Oct  4 05:54:29 SilenceServices sshd[1922]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.28.196.92
Oct  4 05:54:31 SilenceServices sshd[1922]: Failed password for invalid user PASSWORD@1 from 129.28.196.92 port 53432 ssh2
Oct  4 05:59:25 SilenceServices sshd[3175]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.28.196.92

Lines containing failures of 139.99.98.248
Oct  3 00:15:42 MAKserver06 sshd[1593]: Invalid user hanover from 139.99.98.248 port 52754
Oct  3 00:15:42 MAKserver06 sshd[1593]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.99.98.248 
Oct  3 00:15:44 MAKserver06 sshd[1593]: Failed password for invalid user hanover from 139.99.98.248 port 52754 ssh2


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=139.99.98.248

" "

[Aegis] @ 2019-10-04 04:58:47  0100 -> Sendmail rejected message.

Oct  3 20:57:12 localhost kernel: [3888451.672518] iptables_INPUT_denied: IN=eth0 OUT= MAC=f2:3c:91:84:83:95:84:78:ac:57:aa:c1:08:00 SRC=190.14.37.30 DST=[mungedIP2] LEN=40 TOS=0x00 PREC=0x00 TTL=78 ID=33320 DF PROTO=TCP SPT=55980 DPT=22 WINDOW=29200 RES=0x00 SYN URGP=0 
Oct  3 20:57:12 localhost kernel: [3888451.672526] iptables_INPUT_denied: IN=eth0 OUT= MAC=f2:3c:91:84:83:95:84:78:ac:57:aa:c1:08:00 SRC=190.14.37.30 DST=[mungedIP2] LEN=40 TOS=0x00 PREC=0x00 TTL=78 ID=33320 DF PROTO=TCP SPT=55980 DPT=22 SEQ=4139077373 ACK=0 WINDOW=29200 RES=0x00 SYN URGP=0 
Oct  3 23:59:22 localhost kernel: [3899381.476104] iptables_INPUT_denied: IN=eth0 OUT= MAC=f2:3c:91:84:83:95:84:78:ac:57:aa:c1:08:00 SRC=190.14.37.30 DST=[mungedIP2] LEN=40 TOS=0x00 PREC=0x00 TTL=54 ID=63550 DF PROTO=TCP SPT=59450 DPT=22 WINDOW=29200 RES=0x00 SYN URGP=0 
Oct  3 23:59:22 localhost kernel: [3899381.476130] iptables_INPUT_denied: IN=eth0 OUT= MAC=f2:3c:91:84:83:95:84:78:ac:57:aa:c1:08:00 SRC=190.14.37.30 DST=[mungedIP2] LEN=40 TOS=0x00 PREC=

2019-10-04 05:59:25,620 fail2ban.actions: WARNING [recidive] Ban 187.0.221.222

Oct  4 06:29:55 dcd-gentoo sshd[5814]: User root from 222.186.31.136 not allowed because none of user's groups are listed in AllowGroups
Oct  4 06:29:57 dcd-gentoo sshd[5814]: error: PAM: Authentication failure for illegal user root from 222.186.31.136
Oct  4 06:29:55 dcd-gentoo sshd[5814]: User root from 222.186.31.136 not allowed because none of user's groups are listed in AllowGroups
Oct  4 06:29:57 dcd-gentoo sshd[5814]: error: PAM: Authentication failure for illegal user root from 222.186.31.136
Oct  4 06:29:55 dcd-gentoo sshd[5814]: User root from 222.186.31.136 not allowed because none of user's groups are listed in AllowGroups
Oct  4 06:29:57 dcd-gentoo sshd[5814]: error: PAM: Authentication failure for illegal user root from 222.186.31.136
Oct  4 06:29:57 dcd-gentoo sshd[5814]: Failed keyboard-interactive/pam for invalid user root from 222.186.31.136 port 37924 ssh2
...

DATE:2019-10-04 05:48:54, IP:177.158.177.184, PORT:telnet Telnet brute force auth on honeypot server (honey-neo-dc-bis)

WordPress XMLRPC scan :: 149.255.62.99 0.140 BYPASS [04/Oct/2019:07:20:41  1000] [censored_1] "POST /xmlrpc.php HTTP/1.1" 200 413 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"

Oct  4 05:56:13 relay postfix/smtpd\[17329\]: warning: unknown\[46.38.144.146\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Oct  4 05:56:32 relay postfix/smtpd\[32674\]: warning: unknown\[46.38.144.146\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Oct  4 05:58:03 relay postfix/smtpd\[32180\]: warning: unknown\[46.38.144.146\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Oct  4 05:58:21 relay postfix/smtpd\[32673\]: warning: unknown\[46.38.144.146\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Oct  4 05:59:52 relay postfix/smtpd\[17329\]: warning: unknown\[46.38.144.146\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
...

\[2019-10-03 23:59:09\] NOTICE\[1948\] chan_sip.c: Registration from '"379" \' failed for '77.247.108.220:5247' - Wrong password
\[2019-10-03 23:59:09\] SECURITY\[2006\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-10-03T23:59:09.112-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="379",SessionID="0x7f1e1c3b69e8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/77.247.108.220/5247",Challenge="185bed2d",ReceivedChallenge="185bed2d",ReceivedHash="623cf3e0b9e09b5b13179037a49ba3a7"
\[2019-10-03 23:59:09\] NOTICE\[1948\] chan_sip.c: Registration from '"379" \' failed for '77.247.108.220:5247' - Wrong password
\[2019-10-03 23:59:09\] SECURITY\[2006\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-10-03T23:59:09.276-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="379",SessionID="0x7f1e1cb9f6d8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/7

Oct  4 06:09:31 meumeu sshd[2602]: Failed password for root from 222.186.169.194 port 18784 ssh2
Oct  4 06:09:35 meumeu sshd[2602]: Failed password for root from 222.186.169.194 port 18784 ssh2
Oct  4 06:09:40 meumeu sshd[2602]: Failed password for root from 222.186.169.194 port 18784 ssh2
Oct  4 06:09:51 meumeu sshd[2602]: error: maximum authentication attempts exceeded for root from 222.186.169.194 port 18784 ssh2 [preauth]
...

Unauthorised access (Oct  4) SRC=196.188.241.51 LEN=48 TTL=112 ID=1244 DF TCP DPT=445 WINDOW=8192 SYN

Automatic report - Port Scan Attack

CloudCIX Reconnaissance Scan Detected, PTR: 195-154-237-102.rev.poneytelecom.eu.