Postfix RBL failed

Postfix RBL failed

IP was detected trying to Brute-Force SSH, FTP, Web Apps, Port-Scan or Hacking.

IP was detected trying to Brute-Force SSH, FTP, Web Apps, Port-Scan or Hacking.

Email spam message

Jun 16 05:10:11 mail.srvfarm.net postfix/smtpd[915897]: NOQUEUE: reject: RCPT from unknown[217.112.128.161]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Jun 16 05:10:11 mail.srvfarm.net postfix/smtpd[916001]: NOQUEUE: reject: RCPT from unknown[217.112.128.161]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Jun 16 05:10:11 mail.srvfarm.net postfix/smtpd[916085]: NOQUEUE: reject: RCPT from unknown[217.112.128.161]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Jun 16 05:10:13 mail.srvfarm.net postfix/smtpd[906475]: NOQUEUE: reject: RCPT from unknown[217.112.128.161

Jun 16 05:28:44 mail.srvfarm.net postfix/smtpd[953476]: NOQUEUE: reject: RCPT from unknown[217.112.128.208]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Jun 16 05:29:50 mail.srvfarm.net postfix/smtpd[953484]: NOQUEUE: reject: RCPT from unknown[217.112.128.208]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Jun 16 05:36:33 mail.srvfarm.net postfix/smtpd[953473]: NOQUEUE: reject: RCPT from unknown[217.112.128.208]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Jun 16 05:36:33 mail.srvfarm.net postfix/smtpd[936017]: NOQUEUE: reject: RCPT from unknown[217.112.128.208]: 450 4.1.8 

Jun  5 18:05:24 mail.srvfarm.net postfix/smtpd[3172177]: NOQUEUE: reject: RCPT from unknown[217.112.128.61]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Jun  5 18:05:24 mail.srvfarm.net postfix/smtpd[3159447]: NOQUEUE: reject: RCPT from unknown[217.112.128.61]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Jun  5 18:07:13 mail.srvfarm.net postfix/smtpd[3160160]: NOQUEUE: reject: RCPT from unknown[217.112.128.61]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Jun  5 18:07:13 mail.srvfarm.net postfix/smtpd[3160138]: NOQUEUE: reject: RCPT fr

Jun  4 13:55:50 mail.srvfarm.net postfix/smtpd[2502236]: NOQUEUE: reject: RCPT from unknown[217.112.128.207]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Jun  4 13:56:38 mail.srvfarm.net postfix/smtpd[2502231]: NOQUEUE: reject: RCPT from unknown[217.112.128.207]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Jun  4 13:57:06 mail.srvfarm.net postfix/smtpd[2502231]: NOQUEUE: reject: RCPT from unknown[217.112.128.207]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Jun  4 13:57:31 mail.srvfarm.net postfix/smtpd[2502236]: NOQUEUE: reject: RCPT from unknown[217.112.128.207]: 450 4.1.8 

May  7 19:17:07 server postfix/smtpd[19737]: NOQUEUE: reject: RCPT from kinky.zilanco.com[217.112.128.246]: 554 5.7.1 Service unavailable; Client host [217.112.128.246] blocked using zen.spamhaus.org; https://www.spamhaus.org/sbl/query/SBL461503 / https://www.spamhaus.org/sbl/query/SBLCSS; from= to= proto=ESMTP helo=

SpamScore above: 10.0

May  4 13:59:58 mail.srvfarm.net postfix/smtpd[3200928]: NOQUEUE: reject: RCPT from unknown[217.112.128.242]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
May  4 14:02:28 mail.srvfarm.net postfix/smtpd[3194833]: NOQUEUE: reject: RCPT from unknown[217.112.128.242]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
May  4 14:02:28 mail.srvfarm.net postfix/smtpd[3199545]: NOQUEUE: reject: RCPT from unknown[217.112.128.242]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
May  4 14:04:26 mail.srvfarm.net postfix/smtpd[3199545]: NOQUEUE: reject: RCPT fr

Brute force attempt

May  2 05:47:33 mail.srvfarm.net postfix/smtpd[1730651]: NOQUEUE: reject: RCPT from unknown[217.112.128.143]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
May  2 05:49:22 mail.srvfarm.net postfix/smtpd[1728026]: NOQUEUE: reject: RCPT from unknown[217.112.128.143]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
May  2 05:54:07 mail.srvfarm.net postfix/smtpd[1728026]: NOQUEUE: reject: RCPT from unknown[217.112.128.143]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
May  2 05:54:42 mail.srvfarm.net postfix/smtpd[1730698]: NOQUEUE: reject: RCPT from unknown[217.112.128.143]: 450 4.1.8 

