Postfix DNSBL listed. Trying to send SPAM.

Spam mails sent to address hacked/leaked from Nexus Mods in July 2013

IP was detected trying to Brute-Force SSH, FTP, Web Apps, Port-Scan or Hacking.

IP was detected trying to Brute-Force SSH, FTP, Web Apps, Port-Scan or Hacking.

Email spam message

Jun 16 05:10:11 mail.srvfarm.net postfix/smtpd[915897]: NOQUEUE: reject: RCPT from unknown[217.112.128.161]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Jun 16 05:10:11 mail.srvfarm.net postfix/smtpd[916001]: NOQUEUE: reject: RCPT from unknown[217.112.128.161]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Jun 16 05:10:11 mail.srvfarm.net postfix/smtpd[916085]: NOQUEUE: reject: RCPT from unknown[217.112.128.161]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Jun 16 05:10:13 mail.srvfarm.net postfix/smtpd[906475]: NOQUEUE: reject: RCPT from unknown[217.112.128.161

Jun 16 05:28:44 mail.srvfarm.net postfix/smtpd[953476]: NOQUEUE: reject: RCPT from unknown[217.112.128.208]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Jun 16 05:29:50 mail.srvfarm.net postfix/smtpd[953484]: NOQUEUE: reject: RCPT from unknown[217.112.128.208]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Jun 16 05:36:33 mail.srvfarm.net postfix/smtpd[953473]: NOQUEUE: reject: RCPT from unknown[217.112.128.208]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Jun 16 05:36:33 mail.srvfarm.net postfix/smtpd[936017]: NOQUEUE: reject: RCPT from unknown[217.112.128.208]: 450 4.1.8 

Jun  5 18:05:24 mail.srvfarm.net postfix/smtpd[3172177]: NOQUEUE: reject: RCPT from unknown[217.112.128.61]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Jun  5 18:05:24 mail.srvfarm.net postfix/smtpd[3159447]: NOQUEUE: reject: RCPT from unknown[217.112.128.61]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Jun  5 18:07:13 mail.srvfarm.net postfix/smtpd[3160160]: NOQUEUE: reject: RCPT from unknown[217.112.128.61]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Jun  5 18:07:13 mail.srvfarm.net postfix/smtpd[3160138]: NOQUEUE: reject: RCPT fr

Jun  4 13:55:50 mail.srvfarm.net postfix/smtpd[2502236]: NOQUEUE: reject: RCPT from unknown[217.112.128.207]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Jun  4 13:56:38 mail.srvfarm.net postfix/smtpd[2502231]: NOQUEUE: reject: RCPT from unknown[217.112.128.207]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Jun  4 13:57:06 mail.srvfarm.net postfix/smtpd[2502231]: NOQUEUE: reject: RCPT from unknown[217.112.128.207]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Jun  4 13:57:31 mail.srvfarm.net postfix/smtpd[2502236]: NOQUEUE: reject: RCPT from unknown[217.112.128.207]: 450 4.1.8 

May  7 19:17:07 server postfix/smtpd[19737]: NOQUEUE: reject: RCPT from kinky.zilanco.com[217.112.128.246]: 554 5.7.1 Service unavailable; Client host [217.112.128.246] blocked using zen.spamhaus.org; https://www.spamhaus.org/sbl/query/SBL461503 / https://www.spamhaus.org/sbl/query/SBLCSS; from= to= proto=ESMTP helo=

SpamScore above: 10.0

May  4 13:59:58 mail.srvfarm.net postfix/smtpd[3200928]: NOQUEUE: reject: RCPT from unknown[217.112.128.242]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
May  4 14:02:28 mail.srvfarm.net postfix/smtpd[3194833]: NOQUEUE: reject: RCPT from unknown[217.112.128.242]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
May  4 14:02:28 mail.srvfarm.net postfix/smtpd[3199545]: NOQUEUE: reject: RCPT from unknown[217.112.128.242]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
May  4 14:04:26 mail.srvfarm.net postfix/smtpd[3199545]: NOQUEUE: reject: RCPT fr

