Unauthorized connection attempt detected from IP address 37.49.230.7 to port 81 [T]

 TCP (SYN) 37.49.230.7:50851 -> port 81, len 44

 TCP (SYN) 37.49.230.7:57477 -> port 81, len 44

Jun 14 06:45:06 icecube postfix/smtpd[73690]: lost connection after AUTH from unknown[37.49.230.7]

Jun 12 08:01:54 srv01 postfix/smtpd\[21304\]: warning: unknown\[37.49.230.7\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jun 12 08:02:00 srv01 postfix/smtpd\[21314\]: warning: unknown\[37.49.230.7\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jun 12 08:02:10 srv01 postfix/smtpd\[16406\]: warning: unknown\[37.49.230.7\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jun 12 08:02:32 srv01 postfix/smtpd\[24586\]: warning: unknown\[37.49.230.7\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jun 12 08:02:38 srv01 postfix/smtpd\[21304\]: warning: unknown\[37.49.230.7\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
...

Excessive unauthorized requests: 25,587

Jun  1 22:20:05 mail postfix/smtpd\[24742\]: warning: unknown\[37.49.230.7\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6\
Jun  1 22:20:11 mail postfix/smtpd\[24742\]: warning: unknown\[37.49.230.7\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6\
Jun  1 22:20:21 mail postfix/smtpd\[24742\]: warning: unknown\[37.49.230.7\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6\
Jun  1 22:20:31 mail postfix/smtpd\[24742\]: warning: unknown\[37.49.230.7\]: SASL LOGIN authentication failed: Connection lost to authentication server\

Brute Force attack - banned by Fail2Ban

\[2019-11-23 14:03:56\] SECURITY\[2765\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-11-23T14:03:56.961-0500",Severity="Error",Service="SIP",EventVersion="1",AccountID="01146431313358",SessionID="0x7f26c4a90648",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.230.7/61913",ACLName="no_extension_match"
\[2019-11-23 14:08:24\] SECURITY\[2765\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-11-23T14:08:24.572-0500",Severity="Error",Service="SIP",EventVersion="1",AccountID="901146431313358",SessionID="0x7f26c4ab1d88",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.230.7/62371",ACLName="no_extension_match"
\[2019-11-23 14:12:41\] SECURITY\[2765\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-11-23T14:12:41.537-0500",Severity="Error",Service="SIP",EventVersion="1",AccountID="801146431313358",SessionID="0x7f26c4ab1d88",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.230.7/57872",ACLName="no_extension_

\[2019-11-21 01:22:55\] SECURITY\[2765\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-11-21T01:22:55.916-0500",Severity="Error",Service="SIP",EventVersion="1",AccountID="01146243343019",SessionID="0x7f26c4ab1d88",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.230.7/60388",ACLName="no_extension_match"
\[2019-11-21 01:25:58\] SECURITY\[2765\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-11-21T01:25:58.792-0500",Severity="Error",Service="SIP",EventVersion="1",AccountID="901146243343019",SessionID="0x7f26c4364308",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.230.7/53201",ACLName="no_extension_match"
\[2019-11-21 01:29:03\] SECURITY\[2765\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-11-21T01:29:03.554-0500",Severity="Error",Service="SIP",EventVersion="1",AccountID="801146243343019",SessionID="0x7f26c4ab1d88",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.230.7/60709",ACLName="no_extension_

\[2019-11-04 14:11:43\] SECURITY\[2634\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-11-04T14:11:43.835-0500",Severity="Error",Service="SIP",EventVersion="1",AccountID="01146462607521",SessionID="0x7fdf2c172a48",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.230.7/65125",ACLName="no_extension_match"
\[2019-11-04 14:15:48\] SECURITY\[2634\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-11-04T14:15:48.825-0500",Severity="Error",Service="SIP",EventVersion="1",AccountID="901146462607521",SessionID="0x7fdf2c3e3e58",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.230.7/51428",ACLName="no_extension_match"
\[2019-11-04 14:19:50\] SECURITY\[2634\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-11-04T14:19:50.031-0500",Severity="Error",Service="SIP",EventVersion="1",AccountID="801146462607521",SessionID="0x7fdf2c56f048",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.230.7/52230",ACLName="no_extension_

Bible

2020-10-13T06:44:21.356144news0 auth[956]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=admin rhost=37.49.230.238
2020-10-13T06:44:25.395781news0 dovecot[21131]: pop3-login: Aborted login (auth failed, 1 attempts in 4 secs): user=, method=PLAIN, rip=37.49.230.238, lip=95.111.246.42, session=
2020-10-13T06:44:28.401407news0 auth[956]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=admin rhost=37.49.230.238
...

2020-10-13T06:44:21.356144news0 auth[956]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=admin rhost=37.49.230.238
2020-10-13T06:44:25.395781news0 dovecot[21131]: pop3-login: Aborted login (auth failed, 1 attempts in 4 secs): user=, method=PLAIN, rip=37.49.230.238, lip=95.111.246.42, session=
2020-10-13T06:44:28.401407news0 auth[956]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=admin rhost=37.49.230.238
...