Apr 29 22:32:28 web01.agentur-b-2.de postfix/smtpd[1198258]: NOQUEUE: reject: RCPT from unknown[217.112.128.175]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Apr 29 22:32:28 web01.agentur-b-2.de postfix/smtpd[1196196]: NOQUEUE: reject: RCPT from unknown[217.112.128.175]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Apr 29 22:32:28 web01.agentur-b-2.de postfix/smtpd[1200720]: NOQUEUE: reject: RCPT from unknown[217.112.128.175]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Apr 29 22:32:28 web01.agentur-b-2.de postfix/smtpd[1200719]: NOQUEUE: reject: RCPT from unknown[

Apr 27 22:06:27 mail.srvfarm.net postfix/smtpd[579250]: NOQUEUE: reject: RCPT from palliate.kranbery.com[217.112.128.159]: 554 5.7.1 Service unavailable; Client host [217.112.128.159] blocked using zen.spamhaus.org; https://www.spamhaus.org/sbl/query/SBL461503 / https://www.spamhaus.org/sbl/query/SBLCSS; from= to= proto=ESMTP helo=
Apr 27 22:06:32 mail.srvfarm.net postfix/smtpd[578441]: NOQUEUE: reject: RCPT from palliate.kranbery.com[217.112.128.159]: 554 5.7.1 Service unavailable; Client host [217.112.128.159] blocked using zen.spamhaus.org; https://www.spamhaus.org/sbl/query/SBL461503 / https://www.spamhaus.org/sbl/query/SBLCSS; from= to= proto=ESMTP helo=
Apr 27 22:07:00 mail.srvfarm.net postfix/smtpd[583779]: NOQUEUE: reject: RCPT from palliate.kranbery.com[217.112.128.159]: 554 5.7.1 Service unavailable; Client host [217.112.128.

Apr 26 23:36:47 web01.agentur-b-2.de postfix/smtpd[1529141]: NOQUEUE: reject: RCPT from sudden.kranbery.com[217.112.128.183]: 554 5.7.1 Service unavailable; Client host [217.112.128.183] blocked using zen.spamhaus.org; https://www.spamhaus.org/sbl/query/SBLCSS / https://www.spamhaus.org/sbl/query/SBL461503; from= to= proto=ESMTP helo=
Apr 26 23:36:47 web01.agentur-b-2.de postfix/smtpd[1530498]: NOQUEUE: reject: RCPT from sudden.kranbery.com[217.112.128.183]: 554 5.7.1 Service unavailable; Client host [217.112.128.183] blocked using zen.spamhaus.org; https://www.spamhaus.org/sbl/query/SBLCSS / https://www.spamhaus.org/sbl/query/SBL461503; from= to= proto=ESMTP helo=
Apr 26 23:36:47 web01.agentur-b-2.de postfix/smtpd[1531377]: NOQUEUE: reject: RCPT from sudden.kranbery.com[217.112.128.183]: 554 5.7.1 Service unavailable; Client host [217.112.128.183] blocked us

PHISHING
support@rabfakohqeperzkx.cu
return@kabatamaraya.com
Received: from nja6.virnah.pw (nja6.virnah.pw. 185.162.10.199

$f2bV_matches

Lines containing failures of 50.66.157.156
Jul 23 03:43:03 penfold sshd[9718]: Invalid user uym from 50.66.157.156 port 60362
Jul 23 03:43:03 penfold sshd[9718]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=50.66.157.156 
Jul 23 03:43:05 penfold sshd[9718]: Failed password for invalid user uym from 50.66.157.156 port 60362 ssh2
Jul 23 03:43:06 penfold sshd[9718]: Received disconnect from 50.66.157.156 port 60362:11: Bye Bye [preauth]
Jul 23 03:43:06 penfold sshd[9718]: Disconnected from invalid user uym 50.66.157.156 port 60362 [preauth]
Jul 23 03:50:25 penfold sshd[10104]: Invalid user llb from 50.66.157.156 port 52890
Jul 23 03:50:25 penfold sshd[10104]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=50.66.157.156 
Jul 23 03:50:27 penfold sshd[10104]: Failed password for invalid user llb from 50.66.157.156 port 52890 ssh2


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=50.6

2020-07-24T05:04:19.599269dmca.cloudsearch.cf sshd[31554]: Invalid user  from 87.251.74.30 port 36708
2020-07-24T05:04:19.611062dmca.cloudsearch.cf sshd[31555]: Invalid user admin from 87.251.74.30 port 36774
2020-07-24T05:04:19.599269dmca.cloudsearch.cf sshd[31554]: Invalid user  from 87.251.74.30 port 36708
2020-07-24T05:04:20.024409dmca.cloudsearch.cf sshd[31554]: Failed none for invalid user  from 87.251.74.30 port 36708 ssh2
2020-07-24T05:04:21.217117dmca.cloudsearch.cf sshd[31560]: Invalid user user from 87.251.74.30 port 61366
...

