email spam

Apr  2 15:10:30 mail.srvfarm.net postfix/smtpd[1975768]: NOQUEUE: reject: RCPT from squirrel.superacrepair.com[134.73.51.96]: 554 5.7.1 : Relay access denied; from= to= proto=ESMTP helo=
Apr  2 15:13:04 mail.srvfarm.net postfix/smtpd[1975772]: NOQUEUE: reject: RCPT from squirrel.superacrepair.com[134.73.51.96]: 554 5.7.1 : Relay access denied; from= to= proto=ESMTP helo=
Apr  2 15:16:00 mail.srvfarm.net postfix/smtpd[1962002]: NOQUEUE: reject: RCPT from squirrel.superacrepair.com[134.73.51.96]: 554 5.7.1 : Relay access denied; from= to= proto=ESMTP helo=
Apr  2 15:16:02 mail.srvfarm.net postfix/smtpd[1978064]: NOQUEUE: reject: RCPT from squirrel.superacrepair.com[134.73.51.96]: 554 5.7.1 Service unavailab

Apr  2 05:37:50 web01.agentur-b-2.de postfix/smtpd[64779]: NOQUEUE: reject: RCPT from shocker.juntosms.com[134.73.51.53]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Apr  2 05:37:58 web01.agentur-b-2.de postfix/smtpd[64780]: NOQUEUE: reject: RCPT from shocker.juntosms.com[134.73.51.53]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Apr  2 05:39:38 web01.agentur-b-2.de postfix/smtpd[64779]: NOQUEUE: reject: RCPT from shocker.juntosms.com[134.73.51.53]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Apr  2 05:39:56 web01.agentur-b-2.de postfix/smtpd[64780]: NOQUEUE: reject: RCPT from shocker.juntosms.com[134.73

Apr  2 05:24:38 mail.srvfarm.net postfix/smtpd[1752292]: NOQUEUE: reject: RCPT from depend.superacrepair.com[134.73.51.76]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Apr  2 05:24:38 mail.srvfarm.net postfix/smtpd[1751041]: NOQUEUE: reject: RCPT from depend.superacrepair.com[134.73.51.76]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Apr  2 05:24:38 mail.srvfarm.net postfix/smtpd[1753888]: NOQUEUE: reject: RCPT from depend.superacrepair.com[134.73.51.76]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Apr  2 05:24:39 mail.srvfarm.net postfix/smtpd[1752172]: NOQUEUE: reject: RCPT from depend.superacrepair.co

Apr  1 05:35:30 mail.srvfarm.net postfix/smtpd[1068652]: NOQUEUE: reject: RCPT from unknown[134.73.51.62]: 554 5.7.1 Service unavailable; Client host [134.73.51.62] blocked using zen.spamhaus.org; https://www.spamhaus.org/sbl/query/SBLCSS; from= to= proto=ESMTP helo=
Apr  1 05:35:30 mail.srvfarm.net postfix/smtpd[1071960]: NOQUEUE: reject: RCPT from unknown[134.73.51.62]: 554 5.7.1 Service unavailable; Client host [134.73.51.62] blocked using zen.spamhaus.org; https://www.spamhaus.org/sbl/query/SBLCSS; from= to= proto=ESMTP helo=
Apr  1 05:35:30 mail.srvfarm.net postfix/smtpd[1069650]: NOQUEUE: reject: RCPT from unknown[134.73.51.62]: 554 5.7.1 Service unavailable; Client host [134.73.51.62] blocked using zen.spamhaus.org; https://www.spamhaus.org/sbl/query/SBLCSS; from= to= proto=ESMTP helo=

Mar 31 15:27:26 mail.srvfarm.net postfix/smtpd[605797]: NOQUEUE: reject: RCPT from unknown[134.73.51.37]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar 31 15:27:30 mail.srvfarm.net postfix/smtpd[605800]: NOQUEUE: reject: RCPT from unknown[134.73.51.37]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar 31 15:31:58 mail.srvfarm.net postfix/smtpd[619495]: NOQUEUE: reject: RCPT from unknown[134.73.51.37]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar 31 15:35:15 mail.srvfarm.net postfix/smtpd[622924]: NOQUEUE: reject: RCPT

