\[2019-11-22 23:29:24\] SECURITY\[15511\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-11-22T23:29:24.879+0100",Severity="Error",Service="SIP",EventVersion="2",AccountID="10797872",SessionID="0x7fcd8c137cc8",LocalAddress="IPV4/UDP/204.8.216.89/5060",RemoteAddress="IPV4/UDP/37.49.230.11/51314",Challenge="2526cf25",ReceivedChallenge="2526cf25",ReceivedHash="68179f67cd00a6fbb81118fa6ee30740"
\[2019-11-22 23:54:01\] SECURITY\[15511\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-11-22T23:54:01.420+0100",Severity="Error",Service="SIP",EventVersion="2",AccountID="1",SessionID="0x7fcd8c1b4948",LocalAddress="IPV4/UDP/204.8.216.89/5060",RemoteAddress="IPV4/UDP/37.49.230.11/64154",Challenge="1a1cae4c",ReceivedChallenge="1a1cae4c",ReceivedHash="57e79ea45ef0fbddc24421c47d702dd7"
\[2019-11-22 23:54:01\] SECURITY\[15511\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-11-22T23:54:01.544+0100",Severity="Error",Service="SIP",EventVersion="2",
...

Bible

2020-10-13T06:44:21.356144news0 auth[956]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=admin rhost=37.49.230.238
2020-10-13T06:44:25.395781news0 dovecot[21131]: pop3-login: Aborted login (auth failed, 1 attempts in 4 secs): user=, method=PLAIN, rip=37.49.230.238, lip=95.111.246.42, session=
2020-10-13T06:44:28.401407news0 auth[956]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=admin rhost=37.49.230.238
...

2020-10-13T06:44:21.356144news0 auth[956]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=admin rhost=37.49.230.238
2020-10-13T06:44:25.395781news0 dovecot[21131]: pop3-login: Aborted login (auth failed, 1 attempts in 4 secs): user=, method=PLAIN, rip=37.49.230.238, lip=95.111.246.42, session=
2020-10-13T06:44:28.401407news0 auth[956]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=admin rhost=37.49.230.238
...

Dovecot Invalid User Login Attempt.

"AmooT";tag=3533393765393339313363340132313832313335333935

\[2020-10-02 15:01:13\] SECURITY\[6939\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-10-02T15:01:13.624+0200",Severity="Error",Service="SIP",EventVersion="2",AccountID="100",SessionID="0x7f0ffea08d88",LocalAddress="IPV4/UDP/204.8.216.89/5060",RemoteAddress="IPV4/UDP/37.49.230.126/5862",Challenge="096f171f",ReceivedChallenge="096f171f",ReceivedHash="b099bdfad5869da4ae2114a56a2b4299"
\[2020-10-02 15:01:13\] SECURITY\[6939\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-10-02T15:01:13.759+0200",Severity="Error",Service="SIP",EventVersion="2",AccountID="100",SessionID="0x7f0ffeab8148",LocalAddress="IPV4/UDP/204.8.216.89/5060",RemoteAddress="IPV4/UDP/37.49.230.126/5862",Challenge="233a417c",ReceivedChallenge="233a417c",ReceivedHash="0017581d14759d4b5ad3a404ed924131"
\[2020-10-02 15:01:13\] SECURITY\[6939\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-10-02T15:01:13.783+0200",Severity="Error",Service="SIP",EventVersion="2",Accoun
...

\[2020-10-02 15:01:13\] SECURITY\[6939\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-10-02T15:01:13.624+0200",Severity="Error",Service="SIP",EventVersion="2",AccountID="100",SessionID="0x7f0ffea08d88",LocalAddress="IPV4/UDP/204.8.216.89/5060",RemoteAddress="IPV4/UDP/37.49.230.126/5862",Challenge="096f171f",ReceivedChallenge="096f171f",ReceivedHash="b099bdfad5869da4ae2114a56a2b4299"
\[2020-10-02 15:01:13\] SECURITY\[6939\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-10-02T15:01:13.759+0200",Severity="Error",Service="SIP",EventVersion="2",AccountID="100",SessionID="0x7f0ffeab8148",LocalAddress="IPV4/UDP/204.8.216.89/5060",RemoteAddress="IPV4/UDP/37.49.230.126/5862",Challenge="233a417c",ReceivedChallenge="233a417c",ReceivedHash="0017581d14759d4b5ad3a404ed924131"
\[2020-10-02 15:01:13\] SECURITY\[6939\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-10-02T15:01:13.783+0200",Severity="Error",Service="SIP",EventVersion="2",Accoun
...

