134.73.142.250 NRA News - NRANews@coolmepro.us - NRA Now Supports Gun Control, Thu, 29 Apr 2021
Refer to previous related messages.
OrgName: 	LayerHost
NetRange:       23.247.0.0 - 23.247.127.255
NetRange:       104.148.0.0 - 104.148.127.255
NetRange:       134.73.0.0 - 134.73.255.255
104.148.6.239 Cinnamon -iris@coliseum.top- FALSE: Fat + People + Cinnamon Bark = People + Cinnamon Tea, Thu, 15 Apr 2021
134.73.142.197 Speechelo - Speechelo@sonavel.us-  At Last! Human Sounding Text To Speech 2021
134.73.142.204 FHA Program Guidelines - FHAProgramGuidelines@maxspeech.us - RE: your mortgage, Sun, 18 Apr 2021
134.73.142.222 Garden Landscaping - GardenLandscaping@flymee.us - Landscaping Designs Without Hiring Costly Professional Landscape Designers!, Sat, 17 Apr 2021
134.73.142.224 Furniture Flipping - FurnitureFlipping@secrettraining.us - Over $1,000 Per Week Flipping Furniture..., Wed, 14 Apr 2021 
134.73.142.231 Cannabidiol - Cannabidiol@lifesense.guru-  Smilz CBD inventory extremely low Thu, 15 Apr 2021
134.73.142.231 Home Depot Shopper Feedback - HomeDepotOpinionRequested@jointflx.co -, Claim Your Fifty Dollar Home Depot Offer, Fri, 16 Apr 2021 
134.73.142.233 IRA Guide - contact@ideaszilla.us-  The best way to invest in gold,  Wed, 14 Apr 2021
134.73.142.239 BidenMedicarePlans -BidenMedicare@producthut.us- Compare Affordable Plans From Top Carriers Today! Thu, 15 Apr 2021
134.73.142.242 Badass Solar Charger -SolarPowerBank@smartpad.today- This Solar Charger Is A Must Have, Thu, 15 Apr 2021
134.73.142.243 Underwater Inspection - InspectionCamera@lostbook.us -, SmartSnake HD – the newest underwater inspection camera, Fri, 16 Apr 2021 
134.73.142.244 Kahnqr - Kahnqr@maleenhancementt.us - Crime killed his manhood, his family revived it, Sat, 17 Apr 2021 
134.73.142.246 Detect Bug -FindBug@spypod.us- Home 'Bug-Detector' Is Inexpensive Extremely Effective And EASY For Average Folks To Sweep For,

134.73.142.204 FHA Program Guidelines - FHAProgramGuidelines@maxspeech.us - RE: your mortgage, Sun, 18 Apr 2021
Refe  to previous related messages.
OrgName: LayerHost
NetRange:       23.247.0.0 - 23.247.127.255
NetRange:       104.148.0.0 - 104.148.127.255
NetRange:       134.73.0.0 - 134.73.255.255
23.247.125.237 Bidens Secret Pills - taylor@burbositision.top -  USSR + Cold War Research + Russian Scientists = How is Trumps brain still on FIRE?, Fri, 16 Apr 2021
104.148.6.239 Cinnamon -iris@coliseum.top- FALSE: Fat + People + Cinnamon Bark = People + Cinnamon Tea, Thu, 15 Apr 2021
134.73.142.197 Speechelo - Speechelo@sonavel.us-  At Last! Human Sounding Text To Speech 2021
134.73.142.222 Garden Landscaping - GardenLandscaping@flymee.us - Landscaping Designs Without Hiring Costly Professional Landscape Designers!, Sat, 17 Apr 2021
134.73.142.224 Furniture Flipping - FurnitureFlipping@secrettraining.us - Over $1,000 Per Week Flipping Furniture..., Wed, 14 Apr 2021 
134.73.142.231 Cannabidiol - Cannabidiol@lifesense.guru-  Smilz CBD inventory extremely low Thu, 15 Apr 2021
134.73.142.231 Home Depot Shopper Feedback - HomeDepotOpinionRequested@jointflx.co -, Claim Your Fifty Dollar Home Depot Offer, Fri, 16 Apr 2021 
134.73.142.233 IRA Guide - contact@ideaszilla.us-  The best way to invest in gold,  Wed, 14 Apr 2021
134.73.142.239 BidenMedicarePlans -BidenMedicare@producthut.us- Compare Affordable Plans From Top Carriers Today! Thu, 15 Apr 2021
134.73.142.242 Badass Solar Charger -SolarPowerBank@smartpad.today- This Solar Charger Is A Must Have, Thu, 15 Apr 2021
134.73.142.243 Underwater Inspection - InspectionCamera@lostbook.us -, SmartSnake HD – the newest underwater inspection camera, Fri, 16 Apr 2021 
134.73.142.244 Kahnqr - Kahnqr@maleenhancementt.us - Crime killed his manhood, his family revived it, Sat, 17 Apr 2021 
134.73.142.246 Detect Bug -FindBug@spypod.us- Home 'Bug-Detector' Is Inexpensive Extremely Effective And EASY For Average Folks To Sweep For,

