PHISHING AND SPAM ATTACK
63.80.185.105  Re: Special Offer - info@agencedigital.info.  Hello .. your email address .. Stand a chance to win a 10 x $100 McDonald's Voucher,  25 Jun 2021
OrgName:        MCI Communications Services, Inc. d/b/a Verizon Business : OVH Hosting, Inc. : DigitalOcean, LLC :
NetRange:       63.64.0.0 - 63.127.255.255
      	        64.227.0.0 - 64.227.127.255
                66.70.128.0 - 66.70.255.255
                161.35.0.0 - 161.35.255.255
Other emails from same group
63.80.185.62  Re: Special Offer - info@agencedigital.info,  Hello .. your email address .., Don't miss out to win $500 Target Gift Card!,  13 Jun 2021
63.80.185.105  Re: Special Offer - info@agencedigital.info.  Hello .. your email address .. Stand a chance to win a 10 x $100 McDonald's Voucher,  25 Jun 2021
64.227.6.89 Re: Limited Offer -admin@tcwuzi.co.in, ..your email address..,Enter now for your chance to win A $1,000 gift card!, Sun, 09 May 2021
64.227.24.212 Re: Bigger deal - newsletter@surazul.co.in, Hello ..your email address.. ,Grab a chance to win a $300 Hello Fresh Gift Card!, 09 Jun 2021
66.70.242.234  Re: Limited Offer - newsletter@sesanye.com - Hello .. your email address .., Don’t miss this chance to win Dyson V11 Vacuum Cleaner!  Sun, 11 Apr 2021
161.35.111.0 Re: Bigger deal - newsletter@elmyar.co.in, Hello .. your email address .., Grab a chance to win a $300 Hello Fresh Gift Card!, 12 Jun 2021
161.35.111.0 Jackpot Lottery Winners - ... your email address... - I'd won more than $324,000 in the last four months, 18 May 2021 
161.35.111.0 FreeSpins4You +Bonus  newsletter@elmyar.co.in, Claim your welcome Bonus at King Billy on $1000 OR 5 BTC +200 FREE SPINS, 08 Jun 2021

PHISHING AND SPAM ATTACK
63.80.185.62  Re: Special Offer - info@agencedigital.info,  Hello .. your email address .., Don't miss out to win $500 Target Gift Card!,  13 Jun 2021
OrgName:        MCI Communications Services, Inc. d/b/a Verizon Business : OVH Hosting, Inc. : DigitalOcean, LLC :
NetRange:       63.64.0.0 - 63.127.255.255
      	     64.227.0.0 - 64.227.127.255
                66.70.128.0 - 66.70.255.255
               161.35.0.0 - 161.35.255.255
Other emails from same group
63.80.185.62  Re: Special Offer - info@agencedigital.info,  Hello .. your email address .., Don't miss out to win $500 Target Gift Card!,  13 Jun 2021
64.227.6.89 Re: Limited Offer -admin@tcwuzi.co.in, ..your email address..,Enter now for your chance to win A $1,000 gift card!, Sun, 09 May 2021
64.227.24.212 Re: Bigger deal - newsletter@surazul.co.in, Hello ..your email address.. ,Grab a chance to win a $300 Hello Fresh Gift Card!, 09 Jun 2021
66.70.242.234  Re: Limited Offer - newsletter@sesanye.com - Hello .. your email address .., Don’t miss this chance to win Dyson V11 Vacuum Cleaner!  Sun, 11 Apr 2021
161.35.111.0 Re: Bigger deal - newsletter@elmyar.co.in, Hello .. your email address .., Grab a chance to win a $300 Hello Fresh Gift Card!, 12 Jun 2021
161.35.111.0 Jackpot Lottery Winners - ... your email address... - I'd won more than $324,000 in the last four months, 18 May 2021 
161.35.111.0 FreeSpins4You +Bonus  newsletter@elmyar.co.in, Claim your welcome Bonus at King Billy on $1000 OR 5 BTC +200 FREE SPINS, 08 Jun 2021

