2019-04-20 11:37:45 1hHmRN-0005Gz-OE SMTP connection from \(spitball.tecrubesizler.icu\) \[93.115.250.30\]:50259 I=\[193.107.88.166\]:25 closed by DROP in ACL
2019-04-20 11:40:29 1hHmU1-0005Nb-Hm SMTP connection from \(spitball.tecrubesizler.icu\) \[93.115.250.30\]:47115 I=\[193.107.90.29\]:25 closed by DROP in ACL
2019-04-20 11:40:50 1hHmUL-0005Nu-SM SMTP connection from \(spitball.tecrubesizler.icu\) \[93.115.250.30\]:57543 I=\[193.107.88.166\]:25 closed by DROP in ACL
...

2019-04-29 08:05:47 1hKzQB-00009D-AD SMTP connection from \(lovelly.milkray.icu\) \[93.115.250.10\]:35834 I=\[193.107.90.29\]:25 closed by DROP in ACL
2019-04-29 08:07:30 1hKzRq-0000BX-H7 SMTP connection from \(lovelly.milkray.icu\) \[93.115.250.10\]:59752 I=\[193.107.88.166\]:25 closed by DROP in ACL
2019-04-29 08:07:51 1hKzSB-0000Br-0y SMTP connection from \(lovelly.milkray.icu\) \[93.115.250.10\]:60079 I=\[193.107.88.166\]:25 closed by DROP in ACL
...

2019-04-26 15:54:21 1hK1Iz-0001Is-N5 SMTP connection from \(hurt.bersaathevents.icu\) \[93.115.250.11\]:56031 I=\[193.107.88.166\]:25 closed by DROP in ACL
2019-04-26 15:56:20 1hK1Ku-0001NC-BB SMTP connection from \(hurt.bersaathevents.icu\) \[93.115.250.11\]:38775 I=\[193.107.88.166\]:25 closed by DROP in ACL
2019-04-26 15:57:09 1hK1Lh-0001O7-PW SMTP connection from \(hurt.bersaathevents.icu\) \[93.115.250.11\]:50464 I=\[193.107.90.29\]:25 closed by DROP in ACL
...

2019-04-30 11:49:22 H=\(pear.tecrubesizler.icu\) \[93.115.250.12\]:33016 I=\[193.107.88.166\]:25 sender verify fail for \: Unrouteable address
2019-04-30 11:49:22 H=\(pear.tecrubesizler.icu\) \[93.115.250.12\]:33016 I=\[193.107.88.166\]:25 F=\ rejected RCPT \: Sender verify failed
2019-04-30 11:52:05 H=\(pear.tecrubesizler.icu\) \[93.115.250.12\]:43527 I=\[193.107.88.166\]:25 sender verify fail for \: Unrouteable address
2019-04-30 11:52:05 H=\(pear.tecrubesizler.icu\) \[93.115.250.12\]:43527 I=\[193.107.88.166\]:25 F=\ rejected RCPT \: Sender verify failed
...

2019-04-19 00:05:41 1hHFA5-0003Zz-G9 SMTP connection from \(show.bersaathevents.icu\) \[93.115.250.13\]:47467 I=\[193.107.88.166\]:25 closed by DROP in ACL
2019-04-19 00:06:34 1hHFAw-0003bB-7z SMTP connection from \(show.bersaathevents.icu\) \[93.115.250.13\]:34199 I=\[193.107.88.166\]:25 closed by DROP in ACL
2019-04-19 00:09:30 1hHFDm-0003gZ-B5 SMTP connection from \(show.bersaathevents.icu\) \[93.115.250.13\]:36419 I=\[193.107.90.29\]:25 closed by DROP in ACL
...

2019-04-19 16:40:41 1hHUgz-000868-2r SMTP connection from \(unique.khaosob.icu\) \[93.115.250.14\]:41663 I=\[193.107.88.166\]:25 closed by DROP in ACL
2019-04-19 16:41:08 1hHUhQ-00086d-F6 SMTP connection from \(unique.khaosob.icu\) \[93.115.250.14\]:34214 I=\[193.107.88.166\]:25 closed by DROP in ACL
2019-04-19 16:43:25 1hHUjd-00089i-3m SMTP connection from \(unique.khaosob.icu\) \[93.115.250.14\]:40121 I=\[193.107.88.166\]:25 closed by DROP in ACL
...

