May 20 17:56:39 mail.srvfarm.net postfix/smtpd[1512554]: NOQUEUE: reject: RCPT from unknown[63.83.75.74]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
May 20 17:57:24 mail.srvfarm.net postfix/smtpd[1512862]: NOQUEUE: reject: RCPT from unknown[63.83.75.74]: 554 5.7.1 Service unavailable; Client host [63.83.75.74] blocked using bl.spamcop.net; Blocked - see https://www.spamcop.net/bl.shtml?63.83.75.74; from= to= proto=ESMTP helo=
May 20 17:57:24 mail.srvfarm.net postfix/smtpd[1514146]: NOQUEUE: reject: RCPT from unknown[63.83.75.74]: 554 5.7.1 Service unavailable; Client host [63.83.75.74] blocked using bl.spamcop.net; Blocked - see https://www.spamcop.net/bl.shtml?63.83.75.74; from= to= proto=ESMTP he

SpamScore above: 10.0

SpamScore above: 10.0

SpamScore above: 10.0

May 27 01:39:55 mail.srvfarm.net postfix/smtpd[1345660]: NOQUEUE: reject: RCPT from unknown[63.83.75.14]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
May 27 01:40:32 mail.srvfarm.net postfix/smtpd[1345660]: NOQUEUE: reject: RCPT from unknown[63.83.75.14]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
May 27 01:40:44 mail.srvfarm.net postfix/smtpd[1360334]: NOQUEUE: reject: RCPT from unknown[63.83.75.14]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
May 27 01:41:10 mail.srvfarm.net postfix/smtpd[1357239]: NOQUEUE: reject: RCPT from unknown[63.83.75.14]: 450 4.1.8 : Sender address

May 27 01:29:55 web01.agentur-b-2.de postfix/smtpd[23831]: NOQUEUE: reject: RCPT from unknown[63.83.75.174]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
May 27 01:29:55 web01.agentur-b-2.de postfix/smtpd[21085]: NOQUEUE: reject: RCPT from unknown[63.83.75.174]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
May 27 01:32:29 web01.agentur-b-2.de postfix/smtpd[21085]: NOQUEUE: reject: RCPT from unknown[63.83.75.174]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
May 27 01:36:36 web01.agentur-b-2.de postfix/smtpd[23831]: NOQUEUE: reject: RCPT from unknown[63.83.75.174]: 450 4.7.1 

May 26 16:15:44 tux postfix/smtpd[4851]: connect from squeak.alnawwar.com[63.83.75.203]
May x@x
May 26 16:15:47 tux postfix/smtpd[4851]: disconnect from squeak.alnawwar.com[63.83.75.203]
May 26 16:45:48 tux postfix/smtpd[5345]: connect from squeak.alnawwar.com[63.83.75.203]
May x@x
May 26 16:45:48 tux postfix/smtpd[5345]: disconnect from squeak.alnawwar.com[63.83.75.203]
May 26 16:55:49 tux postfix/smtpd[5456]: connect from squeak.alnawwar.com[63.83.75.203]
May x@x
May 26 16:55:49 tux postfix/smtpd[5456]: disconnect from squeak.alnawwar.com[63.83.75.203]
May 26 17:22:32 tux postfix/smtpd[5886]: connect from squeak.alnawwar.com[63.83.75.203]
May x@x
May 26 17:22:32 tux postfix/smtpd[5886]: disconnect from squeak.alnawwar.com[63.83.75.203]


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=63.83.75.203

SpamScore above: 10.0

May 25 14:42:21 mail.srvfarm.net postfix/smtpd[248518]: NOQUEUE: reject: RCPT from unknown[63.83.75.178]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
May 25 14:42:21 mail.srvfarm.net postfix/smtpd[261707]: NOQUEUE: reject: RCPT from unknown[63.83.75.178]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
May 25 14:42:23 mail.srvfarm.net postfix/smtpd[261707]: NOQUEUE: reject: RCPT from unknown[63.83.75.178]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
May 25 14:42:24 mail.srvfarm.net postfix/smtpd[248503]: NOQUEUE: reject: RCPT from unknown[63.83.75.178]: 450 4.1.8 : Sender address

