45.137.22.37 M. Ahmed Bilwani - editorial@thejakartapost.com - OUTSTANDING PAYMENT REMINDER, 17 May 2021
NetRange:       45.128.0.0 - 45.159.255.255
OrgId:          RIPE
Other emails from same group are listed below as PHISHING AND SPAM ATTACK
45.137.22.37 Engr. Ghazanfar Raza - ghazanfar@sgbmdxb.com - NEW ORDER, 17 May 2021 
45.137.22.37 M. Ahmed Bilwani - editorial@thejakartapost.com - OUTSTANDING PAYMENT REMINDER, 17 May 2021

45.137.22.37 Engr. Ghazanfar Raza - ghazanfar@sgbmdxb.com - NEW ORDER, 17 May 2021 
NetRange:       45.128.0.0 - 45.159.255.255
OrgId:          RIPE
Other emails from same group are listed below as PHISHING AND SPAM ATTACK

PHISHING AND SPAM ATTACK
45.137.22.47	UAB LIMORIS - newworld@nwd.com.hk, invoice, 2 Jul 2021
185.222.58.104  khalid Siddiqui - ceo@seafarerpk.com, SHIPPING DOCUMENTS FOR GATE PASS,  3 Jul 2021
person:    	K.M. Badrul Alam
address:   	Naherins Domain, 134/7 B, Furfura Sharif Road, Darus Salam
inetnum:   	45.128.0.0 - 45.159.255.255
		185.222.57.0 - 185.222.57.255
		185.222.58.0 - 185.222.58.255
Other emails from same group are listed below as PHISHING AND SPAM ATTACK as well as; 
45.137.22.37 Engr. Ghazanfar Raza - ghazanfar@sgbmdxb.com - NEW ORDER, 17 May 2021 
45.137.22.37 M. Ahmed Bilwani - editorial@thejakartapost.com - OUTSTANDING PAYMENT REMINDER, 17 May 2021
45.137.22.44 Barbara Liu liuli.hgxs@sinopec.com, Req Invoice, 27 May 2021
185.222.57.140  FUKUSEN (SALES DEPT) - fukusen-ikari@alpha.ocn.ne.jp - RE: Confirmation Order for PO # B18024091/02730918, 4 May 2021 21:38:19
185.222.57.140 Julie shi - shifulan@sinotrans.com - RE: SATEMENT OF ACCOUNT, 5 May 2021
185.222.57.140 Jason Kim - jason@wscorporation.co.kr - Enquiry # A87983T - Fittings and Flanges for LNG project, 30 Apr 2021
185.222.57.140 Jason Kim - jason@wscorporation.co.kr - Enquiry # A87983T - Fittings and Flanges for LNG project, Mon, 26 Apr 2021
185.222.57.140 Jason Kim - jason@wscorporation.co.kr - Enquiry # A87983T - Fittings and Flanges for LNG project, Sun, 25 Apr 2021
185.222.57.140 Magdi Amin - areej@alamalcargo.com - RE: New Order, 6 May 2021
185.222.57.143  Mr. Ahmed Bilwani - daniel.robinson@compelo.com, OUTSTANDING PAYMENT REMINDER, 13 Jun 2021
185.222.57.143  Barbara Liu / 刘莉 - liuli.hgxs"@sinopec.com, Payment confirmation,  13 Jun 2021
185.222.57.143  M. Ahmed Bilwani - jiovieno@marketresearch.com, PAYMENT REMINDER,  18 Jun 2021
185.222.57.143  M. Ahmed Bilwani - jiovieno@marketresearch.com, PAYMENT REMINDER,  19 Jun 2021
185.222.58.104  khalid Siddiqui - ceo@seafarerpk.com, SHIPPING DOCUMENTS FOR GATE PASS,  3 Jul 2021

