2020-02-19T00:19:18.463055+01:00 lumpi kernel: [7357790.238387] INPUT:DROP:SPAMHAUS_EDROP:IN=eth0 OUT= MAC=52:54:a2:01:a5:04:d2:74:7f:6e:37:e3:08:00 SRC=81.22.45.133 DST=78.46.199.189 LEN=40 TOS=0x00 PREC=0x00 TTL=243 ID=60679 PROTO=TCP SPT=50449 DPT=7000 WINDOW=1024 RES=0x00 SYN URGP=0 
...

2020-02-18T20:40:14.685548+01:00 lumpi kernel: [7344646.660249] INPUT:DROP:SPAMHAUS_EDROP:IN=eth0 OUT= MAC=52:54:a2:01:a5:04:d2:74:7f:6e:37:e3:08:00 SRC=81.22.45.133 DST=78.46.199.189 LEN=40 TOS=0x00 PREC=0x00 TTL=243 ID=12495 PROTO=TCP SPT=50449 DPT=7777 WINDOW=1024 RES=0x00 SYN URGP=0 
...

ET CINS Active Threat Intelligence Poor Reputation IP group 79 - port: 37165 proto: TCP cat: Misc Attack

2019-12-28T10:27:28.785940+01:00 lumpi kernel: [2815165.492664] INPUT:DROP:SPAMHAUS_EDROP:IN=eth0 OUT= MAC=52:54:a2:01:a5:04:d2:74:7f:6e:37:e3:08:00 SRC=81.22.45.133 DST=78.46.199.189 LEN=40 TOS=0x00 PREC=0x00 TTL=243 ID=19715 PROTO=TCP SPT=49223 DPT=3366 WINDOW=1024 RES=0x00 SYN URGP=0 
...

SNORT TCP  Port: 3389 Classtype misc-attack - ET CINS Active Threat Intelligence Poor Reputation IP group 78 - - Destination xx.xx.4.1 Port: 3389 - - Source 81.22.45.133 Port: 41389   (Listed on  zen-spamhaus MailSpike (spam wave plus L3-L5))     (417)

TCP 3389 (RDP)

2019-12-10T22:34:41.964859+01:00 lumpi kernel: [1303627.064751] INPUT:DROP:SPAMHAUS_EDROP:IN=eth0 OUT= MAC=52:54:a2:01:a5:04:d2:74:7f:6e:37:e3:08:00 SRC=81.22.45.133 DST=78.46.199.189 LEN=40 TOS=0x00 PREC=0x00 TTL=243 ID=10483 PROTO=TCP SPT=48875 DPT=3391 WINDOW=1024 RES=0x00 SYN URGP=0 
...

Portscan or hack attempt detected by psad/fwsnort

12/01/2019-02:11:46.245188 81.22.45.133 Protocol: 6 ET DROP Dshield Block Listed Source group 1

11/28/2019-14:22:12.665508 81.22.45.133 Protocol: 6 ET DROP Dshield Block Listed Source group 1

11/28/2019-06:11:50.177464 81.22.45.133 Protocol: 6 ET SCAN NMAP -sS window 1024

ET CINS Active Threat Intelligence Poor Reputation IP group 74 - port: 3389 proto: TCP cat: Misc Attack

2019-11-17T10:18:56.128451+01:00 lumpi kernel: [3804707.295394] INPUT:DROP:SPAMHAUS_EDROP:IN=eth0 OUT= MAC=52:54:a2:01:a5:04:d2:74:7f:6e:37:e3:08:00 SRC=81.22.45.133 DST=172.31.1.100 LEN=40 TOS=0x00 PREC=0x00 TTL=244 ID=5432 PROTO=TCP SPT=59832 DPT=3943 WINDOW=1024 RES=0x00 SYN URGP=0 
...

