Sep 13 08:22:02 mail.srvfarm.net postfix/smtpd[1001726]: NOQUEUE: reject: RCPT from unknown[195.62.32.221]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Sep 13 08:22:02 mail.srvfarm.net postfix/smtpd[1001726]: NOQUEUE: reject: RCPT from unknown[195.62.32.221]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Sep 13 08:27:02 mail.srvfarm.net postfix/smtpd[1001562]: NOQUEUE: reject: RCPT from unknown[195.62.32.221]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Sep 13 08:27:02 mail.srvfarm.net postfix/smtpd[1001562]: NOQUEUE: reject: RCPT from unknown[195.62.32.221]: 450 4.7.1 : Helo command rejected: Host not foun

Sep 13 08:22:02 mail.srvfarm.net postfix/smtpd[1001726]: NOQUEUE: reject: RCPT from unknown[195.62.32.221]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Sep 13 08:22:02 mail.srvfarm.net postfix/smtpd[1001726]: NOQUEUE: reject: RCPT from unknown[195.62.32.221]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Sep 13 08:27:02 mail.srvfarm.net postfix/smtpd[1001562]: NOQUEUE: reject: RCPT from unknown[195.62.32.221]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Sep 13 08:27:02 mail.srvfarm.net postfix/smtpd[1001562]: NOQUEUE: reject: RCPT from unknown[195.62.32.221]: 450 4.7.1 : Helo command rejected: Host not foun

PHISHING AND SPAM ATTACK
GROUP USES LayerHost, IP SERVER LLC, Root Networks LLC, Serverion BV, XSServer GmbH, Xervers, Colocrossing
31.210.22.63	Dental Health Issues? - DentalHealthIssues@leadentox.us, This formula is support your healthy teeth, keeping them strong and your breath fresh, 3 Jul 2021 
157.52.177.152	Want Free HD TV? - WantFreeHDTV@antennaology.co, A new product you won’t pass on, 3 Jul 2021
157.52.177.155	Car Warranty - ChoiceAutoWarranty@monsterfx.co, Spread some Holiday Cheer and Never have to Pay for Another Repair!, 3 Jul 2021
195.62.32.81	Stop Cold Sores - RemoveHerpesForever@herpitch.co, Herpes Virus Killer Founds Inside Left Brain, 3 Jul 2021
195.62.32.129	Nanolon Fiber - NanolonFiber@massivemalez.us, Your paper towel is poisoning our environment..., 3 Jul 2021
198.12.127.171 	Life Extension - tony@gmail.com, Kidney dialysis: When is it time to stop?, 3 Jul 2021
OrgName: 	LayerHost, AND SERVER-31-210-22-0 country: NL, netname: SERVER-185-239-242-0 country: NL  AND RU-IPSERVER-20190206, Serverion
NetRange:       31.210.22.0 - 31.210.23.255	org-name:       Serverion BV
NetRange:       157.52.128.0 - 157.52.255.255	OrgName:        LayerHost
NetRange:       185.239.242.0 - 185.239.242.255	org-name:       Serverion BV
inetnum:        194.59.216.0 - 194.59.217.255	org-name:       Serverion BV
inetnum:        195.62.32.0 - 195.62.33.255	org-name:       XSServer GmbH
inetnum:        195.133.12.0 - 195.133.15.255   netname:        Xervers
inetnum:        195.133.39.0 - 195.133.39.255	org-name:       Serverion BV
NetRange:       198.12.64.0 - 198.12.127.255	OrgName:        ColoCrossing

PHISHING ATTACK
195.62.32.183 The First 72 Hours - TheFirst72Hours@divinelockx.us - Did Costco Just Try and CRUSH Conservatives?, Sun, 16 May 2021
inetnum:        195.62.32.0 - 195.62.33.255
org-name:       XSServer GmbH
Other emails from same group
195.62.32.65 Vaccine Survey -CovidSurvey@eyefloters.buzz- COVID-19 vaccine research survey, Sat, 15 May 2021 
195.62.32.183 The First 72 Hours - TheFirst72Hours@divinelockx.us - Did Costco Just Try and CRUSH Conservatives?, Sun, 16 May 2021

195.62.32.65 Vaccine Survey -CovidSurvey@eyefloters.buzz- COVID-19 vaccine research survey, Sat, 15 May 2021
inetnum:        195.62.32.0 - 195.62.33.255
org-name:       XSServer GmbH

