Port scanning [2 denied]

\[Jun 12 22:07:24\] NOTICE\[2019\] chan_sip.c: Registration from '"110" \' failed for '51.75.146.114:6445' - Wrong password
\[Jun 12 22:07:24\] NOTICE\[2019\] chan_sip.c: Registration from '"110" \' failed for '51.75.146.114:6445' - Wrong password
\[Jun 12 22:07:24\] NOTICE\[2019\] chan_sip.c: Registration from '"110" \' failed for '51.75.146.114:6445' - Wrong password
\[Jun 12 22:07:24\] NOTICE\[2019\] chan_sip.c: Registration from '"110" \' failed for '51.75.146.114:6445' - Wrong password
\[Jun 12 22:07:24\] NOTICE\[2019\] chan_sip.c: Registration from '"110" \' failed for '51.75.146.114:6445' - Wrong password
\[Jun 12 22:07:24\] NOTICE\[2019\] chan_sip.c: Registration from '"110" \' failed for '51.75.146.114:6445' - Wrong password
\[Jun 12 22:07:24\] NOTICE\[2019\] chan_sip.c: Registration from '"110" \

VoIP Brute Force - 51.75.146.114 - Auto Report
...

Trying ports that it shouldn't be.

Automatic report - Port Scan Attack

MultiHost/MultiPort Probe, Scan, Hack -

Dec 20 16:06:17 localhost sshd[32594]: Failed password for invalid user ftpuser from 51.75.146.122 port 49202 ssh2
Dec 20 16:13:42 localhost sshd[32996]: Failed password for invalid user guest from 51.75.146.122 port 55970 ssh2
Dec 20 16:18:37 localhost sshd[33181]: Failed password for invalid user sirianne from 51.75.146.122 port 36220 ssh2

Nov  7 08:11:11 SilenceServices sshd[11144]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.146.122
Nov  7 08:11:13 SilenceServices sshd[11144]: Failed password for invalid user ckutp from 51.75.146.122 port 48336 ssh2
Nov  7 08:19:07 SilenceServices sshd[13489]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.146.122

Nov  3 15:49:19 markkoudstaal sshd[13263]: Failed password for root from 51.75.146.38 port 58880 ssh2
Nov  3 15:53:01 markkoudstaal sshd[13631]: Failed password for root from 51.75.146.38 port 45988 ssh2

2019-10-20T11:52:17.276005ns525875 sshd\[29179\]: Invalid user yyyy from 51.75.146.177 port 44962
2019-10-20T11:52:17.282434ns525875 sshd\[29179\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ns3133740.ip-51-75-146.eu
2019-10-20T11:52:19.732018ns525875 sshd\[29179\]: Failed password for invalid user yyyy from 51.75.146.177 port 44962 ssh2
2019-10-20T11:56:00.043187ns525875 sshd\[1167\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ns3133740.ip-51-75-146.eu  user=root
2019-10-20T11:56:01.839620ns525875 sshd\[1167\]: Failed password for root from 51.75.146.177 port 57918 ssh2
2019-10-20T11:59:44.756991ns525875 sshd\[5805\]: Invalid user odroid from 51.75.146.177 port 43230
2019-10-20T11:59:44.758806ns525875 sshd\[5805\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ns3133740.ip-51-75-146.eu
2019-10-20T11:59:45.972744ns525875 sshd\[5805\]: Failed passw
...

Oct 22 06:51:21 * sshd[31347]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.146.177
Oct 22 06:51:24 * sshd[31347]: Failed password for invalid user gerald from 51.75.146.177 port 41514 ssh2

Oct 21 02:51:22 php1 sshd\[29405\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.146.177  user=root
Oct 21 02:51:25 php1 sshd\[29405\]: Failed password for root from 51.75.146.177 port 58022 ssh2
Oct 21 02:55:36 php1 sshd\[29735\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.146.177  user=root
Oct 21 02:55:37 php1 sshd\[29735\]: Failed password for root from 51.75.146.177 port 37834 ssh2
Oct 21 02:59:50 php1 sshd\[30072\]: Invalid user oracle from 51.75.146.177

