$f2bV_matches

SpamScore above: 10.0

Jun 22 14:41:26 mail.srvfarm.net postfix/smtpd[4156079]: NOQUEUE: reject: RCPT from medical.ifixheal.com[69.94.158.125]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Jun 22 14:41:26 mail.srvfarm.net postfix/smtpd[4156127]: NOQUEUE: reject: RCPT from medical.ifixheal.com[69.94.158.125]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Jun 22 14:41:26 mail.srvfarm.net postfix/smtpd[4152946]: NOQUEUE: reject: RCPT from unknown[69.94.158.125]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Jun 22 14:41:27 mail.srvfarm.net postfix/smtpd[4152191]: NOQUEUE: reject: RCPT from u

Jun 17 05:24:07 web01.agentur-b-2.de postfix/smtpd[560626]: NOQUEUE: reject: RCPT from unknown[69.94.158.120]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Jun 17 05:27:51 web01.agentur-b-2.de postfix/smtpd[560626]: NOQUEUE: reject: RCPT from unknown[69.94.158.120]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Jun 17 05:27:58 web01.agentur-b-2.de postfix/smtpd[562233]: NOQUEUE: reject: RCPT from unknown[69.94.158.120]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Jun 17 05:28:11 web01.agentur-b-2.de postfix/smtpd[560625]: NOQUEUE: reject: RCPT from unknown[69.94.158.120]: 45

Jun  8 05:42:37 mail.srvfarm.net postfix/smtpd[671306]: NOQUEUE: reject: RCPT from unknown[69.94.158.91]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Jun  8 05:43:10 mail.srvfarm.net postfix/smtpd[673032]: NOQUEUE: reject: RCPT from unknown[69.94.158.91]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Jun  8 05:43:34 mail.srvfarm.net postfix/smtpd[673035]: NOQUEUE: reject: RCPT from unknown[69.94.158.91]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Jun  8 05:46:47 mail.srvfarm.net postfix/smtpd[671463]: NOQUEUE: reject: RCPT from unknown[69.94.158.91]: 450 4.1.8 

Jun  5 15:31:48 mail.srvfarm.net postfix/smtpd[3113570]: NOQUEUE: reject: RCPT from unknown[69.94.158.78]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Jun  5 15:32:18 mail.srvfarm.net postfix/smtpd[3109485]: NOQUEUE: reject: RCPT from unknown[69.94.158.78]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Jun  5 15:32:26 mail.srvfarm.net postfix/smtpd[3109485]: NOQUEUE: reject: RCPT from unknown[69.94.158.78]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Jun  5 15:36:04 mail.srvfarm.net postfix/smtpd[3113153]: NOQUEUE: reject: RCPT from unknown[69.94.158.78]: 450 4.1.8 

Jun  5 17:35:49 mail.srvfarm.net postfix/smtpd[3156527]: NOQUEUE: reject: RCPT from unknown[69.94.158.83]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Jun  5 17:36:02 mail.srvfarm.net postfix/smtpd[3151339]: NOQUEUE: reject: RCPT from unknown[69.94.158.83]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Jun  5 17:38:26 mail.srvfarm.net postfix/smtpd[3155924]: NOQUEUE: reject: RCPT from unknown[69.94.158.83]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Jun  5 17:42:09 mail.srvfarm.net postfix/smtpd[3156526]: NOQUEUE: reject: RCPT from unknown[69.94.158.83]: 450 4.1.8 : Send

Jun  4 13:33:39 web01.agentur-b-2.de postfix/smtpd[178713]: NOQUEUE: reject: RCPT from unknown[69.94.158.116]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Jun  4 13:35:57 web01.agentur-b-2.de postfix/smtpd[177278]: NOQUEUE: reject: RCPT from unknown[69.94.158.116]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Jun  4 13:36:10 web01.agentur-b-2.de postfix/smtpd[177278]: NOQUEUE: reject: RCPT from unknown[69.94.158.116]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Jun  4 13:40:07 web01.agentur-b-2.de postfix/smtpd[181736]: NOQUEUE: reject: RCPT from unknown[69.94.158.116]: 450 4.7.1 : He

