Return-Path: 
Received: from mail-pl1-x642.google.com ([IPv6:2607:f8b0:4864:20::642])
	by resimta-po-33v.sys.comcast.net with ESMTP
	id CqkokUJQKq7VyCqn3k1cPA; Mon, 31 Aug 2020 20:52:33 +0000
From: "Membership Reminder" 
Subject: Notification: Your membership service not yet confirmed, we tried
 to bill you automatically

NETFLIX

Something went wrong

We have been notified that you questioned a Netflix charge for the payment method we have on file and have terminated your membership.

We would like you to come back. If you change your mind, just restart your membership to enjoy the best TV shows and movies without interruption.

Restart Now 

SSH invalid-user multiple login try

Apr 19 13:59:45 srv01 sshd[18506]: Invalid user cu from 222.239.124.19 port 38750
Apr 19 13:59:45 srv01 sshd[18506]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.239.124.19
Apr 19 13:59:45 srv01 sshd[18506]: Invalid user cu from 222.239.124.19 port 38750
Apr 19 13:59:48 srv01 sshd[18506]: Failed password for invalid user cu from 222.239.124.19 port 38750 ssh2
Apr 19 14:04:40 srv01 sshd[18833]: Invalid user vmware from 222.239.124.19 port 43486
...

SSH Brute-Force reported by Fail2Ban

SSH invalid-user multiple login try

Apr 19 09:05:50 firewall sshd[21452]: Invalid user test from 109.255.108.166
Apr 19 09:05:52 firewall sshd[21452]: Failed password for invalid user test from 109.255.108.166 port 45872 ssh2
Apr 19 09:12:14 firewall sshd[21598]: Invalid user bu from 109.255.108.166
...

Apr 19 08:15:51 ny01 sshd[16326]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.109.213
Apr 19 08:15:53 ny01 sshd[16326]: Failed password for invalid user ubuntu from 157.245.109.213 port 48934 ssh2
Apr 19 08:19:40 ny01 sshd[16826]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.109.213

(smtpauth) Failed SMTP AUTH login from 183.162.144.93 (CN/China/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 2020-04-19 16:34:52 login authenticator failed for (nAYmryL) [183.162.144.93]: 535 Incorrect authentication data (set_id=info)

Apr 19 14:54:50 hosting sshd[30143]: Invalid user wg from 159.65.152.201 port 43596
Apr 19 14:54:50 hosting sshd[30143]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.65.152.201
Apr 19 14:54:50 hosting sshd[30143]: Invalid user wg from 159.65.152.201 port 43596
Apr 19 14:54:53 hosting sshd[30143]: Failed password for invalid user wg from 159.65.152.201 port 43596 ssh2
Apr 19 15:04:22 hosting sshd[31110]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.65.152.201  user=root
Apr 19 15:04:24 hosting sshd[31110]: Failed password for root from 159.65.152.201 port 46846 ssh2
...

SSH invalid-user multiple login try

Apr 19 21:40:41 our-server-hostname postfix/smtpd[21157]: connect from unknown[60.189.116.24]
Apr x@x
Apr x@x
Apr x@x
Apr x@x
Apr x@x
Apr x@x
Apr x@x
Apr x@x
Apr x@x
Apr x@x
Apr x@x


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=60.189.116.24

Apr 19 15:33:57 debian-2gb-nbg1-2 kernel: \[9562204.252641\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=194.26.29.212 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=241 ID=41791 PROTO=TCP SPT=58013 DPT=25859 WINDOW=1024 RES=0x00 SYN URGP=0

Apr 19 13:58:39 vserver sshd\[12285\]: Invalid user user from 118.89.111.225Apr 19 13:58:42 vserver sshd\[12285\]: Failed password for invalid user user from 118.89.111.225 port 55574 ssh2Apr 19 14:04:29 vserver sshd\[12351\]: Invalid user qi from 118.89.111.225Apr 19 14:04:31 vserver sshd\[12351\]: Failed password for invalid user qi from 118.89.111.225 port 60820 ssh2
...

Apr 19 13:56:31 srv01 sshd[18320]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.15.129.164  user=root
Apr 19 13:56:33 srv01 sshd[18320]: Failed password for root from 51.15.129.164 port 56730 ssh2
Apr 19 14:00:39 srv01 sshd[18581]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.15.129.164  user=postgres
Apr 19 14:00:40 srv01 sshd[18581]: Failed password for postgres from 51.15.129.164 port 46964 ssh2
Apr 19 14:04:42 srv01 sshd[18854]: Invalid user wu from 51.15.129.164 port 37174
...

Automatic report - Port Scan Attack

SSH Brute-Forcing (server2)