18.08.2019 06:35:39 SMTP access blocked by firewall

Aug 16 00:32:10  postfix/smtpd: warning: unknown[103.207.39.21]: SASL LOGIN authentication failed

SMTP:25. Blocked 106 login attempts in 20 days.

Aug 12 11:54:39 andromeda postfix/smtpd\[25455\]: warning: unknown\[103.207.39.21\]: SASL LOGIN authentication failed: authentication failure
Aug 12 11:54:41 andromeda postfix/smtpd\[25455\]: warning: unknown\[103.207.39.21\]: SASL LOGIN authentication failed: authentication failure
Aug 12 11:54:42 andromeda postfix/smtpd\[25455\]: warning: unknown\[103.207.39.21\]: SASL LOGIN authentication failed: authentication failure
Aug 12 11:54:43 andromeda postfix/smtpd\[25455\]: warning: unknown\[103.207.39.21\]: SASL LOGIN authentication failed: authentication failure
Aug 12 11:54:45 andromeda postfix/smtpd\[25455\]: warning: unknown\[103.207.39.21\]: SASL LOGIN authentication failed: authentication failure

Aug 12 04:41:20 yabzik postfix/smtpd[5706]: warning: unknown[103.207.39.21]: SASL LOGIN authentication failed: authentication failure
Aug 12 04:41:24 yabzik postfix/smtpd[5706]: warning: unknown[103.207.39.21]: SASL LOGIN authentication failed: authentication failure
Aug 12 04:41:28 yabzik postfix/smtpd[5706]: warning: unknown[103.207.39.21]: SASL LOGIN authentication failed: authentication failure
Aug 12 04:41:31 yabzik postfix/smtpd[5706]: warning: unknown[103.207.39.21]: SASL LOGIN authentication failed: authentication failure
Aug 12 04:41:35 yabzik postfix/smtpd[5706]: warning: unknown[103.207.39.21]: SASL LOGIN authentication failed: authentication failure

smtp auth brute force

Aug 10 12:57:20 yabzik postfix/smtpd[31960]: warning: unknown[103.207.39.21]: SASL LOGIN authentication failed: authentication failure
Aug 10 12:57:24 yabzik postfix/smtpd[31960]: warning: unknown[103.207.39.21]: SASL LOGIN authentication failed: authentication failure
Aug 10 12:57:27 yabzik postfix/smtpd[31960]: warning: unknown[103.207.39.21]: SASL LOGIN authentication failed: authentication failure
Aug 10 12:57:30 yabzik postfix/smtpd[31960]: warning: unknown[103.207.39.21]: SASL LOGIN authentication failed: authentication failure
Aug 10 12:57:34 yabzik postfix/smtpd[31960]: warning: unknown[103.207.39.21]: SASL LOGIN authentication failed: authentication failure

Aug  7 00:28:03 andromeda postfix/smtpd\[55966\]: warning: unknown\[103.207.39.21\]: SASL LOGIN authentication failed: authentication failure
Aug  7 00:28:04 andromeda postfix/smtpd\[55966\]: warning: unknown\[103.207.39.21\]: SASL LOGIN authentication failed: authentication failure
Aug  7 00:28:05 andromeda postfix/smtpd\[55966\]: warning: unknown\[103.207.39.21\]: SASL LOGIN authentication failed: authentication failure
Aug  7 00:28:06 andromeda postfix/smtpd\[55966\]: warning: unknown\[103.207.39.21\]: SASL LOGIN authentication failed: authentication failure
Aug  7 00:28:08 andromeda postfix/smtpd\[55966\]: warning: unknown\[103.207.39.21\]: SASL LOGIN authentication failed: authentication failure

