TCP SYN packets sent to different high-numbered ports. Over 160 packets seen in 7 days. Note that ...
show moreTCP SYN packets sent to different high-numbered ports. Over 160 packets seen in 7 days. Note that it appears to be part of a larger scan, a total of over 550 packets were seen from nearby IP addresses in the same /24.
show less
Repeated probes of a small number of ports between 8000 and 9100, over 200 TCP SYN packets seen in 7 ...
show moreRepeated probes of a small number of ports between 8000 and 9100, over 200 TCP SYN packets seen in 7 days.
show less
Over 300 TCP SYN packets to varying ports received in last 7 days. Note: over 2200 TCP SYN packets ...
show moreOver 300 TCP SYN packets to varying ports received in last 7 days. Note: over 2200 TCP SYN packets received from related IP addresses in same /24.
show less
Scan of ports including 587, 2525, 465 followed by attempted authentication.
Jun 11 02:39:38 mail ...
show moreScan of ports including 587, 2525, 465 followed by attempted authentication.
Jun 11 02:39:38 mail postfix/smtpd[18970]: warning: unknown[185.225.74.189]: SASL PLAIN authentication failed: authentication failure
show less
Phishing attempt:
Dear Client,
This is a billing notice that your invoice no.356846842 which ...
show morePhishing attempt:
Dear Client,
This is a billing notice that your invoice no.356846842 which was gene=
rated on 10/06/2023 is now slightly overdue. Please note that if payme=
nt is not made soon we will unfortunately have to suspend the service.=
show less
Spam containing a virus was either sent from this system, or relayed after originating from 147.135. ...
show moreSpam containing a virus was either sent from this system, or relayed after originating from 147.135.61.130. Partial log:
Received: from host.sdserver28.com (host.sdserver28.com [192.169.81.210])
by mail.foxtree.co.uk (Postfix) with ESMTPS id 2CDD013AF37
for <[email]>; Tue, 6 Jun 2023 08:09:41 +0100 (BST)
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
d=wehappyonline.com.br; s=default; [... too long to include here]
Received: from ip130.ip-147-135-61.us ([147.135.61.130]:64076)
by host.sdserver28.com with esmtpsa (TLS1) tls TLS_DHE_RSA_WITH_AES_256_CBC_SHA
(Exim 4.96)
(envelope-from <[email protected]>)
id 1q6Qon-008k8e-0H;
Tue, 06 Jun 2023 04:09:23 -0300
๏ปฟEset Log:
...\PO-25-67859.7z ยป 7ZIP ยป PO-25-67859.exe - a variant of MSIL/Kryptik.AJAC trojan - deleted
show less
Spam received with an attachment identified as a virus.
Mail header includes:
Return-Path: <supp ...
show moreSpam received with an attachment identified as a virus.
Mail header includes:
Return-Path: <[email protected]>
...
Received: from cgcourses.org (unknown [185.91.69.29])
by [redacted]co.uk (Postfix) with ESMTP id BB70713BCF2
for <[redacted]co.uk>; Mon, 22 May 2023 20:15:46 +0100 (BST)
...
Subject: RE: REMT 049835 SWIFT MT103
๏ปฟESET antivirus Log
F:\Users\[redacted]\Downloads\REMITTANCEADVICE USD 00847645.7z ยป 7ZIP ยป REMITTANCEADVICE USD 00847645.exe - a variant of MSIL/Kryptik.AIWF trojan - deleted
show less
TCP SYN port 81. Repeated 10 times in 3 days. Similar probes on ports including 25565,8080,3128,99 ...
show moreTCP SYN port 81. Repeated 10 times in 3 days. Similar probes on ports including 25565,8080,3128,9999 seen from nearby IP addresses.
show less
Attempt to relay mail to was rejected by local server, followed by repeated unauthorised login attem ...
show moreAttempt to relay mail to was rejected by local server, followed by repeated unauthorised login attempts on SMTP port 25. About 110 attempts seen, all in less than 10 minutes.
Examples:
May 21 08:10:37 mail postfix/smtpd[23804]: NOQUEUE: reject: RCPT from unknown[193.42.32.198]: 554 5.7.1 <mikeana[redacted]@gmail.com>: Relay access denied; from=<[my address]> to=<mikeana[redacted]@
gmail.com> proto=ESMTP helo=<aO6glh2s3A>
:May 21 08:10:52 mail postfix/smtpd[23804]: warning: unknown[193.42.32.198]: SASL LOGIN authentication failed: authentication failure
show less
Remote server connected to port 25 using ESMTP and issued 20+ RCPT commands in the space of 3 second ...
show moreRemote server connected to port 25 using ESMTP and issued 20+ RCPT commands in the space of 3 seconds. Commands were for a mix of users with well known usernames such as "abuse" and random usernames such as "65l9abbxg5ym6d". No content seems to have been offered before the local server broke the connection.
show less
Remote server connected to port 25 using ESMTP and issued 20+ RCPT commands in the space of 5 second ...
show moreRemote server connected to port 25 using ESMTP and issued 20+ RCPT commands in the space of 5 seconds. Commands were for a mix of users with well known usernames such as "abuse" and rubbish usernames such as "srx7d9m4h23o0d". No content seems to have been offered before the local server broke the connection.
show less
Unauthorised logins attempted on port 25 SMTP following port scan
May 14 17:14:52 [ 9949.684567] DR ...
show moreUnauthorised logins attempted on port 25 SMTP following port scan
May 14 17:14:52 [ 9949.684567] DROP IN=enp5s0 OUT= SRC=178.175.129.44 DST=192.168.1.2 LEN=52 TOS=0x00 PREC=0x00 TTL=120 ID=13036 DF PROTO=TCP SPT=57682 DPT=587 WINDOW=64446 RES=0x00 SYN URGP=0
... repeated at least 14 times for ports including 587, 465, 2525
May 14 17:16:03 mail postfix/smtpd[13013]: warning: unknown[178.175.129.44]: SASL PLAIN authentication failed: authentication failure
May 14 17:16:03 mail postfix/smtpd[13013]: warning: unknown[178.175.129.44]: SASL LOGIN authentication failed: authentication failure
show less