"XSS Attack Detected via libinjection - Matched Data: XSS data found within ARGS_NAMES:

 TCP (SYN) 171.233.238.70:23784 -> port 81, len 44

1595568064 - 07/24/2020 07:21:04 Host: 59.125.118.10/59.125.118.10 Port: 445 TCP Blocked

Automatic report - Port Scan Attack

2020-07-24T07:27:31.226604mail.broermann.family sshd[12223]: Invalid user walter from 182.151.15.175 port 36794
2020-07-24T07:27:31.232602mail.broermann.family sshd[12223]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.151.15.175
2020-07-24T07:27:31.226604mail.broermann.family sshd[12223]: Invalid user walter from 182.151.15.175 port 36794
2020-07-24T07:27:33.064904mail.broermann.family sshd[12223]: Failed password for invalid user walter from 182.151.15.175 port 36794 ssh2
2020-07-24T07:29:59.633674mail.broermann.family sshd[12311]: Invalid user ftpuser from 182.151.15.175 port 49818
...

Jul 24 07:13:03 meumeu sshd[1446267]: Invalid user apoio from 106.13.119.163 port 52800
Jul 24 07:13:03 meumeu sshd[1446267]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.119.163 
Jul 24 07:13:03 meumeu sshd[1446267]: Invalid user apoio from 106.13.119.163 port 52800
Jul 24 07:13:05 meumeu sshd[1446267]: Failed password for invalid user apoio from 106.13.119.163 port 52800 ssh2
Jul 24 07:17:06 meumeu sshd[1446376]: Invalid user alpha from 106.13.119.163 port 42794
Jul 24 07:17:06 meumeu sshd[1446376]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.119.163 
Jul 24 07:17:06 meumeu sshd[1446376]: Invalid user alpha from 106.13.119.163 port 42794
Jul 24 07:17:08 meumeu sshd[1446376]: Failed password for invalid user alpha from 106.13.119.163 port 42794 ssh2
Jul 24 07:20:57 meumeu sshd[1446463]: Invalid user kys from 106.13.119.163 port 33360
...

Jul 24 06:59:08 ns392434 sshd[12767]: Invalid user git from 112.21.191.54 port 43812
Jul 24 06:59:08 ns392434 sshd[12767]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.21.191.54
Jul 24 06:59:08 ns392434 sshd[12767]: Invalid user git from 112.21.191.54 port 43812
Jul 24 06:59:11 ns392434 sshd[12767]: Failed password for invalid user git from 112.21.191.54 port 43812 ssh2
Jul 24 07:17:03 ns392434 sshd[13333]: Invalid user bj from 112.21.191.54 port 52374
Jul 24 07:17:03 ns392434 sshd[13333]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.21.191.54
Jul 24 07:17:03 ns392434 sshd[13333]: Invalid user bj from 112.21.191.54 port 52374
Jul 24 07:17:06 ns392434 sshd[13333]: Failed password for invalid user bj from 112.21.191.54 port 52374 ssh2
Jul 24 07:20:47 ns392434 sshd[13371]: Invalid user jobs from 112.21.191.54 port 39928

Host Scan

Unauthorized connection attempt detected from IP address 194.180.224.103 to port 22

2020-07-24T05:20:40+0000 Failed SSH Authentication/Brute Force Attack. (Server 6)

Jul 24 05:16:41 vlre-nyc-1 sshd\[26637\]: Invalid user yong from 49.232.83.75
Jul 24 05:16:41 vlre-nyc-1 sshd\[26637\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.232.83.75
Jul 24 05:16:43 vlre-nyc-1 sshd\[26637\]: Failed password for invalid user yong from 49.232.83.75 port 48670 ssh2
Jul 24 05:20:51 vlre-nyc-1 sshd\[26696\]: Invalid user apacheds from 49.232.83.75
Jul 24 05:20:51 vlre-nyc-1 sshd\[26696\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.232.83.75
...