Dating Fraud Spam

Return-Path: 
Received: from 179-108-83-11.netturbo.com.br (unknown [179.108.83.11])
Message-ID: <_____@netturbo.com.br>
Date: Mon, 28 Oct 2019 13:56:18 -1100
From: "Makayla" 
User-Agent: QUALCOMM Windows Eudora Version 5.1
To: "Makayla" <_____>
Subject: can you meet me on the weekend

Oct 29 07:58:21 vmanager6029 sshd\[17004\]: Invalid user grafika from 106.12.222.40 port 41488
Oct 29 07:58:21 vmanager6029 sshd\[17004\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.222.40
Oct 29 07:58:23 vmanager6029 sshd\[17004\]: Failed password for invalid user grafika from 106.12.222.40 port 41488 ssh2

2019-10-29T11:09:30.046691tmaserv sshd\[25150\]: Failed password for root from 107.170.199.180 port 47664 ssh2
2019-10-29T12:12:38.450516tmaserv sshd\[30398\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=fronterawinddata.mx  user=root
2019-10-29T12:12:40.263634tmaserv sshd\[30398\]: Failed password for root from 107.170.199.180 port 53693 ssh2
2019-10-29T12:16:52.278623tmaserv sshd\[31104\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=fronterawinddata.mx  user=root
2019-10-29T12:16:54.297063tmaserv sshd\[31104\]: Failed password for root from 107.170.199.180 port 44679 ssh2
2019-10-29T12:21:03.666221tmaserv sshd\[31637\]: Invalid user ccom from 107.170.199.180 port 35668
...

[Aegis] @ 2019-10-29 10:20:54  0000 -> Multiple authentication failures.

Oct 29 16:25:37 areeb-Workstation sshd[14795]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.153.159.222
Oct 29 16:25:39 areeb-Workstation sshd[14795]: Failed password for invalid user amit from 218.153.159.222 port 42004 ssh2
...

Oct 29 11:15:17 minden010 sshd[2705]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.3.101.99
Oct 29 11:15:19 minden010 sshd[2705]: Failed password for invalid user eduard from 212.3.101.99 port 50530 ssh2
Oct 29 11:19:19 minden010 sshd[5245]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.3.101.99
...

(sshd) Failed SSH login from 128.199.230.56 (SG/Singapore/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Oct 29 09:20:30 server2 sshd[19806]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.230.56  user=root
Oct 29 09:20:33 server2 sshd[19806]: Failed password for root from 128.199.230.56 port 41210 ssh2
Oct 29 09:24:57 server2 sshd[19874]: Invalid user xq from 128.199.230.56 port 60646
Oct 29 09:24:59 server2 sshd[19874]: Failed password for invalid user xq from 128.199.230.56 port 60646 ssh2
Oct 29 09:29:17 server2 sshd[20048]: Invalid user admin from 128.199.230.56 port 51849

www.ft-1848-basketball.de 209.97.183.237 \[29/Oct/2019:10:29:14 +0100\] "POST /wp-login.php HTTP/1.1" 200 2172 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"
www.ft-1848-basketball.de 209.97.183.237 \[29/Oct/2019:10:29:20 +0100\] "POST /wp-login.php HTTP/1.1" 200 2143 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"

WordPress login Brute force / Web App Attack on client site.

Invalid user srcuser from 45.55.213.169 port 20827

Oct 29 08:40:59 game-panel sshd[25406]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.117.108.88
Oct 29 08:41:00 game-panel sshd[25406]: Failed password for invalid user sjx from 138.117.108.88 port 47463 ssh2
Oct 29 08:45:19 game-panel sshd[25541]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.117.108.88

2019-10-29T05:39:55.994578shield sshd\[17592\]: Invalid user lyndon from 124.251.110.147 port 53086
2019-10-29T05:39:55.998825shield sshd\[17592\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=124.251.110.147
2019-10-29T05:39:58.080091shield sshd\[17592\]: Failed password for invalid user lyndon from 124.251.110.147 port 53086 ssh2
2019-10-29T05:47:08.596533shield sshd\[18945\]: Invalid user yuyuyu from 124.251.110.147 port 56406
2019-10-29T05:47:08.600707shield sshd\[18945\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=124.251.110.147

Oct 28 06:35:16 newdogma sshd[28813]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.128.226.176  user=r.r
Oct 28 06:35:17 newdogma sshd[28813]: Failed password for r.r from 27.128.226.176 port 48378 ssh2
Oct 28 06:35:17 newdogma sshd[28813]: Received disconnect from 27.128.226.176 port 48378:11: Bye Bye [preauth]
Oct 28 06:35:17 newdogma sshd[28813]: Disconnected from 27.128.226.176 port 48378 [preauth]
Oct 28 07:03:04 newdogma sshd[28924]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.128.226.176  user=r.r
Oct 28 07:03:07 newdogma sshd[28924]: Failed password for r.r from 27.128.226.176 port 36630 ssh2
Oct 28 07:03:07 newdogma sshd[28924]: Received disconnect from 27.128.226.176 port 36630:11: Bye Bye [preauth]
Oct 28 07:03:07 newdogma sshd[28924]: Disconnected from 27.128.226.176 port 36630 [preauth]
Oct 28 07:09:07 newdogma sshd[28997]: Invalid user hercul from 27.128.226.176 po........
-------------------------------

207.154.224.103 - - \[29/Oct/2019:09:39:14 +0000\] "POST /wp-login.php HTTP/1.1" 200 4358 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"
207.154.224.103 - - \[29/Oct/2019:09:39:14 +0000\] "POST /xmlrpc.php HTTP/1.1" 200 403 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"
...

2019-10-29T11:42:27.449373mail01 postfix/smtpd[6618]: warning: unknown[78.128.113.120]: SASL PLAIN authentication failed:
2019-10-29T11:42:27.449900mail01 postfix/smtpd[28725]: warning: unknown[78.128.113.120]: SASL PLAIN authentication failed:
2019-10-29T11:42:33.066439mail01 postfix/smtpd[9534]: warning: unknown[78.128.113.120]: SASL PLAIN authentication failed: