https://www.virustotal.com/gui/ip-address/209.85.220.41/relations
https://multirbl.valli.org/lookup/209.85.220.41.html
https://www.liveipmap.com/?ip=209.85.220.41
https://www.abuseipdb.com/check/209.85.220.41

https://www.virustotal.com/gui/ip-address/209.85.220.41/relations
https://multirbl.valli.org/lookup/209.85.220.41.html
https://www.liveipmap.com/?ip=209.85.220.41
https://www.abuseipdb.com/check/209.85.220.41

https://www.virustotal.com/gui/ip-address/209.85.220.41/relations
https://multirbl.valli.org/lookup/209.85.220.41.html
https://www.liveipmap.com/?ip=209.85.220.41
https://www.abuseipdb.com/check/209.85.220.41

https://www.virustotal.com/gui/ip-address/209.85.220.41/relations
https://multirbl.valli.org/lookup/209.85.220.41.html
https://www.liveipmap.com/?ip=209.85.220.41
https://www.abuseipdb.com/check/209.85.220.41

spf=pass (google.com: domain of rodriguezclint5@gmail.com designates 209.85.220.41 as permitted sender) smtp.mailfrom=rodriguezclint5@gmail.com;

BULLSHIT SCAM SPAM
From: aysdefujgf 
Subject: Re: gk61jzdg5b
Message ID: 
 domain gmail.com
CONTENT:  https://www.hulu.com/jkbln/xytm-psar=bvkc&kdaz:919_wt_hncmr
 https://www.hulu.com/tcgwk/ysqr-wmlf=ivef&tuzj:979_tw_agzlw mqzch@hulu.com

This IP address is a professional scammer as evident by this IP search: https://whatismyipaddress.com/ip/209.85.220.41.  They posted a craiglist posting that I replied to and asked to be paid ahead of time and did not deliver as promised.  Will not return money.

PHISHING SPAM !

Original message
Message ID	
Created on:	26 May 2020 at 06:59 (Delivered after 2 seconds)
From:	walgrnsPharmaacyexjq 
Subject:	beestGiiftpsq Re: 2xi4oqnkp5wd
SPF:	PASS with IP 209.85.220.41 Learn more
DKIM:	'PASS' with domain gmail.com Learn more
DMARC:	'PASS'
Surprisee!
You Have Been Selected To Get Up to $760 Walgreens-GiftCard,
To Take Survey Now, Please Use This Link:
https://ltfkytppdggtlzxh.storage.googleapis.com/lyuqgyceuleivxthzpsoewpmrukwjfcdoroaiacnaflsqx.shtml

Original message
Message ID	
Created on:	18 May 2020 at 05:52 (Delivered after 2 seconds)
From:	TornoSatisfaction jwjr 
Subject:	OOh!YouWWiin mm Re:
SPF:	PASS with IP 209.85.220.41 Learn more
DKIM:	'PASS' with domain gmail.com Learn more
DMARC:	'PASS'
Congratulations, You Have Been Selected To Get A $1720 CVS Pharmacy GiftCard,
In Order To Take Your Gift Card All You Have To Do Is Just Answering A Short Survey About Your Shopping Experiences At Cvs
https://jovjsxhacrveftnu.storage.googleapis.com/oxqgduqwyfbsgxrjmpyicvenurskjocaympzbdurib.shtml

Sending out 419 type spam emails from
IP 209.85.220.41
(Google.com) 

"Congratulations Dear Winner,

 We are pleased to inform you of the result of the just concluded annual final draws held by Facebook Lottery Group in Cash Promotion to encourage the usage of Facebook world wide.The online international lotto promo draws was conducted from an exclusive list of 50,000.00 companies/ corporate bodies and 30.000.000 individual users email addresses from Europe, North & South America, Asia, Australia, New Zealand, Middle-East and Africa, were picked by an "Advanced Automated Random Computer Search Machine" from the Facebook Platform. This is a millennium scientific computer which was used. It is a promotional program aimed at encouraging Facebook Users; therefore you do not need to buy ticket to enter for it. "NO TICKETS WERE SOLD"."

Scammer poses as an FBI agent.
federalbureaufbi451@gmail.com

Good day 





The Federal Bureau Of Investigation is just trying to make you understand that you most finish the process with (Mr John c William) from federal reserve bank United States Office.) within 1working days to get your money to you. From the information we received here in our office, you are required to go ahead and send them their required amount of $200 USD, which is the only hitch to the finalization of the transaction you have with him.

Pretends to be renting apartments on craigslist, seeks personal information.  Actual location is not for rent and people residing there are fed up with numerous people going there.  The craigslist photos were obtained from an online real estate website.

This IP address is linked to major fraud and crimes of Bitcoin theft, expeditehackers@ gmail.com is ran from this IP address, so is getbackfunds@gmail.com who pose and impersonate themselves as Bitcoin theft recovery agents. They will prey on and steal from folk for a second time who have come to them looking for help with previous instances of Bitcoin theft. Both sites www.expeditetools.com and www.getbackfunds.org will also communicate through Whatsapp using two different numbers. These rotten vile grossly deceitful crooked stealing low life scum bags need locking up asap never to be released!.

Claims to be young woman, originally from USA, currently working in Syria, as a nurse. Has a profile on a dating site langmate and contacted me to send money to her email. Name she use is Angeline Arias - angelinearias5000@gmail.com

impersonating, threatening mesages

watch out Fraud

Received: from mail-sor-f69.google.com (mail-sor-f69.google.com. [209.85.220.69])
        by mx.google.com with SMTPS id i12sor2127698iol.56.2020.08.05.10.12.24
        for <@>
        (Google Transport Security);
        Wed, 05 Aug 2020 10:12:24 -0700 (PDT)

Real Stories just uploaded a video
Egypt's Voice of Freedom (Great Mind Documentary) | Real Stories
http://www.youtube.com/watch?v=N8R7mDvzEAE&feature=em-uploademail

 realstories@littledotstudios.com 

canonical name littledotstudios.com.
aliases
addresses 37.188.110.40

from:	federal bureau 
reply-to:	service_u@aol.com
to:
date:	Aug 3, 2020, 8:40 PM
subject:	(FBI) PAYMENT MEMO TO PAYMENT BENEFICIARIES.
mailed-by:	gmail.com
signed-by:	gmail.com
security:	 Standard encryption (TLS) Learn more

Received: from mail-sor-f69.google.com (mail-sor-f69.google.com. [209.85.220.69])
        by mx.google.com with SMTPS id b78sor2889200ilg.94.2020.07.29.13.58.01
        for <>
        (Google Transport Security);
        Wed, 29 Jul 2020 13:58:01 -0700 (PDT)

Mr Carlson's Lab just uploaded a video
UFO FINDER Inside Lab 2?
http://www.youtube.com/watch?v=-gpUGw9dgu0&feature=em-uploademail

Received: from mail-sor-f69.google.com (mail-sor-f69.google.com. [209.85.220.69])
        by mx.google.com with SMTPS id t185sor8394064qkb.21.2020.07.03.05.36.11
        for <> (Google Transport Security);
        Fri, 03 Jul 2020 05:36:12 -0700 (PDT)

JohnAudioTech just uploaded a video
How to select audio amplifier input decoupling capacitor value
http://www.youtube.com/watch?v=xzORxnIpbCs&feature=em-uploademail

John N Nay in Vandalia, OH
Current address Po Box 362, Vandalia, OH 45377
    5064 Santa Fe Dr, Dayton, OH 45414
    5062 Santa Fe Dr, Dayton, OH 45414
    3505 Village Dr, APT H, Franklin, OH 45005
    Santa Fe Dr, Dayton, OH 45414	
Current Phone (513) 237-9459
Previous Phones
    (937) 422-1162
    (937) 237-9459
    (513) 422-1162

Received: from mail-sor-f69.google.com (mail-sor-f69.google.com. [209.85.220.69])
        by mx.google.com with SMTPS id x6sor2907370qtd.18.2020.06.24.12.48.41
        for <@gmail.com>
        (Google Transport Security);
        Wed, 24 Jun 2020 12:48:41 -0700 (PDT)


Learn Windows 10 and Computers just uploaded a video
NEW Nvidia GPU Graphics drivers DirectX 12 and more Windows 10 Version 2004  
capabilities June 24th
http://www.youtube.com/watch?v=DiwZvmobi8Q&feature=em-uploademail


ateliersinfo@hotmail.com

PHISHING SPAM!

