They took over somehow my domain. I believe they have some buggy DNS servers that allow it do such thing. While they do have my domain for a little while - they are using my company's real email address to send tons of emails to nonexistent email recipients (hotmail, yahoo, google, etc. (public mail providers)). After a little while I get back tons of NDRs in my SMTP gateways and in corresponding user mailbox. Now the tricky part - I have to be on time when NDRs come in my SMTP gateway - because I have to remove them as soon as possible or there will be another loop and I my SMTP gateway will banned to global spam lists (p.s. It is banned now)

php WP PHPmyadamin ABUSE blocked for 12h

Jul 30 08:38:39 rocket sshd[21778]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.89.251.105
Jul 30 08:38:41 rocket sshd[21778]: Failed password for invalid user grid from 36.89.251.105 port 55348 ssh2
Jul 30 08:43:39 rocket sshd[22555]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.89.251.105
...

Invalid user liucanbin from 51.83.125.8 port 49976

[2020-07-30 03:32:32] NOTICE[1248] chan_sip.c: Registration from '"860"' failed for '212.83.132.45:9522' - Wrong password
[2020-07-30 03:32:32] SECURITY[1275] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-07-30T03:32:32.846-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="860",SessionID="0x7f2720091b18",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/212.83.132.45/9522",Challenge="65acdead",ReceivedChallenge="65acdead",ReceivedHash="47efc2f08bc7e14c721e666a98848432"
[2020-07-30 03:33:36] NOTICE[1248] chan_sip.c: Registration from '"867"' failed for '212.83.132.45:9846' - Wrong password
[2020-07-30 03:33:36] SECURITY[1275] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-07-30T03:33:36.779-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="867",SessionID="0x7f27200510e8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/212.83.132
...

Jul 30 01:09:27 george sshd[31347]: Failed password for invalid user torque from 179.107.7.148 port 46164 ssh2
Jul 30 01:14:23 george sshd[31404]: Invalid user student1 from 179.107.7.148 port 54520
Jul 30 01:14:23 george sshd[31404]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=179.107.7.148 
Jul 30 01:14:24 george sshd[31404]: Failed password for invalid user student1 from 179.107.7.148 port 54520 ssh2
Jul 30 01:19:21 george sshd[31471]: Invalid user lgb from 179.107.7.148 port 34654
...

Invalid user ons from 122.144.212.144 port 55725

Jul 30 09:36:49 debian-2gb-nbg1-2 kernel: \[18353101.483612\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=45.134.179.57 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=10573 PROTO=TCP SPT=49374 DPT=488 WINDOW=1024 RES=0x00 SYN URGP=0

Jul 30 06:58:24 rush sshd[17218]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.53.12.94
Jul 30 06:58:26 rush sshd[17218]: Failed password for invalid user emuser from 120.53.12.94 port 57278 ssh2
Jul 30 07:03:19 rush sshd[17310]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.53.12.94
...

Jul 30 05:51:34 root sshd[23756]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.47.8.199 
Jul 30 05:51:36 root sshd[23756]: Failed password for invalid user wangjf from 58.47.8.199 port 50235 ssh2
Jul 30 05:51:53 root sshd[23784]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.47.8.199 
...

Scanning for exploits - /wp-config.php

07/29/2020-23:51:51.324142 58.58.51.142 Protocol: 6 ET SCAN Suspicious inbound to MSSQL port 1433

invalid user

ET COMPROMISED Known Compromised or Hostile Host Traffic group 9 - port: 22 proto: tcp cat: Misc Attackbytes: 60

Jul 29 20:21:31 web9 sshd\[28775\]: Invalid user user14 from 59.127.152.203
Jul 29 20:21:31 web9 sshd\[28775\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=59.127.152.203
Jul 29 20:21:33 web9 sshd\[28775\]: Failed password for invalid user user14 from 59.127.152.203 port 47900 ssh2
Jul 29 20:26:22 web9 sshd\[29521\]: Invalid user gzy from 59.127.152.203
Jul 29 20:26:22 web9 sshd\[29521\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=59.127.152.203