PHISHING AND SPAM ATTACK
GROUP USES LayerHost, IP SERVER LLC, Root Networks LLC, Serverion BV, XSServer GmbH, Xervers, Colocrossing
31.210.22.63	Dental Health Issues? - DentalHealthIssues@leadentox.us, This formula is support your healthy teeth, keeping them strong and your breath fresh, 3 Jul 2021 
157.52.177.152	Want Free HD TV? - WantFreeHDTV@antennaology.co, A new product you won’t pass on, 3 Jul 2021
157.52.177.155	Car Warranty - ChoiceAutoWarranty@monsterfx.co, Spread some Holiday Cheer and Never have to Pay for Another Repair!, 3 Jul 2021
195.62.32.81	Stop Cold Sores - RemoveHerpesForever@herpitch.co, Herpes Virus Killer Founds Inside Left Brain, 3 Jul 2021
195.62.32.129	Nanolon Fiber - NanolonFiber@massivemalez.us, Your paper towel is poisoning our environment..., 3 Jul 2021
198.12.127.171 	Life Extension - tony@gmail.com, Kidney dialysis: When is it time to stop?, 3 Jul 2021
OrgName: 	LayerHost, AND SERVER-31-210-22-0 country: NL, netname: SERVER-185-239-242-0 country: NL  AND RU-IPSERVER-20190206, Serverion
NetRange:       31.210.22.0 - 31.210.23.255	org-name:       Serverion BV
NetRange:       157.52.128.0 - 157.52.255.255	OrgName:        LayerHost
NetRange:       185.239.242.0 - 185.239.242.255	org-name:       Serverion BV
inetnum:        194.59.216.0 - 194.59.217.255	org-name:       Serverion BV
inetnum:        195.62.32.0 - 195.62.33.255	org-name:       XSServer GmbH
inetnum:        195.133.12.0 - 195.133.15.255   netname:        Xervers
inetnum:        195.133.39.0 - 195.133.39.255	org-name:       Serverion BV
NetRange:       198.12.64.0 - 198.12.127.255	OrgName:        ColoCrossing

PHISHING ATTACK
195.62.32.183 The First 72 Hours - TheFirst72Hours@divinelockx.us - Did Costco Just Try and CRUSH Conservatives?, Sun, 16 May 2021
inetnum:        195.62.32.0 - 195.62.33.255
org-name:       XSServer GmbH
Other emails from same group
195.62.32.65 Vaccine Survey -CovidSurvey@eyefloters.buzz- COVID-19 vaccine research survey, Sat, 15 May 2021 
195.62.32.183 The First 72 Hours - TheFirst72Hours@divinelockx.us - Did Costco Just Try and CRUSH Conservatives?, Sun, 16 May 2021

195.62.32.65 Vaccine Survey -CovidSurvey@eyefloters.buzz- COVID-19 vaccine research survey, Sat, 15 May 2021
inetnum:        195.62.32.0 - 195.62.33.255
org-name:       XSServer GmbH

PHISHING ATTACK
Transparent Face Visor - ClearShield@sugartonic.icu : 
"Wear the Mouth Visor and smile freely!" :
from [195.62.32.23] (port=55637 helo=nate.sugartonic.icu)  :
Thu, 31 Dec 2020 00:28:31 +1100

PHISHING ATTACK
Meet Ultrazoom  : 
"Super Telephoto Zoom Monocular Telescope" :
from [195.62.32.21] (port=49191 helo=yoke.bloodpressure.buzz) :
Wed, 30 Dec 2020 22:04:26 +1100

PHISHING ATTACK
Magical Sandals : 
"Wear these Sandals and pain is gone.":
from [195.62.32.179] (port=33498 helo=ping.shinehead.bid):
Sat, 26 Dec 2020 22:49:08 +1100