Mar 31 05:27:16 mail.srvfarm.net postfix/smtpd[361760]: NOQUEUE: reject: RCPT from unknown[134.73.51.12]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar 31 05:28:14 mail.srvfarm.net postfix/smtpd[381494]: NOQUEUE: reject: RCPT from unknown[134.73.51.12]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar 31 05:33:04 mail.srvfarm.net postfix/smtpd[377289]: NOQUEUE: reject: RCPT from unknown[134.73.51.12]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar 31 05:33:18 mail.srvfarm.net postfix/smtpd[365658]: NOQUEUE: reject: RCPT from unknown[134.73.51.12]: 450 4.1.8 

Mar 31 05:25:53 mail.srvfarm.net postfix/smtpd[365653]: NOQUEUE: reject: RCPT from unknown[134.73.51.113]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar 31 05:26:37 mail.srvfarm.net postfix/smtpd[365653]: NOQUEUE: reject: RCPT from unknown[134.73.51.113]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar 31 05:27:07 mail.srvfarm.net postfix/smtpd[361760]: NOQUEUE: reject: RCPT from unknown[134.73.51.113]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar 31 05:27:56 mail.srvfarm.net postfix/smtpd[364919]: NOQUEUE: reject: RCPT from unknown[134.73.51.113]: 450 4.1.8 <

Mar 31 05:42:52 mail.srvfarm.net postfix/smtpd[381494]: NOQUEUE: reject: RCPT from unknown[134.73.51.168]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar 31 05:42:58 mail.srvfarm.net postfix/smtpd[383948]: NOQUEUE: reject: RCPT from unknown[134.73.51.168]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar 31 05:43:28 mail.srvfarm.net postfix/smtpd[377289]: NOQUEUE: reject: RCPT from unknown[134.73.51.168]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar 31 05:43:56 mail.srvfarm.net postfix/smtpd[377290

Mar 30 16:52:11 mail.srvfarm.net postfix/smtpd[1589027]: NOQUEUE: reject: RCPT from unknown[134.73.51.177]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar 30 16:52:11 mail.srvfarm.net postfix/smtpd[1604476]: NOQUEUE: reject: RCPT from unknown[134.73.51.177]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar 30 16:53:16 mail.srvfarm.net postfix/smtpd[1604431]: NOQUEUE: reject: RCPT from unknown[134.73.51.177]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar 30 16:56:13 mail.srvfarm.net postfix/smtpd[1608170]: NOQUEUE: reject: RCPT from unknown[134.73.51.177]: 450 4.1.8 

Mar 29 05:41:35 mail.srvfarm.net postfix/smtpd[755834]: NOQUEUE: reject: RCPT from kinky.juntosms.com[134.73.51.40]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar 29 05:45:17 mail.srvfarm.net postfix/smtpd[774355]: NOQUEUE: reject: RCPT from kinky.juntosms.com[134.73.51.40]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar 29 05:46:32 mail.srvfarm.net postfix/smtpd[755491]: NOQUEUE: reject: RCPT from kinky.juntosms.com[134.73.51.40]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar 29 05:48:27 mail.srvfarm.net postfix/smtpd[755834]: NOQUEUE: reject: RCPT from kinky.junt

Mar 29 05:41:45 mail.srvfarm.net postfix/smtpd[770786]: NOQUEUE: reject: RCPT from unknown[134.73.51.131]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar 29 05:45:13 mail.srvfarm.net postfix/smtpd[774355]: NOQUEUE: reject: RCPT from unknown[134.73.51.131]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar 29 05:48:25 mail.srvfarm.net postfix/smtpd[770789]: NOQUEUE: reject: RCPT from unknown[134.73.51.131]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar 29 05:50:03 mail.srvfarm.net postfix/smtpd[774394]: NOQUEUE: reject: RCPT from unknown[134.73.51.131]: 450 4.1.8 

