Phishing scam, resulted in successful financial wire transfers.

Spammer

Automatic report - Banned IP Access

(From rosen.zulma@hotmail.com) Zero Cost advertising, submit your site now and start getting new visitors. Visit: https://bit.ly/no-cost-ads

(From hamlet.latasha@googlemail.com) Hello, 

I just wanted to reach out and let you know about our Online Fast Track 4 Week Certified and Accredited Trade School. If you are interested in becoming a Trained and Certified HVAC, Plumbing, Electrical or Solar Technician feel free to check us out at: 

https://bit.ly/dmaceducation

"We look forward to your success!"

(From weldon.bianca@gmail.com) Title:   We may be interested in buying your business

Content:

Have you considered selling your internet business or partnering with someone that can grow your company? 

Hi, my name is Laurent (but everyone calls me "LT"). I am a business broker that specializes in buying and selling internet businesses.  Right now is a great time to consider selling profitable online companies or digital assets (website, ecommerce businesses, dropshipping sites, social media accounts, software, etc). 

We work with many buyers that are looking to buy, invest, operate or partner with internet businesses to create win/win situations. 

If you are interested or even just curious, follow the link and fill out our intake form and we'll reach out to you:
https://bit.ly/madxcapital-business-seller

We look forward to working with you.

Laurent "LT"
MadX Capital Brokers
madxbrokers@gmail.com

(From albright.ngan@msn.com) New Customer System – Automated and Compliant

Hello,
This is Shawn Kocab and I came across your Google Business Listing.
I wanted to introduce myself to you. My company is Alliance, and we focus 
on generating quality inbound phone calls and appointments for chiropractors. 

We are able to generate results for your practice spanning
back and neck pain as well as arthritis and joint pain.

No matter the season - our team can help generate a predictable stream of
exclusive inbound chiropractor leads for your practice. We can help you
find patients in need of
? Neck pain treatment
? Personal injury care
? Back pain relief
? Slip and fall injury treatment
? Automotive collision injury treatment

Unlike shared lead providers - we work EXCLUSIVELY for your company.
With our team, your days of paying for disappointing leads and marketing
that are also sold to your competition are over.

If you have a few minutes, I would love to show how we successfully
generate

Automatic report - Banned IP Access

(From moreira.elliott@outlook.com) 
Sick of paying big bucks for ads that suck? Now you can post your ad on 10,000 ad websites and it'll cost you less than $40. These ads stay up forever, this is a continual supply of organic visitors! 

To find out more check out our site here: http://www.adposting-onautopilot.xyz

Contact page abuser
"Get/wp-json/contact-form-7/v1/contact-forms/11474/feedback"

Contact page abuser
"Get/wp-json/contact-form-7/v1/contact-forms/11474/feedback"

(From nam.langlois@gmail.com) We’re CAS-Supply,  an order management company and can help businesses like yours get post-lockdown ready, ensuring your workplace is safe and equipped to bring your team back to work.

CAS lets you choose all the product types, manufacturers and even countries of origin and takes care of the rest. We have dedicated our efforts to delivering FDA-approved gear so you can use them without any worries.

The following items can be shipped to you within 2 days. You can get in touch either by mail or phone (see footer). Please note this is a first-come, first-served service:
•	KN95 respirators - civil use
•	N95 respirators - civil use
•	3ply disposable masks, civil use or surgical
•	Nitrile gloves
•	Vinyl gloves
•	Isolation gowns
We hope to prepare you for a pandemic-safe environment.

If this email is not relevant to you, please forward it to the purchasing manager of your firm.  

https://bit.ly/cas-supply

Best,

(From teresita.bonnett31@gmail.com) Stem cell therapy has proven itself to be one of the most effective treatments for COPD (Chronic Obstructive Pulmonary Disorder). IMC is the leader in stem cell therapies in Mexico. For more information on how we can treat COPD please visit:
https://bit.ly/copd-integramedicalcenter

(From sharyn.micklem@gmail.com) You Can DOUBLE Your Productivity For Life In Under 48 Hours

And when it comes to changing your life, there's nothing more important to fixing your productivity.

Think about it.

If you're twice as productive, then, as far as your environment supports it, you're going to make at least twice as much. However, the growth is almost always exponential. So expect even more income, free time, and the ability to decide what you want to do at any given moment.

Here's the best course I've seen on this subject:

https://bit.ly/michaeltips-com

It's a fun and pretty short read... and it has the potential to change your life in 48 hours from now.