[N1.H1.VM1] Port Scanner Detected Blocked by UFW

SIP Server BruteForce Attack

[2020-09-30 18:00:12] NOTICE[1159][C-0000421d] chan_sip.c: Call from '' (37.49.230.201:64644) to extension '12526890745' rejected because extension not found in context 'public'.
[2020-09-30 18:00:12] SECURITY[1198] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-09-30T18:00:12.866-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="12526890745",SessionID="0x7fcaa045f8f8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.230.201/64644",ACLName="no_extension_match"
[2020-09-30 18:00:26] NOTICE[1159][C-0000421f] chan_sip.c: Call from '' (37.49.230.201:57391) to extension '712526890745' rejected because extension not found in context 'public'.
[2020-09-30 18:00:26] SECURITY[1198] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-09-30T18:00:26.237-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="712526890745",SessionID="0x7fcaa04d8d08",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.230.201/
...

[2020-09-30 18:00:12] NOTICE[1159][C-0000421d] chan_sip.c: Call from '' (37.49.230.201:64644) to extension '12526890745' rejected because extension not found in context 'public'.
[2020-09-30 18:00:12] SECURITY[1198] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-09-30T18:00:12.866-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="12526890745",SessionID="0x7fcaa045f8f8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.230.201/64644",ACLName="no_extension_match"
[2020-09-30 18:00:26] NOTICE[1159][C-0000421f] chan_sip.c: Call from '' (37.49.230.201:57391) to extension '712526890745' rejected because extension not found in context 'public'.
[2020-09-30 18:00:26] SECURITY[1198] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-09-30T18:00:26.237-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="712526890745",SessionID="0x7fcaa04d8d08",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.230.201/
...

[2020-09-30 18:00:12] NOTICE[1159][C-0000421d] chan_sip.c: Call from '' (37.49.230.201:64644) to extension '12526890745' rejected because extension not found in context 'public'.
[2020-09-30 18:00:12] SECURITY[1198] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-09-30T18:00:12.866-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="12526890745",SessionID="0x7fcaa045f8f8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.230.201/64644",ACLName="no_extension_match"
[2020-09-30 18:00:26] NOTICE[1159][C-0000421f] chan_sip.c: Call from '' (37.49.230.201:57391) to extension '712526890745' rejected because extension not found in context 'public'.
[2020-09-30 18:00:26] SECURITY[1198] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-09-30T18:00:26.237-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="712526890745",SessionID="0x7fcaa04d8d08",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.230.201/
...

Hellooo

Hellooo

Sep 28 15:49:19 : SSH login attempts with invalid user

Jul 13 05:44:22 cumulus sshd[2802]: Invalid user admin from 134.209.82.197 port 58228
Jul 13 05:44:22 cumulus sshd[2802]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.82.197
Jul 13 05:44:22 cumulus sshd[2803]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.82.197  user=r.r
Jul 13 05:44:22 cumulus sshd[2804]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.82.197  user=r.r
Jul 13 05:44:24 cumulus sshd[2802]: Failed password for invalid user admin from 134.209.82.197 port 58228 ssh2
Jul 13 05:44:24 cumulus sshd[2804]: Failed password for r.r from 134.209.82.197 port 58224 ssh2
Jul 13 05:44:24 cumulus sshd[2803]: Failed password for r.r from 134.209.82.197 port 58226 ssh2
Jul 13 05:44:24 cumulus sshd[2802]: Connection closed by 134.209.82.197 port 58228 [preauth]
Jul 13 05:44:24 cumulus sshd[2803]: Connection closed by 134.209.........
-------------------------------

2019-07-14T21:18:38.749759abusebot.cloudsearch.cf sshd\[5393\]: Invalid user hf from 134.175.225.94 port 50234

Jul 14 23:13:38 debian sshd\[12121\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.1.130  user=root
Jul 14 23:13:40 debian sshd\[12121\]: Failed password for root from 218.92.1.130 port 60579 ssh2
...

