134.73.142.250 NRA News - NRANews@coolmepro.us - NRA Now Supports Gun Control, Thu, 29 Apr 2021
Refer to previous related messages.
OrgName: 	LayerHost
NetRange:       23.247.0.0 - 23.247.127.255
NetRange:       104.148.0.0 - 104.148.127.255
NetRange:       134.73.0.0 - 134.73.255.255
104.148.6.239 Cinnamon -iris@coliseum.top- FALSE: Fat + People + Cinnamon Bark = People + Cinnamon Tea, Thu, 15 Apr 2021
134.73.142.197 Speechelo - Speechelo@sonavel.us-  At Last! Human Sounding Text To Speech 2021
134.73.142.204 FHA Program Guidelines - FHAProgramGuidelines@maxspeech.us - RE: your mortgage, Sun, 18 Apr 2021
134.73.142.222 Garden Landscaping - GardenLandscaping@flymee.us - Landscaping Designs Without Hiring Costly Professional Landscape Designers!, Sat, 17 Apr 2021
134.73.142.224 Furniture Flipping - FurnitureFlipping@secrettraining.us - Over $1,000 Per Week Flipping Furniture..., Wed, 14 Apr 2021 
134.73.142.231 Cannabidiol - Cannabidiol@lifesense.guru-  Smilz CBD inventory extremely low Thu, 15 Apr 2021
134.73.142.231 Home Depot Shopper Feedback - HomeDepotOpinionRequested@jointflx.co -, Claim Your Fifty Dollar Home Depot Offer, Fri, 16 Apr 2021 
134.73.142.233 IRA Guide - contact@ideaszilla.us-  The best way to invest in gold,  Wed, 14 Apr 2021
134.73.142.239 BidenMedicarePlans -BidenMedicare@producthut.us- Compare Affordable Plans From Top Carriers Today! Thu, 15 Apr 2021
134.73.142.242 Badass Solar Charger -SolarPowerBank@smartpad.today- This Solar Charger Is A Must Have, Thu, 15 Apr 2021
134.73.142.243 Underwater Inspection - InspectionCamera@lostbook.us -, SmartSnake HD – the newest underwater inspection camera, Fri, 16 Apr 2021 
134.73.142.244 Kahnqr - Kahnqr@maleenhancementt.us - Crime killed his manhood, his family revived it, Sat, 17 Apr 2021 
134.73.142.246 Detect Bug -FindBug@spypod.us- Home 'Bug-Detector' Is Inexpensive Extremely Effective And EASY For Average Folks To Sweep For,

134.73.142.204 FHA Program Guidelines - FHAProgramGuidelines@maxspeech.us - RE: your mortgage, Sun, 18 Apr 2021
Refe  to previous related messages.
OrgName: LayerHost
NetRange:       23.247.0.0 - 23.247.127.255
NetRange:       104.148.0.0 - 104.148.127.255
NetRange:       134.73.0.0 - 134.73.255.255
23.247.125.237 Bidens Secret Pills - taylor@burbositision.top -  USSR + Cold War Research + Russian Scientists = How is Trumps brain still on FIRE?, Fri, 16 Apr 2021
104.148.6.239 Cinnamon -iris@coliseum.top- FALSE: Fat + People + Cinnamon Bark = People + Cinnamon Tea, Thu, 15 Apr 2021
134.73.142.197 Speechelo - Speechelo@sonavel.us-  At Last! Human Sounding Text To Speech 2021
134.73.142.222 Garden Landscaping - GardenLandscaping@flymee.us - Landscaping Designs Without Hiring Costly Professional Landscape Designers!, Sat, 17 Apr 2021
134.73.142.224 Furniture Flipping - FurnitureFlipping@secrettraining.us - Over $1,000 Per Week Flipping Furniture..., Wed, 14 Apr 2021 
134.73.142.231 Cannabidiol - Cannabidiol@lifesense.guru-  Smilz CBD inventory extremely low Thu, 15 Apr 2021
134.73.142.231 Home Depot Shopper Feedback - HomeDepotOpinionRequested@jointflx.co -, Claim Your Fifty Dollar Home Depot Offer, Fri, 16 Apr 2021 
134.73.142.233 IRA Guide - contact@ideaszilla.us-  The best way to invest in gold,  Wed, 14 Apr 2021
134.73.142.239 BidenMedicarePlans -BidenMedicare@producthut.us- Compare Affordable Plans From Top Carriers Today! Thu, 15 Apr 2021
134.73.142.242 Badass Solar Charger -SolarPowerBank@smartpad.today- This Solar Charger Is A Must Have, Thu, 15 Apr 2021
134.73.142.243 Underwater Inspection - InspectionCamera@lostbook.us -, SmartSnake HD – the newest underwater inspection camera, Fri, 16 Apr 2021 
134.73.142.244 Kahnqr - Kahnqr@maleenhancementt.us - Crime killed his manhood, his family revived it, Sat, 17 Apr 2021 
134.73.142.246 Detect Bug -FindBug@spypod.us- Home 'Bug-Detector' Is Inexpensive Extremely Effective And EASY For Average Folks To Sweep For,

