PHISHING AND SPAM ATTACK
FROM "Pooping Perfectly - PoopingPerfectly@visceramaster.cyou -" : 
SUBJECT "If you are not “pooping like a snake” every day, " :
RECEIVED "from masire.royaguage.com ([23.247.75.110]:50218 helo=rush.visceramaster.cyou)  " :
DATE/TIMESENT "Wed, 24 Feb 2021 01:12:33 "

PHISHING AND SPAM ATTACK
FROM "EBook Creator - DigitalBusinessTODAY@lepton.live -" : 
SUBJECT "[NEW] Ebook Creator Software (2018)! " :
RECEIVED "from tayman.verapitan.com ([23.247.75.67]:56703 helo=romeo.lepton.live)  " :
DATE/TIMESENT "Wed, 24 Feb 2021 04:33:49 "

PHISHING AND SPAM ATTACK
FROM "Jeff Martin - AcidReflux@mensfat.guru -" : 
SUBJECT "Odd Trick Eliminates Heartburn Fast? " :
RECEIVED "from hrbipe.verapitan.com ([23.247.75.73]:41473 helo=eagle.mensfat.guru) " :
DATE/TIMESENT "Sun, 07 Mar 2021 04:56:00 "
IP ADDRESS "NetRange: 23.247.75.0 - 23.247.75.255  Customer:  Andrew Horton (C04842071) ":

PHISHING AND SPAM ATTACK
FROM African Tribesmen - PenisElongationRitual@backyrdrevolution.co -" : 
SUBJECT "White Wife Caught In African Elongation Ritual " :
RECEIVED "from duhart.rotonat.com ([23.247.75.97]:39223 helo=lima.backyrdrevolution.co) " :
DATE/TIMESENT "Sat, 06 Mar 2021 07:32:39 "
IP ADDRESS "NetRange:       23.247.75.0 - 23.247.75.255  Customer:  Andrew Horton (C04842071)"

PHISHING AND SPAM ATTACK
FROM "Wireless Earbuds - WirelessEarbuds@hellfire.cyou -" : 
SUBJECT "New Apple H1 headphone chip delivers faster wireless connection to your devices " :
RECEIVED "from kvotes.rotonat.com ([23.247.75.102]:60098 helo=gull.hellfire.cyou)  " :
DATE/TIMESENT "Sat, 27 Feb 2021 23:52:46 "
IP ADDRESS "NetRange:       23.247.75.0 - 23.247.75.255  Customer:  Andrew Horton (C04842071)

PHISHING AND SPAM ATTACK
FROM "Wireless Earbuds - WirelessEarbuds@hellfire.cyou -" : 
SUBJECT "New Apple H1 headphone chip delivers faster wireless connection to your devices " :
RECEIVED "from kvotes.rotonat.com ([23.247.75.102]:60098 helo=gull.hellfire.cyou)  " :
DATE/TIMESENT "Sat, 27 Feb 2021 23:52:46 "
IP ADDRESS "NetRange:       23.247.75.0 - 23.247.75.255  Customer:  Andrew Horton (C04842071)"

PHISHING AND SPAM ATTACK
FROM "Cavities Disinfected - CavitiesDisinfected@denta.cyou -" : 
SUBJECT "Chew this before 10pm to rebuild your teeth and gums " :
RECEIVED "from flzs.royaguage.com ([23.247.75.105]:50946 helo=aoede.denta.cyou)  " :
DATE/TIMESENT "Sun, 28 Feb 2021 00:49:09 "
IP ADDRESS "NetRange:       23.247.75.0 - 23.247.75.255  Customer:  Andrew Horton (C04842071)"

PHISHING AND SPAM ATTACK
FROM "Cavities Disinfected - PerfectTeeth@snorestoptherpy.cyou -" : 
SUBJECT "Could chewing this before bed restore healthy teeth and gums? " :
RECEIVED "from zoriel.verapitan.com ([23.247.75.75]:37014 helo=access.snorestoptherpy.cyou)  " :
DATE/TIMESENT "Thu, 25 Feb 2021 01:23:07 "
IP ADDRESS "NetRange:       23.247.75.0 - 23.247.75.255  Customer:  Andrew Horton (C04842071)"

