from mushawe.yoafrica.com ([196.44.176.11])
	by gwayi.yoafrica.com with esmtp (Exim 4.90_1 (FreeBSD))
	(envelope-from <noc@profihost.ag>)
	id 1hywVG-000IxJ-MJ
	for abuse@yoafrica.com; Sat, 17 Aug 2019 13:04:10 +0200

from [41.190.32.2] (port=11698 helo=sengwe.yoafrica.com)
	by mushawe.yoafrica.com with esmtp (Exim 4.90_1)
	id 1hywXY-0006oM-Hl
	for abuse@yoafrica.com; Sat, 17 Aug 2019 13:06:32 +0200

from localhost (localhost [127.0.0.1])
	by sengwe.yoafrica.com (Postfix) with ESMTP id 802D777D2CF
	for <abuse@yoafrica.com>; Sat, 17 Aug 2019 13:06:17 +0200 (CAT)

No, score=4.928 tagged_above=-999 required=5
	tests=[ANTISPOOF_NAME=5, BAYES_40=-0.001, RCVD_IN_DNSWL_LOW=0.001,
	SPF_HELO_NONE=0.001, ST_P0F_Linux=-0.1, TW_KM=0.027]
	autolearn=no autolearn_force=no

from sengwe.yoafrica.com (localhost [127.0.0.1])
	by sengwe.yoafrica.com (Postfix) with ESMTP id 0C69F77D2C8
	for <abuse@yoafrica.com>; Sat, 17 Aug 2019 13:06:13 +0200 (CAT)

from syslog.vms.phoffice.de-nserver.de (syslog.vms.phoffice.de-nserver.de [185.39.223.37])
	by sengwe.yoafrica.com (Postfix) with ESMTPS id DE99177D2CF
	for <abuse@yoafrica.com>; Sat, 17 Aug 2019 13:06:09 +0200 (CAT)

An attempt to brute-force account passwords over SSH/FTP by a machine in your domain or in your network has been detected. Attached are the host who attacks and time / date of activity. Please take the necessary action(s) to stop this activity immediately. If you have any questions please reply to this email.

Host of attacker: 41.190.36.210 => 210-36sxx.broadband.yoafrica.com => yoafrica.com
Responsible email contacts: abuse@yoafrica.com
Attacked hosts in our Network: 77.75.253.87, 85.158.181.56, 77.75.251.211, 178.250.12.34, 85.158.183.141, 185.39.223.20, 178.250.15.133, 77.75.251.92, 178.250.10.67, 85.158.181.19, 37.228.154.185, 77.75.251.84, 185.39.220.97

