firewall-block, port(s): 1900/udp

firewall-block, port(s): 1900/udp

Jun 26 23:06:30 gitlab-ci sshd\[9346\]: Invalid user SUPERVISOR from 94.102.63.70Jun 26 23:06:38 gitlab-ci sshd\[9349\]: Invalid user SUPERVISOR from 94.102.63.70
...

SSH login attempts.

 TCP (SYN) 94.102.63.51:40723 -> port 443, len 44

trying to access non-authorized port

fail2ban/May 26 01:23:34 h1962932 sshd[32397]: Invalid user NULL from 94.102.63.82 port 41314
May 26 01:23:34 h1962932 sshd[32397]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.102.63.82
May 26 01:23:34 h1962932 sshd[32397]: Invalid user NULL from 94.102.63.82 port 41314
May 26 01:23:36 h1962932 sshd[32397]: Failed password for invalid user NULL from 94.102.63.82 port 41314 ssh2
May 26 01:23:37 h1962932 sshd[32401]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.102.63.82  user=root
May 26 01:23:38 h1962932 sshd[32401]: Failed password for root from 94.102.63.82 port 42882 ssh2

[portscan] tcp/22 [SSH]
in blocklist.de:'listed [ssh]'
in SpamCop:'listed'
*(RWIN=65535)(04041152)

Apr  3 05:55:22 web01.agentur-b-2.de dovecot: pop3-login: Disconnected (auth failed, 1 attempts in 2 secs): user=, method=PLAIN, rip=94.102.63.27, lip=185.118.198.210, session=<1Abf4lqiTK1eZj8b>
Apr  3 05:55:26 web01.agentur-b-2.de dovecot: pop3-login: Disconnected (auth failed, 1 attempts in 6 secs): user=, method=PLAIN, rip=94.102.63.27, lip=185.118.198.210, session=
Apr  3 05:55:26 web01.agentur-b-2.de dovecot: pop3-login: Disconnected (auth failed, 1 attempts in 6 secs): user=, method=PLAIN, rip=94.102.63.27, lip=185.118.198.210, session=
Apr  3 05:55:26 web01.agentur-b-2.de dovecot: pop3-login: Disconnected (auth failed, 1 attempts in 6 secs): user=, method=PLAIN, rip=94.102.63.27, lip=185.118.198.210, session=
Apr  3 05:55:26 web01.agentur-b-2.de dovecot: pop3-login: Disconnected (auth failed, 1 attempts in 6 secs): user=

Dec 20 15:48:40 h2177944 kernel: \[52139.817986\] \[UFW BLOCK\] IN=venet0 OUT= MAC= SRC=94.102.63.65 DST=85.214.117.9 LEN=40 TOS=0x00 PREC=0x00 TTL=250 ID=13964 PROTO=TCP SPT=41984 DPT=43395 WINDOW=1024 RES=0x00 SYN URGP=0 
Dec 20 15:48:40 h2177944 kernel: \[52139.818003\] \[UFW BLOCK\] IN=venet0 OUT= MAC= SRC=94.102.63.65 DST=85.214.117.9 LEN=40 TOS=0x00 PREC=0x00 TTL=250 ID=13964 PROTO=TCP SPT=41984 DPT=43395 WINDOW=1024 RES=0x00 SYN URGP=0 
Dec 20 15:49:21 h2177944 kernel: \[52180.653305\] \[UFW BLOCK\] IN=venet0 OUT= MAC= SRC=94.102.63.65 DST=85.214.117.9 LEN=40 TOS=0x00 PREC=0x00 TTL=250 ID=5193 PROTO=TCP SPT=41984 DPT=33398 WINDOW=1024 RES=0x00 SYN URGP=0 
Dec 20 15:49:21 h2177944 kernel: \[52180.653322\] \[UFW BLOCK\] IN=venet0 OUT= MAC= SRC=94.102.63.65 DST=85.214.117.9 LEN=40 TOS=0x00 PREC=0x00 TTL=250 ID=5193 PROTO=TCP SPT=41984 DPT=33398 WINDOW=1024 RES=0x00 SYN URGP=0 
Dec 20 15:51:26 h2177944 kernel: \[52305.992199\] \[UFW BLOCK\] IN=venet0 OUT= MAC= SRC=94.102.63.65 DST=85.214.117.9 LEN=40 TOS=0