Michael Hehn

*Port Scan* detected from 201.99.85.135 (MX/Mexico/dsl-201-99-85-135-sta.prod-empresarial.com.mx). 4 hits in the last 230 seconds

\[2019-11-10 00:16:22\] SECURITY\[2634\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-11-10T00:16:22.289-0500",Severity="Error",Service="SIP",EventVersion="1",AccountID="6617501148556213011",SessionID="0x7fdf2cae1298",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/45.125.65.99/58456",ACLName="no_extension_match"
\[2019-11-10 00:16:35\] SECURITY\[2634\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-11-10T00:16:35.986-0500",Severity="Error",Service="SIP",EventVersion="1",AccountID="6301601148343508002",SessionID="0x7fdf2c48e508",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/45.125.65.99/53838",ACLName="no_extension_match"
\[2019-11-10 00:16:37\] SECURITY\[2634\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-11-10T00:16:37.709-0500",Severity="Error",Service="SIP",EventVersion="1",AccountID="6959601148585359060",SessionID="0x7fdf2c3e82d8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/45.125.65.99/57420",ACLNam

pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.175.155  user=root
Failed password for root from 222.186.175.155 port 38616 ssh2
Failed password for root from 222.186.175.155 port 38616 ssh2
Failed password for root from 222.186.175.155 port 38616 ssh2
Failed password for root from 222.186.175.155 port 38616 ssh2

2019-11-10T04:48:52.632411shield sshd\[16555\]: Invalid user 3 from 148.70.41.33 port 58382
2019-11-10T04:48:52.636334shield sshd\[16555\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.41.33
2019-11-10T04:48:54.806210shield sshd\[16555\]: Failed password for invalid user 3 from 148.70.41.33 port 58382 ssh2
2019-11-10T04:54:50.016606shield sshd\[17098\]: Invalid user fuckface from 148.70.41.33 port 39530
2019-11-10T04:54:50.021051shield sshd\[17098\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.41.33

Nov 10 05:06:07 marvibiene sshd[3234]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.175.169  user=root
Nov 10 05:06:09 marvibiene sshd[3234]: Failed password for root from 222.186.175.169 port 59522 ssh2
Nov 10 05:06:12 marvibiene sshd[3234]: Failed password for root from 222.186.175.169 port 59522 ssh2
Nov 10 05:06:07 marvibiene sshd[3234]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.175.169  user=root
Nov 10 05:06:09 marvibiene sshd[3234]: Failed password for root from 222.186.175.169 port 59522 ssh2
Nov 10 05:06:12 marvibiene sshd[3234]: Failed password for root from 222.186.175.169 port 59522 ssh2
...

Nov 10 01:54:12 firewall sshd[31455]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.204.87.153
Nov 10 01:54:12 firewall sshd[31455]: Invalid user lightdm from 129.204.87.153
Nov 10 01:54:14 firewall sshd[31455]: Failed password for invalid user lightdm from 129.204.87.153 port 40720 ssh2
...

209.17.96.210 was recorded 10 times by 7 hosts attempting to connect to the following ports: 9418,8333,5061,8080,2161,62078,110,5222,389,135. Incident counter (4h, 24h, all-time): 10, 35, 191

Nov 10 07:54:47 hosting sshd[31895]: Invalid user Qwert123# from 125.212.201.7 port 34933
...

MultiHost/MultiPort Probe, Scan, Hack -

2019-11-10T05:53:39.824953struts4.enskede.local sshd\[22479\]: Invalid user pi from 114.5.81.67 port 57792
2019-11-10T05:53:39.825987struts4.enskede.local sshd\[22478\]: Invalid user pi from 114.5.81.67 port 57790
2019-11-10T05:53:40.034664struts4.enskede.local sshd\[22478\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.5.81.67
2019-11-10T05:53:41.483882struts4.enskede.local sshd\[22479\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.5.81.67
2019-11-10T05:53:43.093975struts4.enskede.local sshd\[22478\]: Failed password for invalid user pi from 114.5.81.67 port 57790 ssh2
...

11/10/2019-06:25:58.917828 193.31.24.113 Protocol: 6 SURICATA SMTP tls rejected

Nov 10 05:51:20 meumeu sshd[11075]: Failed password for root from 51.83.74.203 port 50404 ssh2
Nov 10 05:54:51 meumeu sshd[11590]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.83.74.203 
Nov 10 05:54:53 meumeu sshd[11590]: Failed password for invalid user office from 51.83.74.203 port 40754 ssh2
...

Nov  7 21:56:59 microserver sshd[40740]: Failed none for root from 222.186.180.6 port 58450 ssh2
Nov  7 21:57:01 microserver sshd[40740]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.180.6  user=root
Nov  7 21:57:02 microserver sshd[40740]: Failed password for root from 222.186.180.6 port 58450 ssh2
Nov  7 21:57:07 microserver sshd[40740]: Failed password for root from 222.186.180.6 port 58450 ssh2
Nov  7 21:57:11 microserver sshd[40740]: Failed password for root from 222.186.180.6 port 58450 ssh2
Nov  8 04:38:34 microserver sshd[30890]: Failed none for root from 222.186.180.6 port 25926 ssh2
Nov  8 04:38:35 microserver sshd[30890]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.180.6  user=root
Nov  8 04:38:37 microserver sshd[30890]: Failed password for root from 222.186.180.6 port 25926 ssh2
Nov  8 04:38:42 microserver sshd[30890]: Failed password for root from 222.186.180.6 port 25926 ssh2
Nov  8 04:38:47 m

Nov 10 06:10:38 dedicated sshd[29592]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.204.166.240  user=root
Nov 10 06:10:40 dedicated sshd[29592]: Failed password for root from 121.204.166.240 port 49743 ssh2

1573361677 - 11/10/2019 05:54:37 Host: 119.146.201.88/119.146.201.88 Port: 500 UDP Blocked