Nov 28 07:30:51 jane sshd[23009]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.58.247 
Nov 28 07:30:53 jane sshd[23009]: Failed password for invalid user comuzzi from 165.22.58.247 port 54704 ssh2
...

Nov 28 11:50:30 gw1 sshd[20168]: Failed password for root from 222.186.175.182 port 26414 ssh2
Nov 28 11:50:42 gw1 sshd[20168]: error: maximum authentication attempts exceeded for root from 222.186.175.182 port 26414 ssh2 [preauth]
...

DATE:2019-11-28 07:25:40, IP:190.235.64.67, PORT:telnet Telnet brute force auth on honeypot server (honey-neo-dc)

Nov 28 11:53:58 vibhu-HP-Z238-Microtower-Workstation sshd\[1729\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=140.143.248.69  user=root
Nov 28 11:54:01 vibhu-HP-Z238-Microtower-Workstation sshd\[1729\]: Failed password for root from 140.143.248.69 port 44256 ssh2
Nov 28 12:00:30 vibhu-HP-Z238-Microtower-Workstation sshd\[2108\]: Invalid user kinser from 140.143.248.69
Nov 28 12:00:30 vibhu-HP-Z238-Microtower-Workstation sshd\[2108\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=140.143.248.69
Nov 28 12:00:32 vibhu-HP-Z238-Microtower-Workstation sshd\[2108\]: Failed password for invalid user kinser from 140.143.248.69 port 45548 ssh2
...

Automatic report - Banned IP Access

Unauthorised access (Nov 28) SRC=91.221.65.6 LEN=52 TTL=119 ID=10865 DF TCP DPT=445 WINDOW=8192 SYN

Nov 28 07:23:01 vps647732 sshd[8951]: Failed password for backup from 140.143.196.247 port 59508 ssh2
...

SpamReport

Investment Fraud Website

http://mailer212.letians.a.clickbetter.com/
http://clickbetter.com/a.php?vendor=letians
67.227.165.179

Return-Path: 
Received: from source:[160.20.13.23] helo:comfortart.best
From: " Roberta" 
Date: Wed, 27 Nov 2019 17:18:21 -0500
MIME-Version: 1.0
Subject: Well well, would you look at this one
Message-ID: 

http://www.comfortart.best/rtodgeqe/rxpf51081vxubws/c_____0/W_____q
JAVASCRIPT redirect to
http://www.comfortart.best/offer.php?id=2&sid=730314&h=
META redirect to
http://www.comfortart.best/click/smart3/passiveincome_cbet.php?sid=730314&h=
107.175.246.210
 
http://mailer212.letians.a.clickbetter.com/
67.227.165.179
302 Temporary redirect to
http://clickbetter.com/a.php?vendor=letians&id=mailer212&testurl=&subtid=&pid=¶m=&aemail=&lp=&coty=
67.227.165.179
302 Temporary redirect to
http://easyretiredmillionaire.com/clickbetter.php?cbid=mailer212
198.1.124.203

2019-11-28T07:23:45.201510centos sshd\[3041\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.85.42.175  user=root
2019-11-28T07:23:47.125505centos sshd\[3041\]: Failed password for root from 112.85.42.175 port 6688 ssh2
2019-11-28T07:23:50.429150centos sshd\[3041\]: Failed password for root from 112.85.42.175 port 6688 ssh2

Automatic report - Banned IP Access

$f2bV_matches

Nov 28 07:51:44 v22018086721571380 sshd[23613]: error: maximum authentication attempts exceeded for root from 218.92.0.182 port 19093 ssh2 [preauth]

Nov 27 20:24:28 web1 sshd\[5032\]: Invalid user raed from 185.38.3.138
Nov 27 20:24:28 web1 sshd\[5032\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.38.3.138
Nov 27 20:24:30 web1 sshd\[5032\]: Failed password for invalid user raed from 185.38.3.138 port 34206 ssh2
Nov 27 20:30:57 web1 sshd\[5614\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.38.3.138  user=root
Nov 27 20:30:59 web1 sshd\[5614\]: Failed password for root from 185.38.3.138 port 42278 ssh2

RDP Bruteforce