PHISHING AND SPAM ATTACK
45.137.22.47 Alla Shpedko - mediainquiries@cision.com, Confirmation, 30 Jun 2021
45.137.22.47 Barbara Liu - info@pixelmechanics.com.sg, P O,  30 Jun 2021 
NetRange:       45.128.0.0 - 45.159.255.255
OrgId:          RIPE
Other emails from same group are listed below as PHISHING AND SPAM ATTACK as well as; 
45.137.22.37 Engr. Ghazanfar Raza - ghazanfar@sgbmdxb.com - NEW ORDER, 17 May 2021 
45.137.22.37 M. Ahmed Bilwani - editorial@thejakartapost.com - OUTSTANDING PAYMENT REMINDER, 17 May 2021
45.137.22.44 Barbara Liu liuli.hgxs@sinopec.com, Req Invoice, 27 May 2021
45.137.22.47 Kastriot Buci - Kastriot.Bucii@dahuatech.com, Order, 30 Jun 2021
45.137.22.47 Alla Shpedko - mediainquiries@cision.com, Confirmation, 30 Jun 2021
45.137.22.47 Barbara Liu - info@pixelmechanics.com.sg, P O,  30 Jun 2021

PHISHING AND SPAM ATTACK
45.137.22.47 Kastriot Buci - Kastriot.Bucii@dahuatech.com, Order, 30 Jun 2021 
NetRange:       45.128.0.0 - 45.159.255.255
OrgId:          RIPE
Other emails from same group are listed below as PHISHING AND SPAM ATTACK as well as; 
45.137.22.37 Engr. Ghazanfar Raza - ghazanfar@sgbmdxb.com - NEW ORDER, 17 May 2021 
45.137.22.37 M. Ahmed Bilwani - editorial@thejakartapost.com - OUTSTANDING PAYMENT REMINDER, 17 May 2021
45.137.22.44 Barbara Liu liuli.hgxs@sinopec.com, Req Invoice, 27 May 2021

PHISHING ATTACK
45.137.22.44 Barbara Liu liuli.hgxs@sinopec.com, Req Invoice, 27 May 2021 
NetRange:       45.128.0.0 - 45.159.255.255
OrgId:          RIPE
Other emails from same group are listed below as PHISHING AND SPAM ATTACK as well as; 
45.137.22.37 Engr. Ghazanfar Raza - ghazanfar@sgbmdxb.com - NEW ORDER, 17 May 2021 
45.137.22.37 M. Ahmed Bilwani - editorial@thejakartapost.com - OUTSTANDING PAYMENT REMINDER, 17 May 2021
45.137.22.44 Barbara Liu liuli.hgxs@sinopec.com, Req Invoice, 27 May 2021

PHISHING AND SPAM ATTACK
FROM "Grace 曹向慧 - wh.dzxs02@xinyiglass.com -" : 
SUBJECT "XYG FINANCIAL REQUIREMENT--- LC" :
RECEIVED "from [45.137.22.138] (port=58343 helo=xinyiglass.com)" :
DATE/TIMESENT "Fri, 30 Apr 2021 17:28:39 "
IP ADDRESS "inetnum:45.128.0.0 - 45.159.255.255 org-name:RootLayer Web Services Ltd."

PHISHING AND SPAM ATTACK
FROM "Cherry - zamy0001@126.com -" : 
SUBJECT "Marine Open Policy No. MP/O/10/000116/11/2020/DT, CMIC Chloride - 6000 Kgs. against L/C No. LC/99/082/3087" :
RECEIVED "from [45.137.22.138] (port=55954 helo=126.com) (envelope-from ) id 1lR9XR-004z74-Kj " :
DATE/TIMESENT "Tue, 30 Mar 2021 19:15:51"
IP ADDRESS "inetnum:45.128.0.0 - 45.159.255.255 Organization: RIPE Network Coordination Centre (RIPE)"

Subject: 答复: 答复: Revised Invoice
Date: 21 Sep 2020 11:25:‪27 -0700‬
Message ID: <20200921112527.158DBCFBB65E469C@transwellogistic.com>
Virus/Unauthorized code: >>> Possible MalWare 'AVE/Heur.AdvML.B!200' found in '‪25511069‬_3X_AR_PA2__INVOICE.exe'.