Brute force attempt

May  2 05:47:33 mail.srvfarm.net postfix/smtpd[1730651]: NOQUEUE: reject: RCPT from unknown[217.112.128.143]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
May  2 05:49:22 mail.srvfarm.net postfix/smtpd[1728026]: NOQUEUE: reject: RCPT from unknown[217.112.128.143]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
May  2 05:54:07 mail.srvfarm.net postfix/smtpd[1728026]: NOQUEUE: reject: RCPT from unknown[217.112.128.143]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
May  2 05:54:42 mail.srvfarm.net postfix/smtpd[1730698]: NOQUEUE: reject: RCPT from unknown[217.112.128.143]: 450 4.1.8 

Apr 29 22:32:28 web01.agentur-b-2.de postfix/smtpd[1198258]: NOQUEUE: reject: RCPT from unknown[217.112.128.175]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Apr 29 22:32:28 web01.agentur-b-2.de postfix/smtpd[1196196]: NOQUEUE: reject: RCPT from unknown[217.112.128.175]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Apr 29 22:32:28 web01.agentur-b-2.de postfix/smtpd[1200720]: NOQUEUE: reject: RCPT from unknown[217.112.128.175]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Apr 29 22:32:28 web01.agentur-b-2.de postfix/smtpd[1200719]: NOQUEUE: reject: RCPT from unknown[

Apr 27 22:06:27 mail.srvfarm.net postfix/smtpd[579250]: NOQUEUE: reject: RCPT from palliate.kranbery.com[217.112.128.159]: 554 5.7.1 Service unavailable; Client host [217.112.128.159] blocked using zen.spamhaus.org; https://www.spamhaus.org/sbl/query/SBL461503 / https://www.spamhaus.org/sbl/query/SBLCSS; from= to= proto=ESMTP helo=
Apr 27 22:06:32 mail.srvfarm.net postfix/smtpd[578441]: NOQUEUE: reject: RCPT from palliate.kranbery.com[217.112.128.159]: 554 5.7.1 Service unavailable; Client host [217.112.128.159] blocked using zen.spamhaus.org; https://www.spamhaus.org/sbl/query/SBL461503 / https://www.spamhaus.org/sbl/query/SBLCSS; from= to= proto=ESMTP helo=
Apr 27 22:07:00 mail.srvfarm.net postfix/smtpd[583779]: NOQUEUE: reject: RCPT from palliate.kranbery.com[217.112.128.159]: 554 5.7.1 Service unavailable; Client host [217.112.128.

Apr 26 23:36:47 web01.agentur-b-2.de postfix/smtpd[1529141]: NOQUEUE: reject: RCPT from sudden.kranbery.com[217.112.128.183]: 554 5.7.1 Service unavailable; Client host [217.112.128.183] blocked using zen.spamhaus.org; https://www.spamhaus.org/sbl/query/SBLCSS / https://www.spamhaus.org/sbl/query/SBL461503; from= to= proto=ESMTP helo=
Apr 26 23:36:47 web01.agentur-b-2.de postfix/smtpd[1530498]: NOQUEUE: reject: RCPT from sudden.kranbery.com[217.112.128.183]: 554 5.7.1 Service unavailable; Client host [217.112.128.183] blocked using zen.spamhaus.org; https://www.spamhaus.org/sbl/query/SBLCSS / https://www.spamhaus.org/sbl/query/SBL461503; from= to= proto=ESMTP helo=
Apr 26 23:36:47 web01.agentur-b-2.de postfix/smtpd[1531377]: NOQUEUE: reject: RCPT from sudden.kranbery.com[217.112.128.183]: 554 5.7.1 Service unavailable; Client host [217.112.128.183] blocked us

1594751302 - 07/14/2020 20:28:22 Host: 187.159.116.86/187.159.116.86 Port: 445 TCP Blocked

$f2bV_matches

Jul 14 19:23:44 rocket sshd[28010]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.187.5.137
Jul 14 19:23:47 rocket sshd[28010]: Failed password for invalid user pkl from 37.187.5.137 port 40582 ssh2
...

Automatic report - Banned IP Access

Honeypot attack, port: 5555, PTR: 90-224-199-216-no2570.tbcn.telia.com.