PHISHING AND SPAM ATTACK
FROM "Melissa - Numerology@ligefreedom.guru -" : 
SUBJECT "Number is Nature " :
RECEIVED "from uisuri.rumbece.com ([23.247.75.125]:38074 helo=wayne.ligefreedom.guru)  " :
DATE/TIMESENT "Thu, 25 Feb 2021 05:12:36 "
IP ADDRESS "NetRange:       23.247.75.0 - 23.247.75.255
CIDR:           23.247.75.0/24
NetName:        N3
NetHandle:      NET-23-247-75-0-1
Parent:         LAYER-HOST (NET-23-247-0-0-1)
NetType:        Reassigned
OriginAS:       AS3421
Customer:       Andrew Horton (C04842071)
RegDate:        2014-01-07
Updated:        2014-01-07
Ref:            https://rdap.arin.net/registry/ip/23.247.75.0"

PHISHING AND SPAM ATTACK
FROM "Pooping Perfectly - PoopingPerfectly@visceramaster.cyou -" : 
SUBJECT "If you are not “pooping like a snake” every day, " :
RECEIVED "from masire.royaguage.com ([23.247.75.110]:50218 helo=rush.visceramaster.cyou)  " :
DATE/TIMESENT "Wed, 24 Feb 2021 01:12:33 "

PHISHING AND SPAM ATTACK
FROM "Speechelo - Speechelo@speechgrow.cyou -" : 
SUBJECT "HEAR THIS: Create ‘Human’ Voice-Overs " :
RECEIVED "rom prosos.royaguage.com ([23.247.75.104]:37489 helo=papa.speechgrow.cyou) " :
DATE/TIMESENT "Tue, 23 Feb 2021 01:07:20 "

PHISHING AND SPAM ATTACK
FROM "Forgotten Power - forgottenpower@stopmal.live -" : 
SUBJECT "The Medicinal plant hiding in your backyard " :
RECEIVED "from hsbt.rotonat.com ([23.247.75.101]:60136 helo=tango.stopmal.live)" :
DATE/TIMESENT "Mon, 22 Feb 2021 01:58:13  "

PHISHING AND SPAM ATTACK
FROM "Survive THIS Crisis - SurviveTHISCrisis@medicarespro.buzz -" : 
SUBJECT "Does This Prove We're Witnessing the Beginning of the End?" :
RECEIVED "from klubok.rotonat.com ([23.247.75.94]:48261 helo=paso.medicarespro.buzz)" :
DATE/TIMESENT "Sat, 20 Feb 2021 19:34:21 "

Brute force attempt

IP: 23.247.75.215
ASN: AS46573 Global Frag Networks
Port: Simple Mail Transfer 25
Found in one or more Blacklists
Date: 4/09/2019 9:16:54 AM UTC

Dec 19 16:54:27 sso sshd[15376]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.201.255
Dec 19 16:54:29 sso sshd[15376]: Failed password for invalid user hsiaosu from 157.245.201.255 port 38258 ssh2
...

Dec 19 16:38:10 hcbbdb sshd\[23640\]: Invalid user foon from 65.52.169.39
Dec 19 16:38:10 hcbbdb sshd\[23640\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=65.52.169.39
Dec 19 16:38:12 hcbbdb sshd\[23640\]: Failed password for invalid user foon from 65.52.169.39 port 50952 ssh2
Dec 19 16:44:13 hcbbdb sshd\[24242\]: Invalid user bichnga from 65.52.169.39
Dec 19 16:44:13 hcbbdb sshd\[24242\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=65.52.169.39

Brute-force attempt banned

Dec 19 16:38:08 tux-35-217 sshd\[16798\]: Invalid user chinaqqw from 200.54.96.59 port 43581
Dec 19 16:38:08 tux-35-217 sshd\[16798\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.54.96.59
Dec 19 16:38:10 tux-35-217 sshd\[16798\]: Failed password for invalid user chinaqqw from 200.54.96.59 port 43581 ssh2
Dec 19 16:43:32 tux-35-217 sshd\[16852\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.54.96.59  user=root
...

