Malicious phishing, ISP Timeweb Ltd; repetitive redirects; blacklists; aggregate spam volume up to 5/day

Unsolicited bulk spam - dominol.club, Timeweb Ltd - 92.53.119.43

Spam link batel-dollar.ddnsking.com = 5.23.54.120 (previously 176.57.208.216) Timeweb Ltd - blacklisted – REPETITIVE BLACKLISTED IP - URLSCAN.IO REDIRECT LIST:
-	Effective URL: https://todayinsidernews.net = 192.241.177.202 DigitalOcean
-	www.circlestraight.com = 185.117.118.51, Creanova
-	mgsse.swiftlink.company  = 107.174.17.90, 118.184.32.7 Shanghai Anchnet Network
-	ddnsking.com = 8.23.224.108, Vitalwerks Internet Solutions
-	code.jquery.com = 205.185.208.52 Highwinds Network Group, Inc.

Sender domain domino.club = Timeweb Ltd
46.229.213.52, 46.229.212.250, 5.23.55.227, 162.255.119.8, 46.229.213.106, 46.229.213.65, 46.229.212.240, 46.229.213.130, 46.229.213.5, 46.229.212.228, 46.229.213.69, 46.229.213.118

Sep  8 07:02:54 relay postfix/smtpd\[3014\]: NOQUEUE: reject: RCPT from unknown\[193.32.160.135\]: 554 5.7.1 \: Relay access denied\; from=\ to=\ proto=ESMTP helo=\<\[193.32.160.142\]\>
Sep  8 07:02:54 relay postfix/smtpd\[3014\]: NOQUEUE: reject: RCPT from unknown\[193.32.160.135\]: 554 5.7.1 \: Relay access denied\; from=\ to=\ proto=ESMTP helo=\<\[193.32.160.142\]\>
Sep  8 07:02:54 relay postfix/smtpd\[3014\]: NOQUEUE: reject: RCPT from unknown\[193.32.160.135\]: 554 5.7.1 \: Relay access denied\; from=\ to=\ proto=ESMTP helo=\<\[193.32.160.142\]\>
Sep  8 07:02:54 relay postfix/smtpd\[3014\]: NOQUEUE: reject: RCPT from unknown\[193.32.160.135\]: 554 5.7.1 \: Relay access denied\; from=\

Sep  8 05:08:32 lnxweb61 sshd[5294]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.85.59

Sep  8 07:45:48 herz-der-gamer sshd[30495]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.98.26.177  user=root
Sep  8 07:45:50 herz-der-gamer sshd[30495]: Failed password for root from 218.98.26.177 port 62835 ssh2
...

Sep  7 23:21:06 localhost sshd\[25882\]: Invalid user guest from 103.60.126.65 port 37907
Sep  7 23:21:06 localhost sshd\[25882\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.60.126.65
Sep  7 23:21:08 localhost sshd\[25882\]: Failed password for invalid user guest from 103.60.126.65 port 37907 ssh2
...

Sep  7 19:49:55 ny01 sshd[19833]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.105.110.79
Sep  7 19:49:58 ny01 sshd[19833]: Failed password for invalid user test from 46.105.110.79 port 35274 ssh2
Sep  7 19:54:02 ny01 sshd[20538]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.105.110.79

Sep  8 07:58:13 meumeu sshd[16118]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=144.217.42.212 
Sep  8 07:58:14 meumeu sshd[16118]: Failed password for invalid user deploypass from 144.217.42.212 port 39716 ssh2
Sep  8 08:02:12 meumeu sshd[16887]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=144.217.42.212 
...

Sep  7 23:24:11 mail sshd[30756]: Failed password for r.r from 134.213.27.221 port 55674 ssh2
Sep  7 23:24:17 mail sshd[30758]: Failed password for r.r from 134.213.27.221 port 56030 ssh2
Sep  7 23:24:18 mail sshd[30760]: Invalid user pi from 134.213.27.221
Sep  7 23:24:21 mail sshd[30760]: Failed password for invalid user pi from 134.213.27.221 port 56518 ssh2
Sep  7 23:24:22 mail sshd[30762]: Invalid user pi from 134.213.27.221
Sep  7 23:24:25 mail sshd[30762]: Failed password for invalid user pi from 134.213.27.221 port 57144 ssh2


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=134.213.27.221

Sep  7 21:42:51 vm-dfa0dd01 sshd[53529]: Invalid user ubuntu from 149.202.214.11 port 51476
...

SMB Server BruteForce Attack

Sep  8 07:15:13 amit sshd\[11202\]: Invalid user alex from 98.253.233.55
Sep  8 07:15:13 amit sshd\[11202\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=98.253.233.55
Sep  8 07:15:15 amit sshd\[11202\]: Failed password for invalid user alex from 98.253.233.55 port 55949 ssh2
...

Sep  7 19:18:45 hpm sshd\[20677\]: Invalid user test from 85.246.129.162
Sep  7 19:18:45 hpm sshd\[20677\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=bl13-129-162.dsl.telepac.pt
Sep  7 19:18:47 hpm sshd\[20677\]: Failed password for invalid user test from 85.246.129.162 port 41286 ssh2
Sep  7 19:25:03 hpm sshd\[21159\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=bl13-129-162.dsl.telepac.pt  user=root
Sep  7 19:25:05 hpm sshd\[21159\]: Failed password for root from 85.246.129.162 port 51814 ssh2

Web application attack detected by fail2ban

Sep  8 00:25:12 TORMINT sshd\[763\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.85.42.227  user=root
Sep  8 00:25:14 TORMINT sshd\[763\]: Failed password for root from 112.85.42.227 port 30010 ssh2
Sep  8 00:28:29 TORMINT sshd\[950\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.85.42.227  user=root
...

2019-09-08T05:13:57.997627hub.schaetter.us sshd\[16468\]: Invalid user user2 from 84.19.170.254
2019-09-08T05:13:58.044714hub.schaetter.us sshd\[16468\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=84.19.170.254
2019-09-08T05:14:00.069360hub.schaetter.us sshd\[16468\]: Failed password for invalid user user2 from 84.19.170.254 port 48468 ssh2
2019-09-08T05:18:33.069821hub.schaetter.us sshd\[16505\]: Invalid user test from 84.19.170.254
2019-09-08T05:18:33.114719hub.schaetter.us sshd\[16505\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=84.19.170.254
...