2019-04-29 09:59:33 1hL1CH-0003W7-9I SMTP connection from \(breezy.khaosob.icu\) \[93.115.250.15\]:52473 I=\[193.107.88.166\]:25 closed by DROP in ACL
2019-04-29 10:01:51 1hL1EV-0003eI-4g SMTP connection from \(breezy.khaosob.icu\) \[93.115.250.15\]:34872 I=\[193.107.88.166\]:25 closed by DROP in ACL
2019-04-29 10:02:26 1hL1F4-0003f3-4R SMTP connection from \(breezy.khaosob.icu\) \[93.115.250.15\]:42917 I=\[193.107.88.166\]:25 closed by DROP in ACL
...

2019-04-17 15:35:24 1hGkii-0005Uu-Ox SMTP connection from \(fat.bersaathevents.icu\) \[93.115.250.16\]:55995 I=\[193.107.88.166\]:25 closed by DROP in ACL
2019-04-17 15:37:20 1hGkka-0005Yk-Mo SMTP connection from \(fat.bersaathevents.icu\) \[93.115.250.16\]:39631 I=\[193.107.88.166\]:25 closed by DROP in ACL
2019-04-17 15:37:27 1hGkkh-0005Z1-Q9 SMTP connection from \(fat.bersaathevents.icu\) \[93.115.250.16\]:33282 I=\[193.107.88.166\]:25 closed by DROP in ACL
2019-04-24 01:35:09 1hJ4wP-0004dD-Ge SMTP connection from \(fat.lambakadin.icu\) \[93.115.250.16\]:44761 I=\[193.107.88.166\]:25 closed by DROP in ACL
2019-04-24 01:37:29 1hJ4yf-0004ga-NN SMTP connection from \(fat.lambakadin.icu\) \[93.115.250.16\]:35657 I=\[193.107.88.166\]:25 closed by DROP in ACL
2019-04-24 01:38:07 1hJ4zH-0004hN-Ab SMTP connection from \(fat.lambakadin.icu\) \[93.115.250.16\]:55126 I=\[193.107.90.29\]:25 closed by DROP in ACL
...

2019-04-21 09:36:49 1hI71t-0005Ct-F4 SMTP connection from \(lookalike.khaosob.icu\) \[93.115.250.17\]:56145 I=\[193.107.88.166\]:25 closed by DROP in ACL
2019-04-21 09:36:51 1hI71v-0005Cu-19 SMTP connection from \(lookalike.khaosob.icu\) \[93.115.250.17\]:44007 I=\[193.107.88.166\]:25 closed by DROP in ACL
2019-04-21 09:40:32 1hI75T-0005KP-Ui SMTP connection from \(lookalike.khaosob.icu\) \[93.115.250.17\]:57059 I=\[193.107.90.29\]:25 closed by DROP in ACL
...

2019-04-22 03:28:28 1hINky-0004CG-F7 SMTP connection from \(quiet.timesofwomen.icu\) \[93.115.250.18\]:43003 I=\[193.107.90.29\]:25 closed by DROP in ACL
2019-04-22 03:29:07 1hINlb-0004Di-Ij SMTP connection from \(quiet.timesofwomen.icu\) \[93.115.250.18\]:36435 I=\[193.107.88.166\]:25 closed by DROP in ACL
2019-04-22 03:31:36 1hINo0-0004It-E8 SMTP connection from \(quiet.timesofwomen.icu\) \[93.115.250.18\]:59339 I=\[193.107.88.166\]:25 closed by DROP in ACL
...

2019-04-19 17:08:02 1hHV7R-0000Of-V3 SMTP connection from \(steam.tecrubesizler.icu\) \[93.115.250.19\]:52988 I=\[193.107.88.166\]:25 closed by DROP in ACL
2019-04-19 17:08:24 1hHV7o-0000PN-Ei SMTP connection from \(steam.tecrubesizler.icu\) \[93.115.250.19\]:49175 I=\[193.107.90.29\]:25 closed by DROP in ACL
2019-04-19 17:12:01 1hHVBJ-0000XK-Ok SMTP connection from \(steam.tecrubesizler.icu\) \[93.115.250.19\]:48279 I=\[193.107.88.166\]:25 closed by DROP in ACL
...