Subject: 答复: 答复: Revised Invoice
Date: 21 Sep 2020 11:25:‪27 -0700‬
Message ID: <20200921112527.158DBCFBB65E469C@transwellogistic.com>
Virus/Unauthorized code: >>> Possible MalWare 'AVE/Heur.AdvML.B!200' found in '‪25511069‬_3X_AR_PA2__INVOICE.exe'.

Subject: 答复: 答复: Revised Invoice
Date: 21 Sep 2020 11:25:‪27 -0700‬
Message ID: <20200921112527.158DBCFBB65E469C@transwellogistic.com>
Virus/Unauthorized code: >>> Possible MalWare 'AVE/Heur.AdvML.B!200' found in '‪25511069‬_3X_AR_PA2__INVOICE.exe'.

SMTP AUTH

Sep 15 18:59:01 server postfix/smtpd[12697]: NOQUEUE: reject: RCPT from unknown[45.137.22.108]: 554 5.7.1 Service unavailable; Client host [45.137.22.108] blocked using bl.spamcop.net; Blocked - see https://www.spamcop.net/bl.shtml?45.137.22.108; from= to= proto=ESMTP helo=

Sep 15 18:59:01 server postfix/smtpd[12697]: NOQUEUE: reject: RCPT from unknown[45.137.22.108]: 554 5.7.1 Service unavailable; Client host [45.137.22.108] blocked using bl.spamcop.net; Blocked - see https://www.spamcop.net/bl.shtml?45.137.22.108; from= to= proto=ESMTP helo=

45.137.229.5 - - [29/Aug/2020:05:42:12 +0200] "POST /xmlrpc.php HTTP/1.1" 403 461 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
45.137.229.5 - - [29/Aug/2020:05:59:54 +0200] "POST /xmlrpc.php HTTP/1.1" 403 10784 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
...

Failed password for invalid user from 45.137.22.147 port 54600 ssh2

Subject: RE: Revised purchase order
Date: 21 Aug ‪2020 18‬:52:‪56 -0700‬
Message ID: <20200821185256.4857080578552517@dss-sa.com>
Virus/Unauthorized code: >>> Possible MalWare 'AVE/Scr.Malcode!gen16' found in '176974_9X_AR_PA8__Q20=20054=20R3.exe'.

(sshd) Failed SSH login from 149.202.144.181 (FR/France/vps66.bachathost.ovh): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Oct 17 13:19:45 server2 sshd[30936]: Failed password for root from 149.202.144.181 port 38832 ssh2
Oct 17 13:40:06 server2 sshd[31464]: Failed password for root from 149.202.144.181 port 47872 ssh2
Oct 17 13:43:50 server2 sshd[31562]: Failed password for root from 149.202.144.181 port 33822 ssh2
Oct 17 13:47:38 server2 sshd[31655]: Invalid user 5a5z from 149.202.144.181 port 47726
Oct 17 13:47:40 server2 sshd[31655]: Failed password for invalid user 5a5z from 149.202.144.181 port 47726 ssh2

detected by Fail2Ban

\[2019-10-17 08:33:43\] SECURITY\[1898\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-10-17T08:33:43.940-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="1011441519470459",SessionID="0x7fc3ac5226d8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/216.245.217.2/52080",ACLName="no_extension_match"
\[2019-10-17 08:35:17\] SECURITY\[1898\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-10-17T08:35:17.750-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="011441519470459",SessionID="0x7fc3ac5226d8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/216.245.217.2/64700",ACLName="no_extension_match"
\[2019-10-17 08:36:28\] SECURITY\[1898\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-10-17T08:36:28.530-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="9011441519470459",SessionID="0x7fc3ac5226d8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/216.245.217.2/56947",ACLName="no_e

