\[2019-07-31 19:19:53\] SECURITY\[2326\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-07-31T19:19:53.872-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="4990048422069016",SessionID="0x7ff4d0534f58",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/62.173.154.76/62862",ACLName="no_extension_match"
\[2019-07-31 19:24:18\] SECURITY\[2326\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-07-31T19:24:18.359-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="5000048422069016",SessionID="0x7ff4d00cdaf8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/62.173.154.76/59190",ACLName="no_extension_match"
\[2019-07-31 19:29:28\] SECURITY\[2326\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-07-31T19:29:28.643-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="5010048422069016",SessionID="0x7ff4d00a1b88",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/62.173.154.76/53675",ACLName="no_

\[2019-07-30 19:54:43\] SECURITY\[2326\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-07-30T19:54:43.381-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="1820048422069016",SessionID="0x7ff4d0237d78",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/62.173.154.76/58918",ACLName="no_extension_match"
\[2019-07-30 19:58:24\] SECURITY\[2326\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-07-30T19:58:24.658-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="1830048422069016",SessionID="0x7ff4d0411568",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/62.173.154.76/52330",ACLName="no_extension_match"
\[2019-07-30 20:01:52\] SECURITY\[2326\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-07-30T20:01:52.277-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="1840048422069016",SessionID="0x7ff4d0594458",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/62.173.154.76/62360",ACLName="no_

\[2019-07-29 04:24:49\] SECURITY\[2326\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-07-29T04:24:49.939-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="1950048422069016",SessionID="0x7ff4d0411568",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/62.173.154.76/65071",ACLName="no_extension_match"
\[2019-07-29 04:29:13\] SECURITY\[2326\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-07-29T04:29:13.984-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="1960048422069016",SessionID="0x7ff4d0411568",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/62.173.154.76/53546",ACLName="no_extension_match"
\[2019-07-29 04:34:39\] SECURITY\[2326\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-07-29T04:34:39.566-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="1970048422069016",SessionID="0x7ff4d019b208",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/62.173.154.76/54445",ACLName="no_

Tried our host z.

Tried our host z.

SCAN: Host Sweep CloudCIX Reconnaissance Scan Detected, PTR: www.bgf.vt.

SCAN: Host Sweep CloudCIX Reconnaissance Scan Detected, PTR: www.bgf.vt.

4440/tcp 23/tcp 22/tcp...
[2020-04-23/05-03]8pkt,6pt.(tcp)

" "

[portscan] Port scan

Mar 23 20:27:28 vpn sshd[1485]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.173.154.6
Mar 23 20:27:30 vpn sshd[1485]: Failed password for invalid user ty from 62.173.154.6 port 32832 ssh2
Mar 23 20:32:08 vpn sshd[1514]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.173.154.6

Port scan on 4 port(s): 8094 9080 9083 9084

\[2019-11-30 18:46:24\] NOTICE\[2754\] chan_sip.c: Registration from '"51"\' failed for '62.173.154.81:44487' - Wrong password
\[2019-11-30 18:46:24\] SECURITY\[2765\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-11-30T18:46:24.220-0500",Severity="Error",Service="SIP",EventVersion="2",AccountID="51",SessionID="0x7f26c4ab1d88",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/62.173.154.81/44487",Challenge="264bb77d",ReceivedChallenge="264bb77d",ReceivedHash="b023c244535b8b963f90c6a7b4750cd6"
\[2019-11-30 18:46:36\] NOTICE\[2754\] chan_sip.c: Registration from '"52"\' failed for '62.173.154.81:44491' - Wrong password
\[2019-11-30 18:46:36\] SECURITY\[2765\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-11-30T18:46:36.385-0500",Severity="Error",Service="SIP",EventVersion="2",AccountID="52",SessionID="0x7f26c4740728",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/62.173.15

Fail2Ban Ban Triggered

\[2019-11-30 14:56:29\] NOTICE\[2754\] chan_sip.c: Registration from '"45"\' failed for '62.173.154.81:44438' - Wrong password
\[2019-11-30 14:56:29\] SECURITY\[2765\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-11-30T14:56:29.603-0500",Severity="Error",Service="SIP",EventVersion="2",AccountID="45",SessionID="0x7f26c4276ea8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/62.173.154.81/44438",Challenge="133e5e63",ReceivedChallenge="133e5e63",ReceivedHash="a7eb0e09f9dfa1658be0eca2f1f72627"
\[2019-11-30 14:57:13\] NOTICE\[2754\] chan_sip.c: Registration from '"45"\' failed for '62.173.154.81:44442' - Wrong password
\[2019-11-30 14:57:13\] SECURITY\[2765\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-11-30T14:57:13.915-0500",Severity="Error",Service="SIP",EventVersion="2",AccountID="45",SessionID="0x7f26c4022278",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/62.173.15

\[2019-11-30 06:50:18\] NOTICE\[2754\] chan_sip.c: Registration from '"32"\' failed for '62.173.154.81:44338' - Wrong password
\[2019-11-30 06:50:18\] SECURITY\[2765\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-11-30T06:50:18.583-0500",Severity="Error",Service="SIP",EventVersion="2",AccountID="32",SessionID="0x7f26c4ab1d88",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/62.173.154.81/44338",Challenge="0175dc59",ReceivedChallenge="0175dc59",ReceivedHash="f18a34622b536259767a15f520e6bf6c"
\[2019-11-30 06:51:30\] NOTICE\[2754\] chan_sip.c: Registration from '"33"\' failed for '62.173.154.81:44341' - Wrong password
\[2019-11-30 06:51:30\] SECURITY\[2765\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-11-30T06:51:30.225-0500",Severity="Error",Service="SIP",EventVersion="2",AccountID="33",SessionID="0x7f26c445f668",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/62.173.15

