Postfix RBL failed

IP was detected trying to Brute-Force SSH, FTP, Web Apps, Port-Scan or Hacking.

IP was detected trying to Brute-Force SSH, FTP, Web Apps, Port-Scan or Hacking.

Email spam message

Jun 16 05:10:11 mail.srvfarm.net postfix/smtpd[915897]: NOQUEUE: reject: RCPT from unknown[217.112.128.161]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Jun 16 05:10:11 mail.srvfarm.net postfix/smtpd[916001]: NOQUEUE: reject: RCPT from unknown[217.112.128.161]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Jun 16 05:10:11 mail.srvfarm.net postfix/smtpd[916085]: NOQUEUE: reject: RCPT from unknown[217.112.128.161]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Jun 16 05:10:13 mail.srvfarm.net postfix/smtpd[906475]: NOQUEUE: reject: RCPT from unknown[217.112.128.161

Jun 16 05:28:44 mail.srvfarm.net postfix/smtpd[953476]: NOQUEUE: reject: RCPT from unknown[217.112.128.208]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Jun 16 05:29:50 mail.srvfarm.net postfix/smtpd[953484]: NOQUEUE: reject: RCPT from unknown[217.112.128.208]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Jun 16 05:36:33 mail.srvfarm.net postfix/smtpd[953473]: NOQUEUE: reject: RCPT from unknown[217.112.128.208]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Jun 16 05:36:33 mail.srvfarm.net postfix/smtpd[936017]: NOQUEUE: reject: RCPT from unknown[217.112.128.208]: 450 4.1.8 

Jun  5 18:05:24 mail.srvfarm.net postfix/smtpd[3172177]: NOQUEUE: reject: RCPT from unknown[217.112.128.61]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Jun  5 18:05:24 mail.srvfarm.net postfix/smtpd[3159447]: NOQUEUE: reject: RCPT from unknown[217.112.128.61]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Jun  5 18:07:13 mail.srvfarm.net postfix/smtpd[3160160]: NOQUEUE: reject: RCPT from unknown[217.112.128.61]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Jun  5 18:07:13 mail.srvfarm.net postfix/smtpd[3160138]: NOQUEUE: reject: RCPT fr

Jun  4 13:55:50 mail.srvfarm.net postfix/smtpd[2502236]: NOQUEUE: reject: RCPT from unknown[217.112.128.207]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Jun  4 13:56:38 mail.srvfarm.net postfix/smtpd[2502231]: NOQUEUE: reject: RCPT from unknown[217.112.128.207]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Jun  4 13:57:06 mail.srvfarm.net postfix/smtpd[2502231]: NOQUEUE: reject: RCPT from unknown[217.112.128.207]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Jun  4 13:57:31 mail.srvfarm.net postfix/smtpd[2502236]: NOQUEUE: reject: RCPT from unknown[217.112.128.207]: 450 4.1.8 

May  7 19:17:07 server postfix/smtpd[19737]: NOQUEUE: reject: RCPT from kinky.zilanco.com[217.112.128.246]: 554 5.7.1 Service unavailable; Client host [217.112.128.246] blocked using zen.spamhaus.org; https://www.spamhaus.org/sbl/query/SBL461503 / https://www.spamhaus.org/sbl/query/SBLCSS; from= to= proto=ESMTP helo=

SpamScore above: 10.0

May  4 13:59:58 mail.srvfarm.net postfix/smtpd[3200928]: NOQUEUE: reject: RCPT from unknown[217.112.128.242]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
May  4 14:02:28 mail.srvfarm.net postfix/smtpd[3194833]: NOQUEUE: reject: RCPT from unknown[217.112.128.242]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
May  4 14:02:28 mail.srvfarm.net postfix/smtpd[3199545]: NOQUEUE: reject: RCPT from unknown[217.112.128.242]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
May  4 14:04:26 mail.srvfarm.net postfix/smtpd[3199545]: NOQUEUE: reject: RCPT fr

Brute force attempt

May  2 05:47:33 mail.srvfarm.net postfix/smtpd[1730651]: NOQUEUE: reject: RCPT from unknown[217.112.128.143]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
May  2 05:49:22 mail.srvfarm.net postfix/smtpd[1728026]: NOQUEUE: reject: RCPT from unknown[217.112.128.143]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
May  2 05:54:07 mail.srvfarm.net postfix/smtpd[1728026]: NOQUEUE: reject: RCPT from unknown[217.112.128.143]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
May  2 05:54:42 mail.srvfarm.net postfix/smtpd[1730698]: NOQUEUE: reject: RCPT from unknown[217.112.128.143]: 450 4.1.8 