2019-12-19T16:31:00.993159shield sshd\[8429\]: Invalid user marken from 118.24.40.136 port 53808
2019-12-19T16:31:00.997428shield sshd\[8429\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.24.40.136
2019-12-19T16:31:03.331663shield sshd\[8429\]: Failed password for invalid user marken from 118.24.40.136 port 53808 ssh2
2019-12-19T16:36:34.787028shield sshd\[9847\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.24.40.136  user=root
2019-12-19T16:36:36.639650shield sshd\[9847\]: Failed password for root from 118.24.40.136 port 40222 ssh2

$f2bV_matches

Dec 19 15:37:22 grey postfix/smtpd\[11455\]: NOQUEUE: reject: RCPT from unknown\[187.60.44.74\]: 554 5.7.1 Service unavailable\; Client host \[187.60.44.74\] blocked using truncate.gbudb.net\; http://www.gbudb.com/truncate/ \[187.60.44.74\]\; from=\ to=\ proto=ESMTP helo=\<\[187.60.44.74\]\>
...

Unauthorized connection attempt detected from IP address 125.165.110.110 to port 5555

Dec 19 17:39:04 jane sshd[21392]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.187.131.203 
Dec 19 17:39:06 jane sshd[21392]: Failed password for invalid user chinglong from 37.187.131.203 port 59304 ssh2
...

Dec 19 06:36:55 hanapaa sshd\[3153\]: Invalid user kalaichelvan from 5.39.88.60
Dec 19 06:36:55 hanapaa sshd\[3153\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ns3033121.ip-5-39-88.eu
Dec 19 06:36:57 hanapaa sshd\[3153\]: Failed password for invalid user kalaichelvan from 5.39.88.60 port 55048 ssh2
Dec 19 06:43:15 hanapaa sshd\[3920\]: Invalid user ha2426 from 5.39.88.60
Dec 19 06:43:15 hanapaa sshd\[3920\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ns3033121.ip-5-39-88.eu

Dec 19 17:45:35 loxhost sshd\[16614\]: Invalid user forsaa from 157.230.215.106 port 54818
Dec 19 17:45:35 loxhost sshd\[16614\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.230.215.106
Dec 19 17:45:37 loxhost sshd\[16614\]: Failed password for invalid user forsaa from 157.230.215.106 port 54818 ssh2
Dec 19 17:50:56 loxhost sshd\[16849\]: Invalid user youyou from 157.230.215.106 port 33378
Dec 19 17:50:56 loxhost sshd\[16849\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.230.215.106
...

Dec 19 07:14:34 web9 sshd\[447\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.190.92  user=root
Dec 19 07:14:36 web9 sshd\[447\]: Failed password for root from 222.186.190.92 port 20894 ssh2
Dec 19 07:14:39 web9 sshd\[447\]: Failed password for root from 222.186.190.92 port 20894 ssh2
Dec 19 07:14:42 web9 sshd\[447\]: Failed password for root from 222.186.190.92 port 20894 ssh2
Dec 19 07:14:53 web9 sshd\[514\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.190.92  user=root

Dec 19 16:37:54 MK-Soft-VM6 sshd[18176]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.24.56.143 
Dec 19 16:37:56 MK-Soft-VM6 sshd[18176]: Failed password for invalid user info from 118.24.56.143 port 49464 ssh2
...

Dec 19 16:27:50 OPSO sshd\[5998\]: Invalid user laukholm from 68.183.236.66 port 38752
Dec 19 16:27:50 OPSO sshd\[5998\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.183.236.66
Dec 19 16:27:52 OPSO sshd\[5998\]: Failed password for invalid user laukholm from 68.183.236.66 port 38752 ssh2
Dec 19 16:34:01 OPSO sshd\[6933\]: Invalid user sexsex from 68.183.236.66 port 44306
Dec 19 16:34:01 OPSO sshd\[6933\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.183.236.66

\[2019-12-19 11:01:01\] NOTICE\[2839\] chan_sip.c: Registration from '"1007" \' failed for '37.49.230.81:5765' - Wrong password
\[2019-12-19 11:01:01\] SECURITY\[2857\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-12-19T11:01:01.087-0500",Severity="Error",Service="SIP",EventVersion="2",AccountID="1007",SessionID="0x7f0fb4a5a908",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.230.81/5765",Challenge="2cd2fa42",ReceivedChallenge="2cd2fa42",ReceivedHash="5cfed5545e2072860f7396a79c82cba1"
\[2019-12-19 11:01:01\] NOTICE\[2839\] chan_sip.c: Registration from '"1007" \' failed for '37.49.230.81:5765' - Wrong password
\[2019-12-19 11:01:01\] SECURITY\[2857\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-12-19T11:01:01.209-0500",Severity="Error",Service="SIP",EventVersion="2",AccountID="1007",SessionID="0x7f0fb4935698",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/3