PHISHING AND SPAM ATTACK
107.179.121.2 Live healthy - juliana@adventured.club, Weight loss breakthrough - New Strategies for melting fat Opportunity-Removed -, 19 Jun 2021
134.73.88.74  Live healthy - maria@euroleague.club, Until-6AM - Keep mental health in check during pandemic, 19 Jun 2021
134.73.88.91  Shrink your Prostate - rose@cyprian.club, [Until-6AM] That feeling of needing to pee just won't pass? - Prostate Health: Know the Facts That feeling of needing to pee just won't pass? - Prostate Health: Know the Facts, 19 Jun 2021
OrgName: 	LayerHost
NetRange:       23.247.0.0 - 23.247.127.255
NetRange:       103.73.156.0 - 103.73.156.255
NetRange:       104.148.0.0 - 104.148.127.255
NetRange:       104.223.128.0 - 104.223.255.255
NetRange:       107.179.0.0 - 107.179.127.255
NetRange:       134.73.0.0 - 134.73.255.255
NetRange:       157.52.128.0 - 157.52.255.255
Other emails from same group
107.179.121.6   60 sec Prostate cure -juniper@inusintering.top-  -sydney@zapster.top- [Until-6AM] Heart health … Prostate health: A unique partnership - Prostate Health: Know the Facts Heart health … Prostate health: A unique partnership - Prostate Health: Know the Facts [90Sec-Video], Fri, 14 May 2021
107.179.127.158 Biden Brain Hacks - eden@dard.top - Russians developed secret brain enhancement drugs during the USSR. Now college kids..., Sun, 2 May 2021
107.179.41.181  Lose weight today - reagan@osse.club, Once-a-week treatment is a weight loss game changer - Can't seem to lose weight no matter what you try? 90SecVideo -, 14 Jun 2021
134.73.88.85 Alexandria Crandall - alexandria.crandall@ackbrogrum.top - [DeleteMe] Once in a lifetime discovery - Shed 30lbs in 4 weeks with no exercise or diet fads Once in a lifetime discovery - Shed 30lbs in 4 weeks with no exercise or diet fads, Fri, 14 May 2021
134.73.142.197 Speechelo - Speechelo@sonavel.us-  At Last! Human Sounding Text To Speech 2021

PHISHING ATTACK
107.179.121.28 Save Your Family - heidi@coinmaker.club, Take 1 sip an hour before bed to boost your Growth Hormone & flatten your belly while you sleep, Wed, 26 May 2021 
OrgName: 	LayerHost
NetRange:       23.247.0.0 - 23.247.127.255
NetRange:       103.73.156.0 - 103.73.156.255
NetRange:       104.148.0.0 - 104.148.127.255
NetRange:       104.223.128.0 - 104.223.255.255
NetRange:       107.179.0.0 - 107.179.127.255
NetRange:       134.73.0.0 - 134.73.255.255
NetRange:       157.52.128.0 - 157.52.255.255
Other emails from same group
104.148.6.239 Cinnamon -iris@coliseum.top- FALSE: Fat + People + Cinnamon Bark = People + Cinnamon Tea, Thu, 15 Apr 2021
104.223.155.206 Diabetes Treatment - alaina@branizericing.top - 10% of Diabetics eventually need Amputation - Root cause of Diabetes & and how we stop it 10% of Diabetics eventually need Amputation - Root cause of Diabetes & and how we stop it [Opportunity-Removed], Tue, 18 May 2021
104.223.155.216 Cure Diabetes - eloise@byfoculous.top,[Until-6AM] Once in a lifetime discovery - 10% of Diabetics eventually need Amputation Once in a lifetime discovery - 10% of Diabetics eventually need Amputation, Thu, 20 May 2021 
107.179.121.6   60 sec Prostate cure -juniper@inusintering.top-  -sydney@zapster.top- [Until-6AM] Heart health … Prostate health: A unique partnership - Prostate Health: Know the Facts Heart health … Prostate health: A unique partnership - Prostate Health: Know the Facts [90Sec-Video], Fri, 14 May 2021
107.179.121.28 Save Your Family - heidi@coinmaker.club, Take 1 sip an hour before bed to boost your Growth Hormone & flatten your belly while you sleep, Wed, 26 May 2021
107.179.127.136 Tooth Saver - daisy@trates.top -
107.179.127.139 Julia Gorelik - gorelik-julia@uphooducibly.top - 
107.179.127.158 Biden Brain Hacks - eden@dard.top - Russians developed secret brain enhancement drugs during the USSR. Now college kids..., Sun, 2 May 2021