May 25 13:36:19 web01.agentur-b-2.de postfix/smtpd[210519]: NOQUEUE: reject: RCPT from unknown[63.83.75.210]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
May 25 13:36:20 web01.agentur-b-2.de postfix/smtpd[207908]: NOQUEUE: reject: RCPT from unknown[63.83.75.210]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
May 25 13:36:20 web01.agentur-b-2.de postfix/smtpd[206817]: NOQUEUE: reject: RCPT from unknown[63.83.75.210]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
May 25 13:36:33 web01.agentur-b-2.de postfix/smtpd[207905]: NOQUEUE: reject: RCPT from unknown[63.83.75.210]: 450 4.7.1 : Helo command rejected: Host not found; from=

May 22 14:34:31 mxgate1 postfix/postscreen[11330]: CONNECT from [63.83.75.122]:46738 to [176.31.12.44]:25
May 22 14:34:31 mxgate1 postfix/dnsblog[11347]: addr 63.83.75.122 listed by domain zen.spamhaus.org as 127.0.0.3
May 22 14:34:31 mxgate1 postfix/dnsblog[11349]: addr 63.83.75.122 listed by domain ix.dnsbl.xxxxxx.net as 127.0.0.2
May 22 14:34:31 mxgate1 postfix/dnsblog[11348]: addr 63.83.75.122 listed by domain b.barracudacentral.org as 127.0.0.2
May 22 14:34:37 mxgate1 postfix/postscreen[11330]: DNSBL rank 4 for [63.83.75.122]:46738
May x@x
May 22 14:34:37 mxgate1 postfix/postscreen[11330]: DISCONNECT [63.83.75.122]:46738


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=63.83.75.122

May 22 12:33:07 web01 postfix/smtpd[14806]: connect from puny.alnawwar.com[63.83.75.202]
May 22 12:33:08 web01 policyd-spf[15017]: None; identhostnamey=helo; client-ip=63.83.75.202; helo=puny.alnawwar.com; envelope-from=x@x
May 22 12:33:08 web01 policyd-spf[15017]: Pass; identhostnamey=mailfrom; client-ip=63.83.75.202; helo=puny.alnawwar.com; envelope-from=x@x
May x@x
May 22 12:33:08 web01 postfix/smtpd[14806]: disconnect from puny.alnawwar.com[63.83.75.202]
May 22 12:43:16 web01 postfix/smtpd[15450]: connect from puny.alnawwar.com[63.83.75.202]
May 22 12:43:16 web01 policyd-spf[15520]: None; identhostnamey=helo; client-ip=63.83.75.202; helo=puny.alnawwar.com; envelope-from=x@x
May 22 12:43:16 web01 policyd-spf[15520]: Pass; identhostnamey=mailfrom; client-ip=63.83.75.202; helo=puny.alnawwar.com; envelope-from=x@x
May x@x
May 22 12:43:17 web01 postfix/smtpd[15450]: disconnect from puny.alnawwar.com[63.83.75.202]
May 22 12:44:15 web01 postfix/smtpd[15451]: connect from p........
-------------------------------

May 20 15:16:02 online-web-1 postfix/smtpd[2091593]: connect from flag.szaj-maszkok.com[63.83.75.42]
May x@x
May 20 15:16:08 online-web-1 postfix/smtpd[2091593]: disconnect from flag.szaj-maszkok.com[63.83.75.42] ehlo=1 mail=1 rcpt=0/1 data=0/1 quhostname=1 commands=3/5
May 20 15:16:43 online-web-1 postfix/smtpd[2091597]: connect from flag.szaj-maszkok.com[63.83.75.42]
May x@x
May 20 15:16:49 online-web-1 postfix/smtpd[2091597]: disconnect from flag.szaj-maszkok.com[63.83.75.42] ehlo=1 mail=1 rcpt=0/1 data=0/1 quhostname=1 commands=3/5
May 20 15:25:29 online-web-1 postfix/smtpd[2091591]: connect from flag.szaj-maszkok.com[63.83.75.42]
May x@x
May 20 15:25:34 online-web-1 postfix/smtpd[2091591]: disconnect from flag.szaj-maszkok.com[63.83.75.42] ehlo=1 mail=1 rcpt=0/1 data=0/1 quhostname=1 commands=3/5
May 20 15:38:26 online-web-1 postfix/smtpd[2091601]: connect from flag.szaj-maszkok.com[63.83.75.42]
May 20 15:38:26 online-web-1 postfix/smtpd[2091585]: connect from flag........
-------------------------------

