Did you try any of the other Abuse email addresses associated with the ASN (or their phone number)? Also, do note that according to Bluehost's website, Abuse Notifications should be sent to Newfold (*See * https://www.bluehost.com/help/article/report-tos-violation; *See also * https://www.newfold.com/abuse)
RAbuseHandle: ABUSE3581-ARIN RAbuseName: Abuse Department RAbusePhone: +1-888-401-4678 RAbuseEmail: [email protected] RAbuseRef: https://rdap.arin.net/registry/entity/ABUSE3581-ARIN OrgAbuseHandle: EIGAB1-ARIN OrgAbuseName: EIG-Abuse Mitigation OrgAbusePhone: +1-877-659-6181 OrgAbuseEmail: [email protected] OrgAbuseRef: https://rdap.arin.net/registry/entity/EIGAB1-ARIN https://bgp.he.net/AS46606#_whois On Wed, Sep 3, 2025 at 9:21 PM Ryan Hamel via NANOG <[email protected]> wrote: > The better question is, why are you not filtering SSH to a known set of > source IPs, or have it protected behind a VPN? SSH can listen on other > ports besides 22. > > Ryan Hamel > > ________________________________ > From: Rich Kulawiec via NANOG <[email protected]> > Sent: Wednesday, September 3, 2025 6:16 PM > To: [email protected] <[email protected]> > Cc: Rich Kulawiec <[email protected]> > Subject: Paging Unified Layer/AS46606 in re: NET-162-240-0-0-1 ( > 162.240.0.0/15) > > Caution: This is an external email and may be malicious. Please take care > when clicking links or opening attachments. > > > Who puts a quota on an abuse mailbox...and then allows that quote to > be reached? > > > Date: Tue, 2 Sep 2025 12:38:24 +0000 > > > > Delivery has failed to these recipients or groups: > > > > [email protected]<mailto:[email protected]> > > The recipient's mailbox is full and can't accept messages now. Please > try r= > > esending your message later, or contact the recipient directly. > > I've got nothin': my usual string of exasperated profanities has failed me. > > Anyway, y'all have attackers using various VPS instances on your network > to conduct coordinated brute-force ssh attacks, and you should make that > stop yesterday. > > Details? Logs? Yes, yes, I know, I did try to send them to you -- but > see the above for the explanation covering why you didn't receive them. > > Also: for the love of dog, fix this nonsense. > > ---rsk > _______________________________________________ > NANOG mailing list > > https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.nanog.org%2Farchives%2Flist%2Fnanog%40lists.nanog.org%2Fmessage%2F6CFCYFIP5FHUL4PBZQNOUV2SW6DNK44U%2F&data=05%7C02%7Cryan%40rkhtech.org%7Cf05604ad93864ad3683208ddeb50bcac%7C81c24bb4f9ec4739ba4d25c42594d996%7C0%7C0%7C638925454204425431%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=cqSu%2FCyWt1ABaddhNYQNDkCDwl5P55mPUPcuRgevZVc%3D&reserved=0 > < > https://lists.nanog.org/archives/list/[email protected]/message/6CFCYFIP5FHUL4PBZQNOUV2SW6DNK44U/ > > > _______________________________________________ > NANOG mailing list > > https://lists.nanog.org/archives/list/[email protected]/message/ORCF7T6IW7JE4B7WS3ZGG7B4CHFHPXTK/ > _______________________________________________ NANOG mailing list https://lists.nanog.org/archives/list/[email protected]/message/JCS3RNGHUSPG7JCUBS5GC4TKWZHSZMAG/
