Misc Attack - Port=20285

 TCP (SYN) 68.183.55.223:58282 -> port 20285, len 44

scans once in preceeding hours on the ports (in chronological order) 24956 resulting in total of 4 scans from 68.183.0.0/16 block.

ET CINS Active Threat Intelligence Poor Reputation IP group 61 - port: 24956 proto: tcp cat: Misc Attackbytes: 60

 TCP (SYN) 68.183.55.223:56684 -> port 23445, len 44

" "

firewall-block, port(s): 27323/tcp

Jul  6 18:29:03 debian-2gb-nbg1-2 kernel: \[16311550.921581\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=68.183.55.223 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=244 ID=13617 PROTO=TCP SPT=42841 DPT=26923 WINDOW=1024 RES=0x00 SYN URGP=0

 TCP (SYN) 68.183.55.223:42841 -> port 26923, len 44

Multiport scan 65 ports : 101 399 427 593 960 2431 3512 3994 5699 7673 7936 8901 9064 9159 9533 9615 13308 13354 13622 13682 14404 14669 15593 16078 16742 17053 17638 18549 18592 18786 18931 19040 19244 19541 20820 21576 21728 21816 22530 22973 23437 23523 23596 24488 24742 24783 25652 26116 27328 27448 27804 28449 28749 28915 29184 29262 29304 30967 31308 31385 31426 31443 32177 32193 32669

Port scan denied

 TCP (SYN) 68.183.55.223:59376 -> port 13354, len 44

firewall-block, port(s): 15593/tcp

scans once in preceeding hours on the ports (in chronological order) 24742 resulting in total of 9 scans from 68.183.0.0/16 block.

firewall-block, port(s): 32669/tcp

5699/tcp 9064/tcp 32193/tcp...
[2020-04-12/05-03]71pkt,24pt.(tcp)

firewall-block, port(s): 9064/tcp

firewall-block, port(s): 28449/tcp

19541/tcp 593/tcp 26472/tcp...
[2020-04-12/23]36pkt,12pt.(tcp)

Unauthorized connection attempt detected from IP address 68.183.55.223 to port 2220 [J]

Unauthorized connection attempt detected from IP address 68.183.55.223 to port 2220 [J]

2020-09-21T16:27:47.222669billing sshd[25186]: Invalid user testftp from 68.183.55.125 port 53502
2020-09-21T16:27:49.486109billing sshd[25186]: Failed password for invalid user testftp from 68.183.55.125 port 53502 ssh2
2020-09-21T16:31:36.753697billing sshd[970]: Invalid user www from 68.183.55.125 port 37788
...

<6 unauthorized SSH connections

Sep 20 22:49:39 haigwepa sshd[3419]: Failed password for root from 68.183.55.125 port 43570 ssh2
...

derorga.de:443 68.183.55.207 - - [01/Jun/2020:05:54:13 +0200] "GET / HTTP/1.0" 403 4780 "-" "Mozilla/5.0 (compatible; NetcraftSurveyAgent/1.0; +info@netcraft.com)"

Automated report (2020-02-01T21:59:14+00:00). Spambot detected.

Automated report (2020-01-31T04:59:07+00:00). Spambot detected.

Automated report (2020-01-30T04:59:10+00:00). Spambot detected.

Automated report (2020-01-28T09:59:09+00:00). Spambot detected.

Nov 15 05:58:01 lnxmysql61 sshd[2726]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.183.55.240
Nov 15 05:58:03 lnxmysql61 sshd[2726]: Failed password for invalid user openhabian from 68.183.55.240 port 44714 ssh2
Nov 15 05:58:53 lnxmysql61 sshd[2760]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.183.55.240

vulcan

2019-09-28T12:33:35.400635abusebot-4.cloudsearch.cf sshd\[24220\]: Invalid user ubnt from 68.183.55.240 port 33198

LinkSys E-series Routers Remote Code Execution Vulnerability, PTR: PTR record not found