Apr 29 22:32:28 web01.agentur-b-2.de postfix/smtpd[1198258]: NOQUEUE: reject: RCPT from unknown[217.112.128.175]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Apr 29 22:32:28 web01.agentur-b-2.de postfix/smtpd[1196196]: NOQUEUE: reject: RCPT from unknown[217.112.128.175]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Apr 29 22:32:28 web01.agentur-b-2.de postfix/smtpd[1200720]: NOQUEUE: reject: RCPT from unknown[217.112.128.175]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Apr 29 22:32:28 web01.agentur-b-2.de postfix/smtpd[1200719]: NOQUEUE: reject: RCPT from unknown[

Apr 27 22:06:27 mail.srvfarm.net postfix/smtpd[579250]: NOQUEUE: reject: RCPT from palliate.kranbery.com[217.112.128.159]: 554 5.7.1 Service unavailable; Client host [217.112.128.159] blocked using zen.spamhaus.org; https://www.spamhaus.org/sbl/query/SBL461503 / https://www.spamhaus.org/sbl/query/SBLCSS; from= to= proto=ESMTP helo=
Apr 27 22:06:32 mail.srvfarm.net postfix/smtpd[578441]: NOQUEUE: reject: RCPT from palliate.kranbery.com[217.112.128.159]: 554 5.7.1 Service unavailable; Client host [217.112.128.159] blocked using zen.spamhaus.org; https://www.spamhaus.org/sbl/query/SBL461503 / https://www.spamhaus.org/sbl/query/SBLCSS; from= to= proto=ESMTP helo=
Apr 27 22:07:00 mail.srvfarm.net postfix/smtpd[583779]: NOQUEUE: reject: RCPT from palliate.kranbery.com[217.112.128.159]: 554 5.7.1 Service unavailable; Client host [217.112.128.

Apr 26 23:36:47 web01.agentur-b-2.de postfix/smtpd[1529141]: NOQUEUE: reject: RCPT from sudden.kranbery.com[217.112.128.183]: 554 5.7.1 Service unavailable; Client host [217.112.128.183] blocked using zen.spamhaus.org; https://www.spamhaus.org/sbl/query/SBLCSS / https://www.spamhaus.org/sbl/query/SBL461503; from= to= proto=ESMTP helo=
Apr 26 23:36:47 web01.agentur-b-2.de postfix/smtpd[1530498]: NOQUEUE: reject: RCPT from sudden.kranbery.com[217.112.128.183]: 554 5.7.1 Service unavailable; Client host [217.112.128.183] blocked using zen.spamhaus.org; https://www.spamhaus.org/sbl/query/SBLCSS / https://www.spamhaus.org/sbl/query/SBL461503; from= to= proto=ESMTP helo=
Apr 26 23:36:47 web01.agentur-b-2.de postfix/smtpd[1531377]: NOQUEUE: reject: RCPT from sudden.kranbery.com[217.112.128.183]: 554 5.7.1 Service unavailable; Client host [217.112.128.183] blocked us

May 11 13:49:16 web1 sshd[7321]: Invalid user admin from 132.145.146.78 port 40892
May 11 13:49:16 web1 sshd[7321]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=132.145.146.78
May 11 13:49:16 web1 sshd[7321]: Invalid user admin from 132.145.146.78 port 40892
May 11 13:49:17 web1 sshd[7321]: Failed password for invalid user admin from 132.145.146.78 port 40892 ssh2
May 11 13:55:29 web1 sshd[8922]: Invalid user postgres from 132.145.146.78 port 57640
May 11 13:55:29 web1 sshd[8922]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=132.145.146.78
May 11 13:55:29 web1 sshd[8922]: Invalid user postgres from 132.145.146.78 port 57640
May 11 13:55:31 web1 sshd[8922]: Failed password for invalid user postgres from 132.145.146.78 port 57640 ssh2
May 11 14:01:05 web1 sshd[10314]: Invalid user steffi from 132.145.146.78 port 38694
...