PHISHING ATTACK
107.179.121.6   60 sec Prostate cure  -sydney@zapster.top- [Until-6AM] Heart health … Prostate health: A unique partnership - Prostate Health: Know the Facts Heart health … Prostate health: A unique partnership - Prostate Health: Know the Facts [90Sec-Video], Fri, 14 May 2021
OrgName: LayerHost
NetRange:       23.247.0.0 - 23.247.127.255
NetRange:       103.73.156.0 - 103.73.156.255
NetRange:       104.148.0.0 - 104.148.127.255
NetRange:       107.179.0.0 - 107.179.127.255
NetRange:       134.73.0.0 - 134.73.255.255
NetRange:       157.52.128.0 - 157.52.255.255
Other emails from same group
23.247.53.76 Latest Bluetooth - LingoGenie@onlyhappye.bid - Multi-Language Instant Voice Translator, Wed, 5 May 2021 
23.247.53.89 Your Bone Density - notifications@getmask.biz - 5 foods that cause WEAK BONES, Thu, 6 May 2021
23.247.125.237 Bidens Secret Pills - taylor@burbositision.top -  USSR + Cold War Research + Russian Scientists = How is Trumps brain still on FIRE?, Fri, 16 Apr 2021
23.247.125.241 Trumps Secret Pills - hazel@armchair.top - Cold War USSR brain boosting nootropics uncovered. What do you think Trump..., Tue, 4 May 2021 19:19:19

103.73.156.188 AmnesiaInducing Infection - eliana.lyons@minery.top - University study - dental bacteria & memory loss (MUST WATCH), Sun, 9 May 2021 

104.148.6.239 Cinnamon -iris@coliseum.top- FALSE: Fat + People + Cinnamon Bark = People + Cinnamon Tea, Thu, 15 Apr 2021

107.179.121.6   60 sec Prostate cure  -sydney@zapster.top- [Until-6AM] Heart health … Prostate health: A unique partnership - Prostate Health: Know the Facts Heart health … Prostate health: A unique partnership - Prostate Health: Know the Facts [90Sec-Video], Fri, 14 May 2021
107.179.127.158 Biden Brain Hacks - eden@dard.top - Russians developed secret brain enhancement drugs during the USSR. Now college kids..., Sun, 2 May 2021

IP blocked

Sep 12 08:42:45 rotator sshd\[12913\]: Failed password for root from 142.4.212.121 port 52808 ssh2Sep 12 08:48:40 rotator sshd\[13680\]: Failed password for root from 142.4.212.121 port 50218 ssh2Sep 12 08:49:51 rotator sshd\[13685\]: Failed password for root from 142.4.212.121 port 41576 ssh2Sep 12 08:51:06 rotator sshd\[14440\]: Invalid user odroid from 142.4.212.121Sep 12 08:51:09 rotator sshd\[14440\]: Failed password for invalid user odroid from 142.4.212.121 port 60530 ssh2Sep 12 08:52:19 rotator sshd\[14447\]: Failed password for root from 142.4.212.121 port 51462 ssh2
...

2020-09-12T12:38:42.615247vps1033 sshd[10144]: Failed password for root from 188.166.109.87 port 46404 ssh2
2020-09-12T12:42:52.182840vps1033 sshd[18762]: Invalid user james from 188.166.109.87 port 59050
2020-09-12T12:42:52.186776vps1033 sshd[18762]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.166.109.87
2020-09-12T12:42:52.182840vps1033 sshd[18762]: Invalid user james from 188.166.109.87 port 59050
2020-09-12T12:42:54.403701vps1033 sshd[18762]: Failed password for invalid user james from 188.166.109.87 port 59050 ssh2
...