Logfile entries (time is MET / GMT+1):
Sat Aug 17 00:44:02 2019: user: root service: ssh target: 178.250.10.67 source: 41.190.36.210
Sat Aug 17 00:42:55 2019: user: root service: ssh target: 77.75.253.87 source: 41.190.36.210
Sat Aug 17 00:39:27 2019: user: root service: ssh target: 77.75.251.211 source: 41.190.36.210
Sat Aug 17 00:34:41 2019: user: vhost service: ssh target: 85.158.183.141 source: 41.190.36.210
Sat Aug 17 00:32:32 2019: user: daniel service: ssh target: 178.250.10.67 source: 41.190.36.210
Sat Aug 17 00:31:55 2019: user: daniel service: ssh target: 77.75.253.87 source: 41.190.36.210
Sat Aug 17 00:28:27 2019: user: daniel service: ssh target: 77.75.251.211 source: 41.190.36.210
Sat Aug 17 00:27:57 2019: user: daniel service: ssh target: 185.39.220.97 source: 41.190.36.210
Sat Aug 17 00:21:32 2019: user: kms service: ssh target: 178.250.10.67 source: 41.190.36.210
Sat Aug 17 00:19:28 2019: user: kms service: ssh target: 85.158.181.56 source: 41.190.36.210
Sat Aug 17 00:18:25 2019: user: kms service: ssh target: 77.75.253.87 source: 41.190.36.210
Wed Aug 14 15:33:57 2019: user: centos service: ssh target: 185.39.223.20 source: 41.190.36.210
Wed Aug 14 08:38:11 2019: user: jelena service: ssh target: 77.75.253.87 source: 41.190.36.210
Wed Aug 14 07:51:40 2019: user: gitblit service: ssh target: 77.75.253.87 source: 41.190.36.210
Wed Aug 14 07:30:55 2019: user: ellie service: ssh target: 77.75.253.87 source: 41.190.36.210
Wed Aug 14 07:24:22 2019: user: cynthia service: ssh target: 77.75.253.87 source: 41.190.36.210
Wed Aug 14 07:11:41 2019: user: test service: ssh target: 77.75.253.87 source: 41.190.36.210
Wed Aug 14 07:05:33 2019: user: jiao service: ssh target: 77.75.253.87 source: 41.190.36.210
Wed Aug 14 06:47:22 2019: user: felicia service: ssh target: 77.75.253.87 source: 41.190.36.210
Wed Aug 14 06:16:31 2019: user: david service: ssh target: 77.75.253.87 source: 41.190.36.210
Wed Aug 14 05:58:24 2019: user: manuel service: ssh target: 77.75.253.87 source: 41.190.36.210
Wed Aug 14 05:52:22 2019: user: camille service: ssh target: 77.75.253.87 source: 41.190.36.210
Wed Aug 14 05:40:10 2019: user: flopy service: ssh target: 77.75.253.87 source: 41.190.36.210
Wed Aug 14 05:34:03 2019: user: tac service: ssh target: 77.75.253.87 source: 41.190.36.210
Wed Aug 14 05:28:01 2019: user: postgres service: ssh target: 77.75.253.87 source: 41.190.36.210
Wed Aug 14 05:21:59 2019: user: rules service: ssh target: 77.75.253.87 source: 41.190.36.210
Wed Aug 14 05:09:53 2019: user: oracle service: ssh target: 77.75.253.87 source: 41.190.36.210
Wed Aug 14 04:57:44 2019: user: og service: ssh target: 77.75.253.87 source: 41.190.36.210
Wed Aug 14 04:51:34 2019: user: magdeburg service: ssh target: 77.75.253.87 source: 41.190.36.210
Wed Aug 14 04:45:28 2019: user: testftp service: ssh target: 77.75.253.87 source: 41.190.36.210
Wed Aug 14 04:27:18 2019: user: zzzzz service: ssh target: 77.75.253.87 source: 41.190.36.210
Wed Aug 14 04:21:44 2019: user: ubuntu service: ssh target: 77.75.253.87 source: 41.190.36.210
Wed Aug 14 04:09:27 2019: user: root service: ssh target: 77.75.253.87 source: 41.190.36.210
Wed Aug 14 04:03:46 2019: user: lang service: ssh target: 77.75.253.87 source: 41.190.36.210
Wed Aug 14 03:39:28 2019: user: tccuser service: ssh target: 77.75.253.87 source: 41.190.36.210
Wed Aug 14 03:21:37 2019: user: joana service: ssh target: 77.75.253.87 source: 41.190.36.210
Tue Aug 13 15:47:18 2019: user: root service: ssh target: 37.228.154.185 source: 41.190.36.210
Tue Aug 13 15:46:03 2019: user: root service: ssh target: 77.75.251.92 source: 41.190.36.210
Tue Aug 13 15:44:43 2019: user: root service: ssh target: 178.250.15.133 source: 41.190.36.210
Tue Aug 13 15:39:03 2019: user: student service: ssh target: 77.75.251.92 source: 41.190.36.210
Tue Aug 13 15:37:43 2019: user: student service: ssh target: 178.250.15.133 source: 41.190.36.210
Tue Aug 13 15:37:30 2019: user: student service: ssh target: 85.158.181.19 source: 41.190.36.210
Tue Aug 13 15:25:52 2019: user: oracle service: ssh target: 178.250.12.34 source: 41.190.36.210
Tue Aug 13 15:25:03 2019: user: oracle service: ssh target: 77.75.251.84 source: 41.190.36.210
Tue Aug 13 15:21:03 2019: user: oracle service: ssh target: 77.75.251.92 source: 41.190.36.210
Tue Aug 13 15:15:30 2019: user: oracle service: ssh target: 85.158.181.19 source: 41.190.36.210

Regards,
   Profihost AG Team