Sep 21 19:46:23 ny01 sshd[22355]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.146.122
Sep 21 19:46:25 ny01 sshd[22355]: Failed password for invalid user duchon from 51.75.146.122 port 58502 ssh2
Sep 21 19:50:16 ny01 sshd[23055]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.146.122

Sep 15 08:52:01 saschabauer sshd[28848]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.146.122
Sep 15 08:52:03 saschabauer sshd[28848]: Failed password for invalid user admin from 51.75.146.122 port 54290 ssh2

Sep 10 03:44:11 SilenceServices sshd[2701]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.146.122
Sep 10 03:44:13 SilenceServices sshd[2701]: Failed password for invalid user guest from 51.75.146.122 port 48188 ssh2
Sep 10 03:49:26 SilenceServices sshd[7084]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.146.122

Aug 31 19:39:50 vps200512 sshd\[5624\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.146.122  user=root
Aug 31 19:39:51 vps200512 sshd\[5624\]: Failed password for root from 51.75.146.122 port 32986 ssh2
Aug 31 19:43:30 vps200512 sshd\[5746\]: Invalid user victoire from 51.75.146.122
Aug 31 19:43:30 vps200512 sshd\[5746\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.146.122
Aug 31 19:43:32 vps200512 sshd\[5746\]: Failed password for invalid user victoire from 51.75.146.122 port 47658 ssh2

Aug 27 15:57:14 SilenceServices sshd[32234]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.146.122
Aug 27 15:57:16 SilenceServices sshd[32234]: Failed password for invalid user test from 51.75.146.122 port 41868 ssh2
Aug 27 16:01:28 SilenceServices sshd[1460]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.146.122

Invalid user manager from 51.75.146.122 port 54162

SSH authentication failure x 6 reported by Fail2Ban
...

Aug 12 08:12:13 aat-srv002 sshd[9458]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.146.122
Aug 12 08:12:14 aat-srv002 sshd[9458]: Failed password for invalid user account from 51.75.146.122 port 54118 ssh2
Aug 12 08:16:25 aat-srv002 sshd[9616]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.146.122
Aug 12 08:16:26 aat-srv002 sshd[9616]: Failed password for invalid user slb from 51.75.146.122 port 39018 ssh2
...

Aug 11 15:22:33 OPSO sshd\[28981\]: Invalid user sql from 51.75.146.122 port 46964
Aug 11 15:22:33 OPSO sshd\[28981\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.146.122
Aug 11 15:22:35 OPSO sshd\[28981\]: Failed password for invalid user sql from 51.75.146.122 port 46964 ssh2
Aug 11 15:26:45 OPSO sshd\[29734\]: Invalid user max from 51.75.146.122 port 42266
Aug 11 15:26:45 OPSO sshd\[29734\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.146.122

Nov  2 08:20:15 server sshd\[5617\]: User root from 122.176.77.79 not allowed because listed in DenyUsers
Nov  2 08:20:15 server sshd\[5617\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.176.77.79  user=root
Nov  2 08:20:17 server sshd\[5617\]: Failed password for invalid user root from 122.176.77.79 port 14342 ssh2
Nov  2 08:25:33 server sshd\[7278\]: User root from 122.176.77.79 not allowed because listed in DenyUsers
Nov  2 08:25:33 server sshd\[7278\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.176.77.79  user=root

Nov  1 17:42:31 auw2 sshd\[21895\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.254.45.10  user=root
Nov  1 17:42:33 auw2 sshd\[21895\]: Failed password for root from 43.254.45.10 port 34960 ssh2
Nov  1 17:47:12 auw2 sshd\[22258\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.254.45.10  user=root
Nov  1 17:47:15 auw2 sshd\[22258\]: Failed password for root from 43.254.45.10 port 44094 ssh2
Nov  1 17:52:16 auw2 sshd\[22719\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.254.45.10  user=root

Nov  2 06:43:45 host sshd[59774]: Invalid user pi from 78.225.3.244 port 42406
...