07/14/2020-14:28:28.405517 193.27.228.220 Protocol: 6 ET SCAN NMAP -sS window 1024

port scan and connect, tcp 8080 (http-proxy)

Jul 14 20:42:45 h1745522 sshd[18997]: Invalid user ajeet from 111.229.163.149 port 40978
Jul 14 20:42:45 h1745522 sshd[18997]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.229.163.149
Jul 14 20:42:45 h1745522 sshd[18997]: Invalid user ajeet from 111.229.163.149 port 40978
Jul 14 20:42:47 h1745522 sshd[18997]: Failed password for invalid user ajeet from 111.229.163.149 port 40978 ssh2
Jul 14 20:45:35 h1745522 sshd[19134]: Invalid user hien from 111.229.163.149 port 44080
Jul 14 20:45:35 h1745522 sshd[19134]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.229.163.149
Jul 14 20:45:35 h1745522 sshd[19134]: Invalid user hien from 111.229.163.149 port 44080
Jul 14 20:45:37 h1745522 sshd[19134]: Failed password for invalid user hien from 111.229.163.149 port 44080 ssh2
Jul 14 20:48:12 h1745522 sshd[19256]: Invalid user server from 111.229.163.149 port 47162
...

Jul 14 08:24:35 tdfoods sshd\[16608\]: Invalid user red from 99.17.246.167
Jul 14 08:24:35 tdfoods sshd\[16608\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=99.17.246.167
Jul 14 08:24:37 tdfoods sshd\[16608\]: Failed password for invalid user red from 99.17.246.167 port 43368 ssh2
Jul 14 08:28:33 tdfoods sshd\[16890\]: Invalid user ftpuser from 99.17.246.167
Jul 14 08:28:33 tdfoods sshd\[16890\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=99.17.246.167

2020-07-14T14:07:29.7695771495-001 sshd[61309]: Invalid user klaus from 148.153.134.26 port 26183
2020-07-14T14:07:31.9312961495-001 sshd[61309]: Failed password for invalid user klaus from 148.153.134.26 port 26183 ssh2
2020-07-14T14:09:04.0761371495-001 sshd[61336]: Invalid user fabrice from 148.153.134.26 port 65437
2020-07-14T14:09:04.0793881495-001 sshd[61336]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.153.134.26
2020-07-14T14:09:04.0761371495-001 sshd[61336]: Invalid user fabrice from 148.153.134.26 port 65437
2020-07-14T14:09:05.6107311495-001 sshd[61336]: Failed password for invalid user fabrice from 148.153.134.26 port 65437 ssh2
...

[Wed Jul 15 01:28:22.702077 2020] [:error] [pid 13074:tid 140254315534080] [client 173.252.95.36:64308] [client 173.252.95.36] ModSecurity: Access denied with code 403 (phase 2). Match of "eq 0" against "&REQUEST_HEADERS:Transfer-Encoding" required. [file "/etc/modsecurity/owasp-modsecurity-crs-3.2.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "202"] [id "920171"] [msg "GET or HEAD Request with Transfer-Encoding."] [data "1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.2.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "karangploso.jatim.bmkg.go.id"] [uri "/script-v49.js"] [unique_id "Xw35Rp6BljNWiMsO2yWGSwABwwM"]
...

Honeypot attack, port: 445, PTR: PTR record not found

Jul 14 20:35:35 santamaria sshd\[2157\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.85.42.178  user=root
Jul 14 20:35:37 santamaria sshd\[2157\]: Failed password for root from 112.85.42.178 port 20790 ssh2
Jul 14 20:35:47 santamaria sshd\[2157\]: Failed password for root from 112.85.42.178 port 20790 ssh2
...

(sshd) Failed SSH login from 51.15.125.53 (NL/Netherlands/53-125-15-51.instances.scw.cloud): 5 in the last 3600 secs

2020-07-14T18:25:27.200221shield sshd\[392\]: Invalid user xuyuanchao from 128.199.254.89 port 51554
2020-07-14T18:25:27.208969shield sshd\[392\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.254.89
2020-07-14T18:25:29.021624shield sshd\[392\]: Failed password for invalid user xuyuanchao from 128.199.254.89 port 51554 ssh2
2020-07-14T18:28:38.234165shield sshd\[1372\]: Invalid user maggiori from 128.199.254.89 port 47914
2020-07-14T18:28:38.242831shield sshd\[1372\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.254.89