Received: from mail-io1-f69.google.com (mail-io1-f69.google.com [209.85.166.69])
	by m0116958.mta.everyone.net (EON-INBOUND) with ESMTP id m0116958.5e67f941.2a9a82a
	for <@antihotmail.com>; Wed, 6 May 2020 11:12:44 -0700
Received: from mail-sor-f65.google.com (mail-sor-f65.google.com. [209.85.220.65])
        by mx.google.com with SMTPS id h11sor2644248ilq.116.2020.05.06.10.56.21
        for 
        (Google Transport Security);
        Wed, 06 May 2020 10:56:21 -0700 (PDT)

https://go.aws/2W7vfxt
301 Redirect
https://usa-market2.s3.amazonaws.com/CBDbbbbbbbbbbb.html
Meta-Refresh
https://usa-market2.s3.amazonaws.com/

Received: from mail-sor-f69.google.com (mail-sor-f69.google.com. [209.85.220.69])
        by mx.google.com with SMTPS id y8sor7429274pli.65.2020.04.24.04.15.57
        for <@gmail.com>
        (Google Transport Security);
        Fri, 24 Apr 2020 04:15:57 -0700 (PDT)
Received-SPF: pass (google.com: domain of 3bcq

12voltvids just uploaded a video
Mini road trip to cure boredom during the pandemic great scenery on this  
one in 4k
http://www.youtube.com/watch?v=VxNeZaJ4sR4&feature=em-uploademail

Dave McDonald / Sharon McDonald
(604)-200-1675
(604) 943-0664
(604) 724-5343
(604) 806-4602
1361 Compston Crescent
Delta
Vancouver British Columbia
IP number 205.250.57.86  Telus Broadband/cable/fiber
volt@telus.net

sent me two emails posing as an email address that I potentially wanted to have!

Received: from mail-sor-f69.google.com (mail-sor-f69.google.com. [209.85.220.69])
        by mx.google.com with SMTPS id q1sor5408914plr.16.2020.03.12.00.40.11
        for 
        (Google Transport Security);
        Thu, 12 Mar 2020 00:40:11 -0700 (PDT)


12voltvids just uploaded a video
Panasonic DVD S35 No Playback repair
http://www.youtube.com/watch?v=4T61lpAOHnA&feature=em-uploademail

https://www.abuseipdb.com/check/209.85.220.69
Dave McDonald / Sharon McDonald
(604)-200-1675
(604) 943-0664
(604) 724-5343
(604) 806-4602
1361 Compston Crescent
Delta
Vancouver British Columbia
IP number 205.250.57.86  Telus Broadband/cable/fiber
volt@telus.net

Received: from mail-sor-f69.google.com (mail-sor-f69.google.com. [209.85.220.69])
        by mx.google.com with SMTPS id n29sor15400294pgc.73.2020.02.24.15.09.26
        for <@gmail.com>
        (Google Transport Security);
        Mon, 24 Feb 2020 15:09:27 -0800 (PST)


CareyHolzman just uploaded a video
How Do I Know Which Files Or Directories Are Safe To Delete?
http://www.youtube.com/watch?v=WhxuCnLKcBE&feature=em-uploademail

Name: Carey Alan Holzman
Michelle Lee Holzman
Address: 5381 N 87th Ave, Glendale, Arizona, 85305
https://careyholzman.com
Phone Numbers:
(602) 527-9723 
(623) 628-4266 
carey@tech-vets.com carey.holzman@yahoo.com cholzman@cox.net 
carey@careyholzman.com ,cholzman@outlook.com,cholzman@gmail.com 
IP Number : 68.231.131.39
x-originating-ip: [199.189.26.30]

Received-SPF: pass (google.com: domain of anan11+bncbcrzbwf6xikbbh5gvpyqkgqetybgzxq@techsaga.es designates 209.85.220.69 as permitted sender) client-ip=209.85.220.69;
Authentication-Results: mx.google.com;
       dkim=pass header.i=@techsaga-es.20150623.gappssmtp.com header.s=20150623 header.b=jnwOUSzs;
       arc=pass (i=2 spf=pass spfdomain=gmail.com dkim=pass dkdomain=gmail.com dmarc=pass fromdomain=gmail.com);
       spf=pass (google.com: domain of anan11+bncbcrzbwf6xikbbh5gvpyqkgqetybgzxq@techsaga.es designates 209.85.220.69 as permitted sender) smtp.mailfrom=anan11+bncBCRZBWF6XIKBBH5GVPYQKGQETYBGZXQ@techsaga.es;
       dmarc=fail (p=NONE sp=QUARANTINE dis=NONE arc=pass) header.from=gmail.com

Received: from mail-sor-f69.google.com (mail-sor-f69.google.com. [209.85.220.69])
        by mx.google.com with SMTPS id k19sor18099186qvu.63.2019.12.24.22.07.03
        for <@gmail.com>
        (Google Transport Security);
        Tue, 24 Dec 2019 22:07:03 -0800 (PST)