PHISHING AND SPAM ATTACK
FROM "Costco Shopper Feedback " : 
SUBJECT "Your Opinion is Important! Take This Survey to Claim Your $50 Costco Reward" :
RECEIVED "rom [134.73.142.211] (port=54419 helo=stack.medicarespro.buzz)" :
DATE/TIMESENT "Sun, 04 Apr 2021 20:57:11"
IP ADDRESS "inetnum: 134.73.0.0 - 134.73.255.255 OrgName: LayerHost"

PHISHING ATTACK
Future - WifiPod@mechanism.icu : 
"Public Wifi Scam..." :
from [134.73.146.23] (port=38468 helo=cindy.mechanism.icu) :
Thu, 31 Dec 2020 04:33:28 +1100

PHISHING ATTACK
Neck Relax - ElectronicPulseMassager@dealspost.icu : 
"Everyone at some point has suffered pain in their neck" :
from [134.73.146.14] (port=60062 helo=chula.dealspost.icu) :
Wed, 30 Dec 2020 22:29:47 +1100

PHISHING ATTACK
Home Depot Shopper Gift Opportunity <"Thankyou!HomeDepot"@carbofixhero.icu>: 
"Leave your feedback and you could WIN!":
from [134.73.146.49] (port=60696 helo=tempe.carbofixhero.icu):
Sat, 26 Dec 2020 21:07:07 +1100

Double-Sided Holster : 
Is this the perfect concealed holster?:
from [134.73.146.43] (port=53859 helo=burke.healthief.best):
Sat, 26 Dec 2020 19:12:01 +1100

PHISHING ATTACK  "CLAIM Your Trump 2020 Commemorative Golf Ball!"

PHISHING ATTACK  "New Arrival: Hilarious Christmas Ornament, Now 50% Off"

Spam

[Sun Jun  7 03:44:45 2020 GMT] Designer Bags  [], Subject: Today's Best Deals! Louis Vuitton Handbag 70% OFF Only Today!

3478/udp 123/udp 5683/udp...
[2019-12-15/2020-02-06]33pkt,5pt.(udp)

MultiHost/MultiPort Probe, Scan, Hack -

Host Scan

scan r

2020-09-25T04:38:12.356953lavrinenko.info sshd[13381]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.42.213  user=root
2020-09-25T04:38:13.875170lavrinenko.info sshd[13381]: Failed password for root from 222.186.42.213 port 14534 ssh2
2020-09-25T04:38:12.356953lavrinenko.info sshd[13381]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.42.213  user=root
2020-09-25T04:38:13.875170lavrinenko.info sshd[13381]: Failed password for root from 222.186.42.213 port 14534 ssh2
2020-09-25T04:38:17.147847lavrinenko.info sshd[13381]: Failed password for root from 222.186.42.213 port 14534 ssh2
...

Sep 25 03:55:46 router sshd[20477]: Failed password for root from 218.92.0.250 port 54187 ssh2
Sep 25 03:55:51 router sshd[20477]: Failed password for root from 218.92.0.250 port 54187 ssh2
Sep 25 03:55:54 router sshd[20477]: Failed password for root from 218.92.0.250 port 54187 ssh2
Sep 25 03:55:59 router sshd[20477]: Failed password for root from 218.92.0.250 port 54187 ssh2
...

2020-09-24T21:41:42.211303ks3355764 sshd[879]: Failed password for invalid user mc from 36.133.109.23 port 57644 ssh2
2020-09-24T23:45:46.123892ks3355764 sshd[2991]: Invalid user yun from 36.133.109.23 port 46436
...

[H1.VM1] Blocked by UFW

2020-09-25T02:52:32.704351amanda2.illicoweb.com sshd\[43031\]: Invalid user dl from 176.122.157.32 port 41744
2020-09-25T02:52:32.711360amanda2.illicoweb.com sshd\[43031\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=176.122.157.32.16clouds.com
2020-09-25T02:52:34.742265amanda2.illicoweb.com sshd\[43031\]: Failed password for invalid user dl from 176.122.157.32 port 41744 ssh2
2020-09-25T03:00:04.931002amanda2.illicoweb.com sshd\[43513\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=176.122.157.32.16clouds.com  user=root
2020-09-25T03:00:07.012117amanda2.illicoweb.com sshd\[43513\]: Failed password for root from 176.122.157.32 port 38320 ssh2
...