11/15/2019-03:09:03.998147 81.22.45.133 Protocol: 6 ET DROP Dshield Block Listed Source group 1

firewall-block, port(s): 3391/tcp, 3394/tcp, 3399/tcp

MultiHost/MultiPort Probe, Scan, Hack -

11/07/2019-13:06:59.417963 81.22.45.133 Protocol: 6 ET DROP Dshield Block Listed Source group 1

11/06/2019-20:55:22.318406 81.22.45.133 Protocol: 6 ET DROP Dshield Block Listed Source group 1

ET CINS Active Threat Intelligence Poor Reputation IP group 75 - port: 3389 proto: TCP cat: Misc Attack

firewall-block, port(s): 1000/tcp, 2222/tcp, 3000/tcp, 3389/tcp, 3391/tcp, 3398/tcp

Port scan: Attack repeated for 24 hours

Portscan or hack attempt detected by psad/fwsnort

2019-10-30T06:00:32.008051+01:00 lumpi kernel: [2234024.653716] INPUT:DROP:SPAMHAUS_EDROP:IN=eth0 OUT= MAC=52:54:a2:01:a5:04:d2:74:7f:6e:37:e3:08:00 SRC=81.22.45.133 DST=172.31.1.100 LEN=40 TOS=0x00 PREC=0x00 TTL=244 ID=34631 PROTO=TCP SPT=44062 DPT=6000 WINDOW=1024 RES=0x00 SYN URGP=0 
...

10/27/2019-19:34:07.045779 81.22.45.133 Protocol: 6 ET DROP Dshield Block Listed Source group 1

Unauthorized connection attempt from IP address 81.22.45.133 on Port 3389(RDP)

firewall-block, port(s): 33390/tcp, 33399/tcp

2019-10-16T03:06:07.033937+02:00 lumpi kernel: [1010376.440593] INPUT:DROP:SPAMHAUS_EDROP:IN=eth0 OUT= MAC=52:54:a2:01:a5:04:d2:74:7f:6e:37:e3:08:00 SRC=81.22.45.133 DST=172.31.1.100 LEN=40 TOS=0x00 PREC=0x00 TTL=244 ID=29618 PROTO=TCP SPT=49558 DPT=4000 WINDOW=1024 RES=0x00 SYN URGP=0 
...

2019-10-14T14:06:44.581750+02:00 lumpi kernel: [877215.831007] INPUT:DROP:SPAMHAUS_EDROP:IN=eth0 OUT= MAC=52:54:a2:01:a5:04:d2:74:7f:6e:37:e3:08:00 SRC=81.22.45.133 DST=172.31.1.100 LEN=40 TOS=0x00 PREC=0x00 TTL=244 ID=37817 PROTO=TCP SPT=49558 DPT=5000 WINDOW=1024 RES=0x00 SYN URGP=0 
...

MultiHost/MultiPort Probe, Scan, Hack -

10/07/2019-20:16:25.998415 81.22.45.133 Protocol: 6 ET DROP Dshield Block Listed Source group 1

suspicious action Sat, 29 Feb 2020 11:28:01 -0300

02/17/2020-20:00:28.393431 81.22.45.106 Protocol: 6 ET CINS Active Threat Intelligence Poor Reputation IP group 83

ET CINS Active Threat Intelligence Poor Reputation IP group 69 - port: 5322 proto: TCP cat: Misc Attack

Fail2Ban Ban Triggered

MultiHost/MultiPort Probe, Scan, Hack -

Feb  8 10:02:23 mail kernel: [562000.917378] [UFW BLOCK] IN=eth0 OUT= MAC=00:16:3c:05:0d:89:f8:66:f2:68:66:ff:08:00 SRC=81.22.45.182 DST=77.73.69.240 LEN=40 TOS=0x00 PREC=0x00 TTL=250 ID=56258 PROTO=TCP SPT=42357 DPT=16115 WINDOW=1024 RES=0x00 SYN URGP=0 
...

