Mar  8 02:19:44 vps691689 sshd[18063]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.234.122.222
Mar  8 02:19:45 vps691689 sshd[18063]: Failed password for invalid user rooot#123 from 49.234.122.222 port 58122 ssh2
...

Invalid user ts3server from 68.183.193.46 port 44872

xmlrpc attack

2020-03-08T01:10:33.802677shield sshd\[1345\]: Invalid user bpadmin from 200.87.7.61 port 54352
2020-03-08T01:10:33.812434shield sshd\[1345\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.87.7.61
2020-03-08T01:10:35.989048shield sshd\[1345\]: Failed password for invalid user bpadmin from 200.87.7.61 port 54352 ssh2
2020-03-08T01:20:01.774580shield sshd\[3117\]: Invalid user fabian from 200.87.7.61 port 49148
2020-03-08T01:20:01.778929shield sshd\[3117\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.87.7.61

Automatic report - Port Scan Attack

Lines containing failures of 45.178.116.26
Mar  7 15:11:11 kopano sshd[13726]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.178.116.26  user=r.r
Mar  7 15:11:13 kopano sshd[13726]: Failed password for r.r from 45.178.116.26 port 49234 ssh2
Mar  7 15:11:13 kopano sshd[13726]: Received disconnect from 45.178.116.26 port 49234:11: Bye Bye [preauth]
Mar  7 15:11:13 kopano sshd[13726]: Disconnected from authenticating user r.r 45.178.116.26 port 49234 [preauth]
Mar  7 15:14:28 kopano sshd[13863]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.178.116.26  user=r.r
Mar  7 15:14:30 kopano sshd[13863]: Failed password for r.r from 45.178.116.26 port 60544 ssh2
Mar  7 15:14:31 kopano sshd[13863]: Received disconnect from 45.178.116.26 port 60544:11: Bye Bye [preauth]
Mar  7 15:14:31 kopano sshd[13863]: Disconnected from authenticating user r.r 45.178.116.26 port 60544 [preauth]
Mar  7 15:16:2........
------------------------------

[2020-03-07 17:49:34] NOTICE[1148][C-0000f99b] chan_sip.c: Call from '' (45.143.220.240:63255) to extension '01146843737607' rejected because extension not found in context 'public'.
[2020-03-07 17:49:34] SECURITY[1163] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-03-07T17:49:34.550-0500",Severity="Error",Service="SIP",EventVersion="1",AccountID="01146843737607",SessionID="0x7fd82c3f03d8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/45.143.220.240/63255",ACLName="no_extension_match"
[2020-03-07 17:51:36] NOTICE[1148][C-0000f99d] chan_sip.c: Call from '' (45.143.220.240:63141) to extension '901146843737607' rejected because extension not found in context 'public'.
[2020-03-07 17:51:36] SECURITY[1163] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-03-07T17:51:36.727-0500",Severity="Error",Service="SIP",EventVersion="1",AccountID="901146843737607",SessionID="0x7fd82cdb8718",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP
...

Port probing on unauthorized port 23

DATE:2020-03-07 23:01:39, IP:131.161.34.100, PORT:telnet Telnet brute force auth on honeypot server (epe-honey1-hq)

Mar  8 07:19:16 areeb-Workstation sshd[24148]: Failed password for root from 112.85.42.186 port 56707 ssh2
Mar  8 07:19:19 areeb-Workstation sshd[24148]: Failed password for root from 112.85.42.186 port 56707 ssh2
...

Port probing on unauthorized port 2004

Mar  8 04:47:09 server sshd\[14639\]: Invalid user test from 182.61.3.119
Mar  8 04:47:09 server sshd\[14639\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.3.119 
Mar  8 04:47:11 server sshd\[14639\]: Failed password for invalid user test from 182.61.3.119 port 58942 ssh2
Mar  8 05:01:08 server sshd\[17414\]: Invalid user lasse from 182.61.3.119
Mar  8 05:01:08 server sshd\[17414\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.3.119 
...

Mar  7 23:03:31 grey postfix/smtpd\[14681\]: NOQUEUE: reject: RCPT from unknown\[180.127.111.202\]: 554 5.7.1 Service unavailable\; Client host \[180.127.111.202\] blocked using truncate.gbudb.net\; http://www.gbudb.com/truncate/ \[180.127.111.202\]\; from=\ to=\ proto=ESMTP helo=\
...

Invalid user hewenlong from 180.100.243.210 port 42460

Mar  7 21:41:50 fwweb01 sshd[31485]: Invalid user vps from 106.12.21.78
Mar  7 21:41:50 fwweb01 sshd[31485]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.21.78 
Mar  7 21:41:51 fwweb01 sshd[31485]: Failed password for invalid user vps from 106.12.21.78 port 36818 ssh2
Mar  7 21:41:52 fwweb01 sshd[31485]: Received disconnect from 106.12.21.78: 11: Bye Bye [preauth]
Mar  7 21:48:05 fwweb01 sshd[31824]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.21.78  user=r.r
Mar  7 21:48:07 fwweb01 sshd[31824]: Failed password for r.r from 106.12.21.78 port 48130 ssh2
Mar  7 21:48:07 fwweb01 sshd[31824]: Received disconnect from 106.12.21.78: 11: Bye Bye [preauth]
Mar  7 21:53:23 fwweb01 sshd[32098]: Invalid user wlk-lab from 106.12.21.78
Mar  7 21:53:23 fwweb01 sshd[32098]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.21.78 
Mar  7 21:5........
-------------------------------