PHISHING AND SPAM ATTACK
FROM "Costco Shopper Feedback " : 
SUBJECT "Your Opinion is Important! Take This Survey to Claim Your $50 Costco Reward" :
RECEIVED "rom [134.73.142.211] (port=54419 helo=stack.medicarespro.buzz)" :
DATE/TIMESENT "Sun, 04 Apr 2021 20:57:11"
IP ADDRESS "inetnum: 134.73.0.0 - 134.73.255.255 OrgName: LayerHost"

PHISHING ATTACK
Future - WifiPod@mechanism.icu : 
"Public Wifi Scam..." :
from [134.73.146.23] (port=38468 helo=cindy.mechanism.icu) :
Thu, 31 Dec 2020 04:33:28 +1100

PHISHING ATTACK
Neck Relax - ElectronicPulseMassager@dealspost.icu : 
"Everyone at some point has suffered pain in their neck" :
from [134.73.146.14] (port=60062 helo=chula.dealspost.icu) :
Wed, 30 Dec 2020 22:29:47 +1100

PHISHING ATTACK
Home Depot Shopper Gift Opportunity <"Thankyou!HomeDepot"@carbofixhero.icu>: 
"Leave your feedback and you could WIN!":
from [134.73.146.49] (port=60696 helo=tempe.carbofixhero.icu):
Sat, 26 Dec 2020 21:07:07 +1100

Double-Sided Holster : 
Is this the perfect concealed holster?:
from [134.73.146.43] (port=53859 helo=burke.healthief.best):
Sat, 26 Dec 2020 19:12:01 +1100

PHISHING ATTACK  "CLAIM Your Trump 2020 Commemorative Golf Ball!"

PHISHING ATTACK  "New Arrival: Hilarious Christmas Ornament, Now 50% Off"

Spam

[Sun Jun  7 03:44:45 2020 GMT] Designer Bags  [], Subject: Today's Best Deals! Louis Vuitton Handbag 70% OFF Only Today!

3478/udp 123/udp 5683/udp...
[2019-12-15/2020-02-06]33pkt,5pt.(udp)

MultiHost/MultiPort Probe, Scan, Hack -

Host Scan

scan r

Unauthorised access (Oct  3) SRC=171.122.41.95 LEN=40 TTL=49 ID=25418 TCP DPT=8080 WINDOW=65039 SYN 
Unauthorised access (Oct  3) SRC=171.122.41.95 LEN=40 TTL=49 ID=51366 TCP DPT=8080 WINDOW=42327 SYN 
Unauthorised access (Oct  3) SRC=171.122.41.95 LEN=40 TTL=49 ID=40310 TCP DPT=8080 WINDOW=42327 SYN

(Oct  4)  LEN=40 TTL=249 ID=41848 TCP DPT=3306 WINDOW=1024 SYN 
 (Oct  4)  LEN=40 TTL=249 ID=57188 TCP DPT=3306 WINDOW=1024 SYN 
 (Oct  3)  LEN=40 TTL=249 ID=55546 TCP DPT=3306 WINDOW=1024 SYN 
 (Oct  3)  LEN=40 TTL=249 ID=21852 TCP DPT=3306 WINDOW=1024 SYN 
 (Oct  3)  LEN=40 TTL=249 ID=43456 TCP DPT=3306 WINDOW=1024 SYN 
 (Oct  3)  LEN=40 TTL=249 ID=27420 TCP DPT=3306 WINDOW=1024 SYN 
 (Oct  3)  LEN=40 TTL=249 ID=14197 TCP DPT=3306 WINDOW=1024 SYN 
 (Oct  3)  LEN=40 TTL=249 ID=146 TCP DPT=3306 WINDOW=1024 SYN 
 (Oct  3)  LEN=40 TTL=249 ID=48042 TCP DPT=3306 WINDOW=1024 SYN 
 (Oct  3)  LEN=40 TTL=249 ID=60194 TCP DPT=3306 WINDOW=1024 SYN 
 (Oct  3)  LEN=40 TTL=249 ID=28393 TCP DPT=3306 WINDOW=1024 SYN 
 (Oct  3)  LEN=40 TTL=249 ID=52963 TCP DPT=3306 WINDOW=1024 SYN 
 (Oct  3)  LEN=40 TTL=249 ID=34783 TCP DPT=3306 WINDOW=1024 SYN 
 (Oct  3)  LEN=40 TTL=249 ID=31251 TCP DPT=3306 WINDOW=1024 SYN 
 (Oct  3)  LEN=40 TTL=249 ID=36293 TCP DPT=3306 WINDOW=1024 SYN 
 (Oct  3)  LEN=40 TTL=249 I...