Lines containing failures of 63.83.75.55
/var/log/apache/pucorp.org.log:May 20 08:10:47 server01 postfix/smtpd[25727]: connect from billowy.szajmaszk-informaciok.com[63.83.75.55]
/var/log/apache/pucorp.org.log:May x@x
/var/log/apache/pucorp.org.log:May x@x
/var/log/apache/pucorp.org.log:May x@x
/var/log/apache/pucorp.org.log:May x@x
/var/log/apache/pucorp.org.log:May 20 08:10:50 server01 postfix/smtpd[25727]: disconnect from billowy.szajmaszk-informaciok.com[63.83.75.55]


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=63.83.75.55

SpamScore above: 10.0

Invalid user deamon from 45.126.125.190 port 58706

DATE:2020-09-29 00:10:20, IP:103.126.100.225, PORT:ssh SSH brute force auth (docker-dc)

 TCP (SYN) 58.215.12.226:49318 -> port 8735, len 44

Failed password for invalid user from 222.186.175.148 port 12334 ssh2

177.79.64.41 (BR/Brazil/-), 6 distributed sshd attacks on account [root] in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_DISTATTACK; Logs: Sep 27 16:38:13 server4 sshd[23740]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.108.46  user=root
Sep 27 16:09:59 server4 sshd[5813]: Failed password for root from 82.64.132.50 port 59946 ssh2
Sep 27 16:28:51 server4 sshd[17584]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=154.83.16.140  user=root
Sep 27 16:16:40 server4 sshd[10243]: Failed password for root from 177.79.64.41 port 12665 ssh2
Sep 27 16:16:39 server4 sshd[10243]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.79.64.41  user=root
Sep 27 16:28:53 server4 sshd[17584]: Failed password for root from 154.83.16.140 port 47326 ssh2

IP Addresses Blocked:

128.199.108.46 (SG/Singapore/-)
82.64.132.50 (FR/France/-)
154.83.16.140 (US/United States/-)

Brute%20Force%20SSH

2020-09-28T09:33:12.548381lavrinenko.info sshd[3641]: Failed password for root from 112.85.42.190 port 47510 ssh2
2020-09-28T09:33:17.510757lavrinenko.info sshd[3641]: Failed password for root from 112.85.42.190 port 47510 ssh2
2020-09-28T09:33:22.461451lavrinenko.info sshd[3641]: Failed password for root from 112.85.42.190 port 47510 ssh2
2020-09-28T09:33:25.484925lavrinenko.info sshd[3641]: Failed password for root from 112.85.42.190 port 47510 ssh2
2020-09-28T09:33:25.903723lavrinenko.info sshd[3641]: error: maximum authentication attempts exceeded for root from 112.85.42.190 port 47510 ssh2 [preauth]
...

2020-09-28T22:09:18.076022server.espacesoutien.com sshd[6093]: Invalid user admin from 107.175.115.67 port 43368
2020-09-28T22:09:18.087399server.espacesoutien.com sshd[6093]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.175.115.67
2020-09-28T22:09:18.076022server.espacesoutien.com sshd[6093]: Invalid user admin from 107.175.115.67 port 43368
2020-09-28T22:09:20.433134server.espacesoutien.com sshd[6093]: Failed password for invalid user admin from 107.175.115.67 port 43368 ssh2
...

Invalid user nikhil from 43.229.153.13 port 33389

Sep 28 08:20:11 serwer sshd\[32045\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.85.42.122  user=root
Sep 28 08:20:14 serwer sshd\[32045\]: Failed password for root from 112.85.42.122 port 63674 ssh2
Sep 28 08:20:17 serwer sshd\[32045\]: Failed password for root from 112.85.42.122 port 63674 ssh2
Sep 28 08:20:20 serwer sshd\[32045\]: Failed password for root from 112.85.42.122 port 63674 ssh2
Sep 28 08:20:23 serwer sshd\[32045\]: Failed password for root from 112.85.42.122 port 63674 ssh2
Sep 28 08:20:27 serwer sshd\[32045\]: Failed password for root from 112.85.42.122 port 63674 ssh2
Sep 28 08:20:27 serwer sshd\[32045\]: error: maximum authentication attempts exceeded for root from 112.85.42.122 port 63674 ssh2 \[preauth\]
Sep 28 08:20:31 serwer sshd\[32082\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.85.42.122  user=root
Sep 28 08:20:32 serwer sshd\[32082\]: Failed password for ro
...

Automatic report - Banned IP Access

Sep 28 23:49:50 host sshd[17822]: Invalid user kongxx from 159.65.84.183 port 46172
...

4 SSH login attempts.

Automatic report - Banned IP Access

$f2bV_matches