v+mailserver-auth-bruteforce

Aug  3 19:30:19 yabzik postfix/smtpd[25694]: warning: unknown[103.207.39.21]: SASL LOGIN authentication failed: authentication failure
Aug  3 19:30:23 yabzik postfix/smtpd[25694]: warning: unknown[103.207.39.21]: SASL LOGIN authentication failed: authentication failure
Aug  3 19:30:26 yabzik postfix/smtpd[25694]: warning: unknown[103.207.39.21]: SASL LOGIN authentication failed: authentication failure
Aug  3 19:30:29 yabzik postfix/smtpd[25694]: warning: unknown[103.207.39.21]: SASL LOGIN authentication failed: authentication failure
Aug  3 19:30:32 yabzik postfix/smtpd[25694]: warning: unknown[103.207.39.21]: SASL LOGIN authentication failed: authentication failure

2019-07-31 04:53:13 dovecot_login authenticator failed for (User) [103.207.39.21]:60905 I=[192.147.25.65]:25: 535 Incorrect authentication data (set_id=company@lerctr.org)
2019-07-31 04:53:20 dovecot_login authenticator failed for (User) [103.207.39.21]:60905 I=[192.147.25.65]:25: 535 Incorrect authentication data (set_id=company@lerctr.org)
2019-07-31 04:53:31 dovecot_login authenticator failed for (User) [103.207.39.21]:60905 I=[192.147.25.65]:25: 535 Incorrect authentication data (set_id=company@lerctr.org)
...

Try access to SMTP/POP/IMAP server.

2019-07-28T03:59:52.608550beta postfix/smtpd[18312]: warning: unknown[103.207.39.21]: SASL LOGIN authentication failed: authentication failure
2019-07-28T03:59:55.747842beta postfix/smtpd[18312]: warning: unknown[103.207.39.21]: SASL LOGIN authentication failed: authentication failure
2019-07-28T03:59:58.672743beta postfix/smtpd[18312]: warning: unknown[103.207.39.21]: SASL LOGIN authentication failed: authentication failure
...

2019-07-25T21:12:38.758234beta postfix/smtpd[14378]: warning: unknown[103.207.39.21]: SASL LOGIN authentication failed: authentication failure
2019-07-25T21:12:41.724280beta postfix/smtpd[14378]: warning: unknown[103.207.39.21]: SASL LOGIN authentication failed: authentication failure
2019-07-25T21:12:44.435675beta postfix/smtpd[14378]: warning: unknown[103.207.39.21]: SASL LOGIN authentication failed: authentication failure
...

lfd: (smtpauth) Failed SMTP AUTH login from 103.207.39.104 (VN/Vietnam/-): 5 in the last 3600 secs - Wed Aug 22 11:23:38 2018

lfd: (smtpauth) Failed SMTP AUTH login from 103.207.39.104 (VN/Vietnam/-): 5 in the last 3600 secs - Wed Aug 22 11:23:38 2018

SmallBizIT.US 1 packets to tcp(3389)

Aug  7 09:56:29 debian-2gb-nbg1-2 kernel: \[19045441.513753\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=103.207.39.19 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=238 ID=48940 PROTO=TCP SPT=45228 DPT=3406 WINDOW=1024 RES=0x00 SYN URGP=0

Jul 12 05:47:19 debian-2gb-nbg1-2 kernel: \[16784220.298741\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=103.207.39.104 DST=195.201.40.59 LEN=52 TOS=0x02 PREC=0x00 TTL=111 ID=22245 DF PROTO=TCP SPT=61578 DPT=25 WINDOW=8192 RES=0x00 CWR ECE SYN URGP=0

Jul 11 10:19:58 debian-2gb-nbg1-2 kernel: \[16714183.132684\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=103.207.39.104 DST=195.201.40.59 LEN=52 TOS=0x02 PREC=0x00 TTL=112 ID=19696 DF PROTO=TCP SPT=50580 DPT=25 WINDOW=8192 RES=0x00 CWR ECE SYN URGP=0