2019-04-29 11:40:45 1hL2mD-00073I-Ay SMTP connection from \(absorbing.tecrubesizler.icu\) \[93.115.250.20\]:33078 I=\[193.107.88.166\]:25 closed by DROP in ACL
2019-04-29 11:40:49 1hL2mH-00073Z-JZ SMTP connection from \(absorbing.tecrubesizler.icu\) \[93.115.250.20\]:56789 I=\[193.107.88.166\]:25 closed by DROP in ACL
2019-04-29 11:41:57 1hL2nN-000757-Bj SMTP connection from \(absorbing.tecrubesizler.icu\) \[93.115.250.20\]:51049 I=\[193.107.88.166\]:25 closed by DROP in ACL
...

2019-04-30 06:08:51 H=\(crawl.bookholics.icu\) \[93.115.250.21\]:39619 I=\[193.107.88.166\]:25 sender verify fail for \: Unrouteable address
2019-04-30 06:08:51 H=\(crawl.bookholics.icu\) \[93.115.250.21\]:39619 I=\[193.107.88.166\]:25 F=\ rejected RCPT \: Sender verify failed
2019-04-30 06:11:54 H=\(crawl.bookholics.icu\) \[93.115.250.21\]:35408 I=\[193.107.88.166\]:25 sender verify fail for \: Unrouteable address
2019-04-30 06:11:54 H=\(crawl.bookholics.icu\) \[93.115.250.21\]:35408 I=\[193.107.88.166\]:25 F=\ rejected RCPT \: Sender verify failed
...

2019-04-30 18:56:45 H=\(happen.bersaathevents.icu\) \[93.115.250.22\]:45014 I=\[193.107.90.29\]:25 sender verify fail for \: Unrouteable address
2019-04-30 18:56:45 H=\(happen.bersaathevents.icu\) \[93.115.250.22\]:45014 I=\[193.107.90.29\]:25 F=\ rejected RCPT \: Sender verify failed
2019-04-30 18:57:33 H=\(happen.bersaathevents.icu\) \[93.115.250.22\]:55101 I=\[193.107.88.166\]:25 sender verify fail for \: Unrouteable address
2019-04-30 18:57:33 H=\(happen.bersaathevents.icu\) \[93.115.250.22\]:55101 I=\[193.107.88.166\]:25 F=\ rejected RCPT \: Sender verify failed
...

2019-04-22 05:29:12 1hIPdo-0008Bx-JY SMTP connection from \(optimal.bookholics.icu\) \[93.115.250.23\]:44308 I=\[193.107.88.166\]:25 closed by DROP in ACL
2019-04-22 05:29:31 1hIPe7-0008CU-P9 SMTP connection from \(optimal.bookholics.icu\) \[93.115.250.23\]:33215 I=\[193.107.88.166\]:25 closed by DROP in ACL
2019-04-22 05:32:24 1hIPgt-0008Ip-Su SMTP connection from \(optimal.bookholics.icu\) \[93.115.250.23\]:33708 I=\[193.107.88.166\]:25 closed by DROP in ACL
...

2019-04-22 15:36:35 1hIZ7a-0000Gw-RM SMTP connection from \(scissors.bersaathevents.icu\) \[93.115.250.24\]:33029 I=\[193.107.88.166\]:25 closed by DROP in ACL
2019-04-22 15:38:22 1hIZ9J-0000Jp-WA SMTP connection from \(scissors.bersaathevents.icu\) \[93.115.250.24\]:37360 I=\[193.107.88.166\]:25 closed by DROP in ACL
2019-04-22 15:38:49 1hIZ9k-0000KH-Ua SMTP connection from \(scissors.bersaathevents.icu\) \[93.115.250.24\]:60972 I=\[193.107.88.166\]:25 closed by DROP in ACL
...

Apr 18 07:03:36 legacy sshd[20260]: Failed password for root from 83.103.59.192 port 49254 ssh2
Apr 18 07:08:23 legacy sshd[20476]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=83.103.59.192
Apr 18 07:08:25 legacy sshd[20476]: Failed password for invalid user ln from 83.103.59.192 port 56722 ssh2
...

Invalid user test from 188.165.24.200 port 58380

Triggered: repeated knocking on closed ports.