Jul 18 03:13:06 xb0 sshd[7773]: Bad protocol version identification '' from 68.183.55.240 port 49924
Jul 18 03:15:05 xb0 sshd[11745]: Failed password for invalid user cisco from 68.183.55.240 port 57662 ssh2
Jul 18 03:16:11 xb0 sshd[32275]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.183.55.240  user=r.r
Jul 18 03:16:13 xb0 sshd[32275]: Failed password for r.r from 68.183.55.240 port 34796 ssh2
Jul 18 03:17:19 xb0 sshd[3473]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.183.55.240  user=r.r
Jul 18 03:17:22 xb0 sshd[3473]: Failed password for r.r from 68.183.55.240 port 50612 ssh2
Jul 18 03:17:26 xb0 sshd[3473]: Connection closed by 68.183.55.240 [preauth]
Jul 18 03:18:23 xb0 sshd[6866]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.183.55.240  user=r.r
Jul 18 03:18:26 xb0 sshd[6866]: Failed password for r.r from 68.183.55.240 port 576........
-------------------------------

Apr  4 01:18:47 server sshd\[5219\]: Failed password for root from 189.4.151.102 port 51784 ssh2
Apr  4 08:54:29 server sshd\[22210\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.4.151.102  user=root
Apr  4 08:54:30 server sshd\[22210\]: Failed password for root from 189.4.151.102 port 45150 ssh2
Apr  4 09:10:13 server sshd\[26663\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.4.151.102  user=root
Apr  4 09:10:15 server sshd\[26663\]: Failed password for root from 189.4.151.102 port 59694 ssh2
...

Apr  4 08:54:47 server sshd\[22264\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.40.146  user=root
Apr  4 08:54:48 server sshd\[22264\]: Failed password for root from 122.51.40.146 port 53686 ssh2
Apr  4 09:08:34 server sshd\[25986\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.40.146  user=root
Apr  4 09:08:36 server sshd\[25986\]: Failed password for root from 122.51.40.146 port 40008 ssh2
Apr  4 09:12:37 server sshd\[26986\]: Invalid user mm from 122.51.40.146
Apr  4 09:12:37 server sshd\[26986\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.40.146 
...

Apr  4 06:40:57 mail.srvfarm.net postfix/smtpd[3130896]: warning: unknown[45.133.99.16]: SASL PLAIN authentication failed: 
Apr  4 06:40:57 mail.srvfarm.net postfix/smtpd[3130896]: lost connection after AUTH from unknown[45.133.99.16]
Apr  4 06:41:02 mail.srvfarm.net postfix/smtpd[3111169]: lost connection after CONNECT from unknown[45.133.99.16]
Apr  4 06:41:06 mail.srvfarm.net postfix/smtpd[3132373]: lost connection after AUTH from unknown[45.133.99.16]
Apr  4 06:41:07 mail.srvfarm.net postfix/smtpd[3130902]: lost connection after AUTH from unknown[45.133.99.16]

Apr  4 10:44:03 server sshd\[17153\]: Invalid user cl from 140.143.130.52
Apr  4 10:44:03 server sshd\[17153\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=140.143.130.52 
Apr  4 10:44:05 server sshd\[17153\]: Failed password for invalid user cl from 140.143.130.52 port 58426 ssh2
Apr  4 11:11:49 server sshd\[25058\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=140.143.130.52  user=root
Apr  4 11:11:51 server sshd\[25058\]: Failed password for root from 140.143.130.52 port 48532 ssh2
...

Apr  4 09:11:16 web01.agentur-b-2.de postfix/smtpd[979879]: warning: unknown[185.234.217.191]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Apr  4 09:11:16 web01.agentur-b-2.de postfix/smtpd[979879]: lost connection after AUTH from unknown[185.234.217.191]
Apr  4 09:20:10 web01.agentur-b-2.de postfix/smtpd[979879]: warning: unknown[185.234.217.191]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Apr  4 09:20:10 web01.agentur-b-2.de postfix/smtpd[979879]: lost connection after AUTH from unknown[185.234.217.191]
Apr  4 09:20:14 web01.agentur-b-2.de postfix/smtpd[980997]: warning: unknown[185.234.217.191]: SASL LOGIN authentication failed: UGFzc3dvcmQ6