Jul 14 23:55:59 relay postfix/smtpd\[13869\]: warning: unknown\[45.227.253.213\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jul 14 23:56:10 relay postfix/smtpd\[16182\]: warning: unknown\[45.227.253.213\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jul 14 23:56:12 relay postfix/smtpd\[15052\]: warning: unknown\[45.227.253.213\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jul 14 23:56:26 relay postfix/smtpd\[15032\]: warning: unknown\[45.227.253.213\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jul 14 23:57:46 relay postfix/smtpd\[14055\]: warning: unknown\[45.227.253.213\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
...

Jul 14 23:30:06 localhost sshd\[20312\]: Invalid user pradeep from 190.0.159.86
Jul 14 23:30:06 localhost sshd\[20312\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.0.159.86
Jul 14 23:30:08 localhost sshd\[20312\]: Failed password for invalid user pradeep from 190.0.159.86 port 55982 ssh2
Jul 14 23:36:54 localhost sshd\[20637\]: Invalid user acs from 190.0.159.86
Jul 14 23:36:54 localhost sshd\[20637\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.0.159.86
...

Jul 15 03:24:55 vibhu-HP-Z238-Microtower-Workstation sshd\[25087\]: Invalid user daniel from 190.151.105.182
Jul 15 03:24:55 vibhu-HP-Z238-Microtower-Workstation sshd\[25087\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.151.105.182
Jul 15 03:24:57 vibhu-HP-Z238-Microtower-Workstation sshd\[25087\]: Failed password for invalid user daniel from 190.151.105.182 port 56124 ssh2
Jul 15 03:32:41 vibhu-HP-Z238-Microtower-Workstation sshd\[25387\]: Invalid user testuser from 190.151.105.182
Jul 15 03:32:42 vibhu-HP-Z238-Microtower-Workstation sshd\[25387\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.151.105.182
...

Jul 14 23:37:32 lnxweb61 sshd[17453]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.157.34.104
Jul 14 23:37:32 lnxweb61 sshd[17453]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.157.34.104

Jul 14 23:30:47 mout sshd[1986]: Invalid user molisoft from 104.168.147.210 port 47298

Automatic report - Port Scan Attack

Jul 14 23:13:12 SilenceServices sshd[28453]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.132.74.224
Jul 14 23:13:14 SilenceServices sshd[28453]: Failed password for invalid user resin from 164.132.74.224 port 51230 ssh2
Jul 14 23:17:38 SilenceServices sshd[32364]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.132.74.224

Jul 14 23:29:11 eventyay sshd[7852]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.172.91.170
Jul 14 23:29:13 eventyay sshd[7852]: Failed password for invalid user redis from 200.172.91.170 port 41139 ssh2
Jul 14 23:35:16 eventyay sshd[9421]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.172.91.170
...

masters-of-media.de 159.69.77.184 \[14/Jul/2019:23:16:49 +0200\] "POST /wp-login.php HTTP/1.1" 200 5855 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"
masters-of-media.de 159.69.77.184 \[14/Jul/2019:23:16:50 +0200\] "POST /wp-login.php HTTP/1.1" 200 5810 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"
masters-of-media.de 159.69.77.184 \[14/Jul/2019:23:16:50 +0200\] "POST /xmlrpc.php HTTP/1.1" 200 4102 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"

Jul 14 21:17:44 sshgateway sshd\[32767\]: Invalid user ts3srv from 106.75.103.35
Jul 14 21:17:44 sshgateway sshd\[32767\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.75.103.35
Jul 14 21:17:45 sshgateway sshd\[32767\]: Failed password for invalid user ts3srv from 106.75.103.35 port 59638 ssh2

2019-07-14T21:53:24.309228abusebot.cloudsearch.cf sshd\[5989\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.207  user=root

Jul 14 17:30:37 vps200512 sshd\[25033\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=199.195.252.213  user=root
Jul 14 17:30:39 vps200512 sshd\[25033\]: Failed password for root from 199.195.252.213 port 46112 ssh2
Jul 14 17:35:11 vps200512 sshd\[25092\]: Invalid user test from 199.195.252.213
Jul 14 17:35:11 vps200512 sshd\[25092\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=199.195.252.213
Jul 14 17:35:13 vps200512 sshd\[25092\]: Failed password for invalid user test from 199.195.252.213 port 44802 ssh2