Dovecot Invalid User Login Attempt.

"AmooT";tag=3533393765393339313363340132313832313335333935

\[2020-10-02 15:01:13\] SECURITY\[6939\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-10-02T15:01:13.624+0200",Severity="Error",Service="SIP",EventVersion="2",AccountID="100",SessionID="0x7f0ffea08d88",LocalAddress="IPV4/UDP/204.8.216.89/5060",RemoteAddress="IPV4/UDP/37.49.230.126/5862",Challenge="096f171f",ReceivedChallenge="096f171f",ReceivedHash="b099bdfad5869da4ae2114a56a2b4299"
\[2020-10-02 15:01:13\] SECURITY\[6939\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-10-02T15:01:13.759+0200",Severity="Error",Service="SIP",EventVersion="2",AccountID="100",SessionID="0x7f0ffeab8148",LocalAddress="IPV4/UDP/204.8.216.89/5060",RemoteAddress="IPV4/UDP/37.49.230.126/5862",Challenge="233a417c",ReceivedChallenge="233a417c",ReceivedHash="0017581d14759d4b5ad3a404ed924131"
\[2020-10-02 15:01:13\] SECURITY\[6939\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-10-02T15:01:13.783+0200",Severity="Error",Service="SIP",EventVersion="2",Accoun
...

\[2020-10-02 15:01:13\] SECURITY\[6939\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-10-02T15:01:13.624+0200",Severity="Error",Service="SIP",EventVersion="2",AccountID="100",SessionID="0x7f0ffea08d88",LocalAddress="IPV4/UDP/204.8.216.89/5060",RemoteAddress="IPV4/UDP/37.49.230.126/5862",Challenge="096f171f",ReceivedChallenge="096f171f",ReceivedHash="b099bdfad5869da4ae2114a56a2b4299"
\[2020-10-02 15:01:13\] SECURITY\[6939\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-10-02T15:01:13.759+0200",Severity="Error",Service="SIP",EventVersion="2",AccountID="100",SessionID="0x7f0ffeab8148",LocalAddress="IPV4/UDP/204.8.216.89/5060",RemoteAddress="IPV4/UDP/37.49.230.126/5862",Challenge="233a417c",ReceivedChallenge="233a417c",ReceivedHash="0017581d14759d4b5ad3a404ed924131"
\[2020-10-02 15:01:13\] SECURITY\[6939\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-10-02T15:01:13.783+0200",Severity="Error",Service="SIP",EventVersion="2",Accoun
...

[N1.H1.VM1] Port Scanner Detected Blocked by UFW

SIP Server BruteForce Attack

[2020-09-30 18:00:12] NOTICE[1159][C-0000421d] chan_sip.c: Call from '' (37.49.230.201:64644) to extension '12526890745' rejected because extension not found in context 'public'.
[2020-09-30 18:00:12] SECURITY[1198] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-09-30T18:00:12.866-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="12526890745",SessionID="0x7fcaa045f8f8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.230.201/64644",ACLName="no_extension_match"
[2020-09-30 18:00:26] NOTICE[1159][C-0000421f] chan_sip.c: Call from '' (37.49.230.201:57391) to extension '712526890745' rejected because extension not found in context 'public'.
[2020-09-30 18:00:26] SECURITY[1198] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-09-30T18:00:26.237-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="712526890745",SessionID="0x7fcaa04d8d08",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.230.201/
...

[2020-09-30 18:00:12] NOTICE[1159][C-0000421d] chan_sip.c: Call from '' (37.49.230.201:64644) to extension '12526890745' rejected because extension not found in context 'public'.
[2020-09-30 18:00:12] SECURITY[1198] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-09-30T18:00:12.866-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="12526890745",SessionID="0x7fcaa045f8f8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.230.201/64644",ACLName="no_extension_match"
[2020-09-30 18:00:26] NOTICE[1159][C-0000421f] chan_sip.c: Call from '' (37.49.230.201:57391) to extension '712526890745' rejected because extension not found in context 'public'.
[2020-09-30 18:00:26] SECURITY[1198] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-09-30T18:00:26.237-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="712526890745",SessionID="0x7fcaa04d8d08",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.230.201/
...

[2020-09-30 18:00:12] NOTICE[1159][C-0000421d] chan_sip.c: Call from '' (37.49.230.201:64644) to extension '12526890745' rejected because extension not found in context 'public'.
[2020-09-30 18:00:12] SECURITY[1198] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-09-30T18:00:12.866-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="12526890745",SessionID="0x7fcaa045f8f8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.230.201/64644",ACLName="no_extension_match"
[2020-09-30 18:00:26] NOTICE[1159][C-0000421f] chan_sip.c: Call from '' (37.49.230.201:57391) to extension '712526890745' rejected because extension not found in context 'public'.
[2020-09-30 18:00:26] SECURITY[1198] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-09-30T18:00:26.237-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="712526890745",SessionID="0x7fcaa04d8d08",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.230.201/
...

