PHISHING AND SPAM ATTACK
45.137.22.47	UAB LIMORIS - newworld@nwd.com.hk, invoice, 2 Jul 2021
185.222.58.104  khalid Siddiqui - ceo@seafarerpk.com, SHIPPING DOCUMENTS FOR GATE PASS,  3 Jul 2021
person:    	K.M. Badrul Alam
address:   	Naherins Domain, 134/7 B, Furfura Sharif Road, Darus Salam
inetnum:   	45.128.0.0 - 45.159.255.255
		185.222.57.0 - 185.222.57.255
		185.222.58.0 - 185.222.58.255
Other emails from same group are listed below as PHISHING AND SPAM ATTACK as well as; 
45.137.22.37 Engr. Ghazanfar Raza - ghazanfar@sgbmdxb.com - NEW ORDER, 17 May 2021 
45.137.22.37 M. Ahmed Bilwani - editorial@thejakartapost.com - OUTSTANDING PAYMENT REMINDER, 17 May 2021
45.137.22.44 Barbara Liu liuli.hgxs@sinopec.com, Req Invoice, 27 May 2021
185.222.57.140  FUKUSEN (SALES DEPT) - fukusen-ikari@alpha.ocn.ne.jp - RE: Confirmation Order for PO # B18024091/02730918, 4 May 2021 21:38:19
185.222.57.140 Julie shi - shifulan@sinotrans.com - RE: SATEMENT OF ACCOUNT, 5 May 2021
185.222.57.140 Jason Kim - jason@wscorporation.co.kr - Enquiry # A87983T - Fittings and Flanges for LNG project, 30 Apr 2021
185.222.57.140 Jason Kim - jason@wscorporation.co.kr - Enquiry # A87983T - Fittings and Flanges for LNG project, Mon, 26 Apr 2021
185.222.57.140 Jason Kim - jason@wscorporation.co.kr - Enquiry # A87983T - Fittings and Flanges for LNG project, Sun, 25 Apr 2021
185.222.57.140 Magdi Amin - areej@alamalcargo.com - RE: New Order, 6 May 2021
185.222.57.143  Mr. Ahmed Bilwani - daniel.robinson@compelo.com, OUTSTANDING PAYMENT REMINDER, 13 Jun 2021
185.222.57.143  Barbara Liu / 刘莉 - liuli.hgxs"@sinopec.com, Payment confirmation,  13 Jun 2021
185.222.57.143  M. Ahmed Bilwani - jiovieno@marketresearch.com, PAYMENT REMINDER,  18 Jun 2021
185.222.57.143  M. Ahmed Bilwani - jiovieno@marketresearch.com, PAYMENT REMINDER,  19 Jun 2021
185.222.58.104  khalid Siddiqui - ceo@seafarerpk.com, SHIPPING DOCUMENTS FOR GATE PASS,  3 Jul 2021

PHISHING AND SPAM ATTACK
45.137.22.47 Alla Shpedko - mediainquiries@cision.com, Confirmation, 30 Jun 2021
45.137.22.47 Barbara Liu - info@pixelmechanics.com.sg, P O,  30 Jun 2021 
NetRange:       45.128.0.0 - 45.159.255.255
OrgId:          RIPE
Other emails from same group are listed below as PHISHING AND SPAM ATTACK as well as; 
45.137.22.37 Engr. Ghazanfar Raza - ghazanfar@sgbmdxb.com - NEW ORDER, 17 May 2021 
45.137.22.37 M. Ahmed Bilwani - editorial@thejakartapost.com - OUTSTANDING PAYMENT REMINDER, 17 May 2021
45.137.22.44 Barbara Liu liuli.hgxs@sinopec.com, Req Invoice, 27 May 2021
45.137.22.47 Kastriot Buci - Kastriot.Bucii@dahuatech.com, Order, 30 Jun 2021
45.137.22.47 Alla Shpedko - mediainquiries@cision.com, Confirmation, 30 Jun 2021
45.137.22.47 Barbara Liu - info@pixelmechanics.com.sg, P O,  30 Jun 2021

PHISHING AND SPAM ATTACK
45.137.22.47 Kastriot Buci - Kastriot.Bucii@dahuatech.com, Order, 30 Jun 2021 
NetRange:       45.128.0.0 - 45.159.255.255
OrgId:          RIPE
Other emails from same group are listed below as PHISHING AND SPAM ATTACK as well as; 
45.137.22.37 Engr. Ghazanfar Raza - ghazanfar@sgbmdxb.com - NEW ORDER, 17 May 2021 
45.137.22.37 M. Ahmed Bilwani - editorial@thejakartapost.com - OUTSTANDING PAYMENT REMINDER, 17 May 2021
45.137.22.44 Barbara Liu liuli.hgxs@sinopec.com, Req Invoice, 27 May 2021