10/17/2019-13:45:12.679003 159.203.201.64 Protocol: 6 ET DROP Dshield Block Listed Source group 1

Oct 17 14:24:41 webserver postfix/smtpd\[5303\]: warning: unknown\[45.142.195.5\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Oct 17 14:25:29 webserver postfix/smtpd\[5510\]: warning: unknown\[45.142.195.5\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Oct 17 14:26:18 webserver postfix/smtpd\[5510\]: warning: unknown\[45.142.195.5\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Oct 17 14:27:07 webserver postfix/smtpd\[5303\]: warning: unknown\[45.142.195.5\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Oct 17 14:27:55 webserver postfix/smtpd\[5510\]: warning: unknown\[45.142.195.5\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
...

Oct 17 19:49:09 webhost01 sshd[6920]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.111.137.132
Oct 17 19:49:10 webhost01 sshd[6920]: Failed password for invalid user password321 from 200.111.137.132 port 40682 ssh2
...

Oct 17 14:59:07 localhost sshd\[2430\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.77.200.243  user=root
Oct 17 14:59:09 localhost sshd\[2430\]: Failed password for root from 51.77.200.243 port 56700 ssh2
Oct 17 15:02:54 localhost sshd\[4886\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.77.200.243  user=root

MultiHost/MultiPort Probe, Scan, Hack -

Oct 17 06:37:54 askasleikir sshd[724531]: Failed password for root from 134.209.115.206 port 56458 ssh2
Oct 17 06:41:21 askasleikir sshd[724620]: Failed password for invalid user test from 134.209.115.206 port 39844 ssh2
Oct 17 06:25:49 askasleikir sshd[724240]: Failed password for invalid user admin from 134.209.115.206 port 55482 ssh2

Oct 17 13:56:12 mc1 kernel: \[2599739.907338\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:11:a9:7b:d2:74:7f:6e:37:e3:08:00 SRC=92.119.160.80 DST=159.69.205.51 LEN=40 TOS=0x00 PREC=0x00 TTL=243 ID=345 PROTO=TCP SPT=50363 DPT=23385 WINDOW=1024 RES=0x00 SYN URGP=0 
Oct 17 13:59:47 mc1 kernel: \[2599954.601096\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:11:a9:7b:d2:74:7f:6e:37:e3:08:00 SRC=92.119.160.80 DST=159.69.205.51 LEN=40 TOS=0x00 PREC=0x00 TTL=243 ID=10475 PROTO=TCP SPT=50363 DPT=13391 WINDOW=1024 RES=0x00 SYN URGP=0 
Oct 17 14:02:06 mc1 kernel: \[2600094.271590\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:11:a9:7b:d2:74:7f:6e:37:e3:08:00 SRC=92.119.160.80 DST=159.69.205.51 LEN=40 TOS=0x00 PREC=0x00 TTL=243 ID=61420 PROTO=TCP SPT=50363 DPT=3392 WINDOW=1024 RES=0x00 SYN URGP=0 
...

Triggered by Fail2Ban at Ares web server

MultiHost/MultiPort Probe, Scan, Hack -

Oct 17 13:44:39 rotator sshd\[21233\]: Invalid user developer from 164.132.51.91Oct 17 13:44:42 rotator sshd\[21233\]: Failed password for invalid user developer from 164.132.51.91 port 47720 ssh2Oct 17 13:44:43 rotator sshd\[21233\]: Failed password for invalid user developer from 164.132.51.91 port 47720 ssh2Oct 17 13:44:46 rotator sshd\[21233\]: Failed password for invalid user developer from 164.132.51.91 port 47720 ssh2Oct 17 13:44:49 rotator sshd\[21233\]: Failed password for invalid user developer from 164.132.51.91 port 47720 ssh2Oct 17 13:44:52 rotator sshd\[21233\]: Failed password for invalid user developer from 164.132.51.91 port 47720 ssh2
...

B: zzZZzz blocked content access

Joomla User : try to access forms...