12voltvids just uploaded a video
Auto Vox Auora Dual 1080p + QHD dash camera with GPS
http://www.youtube.com/watch?v=P83BEVHZ4Sw&feature=em-uploademail

Dave McDonald / Sharon McDonald
(604)-200-1675
(604) 943-0664
(604) 724-5343
(604) 806-4602
1361 Compston Crescent
Delta
Vancouver British Columbia
IP number 205.250.57.86  Telus Broadband/cable/fiber
volt@telus.net

Received: from mail-sor-f69.google.com (mail-sor-f69.google.com. [209.85.220.69])
        by mx.google.com with SMTPS id a130sor408591ybg.114.2019.12.02.12.31.39
        for <@gmail.com>
        (Google Transport Security);
        Mon, 02 Dec 2019 12:31:39 -0800 (PST)


CareyHolzman just uploaded a video
What Did Windows 10 1809 Do To Your USB Speeds? A Lesson That Everyone  
Should Know About!
http://www.youtube.com/watch?v=au-niXiKYXo&feature=em-uploademail


Name: Carey Alan Holzman
Michelle Lee Holzman
Address: 5381 N 87th Ave, Glendale, Arizona, 85305
https://careyholzman.com
Phone Numbers:
(602) 527-9723 
(623) 628-4266 
carey@tech-vets.com carey.holzman@yahoo.com cholzman@cox.net 
carey@careyholzman.com ,cholzman@outlook.com,cholzman@gmail.com 
IP Number : 68.231.131.39
x-originating-ip: [199.189.26.30]

$f2bV_matches

port scan and connect, tcp 1433 (ms-sql-s)

Sep  7 14:38:32 minden010 sshd[5671]: Failed password for root from 180.76.109.16 port 56360 ssh2
Sep  7 14:43:17 minden010 sshd[7407]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.109.16
Sep  7 14:43:19 minden010 sshd[7407]: Failed password for invalid user dominic from 180.76.109.16 port 57026 ssh2
...

Icarus honeypot on github

TCP ports : 4495 / 7876 / 12326

sshd: Failed password for .... from 139.199.85.241 port 39654 ssh2 (8 attempts)

Sep  7 19:03:48 nextcloud sshd\[25433\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.177.172.128  user=root
Sep  7 19:03:50 nextcloud sshd\[25433\]: Failed password for root from 61.177.172.128 port 48538 ssh2
Sep  7 19:04:01 nextcloud sshd\[25433\]: Failed password for root from 61.177.172.128 port 48538 ssh2

Malicious/Probing: /wp/wp-includes/wlwmanifest.xml

Sep  7 19:25:08 v22019058497090703 postfix/smtpd[1352]: warning: unknown[45.142.120.20]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Sep  7 19:25:46 v22019058497090703 postfix/smtpd[30023]: warning: unknown[45.142.120.20]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Sep  7 19:26:24 v22019058497090703 postfix/smtpd[1352]: warning: unknown[45.142.120.20]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
...

Cowrie Honeypot: 3 unauthorised SSH/Telnet login attempts between 2020-09-07T07:46:19Z and 2020-09-07T07:56:30Z

sshd: Failed password for .... from 171.34.173.17 port 39534 ssh2 (11 attempts)

Unauthorized connection attempt from IP address 189.59.5.49 on port 993

Sep  7 17:08:22 scw-6657dc sshd[7063]: Failed password for root from 61.177.172.168 port 19103 ssh2
Sep  7 17:08:22 scw-6657dc sshd[7063]: Failed password for root from 61.177.172.168 port 19103 ssh2
Sep  7 17:08:25 scw-6657dc sshd[7063]: Failed password for root from 61.177.172.168 port 19103 ssh2
...

Sep  7 08:09:32 santamaria sshd\[6562\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.192.136.43  user=root
Sep  7 08:09:34 santamaria sshd\[6562\]: Failed password for root from 91.192.136.43 port 46004 ssh2
Sep  7 08:13:21 santamaria sshd\[6599\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.192.136.43  user=root
...

(sshd) Failed SSH login from 103.253.3.214 (ID/Indonesia/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Sep  6 23:08:15 server5 sshd[20487]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.253.3.214  user=mysql
Sep  6 23:08:17 server5 sshd[20487]: Failed password for mysql from 103.253.3.214 port 38360 ssh2
Sep  6 23:21:52 server5 sshd[26996]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.253.3.214  user=root
Sep  6 23:21:54 server5 sshd[26996]: Failed password for root from 103.253.3.214 port 35964 ssh2
Sep  6 23:26:53 server5 sshd[29374]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.253.3.214  user=root