Postfix RBL failed

Apr  4 15:20:30 mail.srvfarm.net postfix/smtpd[3301977]: NOQUEUE: reject: RCPT from unknown[63.81.87.144]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Apr  4 15:24:30 mail.srvfarm.net postfix/smtpd[3318077]: NOQUEUE: reject: RCPT from unknown[63.81.87.144]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Apr  4 15:25:55 mail.srvfarm.net postfix/smtpd[3314744]: NOQUEUE: reject: RCPT from unknown[63.81.87.144]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Apr  4 15:26:40 mail.srvfarm.net postfix/smtpd[3301977]: NOQUEUE: reject: RCPT from unknown[63.81.87.144]: 450 4.1.8 :

Apr  4 05:30:07 web01.agentur-b-2.de postfix/smtpd[920628]: NOQUEUE: reject: RCPT from unknown[63.81.87.178]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Apr  4 05:30:13 web01.agentur-b-2.de postfix/smtpd[920628]: NOQUEUE: reject: RCPT from unknown[63.81.87.178]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Apr  4 05:32:45 web01.agentur-b-2.de postfix/smtpd[920628]: NOQUEUE: reject: RCPT from unknown[63.81.87.178]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Apr  4 05:33:38 web01.agentur-b-2.de postfix/smtpd[920628]: NOQUEUE: reject: RCPT from unknown[63.81.87.178]: 450 4.7.1 

(RCPT) RCPT NOT ALLOWED FROM  63.81.87.167 (US/United States/-): 1 in the last 3600 secs

Apr  2 05:35:44 mail.srvfarm.net postfix/smtpd[1755935]: NOQUEUE: reject: RCPT from unknown[63.81.87.146]: 554 5.7.1 Service unavailable; Client host [63.81.87.146] blocked using zen.spamhaus.org; https://www.spamhaus.org/sbl/query/SBLCSS; from= to= proto=ESMTP helo=
Apr  2 05:35:44 mail.srvfarm.net postfix/smtpd[1753858]: NOQUEUE: reject: RCPT from unknown[63.81.87.146]: 554 5.7.1 Service unavailable; Client host [63.81.87.146] blocked using zen.spamhaus.org; https://www.spamhaus.org/sbl/query/SBLCSS; from= to= proto=ESMTP helo=
Apr  2 05:35:45 mail.srvfarm.net postfix/smtpd[1755903]: NOQUEUE: reject: RCPT from unknown[63.81.87.146]: 554 5.7.1 Service unavailable; Client host [63.81.87.146] blocked using zen.spamhaus.org; https://www.spamhaus.org/sbl/query/SBLCSS; from= to= proto=ESMTP helo=

Apr  2 06:54:55 web01.agentur-b-2.de postfix/smtpd[72992]: NOQUEUE: reject: RCPT from unknown[63.81.87.151]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Apr  2 06:54:55 web01.agentur-b-2.de postfix/smtpd[77755]: NOQUEUE: reject: RCPT from unknown[63.81.87.151]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Apr  2 06:54:55 web01.agentur-b-2.de postfix/smtpd[77756]: NOQUEUE: reject: RCPT from unknown[63.81.87.151]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Apr  2 06:54:55 web01.agentur-b-2.de postfix/smtpd[77758]: NOQUEUE: reject: RCPT from unknown[63.81.87.151]: 450 4.7.1 : Helo command rejected: Host not found; from=

Mar 31 23:29:39 mail.srvfarm.net postfix/smtpd[783722]: NOQUEUE: reject: RCPT from unknown[63.81.87.159]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar 31 23:29:41 mail.srvfarm.net postfix/smtpd[783721]: NOQUEUE: reject: RCPT from unknown[63.81.87.159]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar 31 23:30:28 mail.srvfarm.net postfix/smtpd[796986]: NOQUEUE: reject: RCPT from unknown[63.81.87.159]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar 31 23:31:50 mail.srvfarm.net postfix/smtpd[778578]: NOQUEUE

Mar 30 05:24:03 tux postfix/smtpd[14066]: connect from unknown[63.81.87.157]
Mar x@x
Mar 30 05:24:04 tux postfix/smtpd[14066]: disconnect from unknown[63.81.87.157]


