PHISHING AND SPAM ATTACK
45.137.22.47	UAB LIMORIS - newworld@nwd.com.hk, invoice, 2 Jul 2021
185.222.58.104  khalid Siddiqui - ceo@seafarerpk.com, SHIPPING DOCUMENTS FOR GATE PASS,  3 Jul 2021
person:    	K.M. Badrul Alam
address:   	Naherins Domain, 134/7 B, Furfura Sharif Road, Darus Salam
inetnum:   	45.128.0.0 - 45.159.255.255
		185.222.57.0 - 185.222.57.255
		185.222.58.0 - 185.222.58.255
Other emails from same group are listed below as PHISHING AND SPAM ATTACK as well as; 
45.137.22.37 Engr. Ghazanfar Raza - ghazanfar@sgbmdxb.com - NEW ORDER, 17 May 2021 
45.137.22.37 M. Ahmed Bilwani - editorial@thejakartapost.com - OUTSTANDING PAYMENT REMINDER, 17 May 2021
45.137.22.44 Barbara Liu liuli.hgxs@sinopec.com, Req Invoice, 27 May 2021
185.222.57.140  FUKUSEN (SALES DEPT) - fukusen-ikari@alpha.ocn.ne.jp - RE: Confirmation Order for PO # B18024091/02730918, 4 May 2021 21:38:19
185.222.57.140 Julie shi - shifulan@sinotrans.com - RE: SATEMENT OF ACCOUNT, 5 May 2021
185.222.57.140 Jason Kim - jason@wscorporation.co.kr - Enquiry # A87983T - Fittings and Flanges for LNG project, 30 Apr 2021
185.222.57.140 Jason Kim - jason@wscorporation.co.kr - Enquiry # A87983T - Fittings and Flanges for LNG project, Mon, 26 Apr 2021
185.222.57.140 Jason Kim - jason@wscorporation.co.kr - Enquiry # A87983T - Fittings and Flanges for LNG project, Sun, 25 Apr 2021
185.222.57.140 Magdi Amin - areej@alamalcargo.com - RE: New Order, 6 May 2021
185.222.57.143  Mr. Ahmed Bilwani - daniel.robinson@compelo.com, OUTSTANDING PAYMENT REMINDER, 13 Jun 2021
185.222.57.143  Barbara Liu / 刘莉 - liuli.hgxs"@sinopec.com, Payment confirmation,  13 Jun 2021
185.222.57.143  M. Ahmed Bilwani - jiovieno@marketresearch.com, PAYMENT REMINDER,  18 Jun 2021
185.222.57.143  M. Ahmed Bilwani - jiovieno@marketresearch.com, PAYMENT REMINDER,  19 Jun 2021
185.222.58.104  khalid Siddiqui - ceo@seafarerpk.com, SHIPPING DOCUMENTS FOR GATE PASS,  3 Jul 2021

PHISHING AND SPAM ATTACK
45.137.22.47 Alla Shpedko - mediainquiries@cision.com, Confirmation, 30 Jun 2021
45.137.22.47 Barbara Liu - info@pixelmechanics.com.sg, P O,  30 Jun 2021 
NetRange:       45.128.0.0 - 45.159.255.255
OrgId:          RIPE
Other emails from same group are listed below as PHISHING AND SPAM ATTACK as well as; 
45.137.22.37 Engr. Ghazanfar Raza - ghazanfar@sgbmdxb.com - NEW ORDER, 17 May 2021 
45.137.22.37 M. Ahmed Bilwani - editorial@thejakartapost.com - OUTSTANDING PAYMENT REMINDER, 17 May 2021
45.137.22.44 Barbara Liu liuli.hgxs@sinopec.com, Req Invoice, 27 May 2021
45.137.22.47 Kastriot Buci - Kastriot.Bucii@dahuatech.com, Order, 30 Jun 2021
45.137.22.47 Alla Shpedko - mediainquiries@cision.com, Confirmation, 30 Jun 2021
45.137.22.47 Barbara Liu - info@pixelmechanics.com.sg, P O,  30 Jun 2021

PHISHING AND SPAM ATTACK
45.137.22.47 Kastriot Buci - Kastriot.Bucii@dahuatech.com, Order, 30 Jun 2021 
NetRange:       45.128.0.0 - 45.159.255.255
OrgId:          RIPE
Other emails from same group are listed below as PHISHING AND SPAM ATTACK as well as; 
45.137.22.37 Engr. Ghazanfar Raza - ghazanfar@sgbmdxb.com - NEW ORDER, 17 May 2021 
45.137.22.37 M. Ahmed Bilwani - editorial@thejakartapost.com - OUTSTANDING PAYMENT REMINDER, 17 May 2021
45.137.22.44 Barbara Liu liuli.hgxs@sinopec.com, Req Invoice, 27 May 2021