3389BruteforceFW23

SASL broute force

Invalid user cmveng from 149.56.44.101 port 45510

\[2019-11-02 00:13:27\] NOTICE\[2601\] chan_sip.c: Registration from '"888" \' failed for '45.143.221.15:5684' - Wrong password
\[2019-11-02 00:13:27\] SECURITY\[2634\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-11-02T00:13:27.348-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="888",SessionID="0x7fdf2cd1cd48",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/45.143.221.15/5684",Challenge="0c2dc7bd",ReceivedChallenge="0c2dc7bd",ReceivedHash="849fe883c5c229cb3b47f3666d35bd21"
\[2019-11-02 00:13:27\] NOTICE\[2601\] chan_sip.c: Registration from '"888" \' failed for '45.143.221.15:5684' - Wrong password
\[2019-11-02 00:13:27\] SECURITY\[2634\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-11-02T00:13:27.478-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="888",SessionID="0x7fdf2c1392a8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/45.1

Lines containing failures of 93.157.63.60
Nov  2 03:26:31 expertgeeks postfix/smtpd[22256]: connect from dfg.londonmarketwatch.com[93.157.63.60]
Nov  2 03:26:31 expertgeeks postfix/smtpd[22256]: Anonymous TLS connection established from dfg.londonmarketwatch.com[93.157.63.60]: TLSv1 whostnameh cipher ECDHE-RSA-AES256-SHA (256/256 bhostnames)
Nov x@x
Nov  2 03:26:32 expertgeeks postfix/smtpd[22256]: disconnect from dfg.londonmarketwatch.com[93.157.63.60] ehlo=2 starttls=1 mail=1 rcpt=0/1 quhostname=1 commands=5/6
Nov  2 03:37:21 expertgeeks postfix/smtpd[23321]: connect from dfg.londonmarketwatch.com[93.157.63.60]
Nov  2 03:37:21 expertgeeks postfix/smtpd[23321]: Anonymous TLS connection established from dfg.londonmarketwatch.com[93.157.63.60]: TLSv1 whostnameh cipher ECDHE-RSA-AES256-SHA (256/256 bhostnames)
Nov x@x
Nov  2 03:37:22 expertgeeks postfix/smtpd[23321]: disconnect from dfg.londonmarketwatch.com[93.157.63.60] ehlo=2 starttls=1 mail=1 rcpt=0/1 quhostname=1 comm........
------------------------------

Automatic report - Port Scan

Nov  2 04:35:13 xzibhostname postfix/smtpd[4875]: warning: hostname host-41.43.125.185.tedata.net does not resolve to address 41.43.125.185: Name or service not known
Nov  2 04:35:13 xzibhostname postfix/smtpd[4875]: connect from unknown[41.43.125.185]
Nov  2 04:35:14 xzibhostname postfix/smtpd[4876]: warning: hostname host-41.43.125.185.tedata.net does not resolve to address 41.43.125.185: Name or service not known
Nov  2 04:35:14 xzibhostname postfix/smtpd[4876]: connect from unknown[41.43.125.185]
Nov  2 04:36:01 xzibhostname postfix/smtpd[4876]: lost connection after CONNECT from unknown[41.43.125.185]
Nov  2 04:36:01 xzibhostname postfix/smtpd[4876]: disconnect from unknown[41.43.125.185]
Nov  2 04:36:01 xzibhostname postfix/smtpd[4875]: SSL_accept error from unknown[41.43.125.185]: lost connection
Nov  2 04:36:01 xzibhostname postfix/smtpd[4875]: lost connection after CONNECT from unknown[41.43.125.185]
Nov  2 04:36:01 xzibhostname postfix/smtpd[4875]: disconnect ........
-------------------------------

TCP Port Scanning

Nov  2 01:57:54 web1 postfix/smtpd[30566]: warning: unknown[45.227.253.140]: SASL LOGIN authentication failed: authentication failure
...

Automatic report - Banned IP Access

Nov  1 19:10:21 hanapaa sshd\[3376\]: Invalid user project1234 from 106.13.146.210
Nov  1 19:10:21 hanapaa sshd\[3376\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.146.210
Nov  1 19:10:23 hanapaa sshd\[3376\]: Failed password for invalid user project1234 from 106.13.146.210 port 44488 ssh2
Nov  1 19:16:39 hanapaa sshd\[4058\]: Invalid user admin75g from 106.13.146.210
Nov  1 19:16:39 hanapaa sshd\[4058\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.146.210

Invalid user prueba from 220.248.17.34 port 53763