smtp brute force login

COPYRIGHT ABUSE

PHISHING AND SPAM ATTACK
176.10.127.151 Beat Fungus - DefeatFungus@sleeppowder.us, Nail Fungus: Lack These Two Nutrients And You Risk Total Body Infection, 10 Jun 2021
inetnum:        176.10.127.1 - 176.10.127.255
netname:        Speed-Net
country:        CH
Other emails from same group
176.10.127.151 Beat Fungus - DefeatFungus@sleeppowder.us, Nail Fungus: Lack These Two Nutrients And You Risk Total Body Infection, 10 Jun 2021
176.10.127.165 Moderna Shopper Gift Card Chance@viscarofix.us - ModernaShopperFeedback@viscarofix.us, Congratulations! You can get a $50 Moderna gift card!, 2 Jun 2021
176.10.127.199 American Airlines Shopper Gift Card Chance@viscarofix.us - AmericanAirlinesShopperGiftOpportunity@viscarofix.us, Congratulations! You can get a $50 American Airlines gift card!, 2 Jun 2021

PHISHING ATTACK
195.133.39.135 Get Control -GetControl@shippingcontainr.us, Rioters Set to Target THESE States Next?, Thu, Fri, 21 May 2021 
inetnum:        194.59.216.0 - 194.59.217.255
inetnum:        195.133.12.0 - 195.133.15.255
inetnum:        195.133.39.0 - 195.133.39.255
netname:        Serverion
Other emails from same group
194.59.216.25  Red Lobster Opinion Requested@lostbook.us - RedLobsterShopperGiftOpportunity@lostbook.us - Congratulations! You can get a $50 Red Lobster gift card!, Sun, 16 May 2021
194.59.216.51  Battery Trick - RestorationTrick@promindbettry.us - [video] Dead Simple Trick Brings Any Battery Back To LifeBattery Trick, Wed, 19 May 2021 14:34:46
195.133.15.205 Verizon Opinion Requested - VerizonShopperFeedback@verizonx.us - BONUS: $50 VERIZON Gift Card Opportunity, Thu, 6 May 2021
195.133.15.206 LingoGenie - LingoGenie@verizonx.us - A Must Have for Your Travel and Business Meetings, Thu, 6 May 2021
195.133.15.208 Space Age - SpaceAge@prayrmiracle.us -  ,Bioenergetic Imprinting to overcome 10 years of back pain!, Sat, 15 May 2021
195.133.15.208 Space Age - SpaceAge@prayrmiracle.us - , BONUS: $50 KROGER Gift Card Opportunity, Sat, 15 May 2021
195.133.15.216 TedsWoodworking - TedsWoodworking@nerveshield.buzz -, open this..., Thu, 13 May 2021 
195.133.15.229 Diy Landscaping Designs -DiyLandscapingDesigns@urgentwood.us- Home & garden landscaping, Sun, 9 May 2021 
195.133.15.231 Easy sheds -ShedPlansInside@sonavel.us- Build sheds easily with this collection of 12,000 plans, Sun, 9 May 2021
195.133.39.132 Thank You! Pickupsavings -PickupsavingsRewardNotice@promindboost.us- CONGRATS! You Can Get $100 CVS Rewards, Thu, 20 May 2021 13:38:55 
195.133.39.135 Get Control -GetControl@shippingcontainr.us, Rioters Set to Target THESE States Next?, Thu, Fri, 21 May 2021 
195.133.39.193 Secret Leaked - SecretLeaked@droness.us - Is it possible to drop 3lbs a week just by taking a capsule a day?, Thu, 20 May 2021 10:44:48

PHISHING ATTACK
45.137.22.44 Barbara Liu liuli.hgxs@sinopec.com, Req Invoice, 27 May 2021 
NetRange:       45.128.0.0 - 45.159.255.255
OrgId:          RIPE
Other emails from same group are listed below as PHISHING AND SPAM ATTACK as well as; 
45.137.22.37 Engr. Ghazanfar Raza - ghazanfar@sgbmdxb.com - NEW ORDER, 17 May 2021 
45.137.22.37 M. Ahmed Bilwani - editorial@thejakartapost.com - OUTSTANDING PAYMENT REMINDER, 17 May 2021
45.137.22.44 Barbara Liu liuli.hgxs@sinopec.com, Req Invoice, 27 May 2021