ET CINS Active Threat Intelligence Poor Reputation IP group 77 - port: 3389 proto: TCP cat: Misc Attack

3388/tcp 3377/tcp 3385/tcp...
[2019-12-09/2020-02-07]121pkt,33pt.(tcp)

Unauthorized connection attempt from IP address 81.22.45.83 on Port 3389(RDP)

Feb  6 17:32:05 mail kernel: [416183.709828] [UFW BLOCK] IN=eth0 OUT= MAC=00:16:3c:05:0d:89:f8:66:f2:68:66:ff:08:00 SRC=81.22.45.182 DST=77.73.69.240 LEN=40 TOS=0x00 PREC=0x00 TTL=249 ID=30608 PROTO=TCP SPT=50336 DPT=10904 WINDOW=1024 RES=0x00 SYN URGP=0 
...

Feb  6 08:44:36 mail kernel: [384534.949997] [UFW BLOCK] IN=eth0 OUT= MAC=00:16:3c:05:0d:89:f8:66:f2:68:66:ff:08:00 SRC=81.22.45.182 DST=77.73.69.240 LEN=40 TOS=0x00 PREC=0x00 TTL=250 ID=55760 PROTO=TCP SPT=50336 DPT=10994 WINDOW=1024 RES=0x00 SYN URGP=0 
...

Unauthorised access (Feb  6) SRC=81.22.45.104 LEN=40 TTL=249 ID=41689 TCP DPT=3389 WINDOW=1024 SYN 
Unauthorised access (Feb  4) SRC=81.22.45.104 LEN=40 TTL=249 ID=63055 TCP DPT=3389 WINDOW=1024 SYN 
Unauthorised access (Feb  2) SRC=81.22.45.104 LEN=40 TTL=248 ID=40974 TCP DPT=3389 WINDOW=1024 SYN

Feb  6 01:19:32 mail kernel: [357831.266667] [UFW BLOCK] IN=eth0 OUT= MAC=00:16:3c:05:0d:89:f8:66:f2:68:66:ff:08:00 SRC=81.22.45.182 DST=77.73.69.240 LEN=40 TOS=0x00 PREC=0x00 TTL=249 ID=40878 PROTO=TCP SPT=50336 DPT=10137 WINDOW=1024 RES=0x00 SYN URGP=0 
...

2020-02-05T16:27:24.910370+01:00 lumpi kernel: [6206298.189738] INPUT:DROP:SPAMHAUS_EDROP:IN=eth0 OUT= MAC=52:54:a2:01:a5:04:d2:74:7f:6e:37:e3:08:00 SRC=81.22.45.85 DST=78.46.199.189 LEN=40 TOS=0x00 PREC=0x00 TTL=244 ID=19368 PROTO=TCP SPT=47987 DPT=43389 WINDOW=1024 RES=0x00 SYN URGP=0 
...

Feb  4 15:52:28 mail kernel: [237408.614381] [UFW BLOCK] IN=eth0 OUT= MAC=00:16:3c:05:0d:89:f8:66:f2:68:66:ff:08:00 SRC=81.22.45.182 DST=77.73.69.240 LEN=40 TOS=0x00 PREC=0x00 TTL=249 ID=57208 PROTO=TCP SPT=50336 DPT=10897 WINDOW=1024 RES=0x00 SYN URGP=0 
...

Dec 23 16:36:08 lnxweb61 sshd[7349]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.220.85.26

Dec 23 20:41:26 MK-Soft-VM7 sshd[1506]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.32.230 
Dec 23 20:41:29 MK-Soft-VM7 sshd[1506]: Failed password for invalid user ambelang from 51.38.32.230 port 37408 ssh2
...

445/tcp 445/tcp 445/tcp...
[2019-10-26/12-22]29pkt,1pt.(tcp)

Dec 23 10:55:47 ny01 sshd[26744]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.77.140.36
Dec 23 10:55:49 ny01 sshd[26744]: Failed password for invalid user callyann from 51.77.140.36 port 46648 ssh2
Dec 23 11:00:50 ny01 sshd[27440]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.77.140.36

23/tcp 23/tcp 23/tcp...
[2019-11-12/12-22]11pkt,1pt.(tcp)

445/tcp 1433/tcp...
[2019-10-27/12-22]12pkt,2pt.(tcp)

Apr 20 01:20:52 yesfletchmain sshd\[18927\]: Invalid user ahmed from 129.204.15.159 port 40018
Apr 20 01:20:53 yesfletchmain sshd\[18927\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.204.15.159
Apr 20 01:20:55 yesfletchmain sshd\[18927\]: Failed password for invalid user ahmed from 129.204.15.159 port 40018 ssh2
Apr 20 01:23:46 yesfletchmain sshd\[18959\]: Invalid user tadpole from 129.204.15.159 port 38292
Apr 20 01:23:46 yesfletchmain sshd\[18959\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.204.15.159
...

