Apr 20 05:38:05 mail.srvfarm.net postfix/smtpd[1039654]: NOQUEUE: reject: RCPT from unknown[217.112.142.97]: 554 5.7.1 Service unavailable; Client host [217.112.142.97] blocked using zen.spamhaus.org; https://www.spamhaus.org/sbl/query/SBLCSS; from= to= proto=ESMTP helo=
Apr 20 05:39:27 mail.srvfarm.net postfix/smtpd[1039769]: NOQUEUE: reject: RCPT from unknown[217.112.142.97]: 554 5.7.1 Service unavailable; Client host [217.112.142.97] blocked using zen.spamhaus.org; https://www.spamhaus.org/sbl/query/SBLCSS; from= to= proto=ESMTP helo=
Apr 20 05:39:34 mail.srvfarm.net postfix/smtpd[1041582]: NOQUEUE: reject: RCPT from unknown[217.112.142.97]: 554 5.7.1 Service unavailable; Client host [217.112.142.97] blocked using zen.spamhaus.org; https://www.spamhaus.org/sbl/query/SBLCSS; from= to= pr

Apr 20 05:32:41 mail.srvfarm.net postfix/smtpd[1038666]: NOQUEUE: reject: RCPT from placid.onvacationnow.com[208.187.166.179]: 554 5.7.1 Service unavailable; Client host [208.187.166.179] blocked using zen.spamhaus.org; https://www.spamhaus.org/sbl/query/SBLCSS; from= to= proto=ESMTP helo=
Apr 20 05:36:15 mail.srvfarm.net postfix/smtpd[1039769]: NOQUEUE: reject: RCPT from placid.onvacationnow.com[208.187.166.179]: 554 5.7.1 : Relay access denied; from= to= proto=ESMTP helo=
Apr 20 05:36:15 mail.srvfarm.net postfix/smtpd[1039654]: NOQUEUE: reject: RCPT from placid.onvacationnow.com[208.187.166.179]: 554 5.7.1 Service unavailable; Client host [208.187.166.179] blocked using zen.spamhaus.org; https://www.spamhaus.org/sbl/query/SBLCSS; from= to= proto=ESMTP helo=

Apr 20 03:49:41 vps46666688 sshd[32624]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=75.44.16.251
Apr 20 03:49:43 vps46666688 sshd[32624]: Failed password for invalid user ubuntu2 from 75.44.16.251 port 43382 ssh2
...

WordPress wp-login brute force :: 190.218.251.162 0.052 BYPASS [20/Apr/2020:05:01:05  0000] [censored_2] "POST /wp-login.php HTTP/1.1" 200 2287 "https://[censored_2]/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36"

FTP Brute Force

Apr 20 05:56:12 prod4 vsftpd\[31624\]: \[anonymous\] FAIL LOGIN: Client "36.148.89.82"
Apr 20 05:56:16 prod4 vsftpd\[31628\]: \[www\] FAIL LOGIN: Client "36.148.89.82"
Apr 20 05:56:19 prod4 vsftpd\[31630\]: \[www\] FAIL LOGIN: Client "36.148.89.82"
Apr 20 05:56:25 prod4 vsftpd\[31637\]: \[www\] FAIL LOGIN: Client "36.148.89.82"
Apr 20 05:56:28 prod4 vsftpd\[31642\]: \[www\] FAIL LOGIN: Client "36.148.89.82"
...

fail2ban

Apr 20 10:13:41 takio postfix/smtpd[19302]: lost connection after AUTH from unknown[92.118.38.83]
Apr 20 10:16:49 takio postfix/smtpd[19346]: lost connection after AUTH from unknown[92.118.38.83]
Apr 20 10:20:05 takio postfix/smtpd[19357]: lost connection after AUTH from unknown[92.118.38.83]

Apr 20 06:45:51 vlre-nyc-1 sshd\[17894\]: Invalid user ez from 4.7.94.244
Apr 20 06:45:51 vlre-nyc-1 sshd\[17894\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=4.7.94.244
Apr 20 06:45:53 vlre-nyc-1 sshd\[17894\]: Failed password for invalid user ez from 4.7.94.244 port 37036 ssh2
Apr 20 06:50:11 vlre-nyc-1 sshd\[18042\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=4.7.94.244  user=root
Apr 20 06:50:13 vlre-nyc-1 sshd\[18042\]: Failed password for root from 4.7.94.244 port 56464 ssh2
...

(From claudiauclement@yahoo.com) Hi, We are wondering if you would be interested in our service, where we can provide you with a dofollow link from Amazon (DA 96) back to michelchiropracticcenter.com?

The price is just $79 per link, via Paypal.

To explain what DA is and the benefit for your website, along with a sample of an existing link, please read here: https://justpaste.it/6jp87

If you'd be interested in learning more, reply to this email but please make sure you include the word INTERESTED in the subject line field, so we can get to your reply sooner.

Kind Regards,
Claudia

Apr 20 07:08:37 vmd26974 sshd[24196]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.154.119.48
Apr 20 07:08:39 vmd26974 sshd[24196]: Failed password for invalid user admin2 from 195.154.119.48 port 54298 ssh2
...

Apr 20 08:39:38 web01.agentur-b-2.de postfix/smtpd[1426427]: warning: unknown[185.50.149.16]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Apr 20 08:39:38 web01.agentur-b-2.de postfix/smtpd[1426427]: lost connection after AUTH from unknown[185.50.149.16]
Apr 20 08:39:43 web01.agentur-b-2.de postfix/smtpd[1426427]: lost connection after AUTH from unknown[185.50.149.16]
Apr 20 08:39:47 web01.agentur-b-2.de postfix/smtpd[1426427]: lost connection after AUTH from unknown[185.50.149.16]
Apr 20 08:39:52 web01.agentur-b-2.de postfix/smtpd[1426450]: lost connection after AUTH from unknown[185.50.149.16]

Automatic report - WordPress Brute Force

(sshd) Failed SSH login from 51.15.140.60 (FR/France/60-140-15-51.rev.cloud.scaleway.com): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Apr 20 05:54:35 amsweb01 sshd[11807]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.15.140.60  user=root
Apr 20 05:54:36 amsweb01 sshd[11807]: Failed password for root from 51.15.140.60 port 54872 ssh2
Apr 20 06:06:30 amsweb01 sshd[13414]: Invalid user rg from 51.15.140.60 port 50528
Apr 20 06:06:32 amsweb01 sshd[13414]: Failed password for invalid user rg from 51.15.140.60 port 50528 ssh2
Apr 20 06:10:32 amsweb01 sshd[13861]: Invalid user postgres from 51.15.140.60 port 40174

$f2bV_matches