PHISHING ATTACK
45.137.22.44 Barbara Liu liuli.hgxs@sinopec.com, Req Invoice, 27 May 2021 
NetRange:       45.128.0.0 - 45.159.255.255
OrgId:          RIPE
Other emails from same group are listed below as PHISHING AND SPAM ATTACK as well as; 
45.137.22.37 Engr. Ghazanfar Raza - ghazanfar@sgbmdxb.com - NEW ORDER, 17 May 2021 
45.137.22.37 M. Ahmed Bilwani - editorial@thejakartapost.com - OUTSTANDING PAYMENT REMINDER, 17 May 2021
45.137.22.44 Barbara Liu liuli.hgxs@sinopec.com, Req Invoice, 27 May 2021

45.137.22.37 M. Ahmed Bilwani - editorial@thejakartapost.com - OUTSTANDING PAYMENT REMINDER, 17 May 2021
NetRange:       45.128.0.0 - 45.159.255.255
OrgId:          RIPE
Other emails from same group are listed below as PHISHING AND SPAM ATTACK
45.137.22.37 Engr. Ghazanfar Raza - ghazanfar@sgbmdxb.com - NEW ORDER, 17 May 2021 
45.137.22.37 M. Ahmed Bilwani - editorial@thejakartapost.com - OUTSTANDING PAYMENT REMINDER, 17 May 2021

45.137.22.37 Engr. Ghazanfar Raza - ghazanfar@sgbmdxb.com - NEW ORDER, 17 May 2021 
NetRange:       45.128.0.0 - 45.159.255.255
OrgId:          RIPE
Other emails from same group are listed below as PHISHING AND SPAM ATTACK

PHISHING AND SPAM ATTACK
FROM "Grace 曹向慧 - wh.dzxs02@xinyiglass.com -" : 
SUBJECT "XYG FINANCIAL REQUIREMENT--- LC" :
RECEIVED "from [45.137.22.138] (port=58343 helo=xinyiglass.com)" :
DATE/TIMESENT "Fri, 30 Apr 2021 17:28:39 "
IP ADDRESS "inetnum:45.128.0.0 - 45.159.255.255 org-name:RootLayer Web Services Ltd."

PHISHING AND SPAM ATTACK
FROM "Cherry - zamy0001@126.com -" : 
SUBJECT "Marine Open Policy No. MP/O/10/000116/11/2020/DT, CMIC Chloride - 6000 Kgs. against L/C No. LC/99/082/3087" :
RECEIVED "from [45.137.22.138] (port=55954 helo=126.com) (envelope-from ) id 1lR9XR-004z74-Kj " :
DATE/TIMESENT "Tue, 30 Mar 2021 19:15:51"
IP ADDRESS "inetnum:45.128.0.0 - 45.159.255.255 Organization: RIPE Network Coordination Centre (RIPE)"

Subject: 答复: 答复: Revised Invoice
Date: 21 Sep 2020 11:25:‪27 -0700‬
Message ID: <20200921112527.158DBCFBB65E469C@transwellogistic.com>
Virus/Unauthorized code: >>> Possible MalWare 'AVE/Heur.AdvML.B!200' found in '‪25511069‬_3X_AR_PA2__INVOICE.exe'.

Subject: 答复: 答复: Revised Invoice
Date: 21 Sep 2020 11:25:‪27 -0700‬
Message ID: <20200921112527.158DBCFBB65E469C@transwellogistic.com>
Virus/Unauthorized code: >>> Possible MalWare 'AVE/Heur.AdvML.B!200' found in '‪25511069‬_3X_AR_PA2__INVOICE.exe'.

Subject: 答复: 答复: Revised Invoice
Date: 21 Sep 2020 11:25:‪27 -0700‬
Message ID: <20200921112527.158DBCFBB65E469C@transwellogistic.com>
Virus/Unauthorized code: >>> Possible MalWare 'AVE/Heur.AdvML.B!200' found in '‪25511069‬_3X_AR_PA2__INVOICE.exe'.

SMTP AUTH

Sep 15 18:59:01 server postfix/smtpd[12697]: NOQUEUE: reject: RCPT from unknown[45.137.22.108]: 554 5.7.1 Service unavailable; Client host [45.137.22.108] blocked using bl.spamcop.net; Blocked - see https://www.spamcop.net/bl.shtml?45.137.22.108; from= to= proto=ESMTP helo=

Sep 15 18:59:01 server postfix/smtpd[12697]: NOQUEUE: reject: RCPT from unknown[45.137.22.108]: 554 5.7.1 Service unavailable; Client host [45.137.22.108] blocked using bl.spamcop.net; Blocked - see https://www.spamcop.net/bl.shtml?45.137.22.108; from= to= proto=ESMTP helo=

45.137.229.5 - - [29/Aug/2020:05:42:12 +0200] "POST /xmlrpc.php HTTP/1.1" 403 461 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
45.137.229.5 - - [29/Aug/2020:05:59:54 +0200] "POST /xmlrpc.php HTTP/1.1" 403 10784 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
...

5x Failed Password

Apr  5 21:49:39 game-panel sshd[20404]: Failed password for root from 198.46.242.175 port 55484 ssh2
Apr  5 21:53:04 game-panel sshd[20528]: Failed password for root from 198.46.242.175 port 36584 ssh2

Apr  5 13:27:51 fwservlet sshd[28703]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.197.220.149  user=r.r
Apr  5 13:27:53 fwservlet sshd[28703]: Failed password for r.r from 104.197.220.149 port 41432 ssh2
Apr  5 13:27:53 fwservlet sshd[28703]: Received disconnect from 104.197.220.149 port 41432:11: Bye Bye [preauth]
Apr  5 13:27:53 fwservlet sshd[28703]: Disconnected from 104.197.220.149 port 41432 [preauth]
Apr  5 13:40:35 fwservlet sshd[29077]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.197.220.149  user=r.r
Apr  5 13:40:37 fwservlet sshd[29077]: Failed password for r.r from 104.197.220.149 port 60074 ssh2
Apr  5 13:40:37 fwservlet sshd[29077]: Received disconnect from 104.197.220.149 port 60074:11: Bye Bye [preauth]
Apr  5 13:40:37 fwservlet sshd[29077]: Disconnected from 104.197.220.149 port 60074 [preauth]
Apr  5 13:44:07 fwservlet sshd[29183]: pam_unix(sshd:auth): auth........
-------------------------------

Apr  6 00:44:20 ns382633 sshd\[31483\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.72.187.2  user=root
Apr  6 00:44:21 ns382633 sshd\[31483\]: Failed password for root from 37.72.187.2 port 35724 ssh2
Apr  6 00:54:04 ns382633 sshd\[1105\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.72.187.2  user=root
Apr  6 00:54:07 ns382633 sshd\[1105\]: Failed password for root from 37.72.187.2 port 38834 ssh2
Apr  6 00:58:08 ns382633 sshd\[1958\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.72.187.2  user=root

Tried sshing with brute force.

2020-04-05T21:48:20.539339shield sshd\[18631\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.123.29  user=root
2020-04-05T21:48:22.309602shield sshd\[18631\]: Failed password for root from 106.13.123.29 port 41518 ssh2
2020-04-05T21:52:11.347025shield sshd\[19837\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.123.29  user=root
2020-04-05T21:52:13.162447shield sshd\[19837\]: Failed password for root from 106.13.123.29 port 41930 ssh2
2020-04-05T21:56:08.405107shield sshd\[20980\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.123.29  user=root

04/05/2020-18:18:38.030897 195.54.166.70 Protocol: 6 ET SCAN NMAP -sS window 1024

scan z

Apr  6 02:07:37 web01.agentur-b-2.de postfix/smtpd[38562]: warning: unknown[45.133.99.6]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Apr  6 02:07:38 web01.agentur-b-2.de postfix/smtpd[38562]: lost connection after AUTH from unknown[45.133.99.6]
Apr  6 02:07:44 web01.agentur-b-2.de postfix/smtpd[38562]: lost connection after AUTH from unknown[45.133.99.6]
Apr  6 02:07:49 web01.agentur-b-2.de postfix/smtpd[38562]: lost connection after CONNECT from unknown[45.133.99.6]
Apr  6 02:07:53 web01.agentur-b-2.de postfix/smtpd[38934]: lost connection after CONNECT from unknown[45.133.99.6]

Automatic report - Port Scan Attack

2020-04-06T00:38:28.857822shield sshd\[4552\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.173.180  user=root
2020-04-06T00:38:30.340957shield sshd\[4552\]: Failed password for root from 222.186.173.180 port 54954 ssh2
2020-04-06T00:38:33.488864shield sshd\[4552\]: Failed password for root from 222.186.173.180 port 54954 ssh2
2020-04-06T00:38:36.717018shield sshd\[4552\]: Failed password for root from 222.186.173.180 port 54954 ssh2
2020-04-06T00:38:40.356368shield sshd\[4552\]: Failed password for root from 222.186.173.180 port 54954 ssh2

2020-04-05T21:41:27.800943ionos.janbro.de sshd[60522]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.37.71.235  user=root
2020-04-05T21:41:30.212859ionos.janbro.de sshd[60522]: Failed password for root from 54.37.71.235 port 52883 ssh2
2020-04-05T21:49:43.742869ionos.janbro.de sshd[60569]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.37.71.235  user=root
2020-04-05T21:49:45.909666ionos.janbro.de sshd[60569]: Failed password for root from 54.37.71.235 port 58217 ssh2
2020-04-05T21:58:05.291235ionos.janbro.de sshd[60603]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.37.71.235  user=root
2020-04-05T21:58:07.717493ionos.janbro.de sshd[60603]: Failed password for root from 54.37.71.235 port 35324 ssh2
2020-04-05T22:05:23.312344ionos.janbro.de sshd[60649]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.37.71.235  
...

Autoban   156.213.17.32 AUTH/CONNECT

SSH brutforce

Apr  6 00:37:38 ncomp sshd[11830]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=41.111.135.199  user=root
Apr  6 00:37:40 ncomp sshd[11830]: Failed password for root from 41.111.135.199 port 45882 ssh2
Apr  6 00:45:20 ncomp sshd[12126]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=41.111.135.199  user=root
Apr  6 00:45:22 ncomp sshd[12126]: Failed password for root from 41.111.135.199 port 57456 ssh2