Sgsvsl

UFW BLOCK

773911650

gg

PHISHING ATTACK
195.133.39.208 American Airlines Opinion Requested@highspeech.us - AmericanAirlinesOpinionRequested@highspeech.us, Congratulations! You can get a $50 American Airlines gift card!, 1 Jun 2021 
inetnum:        194.59.216.0 - 194.59.217.255
inetnum:        195.133.12.0 - 195.133.15.255
inetnum:        195.133.39.0 - 195.133.39.255
netname:        Serverion
Other emails from same group
194.59.216.51  Battery Trick - RestorationTrick@promindbettry.us - [video] Dead Simple Trick Brings Any Battery Back To LifeBattery Trick, Wed, 19 May 2021 14:34:46
195.133.15.205 Verizon Opinion Requested - VerizonShopperFeedback@verizonx.us - BONUS: $50 VERIZON Gift Card Opportunity, Thu, 6 May 2021
195.133.15.229 Diy Landscaping Designs -DiyLandscapingDesigns@urgentwood.us- Home & garden landscaping, Sun, 9 May 2021 
195.133.15.231 Easy sheds -ShedPlansInside@sonavel.us- Build sheds easily with this collection of 12,000 plans, Sun, 9 May 2021
195.133.39.132 Thank You! Pickupsavings -PickupsavingsRewardNotice@promindboost.us- CONGRATS! You Can Get $100 CVS Rewards, Thu, 20 May 2021 13:38:55 
195.133.39.135 Get Control -GetControl@shippingcontainr.us, Rioters Set to Target THESE States Next?, Thu, Fri, 21 May 2021 
195.133.39.193 Secret Leaked - SecretLeaked@droness.us - Is it possible to drop 3lbs a week just by taking a capsule a day?, Thu, 20 May 2021 10:44:48
195.133.39.208 American Airlines Opinion Requested@highspeech.us - AmericanAirlinesOpinionRequested@highspeech.us, Congratulations! You can get a $50 American Airlines gift card!, 1 Jun 2021 
195.133.39.228 Winning Powerball  LotteryJackpots@speechocity.co , Scientists: 12X More Chances Of Winning The Lottery If You’re Bad At Math, 30 May 2021
195.133.39.231 Pfizer Opinion Requested - PfizerShopperGiftCardChance@gripshed.us, Shopper, You can qualify to get a $50 Pfizer gift card!, 31 May 2021

PHISHING AND SPAM ATTACK
185.222.57.143  Barbara Liu / 刘莉 - liuli.hgxs"@sinopec.com, Payment confirmation,  13 Jun 2021
person:    	K.M. Badrul Alam
address:   Naherins Domain, 134/7 B, Furfura Sharif Road, Darus Salam
inetnum:   45.128.0.0 - 45.159.255.255
	185.222.57.0 - 185.222.57.255
Other emails from same group are listed below as PHISHING AND SPAM ATTACK as well as; 
45.137.22.37 Engr. Ghazanfar Raza - ghazanfar@sgbmdxb.com - NEW ORDER, 17 May 2021 
45.137.22.37 M. Ahmed Bilwani - editorial@thejakartapost.com - OUTSTANDING PAYMENT REMINDER, 17 May 2021
45.137.22.44 Barbara Liu liuli.hgxs@sinopec.com, Req Invoice, 27 May 2021
185.222.57.140  FUKUSEN (SALES DEPT) - fukusen-ikari@alpha.ocn.ne.jp - RE: Confirmation Order for PO # B18024091/02730918, 4 May 2021 21:38:19
185.222.57.140 Julie shi - shifulan@sinotrans.com - RE: SATEMENT OF ACCOUNT, 5 May 2021
185.222.57.140 Jason Kim - jason@wscorporation.co.kr - Enquiry # A87983T - Fittings and Flanges for LNG project, 30 Apr 2021
185.222.57.140 Jason Kim - jason@wscorporation.co.kr - Enquiry # A87983T - Fittings and Flanges for LNG project, Mon, 26 Apr 2021
185.222.57.140 Jason Kim - jason@wscorporation.co.kr - Enquiry # A87983T - Fittings and Flanges for LNG project, Sun, 25 Apr 2021
185.222.57.140 Magdi Amin - areej@alamalcargo.com - RE: New Order, 6 May 2021
185.222.57.143  Mr. Ahmed Bilwani - daniel.robinson@compelo.com, OUTSTANDING PAYMENT REMINDER, 13 Jun 2021