\[2019-11-29 12:56:31\] NOTICE\[2754\] chan_sip.c: Registration from '"6"\' failed for '62.173.154.81:44130' - Wrong password
\[2019-11-29 12:56:31\] SECURITY\[2765\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-11-29T12:56:31.168-0500",Severity="Error",Service="SIP",EventVersion="2",AccountID="6",SessionID="0x7f26c445f668",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/62.173.154.81/44130",Challenge="12c69921",ReceivedChallenge="12c69921",ReceivedHash="e19730bd8ae644885f9162a7c46f1667"
\[2019-11-29 12:57:35\] NOTICE\[2754\] chan_sip.c: Registration from '"7"\' failed for '62.173.154.81:44137' - Wrong password
\[2019-11-29 12:57:35\] SECURITY\[2765\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-11-29T12:57:35.702-0500",Severity="Error",Service="SIP",EventVersion="2",AccountID="7",SessionID="0x7f26c4022278",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/62.173.154.81/4

MultiHost/MultiPort Probe, Scan, Hack -

Autoban   69.94.131.55 AUTH/CONNECT

Dec 23 08:55:15 server sshd\[21682\]: Invalid user guest from 101.4.130.249
Dec 23 08:55:15 server sshd\[21682\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=101.4.130.249 
Dec 23 08:55:18 server sshd\[21682\]: Failed password for invalid user guest from 101.4.130.249 port 48828 ssh2
Dec 23 09:14:49 server sshd\[26624\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=101.4.130.249  user=root
Dec 23 09:14:50 server sshd\[26624\]: Failed password for root from 101.4.130.249 port 38666 ssh2
...

Unauthorized connection attempt detected from IP address 211.75.164.5 to port 445

Dec 23 05:54:12 debian-2gb-nbg1-2 kernel: \[729599.624381\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=92.118.37.99 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=247 ID=39426 PROTO=TCP SPT=57633 DPT=3538 WINDOW=1024 RES=0x00 SYN URGP=0

Dec 22 13:22:27 debian sshd[17584]: Unable to negotiate with 222.186.173.142 port 47808: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1 [preauth]
Dec 23 01:12:34 debian sshd[17543]: Unable to negotiate with 222.186.173.142 port 21260: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1 [preauth]
...

Bruteforce on smtp

Dec 22 19:39:44 php1 sshd\[19950\]: Invalid user diego from 198.211.124.188
Dec 22 19:39:44 php1 sshd\[19950\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=198.211.124.188
Dec 22 19:39:46 php1 sshd\[19950\]: Failed password for invalid user diego from 198.211.124.188 port 50976 ssh2
Dec 22 19:45:19 php1 sshd\[20504\]: Invalid user skagen from 198.211.124.188
Dec 22 19:45:19 php1 sshd\[20504\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=198.211.124.188

167.71.220.148 - - [23/Dec/2019:04:54:33 +0000] "POST /wp/wp-login.php HTTP/1.1" 200 6239 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
167.71.220.148 - - [23/Dec/2019:04:54:39 +0000] "POST /wp/xmlrpc.php HTTP/1.1" 200 403 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
...

Unauthorised access (Dec 23) SRC=117.213.87.82 LEN=52 TTL=110 ID=21156 DF TCP DPT=445 WINDOW=8192 SYN

$f2bV_matches

12/23/2019-00:40:15.308555 92.118.37.86 Protocol: 6 ET SCAN NMAP -sS window 1024

20 attempts against mh-ssh on cloud.magehost.pro

Too many connections or unauthorized access detected from Arctic banned ip

Dec 23 00:56:10 rama sshd[795251]: Address 182.156.209.222 maps to static-222.209.156.182-tataidc.co.in, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!
Dec 23 00:56:10 rama sshd[795251]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.156.209.222  user=ftp
Dec 23 00:56:12 rama sshd[795251]: Failed password for ftp from 182.156.209.222 port 40823 ssh2
Dec 23 00:56:12 rama sshd[795251]: Received disconnect from 182.156.209.222: 11: Bye Bye [preauth]
Dec 23 01:08:23 rama sshd[798093]: Address 182.156.209.222 maps to static-222.209.156.182-tataidc.co.in, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!
Dec 23 01:08:23 rama sshd[798093]: Invalid user test from 182.156.209.222
Dec 23 01:08:23 rama sshd[798093]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.156.209.222 
Dec 23 01:08:26 rama sshd[798093]: Failed password for invalid user test f........
-------------------------------

Dec 23 06:51:30 sd-53420 sshd\[7503\]: Invalid user spark from 51.75.248.241
Dec 23 06:51:30 sd-53420 sshd\[7503\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.248.241
Dec 23 06:51:32 sd-53420 sshd\[7503\]: Failed password for invalid user spark from 51.75.248.241 port 33426 ssh2
Dec 23 06:52:41 sd-53420 sshd\[7934\]: Invalid user spark from 51.75.248.241
Dec 23 06:52:41 sd-53420 sshd\[7934\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.248.241
...