Holiday Sale  : The low energy heater : 
from [195.62.32.173] (port=54745 helo=irene.woodsworking.co) :
Sun, 27 Dec 2020 01:04:41 +1100

multiple daily spam from:195.62.32.154/195.62.32.173

multiple daily email spam from:195.62.32.173/195.62.32.154/195.62.32.176/

Sep 13 08:22:02 mail.srvfarm.net postfix/smtpd[1001726]: NOQUEUE: reject: RCPT from unknown[195.62.32.221]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Sep 13 08:22:02 mail.srvfarm.net postfix/smtpd[1001726]: NOQUEUE: reject: RCPT from unknown[195.62.32.221]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Sep 13 08:27:02 mail.srvfarm.net postfix/smtpd[1001562]: NOQUEUE: reject: RCPT from unknown[195.62.32.221]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Sep 13 08:27:02 mail.srvfarm.net postfix/smtpd[1001562]: NOQUEUE: reject: RCPT from unknown[195.62.32.221]: 450 4.7.1 : Helo command rejected: Host not foun

Sep 12 22:41:49 web01.agentur-b-2.de postfix/smtpd[2309467]: NOQUEUE: reject: RCPT from unknown[195.62.32.227]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Sep 12 22:41:49 web01.agentur-b-2.de postfix/smtpd[2309467]: NOQUEUE: reject: RCPT from unknown[195.62.32.227]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Sep 12 22:41:52 web01.agentur-b-2.de postfix/smtpd[2330232]: NOQUEUE: reject: RCPT from unknown[195.62.32.227]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Sep 12 22:46:50 web01.agentur-b-2.de postfix/smtpd[2330232]: NOQUEUE: reject: RCPT from unknown[195.62.32.227]: 450 4.7.1 : Helo comman

Sep 13 08:22:02 mail.srvfarm.net postfix/smtpd[1001726]: NOQUEUE: reject: RCPT from unknown[195.62.32.221]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Sep 13 08:22:02 mail.srvfarm.net postfix/smtpd[1001726]: NOQUEUE: reject: RCPT from unknown[195.62.32.221]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Sep 13 08:27:02 mail.srvfarm.net postfix/smtpd[1001562]: NOQUEUE: reject: RCPT from unknown[195.62.32.221]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Sep 13 08:27:02 mail.srvfarm.net postfix/smtpd[1001562]: NOQUEUE: reject: RCPT from unknown[195.62.32.221]: 450 4.7.1 : Helo command rejected: Host not foun

Sep 12 22:41:49 web01.agentur-b-2.de postfix/smtpd[2309467]: NOQUEUE: reject: RCPT from unknown[195.62.32.227]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Sep 12 22:41:49 web01.agentur-b-2.de postfix/smtpd[2309467]: NOQUEUE: reject: RCPT from unknown[195.62.32.227]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Sep 12 22:41:52 web01.agentur-b-2.de postfix/smtpd[2330232]: NOQUEUE: reject: RCPT from unknown[195.62.32.227]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=
Sep 12 22:46:50 web01.agentur-b-2.de postfix/smtpd[2330232]: NOQUEUE: reject: RCPT from unknown[195.62.32.227]: 450 4.7.1 : Helo comman

mutliple daily email spam from:<17_116639-_17@nor.nosathe.de>

Daily mutiple spam  

Automatic report - Banned IP Access

Nov 15 15:25:01 ns382633 sshd\[28409\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.216.15  user=root
Nov 15 15:25:03 ns382633 sshd\[28409\]: Failed password for root from 106.12.216.15 port 55578 ssh2
Nov 15 15:38:45 ns382633 sshd\[31148\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.216.15  user=root
Nov 15 15:38:47 ns382633 sshd\[31148\]: Failed password for root from 106.12.216.15 port 39152 ssh2
Nov 15 15:44:26 ns382633 sshd\[32185\]: Invalid user geigad from 106.12.216.15 port 44274
Nov 15 15:44:26 ns382633 sshd\[32185\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.216.15

MultiHost/MultiPort Probe, Scan, Hack -

63.88.23.221 was recorded 5 times by 3 hosts attempting to connect to the following ports: 80. Incident counter (4h, 24h, all-time): 5, 37, 112

Nov 15 17:03:23 SilenceServices sshd[28381]: Failed password for root from 222.186.30.59 port 36588 ssh2
Nov 15 17:03:26 SilenceServices sshd[28381]: Failed password for root from 222.186.30.59 port 36588 ssh2
Nov 15 17:03:27 SilenceServices sshd[28381]: Failed password for root from 222.186.30.59 port 36588 ssh2