PHISHING AND SPAM ATTACK
31.210.22.79 Facebook Shopper Gift Card - FacebookShopperFeedback@ebaysurveye.us, BONUS: $50 FACEBOOK Gift Card Opportunity, 9 Jun 2021 
netname: 	SERVER-31-210-22-0 country: NL, netname: SERVER-185-239-242-0 country: NL
NetRange:       31.210.22.0 - 31.210.23.255
NetRange:       185.239.242.0 - 185.239.242.255 
Other emails from same group
31.210.22.10 Miraculous Solution - MiraculousSolution@moskintorpro.us, 1 morning drink RESETS high blood sugar?, 8 Jun 2021 
31.210.22.67 American Airlines Shopper Gift Opportunity@edelixir.buzz - AmericanAirlinesOpinionRequested@edelixir.buzz, Shopper, You can qualify to get a $50 American Airlines gift card!, 8 Jun 2021 
31.210.22.79 Facebook Shopper Gift Card - FacebookShopperFeedback@ebaysurveye.us, BONUS: $50 FACEBOOK Gift Card Opportunity, 9 Jun 2021
31.210.22.81 ReverseMortgageQuiz -ReverseMortgageQuiz@probiotic.guru- Take this quiz to see if you qualify for a reverse mortgage  Sat, 10 Apr 2021
185.239.242.73 Divine Locks Method -DivineLocksMethod@heaterwood.buzz- Divine Locks Method for revitalizing your thick, full and youthful hair. Sat, 10 Apr 2021   
185.239.242.82 Soul-Mate -Soulmate@savagehut.us- Want to Meet Your Soulmate? Sun, 11 Apr 2021 
185.239.242.122 Sugar Control Remedies@savagegroww.us - SugarControlRemedies@savagegroww.us -  4 Year Old SAVES Grandpa From Diabetes Type 2, Sat, 17 Apr 2021

2001:0002:14:5:1:2:bf35:2610

PHISHING AND SPAM ATTACK
161.35.111.0 Re: Bigger deal - newsletter@elmyar.co.in, Hello .. your email address .., Grab a chance to win a $300 Hello Fresh Gift Card!, 12 Jun 2021
NetName:        DIGITALOCEAN-161-35-0-0
country:        US
inetnum:        161.35.0.0 - 161.35.255.255
Other emails from same group
161.35.111.0 Jackpot Lottery Winners - tony@gmail.com - I'd won more than $324,000 in the last four months, 18 May 2021 
161.35.111.0 FreeSpins4You +Bonus  newsletter@elmyar.co.in, Claim your welcome Bonus at King Billy on $1000 OR 5 BTC +200 FREE SPINS, 08 Jun 2021

login failure for user admin from 95.172.59.182 via dude

PHISHING ATTACK
213.202.208.175 Australia citizens - unvesty@gotorinshotel.nrw - Using this "wealth loophole", Tue, 18 May 2021 05:10:07
inetnum:        213.202.208.0 - 213.202.208.255
netname:        MYLOC-WEBTROPIA-ADD-02
descr:          Additional IPs for webtropia.com hosts

PHISHING AND SPAM ATTACK
31.210.22.7    Mosquito Band - RepelsMosquitoes@carbofixx.co, This summer's solution: repel mosquitoes with a Smart Watch, 17 Jun 2021
31.210.22.9    Fat belly - info@bloodpressure.buzz,  Japanese “Fix” for Belly Fat?, 17 Jun 2021
31.210.22.59   Libido Dropped - PenisMinerals@shippingcontainr.us, Lack These Two Minerals And Risk A Permanent Limp Penis, 17 Jun 2021
31.210.22.69   Enhance Your Health - EnhanceYourHealth@dietzilla.us, Here's exactly what you'll get with your custom keto meal plan, 17 Jun 2021
31.210.22.82   Online Gaming - OnlineCasino@smartpad.today, It’s your way or the highway at Highway Casino!, 17 Jun 2021
netname: 		SERVER-31-210-22-0 country: NL, netname: SERVER-185-239-242-0 country: NL
NetRange:       	31.210.22.0 - 31.210.23.255
NetRange:       	185.239.242.0 - 185.239.242.255 
Other emails from same group
31.210.22.10 Miraculous Solution - MiraculousSolution@moskintorpro.us, 1 morning drink RESETS high blood sugar?, 8 Jun 2021
31.210.22.17 Anti Tar - AntiTar@massivemalez.us, Who said smoking has to be unhealthy?, 9 Jun 2021 
31.210.22.18 woodworking business ideas - woodworkingbusinessideas@massivemalez.us, How to start a woodworking business, 9 Jun 2021 
31.210.22.24   Remodeling Solution - OneDayBathroomRenovation@smartexx.us, Update your bathroom in ONE DAY, 11 Jun 2021
31.210.22.67 American Airlines Shopper Gift Opportunity@edelixir.buzz - AmericanAirlinesOpinionRequested@edelixir.buzz, Shopper, You can qualify to get a $50 American Airlines gift card!, 8 Jun 2021 
31.210.22.79 Facebook Shopper Gift Card - FacebookShopperFeedback@ebaysurveye.us, BONUS: $50 FACEBOOK Gift Card Opportunity, 9 Jun 2021
31.210.22.81 ReverseMortgageQuiz -ReverseMortgageQuiz@probiotic.guru- Take this quiz to see if you qualify for a reverse mortgage  Sat, 10 Apr 2021