 TCP (SYN) 103.207.39.31:45654 -> port 3389, len 44

Jun 17 08:06:55 srv01 postfix/smtpd\[26245\]: warning: unknown\[103.207.39.104\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jun 17 08:07:02 srv01 postfix/smtpd\[26245\]: warning: unknown\[103.207.39.104\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jun 17 08:07:13 srv01 postfix/smtpd\[26245\]: warning: unknown\[103.207.39.104\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jun 17 08:07:14 srv01 postfix/smtpd\[31759\]: warning: unknown\[103.207.39.104\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jun 17 08:07:14 srv01 postfix/smtpd\[32158\]: warning: unknown\[103.207.39.104\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jun 17 08:07:14 srv01 postfix/smtpd\[32160\]: warning: unknown\[103.207.39.104\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
...

Port probing on unauthorized port 3389

May 24 12:17:56 srv01 postfix/smtpd\[2828\]: warning: unknown\[103.207.39.104\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
May 24 12:17:56 srv01 postfix/smtpd\[768\]: warning: unknown\[103.207.39.104\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
May 24 12:17:57 srv01 postfix/smtpd\[2143\]: warning: unknown\[103.207.39.104\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
May 24 12:17:59 srv01 postfix/smtpd\[2828\]: warning: unknown\[103.207.39.104\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
May 24 12:17:59 srv01 postfix/smtpd\[768\]: warning: unknown\[103.207.39.104\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
...

May 23 22:35:49 srv01 postfix/smtpd\[28626\]: warning: unknown\[103.207.39.104\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
May 23 22:35:49 srv01 postfix/smtpd\[2162\]: warning: unknown\[103.207.39.104\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
May 23 22:35:49 srv01 postfix/smtpd\[2164\]: warning: unknown\[103.207.39.104\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
May 23 22:35:52 srv01 postfix/smtpd\[28626\]: warning: unknown\[103.207.39.104\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
May 23 22:35:52 srv01 postfix/smtpd\[2162\]: warning: unknown\[103.207.39.104\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
May 23 22:35:52 srv01 postfix/smtpd\[2164\]: warning: unknown\[103.207.39.104\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
...

lfd: (smtpauth) Failed SMTP AUTH login from 103.207.39.132 (-): 5 in the last 3600 secs - Sun Jun  3 04:04:38 2018

lfd: (smtpauth) Failed SMTP AUTH login from 103.207.39.183 (-): 5 in the last 3600 secs - Thu Jun 21 13:02:08 2018

Unauthorized connection attempt from IP address 103.207.39.71 on Port 3389(RDP)

2020-04-01 06:47:47 dovecot_login authenticator failed for (User) [103.207.39.163]: 535 Incorrect authentication data (set_id=access@duckdns.org)
...

Oct 10 00:33:07 mavik sshd[20477]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.36.25.214  user=root
Oct 10 00:33:09 mavik sshd[20477]: Failed password for root from 120.36.25.214 port 21583 ssh2
Oct 10 00:35:59 mavik sshd[20585]: Invalid user radvd from 120.36.25.214
Oct 10 00:35:59 mavik sshd[20585]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.36.25.214
Oct 10 00:36:01 mavik sshd[20585]: Failed password for invalid user radvd from 120.36.25.214 port 24570 ssh2
...

Oct 10 18:16:09 theomazars sshd[31339]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.30.112  user=root
Oct 10 18:16:11 theomazars sshd[31339]: Failed password for root from 222.186.30.112 port 10656 ssh2

$f2bV_matches

Sep 24 02:18:12 *hidden* postfix/postscreen[32624]: DNSBL rank 3 for [192.35.168.219]:56588

Invalid user rr from 139.59.159.0 port 57936

5x Failed Password

php WP PHPmyadamin ABUSE blocked for 12h

Oct 10 17:26:44 s1 sshd\[4827\]: Invalid user test from 41.216.181.3 port 37022
Oct 10 17:26:44 s1 sshd\[4827\]: Failed password for invalid user test from 41.216.181.3 port 37022 ssh2
Oct 10 17:34:23 s1 sshd\[6209\]: User root from 41.216.181.3 not allowed because not listed in AllowUsers
Oct 10 17:34:23 s1 sshd\[6209\]: Failed password for invalid user root from 41.216.181.3 port 43656 ssh2
Oct 10 17:42:19 s1 sshd\[8575\]: User root from 41.216.181.3 not allowed because not listed in AllowUsers
Oct 10 17:42:19 s1 sshd\[8575\]: Failed password for invalid user root from 41.216.181.3 port 50290 ssh2
...

