from mushawe.yoafrica.com ([196.44.176.11])
	by gwayi.yoafrica.com with esmtp (Exim 4.90_1 (FreeBSD))
	(envelope-from <noc@profihost.ag>)
	id 1hy5PW-000N6E-2T
	for abuse@yoafrica.com; Thu, 15 Aug 2019 04:22:42 +0200

from [41.190.32.2] (port=12020 helo=sengwe.yoafrica.com)
	by mushawe.yoafrica.com with esmtp (Exim 4.90_1)
	id 1hy5Rn-0006Zr-To
	for abuse@yoafrica.com; Thu, 15 Aug 2019 04:25:03 +0200

from localhost (localhost [127.0.0.1])
	by sengwe.yoafrica.com (Postfix) with ESMTP id 114FA77D2AE
	for <abuse@yoafrica.com>; Thu, 15 Aug 2019 04:24:53 +0200 (CAT)

Yes, score=6.493 tagged_above=-999 required=5
	tests=[ANTISPOOF_NAME=5, BAYES_20=-0.001, DATE_IN_PAST_03_06=1.592,
	RCVD_IN_DNSWL_LOW=0.001, SPF_HELO_NONE=0.001, ST_P0F_Linux=-0.1]
	autolearn=no autolearn_force=no

from sengwe.yoafrica.com (localhost [127.0.0.1])
	by sengwe.yoafrica.com (Postfix) with ESMTP id 8C25277D2A2
	for <abuse@yoafrica.com>; Thu, 15 Aug 2019 04:24:49 +0200 (CAT)

from syslog.vms.phoffice.de-nserver.de (syslog.vms.phoffice.de-nserver.de [185.39.223.37])
	by sengwe.yoafrica.com (Postfix) with ESMTPS id 5E28F77D2C8
	for <abuse@yoafrica.com>; Thu, 15 Aug 2019 04:24:42 +0200 (CAT)

An attempt to brute-force account passwords over SSH/FTP by a machine in your domain or in your network has been detected. Attached are the host who attacks and time / date of activity. Please take the necessary action(s) to stop this activity immediately. If you have any questions please reply to this email.

Host of attacker: 196.44.191.3 => s35931.broadband.yoafrica.com => yoafrica.com
Responsible email contacts: abuse@yoafrica.com
Attacked hosts in our Network: 178.250.12.176, 85.158.181.12, 37.228.155.183, 37.228.159.181

Logfile entries (time is MET / GMT+1):
Wed Aug 14 23:46:33 2019: user: root service: ssh target: 85.158.181.12 source: 196.44.191.3
Wed Aug 14 23:46:03 2019: user: root service: ssh target: 37.228.159.181 source: 196.44.191.3
Wed Aug 14 23:45:26 2019: user: root service: ssh target: 37.228.155.183 source: 196.44.191.3
Wed Aug 14 23:40:25 2019: user: root service: ssh target: 178.250.12.176 source: 196.44.191.3

Regards,
   Profihost AG Team