Mar 28 04:41:31 mail.srvfarm.net postfix/smtpd[160963]: NOQUEUE: reject: RCPT from unknown[134.73.51.221]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar 28 04:46:02 mail.srvfarm.net postfix/smtpd[160577]: NOQUEUE: reject: RCPT from unknown[134.73.51.221]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar 28 04:46:02 mail.srvfarm.net postfix/smtpd[160577]: NOQUEUE: reject: RCPT from unknown[134.73.51.221]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar 28 04:49:26 mail.srvfarm.net postfix/smtpd[1602

Mar 27 05:42:05 mail.srvfarm.net postfix/smtpd[3723724]: NOQUEUE: reject: RCPT from unknown[134.73.51.153]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar 27 05:42:05 mail.srvfarm.net postfix/smtpd[3721876]: NOQUEUE: reject: RCPT from unknown[134.73.51.153]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar 27 05:42:05 mail.srvfarm.net postfix/smtpd[3723721]: NOQUEUE: reject: RCPT from unknown[134.73.51.153]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar 27 05:42:05 mail.srvfarm.net postfix/smtpd[3721944]: NOQUEUE: reject: RCPT from unknown[134.73.51.153]:

Mar 27 06:01:19 mail.srvfarm.net postfix/smtpd[3722006]: NOQUEUE: reject: RCPT from unknown[134.73.51.215]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar 27 06:02:10 mail.srvfarm.net postfix/smtpd[3722006]: NOQUEUE: reject: RCPT from unknown[134.73.51.215]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar 27 06:03:07 mail.srvfarm.net postfix/smtpd[3721909]: NOQUEUE: reject: RCPT from unknown[134.73.51.215]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar 27 06:03:18 mail.srvfarm.net postfix/smtpd[3722006]: NOQUEUE: reject: RCPT from unknown[134.73.51.215]:

Mar 23 15:42:08 web01 postfix/smtpd[13317]: connect from arrange.yojaana.com[134.73.51.173]
Mar 23 15:42:09 web01 policyd-spf[13319]: None; identhostnamey=helo; client-ip=134.73.51.173; helo=arrange.tmtsuarl.com; envelope-from=x@x
Mar 23 15:42:09 web01 policyd-spf[13319]: Pass; identhostnamey=mailfrom; client-ip=134.73.51.173; helo=arrange.tmtsuarl.com; envelope-from=x@x
Mar x@x
Mar 23 15:42:10 web01 postfix/smtpd[13317]: disconnect from arrange.yojaana.com[134.73.51.173]
Mar 23 15:47:38 web01 postfix/smtpd[13627]: connect from arrange.yojaana.com[134.73.51.173]
Mar 23 15:47:38 web01 policyd-spf[13660]: None; identhostnamey=helo; client-ip=134.73.51.173; helo=arrange.tmtsuarl.com; envelope-from=x@x
Mar 23 15:47:38 web01 policyd-spf[13660]: Pass; identhostnamey=mailfrom; client-ip=134.73.51.173; helo=arrange.tmtsuarl.com; envelope-from=x@x
Mar x@x
Mar 23 15:47:39 web01 postfix/smtpd[13627]: disconnect from arrange.yojaana.com[134.73.51.173]
Mar 23 15:51:19 web01 postfix/........
-------------------------------

22 attempts against mh-misbehave-ban on float

Jun 30 07:59:20 lnxded64 sshd[6763]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=124.251.110.147
Jun 30 07:59:22 lnxded64 sshd[6763]: Failed password for invalid user anderson from 124.251.110.147 port 50060 ssh2
Jun 30 08:01:38 lnxded64 sshd[8017]: Failed password for root from 124.251.110.147 port 34036 ssh2

