Automatic report - Port Scan Attack

Dec  1 08:01:41 hpm sshd\[8767\]: Invalid user server from 147.50.3.30
Dec  1 08:01:41 hpm sshd\[8767\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=147.50.3.30
Dec  1 08:01:43 hpm sshd\[8767\]: Failed password for invalid user server from 147.50.3.30 port 15807 ssh2
Dec  1 08:05:37 hpm sshd\[9138\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=147.50.3.30  user=root
Dec  1 08:05:39 hpm sshd\[9138\]: Failed password for root from 147.50.3.30 port 32743 ssh2

[munged]::443 81.208.42.145 - - [01/Dec/2019:15:41:01 +0100] "POST /[munged]: HTTP/1.1" 200 9081 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
[munged]::443 81.208.42.145 - - [01/Dec/2019:15:41:02 +0100] "POST /[munged]: HTTP/1.1" 200 9081 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
[munged]::443 81.208.42.145 - - [01/Dec/2019:15:41:03 +0100] "POST /[munged]: HTTP/1.1" 200 9081 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
[munged]::443 81.208.42.145 - - [01/Dec/2019:15:41:04 +0100] "POST /[munged]: HTTP/1.1" 200 9081 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
[munged]::443 81.208.42.145 - - [01/Dec/2019:15:41:04 +0100] "POST /[munged]: HTTP/1.1" 200 9081 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
[munged]::443 81.208.42.145 - - [01/Dec/2019:15:41:05 +0100] "POST /[munged]: HTTP/1.1" 200 9081 "-" "Mozilla/5.0 (X11; Ubun

Message ID	
Created at:	Sun, Dec 1, 2019 at 8:37 AM (Delivered after -2409 seconds)
From:	Alert 
Subject:	(08) Your account will be closed in 10 Hours
SPF:	PASS with IP 3.115.189.184
ARC-Authentication-Results: i=1; mx.google.com;
       spf=pass (google.com: best guess record for domain of uwbqoczr@n2vs6---n2vs6----us-west-2.compute.amazonaws.com designates 3.115.189.184 as permitted sender) smtp.mailfrom=UwBQOcZr@n2vs6---n2vs6----us-west-2.compute.amazonaws.com
Return-Path: 
Received: from cyborganic.com (ec2-3-115-189-184.ap-northeast-1.compute.amazonaws.com. [3.115.189.184])
        by mx.google.com with ESMTP id t142si9144246oih.242.2019.12.01.05.57.37

(imapd) Failed IMAP login from 24.224.216.187 (CA/Canada/blk-224-216-187.eastlink.ca): 1 in the last 3600 secs

Dec  1 19:08:43 relay postfix/smtpd\[29589\]: warning: unknown\[46.38.144.179\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Dec  1 19:09:37 relay postfix/smtpd\[20110\]: warning: unknown\[46.38.144.179\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Dec  1 19:09:55 relay postfix/smtpd\[29589\]: warning: unknown\[46.38.144.179\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Dec  1 19:10:51 relay postfix/smtpd\[26314\]: warning: unknown\[46.38.144.179\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Dec  1 19:11:09 relay postfix/smtpd\[29589\]: warning: unknown\[46.38.144.179\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
...

Dec  1 17:40:55 cp sshd[5739]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.1.100

5x Failed Password

Dec  1 17:53:48 mail sshd\[30445\]: Invalid user muzio from 122.165.207.151
Dec  1 17:53:48 mail sshd\[30445\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.165.207.151
Dec  1 17:53:50 mail sshd\[30445\]: Failed password for invalid user muzio from 122.165.207.151 port 19460 ssh2
...

" "

Sending out some get laid now type spam emails
from IP 209.85.220.69  (Google.com) 

The spammer's websites are located at 

https://docs.google.com/forms/d/e/1FAIpQLSeJ6xrSPrAFWOMMXgCExIRlu7zB3VNCzARdwdlR5uedryWSvg/viewform?vc=0&c=0&w=1&usp=mail_form_link
IP: 172.217.14.206 (Google.com) 

http://meetsafes.us/meet.php
IP: 198.54.120.157 
(namecheap.com / namecheaphosting.com) 

Which redirects to 
http://getlaidsecrets.com/presales/RF_Dating_Prelanders/lp5/?aff_id=3855&aff_sub=&aff_sub2=b7c916662fd3310772724b17de49cf9f355a1344&aff_sub3=&aff_sub4=&aff_sub5=&aff_unique5=kvSq120159927&trn=102cc1db6c7aae3b42a2606c020aff
IP: 107.170.239.229 (digitalocean.com)


Which redirects to 
http://fastsecuredating.com/?page=land2/512_ac_ffriend&long=y&x_source=vip52744.46200-1973716.GSL-3855.102d7abb8fba79005993e4cf832a3e..Web.&eml=
IP: 35.174.201.165, 34.238.141.146
(amazon.com / amazonaws.com)

DO NOT go to any of these sites or buy
anything from any of these sites as it is a scam!

Dec  1 07:39:04 php1 sshd\[13265\]: Invalid user ramroop from 139.155.1.18
Dec  1 07:39:04 php1 sshd\[13265\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.155.1.18
Dec  1 07:39:06 php1 sshd\[13265\]: Failed password for invalid user ramroop from 139.155.1.18 port 57380 ssh2
Dec  1 07:42:43 php1 sshd\[13610\]: Invalid user host from 139.155.1.18
Dec  1 07:42:43 php1 sshd\[13610\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.155.1.18

" "

12/01/2019-09:41:12.248641 181.177.250.9 Protocol: 6 ET SCAN Suspicious inbound to MSSQL port 1433

Dec  1 15:06:45 firewall sshd[9354]: Failed password for root from 222.186.180.6 port 61680 ssh2
Dec  1 15:06:48 firewall sshd[9354]: Failed password for root from 222.186.180.6 port 61680 ssh2
Dec  1 15:06:52 firewall sshd[9354]: Failed password for root from 222.186.180.6 port 61680 ssh2
...