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=63.81.87.157

Mar 29 05:33:39 mail.srvfarm.net postfix/smtpd[755834]: NOQUEUE: reject: RCPT from unknown[63.81.87.146]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar 29 05:35:33 mail.srvfarm.net postfix/smtpd[774356]: NOQUEUE: reject: RCPT from unknown[63.81.87.146]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar 29 05:35:42 mail.srvfarm.net postfix/smtpd[755659]: NOQUEUE: reject: RCPT from unknown[63.81.87.146]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar 29 05:37:35 mail.srvfarm.net postfix/smtpd[756001]: NOQUEU

Mar 22 05:36:09 mail.srvfarm.net postfix/smtpd[562348]: NOQUEUE: reject: RCPT from unknown[63.81.87.152]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar 22 05:36:26 mail.srvfarm.net postfix/smtpd[562346]: NOQUEUE: reject: RCPT from unknown[63.81.87.152]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar 22 05:37:58 mail.srvfarm.net postfix/smtpd[557306]: NOQUEUE: reject: RCPT from unknown[63.81.87.152]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar 22 05:37:58 mail.srvfarm.net postfix/smtpd[561117]: NOQUEUE: reject: RCPT from unknown[63.81.87.152]: 450 4.1.8 : Sender address

Mar 20 05:34:59 mail.srvfarm.net postfix/smtpd[2604122]: NOQUEUE: reject: RCPT from unknown[63.81.87.179]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar 20 05:34:59 mail.srvfarm.net postfix/smtpd[2603295]: NOQUEUE: reject: RCPT from unknown[63.81.87.179]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar 20 05:35:05 mail.srvfarm.net postfix/smtpd[2603273]: NOQUEUE: reject: RCPT from unknown[63.81.87.179]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar 20 05:35:07 mail.srvfarm.net postfix/smtpd[2588041]: NOQUEUE: reject: RCPT from unknown[63.81.87.179]: 450 4.1.8 

Mar 17 01:28:30 mail.srvfarm.net postfix/smtpd[575988]: NOQUEUE: reject: RCPT from unknown[63.81.87.170]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar 17 01:28:33 mail.srvfarm.net postfix/smtpd[588708]: NOQUEUE: reject: RCPT from unknown[63.81.87.170]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar 17 01:30:31 mail.srvfarm.net postfix/smtpd[588739]: NOQUEUE: reject: RCPT from unknown[63.81.87.170]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar 17 01:30:32 mail.srvfarm.net postfix/smtpd[575986]: NOQUEUE: reject: RCPT from unknown[63.81.87.170]: 450 4.1.8 

Mar 16 16:25:31 mail.srvfarm.net postfix/smtpd[249206]: NOQUEUE: reject: RCPT from unknown[63.81.87.145]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar 16 16:25:41 mail.srvfarm.net postfix/smtpd[249187]: NOQUEUE: reject: RCPT from unknown[63.81.87.145]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar 16 16:26:04 mail.srvfarm.net postfix/smtpd[220455]: NOQUEUE: reject: RCPT from unknown[63.81.87.145]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar 16 16:26:31 mail.srvfarm.net postfix/smtpd[249188]: NOQUEUE: reject: RCPT from unknown[63.81.87.145]: 450 4.1.8 

Mar 12 13:47:08 mail.srvfarm.net postfix/smtpd[1811060]: NOQUEUE: reject: RCPT from unknown[63.81.87.140]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar 12 13:47:08 mail.srvfarm.net postfix/smtpd[1830689]: NOQUEUE: reject: RCPT from unknown[63.81.87.140]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar 12 13:47:08 mail.srvfarm.net postfix/smtpd[1830650]: NOQUEUE: reject: RCPT from unknown[63.81.87.140]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar 12 13:47:08 mail.srvfarm.net postfix/smtpd[1827922]: NOQUEUE: reject: RCPT from unknown[63.81.87.140]: 450 4.1.8 