Jun  1 13:36:25 mail.srvfarm.net postfix/smtpd[577447]: NOQUEUE: reject: RCPT from unknown[69.94.158.68]: 554 5.7.1 Service unavailable; Client host [69.94.158.68] blocked using zen.spamhaus.org; https://www.spamhaus.org/sbl/query/SBLCSS; from= to= proto=ESMTP helo=
Jun  1 13:36:54 mail.srvfarm.net postfix/smtpd[576967]: NOQUEUE: reject: RCPT from unknown[69.94.158.68]: 554 5.7.1 Service unavailable; Client host [69.94.158.68] blocked using zen.spamhaus.org; https://www.spamhaus.org/sbl/query/SBLCSS; from= to= proto=ESMTP helo=
Jun  1 13:36:59 mail.srvfarm.net postfix/smtpd[576966]: NOQUEUE: reject: RCPT from unknown[69.94.158.68]: 554 5.7.1 Service unavailable; Client host [69.94.158.68] blocked using zen.spamhaus.org; https://www.spamhaus.org/sbl/query/SBLCSS; from= to= proto=ESMTP helo=

May 24 05:02:36 web01.agentur-b-2.de postfix/smtpd[509182]: NOQUEUE: reject: RCPT from unknown[69.94.158.92]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
May 24 05:05:46 web01.agentur-b-2.de postfix/smtpd[507167]: NOQUEUE: reject: RCPT from unknown[69.94.158.92]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
May 24 05:10:08 web01.agentur-b-2.de postfix/smtpd[502191]: NOQUEUE: reject: RCPT from unknown[69.94.158.92]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
May 24 05:12:05 web01.agentur-b-2.de postfix/smtpd[502191]: NOQUEUE: reject: RCPT from unknown[69.94.158.92]: 450 4.7.1 : Helo command rejected: Host

Email Spam

Apr 30 22:24:29 web01.agentur-b-2.de postfix/smtpd[308782]: NOQUEUE: reject: RCPT from unknown[69.94.158.68]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Apr 30 22:25:27 web01.agentur-b-2.de postfix/smtpd[311470]: NOQUEUE: reject: RCPT from unknown[69.94.158.68]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Apr 30 22:27:15 web01.agentur-b-2.de postfix/smtpd[314121]: NOQUEUE: reject: RCPT from unknown[69.94.158.68]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Apr 30 22:28:36 web01.agentur-b-2.de postfix/smtpd[311518]: NOQUEUE: reject: RCPT from unknown[69.94.158.68]: 450 4.7.1 : Helo command rejected: Host n

Apr 29 14:28:32 mail.srvfarm.net postfix/smtpd[166895]: NOQUEUE: reject: RCPT from unknown[69.94.158.86]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Apr 29 14:30:31 mail.srvfarm.net postfix/smtpd[148816]: NOQUEUE: reject: RCPT from unknown[69.94.158.86]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Apr 29 14:31:05 mail.srvfarm.net postfix/smtpd[169893]: NOQUEUE: reject: RCPT from unknown[69.94.158.86]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Apr 29 14:31:29 mail.srvfarm.net postfix/smtpd[169892]: NOQUEUE: reject: RCPT from unknown[69.94.158.86]: 450 4.1.8 : Sender add

2020-04-25 1jSBUh-00034G-NK H=medical.ifixheal.com \(medical.porkaspk.com\) \[69.94.158.125\] rejected **REMOVED** : REJECTED - You seem to be a spammer!
2020-04-25 1jSCC3-00038E-DK H=medical.ifixheal.com \(medical.porkaspk.com\) \[69.94.158.125\] rejected **REMOVED** : REJECTED - You seem to be a spammer!
2020-04-25 1jSCC3-00038F-DK H=medical.ifixheal.com \(medical.porkaspk.com\) \[69.94.158.125\] rejected **REMOVED** : REJECTED - You seem to be a spammer!

Apr 23 10:12:23 web01.agentur-b-2.de postfix/smtpd[128143]: NOQUEUE: reject: RCPT from unknown[69.94.158.98]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Apr 23 10:13:59 web01.agentur-b-2.de postfix/smtpd[131327]: NOQUEUE: reject: RCPT from unknown[69.94.158.98]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Apr 23 10:15:25 web01.agentur-b-2.de postfix/smtpd[128143]: NOQUEUE: reject: RCPT from unknown[69.94.158.98]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Apr 23 10:16:17 web01.agentur-b-2.de postfix/smtpd[128143]: NOQUEUE: reject: RCPT from unknown[69.94.158.98]: 450

Apr 22 22:41:32 mail.srvfarm.net postfix/smtpd[3565326]: NOQUEUE: reject: RCPT from unknown[69.94.158.117]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Apr 22 22:41:32 mail.srvfarm.net postfix/smtpd[3564410]: NOQUEUE: reject: RCPT from unknown[69.94.158.117]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Apr 22 22:41:32 mail.srvfarm.net postfix/smtpd[3565329]: NOQUEUE: reject: RCPT from unknown[69.94.158.117]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Apr 22 22:41:32 mail.srvfar