Mar 12 04:26:20 mail.srvfarm.net postfix/smtpd[1637570]: NOQUEUE: reject: RCPT from unknown[63.80.185.75]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar 12 04:30:22 mail.srvfarm.net postfix/smtpd[1636119]: NOQUEUE: reject: RCPT from unknown[63.80.185.75]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar 12 04:31:43 mail.srvfarm.net postfix/smtpd[1637564]: NOQUEUE: reject: RCPT from unknown[63.80.185.75]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar 12 04:32:29 mail.srvfarm.net postfix/

Mar  6 13:58:09 mail.srvfarm.net postfix/smtpd[2116253]: NOQUEUE: reject: RCPT from unknown[63.80.185.73]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar  6 14:07:14 mail.srvfarm.net postfix/smtpd[2116265]: NOQUEUE: reject: RCPT from unknown[63.80.185.73]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar  6 14:07:14 mail.srvfarm.net postfix/smtpd[2112351]: NOQUEUE: reject: RCPT from unknown[63.80.185.73]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo=
Mar  6 14:07:14 mail.srvfarm.net postfix/smt

2020-02-20 1j4l9f-0004h6-Hg H=rations.kaanahr.com \(rations.sepehrms.com\) \[63.80.185.81\] rejected **REMOVED** : REJECTED - You seem to be a spammer!
2020-02-20 H=rations.kaanahr.com \(rations.sepehrms.com\) \[63.80.185.81\] F=\ rejected RCPT \: Mail not accepted. 63.80.185.81 is listed at a DNSBL.
2020-02-20 H=rations.kaanahr.com \(rations.sepehrms.com\) \[63.80.185.81\] F=\ rejected RCPT \<**REMOVED**@**REMOVED**.de\>: Mail not accepted. 63.80.185.81 is listed at a DNSBL.

Feb 13 10:44:28 mxgate1 postfix/postscreen[1864]: CONNECT from [63.80.185.166]:59037 to [176.31.12.44]:25
Feb 13 10:44:28 mxgate1 postfix/dnsblog[2011]: addr 63.80.185.166 listed by domain zen.spamhaus.org as 127.0.0.3
Feb 13 10:44:28 mxgate1 postfix/dnsblog[2011]: addr 63.80.185.166 listed by domain zen.spamhaus.org as 127.0.0.2
Feb 13 10:44:34 mxgate1 postfix/postscreen[1864]: DNSBL rank 2 for [63.80.185.166]:59037
Feb x@x
Feb 13 10:44:36 mxgate1 postfix/postscreen[1864]: DISCONNECT [63.80.185.166]:59037


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=63.80.185.166

Feb  6 21:04:18 mxgate1 postfix/postscreen[17935]: CONNECT from [63.80.185.36]:49555 to [176.31.12.44]:25
Feb  6 21:04:18 mxgate1 postfix/dnsblog[17936]: addr 63.80.185.36 listed by domain zen.spamhaus.org as 127.0.0.3
Feb  6 21:04:18 mxgate1 postfix/dnsblog[17938]: addr 63.80.185.36 listed by domain bl.spamcop.net as 127.0.0.2
Feb  6 21:04:18 mxgate1 postfix/dnsblog[17937]: addr 63.80.185.36 listed by domain ix.dnsbl.xxxxxx.net as 127.0.0.2
Feb  6 21:04:24 mxgate1 postfix/postscreen[18965]: DNSBL rank 4 for [63.80.185.36]:49555
Feb x@x
Feb  6 21:04:25 mxgate1 postfix/postscreen[18965]: DISCONNECT [63.80.185.36]:49555