Apr 18 07:35:48 nbi-636 sshd[31845]: Invalid user v from 139.199.18.194 port 57476
Apr 18 07:35:48 nbi-636 sshd[31845]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.199.18.194 
Apr 18 07:35:50 nbi-636 sshd[31845]: Failed password for invalid user v from 139.199.18.194 port 57476 ssh2
Apr 18 07:35:51 nbi-636 sshd[31845]: Received disconnect from 139.199.18.194 port 57476:11: Bye Bye [preauth]
Apr 18 07:35:51 nbi-636 sshd[31845]: Disconnected from invalid user v 139.199.18.194 port 57476 [preauth]
Apr 18 07:52:09 nbi-636 sshd[4956]: Invalid user desktop from 139.199.18.194 port 52072
Apr 18 07:52:09 nbi-636 sshd[4956]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.199.18.194 
Apr 18 07:52:11 nbi-636 sshd[4956]: Failed password for invalid user desktop from 139.199.18.194 port 52072 ssh2
Apr 18 07:52:14 nbi-636 sshd[4956]: Received disconnect from 139.199.18.194 port 52072:11: Bye ........
-------------------------------

(FakeHost) Fake Host From  114.25.186.139 (TW/Taiwan/114-25-186-139.dynamic-ip.hinet.net): 1 in the last 3600 secs

Apr 18 03:59:54 firewall sshd[6702]: Failed password for root from 222.186.52.39 port 33208 ssh2
Apr 18 03:59:57 firewall sshd[6702]: Failed password for root from 222.186.52.39 port 33208 ssh2
Apr 18 04:00:00 firewall sshd[6702]: Failed password for root from 222.186.52.39 port 33208 ssh2
...

04/18/2020-02:32:49.145091 193.202.45.202 Protocol: 17 ET SCAN Sipvicious Scan

Apr 18 08:47:50 eventyay sshd[16768]: Failed password for root from 222.186.175.148 port 11804 ssh2
Apr 18 08:47:53 eventyay sshd[16768]: Failed password for root from 222.186.175.148 port 11804 ssh2
Apr 18 08:47:56 eventyay sshd[16768]: Failed password for root from 222.186.175.148 port 11804 ssh2
Apr 18 08:48:00 eventyay sshd[16768]: Failed password for root from 222.186.175.148 port 11804 ssh2
...

04/18/2020-01:58:16.257488 185.156.73.38 Protocol: 6 ET SCAN NMAP -sS window 1024

$f2bV_matches

Apr 18 08:32:56 ns381471 sshd[23162]: Failed password for root from 222.186.190.2 port 10192 ssh2
Apr 18 08:33:00 ns381471 sshd[23162]: Failed password for root from 222.186.190.2 port 10192 ssh2

[2020-04-18 02:10:22] NOTICE[1170][C-00001963] chan_sip.c: Call from '' (212.129.18.55:50380) to extension '01148221530196' rejected because extension not found in context 'public'.
[2020-04-18 02:10:22] SECURITY[1184] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-04-18T02:10:22.159-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="01148221530196",SessionID="0x7f6c08099cc8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/212.129.18.55/50380",ACLName="no_extension_match"
[2020-04-18 02:11:36] NOTICE[1170][C-00001965] chan_sip.c: Call from '' (212.129.18.55:56351) to extension '+48221530196' rejected because extension not found in context 'public'.
[2020-04-18 02:11:36] SECURITY[1184] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-04-18T02:11:36.198-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="+48221530196",SessionID="0x7f6c0824ccd8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/212.129.
...

(sshd) Failed SSH login from 222.186.180.142 (CN/China/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Apr 18 08:26:44 amsweb01 sshd[20254]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.180.142  user=root
Apr 18 08:26:46 amsweb01 sshd[20254]: Failed password for root from 222.186.180.142 port 46895 ssh2
Apr 18 08:26:48 amsweb01 sshd[20254]: Failed password for root from 222.186.180.142 port 46895 ssh2
Apr 18 08:26:50 amsweb01 sshd[20254]: Failed password for root from 222.186.180.142 port 46895 ssh2
Apr 18 08:34:18 amsweb01 sshd[20997]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.180.142  user=root

$f2bV_matches

Apr 18 08:24:47 debian-2gb-nbg1-2 kernel: \[9450059.810604\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=94.102.56.181 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=247 ID=21826 PROTO=TCP SPT=47562 DPT=9506 WINDOW=1024 RES=0x00 SYN URGP=0