PHISHING ATTACK
45.137.22.44 Barbara Liu liuli.hgxs@sinopec.com, Req Invoice, 27 May 2021 
NetRange:       45.128.0.0 - 45.159.255.255
OrgId:          RIPE
Other emails from same group are listed below as PHISHING AND SPAM ATTACK as well as; 
45.137.22.37 Engr. Ghazanfar Raza - ghazanfar@sgbmdxb.com - NEW ORDER, 17 May 2021 
45.137.22.37 M. Ahmed Bilwani - editorial@thejakartapost.com - OUTSTANDING PAYMENT REMINDER, 17 May 2021
45.137.22.44 Barbara Liu liuli.hgxs@sinopec.com, Req Invoice, 27 May 2021

45.137.22.37 M. Ahmed Bilwani - editorial@thejakartapost.com - OUTSTANDING PAYMENT REMINDER, 17 May 2021
NetRange:       45.128.0.0 - 45.159.255.255
OrgId:          RIPE
Other emails from same group are listed below as PHISHING AND SPAM ATTACK
45.137.22.37 Engr. Ghazanfar Raza - ghazanfar@sgbmdxb.com - NEW ORDER, 17 May 2021 
45.137.22.37 M. Ahmed Bilwani - editorial@thejakartapost.com - OUTSTANDING PAYMENT REMINDER, 17 May 2021

45.137.22.37 Engr. Ghazanfar Raza - ghazanfar@sgbmdxb.com - NEW ORDER, 17 May 2021 
NetRange:       45.128.0.0 - 45.159.255.255
OrgId:          RIPE
Other emails from same group are listed below as PHISHING AND SPAM ATTACK

PHISHING AND SPAM ATTACK
FROM "Grace 曹向慧 - wh.dzxs02@xinyiglass.com -" : 
SUBJECT "XYG FINANCIAL REQUIREMENT--- LC" :
RECEIVED "from [45.137.22.138] (port=58343 helo=xinyiglass.com)" :
DATE/TIMESENT "Fri, 30 Apr 2021 17:28:39 "
IP ADDRESS "inetnum:45.128.0.0 - 45.159.255.255 org-name:RootLayer Web Services Ltd."

PHISHING AND SPAM ATTACK
FROM "Cherry - zamy0001@126.com -" : 
SUBJECT "Marine Open Policy No. MP/O/10/000116/11/2020/DT, CMIC Chloride - 6000 Kgs. against L/C No. LC/99/082/3087" :
RECEIVED "from [45.137.22.138] (port=55954 helo=126.com) (envelope-from ) id 1lR9XR-004z74-Kj " :
DATE/TIMESENT "Tue, 30 Mar 2021 19:15:51"
IP ADDRESS "inetnum:45.128.0.0 - 45.159.255.255 Organization: RIPE Network Coordination Centre (RIPE)"

Subject: 答复: 答复: Revised Invoice
Date: 21 Sep 2020 11:25:‪27 -0700‬
Message ID: <20200921112527.158DBCFBB65E469C@transwellogistic.com>
Virus/Unauthorized code: >>> Possible MalWare 'AVE/Heur.AdvML.B!200' found in '‪25511069‬_3X_AR_PA2__INVOICE.exe'.

Subject: 答复: 答复: Revised Invoice
Date: 21 Sep 2020 11:25:‪27 -0700‬
Message ID: <20200921112527.158DBCFBB65E469C@transwellogistic.com>
Virus/Unauthorized code: >>> Possible MalWare 'AVE/Heur.AdvML.B!200' found in '‪25511069‬_3X_AR_PA2__INVOICE.exe'.

Subject: 答复: 答复: Revised Invoice
Date: 21 Sep 2020 11:25:‪27 -0700‬
Message ID: <20200921112527.158DBCFBB65E469C@transwellogistic.com>
Virus/Unauthorized code: >>> Possible MalWare 'AVE/Heur.AdvML.B!200' found in '‪25511069‬_3X_AR_PA2__INVOICE.exe'.

SMTP AUTH

Sep 15 18:59:01 server postfix/smtpd[12697]: NOQUEUE: reject: RCPT from unknown[45.137.22.108]: 554 5.7.1 Service unavailable; Client host [45.137.22.108] blocked using bl.spamcop.net; Blocked - see https://www.spamcop.net/bl.shtml?45.137.22.108; from= to= proto=ESMTP helo=

Sep 15 18:59:01 server postfix/smtpd[12697]: NOQUEUE: reject: RCPT from unknown[45.137.22.108]: 554 5.7.1 Service unavailable; Client host [45.137.22.108] blocked using bl.spamcop.net; Blocked - see https://www.spamcop.net/bl.shtml?45.137.22.108; from= to= proto=ESMTP helo=

45.137.229.5 - - [29/Aug/2020:05:42:12 +0200] "POST /xmlrpc.php HTTP/1.1" 403 461 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
45.137.229.5 - - [29/Aug/2020:05:59:54 +0200] "POST /xmlrpc.php HTTP/1.1" 403 10784 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
...