2020-06-30T05:52:58.976396dmca.cloudsearch.cf sshd[31632]: Invalid user julie from 94.198.110.205 port 46845
2020-06-30T05:52:58.983169dmca.cloudsearch.cf sshd[31632]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.198.110.205
2020-06-30T05:52:58.976396dmca.cloudsearch.cf sshd[31632]: Invalid user julie from 94.198.110.205 port 46845
2020-06-30T05:53:01.280233dmca.cloudsearch.cf sshd[31632]: Failed password for invalid user julie from 94.198.110.205 port 46845 ssh2
2020-06-30T05:58:19.728773dmca.cloudsearch.cf sshd[31813]: Invalid user user from 94.198.110.205 port 57286
2020-06-30T05:58:19.734906dmca.cloudsearch.cf sshd[31813]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.198.110.205
2020-06-30T05:58:19.728773dmca.cloudsearch.cf sshd[31813]: Invalid user user from 94.198.110.205 port 57286
2020-06-30T05:58:21.766043dmca.cloudsearch.cf sshd[31813]: Failed password for invalid user user from 94.198
...

Invalid user oracle from 94.237.53.210 port 55472
pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94-237-53-210.uk-lon1.upcloud.host
Invalid user oracle from 94.237.53.210 port 55472
Failed password for invalid user oracle from 94.237.53.210 port 55472 ssh2
Invalid user mos from 94.237.53.210 port 54852

Jun 30 07:43:50 piServer sshd[5977]: Failed password for root from 121.166.187.187 port 54282 ssh2
Jun 30 07:47:21 piServer sshd[6246]: Failed password for root from 121.166.187.187 port 52874 ssh2
...

06/30/2020-01:49:13.471887 146.88.240.4 Protocol: 17 ET DROP Dshield Block Listed Source group 1

Jun 30 07:21:44 vmd48417 sshd[18521]: Failed password for root from 104.47.142.2 port 13774 ssh2

06/29/2020-23:54:26.038794 106.6.70.204 Protocol: 6 ET SCAN Suspicious inbound to MSSQL port 1433

Failed password for invalid user otrs from 58.26.237.222 port 39396 ssh2

Unauthorized connection attempt detected from IP address 65.49.20.68 to port 22

[Tue Jun 30 10:54:47.002031 2020] [:error] [pid 3647:tid 139691177268992] [client 92.43.170.11:58982] [client 92.43.170.11] ModSecurity: Access denied with code 403 (phase 2). Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/modsecurity/owasp-modsecurity-crs-3.2.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "696"] [id "920350"] [msg "Host header is a numeric IP address"] [data "103.27.207.197"] [severity "WARNING"] [ver "OWASP_CRS/3.2.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/IP_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "103.27.207.197"] [uri "/favicon.ico"] [unique_id "Xvq3hp5-VmYWBSWxGQF6ZwAAAfE"], referer: http://103.27.207.197/
...

$f2bV_matches

Jun 29 19:47:31 eddieflores sshd\[5130\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.42.137  user=root
Jun 29 19:47:34 eddieflores sshd\[5130\]: Failed password for root from 222.186.42.137 port 21708 ssh2
Jun 29 19:47:36 eddieflores sshd\[5130\]: Failed password for root from 222.186.42.137 port 21708 ssh2
Jun 29 19:47:38 eddieflores sshd\[5130\]: Failed password for root from 222.186.42.137 port 21708 ssh2
Jun 29 19:47:40 eddieflores sshd\[5136\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.42.137  user=root

From corretor-agtv=agtv.com.br@sao.we.bs Tue Jun 30 00:54:12 2020
Received: from yjfmodvhmwe2.sao.we.bs ([177.37.52.18]:48754)

2020-06-30T06:55:36+0200 Failed SSH Authentication/Brute Force Attack.(Server 2)