(sshd) Failed SSH login from 51.255.173.70 (FR/France/70.ip-51-255-173.eu): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Mar 24 22:27:05 amsweb01 sshd[29830]: Invalid user zc from 51.255.173.70 port 42530
Mar 24 22:27:07 amsweb01 sshd[29830]: Failed password for invalid user zc from 51.255.173.70 port 42530 ssh2
Mar 24 22:34:16 amsweb01 sshd[30620]: Invalid user speech-dispatcher from 51.255.173.70 port 59396
Mar 24 22:34:18 amsweb01 sshd[30620]: Failed password for invalid user speech-dispatcher from 51.255.173.70 port 59396 ssh2
Mar 24 22:38:20 amsweb01 sshd[31073]: Invalid user vincintz from 51.255.173.70 port 45150

Mar 24 21:08:54 ns382633 sshd\[25080\]: Invalid user vinay from 198.100.146.98 port 43496
Mar 24 21:08:54 ns382633 sshd\[25080\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=198.100.146.98
Mar 24 21:08:57 ns382633 sshd\[25080\]: Failed password for invalid user vinay from 198.100.146.98 port 43496 ssh2
Mar 24 21:17:23 ns382633 sshd\[26909\]: Invalid user xina from 198.100.146.98 port 56322
Mar 24 21:17:23 ns382633 sshd\[26909\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=198.100.146.98

[ssh] SSH attack

Mar 24 22:47:15 host sshd[19019]: Invalid user janna from 37.49.207.240 port 60536
...

(sshd) Failed SSH login from 51.38.48.127 (FR/France/127.ip-51-38-48.eu): 2 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Mar 24 21:34:04 ubnt-55d23 sshd[19545]: Invalid user zhijun from 51.38.48.127 port 45410
Mar 24 21:34:06 ubnt-55d23 sshd[19545]: Failed password for invalid user zhijun from 51.38.48.127 port 45410 ssh2

Mar 24 23:20:54 santamaria sshd\[5169\]: Invalid user lg from 106.12.88.95
Mar 24 23:20:54 santamaria sshd\[5169\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.88.95
Mar 24 23:20:56 santamaria sshd\[5169\]: Failed password for invalid user lg from 106.12.88.95 port 45112 ssh2
...

Mar 24 21:49:28 combo sshd[21697]: Invalid user unknown from 153.142.247.196 port 46590
Mar 24 21:49:30 combo sshd[21697]: Failed password for invalid user unknown from 153.142.247.196 port 46590 ssh2
Mar 24 21:53:50 combo sshd[22017]: Invalid user ubuntu from 153.142.247.196 port 35134
...

ssh brute force

2020-03-24T19:07:36.486424shield sshd\[11843\]: Invalid user cop from 92.222.89.7 port 39300
2020-03-24T19:07:36.494648shield sshd\[11843\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=7.ip-92-222-89.eu
2020-03-24T19:07:38.736972shield sshd\[11843\]: Failed password for invalid user cop from 92.222.89.7 port 39300 ssh2
2020-03-24T19:10:36.219184shield sshd\[12455\]: Invalid user nee from 92.222.89.7 port 56400
2020-03-24T19:10:36.228387shield sshd\[12455\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=7.ip-92-222-89.eu

Mar 24 21:46:15 ns392434 sshd[10395]: Invalid user v from 128.199.143.89 port 45676
Mar 24 21:46:15 ns392434 sshd[10395]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.143.89
Mar 24 21:46:15 ns392434 sshd[10395]: Invalid user v from 128.199.143.89 port 45676
Mar 24 21:46:16 ns392434 sshd[10395]: Failed password for invalid user v from 128.199.143.89 port 45676 ssh2
Mar 24 21:52:09 ns392434 sshd[10563]: Invalid user randall from 128.199.143.89 port 33684
Mar 24 21:52:09 ns392434 sshd[10563]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.143.89
Mar 24 21:52:09 ns392434 sshd[10563]: Invalid user randall from 128.199.143.89 port 33684
Mar 24 21:52:11 ns392434 sshd[10563]: Failed password for invalid user randall from 128.199.143.89 port 33684 ssh2
Mar 24 21:55:35 ns392434 sshd[10605]: Invalid user qiaodan from 128.199.143.89 port 52349

fail2ban -- 49.232.95.250
...

SSH brute-force attempt

$f2bV_matches | Triggered by Fail2Ban at Vostok web server

k+ssh-bruteforce

03/24/2020-18:21:06.716280 185.175.93.101 Protocol: 6 ET DROP Dshield Block Listed Source group 1