Invalid user sysadm from 134.209.18.220 port 39988

Apr  4 05:30:07 web01.agentur-b-2.de postfix/smtpd[920628]: NOQUEUE: reject: RCPT from unknown[63.81.87.178]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Apr  4 05:30:13 web01.agentur-b-2.de postfix/smtpd[920628]: NOQUEUE: reject: RCPT from unknown[63.81.87.178]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Apr  4 05:32:45 web01.agentur-b-2.de postfix/smtpd[920628]: NOQUEUE: reject: RCPT from unknown[63.81.87.178]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Apr  4 05:33:38 web01.agentur-b-2.de postfix/smtpd[920628]: NOQUEUE: reject: RCPT from unknown[63.81.87.178]: 450 4.7.1 

(sshd) Failed SSH login from 159.65.77.254 (US/United States/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Apr  4 10:31:04 srv sshd[13159]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.65.77.254  user=root
Apr  4 10:31:06 srv sshd[13159]: Failed password for root from 159.65.77.254 port 48792 ssh2
Apr  4 10:38:09 srv sshd[13557]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.65.77.254  user=root
Apr  4 10:38:11 srv sshd[13557]: Failed password for root from 159.65.77.254 port 38044 ssh2
Apr  4 10:42:37 srv sshd[13776]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.65.77.254  user=root

Apr  4 10:00:09 ArkNodeAT sshd\[23369\]: Invalid user student from 209.97.167.100
Apr  4 10:00:09 ArkNodeAT sshd\[23369\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=209.97.167.100
Apr  4 10:00:12 ArkNodeAT sshd\[23369\]: Failed password for invalid user student from 209.97.167.100 port 56594 ssh2

" "

Apr  4 09:54:29 ns382633 sshd\[4741\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.146.76.21  user=root
Apr  4 09:54:31 ns382633 sshd\[4741\]: Failed password for root from 186.146.76.21 port 36148 ssh2
Apr  4 09:59:14 ns382633 sshd\[5663\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.146.76.21  user=root
Apr  4 09:59:16 ns382633 sshd\[5663\]: Failed password for root from 186.146.76.21 port 48278 ssh2
Apr  4 10:03:24 ns382633 sshd\[6546\]: Invalid user ccodrunner from 186.146.76.21 port 53692
Apr  4 10:03:24 ns382633 sshd\[6546\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.146.76.21

Apr  4 05:32:07 mail.srvfarm.net postfix/smtpd[3108685]: NOQUEUE: reject: RCPT from unknown[81.2.47.181]: 554 5.7.1 Service unavailable; Client host [81.2.47.181] blocked using bl.spamcop.net; Blocked - see https://www.spamcop.net/bl.shtml?81.2.47.181; from= to= proto=ESMTP helo=
Apr  4 05:32:09 mail.srvfarm.net postfix/smtpd[3108685]: NOQUEUE: reject: RCPT from unknown[81.2.47.181]: 554 5.7.1 Service unavailable; Client host [81.2.47.181] blocked using bl.spamcop.net; Blocked - see https://www.spamcop.net/bl.shtml?81.2.47.181; from= to= proto=ESMTP helo=
Apr  4 05:32:10 mail.srvfarm.net postfix/smtpd[3108685]: NOQUEUE: reject: RCPT from unknown[81.2.47.181]: 554 5.7.1 Service unavailable; Client host [81.2.47.181] blocked using bl.spamcop.net; Blocked - see https://www.spamcop.net/bl.shtml?81.2.47.181; from= to= proto=ESMTP helo=<

detected by Fail2Ban

2020-04-04 09:53:38 dovecot_login authenticator failed for \(\[45.133.99.8\]\) \[45.133.99.8\]: 535 Incorrect authentication data \(set_id=postmaster@nophost.com\)
2020-04-04 09:53:47 dovecot_login authenticator failed for \(\[45.133.99.8\]\) \[45.133.99.8\]: 535 Incorrect authentication data
2020-04-04 09:53:58 dovecot_login authenticator failed for \(\[45.133.99.8\]\) \[45.133.99.8\]: 535 Incorrect authentication data
2020-04-04 09:54:05 dovecot_login authenticator failed for \(\[45.133.99.8\]\) \[45.133.99.8\]: 535 Incorrect authentication data
2020-04-04 09:54:18 dovecot_login authenticator failed for \(\[45.133.99.8\]\) \[45.133.99.8\]: 535 Incorrect authentication data

email spam