20 attempts against mh-ssh on echoip

Fail2Ban Ban Triggered

Jun 15 11:57:40 ny01 sshd[23471]: Failed password for root from 115.68.207.164 port 59714 ssh2
Jun 15 12:05:17 ny01 sshd[24513]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.68.207.164
Jun 15 12:05:19 ny01 sshd[24513]: Failed password for invalid user worker from 115.68.207.164 port 51070 ssh2

Jun 15 19:07:37 localhost sshd\[6451\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.137.190.213  user=root
Jun 15 19:07:39 localhost sshd\[6451\]: Failed password for root from 45.137.190.213 port 59728 ssh2
Jun 15 19:13:26 localhost sshd\[6713\]: Invalid user alex from 45.137.190.213
Jun 15 19:13:26 localhost sshd\[6713\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.137.190.213
Jun 15 19:13:28 localhost sshd\[6713\]: Failed password for invalid user alex from 45.137.190.213 port 58572 ssh2
...

Jun 15 18:04:30 mail sshd\[14979\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=95.167.225.81  user=root
Jun 15 18:04:33 mail sshd\[14979\]: Failed password for root from 95.167.225.81 port 53464 ssh2
Jun 15 18:10:10 mail sshd\[15246\]: Invalid user xh from 95.167.225.81
Jun 15 18:10:10 mail sshd\[15246\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=95.167.225.81
...

Jun 15 19:06:21 abendstille sshd\[15121\]: Invalid user ok from 118.193.35.230
Jun 15 19:06:21 abendstille sshd\[15121\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.193.35.230
Jun 15 19:06:23 abendstille sshd\[15121\]: Failed password for invalid user ok from 118.193.35.230 port 57674 ssh2
Jun 15 19:11:44 abendstille sshd\[20196\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.193.35.230  user=root
Jun 15 19:11:46 abendstille sshd\[20196\]: Failed password for root from 118.193.35.230 port 59642 ssh2
...

$f2bV_matches

Port probing on unauthorized port 23

Unauthorized connection attempt from IP address 222.254.34.177 on Port 445(SMB)

1592223387 - 06/15/2020 14:16:27 Host: 93.125.13.92/93.125.13.92 Port: 445 TCP Blocked

Unauthorized connection attempt from IP address 91.238.24.168 on Port 445(SMB)

Icarus honeypot on github

2020-06-15T12:08:44.709461abusebot-8.cloudsearch.cf sshd[25815]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.3.30.17  user=root
2020-06-15T12:08:46.620546abusebot-8.cloudsearch.cf sshd[25815]: Failed password for root from 112.3.30.17 port 59160 ssh2
2020-06-15T12:12:49.469912abusebot-8.cloudsearch.cf sshd[26094]: Invalid user pip from 112.3.30.17 port 33384
2020-06-15T12:12:49.482578abusebot-8.cloudsearch.cf sshd[26094]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.3.30.17
2020-06-15T12:12:49.469912abusebot-8.cloudsearch.cf sshd[26094]: Invalid user pip from 112.3.30.17 port 33384
2020-06-15T12:12:51.027511abusebot-8.cloudsearch.cf sshd[26094]: Failed password for invalid user pip from 112.3.30.17 port 33384 ssh2
2020-06-15T12:16:43.026845abusebot-8.cloudsearch.cf sshd[26420]: Invalid user nexus from 112.3.30.17 port 35840
...

Jun 15 16:17:12 abendstille sshd\[11730\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.69.237.54  user=root
Jun 15 16:17:14 abendstille sshd\[11730\]: Failed password for root from 177.69.237.54 port 52846 ssh2
Jun 15 16:22:15 abendstille sshd\[17160\]: Invalid user tina from 177.69.237.54
Jun 15 16:22:15 abendstille sshd\[17160\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.69.237.54
Jun 15 16:22:17 abendstille sshd\[17160\]: Failed password for invalid user tina from 177.69.237.54 port 53730 ssh2
...

Jun 15 17:23:29 ntop sshd[419]: Invalid user public from 183.15.179.11 port 60684
Jun 15 17:23:29 ntop sshd[419]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.15.179.11 
Jun 15 17:23:31 ntop sshd[419]: Failed password for invalid user public from 183.15.179.11 port 60684 ssh2
Jun 15 17:23:34 ntop sshd[419]: Received disconnect from 183.15.179.11 port 60684:11: Bye Bye [preauth]
Jun 15 17:23:34 ntop sshd[419]: Disconnected from invalid user public 183.15.179.11 port 60684 [preauth]
Jun 15 17:33:14 ntop sshd[1626]: Invalid user tom1 from 183.15.179.11 port 43738
Jun 15 17:33:14 ntop sshd[1626]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.15.179.11 
Jun 15 17:33:16 ntop sshd[1626]: Failed password for invalid user tom1 from 183.15.179.11 port 43738 ssh2
Jun 15 17:33:17 ntop sshd[1626]: Received disconnect from 183.15.179.11 port 43738:11: Bye Bye [preauth]
Jun 15 17:33:17 ntop ss........
-------------------------------