Hellooo

Hellooo

Sep 28 15:49:19 : SSH login attempts with invalid user

k+ssh-bruteforce

SSH/22 MH Probe, BF, Hack -

SSH/22 MH Probe, BF, Hack -

Aug 26 22:51:26 inter-technics sshd[23185]: Invalid user chandra from 145.239.82.174 port 33290
Aug 26 22:51:27 inter-technics sshd[23185]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=145.239.82.174
Aug 26 22:51:26 inter-technics sshd[23185]: Invalid user chandra from 145.239.82.174 port 33290
Aug 26 22:51:28 inter-technics sshd[23185]: Failed password for invalid user chandra from 145.239.82.174 port 33290 ssh2
Aug 26 22:55:18 inter-technics sshd[23440]: Invalid user Joshua from 145.239.82.174 port 43756
...

Aug 26 19:12:18 dev0-dcde-rnet sshd[30779]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.77.171.127
Aug 26 19:12:20 dev0-dcde-rnet sshd[30779]: Failed password for invalid user lpadmin from 45.77.171.127 port 58274 ssh2
Aug 26 19:14:29 dev0-dcde-rnet sshd[30789]: Failed password for root from 45.77.171.127 port 59688 ssh2

167.172.186.32 - - \[26/Aug/2020:14:32:15 +0200\] "POST /wp-login.php HTTP/1.0" 200 5615 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"
167.172.186.32 - - \[26/Aug/2020:14:32:16 +0200\] "POST /wp-login.php HTTP/1.0" 200 5435 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"
167.172.186.32 - - \[26/Aug/2020:14:32:17 +0200\] "POST /wp-login.php HTTP/1.0" 200 5428 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"

Forbidden directory scan :: 2020/08/26 12:32:24 [error] 1010#1010: *555923 access forbidden by rule, client: 5.62.61.106, server: [censored_1], request: "GET /.git//index HTTP/1.1", host: "www.[censored_1]"

2020-08-26T16:32:08.7424991495-001 sshd[27410]: Invalid user console from 123.30.149.76 port 46047
2020-08-26T16:32:10.6338301495-001 sshd[27410]: Failed password for invalid user console from 123.30.149.76 port 46047 ssh2
2020-08-26T16:33:22.1725901495-001 sshd[27483]: Invalid user samba from 123.30.149.76 port 54760
2020-08-26T16:33:22.1759531495-001 sshd[27483]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.30.149.76
2020-08-26T16:33:22.1725901495-001 sshd[27483]: Invalid user samba from 123.30.149.76 port 54760
2020-08-26T16:33:23.8881361495-001 sshd[27483]: Failed password for invalid user samba from 123.30.149.76 port 54760 ssh2
...

SSH/22 MH Probe, BF, Hack -

 TCP (SYN) 192.35.169.44:57562 -> port 9027, len 44

Aug 26 22:00:11 marvibiene sshd[17531]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=150.109.99.68 
Aug 26 22:00:13 marvibiene sshd[17531]: Failed password for invalid user recepcja from 150.109.99.68 port 39076 ssh2

*Port Scan* detected from 51.159.88.179 (FR/France/Île-de-France/Villiers-sur-Marne/51-159-88-179.rev.poneytelecom.eu). 4 hits in the last 70 seconds

1598445155 - 08/26/2020 14:32:35 Host: 220.132.243.135/220.132.243.135 Port: 23 TCP Blocked
...

Aug 26 12:03:42 firewall sshd[8575]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.123.163.106
Aug 26 12:03:42 firewall sshd[8575]: Invalid user abc from 37.123.163.106
Aug 26 12:03:43 firewall sshd[8575]: Failed password for invalid user abc from 37.123.163.106 port 40760 ssh2
...

2020-08-26T13:13:56.441872abusebot-7.cloudsearch.cf sshd[31729]: Invalid user ubnt from 45.124.86.155 port 47620
2020-08-26T13:13:56.445940abusebot-7.cloudsearch.cf sshd[31729]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.124.86.155
2020-08-26T13:13:56.441872abusebot-7.cloudsearch.cf sshd[31729]: Invalid user ubnt from 45.124.86.155 port 47620
2020-08-26T13:13:58.567361abusebot-7.cloudsearch.cf sshd[31729]: Failed password for invalid user ubnt from 45.124.86.155 port 47620 ssh2
2020-08-26T13:23:25.575329abusebot-7.cloudsearch.cf sshd[31857]: Invalid user user from 45.124.86.155 port 52808
2020-08-26T13:23:25.579033abusebot-7.cloudsearch.cf sshd[31857]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.124.86.155
2020-08-26T13:23:25.575329abusebot-7.cloudsearch.cf sshd[31857]: Invalid user user from 45.124.86.155 port 52808
2020-08-26T13:23:27.143875abusebot-7.cloudsearch.cf sshd[31857]: Failed pass
...