Aug  2 06:18:16 debian-2gb-nbg1-2 kernel: \[18600373.625228\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=94.102.56.231 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=247 ID=21136 PROTO=TCP SPT=48550 DPT=8631 WINDOW=1024 RES=0x00 SYN URGP=0

07/22/2020-01:14:40.828040 94.102.56.231 Protocol: 6 ET SCAN NMAP -sS window 1024

Port scan: Attack repeated for 24 hours

Triggered: repeated knocking on closed ports.

TCP ports : 8488 / 8996

 TCP (SYN) 94.102.56.231:40950 -> port 8132, len 44

ET CINS Active Threat Intelligence Poor Reputation IP group 80 - port: 8419 proto: tcp cat: Misc Attackbytes: 60

firewall-block, port(s): 8733/tcp

Automatic report - Port Scan

 TCP (SYN) 94.102.56.231:40950 -> port 8995, len 44

07/05/2020-16:23:13.320156 94.102.56.231 Protocol: 6 ET SCAN NMAP -sS window 1024

Port scan on 7 port(s): 8226 8236 8426 8637 8769 8899 8915

 TCP (SYN) 94.102.56.231:40950 -> port 8492, len 44

Jul  4 23:42:45 debian-2gb-nbg1-2 kernel: \[16157582.453966\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=94.102.56.231 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=247 ID=6785 PROTO=TCP SPT=40950 DPT=8459 WINDOW=1024 RES=0x00 SYN URGP=0

 TCP (SYN) 94.102.56.231:40950 -> port 8168, len 44

06/30/2020-22:56:11.320835 94.102.56.231 Protocol: 6 ET SCAN NMAP -sS window 1024

Jun 27 12:08:52 debian-2gb-nbg1-2 kernel: \[15511184.802079\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=94.102.56.231 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=247 ID=25889 PROTO=TCP SPT=41281 DPT=8625 WINDOW=1024 RES=0x00 SYN URGP=0

Jun 21 01:27:56 debian-2gb-nbg1-2 kernel: \[14954358.592526\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=94.102.56.231 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=247 ID=57028 PROTO=TCP SPT=41281 DPT=8166 WINDOW=1024 RES=0x00 SYN URGP=0

 TCP (SYN) 94.102.56.231:41281 -> port 8120, len 44

firewall-block, port(s): 8107/tcp

 TCP (SYN) 94.102.56.231:41281 -> port 8021, len 44

Jun 10 20:40:45 debian-2gb-nbg1-2 kernel: \[14073174.660144\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=94.102.56.231 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=247 ID=63297 PROTO=TCP SPT=57419 DPT=8755 WINDOW=1024 RES=0x00 SYN URGP=0

 TCP (SYN) 94.102.56.231:51209 -> port 8648, len 44

Jun  4 18:40:21 debian kernel: [187784.508789] [UFW BLOCK] IN=eth0 OUT= MAC=52:54:00:be:e4:65:08:e8:4f:6e:48:0c:08:00 SRC=94.102.56.231 DST=89.252.131.35 LEN=40 TOS=0x00 PREC=0x00 TTL=244 ID=1923 PROTO=TCP SPT=51209 DPT=8089 WINDOW=1024 RES=0x00 SYN URGP=0

firewall-block, port(s): 8061/tcp

8824/tcp
[2020-06-03]1pkt

Too many connections or unauthorized access detected from Yankee banned ip

2020-10-11 14:30:32 dovecot_login authenticator failed for (User) [94.102.56.238]: 535 Incorrect authentication data (set_id=office@usmancity.ru)
2020-10-11 14:30:38 dovecot_login authenticator failed for (User) [94.102.56.238]: 535 Incorrect authentication data (set_id=office@usmancity.ru)
2020-10-11 14:30:48 dovecot_login authenticator failed for (User) [94.102.56.238]: 535 Incorrect authentication data (set_id=office@usmancity.ru)
...

Oct 10 14:08:39 mail postfix/smtpd[102206]: warning: unknown[94.102.56.238]: SASL LOGIN authentication failed: generic failure
Oct 10 14:08:39 mail postfix/smtpd[102206]: warning: unknown[94.102.56.238]: SASL LOGIN authentication failed: generic failure
Oct 10 14:08:39 mail postfix/smtpd[102206]: warning: unknown[94.102.56.238]: SASL LOGIN authentication failed: generic failure
Oct 10 14:08:39 mail postfix/smtpd[102206]: warning: unknown[94.102.56.238]: SASL LOGIN authentication failed: generic failure
Oct 10 14:08:39 mail postfix/smtpd[102206]: warning: unknown[94.102.56.238]: SASL LOGIN authentication failed: generic failure
...

