Apr 26 06:47:54 mail.srvfarm.net postfix/smtpd[1243822]: NOQUEUE: reject: RCPT from unknown[63.82.49.36]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Apr 26 06:47:54 mail.srvfarm.net postfix/smtpd[1242661]: NOQUEUE: reject: RCPT from unknown[63.82.49.36]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Apr 26 06:47:54 mail.srvfarm.net postfix/smtpd[1244515]: NOQUEUE: reject: RCPT from unknown[63.82.49.36]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Apr 26 06:47:54 mail.srvfarm.net postfix/smtpd[1245194]: NOQUEUE: reject: RCPT from unknown[63.82.49.36]:

Apr 25 05:40:18 mail.srvfarm.net postfix/smtpd[852178]: NOQUEUE: reject: RCPT from unknown[63.82.49.67]: 554 5.7.1 Service unavailable; Client host [63.82.49.67] blocked using zen.spamhaus.org; https://www.spamhaus.org/sbl/query/SBLCSS; from= to= proto=ESMTP helo=
Apr 25 05:40:48 mail.srvfarm.net postfix/smtpd[852178]: NOQUEUE: reject: RCPT from unknown[63.82.49.67]: 554 5.7.1 Service unavailable; Client host [63.82.49.67] blocked using zen.spamhaus.org; https://www.spamhaus.org/sbl/query/SBLCSS; from= to= proto=ESMTP helo=
Apr 25 05:40:54 mail.srvfarm.net postfix/smtpd[849742]: NOQUEUE: reject: RCPT from unknown[63.82.49.67]: 554 5.7.1 Service unavailable; Client host [63.82.49.67] blocked using zen.spamhaus.org; https://www.spamhaus.org/sbl/query/SBLCSS; from= to= proto=ESMTP helo=
Apr 25

Apr 24 23:19:33 mail.srvfarm.net postfix/smtpd[574078]: NOQUEUE: reject: RCPT from unknown[63.82.49.25]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Apr 24 23:19:33 mail.srvfarm.net postfix/smtpd[575140]: NOQUEUE: reject: RCPT from unknown[63.82.49.25]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Apr 24 23:19:33 mail.srvfarm.net postfix/smtpd[573787]: NOQUEUE: reject: RCPT from unknown[63.82.49.25]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Apr 24 23:19:33 mail.srvfarm.net postfix/smtpd[575147]: NOQUEUE: reject: RCPT from unknown[63.82.49

Apr 23 10:03:36 web01.agentur-b-2.de postfix/smtpd[115787]: NOQUEUE: reject: RCPT from unknown[63.82.49.53]: 554 5.7.1 Service unavailable; Client host [63.82.49.53] blocked using zen.spamhaus.org; https://www.spamhaus.org/sbl/query/SBLCSS; from= to= proto=ESMTP helo=
Apr 23 10:06:24 web01.agentur-b-2.de postfix/smtpd[128143]: NOQUEUE: reject: RCPT from unknown[63.82.49.53]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Apr 23 10:06:24 web01.agentur-b-2.de postfix/smtpd[128159]: NOQUEUE: reject: RCPT from unknown[63.82.49.53]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Apr 23 10:06:24 web01.agentur-b-2.de postfix/smtpd[128160]: NOQUEUE: rejec

Apr 17 06:00:24 web01.agentur-b-2.de postfix/smtpd[884902]: NOQUEUE: reject: RCPT from unknown[63.82.49.33]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Apr 17 06:09:42 web01.agentur-b-2.de postfix/smtpd[884902]: NOQUEUE: reject: RCPT from unknown[63.82.49.33]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Apr 17 06:09:42 web01.agentur-b-2.de postfix/smtpd[883792]: NOQUEUE: reject: RCPT from unknown[63.82.49.33]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Apr 17 06:09:42 web01.agentur-b-2.de postfix/smtpd[887607]: NOQUEUE: reject: RCPT from unknown[63.82.49.33]: 450 4.7.1 : Helo command r