PHISHING ATTACK
Transparent Face Visor - ClearShield@sugartonic.icu : 
"Wear the Mouth Visor and smile freely!" :
from [195.62.32.23] (port=55637 helo=nate.sugartonic.icu)  :
Thu, 31 Dec 2020 00:28:31 +1100

PHISHING ATTACK
Meet Ultrazoom  : 
"Super Telephoto Zoom Monocular Telescope" :
from [195.62.32.21] (port=49191 helo=yoke.bloodpressure.buzz) :
Wed, 30 Dec 2020 22:04:26 +1100

PHISHING ATTACK
Magical Sandals : 
"Wear these Sandals and pain is gone.":
from [195.62.32.179] (port=33498 helo=ping.shinehead.bid):
Sat, 26 Dec 2020 22:49:08 +1100

Holiday Sale  : The low energy heater : 
from [195.62.32.173] (port=54745 helo=irene.woodsworking.co) :
Sun, 27 Dec 2020 01:04:41 +1100

multiple daily spam from:195.62.32.154/195.62.32.173

multiple daily email spam from:195.62.32.173/195.62.32.154/195.62.32.176/

Sep 12 22:41:49 web01.agentur-b-2.de postfix/smtpd[2309467]: NOQUEUE: reject: RCPT from unknown[195.62.32.227]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Sep 12 22:41:49 web01.agentur-b-2.de postfix/smtpd[2309467]: NOQUEUE: reject: RCPT from unknown[195.62.32.227]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Sep 12 22:41:52 web01.agentur-b-2.de postfix/smtpd[2330232]: NOQUEUE: reject: RCPT from unknown[195.62.32.227]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Sep 12 22:46:50 web01.agentur-b-2.de postfix/smtpd[2330232]: NOQUEUE: reject: RCPT from unknown[195.62.32.227]: 450 4.7.1 : Helo comman

Sep 12 22:41:49 web01.agentur-b-2.de postfix/smtpd[2309467]: NOQUEUE: reject: RCPT from unknown[195.62.32.227]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Sep 12 22:41:49 web01.agentur-b-2.de postfix/smtpd[2309467]: NOQUEUE: reject: RCPT from unknown[195.62.32.227]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Sep 12 22:41:52 web01.agentur-b-2.de postfix/smtpd[2330232]: NOQUEUE: reject: RCPT from unknown[195.62.32.227]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Sep 12 22:46:50 web01.agentur-b-2.de postfix/smtpd[2330232]: NOQUEUE: reject: RCPT from unknown[195.62.32.227]: 450 4.7.1 : Helo comman

mutliple daily email spam from:<17_116639-_17@nor.nosathe.de>

Daily mutiple spam  

Daily spam 

\[May  7 23:01:22\] NOTICE\[2019\] chan_sip.c: Registration from '\' failed for '195.62.32.50:57986' - Wrong password
\[May  7 23:02:14\] NOTICE\[2019\] chan_sip.c: Registration from '\' failed for '195.62.32.50:50409' - Wrong password
\[May  7 23:03:56\] NOTICE\[2019\] chan_sip.c: Registration from '\' failed for '195.62.32.50:51522' - Wrong password
\[May  7 23:04:52\] NOTICE\[2019\] chan_sip.c: Registration from '\' failed for '195.62.32.50:60697' - Wrong password
\[May  7 23:05:46\] NOTICE\[2019\] chan_sip.c: Registration from '\' failed for '195.62.32.50:53545' - Wrong password
\[May  7 23:06:39\] NOTICE\[2019\] chan_sip.c: Registration from '\' failed for '195.62.32.50:62449' - Wrong password
\[May  7 23:07:33\] NOTICE\[2019\] chan_sip.c: Registration from '\' failed for '19
...

2019-09-19T19:13:08.8141471495-001 sshd\[5263\]: Invalid user jobe from 187.188.193.211 port 46510
2019-09-19T19:13:08.8215441495-001 sshd\[5263\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=fixed-187-188-193-211.totalplay.net
2019-09-19T19:13:10.6526821495-001 sshd\[5263\]: Failed password for invalid user jobe from 187.188.193.211 port 46510 ssh2
2019-09-19T19:17:23.0464941495-001 sshd\[5551\]: Invalid user bk from 187.188.193.211 port 60194
2019-09-19T19:17:23.0544531495-001 sshd\[5551\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=fixed-187-188-193-211.totalplay.net
2019-09-19T19:17:25.1666051495-001 sshd\[5551\]: Failed password for invalid user bk from 187.188.193.211 port 60194 ssh2
...