MultiHost/MultiPort Probe, Scan, Hack -

Nov 15 14:35:43 zeus sshd[26186]: Failed password for root from 66.85.156.75 port 56806 ssh2
Nov 15 14:39:55 zeus sshd[26333]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=66.85.156.75 
Nov 15 14:39:57 zeus sshd[26333]: Failed password for invalid user jayesh. from 66.85.156.75 port 53422 ssh2

Nov 15 17:23:04 lnxded64 sshd[29395]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.123.170
Nov 15 17:23:06 lnxded64 sshd[29395]: Failed password for invalid user admin from 128.199.123.170 port 46942 ssh2
Nov 15 17:27:05 lnxded64 sshd[30345]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.123.170

Nov 15 17:36:41 vtv3 sshd\[17473\]: Invalid user gubenco from 95.85.60.251 port 42830
Nov 15 17:36:41 vtv3 sshd\[17473\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=95.85.60.251
Nov 15 17:36:43 vtv3 sshd\[17473\]: Failed password for invalid user gubenco from 95.85.60.251 port 42830 ssh2
Nov 15 17:43:39 vtv3 sshd\[18511\]: Invalid user wwwadmin from 95.85.60.251 port 52130
Nov 15 17:43:39 vtv3 sshd\[18511\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=95.85.60.251
Nov 15 17:55:11 vtv3 sshd\[20714\]: Invalid user counsel from 95.85.60.251 port 42486
Nov 15 17:55:11 vtv3 sshd\[20714\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=95.85.60.251
Nov 15 17:55:13 vtv3 sshd\[20714\]: Failed password for invalid user counsel from 95.85.60.251 port 42486 ssh2
Nov 15 18:00:08 vtv3 sshd\[21458\]: Invalid user martha from 95.85.60.251 port 51774
Nov 15 18:00:08 vtv3 sshd\[21458\]: pa

Telnet Server BruteForce Attack

Automatic report - Port Scan Attack

Nov 15 06:30:43 tdfoods sshd\[3384\]: Invalid user a from 104.248.94.159
Nov 15 06:30:43 tdfoods sshd\[3384\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.94.159
Nov 15 06:30:45 tdfoods sshd\[3384\]: Failed password for invalid user a from 104.248.94.159 port 53802 ssh2
Nov 15 06:34:27 tdfoods sshd\[3683\]: Invalid user wangfei from 104.248.94.159
Nov 15 06:34:27 tdfoods sshd\[3683\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.94.159

Nov 15 17:08:20 vps666546 sshd\[29022\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.175.183  user=root
Nov 15 17:08:22 vps666546 sshd\[29022\]: Failed password for root from 222.186.175.183 port 10524 ssh2
Nov 15 17:08:26 vps666546 sshd\[29022\]: Failed password for root from 222.186.175.183 port 10524 ssh2
Nov 15 17:08:29 vps666546 sshd\[29022\]: Failed password for root from 222.186.175.183 port 10524 ssh2
Nov 15 17:08:32 vps666546 sshd\[29022\]: Failed password for root from 222.186.175.183 port 10524 ssh2
...

Fail2Ban Ban Triggered

Nov 15 17:55:37 microserver sshd[12841]: Invalid user cactiuser from 51.75.30.199 port 43774
Nov 15 17:55:37 microserver sshd[12841]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.30.199
Nov 15 17:55:39 microserver sshd[12841]: Failed password for invalid user cactiuser from 51.75.30.199 port 43774 ssh2
Nov 15 17:59:08 microserver sshd[13040]: Invalid user xing from 51.75.30.199 port 33807
Nov 15 17:59:08 microserver sshd[13040]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.30.199
Nov 15 18:09:54 microserver sshd[14504]: Invalid user team from 51.75.30.199 port 60353
Nov 15 18:09:54 microserver sshd[14504]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.30.199
Nov 15 18:09:56 microserver sshd[14504]: Failed password for invalid user team from 51.75.30.199 port 60353 ssh2
Nov 15 18:13:30 microserver sshd[15104]: Invalid user ssh from 51.75.30.199 port 50380
Nov 15 18:1