Spam/Phish - smtp.mailfrom=reply.lexlegis-mailers.com; live.com; dkim=pass (signature wasReceived: from DB3EUR04HT013.eop-eur04.prod.protection.outlook.com Received: from DB3EUR04FT043.eop-eur04.prod.protection.outlook.com Received: from a10-123.smtp-out.amazonses.com (54.240.10.123) by
Sending out Netflix spam from IP 54.240.14.174
(amazon.com / amazonaws.com)
I have NEVER been a Netflix customer and
never asked for this junk.
The website spammed out is
https://www.netflix.com/signup/creditoption?nftoken=BQAbAAEBEA77T6CHfer3tv8qolkSAduAkLFC%2FFYUyiUS4Sdi62TDOAptLP7WiMxUQK74rIuN%2BRXrWDnwU8vxCNSC2khWG0ZmflN2tsqMsqNHMDWRdKmlf6XFVqwlgd%2BFLY2Nz88IH4y3pcuOeFYD5X9L4G9ZZfbRHvrmZF%2FjsAyUI1f5mpTFg3eEFWfNQayYDiVrbb%2FU65EF%2B0XXrVI0T4jKa2zmCB8w5g%3D%3D&lnktrk=EMP&g=AEF2F71097E503EBEB44921E2720235C64526E40&lkid=URL_SIGNUP_CREDIT
IPs: 54.69.16.110, 54.70.73.70, 54.149.101.155,
54.201.91.38, 54.213.182.74, 52.37.77.112,
52.41.20.47, 52.41.193.16
(amazon.com / amazonaws.com)
amazon are pure scumbags who allow their
customers to send out spam and do nothing
about it!
Report via email and website at
https://support.aws.amazon.com/#/contacts/report-abuse
Attempt to login to email server on SMTP service on 05-09-2019 09:34:42.
2019-09-05 17:13:16
Whois info:
b
Dig info:
; <<>> DiG 9.10.3-P4-Ubuntu <<>> 54.240.1.143
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 34359
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
;; QUESTION SECTION:
;54.240.1.143. IN A
;; AUTHORITY SECTION:
. 457 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2022021300 1800 900 604800 86400
;; Query time: 17 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Sun Feb 13 17:53:38 CST 2022
;; MSG SIZE rcvd: 105
Host info
143.1.240.54.in-addr.arpa domain name pointer a1-143.smtp-out.eu-west-1.amazonses.com.
Nslookup info:
Server: 183.60.83.19
Address: 183.60.83.19#53
Non-authoritative answer:
143.1.240.54.in-addr.arpa name = a1-143.smtp-out.eu-west-1.amazonses.com.
Authoritative answers can be found from:
May 10 08:10:28 OPSO sshd\[5832\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.136.204.171 user=root
May 10 08:10:31 OPSO sshd\[5832\]: Failed password for root from 152.136.204.171 port 34210 ssh2
May 10 08:15:38 OPSO sshd\[6809\]: Invalid user testftp from 152.136.204.171 port 44206
May 10 08:15:38 OPSO sshd\[6809\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.136.204.171
May 10 08:15:40 OPSO sshd\[6809\]: Failed password for invalid user testftp from 152.136.204.171 port 44206 ssh2
May 10 07:10:19 roki-contabo sshd\[16387\]: Invalid user oracle from 190.85.171.126
May 10 07:10:19 roki-contabo sshd\[16387\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.85.171.126
May 10 07:10:21 roki-contabo sshd\[16387\]: Failed password for invalid user oracle from 190.85.171.126 port 46974 ssh2
May 10 07:24:50 roki-contabo sshd\[16541\]: Invalid user tf2server from 190.85.171.126
May 10 07:24:50 roki-contabo sshd\[16541\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.85.171.126
...
May 10 10:29:08 sigma sshd\[24249\]: Invalid user deploy from 218.153.133.68May 10 10:29:10 sigma sshd\[24249\]: Failed password for invalid user deploy from 218.153.133.68 port 46516 ssh2
...
Lines containing failures of 188.68.59.80
May 9 23:42:54 shared04 sshd[18754]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.68.59.80 user=sys
May 9 23:42:56 shared04 sshd[18754]: Failed password for sys from 188.68.59.80 port 35584 ssh2
May 9 23:42:56 shared04 sshd[18754]: Received disconnect from 188.68.59.80 port 35584:11: Bye Bye [preauth]
May 9 23:42:56 shared04 sshd[18754]: Disconnected from authenticating user sys 188.68.59.80 port 35584 [preauth]
May 10 00:01:32 shared04 sshd[24578]: Invalid user arabelle from 188.68.59.80 port 41672
May 10 00:01:32 shared04 sshd[24578]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.68.59.80
May 10 00:01:34 shared04 sshd[24578]: Failed password for invalid user arabelle from 188.68.59.80 port 41672 ssh2
May 10 00:01:34 shared04 sshd[24578]: Received disconnect from 188.68.59.80 port 41672:11: Bye Bye [preauth]
May 10 00:01:34 shared04........
------------------------------
May 10 10:00:04 inter-technics sshd[31550]: Invalid user west from 185.51.201.115 port 60884
May 10 10:00:04 inter-technics sshd[31550]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.51.201.115
May 10 10:00:04 inter-technics sshd[31550]: Invalid user west from 185.51.201.115 port 60884
May 10 10:00:06 inter-technics sshd[31550]: Failed password for invalid user west from 185.51.201.115 port 60884 ssh2
May 10 10:04:29 inter-technics sshd[31813]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.51.201.115 user=root
May 10 10:04:31 inter-technics sshd[31813]: Failed password for root from 185.51.201.115 port 39496 ssh2
...