Oct 10 06:36:11 ns308116 postfix/smtpd[8160]: warning: unknown[94.102.56.238]: SASL LOGIN authentication failed: authentication failure
Oct 10 06:36:11 ns308116 postfix/smtpd[8160]: warning: unknown[94.102.56.238]: SASL LOGIN authentication failed: authentication failure
Oct 10 06:36:11 ns308116 postfix/smtpd[8160]: warning: unknown[94.102.56.238]: SASL LOGIN authentication failed: authentication failure
Oct 10 06:36:11 ns308116 postfix/smtpd[8160]: warning: unknown[94.102.56.238]: SASL LOGIN authentication failed: authentication failure
Oct 10 06:36:11 ns308116 postfix/smtpd[8160]: warning: unknown[94.102.56.238]: SASL LOGIN authentication failed: authentication failure
Oct 10 06:36:11 ns308116 postfix/smtpd[8160]: warning: unknown[94.102.56.238]: SASL LOGIN authentication failed: authentication failure
...

2020-10-10 02:08:19 auth_plain authenticator failed for (User) [94.102.56.238]: 535 Incorrect authentication data (set_id=test@lavrinenko.info,)
2020-10-10 02:08:19 SMTP call from (User) [94.102.56.238] dropped: too many nonmail commands (last was "RSET")
...

Oct  9 18:07:38 srv3 postfix/smtpd\[26675\]: warning: unknown\[94.102.56.238\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Oct  9 18:07:44 srv3 postfix/smtpd\[26675\]: warning: unknown\[94.102.56.238\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Oct  9 18:07:54 srv3 postfix/smtpd\[26675\]: warning: unknown\[94.102.56.238\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
...

SMTP AUTH break-in attempt.

Persistent port scanning [69 denied]

warning: unknown[94.102.56.238]: SASL LOGIN authentication failed

Persistent port scanning [69 denied]

SASL LOGIN authentication failed: authentication failure

 UDP 94.102.56.216:58033 -> port 9136, len 57

Port probe and connect to SMTP:25.
Auth intiated but dropped.

[N3.H3.VM3] Port Scanner Detected Blocked by UFW

2020-10-03 13:06:53 dovecot_login authenticator failed for \(User\) \[94.102.56.238\]: 535 Incorrect authentication data \(set_id=info@no-server.de\)
2020-10-03 13:06:59 dovecot_login authenticator failed for \(User\) \[94.102.56.238\]: 535 Incorrect authentication data \(set_id=info@no-server.de\)
2020-10-03 13:07:09 dovecot_login authenticator failed for \(User\) \[94.102.56.238\]: 535 Incorrect authentication data \(set_id=info@no-server.de\)
2020-10-03 13:07:26 dovecot_login authenticator failed for \(User\) \[94.102.56.238\]: 535 Incorrect authentication data \(set_id=info@no-server.de\)
2020-10-03 13:07:43 dovecot_login authenticator failed for \(User\) \[94.102.56.238\]: 535 Incorrect authentication data \(set_id=info@no-server.de\)
2020-10-03 13:08:00 dovecot_login authenticator failed for \(User\) \[94.102.56.238\]: 535 Incorrect authentication data \(set_id=info@no-server.de\)
2020-10-03 13:08:00 SMTP call from \(User\) \[94.102.56.238\] dropped: too many nonmail commands \(l
...

May  7 sshd[15527]: Invalid user yago from 62.210.119.215 port 47620

May  7 19:19:09 nextcloud sshd\[12142\]: Invalid user customer from 63.239.129.138
May  7 19:19:09 nextcloud sshd\[12142\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=63.239.129.138
May  7 19:19:11 nextcloud sshd\[12142\]: Failed password for invalid user customer from 63.239.129.138 port 47006 ssh2

May  7 17:54:24 ns3033917 sshd[407]: Invalid user ubuntu from 91.121.65.15 port 32798
May  7 17:54:27 ns3033917 sshd[407]: Failed password for invalid user ubuntu from 91.121.65.15 port 32798 ssh2
May  7 17:58:29 ns3033917 sshd[436]: Invalid user dstserver from 91.121.65.15 port 51080
...

