Feb 21 13:41:30 web1 sshd\[29731\]: Invalid user gitlab-runner from 165.227.144.125
Feb 21 13:41:30 web1 sshd\[29731\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.227.144.125
Feb 21 13:41:32 web1 sshd\[29731\]: Failed password for invalid user gitlab-runner from 165.227.144.125 port 59308 ssh2
Feb 21 13:42:32 web1 sshd\[29831\]: Invalid user jenkins from 165.227.144.125
Feb 21 13:42:32 web1 sshd\[29831\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.227.144.125

Invalid user nicola from 51.15.84.255 port 49356

Honeypot attack, port: 81, PTR: PTR record not found

Automatic report - Port Scan Attack

Feb 21 22:27:52 v22018076622670303 sshd\[6787\]: Invalid user alma from 89.244.189.219 port 36798
Feb 21 22:27:52 v22018076622670303 sshd\[6787\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=89.244.189.219
Feb 21 22:27:54 v22018076622670303 sshd\[6787\]: Failed password for invalid user alma from 89.244.189.219 port 36798 ssh2
...

Invalid user jira from 125.212.207.205 port 46940

SSH Brute-Forcing (server1)

Feb 22 00:01:03 mail postfix/smtpd\[26340\]: warning: unknown\[185.36.81.23\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6\
Feb 22 00:26:06 mail postfix/smtpd\[26967\]: warning: unknown\[185.36.81.23\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6\
Feb 22 01:16:20 mail postfix/smtpd\[27824\]: warning: unknown\[185.36.81.23\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6\
Feb 22 01:41:31 mail postfix/smtpd\[28256\]: warning: unknown\[185.36.81.23\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6\

2020-02-22 02:01:08 dovecot_login authenticator failed for \(User\) \[92.118.38.57\]: 535 Incorrect authentication data \(set_id=shyy@no-server.de\)
2020-02-22 02:01:09 dovecot_login authenticator failed for \(User\) \[92.118.38.57\]: 535 Incorrect authentication data \(set_id=shyy@no-server.de\)
2020-02-22 02:01:14 dovecot_login authenticator failed for \(User\) \[92.118.38.57\]: 535 Incorrect authentication data \(set_id=shyy@no-server.de\)
2020-02-22 02:01:18 dovecot_login authenticator failed for \(User\) \[92.118.38.57\]: 535 Incorrect authentication data \(set_id=shyy@no-server.de\)
2020-02-22 02:01:39 dovecot_login authenticator failed for \(User\) \[92.118.38.57\]: 535 Incorrect authentication data \(set_id=si@no-server.de\)
...

[2020-02-21 17:16:57] NOTICE[1148] chan_sip.c: Registration from '' failed for '74.208.18.250:47199' - Wrong password
[2020-02-21 17:16:57] SECURITY[1163] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-02-21T17:16:57.777-0500",Severity="Error",Service="SIP",EventVersion="2",AccountID="3551",SessionID="0x7fd82c9bc688",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/74.208.18.250/47199",Challenge="70f535c5",ReceivedChallenge="70f535c5",ReceivedHash="7cbd655159e0317e578ed042a9cb7602"
[2020-02-21 17:19:08] NOTICE[1148] chan_sip.c: Registration from '' failed for '74.208.18.250:51809' - Wrong password
[2020-02-21 17:19:08] SECURITY[1163] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-02-21T17:19:08.356-0500",Severity="Error",Service="SIP",EventVersion="2",AccountID="1001",SessionID="0x7fd82cce0268",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/74.208.18.250
...

Feb 21 14:33:00 php1 sshd\[24194\]: Invalid user nathan from 118.25.196.31
Feb 21 14:33:00 php1 sshd\[24194\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.25.196.31
Feb 21 14:33:02 php1 sshd\[24194\]: Failed password for invalid user nathan from 118.25.196.31 port 38972 ssh2
Feb 21 14:35:35 php1 sshd\[24422\]: Invalid user bot2 from 118.25.196.31
Feb 21 14:35:35 php1 sshd\[24422\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.25.196.31

Feb 22 01:54:11 vps647732 sshd[5100]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=95.156.31.74
Feb 22 01:54:12 vps647732 sshd[5100]: Failed password for invalid user net from 95.156.31.74 port 12041 ssh2
...

Feb 22 05:57:36 gw1 sshd[6726]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=141.98.80.173
Feb 22 05:57:38 gw1 sshd[6726]: Failed password for invalid user admin from 141.98.80.173 port 55343 ssh2
...

firewall-block, port(s): 23/tcp

Honeypot attack, port: 445, PTR: PTR record not found