.130]
Aug 27 08:54:46 mail.srvfarm.net postfix/smtps/smtpd[1437774]: warning: unknown[210.16.88.130]: SASL PLAIN authentication failed:

Attempted Brute Force (dovecot)

Brute force attempt

Aug 16 05:41:19 mail.srvfarm.net postfix/smtps/smtpd[1890600]: warning: unknown[210.16.88.232]: SASL PLAIN authentication failed: 
Aug 16 05:41:19 mail.srvfarm.net postfix/smtps/smtpd[1890600]: lost connection after AUTH from unknown[210.16.88.232]
Aug 16 05:41:36 mail.srvfarm.net postfix/smtpd[1907800]: warning: unknown[210.16.88.232]: SASL PLAIN authentication failed: 
Aug 16 05:41:36 mail.srvfarm.net postfix/smtpd[1907800]: lost connection after AUTH from unknown[210.16.88.232]
Aug 16 05:43:42 mail.srvfarm.net postfix/smtps/smtpd[1890604]: warning: unknown[210.16.88.232]: SASL PLAIN authentication failed:

SASL PLAIN auth failed: ruser=...

(smtpauth) Failed SMTP AUTH login from 210.16.88.221 (IN/India/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 2020-07-09 08:27:47 plain authenticator failed for ([210.16.88.221]) [210.16.88.221]: 535 Incorrect authentication data (set_id=info@zarlif.com)

SSH invalid-user multiple login try

(smtpauth) Failed SMTP AUTH login from 210.16.88.205 (IN/India/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 2020-07-07 08:20:04 plain authenticator failed for ([210.16.88.205]) [210.16.88.205]: 535 Incorrect authentication data (set_id=info@granrif.com)

Jun 25 21:58:43 mail.srvfarm.net postfix/smtpd[2056272]: warning: unknown[210.16.88.130]: SASL PLAIN authentication failed: 
Jun 25 21:58:43 mail.srvfarm.net postfix/smtpd[2056272]: lost connection after AUTH from unknown[210.16.88.130]
Jun 25 22:03:08 mail.srvfarm.net postfix/smtpd[2055920]: warning: unknown[210.16.88.130]: SASL PLAIN authentication failed: 
Jun 25 22:03:08 mail.srvfarm.net postfix/smtpd[2055920]: lost connection after AUTH from unknown[210.16.88.130]
Jun 25 22:06:00 mail.srvfarm.net postfix/smtpd[2054387]: warning: unknown[210.16.88.130]: SASL PLAIN authentication failed:

Jun  5 16:02:48 mail.srvfarm.net postfix/smtpd[3113153]: warning: unknown[210.16.88.38]: SASL PLAIN authentication failed: 
Jun  5 16:02:48 mail.srvfarm.net postfix/smtpd[3113153]: lost connection after AUTH from unknown[210.16.88.38]
Jun  5 16:09:08 mail.srvfarm.net postfix/smtps/smtpd[3129519]: warning: unknown[210.16.88.38]: SASL PLAIN authentication failed: 
Jun  5 16:09:08 mail.srvfarm.net postfix/smtps/smtpd[3129519]: lost connection after AUTH from unknown[210.16.88.38]
Jun  5 16:10:40 mail.srvfarm.net postfix/smtpd[3129213]: warning: unknown[210.16.88.38]: SASL PLAIN authentication failed:

Jun  5 17:10:11 mail.srvfarm.net postfix/smtpd[3136972]: warning: unknown[210.16.88.126]: SASL PLAIN authentication failed: 
Jun  5 17:10:11 mail.srvfarm.net postfix/smtpd[3136972]: lost connection after AUTH from unknown[210.16.88.126]
Jun  5 17:14:18 mail.srvfarm.net postfix/smtps/smtpd[3137557]: warning: unknown[210.16.88.126]: SASL PLAIN authentication failed: 
Jun  5 17:14:18 mail.srvfarm.net postfix/smtps/smtpd[3137557]: lost connection after AUTH from unknown[210.16.88.126]
Jun  5 17:16:20 mail.srvfarm.net postfix/smtpd[3150162]: warning: unknown[210.16.88.126]: SASL PLAIN authentication failed:

Jun  5 16:29:51 mail.srvfarm.net postfix/smtpd[3132026]: warning: unknown[210.16.88.171]: SASL PLAIN authentication failed: 
Jun  5 16:29:52 mail.srvfarm.net postfix/smtpd[3132026]: lost connection after AUTH from unknown[210.16.88.171]
Jun  5 16:36:23 mail.srvfarm.net postfix/smtpd[3132025]: warning: unknown[210.16.88.171]: SASL PLAIN authentication failed: 
Jun  5 16:36:24 mail.srvfarm.net postfix/smtpd[3132025]: lost connection after AUTH from unknown[210.16.88.171]
Jun  5 16:38:03 mail.srvfarm.net postfix/smtpd[3129285]: warning: unknown[210.16.88.171]: SASL PLAIN authentication failed:

Oct  7 06:33:16 mail sshd\[13074\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.137  user=root
Oct  7 06:33:19 mail sshd\[13074\]: Failed password for root from 218.92.0.137 port 38437 ssh2
Oct  7 06:33:21 mail sshd\[13074\]: Failed password for root from 218.92.0.137 port 38437 ssh2
...