Time:     Sat Sep 12 12:32:10 2020 +0000
IP:       149.202.56.228 (FR/France/228.ip-149-202-56.eu)
Failures: 5 (sshd)
Interval: 3600 seconds
Blocked:  Permanent Block [LF_SSHD]

Log entries:

Sep 12 12:06:25 pv-14-ams2 sshd[18783]: Failed password for root from 149.202.56.228 port 56478 ssh2
Sep 12 12:20:07 pv-14-ams2 sshd[31798]: Failed password for root from 149.202.56.228 port 51596 ssh2
Sep 12 12:24:10 pv-14-ams2 sshd[12773]: Failed password for root from 149.202.56.228 port 39076 ssh2
Sep 12 12:28:01 pv-14-ams2 sshd[25722]: Failed password for root from 149.202.56.228 port 54686 ssh2
Sep 12 12:32:09 pv-14-ams2 sshd[6971]: Failed password for root from 149.202.56.228 port 42064 ssh2

Sep 12 09:39:06 baraca dovecot: auth-worker(61219): passwd(test,185.234.216.66): unknown user
Sep 12 10:21:44 baraca dovecot: auth-worker(64826): passwd(postmaster,185.234.216.66): Password mismatch
Sep 12 11:04:22 baraca dovecot: auth-worker(67464): passwd(test1,185.234.216.66): unknown user
Sep 12 11:46:48 baraca dovecot: auth-worker(69914): passwd(info,185.234.216.66): unknown user
Sep 12 12:29:25 baraca dovecot: auth-worker(72797): passwd(test,185.234.216.66): unknown user
Sep 12 13:11:36 baraca dovecot: auth-worker(75275): passwd(postmaster,185.234.216.66): Password mismatch
...

Sep 11 01:45:14 ns5 sshd[23393]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.220.215.200  user=r.r
Sep 11 01:45:17 ns5 sshd[23393]: Failed password for r.r from 125.220.215.200 port 44924 ssh2
Sep 11 01:45:17 ns5 sshd[23393]: Received disconnect from 125.220.215.200: 11: Bye Bye [preauth]
Sep 11 01:47:17 ns5 sshd[23412]: Failed password for invalid user tortoisesvn from 125.220.215.200 port 50990 ssh2
Sep 11 01:47:17 ns5 sshd[23412]: Received disconnect from 125.220.215.200: 11: Bye Bye [preauth]
Sep 11 01:49:16 ns5 sshd[23432]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.220.215.200  user=r.r
Sep 11 01:49:18 ns5 sshd[23432]: Failed password for r.r from 125.220.215.200 port 54198 ssh2
Sep 11 01:49:18 ns5 sshd[23432]: Received disconnect from 125.220.215.200: 11: Bye Bye [preauth]
Sep 11 01:51:06 ns5 sshd[23459]: pam_unix(sshd:auth): authentication failure; logname= uid=0 eui........
-------------------------------

Sep 12 15:21:21 eventyay sshd[600]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.136.130.29
Sep 12 15:21:22 eventyay sshd[600]: Failed password for invalid user shiny from 152.136.130.29 port 55126 ssh2
Sep 12 15:27:16 eventyay sshd[706]: Failed password for root from 152.136.130.29 port 39656 ssh2
...

(sshd) Failed SSH login from 37.23.214.18 (RU/Russia/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Sep 11 12:56:00 server5 sshd[15108]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.23.214.18  user=root
Sep 11 12:56:02 server5 sshd[15108]: Failed password for root from 37.23.214.18 port 34085 ssh2
Sep 11 12:56:07 server5 sshd[15108]: Failed password for root from 37.23.214.18 port 34085 ssh2
Sep 11 12:56:12 server5 sshd[15108]: Failed password for root from 37.23.214.18 port 34085 ssh2
Sep 11 12:56:14 server5 sshd[15108]: Failed password for root from 37.23.214.18 port 34085 ssh2

1599843394 - 09/11/2020 18:56:34 Host: 114.39.199.34/114.39.199.34 Port: 445 TCP Blocked

Port Scan
...

Sep 12 12:00:30 vlre-nyc-1 sshd\[7524\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.195.47.153  user=root
Sep 12 12:00:32 vlre-nyc-1 sshd\[7524\]: Failed password for root from 51.195.47.153 port 52030 ssh2
Sep 12 12:06:50 vlre-nyc-1 sshd\[7688\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.195.47.153  user=root
Sep 12 12:06:52 vlre-nyc-1 sshd\[7688\]: Failed password for root from 51.195.47.153 port 54932 ssh2
Sep 12 12:09:24 vlre-nyc-1 sshd\[7769\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.195.47.153  user=root
...

Brute%20Force%20SSH

Fail2Ban Ban Triggered

arw-Joomla User : try to access forms...

RDP Brute force