Brute-force attempt banned

port scan and connect, tcp 8080 (http-proxy)

May  7 18:30:10 Ubuntu-1404-trusty-64-minimal sshd\[20448\]: Invalid user catchall from 59.108.66.247
May  7 18:30:10 Ubuntu-1404-trusty-64-minimal sshd\[20448\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=59.108.66.247
May  7 18:30:12 Ubuntu-1404-trusty-64-minimal sshd\[20448\]: Failed password for invalid user catchall from 59.108.66.247 port 27131 ssh2
May  7 19:19:25 Ubuntu-1404-trusty-64-minimal sshd\[2230\]: Invalid user ats from 59.108.66.247
May  7 19:19:25 Ubuntu-1404-trusty-64-minimal sshd\[2230\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=59.108.66.247

(imapd) Failed IMAP login from 203.147.80.40 (NC/New Caledonia/host-203-147-80-40.h33.canl.nc): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: May  7 21:49:12 ir1 dovecot[264309]: imap-login: Disconnected (auth failed, 1 attempts in 6 secs): user=, method=PLAIN, rip=203.147.80.40, lip=5.63.12.44, session=

May  7 20:31:03 vps687878 sshd\[19545\]: Failed password for invalid user zsf from 203.92.113.188 port 58654 ssh2
May  7 20:35:08 vps687878 sshd\[19932\]: Invalid user tester1 from 203.92.113.188 port 39498
May  7 20:35:08 vps687878 sshd\[19932\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.92.113.188
May  7 20:35:10 vps687878 sshd\[19932\]: Failed password for invalid user tester1 from 203.92.113.188 port 39498 ssh2
May  7 20:39:15 vps687878 sshd\[20182\]: Invalid user ahsan from 203.92.113.188 port 48574
May  7 20:39:15 vps687878 sshd\[20182\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.92.113.188
...

May  7 22:27:31 eventyay sshd[30444]: Failed password for root from 222.186.175.154 port 48928 ssh2
May  7 22:27:34 eventyay sshd[30444]: Failed password for root from 222.186.175.154 port 48928 ssh2
May  7 22:27:44 eventyay sshd[30444]: error: maximum authentication attempts exceeded for root from 222.186.175.154 port 48928 ssh2 [preauth]
...

05/07/2020-15:34:01.972370 103.18.246.184 Protocol: 6 ET SCAN NMAP -sS window 1024

May  7 21:23:10 jane sshd[18599]: Failed password for root from 14.42.114.231 port 37906 ssh2
...

2020-05-07T21:28:09.024937vps751288.ovh.net sshd\[6852\]: Invalid user tuesday from 36.84.139.46 port 45136
2020-05-07T21:28:09.032214vps751288.ovh.net sshd\[6852\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.84.139.46
2020-05-07T21:28:11.338041vps751288.ovh.net sshd\[6852\]: Failed password for invalid user tuesday from 36.84.139.46 port 45136 ssh2
2020-05-07T21:32:25.375735vps751288.ovh.net sshd\[6878\]: Invalid user cturner from 36.84.139.46 port 50648
2020-05-07T21:32:25.385060vps751288.ovh.net sshd\[6878\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.84.139.46

Unauthorized connection attempt detected from IP address 104.140.188.34 to port 1433

May  7 19:20:51 scw-6657dc sshd[14194]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.79.90.72
May  7 19:20:51 scw-6657dc sshd[14194]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.79.90.72
May  7 19:20:53 scw-6657dc sshd[14194]: Failed password for invalid user zebra from 103.79.90.72 port 38768 ssh2
...

May  7 19:50:24 electroncash sshd[18211]: Invalid user common from 138.197.118.32 port 40914
May  7 19:50:24 electroncash sshd[18211]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.118.32 
May  7 19:50:24 electroncash sshd[18211]: Invalid user common from 138.197.118.32 port 40914
May  7 19:50:26 electroncash sshd[18211]: Failed password for invalid user common from 138.197.118.32 port 40914 ssh2
May  7 19:53:14 electroncash sshd[18971]: Invalid user mysql from 138.197.118.32 port 53264
...