@LucianNitescu Personal Honeypot Network <<<>>> Donate at paypal.me/LNitescu <<<>>> 2019-09-21 02:56:54,806 INFO [amun_request_handler] PortScan Detected on Port: 445 (14.251.171.128)

Invalid user Admin from 5.135.165.51 port 59254

Sep 21 04:27:55 plusreed sshd[19059]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=153.36.242.143  user=root
Sep 21 04:27:57 plusreed sshd[19059]: Failed password for root from 153.36.242.143 port 33613 ssh2
...

Sep 21 10:41:44 mail sshd\[23513\]: Invalid user bian from 106.75.174.233 port 46792
Sep 21 10:41:44 mail sshd\[23513\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.75.174.233
Sep 21 10:41:46 mail sshd\[23513\]: Failed password for invalid user bian from 106.75.174.233 port 46792 ssh2
Sep 21 10:47:48 mail sshd\[24131\]: Invalid user somsak from 106.75.174.233 port 59628
Sep 21 10:47:48 mail sshd\[24131\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.75.174.233

C1,WP GET /blog/wp-login.php

445/tcp 445/tcp 445/tcp...
[2019-07-26/09-21]32pkt,1pt.(tcp)

\[2019-09-21 02:28:15\] SECURITY\[2283\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-09-21T02:28:15.621-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="90010048525260159",SessionID="0x7fcd8c62a6d8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/95.168.180.70/9556",ACLName="no_extension_match"
\[2019-09-21 02:31:39\] SECURITY\[2283\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-09-21T02:31:39.915-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="101548525260159",SessionID="0x7fcd8ca44b78",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/95.168.180.70/9166",ACLName="no_extension_match"
\[2019-09-21 02:35:03\] SECURITY\[2283\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-09-21T02:35:03.643-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="101948525260159",SessionID="0x7fcd8c23c548",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/95.168.180.70/8017",ACLName="no_exte

RDP Brute-Force

Sep 20 19:14:12 tdfoods sshd\[26970\]: Invalid user teamspeak3 from 85.37.38.195
Sep 20 19:14:12 tdfoods sshd\[26970\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=host195-38-static.37-85-b.business.telecomitalia.it
Sep 20 19:14:14 tdfoods sshd\[26970\]: Failed password for invalid user teamspeak3 from 85.37.38.195 port 16836 ssh2
Sep 20 19:18:40 tdfoods sshd\[27387\]: Invalid user website from 85.37.38.195
Sep 20 19:18:40 tdfoods sshd\[27387\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=host195-38-static.37-85-b.business.telecomitalia.it

\[2019-09-21 10:48:32\] NOTICE\[29653\] res_pjsip/pjsip_distributor.c: Request 'REGISTER' from '\' failed for '145.239.0.81:50184' \(callid: 77174822-1309346008-1391373692\) - Failed to authenticate
\[2019-09-21 10:48:32\] SECURITY\[1715\] res_security_log.c: SecurityEvent="ChallengeResponseFailed",EventTV="2019-09-21T10:48:32.153+0200",Severity="Error",Service="PJSIP",EventVersion="1",AccountID="\",SessionID="77174822-1309346008-1391373692",LocalAddress="IPV4/UDP/188.40.118.248/5060",RemoteAddress="IPV4/UDP/145.239.0.81/50184",Challenge="1569055712/c63deb322dea58b9ab7889fac6d36200",Response="531c392b7364222530ea16c7095ea3e1",ExpectedResponse=""
\[2019-09-21 10:48:32\] NOTICE\[7412\] res_pjsip/pjsip_distributor.c: Request 'REGISTER' from '\' failed for '145.239.0.81:50184' \(callid: 77174822-1309346008-1391373692\) - Failed to authenticate
\[2019-09-21 10:48:32\] SECURITY\[1715\] res_security_log.c: SecurityEvent="ChallengeResponseFail

Sep 21 09:43:15 microserver sshd[42461]: Invalid user admin from 92.242.240.17 port 56932
Sep 21 09:43:15 microserver sshd[42461]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.242.240.17
Sep 21 09:43:17 microserver sshd[42461]: Failed password for invalid user admin from 92.242.240.17 port 56932 ssh2
Sep 21 09:47:31 microserver sshd[43092]: Invalid user nagios from 92.242.240.17 port 42146
Sep 21 09:47:31 microserver sshd[43092]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.242.240.17
Sep 21 10:00:08 microserver sshd[44857]: Invalid user joomla from 92.242.240.17 port 54238
Sep 21 10:00:08 microserver sshd[44857]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.242.240.17
Sep 21 10:00:11 microserver sshd[44857]: Failed password for invalid user joomla from 92.242.240.17 port 54238 ssh2
Sep 21 10:04:28 microserver sshd[45219]: pam_unix(sshd:auth): authentication failure; lognam

SSH bruteforce (Triggered fail2ban)

Sep 21 08:30:25 lnxweb61 sshd[23549]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.252.30.117

Sep 21 08:41:54 hcbbdb sshd\[1347\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.37.82.220  user=root
Sep 21 08:41:56 hcbbdb sshd\[1347\]: Failed password for root from 61.37.82.220 port 48842 ssh2
Sep 21 08:46:21 hcbbdb sshd\[1867\]: Invalid user chaylock from 61.37.82.220
Sep 21 08:46:21 hcbbdb sshd\[1867\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.37.82.220
Sep 21 08:46:23 hcbbdb sshd\[1867\]: Failed password for invalid user chaylock from 61.37.82.220 port 33612 ssh2

Sep 21 10:04:54 nextcloud sshd\[13602\]: Invalid user krystyna from 106.12.24.108
Sep 21 10:04:54 nextcloud sshd\[13602\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.24.108
Sep 21 10:04:55 nextcloud sshd\[13602\]: Failed password for invalid user krystyna from 106.12.24.108 port 50972 ssh2
...