Spam

Mar 24 00:22:23 web01 postfix/smtpd[7559]: connect from tempt.kaagaan.com[63.82.49.175]
Mar 24 00:22:23 web01 policyd-spf[8166]: None; identhostnamey=helo; client-ip=63.82.49.175; helo=tempt.teedasa.com; envelope-from=x@x
Mar 24 00:22:23 web01 policyd-spf[8166]: Pass; identhostnamey=mailfrom; client-ip=63.82.49.175; helo=tempt.teedasa.com; envelope-from=x@x
Mar x@x
Mar 24 00:22:23 web01 postfix/smtpd[7559]: disconnect from tempt.kaagaan.com[63.82.49.175]
Mar 24 00:22:33 web01 postfix/smtpd[7559]: connect from tempt.kaagaan.com[63.82.49.175]
Mar 24 00:22:34 web01 policyd-spf[8166]: None; identhostnamey=helo; client-ip=63.82.49.175; helo=tempt.teedasa.com; envelope-from=x@x
Mar 24 00:22:34 web01 policyd-spf[8166]: Pass; identhostnamey=mailfrom; client-ip=63.82.49.175; helo=tempt.teedasa.com; envelope-from=x@x
Mar x@x
Mar 24 00:22:34 web01 postfix/smtpd[7559]: disconnect from tempt.kaagaan.com[63.82.49.175]
Mar 24 00:23:04 web01 postfix/smtpd[7559]: connect from tempt.kaag........
-------------------------------

Email Spam

Email Spam

Email Spam

Email Spam

Mar 22 04:30:46 mail.srvfarm.net postfix/smtpd[541910]: NOQUEUE: reject: RCPT from unknown[63.82.49.163]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar 22 04:30:46 mail.srvfarm.net postfix/smtpd[541893]: NOQUEUE: reject: RCPT from unknown[63.82.49.163]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar 22 04:30:46 mail.srvfarm.net postfix/smtpd[541911]: NOQUEUE: reject: RCPT from unknown[63.82.49.163]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar 22 04:30:46 mail.srvfarm.net postfix/smtpd[541912]: NOQUEUE: reject: RCPT from unknown[63.82.49.163]: 450 4.1.8 

SpamScore above: 10.0

Mar 16 13:24:14 web01 postfix/smtpd[12674]: connect from group.kaagaan.com[63.82.49.161]
Mar 16 13:24:14 web01 policyd-spf[12676]: None; identhostnamey=helo; client-ip=63.82.49.161; helo=group.teedasa.com; envelope-from=x@x
Mar 16 13:24:14 web01 policyd-spf[12676]: Pass; identhostnamey=mailfrom; client-ip=63.82.49.161; helo=group.teedasa.com; envelope-from=x@x
Mar x@x
Mar 16 13:24:15 web01 postfix/smtpd[12674]: disconnect from group.kaagaan.com[63.82.49.161]
Mar 16 13:26:10 web01 postfix/smtpd[12674]: connect from group.kaagaan.com[63.82.49.161]
Mar 16 13:26:10 web01 policyd-spf[12676]: None; identhostnamey=helo; client-ip=63.82.49.161; helo=group.teedasa.com; envelope-from=x@x
Mar 16 13:26:10 web01 policyd-spf[12676]: Pass; identhostnamey=mailfrom; client-ip=63.82.49.161; helo=group.teedasa.com; envelope-from=x@x
Mar x@x
Mar 16 13:26:11 web01 postfix/smtpd[12674]: disconnect from group.kaagaan.com[63.82.49.161]
Mar 16 13:26:16 web01 postfix/smtpd[12670]: connect from g........
-------------------------------

Dec 19 19:40:45 kapalua sshd\[5589\]: Invalid user prints from 91.134.240.73
Dec 19 19:40:45 kapalua sshd\[5589\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=73.ip-91-134-240.eu
Dec 19 19:40:46 kapalua sshd\[5589\]: Failed password for invalid user prints from 91.134.240.73 port 41414 ssh2
Dec 19 19:46:24 kapalua sshd\[6076\]: Invalid user buted from 91.134.240.73
Dec 19 19:46:24 kapalua sshd\[6076\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=73.ip-91-134-240.eu

Dec 20 07:09:57 localhost postfix/smtpd\[8862\]: warning: ns3048742.ip-94-23-196.eu\[94.23.196.177\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Dec 20 07:10:03 localhost postfix/smtpd\[8864\]: warning: ns3048742.ip-94-23-196.eu\[94.23.196.177\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Dec 20 07:10:13 localhost postfix/smtpd\[8862\]: warning: ns3048742.ip-94-23-196.eu\[94.23.196.177\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Dec 20 07:10:36 localhost postfix/smtpd\[8864\]: warning: ns3048742.ip-94-23-196.eu\[94.23.196.177\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Dec 20 07:10:42 localhost postfix/smtpd\[8456\]: warning: ns3048742.ip-94-23-196.eu\[94.23.196.177\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
...