Mar 12 04:41:19 mail.srvfarm.net postfix/smtpd[1642187]: NOQUEUE: reject: RCPT from unknown[63.81.87.174]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar 12 04:41:24 mail.srvfarm.net postfix/smtpd[1636114]: NOQUEUE: reject: RCPT from unknown[63.81.87.174]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar 12 04:41:48 mail.srvfarm.net postfix/smtpd[1642190]: NOQUEUE: reject: RCPT from unknown[63.81.87.174]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar 12 04:44:06 mail.srvfarm.net postfix/smtpd[1642190]: NOQUEUE: reject: RCPT from unknown[63.81.87.174]: 450 4.1.8 : Sender address rejected: Domain not found;

Mar 10 04:32:26 web01 postfix/smtpd[4013]: connect from unknown[63.81.87.142]
Mar 10 04:32:26 web01 policyd-spf[4019]: None; identhostnamey=helo; client-ip=63.81.87.142; helo=mature.svcoding.com; envelope-from=x@x
Mar 10 04:32:26 web01 policyd-spf[4019]: Pass; identhostnamey=mailfrom; client-ip=63.81.87.142; helo=mature.svcoding.com; envelope-from=x@x
Mar x@x
Mar 10 04:32:27 web01 postfix/smtpd[4013]: disconnect from unknown[63.81.87.142]
Mar 10 04:33:00 web01 postfix/smtpd[4013]: connect from unknown[63.81.87.142]
Mar 10 04:33:01 web01 policyd-spf[4019]: None; identhostnamey=helo; client-ip=63.81.87.142; helo=mature.svcoding.com; envelope-from=x@x
Mar 10 04:33:01 web01 policyd-spf[4019]: Pass; identhostnamey=mailfrom; client-ip=63.81.87.142; helo=mature.svcoding.com; envelope-from=x@x
Mar x@x
Mar 10 04:33:01 web01 postfix/smtpd[4013]: disconnect from unknown[63.81.87.142]
Mar 10 04:38:17 web01 postfix/smtpd[3383]: connect from unknown[63.81.87.142]
Mar 10 04:38:17 web0........
-------------------------------

Sep 22 13:43:42 minden010 sshd[23999]: Failed password for root from 222.186.173.201 port 17326 ssh2
Sep 22 13:43:57 minden010 sshd[23999]: Failed password for root from 222.186.173.201 port 17326 ssh2
Sep 22 13:43:57 minden010 sshd[23999]: error: maximum authentication attempts exceeded for root from 222.186.173.201 port 17326 ssh2 [preauth]
...

Sep 22 13:10:16 haigwepa sshd[19042]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.65.125.190 
Sep 22 13:10:18 haigwepa sshd[19042]: Failed password for invalid user ftpadmin from 112.65.125.190 port 53808 ssh2
...

srv02 Mass scanning activity detected Target: 9002  ..

Brute force attempt

$f2bV_matches

Sep 22 11:03:20 scw-focused-cartwright sshd[17684]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=144.34.207.90
Sep 22 11:03:23 scw-focused-cartwright sshd[17684]: Failed password for invalid user xiao from 144.34.207.90 port 44178 ssh2

Sep 22 11:50:59 host sshd[28758]: Invalid user jeff from 35.179.53.255 port 54350
...

Telnet/23 MH Probe, Scan, BF, Hack -

Sep 21 19:04:44 host sshd[15352]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.79.43.25  user=root
Sep 21 19:04:46 host sshd[15352]: Failed password for root from 115.79.43.25 port 4845 ssh2
...

Invalid user ubuntu from 49.235.28.55 port 45146

159.89.99.68 - - [22/Sep/2020:09:31:34 +0200] "GET /wp-login.php HTTP/1.1" 200 9061 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
159.89.99.68 - - [22/Sep/2020:09:31:40 +0200] "POST /wp-login.php HTTP/1.1" 200 9312 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
159.89.99.68 - - [22/Sep/2020:09:31:40 +0200] "POST /xmlrpc.php HTTP/1.1" 200 427 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"

DATE:2020-09-21 19:04:52, IP:191.233.232.95, PORT:1433 MSSQL brute force auth on honeypot server (honey-neo-dc)

DATE:2020-09-21 18:59:35, IP:13.76.194.200, PORT:1433 MSSQL brute force auth on honeypot server (honey-neo-dc)

Telnet/23 MH Probe, Scan, BF, Hack -

ModSecurity detections (a)