(imapd) Failed IMAP login from 171.103.45.90 (TH/Thailand/171-103-45-90.static.asianet.co.th): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Apr  6 02:07:00 ir1 dovecot[566034]: imap-login: Disconnected (auth failed, 1 attempts in 13 secs): user=, method=PLAIN, rip=171.103.45.90, lip=5.63.12.44, TLS, session=

Autoban   156.213.17.32 AUTH/CONNECT

[2020-04-05 19:56:11] NOTICE[12114][C-00001d40] chan_sip.c: Call from '' (45.143.221.59:55510) to extension '011442080892691' rejected because extension not found in context 'public'.
[2020-04-05 19:56:11] SECURITY[12128] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-04-05T19:56:11.609-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="011442080892691",SessionID="0x7f020c088288",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/45.143.221.59/55510",ACLName="no_extension_match"
[2020-04-05 20:04:24] NOTICE[12114][C-00001d4c] chan_sip.c: Call from '' (45.143.221.59:59997) to extension '9011442080892691' rejected because extension not found in context 'public'.
[2020-04-05 20:04:24] SECURITY[12128] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-04-05T20:04:24.018-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="9011442080892691",SessionID="0x7f020c088288",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV
...

Port scan on 6 port(s): 874 33119 35023 46472 49975 51784

Apr  5 23:37:22 mout sshd[21562]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.137.85.215  user=pi
Apr  5 23:37:24 mout sshd[21562]: Failed password for pi from 188.137.85.215 port 41518 ssh2
Apr  5 23:37:25 mout sshd[21562]: Connection closed by 188.137.85.215 port 41518 [preauth]

$f2bV_matches

US_Sharktech_<177>1586129901 [1:2403355:56467] ET CINS Active Threat Intelligence Poor Reputation IP UDP group 28 [Classification: Misc Attack] [Priority: 2]:  {UDP} 45.58.146.42:50923

Apr  6 01:25:32 localhost sshd\[5090\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.182.95.16  user=root
Apr  6 01:25:34 localhost sshd\[5090\]: Failed password for root from 217.182.95.16 port 47588 ssh2
Apr  6 01:29:23 localhost sshd\[5182\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.182.95.16  user=root
Apr  6 01:29:25 localhost sshd\[5182\]: Failed password for root from 217.182.95.16 port 52800 ssh2
Apr  6 01:33:25 localhost sshd\[5429\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.182.95.16  user=root
...

Attempts against SMTP/SSMTP

firewall-block, port(s): 3389/tcp

Brute force attack stopped by firewall

Apr  5 23:25:17 vps sshd[21272]: Failed password for root from 117.173.67.119 port 3229 ssh2
Apr  5 23:33:51 vps sshd[21677]: Failed password for root from 117.173.67.119 port 3230 ssh2
...

Apr  6 07:33:47 bacztwo sshd[27012]: error: PAM: Authentication failure for root from 222.186.180.9
Apr  6 07:33:38 bacztwo sshd[27012]: error: PAM: Authentication failure for root from 222.186.180.9
Apr  6 07:33:41 bacztwo sshd[27012]: error: PAM: Authentication failure for root from 222.186.180.9
Apr  6 07:33:44 bacztwo sshd[27012]: error: PAM: Authentication failure for root from 222.186.180.9
Apr  6 07:33:47 bacztwo sshd[27012]: error: PAM: Authentication failure for root from 222.186.180.9
Apr  6 07:33:47 bacztwo sshd[27012]: Failed keyboard-interactive/pam for root from 222.186.180.9 port 60538 ssh2
Apr  6 07:33:38 bacztwo sshd[27012]: error: PAM: Authentication failure for root from 222.186.180.9
Apr  6 07:33:41 bacztwo sshd[27012]: error: PAM: Authentication failure for root from 222.186.180.9
Apr  6 07:33:44 bacztwo sshd[27012]: error: PAM: Authentication failure for root from 222.186.180.9
Apr  6 07:33:47 bacztwo sshd[27012]: error: PAM: Authentication failure for root from 2
...

Apr  6 01:11:57 vmd26974 sshd[5981]: Failed password for root from 24.142.36.105 port 38328 ssh2
...

[ssh] SSH attack