2019-10-03T21:20:40.012286abusebot-7.cloudsearch.cf sshd\[14680\]: Invalid user Esaias from 129.211.117.47 port 55736

Automatic report - Banned IP Access

Oct  4 03:17:45 microserver sshd[65288]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=76.24.160.205  user=root
Oct  4 03:17:47 microserver sshd[65288]: Failed password for root from 76.24.160.205 port 40024 ssh2
Oct  4 03:21:54 microserver sshd[672]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=76.24.160.205  user=root
Oct  4 03:21:56 microserver sshd[672]: Failed password for root from 76.24.160.205 port 53294 ssh2
Oct  4 03:26:15 microserver sshd[1340]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=76.24.160.205  user=root
Oct  4 03:39:10 microserver sshd[2850]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=76.24.160.205  user=root
Oct  4 03:39:12 microserver sshd[2850]: Failed password for root from 76.24.160.205 port 50012 ssh2
Oct  4 03:43:25 microserver sshd[3477]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=s

Brute force attempt

Oct  4 00:07:24 OPSO sshd\[31342\]: Invalid user lada from 58.162.140.172 port 51631
Oct  4 00:07:24 OPSO sshd\[31342\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.162.140.172
Oct  4 00:07:25 OPSO sshd\[31342\]: Failed password for invalid user lada from 58.162.140.172 port 51631 ssh2
Oct  4 00:12:51 OPSO sshd\[32085\]: Invalid user dong from 58.162.140.172 port 43929
Oct  4 00:12:51 OPSO sshd\[32085\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.162.140.172

Port scan

Oct  4 01:21:30 ms-srv sshd[38544]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=67.184.64.224  user=root
Oct  4 01:21:32 ms-srv sshd[38544]: Failed password for invalid user root from 67.184.64.224 port 1129 ssh2

Oct  3 23:31:44 www_kotimaassa_fi sshd[12976]: Failed password for root from 162.248.52.82 port 38968 ssh2
...

Oct  3 15:59:59 localhost kernel: [3870618.326715] iptables_INPUT_denied: IN=eth0 OUT= MAC=f2:3c:91:84:83:95:84:78:ac:57:a8:41:08:00 SRC=181.174.166.222 DST=[mungedIP2] LEN=40 TOS=0x08 PREC=0x20 TTL=62 ID=23806 DF PROTO=TCP SPT=63053 DPT=22 SEQ=1048241501 ACK=0 WINDOW=29200 RES=0x00 SYN URGP=0 
Oct  3 17:41:21 localhost kernel: [3876700.919375] iptables_INPUT_denied: IN=eth0 OUT= MAC=f2:3c:91:84:83:95:84:78:ac:57:aa:c1:08:00 SRC=181.174.166.222 DST=[mungedIP2] LEN=40 TOS=0x00 PREC=0x00 TTL=79 ID=14629 DF PROTO=TCP SPT=62373 DPT=22 SEQ=2960752615 ACK=0 WINDOW=29200 RES=0x00 SYN URGP=0 
Oct  3 17:54:44 localhost kernel: [3877503.598542] iptables_INPUT_denied: IN=eth0 OUT= MAC=f2:3c:91:84:83:95:84:78:ac:57:a8:41:08:00 SRC=181.174.166.222 DST=[mungedIP2] LEN=40 TOS=0x00 PREC=0x00 TTL=67 ID=16628 DF PROTO=TCP SPT=51096 DPT=22 WINDOW=29200 RES=0x00 SYN URGP=0 
Oct  3 17:54:44 localhost kernel: [3877503.598579] iptables_INPUT_denied: IN=eth0 OUT= MAC=f2:3c:91:84:83:95:84:78:ac:57:a8:41:08:00 SRC=181.174.166.222 DST=

Oct  3 15:42:32 localhost kernel: [3869571.256599] iptables_INPUT_denied: IN=eth0 OUT= MAC=f2:3c:91:84:83:95:84:78:ac:57:a8:41:08:00 SRC=181.174.165.190 DST=[mungedIP2] LEN=40 TOS=0x08 PREC=0x20 TTL=62 ID=19492 DF PROTO=TCP SPT=62835 DPT=22 SEQ=77134336 ACK=0 WINDOW=29200 RES=0x00 SYN URGP=0 
Oct  3 15:45:47 localhost kernel: [3869766.741562] iptables_INPUT_denied: IN=eth0 OUT= MAC=f2:3c:91:84:83:95:84:78:ac:57:a8:41:08:00 SRC=181.174.165.190 DST=[mungedIP2] LEN=40 TOS=0x08 PREC=0x20 TTL=75 ID=31776 DF PROTO=TCP SPT=52806 DPT=22 SEQ=2749986142 ACK=0 WINDOW=29200 RES=0x00 SYN URGP=0 
Oct  3 16:49:54 localhost kernel: [3873613.907476] iptables_INPUT_denied: IN=eth0 OUT= MAC=f2:3c:91:84:83:95:84:78:ac:57:a8:41:08:00 SRC=181.174.165.190 DST=[mungedIP2] LEN=40 TOS=0x08 PREC=0x20 TTL=81 ID=41021 DF PROTO=TCP SPT=64002 DPT=22 SEQ=2771226610 ACK=0 WINDOW=29200 RES=0x00 SYN URGP=0

10/04/2019-01:25:52.212796 185.176.27.18 Protocol: 6 ET DROP Dshield Block Listed Source group 1

IMAP

Port scan