Sep 24 22:24:15 [host] sshd[7635]: Invalid user ss
Sep 24 22:24:16 [host] sshd[7635]: pam_unix(sshd:a
Sep 24 22:24:17 [host] sshd[7635]: Failed password

Sep 25 02:19:43 ajax sshd[28264]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=40.122.169.225 
Sep 25 02:19:45 ajax sshd[28264]: Failed password for invalid user cliente4 from 40.122.169.225 port 2540 ssh2

Sep 23 17:52:15 master sshd[17503]: Failed password for root from 40.88.38.216 port 40644 ssh2
Sep 24 09:20:43 master sshd[16751]: Failed password for invalid user azureuser from 40.88.38.216 port 2449 ssh2
Sep 24 19:20:56 master sshd[2710]: Failed password for root from 40.88.38.216 port 39603 ssh2
Sep 25 04:23:17 master sshd[20427]: Failed password for invalid user activepathways from 40.88.38.216 port 33040 ssh2

CMS (WordPress or Joomla) login attempt.

[Fri Sep 25 02:51:48.422282 2020] [:error] [pid 16463:tid 140589363676928] [client 5.255.253.175:42582] [client 5.255.253.175] ModSecurity: Access denied with code 403 (phase 2). Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/modsecurity/coreruleset-3.3.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "756"] [id "920350"] [msg "Host header is a numeric IP address"] [data "103.27.207.197"] [severity "WARNING"] [ver "OWASP_CRS/3.3.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "103.27.207.197"] [uri "/"] [unique_id "X2z41HZgw1gzcFSlmDjlNgAAAIg"]
...

Sep 23 17:49:19 master sshd[17410]: Failed password for root from 52.188.179.13 port 14609 ssh2
Sep 23 22:07:35 master sshd[26183]: Failed password for root from 52.188.179.13 port 27050 ssh2
Sep 25 04:07:14 master sshd[19959]: Failed password for invalid user groupin from 52.188.179.13 port 27834 ssh2

Sep 25 02:47:07 vps639187 sshd\[27099\]: Invalid user dromedian from 40.77.104.58 port 1536
Sep 25 02:47:07 vps639187 sshd\[27099\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=40.77.104.58
Sep 25 02:47:09 vps639187 sshd\[27099\]: Failed password for invalid user dromedian from 40.77.104.58 port 1536 ssh2
...

SSH Login Bruteforce

Sep 24 23:39:07 meumeu sshd[528426]: Invalid user admin from 91.217.63.14 port 44852
Sep 24 23:39:07 meumeu sshd[528426]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.217.63.14 
Sep 24 23:39:07 meumeu sshd[528426]: Invalid user admin from 91.217.63.14 port 44852
Sep 24 23:39:09 meumeu sshd[528426]: Failed password for invalid user admin from 91.217.63.14 port 44852 ssh2
Sep 24 23:42:59 meumeu sshd[528679]: Invalid user contabilidad from 91.217.63.14 port 49342
Sep 24 23:42:59 meumeu sshd[528679]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.217.63.14 
Sep 24 23:42:59 meumeu sshd[528679]: Invalid user contabilidad from 91.217.63.14 port 49342
Sep 24 23:43:01 meumeu sshd[528679]: Failed password for invalid user contabilidad from 91.217.63.14 port 49342 ssh2
Sep 24 23:47:00 meumeu sshd[528933]: Invalid user Guest from 91.217.63.14 port 53843
...

(sshd) Failed SSH login from 106.54.253.152 (CN/China/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Sep 24 19:39:24 idl1-dfw sshd[2120814]: Invalid user usuario from 106.54.253.152 port 59998
Sep 24 19:39:27 idl1-dfw sshd[2120814]: Failed password for invalid user usuario from 106.54.253.152 port 59998 ssh2
Sep 24 19:43:56 idl1-dfw sshd[2124256]: Invalid user edgar from 106.54.253.152 port 50046
Sep 24 19:43:58 idl1-dfw sshd[2124256]: Failed password for invalid user edgar from 106.54.253.152 port 50046 ssh2
Sep 24 19:47:50 idl1-dfw sshd[2127516]: Invalid user minecraft from 106.54.253.152 port 37132