(smtpauth) Failed SMTP AUTH login from 191.53.52.126 (BR/Brazil/191-53-52-126.vze-wr.mastercabo.com.br): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 2020-05-11 08:18:36 plain authenticator failed for ([191.53.52.126]) [191.53.52.126]: 535 Incorrect authentication data (set_id=job)

20/5/10@23:48:28: FAIL: Alarm-Network address from=14.161.221.67
...

2020-05-10 UTC: (2x) - adminuser,root

May 11 05:48:30 debian-2gb-nbg1-2 kernel: \[11427779.370759\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=42.2.180.164 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=51 ID=57767 PROTO=TCP SPT=18105 DPT=5555 WINDOW=31105 RES=0x00 SYN URGP=0

Fail2Ban Ban Triggered

SSH/22 MH Probe, BF, Hack -

20/5/11@02:17:23: FAIL: IoT-SSH address from=201.238.193.40
...

May 11 10:00:50 ip-172-31-61-156 sshd[25487]: Failed password for invalid user amavis from 31.27.216.108 port 37654 ssh2
May 11 10:00:48 ip-172-31-61-156 sshd[25487]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.27.216.108
May 11 10:00:48 ip-172-31-61-156 sshd[25487]: Invalid user amavis from 31.27.216.108
May 11 10:00:50 ip-172-31-61-156 sshd[25487]: Failed password for invalid user amavis from 31.27.216.108 port 37654 ssh2
May 11 10:04:23 ip-172-31-61-156 sshd[25625]: Invalid user salavdor from 31.27.216.108
...

May 11 00:23:45 web1 sshd\[7471\]: Invalid user tn from 24.72.212.241
May 11 00:23:45 web1 sshd\[7471\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=24.72.212.241
May 11 00:23:47 web1 sshd\[7471\]: Failed password for invalid user tn from 24.72.212.241 port 56604 ssh2
May 11 00:28:58 web1 sshd\[7963\]: Invalid user admin from 24.72.212.241
May 11 00:28:58 web1 sshd\[7963\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=24.72.212.241

$f2bV_matches

May 11 12:19:43 debian-2gb-nbg1-2 kernel: \[11451251.488055\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=195.54.167.12 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=245 ID=44928 PROTO=TCP SPT=49045 DPT=6959 WINDOW=1024 RES=0x00 SYN URGP=0

2020-05-11T03:44:30.959193dmca.cloudsearch.cf sshd[31988]: Invalid user ubuntu from 222.73.129.15 port 34533
2020-05-11T03:44:30.966635dmca.cloudsearch.cf sshd[31988]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.73.129.15
2020-05-11T03:44:30.959193dmca.cloudsearch.cf sshd[31988]: Invalid user ubuntu from 222.73.129.15 port 34533
2020-05-11T03:44:33.332125dmca.cloudsearch.cf sshd[31988]: Failed password for invalid user ubuntu from 222.73.129.15 port 34533 ssh2
2020-05-11T03:48:40.169949dmca.cloudsearch.cf sshd[32229]: Invalid user doloczki from 222.73.129.15 port 46914
2020-05-11T03:48:40.176899dmca.cloudsearch.cf sshd[32229]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.73.129.15
2020-05-11T03:48:40.169949dmca.cloudsearch.cf sshd[32229]: Invalid user doloczki from 222.73.129.15 port 46914
2020-05-11T03:48:42.527653dmca.cloudsearch.cf sshd[32229]: Failed password for invalid user doloczki fro
...

May 11 11:00:19 ns3164893 sshd[10899]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.50.202.61
May 11 11:00:21 ns3164893 sshd[10899]: Failed password for invalid user ftpuser from 85.50.202.61 port 49962 ssh2
...

May 11 05:38:31 roki-contabo sshd\[4233\]: Invalid user hadoop from 129.204.181.48
May 11 05:38:31 roki-contabo sshd\[4233\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.204.181.48
May 11 05:38:33 roki-contabo sshd\[4233\]: Failed password for invalid user hadoop from 129.204.181.48 port 34346 ssh2
May 11 05:48:27 roki-contabo sshd\[4438\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.204.181.48  user=root
May 11 05:48:29 roki-contabo sshd\[4438\]: Failed password for root from 129.204.181.48 port 44482 ssh2
...