2019-12-23T20:09:17.428307shield sshd\[31992\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.88.112.70  user=root
2019-12-23T20:09:19.613272shield sshd\[31992\]: Failed password for root from 49.88.112.70 port 62137 ssh2
2019-12-23T20:09:21.959559shield sshd\[31992\]: Failed password for root from 49.88.112.70 port 62137 ssh2
2019-12-23T20:09:24.386152shield sshd\[31992\]: Failed password for root from 49.88.112.70 port 62137 ssh2
2019-12-23T20:11:20.792933shield sshd\[32361\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.88.112.70  user=root

2019-12-23T18:33:35.307150abusebot-8.cloudsearch.cf sshd[10825]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.237.25.99  user=root
2019-12-23T18:33:37.548268abusebot-8.cloudsearch.cf sshd[10825]: Failed password for root from 212.237.25.99 port 53168 ssh2
2019-12-23T18:33:40.088595abusebot-8.cloudsearch.cf sshd[10827]: Invalid user admin from 212.237.25.99 port 58404
2019-12-23T18:33:40.096291abusebot-8.cloudsearch.cf sshd[10827]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.237.25.99
2019-12-23T18:33:40.088595abusebot-8.cloudsearch.cf sshd[10827]: Invalid user admin from 212.237.25.99 port 58404
2019-12-23T18:33:42.025865abusebot-8.cloudsearch.cf sshd[10827]: Failed password for invalid user admin from 212.237.25.99 port 58404 ssh2
2019-12-23T18:33:44.314912abusebot-8.cloudsearch.cf sshd[10829]: Invalid user admin from 212.237.25.99 port 34792
...

MultiHost/MultiPort Probe, Scan, Hack -

Dec 23 16:59:36 vps691689 sshd[30240]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.234.86.229
Dec 23 16:59:38 vps691689 sshd[30240]: Failed password for invalid user ### from 49.234.86.229 port 42124 ssh2
Dec 23 17:05:18 vps691689 sshd[30390]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.234.86.229
...

Dec 23 21:06:13 debian-2gb-nbg1-2 kernel: \[784316.837388\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=139.162.110.42 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=241 ID=54321 PROTO=TCP SPT=40043 DPT=3306 WINDOW=65535 RES=0x00 SYN URGP=0

MultiHost/MultiPort Probe, Scan, Hack -

Dec 23 15:22:28 pi sshd\[18356\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.249.243.235  user=root
Dec 23 15:22:30 pi sshd\[18356\]: Failed password for root from 49.249.243.235 port 47304 ssh2
Dec 23 15:28:38 pi sshd\[18644\]: Invalid user klemushin from 49.249.243.235 port 49510
Dec 23 15:28:38 pi sshd\[18644\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.249.243.235
Dec 23 15:28:40 pi sshd\[18644\]: Failed password for invalid user klemushin from 49.249.243.235 port 49510 ssh2
Dec 23 15:34:51 pi sshd\[18871\]: Invalid user vinjar from 49.249.243.235 port 51706
Dec 23 15:34:51 pi sshd\[18871\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.249.243.235
Dec 23 15:34:53 pi sshd\[18871\]: Failed password for invalid user vinjar from 49.249.243.235 port 51706 ssh2
Dec 23 15:40:57 pi sshd\[19200\]: pam_unix\(sshd:auth\): authentication failur
...

5432/tcp 3389/tcp...
[2019-11-03/12-22]19pkt,2pt.(tcp)