Dec 20 10:13:26 gw1 sshd[25724]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.236.124.45
Dec 20 10:13:28 gw1 sshd[25724]: Failed password for invalid user webmail from 104.236.124.45 port 59345 ssh2
...

Invalid user adina from 212.237.22.79 port 38488

Honeypot hit: [2019-12-20 07:56:04 +0300] Connected from 159.203.197.28 to (HoneypotIP):143

\[2019-12-20 00:26:35\] SECURITY\[2857\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-12-20T00:26:35.558-0500",Severity="Error",Service="SIP",EventVersion="1",AccountID="01146490381261",SessionID="0x7f0fb4e801a8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/45.143.220.92/5071",ACLName="no_extension_match"
\[2019-12-20 00:31:19\] SECURITY\[2857\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-12-20T00:31:19.242-0500",Severity="Error",Service="SIP",EventVersion="1",AccountID="01146490381261",SessionID="0x7f0fb534edb8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/45.143.220.92/5078",ACLName="no_extension_match"
\[2019-12-20 00:35:56\] SECURITY\[2857\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-12-20T00:35:56.601-0500",Severity="Error",Service="SIP",EventVersion="1",AccountID="01146490381261",SessionID="0x7f0fb4425c48",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/45.143.220.92/5074",ACLName="no_extension

Dec 20 04:55:48 *** sshd[32650]: User root from 113.160.178.148 not allowed because not listed in AllowUsers

2019-12-20T05:43:47.091328hub.schaetter.us sshd\[20606\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.190.92  user=root
2019-12-20T05:43:49.214086hub.schaetter.us sshd\[20606\]: Failed password for root from 222.186.190.92 port 42880 ssh2
2019-12-20T05:43:52.962721hub.schaetter.us sshd\[20606\]: Failed password for root from 222.186.190.92 port 42880 ssh2
2019-12-20T05:43:55.921227hub.schaetter.us sshd\[20606\]: Failed password for root from 222.186.190.92 port 42880 ssh2
2019-12-20T05:43:58.965171hub.schaetter.us sshd\[20606\]: Failed password for root from 222.186.190.92 port 42880 ssh2
...

Dec 20 07:42:38 server sshd\[9315\]: Invalid user bruflot from 128.199.177.224
Dec 20 07:42:38 server sshd\[9315\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.177.224 
Dec 20 07:42:39 server sshd\[9315\]: Failed password for invalid user bruflot from 128.199.177.224 port 45736 ssh2
Dec 20 07:55:41 server sshd\[12734\]: Invalid user vanaja from 128.199.177.224
Dec 20 07:55:41 server sshd\[12734\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.177.224 
...

1576817767 - 12/20/2019 05:56:07 Host: 113.179.150.42/113.179.150.42 Port: 445 TCP Blocked

Dec 20 06:48:30 arianus sshd\[31275\]: Unable to negotiate with 218.92.0.158 port 51173: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1 \[preauth\]
...

Dec 20 01:50:16 firewall sshd[18393]: Invalid user user1 from 182.73.245.70
Dec 20 01:50:18 firewall sshd[18393]: Failed password for invalid user user1 from 182.73.245.70 port 44344 ssh2
Dec 20 01:55:51 firewall sshd[18518]: Invalid user jahangeer from 182.73.245.70
...

Invalid user helvik from 164.132.197.108 port 36312
pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.132.197.108
Failed password for invalid user helvik from 164.132.197.108 port 36312 ssh2
Invalid user rpm from 164.132.197.108 port 42518
pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.132.197.108

Tried sshing with brute force.

postfix (unknown user, SPF fail or relay access denied)