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=63.80.185.36

Autoban   63.80.185.72 AUTH/CONNECT

Autoban   63.80.185.73 AUTH/CONNECT

Autoban   63.80.185.74 AUTH/CONNECT

Autoban   63.80.185.75 AUTH/CONNECT

Autoban   63.80.185.76 AUTH/CONNECT

907. On Jul 16 2020 experienced a Brute Force SSH login attempt -> 22 unique times by 211.110.1.206.

Invalid user whz from 176.31.251.177 port 33474

DATE:2020-07-16 21:42:06,IP:190.85.54.158,MATCHES:11,PORT:ssh

Jul 16 05:07:02 online-web-1 sshd[471525]: Invalid user sanjhostname from 107.191.121.124 port 47988
Jul 16 05:07:02 online-web-1 sshd[471525]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.191.121.124
Jul 16 05:07:04 online-web-1 sshd[471525]: Failed password for invalid user sanjhostname from 107.191.121.124 port 47988 ssh2
Jul 16 05:07:04 online-web-1 sshd[471525]: Received disconnect from 107.191.121.124 port 47988:11: Bye Bye [preauth]
Jul 16 05:07:04 online-web-1 sshd[471525]: Disconnected from 107.191.121.124 port 47988 [preauth]
Jul 16 05:20:06 online-web-1 sshd[473260]: Invalid user student from 107.191.121.124 port 44736
Jul 16 05:20:06 online-web-1 sshd[473260]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.191.121.124
Jul 16 05:20:08 online-web-1 sshd[473260]: Failed password for invalid user student from 107.191.121.124 port 44736 ssh2
Jul 16 05:20:08 online-web-1 ss........
-------------------------------

Jul 15 06:00:44 myvps sshd[23689]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.193.60.137 
Jul 15 06:00:46 myvps sshd[23689]: Failed password for invalid user ftpuser from 211.193.60.137 port 55288 ssh2
Jul 15 06:09:17 myvps sshd[31447]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.193.60.137 
...

921. On Jul 16 2020 experienced a Brute Force SSH login attempt -> 2 unique times by 212.129.57.201.

Jul 17 00:05:05 OPSO sshd\[30005\]: Invalid user yoyo from 46.175.21.30 port 58882
Jul 17 00:05:05 OPSO sshd\[30005\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.175.21.30
Jul 17 00:05:07 OPSO sshd\[30005\]: Failed password for invalid user yoyo from 46.175.21.30 port 58882 ssh2
Jul 17 00:09:06 OPSO sshd\[30943\]: Invalid user ms from 46.175.21.30 port 55896
Jul 17 00:09:06 OPSO sshd\[30943\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.175.21.30

Jul 16 18:09:06 mail sshd\[7721\]: Invalid user photos from 106.54.145.68
Jul 16 18:09:06 mail sshd\[7721\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.54.145.68
...

Tried sshing with brute force.

Jul 16 23:22:22 rocket sshd[22578]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.221.252.46
Jul 16 23:22:24 rocket sshd[22578]: Failed password for invalid user diana from 103.221.252.46 port 48666 ssh2
...

Connection to SSH Honeypot - Detected by HoneypotDB

Unwanted checking 80 or 443 port
...

Jul 17 00:22:00 OPSO sshd\[1937\]: Invalid user rsync from 167.71.219.169 port 33670
Jul 17 00:22:00 OPSO sshd\[1937\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.219.169
Jul 17 00:22:02 OPSO sshd\[1937\]: Failed password for invalid user rsync from 167.71.219.169 port 33670 ssh2
Jul 17 00:26:25 OPSO sshd\[2643\]: Invalid user wenyan from 167.71.219.169 port 49756
Jul 17 00:26:25 OPSO sshd\[2643\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.71.219.169

Arctic Air-1 Portable Energy Efficient Evaporation Cooling

Jul 17 00:00:34 meumeu sshd[813774]: Invalid user xyz from 51.15.242.165 port 59110
Jul 17 00:00:34 meumeu sshd[813774]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.15.242.165 
Jul 17 00:00:34 meumeu sshd[813774]: Invalid user xyz from 51.15.242.165 port 59110
Jul 17 00:00:36 meumeu sshd[813774]: Failed password for invalid user xyz from 51.15.242.165 port 59110 ssh2
Jul 17 00:04:58 meumeu sshd[814430]: Invalid user zbq from 51.15.242.165 port 47518
Jul 17 00:04:58 meumeu sshd[814430]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.15.242.165 
Jul 17 00:04:58 meumeu sshd[814430]: Invalid user zbq from 51.15.242.165 port 47518
Jul 17 00:05:00 meumeu sshd[814430]: Failed password for invalid user zbq from 51.15.242.165 port 47518 ssh2
Jul 17 00:09:06 meumeu sshd[814701]: Invalid user sharon from 51.15.242.165 port 35926
...