Nov 28 07:26:30 ns3042688 courier-imapd: LOGIN FAILED, method=PLAIN, ip=\[::ffff:183.65.17.118\]
...

Nov 28 11:58:29 sauna sshd[68315]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.99.233
Nov 28 11:58:31 sauna sshd[68315]: Failed password for invalid user garth from 106.12.99.233 port 23342 ssh2
...

Nov 28 09:54:19 meumeu sshd[967]: Failed password for root from 78.94.119.186 port 39308 ssh2
Nov 28 10:00:41 meumeu sshd[2104]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=78.94.119.186 
Nov 28 10:00:43 meumeu sshd[2104]: Failed password for invalid user admin from 78.94.119.186 port 49230 ssh2
...

xmlrpc attack

Received: from golavans.network (ip123.ip-54-36-185.eu [54.36.185.123])
	by mail.golavans.network (Postfix) with ESMTPA id F39AB2821C73;
	Wed, 27 Nov 2019 04:03:09 +0200 (EET)
Message-ID: 
From: "Australian Financial Platform" 
To: 
Subject: People are Making Thousands Everyday From This With No Experience
Date: Wed, 27 Nov 2019 04:03:06 +0200
MIME-Version: 1.0
Content-Type: multipart/related;
	type="multipart/alternative";
	boundary="----=_NextPart_000_0018_01D5A4D7.901755F0"
Precedence: bulk
List-Id: b43713385v50415071
X-Complaints-To: abuse@golavans.network
List-Unsubscribe: 

This is a multi-part message in MIME format.

------=_NextPart_000_0018_01D5A4D7.901755F0
Content-Type: multipart/alternative;
	boundary="----=_NextPart_000_0019_01D5A4D7.901755F0"

------=_NextPart_000_0019_01D5A4D7.901755F0

\[2019-11-28 04:15:20\] NOTICE\[2754\] chan_sip.c: Registration from '"104" \' failed for '94.177.238.29:5100' - Wrong password
\[2019-11-28 04:15:20\] SECURITY\[2765\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-11-28T04:15:20.876-0500",Severity="Error",Service="SIP",EventVersion="2",AccountID="104",SessionID="0x7f26c445f668",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/94.177.238.29/5100",Challenge="3b688d2f",ReceivedChallenge="3b688d2f",ReceivedHash="66657467b745e89300f024ec3a5d2f2c"
\[2019-11-28 04:16:10\] NOTICE\[2754\] chan_sip.c: Registration from '"4300" \' failed for '94.177.238.29:5087' - Wrong password
\[2019-11-28 04:16:10\] SECURITY\[2765\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-11-28T04:16:10.521-0500",Severity="Error",Service="SIP",EventVersion="2",AccountID="4300",SessionID="0x7f26c445f668",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/9

Nov 28 11:58:22 ncomp postfix/smtpd[16907]: warning: unknown[45.82.153.136]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Nov 28 11:58:47 ncomp postfix/smtpd[16907]: warning: unknown[45.82.153.136]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Nov 28 11:59:10 ncomp postfix/smtpd[16908]: warning: unknown[45.82.153.136]: SASL LOGIN authentication failed: UGFzc3dvcmQ6

Unauthorised access (Nov 28) SRC=210.246.240.50 LEN=52 TTL=113 ID=4740 DF TCP DPT=445 WINDOW=8192 SYN

Nov 27 23:16:35 eddieflores sshd\[4570\]: Invalid user azumatam from 180.250.140.74
Nov 27 23:16:35 eddieflores sshd\[4570\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.250.140.74
Nov 27 23:16:38 eddieflores sshd\[4570\]: Failed password for invalid user azumatam from 180.250.140.74 port 46078 ssh2
Nov 27 23:25:01 eddieflores sshd\[5233\]: Invalid user pumpkin from 180.250.140.74
Nov 27 23:25:01 eddieflores sshd\[5233\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.250.140.74

2019-11-28T09:44:36.698862shield sshd\[29989\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.173.142  user=root
2019-11-28T09:44:39.012950shield sshd\[29989\]: Failed password for root from 222.186.173.142 port 55034 ssh2
2019-11-28T09:44:41.791003shield sshd\[29989\]: Failed password for root from 222.186.173.142 port 55034 ssh2
2019-11-28T09:44:44.987509shield sshd\[29989\]: Failed password for root from 222.186.173.142 port 55034 ssh2
2019-11-28T09:44:48.584754shield sshd\[29989\]: Failed password for root from 222.186.173.142 port 55034 ssh2

Nov 28 09:30:47 MainVPS sshd[3659]: Invalid user root1 from 45.55.129.23 port 40691
Nov 28 09:30:47 MainVPS sshd[3659]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.55.129.23
Nov 28 09:30:47 MainVPS sshd[3659]: Invalid user root1 from 45.55.129.23 port 40691
Nov 28 09:30:49 MainVPS sshd[3659]: Failed password for invalid user root1 from 45.55.129.23 port 40691 ssh2
Nov 28 09:37:54 MainVPS sshd[16264]: Invalid user prueba from 45.55.129.23 port 58633
...

$f2bV_matches

Nov 28 10:29:44 DAAP sshd[7193]: Invalid user sawada from 36.46.136.149 port 35182
...

Nov 28 10:51:06 vps691689 sshd[11852]: Failed password for root from 222.186.175.163 port 29180 ssh2
Nov 28 10:51:09 vps691689 sshd[11852]: Failed password for root from 222.186.175.163 port 29180 ssh2
Nov 28 10:51:12 vps691689 sshd[11852]: Failed password for root from 222.186.175.163 port 29180 ssh2
...

Nov 28 10:38:35 vmanager6029 sshd\[14855\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.157  user=root
Nov 28 10:38:37 vmanager6029 sshd\[14855\]: Failed password for root from 218.92.0.157 port 10198 ssh2
Nov 28 10:38:40 vmanager6029 sshd\[14855\]: Failed password for root from 218.92.0.157 port 10198 ssh2