Oct  7 05:57:27 hcbbdb sshd\[26407\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.170.45  user=root
Oct  7 05:57:29 hcbbdb sshd\[26407\]: Failed password for root from 104.248.170.45 port 45828 ssh2
Oct  7 06:01:42 hcbbdb sshd\[26893\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.170.45  user=root
Oct  7 06:01:45 hcbbdb sshd\[26893\]: Failed password for root from 104.248.170.45 port 57476 ssh2
Oct  7 06:05:56 hcbbdb sshd\[27363\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.170.45  user=root

Oct  7 05:48:34 xeon sshd[29446]: Failed password for root from 180.76.100.183 port 49284 ssh2

2019-10-06T13:18:36.4915921495-001 sshd\[9706\]: Failed password for root from 188.93.235.226 port 50682 ssh2
2019-10-06T13:38:49.1931221495-001 sshd\[11222\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.93.235.226  user=root
2019-10-06T13:38:51.2064121495-001 sshd\[11222\]: Failed password for root from 188.93.235.226 port 49499 ssh2
2019-10-06T13:45:29.9946041495-001 sshd\[11763\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.93.235.226  user=root
2019-10-06T13:45:32.2541141495-001 sshd\[11763\]: Failed password for root from 188.93.235.226 port 50853 ssh2
2019-10-06T13:52:28.3803451495-001 sshd\[12266\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.93.235.226  user=root
...

Honeypot attack, port: 23, PTR: PTR record not found

Oct  6 19:40:12 eddieflores sshd\[10442\]: Invalid user White123 from 5.196.7.123
Oct  6 19:40:12 eddieflores sshd\[10442\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.ip-5-196-7.eu
Oct  6 19:40:14 eddieflores sshd\[10442\]: Failed password for invalid user White123 from 5.196.7.123 port 40252 ssh2
Oct  6 19:44:01 eddieflores sshd\[10769\]: Invalid user Status123 from 5.196.7.123
Oct  6 19:44:02 eddieflores sshd\[10769\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.ip-5-196-7.eu

www.handydirektreparatur.de 104.248.195.183 \[07/Oct/2019:07:02:06 +0200\] "POST /wp-login.php HTTP/1.1" 200 5665 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"
www.handydirektreparatur.de 104.248.195.183 \[07/Oct/2019:07:02:06 +0200\] "POST /xmlrpc.php HTTP/1.1" 200 4114 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"

Oct  6 19:19:57 php1 sshd\[3676\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=63.ip-217-182-252.eu  user=root
Oct  6 19:19:59 php1 sshd\[3676\]: Failed password for root from 217.182.252.63 port 38714 ssh2
Oct  6 19:23:37 php1 sshd\[4111\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=63.ip-217-182-252.eu  user=root
Oct  6 19:23:39 php1 sshd\[4111\]: Failed password for root from 217.182.252.63 port 49326 ssh2
Oct  6 19:27:17 php1 sshd\[4553\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=63.ip-217-182-252.eu  user=root

port scan and connect, tcp 80 (http)

Received: from iosqdio.ebay.com (54.196.118.126) by VE1EUR02FT047.mail.protection.outlook.com (10.152.13.237) with Microsoft SMTP Server id 15.20.2327.20 via Frontend Transport; OriginalChecksum:D6200170066A948894069BED197D6BB3CC91F2048164B999D6003FE83B8B00FA;UpperCasedChecksum:4E92F10BE319BC154A050329625C64AF208FD79D56DEB538165BC0CC9D77D87B;SizeAsReceived:512;Count:9 From: Build Wealth By Gold  Subject: IRS Loophole Converts Your IRA/401(k) to Physical Gold Reply-To: Received: from 4brinkdealbsdomain.com (172.31.45.160) by 4brinkdealbsdomain.com id PHTMCOvjFz6H for ; Sun, 06 Oct 2019 22:59:16 +0200 (envelope-from  To: joycemarie1212@hotmail.com 
Message-ID:  Return-Path: bounce@6brinkdealXQdomain.com 
X-SID-PRA: FROM@2BRINKDEALRKDOMAIN.COM X-SID-Result: NONE

Automatic report - Banned IP Access

Oct  7 07:36:19 MK-Soft-VM6 sshd[22338]: Failed password for root from 45.55.47.149 port 49233 ssh2
...

Oct  7 05:03:38 game-panel sshd[22625]: Failed password for root from 49.88.112.73 port 59316 ssh2
Oct  7 05:05:08 game-panel sshd[22661]: Failed password for root from 49.88.112.73 port 37829 ssh2

Connection by 47.74.244.144 on port: 5900 got caught by honeypot at 10/6/2019 10:47:14 PM

DATE:2019-10-07 05:52:28, IP:180.129.127.80, PORT:telnet - Telnet brute force auth on a honeypot server (epe-dc)