Sep 20 00:47:44 microserver sshd[31010]: Invalid user jose from 220.117.175.165 port 50276
Sep 20 00:47:44 microserver sshd[31010]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=220.117.175.165
Sep 20 00:47:45 microserver sshd[31010]: Failed password for invalid user jose from 220.117.175.165 port 50276 ssh2
Sep 20 00:53:04 microserver sshd[31702]: Invalid user weblogic from 220.117.175.165 port 35738
Sep 20 00:53:04 microserver sshd[31702]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=220.117.175.165
Sep 20 01:04:08 microserver sshd[33168]: Invalid user transfer from 220.117.175.165 port 34902
Sep 20 01:04:08 microserver sshd[33168]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=220.117.175.165
Sep 20 01:04:10 microserver sshd[33168]: Failed password for invalid user transfer from 220.117.175.165 port 34902 ssh2
Sep 20 01:09:30 microserver sshd[33864]: Invalid user rf from 220.117.17

IP Ban Report : https://help-dysk.pl/wordpress-firewall-plugins/ip/107.158.223.153/ 
 NL - 1H : (40)  
 Protection Against DDoS WordPress plugin :  
 "odzyskiwanie danych help-dysk" 
 IP Address Ranges by Country : NL 
 NAME ASN : ASN49532 
 
 IP : 107.158.223.153 
 
 CIDR : 107.158.220.0/22 
 
 PREFIX COUNT : 23 
 
 UNIQUE IP COUNT : 23552 
 
 
 WYKRYTE ATAKI Z ASN49532 :  
  1H - 1 
  3H - 3 
  6H - 3 
 12H - 11 
 24H - 16 
 
 INFO : Looking for resource vulnerabilities 403 Detected and Blocked by ADMIN  - data recovery

Sep 20 01:04:10 vpn01 sshd\[18916\]: Invalid user abell from 188.213.49.176
Sep 20 01:04:10 vpn01 sshd\[18916\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.213.49.176
Sep 20 01:04:12 vpn01 sshd\[18916\]: Failed password for invalid user abell from 188.213.49.176 port 33358 ssh2

[munged]::443 165.22.19.102 - - [20/Sep/2019:01:44:23 +0200] "POST /[munged]: HTTP/1.1" 200 9079 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
[munged]::443 165.22.19.102 - - [20/Sep/2019:01:44:27 +0200] "POST /[munged]: HTTP/1.1" 200 9079 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
[munged]::443 165.22.19.102 - - [20/Sep/2019:01:44:27 +0200] "POST /[munged]: HTTP/1.1" 200 9079 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
[munged]::443 165.22.19.102 - - [20/Sep/2019:01:44:29 +0200] "POST /[munged]: HTTP/1.1" 200 9079 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
[munged]::443 165.22.19.102 - - [20/Sep/2019:01:44:29 +0200] "POST /[munged]: HTTP/1.1" 200 9079 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
[munged]::443 165.22.19.102 - - [20/Sep/2019:01:44:30 +0200] "POST /[munged]: HTTP/1.1" 200 9079 "-" "Mozilla/5.0 (X11; Ubun

scan z

$f2bV_matches

Sep 19 13:45:35 php1 sshd\[18536\]: Invalid user nagios from 43.227.68.60
Sep 19 13:45:35 php1 sshd\[18536\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.227.68.60
Sep 19 13:45:37 php1 sshd\[18536\]: Failed password for invalid user nagios from 43.227.68.60 port 44716 ssh2
Sep 19 13:49:39 php1 sshd\[18864\]: Invalid user to from 43.227.68.60
Sep 19 13:49:39 php1 sshd\[18864\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.227.68.60

Unauthorized connection attempt from IP address 105.247.158.232 on Port 445(SMB)

Unauthorized connection attempt from IP address 117.4.192.89 on Port 445(SMB)

Unauthorized connection attempt from IP address 176.113.128.114 on Port 445(SMB)

web-1 [ssh_2] SSH Attack

Unauthorized connection attempt from IP address 168.167.79.69 on Port 445(SMB)

Automatic report - Banned IP Access

Sep 20 00:37:42 jane sshd[8674]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=151.80.207.9 
Sep 20 00:37:44 jane sshd[8674]: Failed password for invalid user edi from 151.80.207.9 port 41678 ssh2
...