1602276461 - 10/09/2020 22:47:41 Host: 201.108.15.222/201.108.15.222 Port: 445 TCP Blocked

Lines containing failures of 64.227.24.186 (max 1000)
Oct  6 23:08:56 Tosca sshd[2078667]: User r.r from 64.227.24.186 not allowed because none of user's groups are listed in AllowGroups
Oct  6 23:08:56 Tosca sshd[2078667]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.24.186  user=r.r
Oct  6 23:08:58 Tosca sshd[2078667]: Failed password for invalid user r.r from 64.227.24.186 port 40416 ssh2
Oct  6 23:08:59 Tosca sshd[2078667]: Received disconnect from 64.227.24.186 port 40416:11: Bye Bye [preauth]
Oct  6 23:08:59 Tosca sshd[2078667]: Disconnected from invalid user r.r 64.227.24.186 port 40416 [preauth]
Oct  6 23:24:37 Tosca sshd[2093797]: User r.r from 64.227.24.186 not allowed because none of user's groups are listed in AllowGroups
Oct  6 23:24:37 Tosca sshd[2093797]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.24.186  user=r.r
Oct  6 23:24:40 Tosca sshd[2093797]: Faile........
------------------------------

Port probing on unauthorized port 23

Lines containing failures of 117.192.225.203
Oct  9 22:44:50 kopano sshd[7427]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.192.225.203  user=r.r
Oct  9 22:44:52 kopano sshd[7427]: Failed password for r.r from 117.192.225.203 port 57126 ssh2
Oct  9 22:44:52 kopano sshd[7427]: Received disconnect from 117.192.225.203 port 57126:11: Bye Bye [preauth]
Oct  9 22:44:52 kopano sshd[7427]: Disconnected from authenticating user r.r 117.192.225.203 port 57126 [preauth]
Oct  9 23:02:50 kopano sshd[8052]: Invalid user test123 from 117.192.225.203 port 54302
Oct  9 23:02:50 kopano sshd[8052]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.192.225.203
Oct  9 23:02:51 kopano sshd[8052]: Failed password for invalid user test123 from 117.192.225.203 port 54302 ssh2
Oct  9 23:02:52 kopano sshd[8052]: Received disconnect from 117.192.225.203 port 54302:11: Bye Bye [preauth]
Oct  9 23:02:52 kopano ........
------------------------------

Oct 8 03:08:05 *hidden* sshd[13356]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.224.172.230 Oct 8 03:08:07 *hidden* sshd[13356]: Failed password for invalid user osmc from 81.224.172.230 port 33416 ssh2 Oct 8 19:04:58 *hidden* sshd[10103]: Invalid user osmc from 81.224.172.230 port 41548

2020-10-09 15:46:28.207311-0500  localhost smtpd[23498]: NOQUEUE: reject: RCPT from unknown[208.186.113.144]: 450 4.7.25 Client host rejected: cannot find your hostname, [208.186.113.144]; from= to= proto=ESMTP helo=

(sshd) Failed SSH login from 95.84.134.5 (RU/Russia/broadband-95-84-134-5.ip.moscow.rt.ru): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Oct 10 11:08:12 optimus sshd[29498]: Invalid user abcd from 95.84.134.5
Oct 10 11:08:14 optimus sshd[29498]: Failed password for invalid user abcd from 95.84.134.5 port 60134 ssh2
Oct 10 11:18:40 optimus sshd[453]: Failed password for root from 95.84.134.5 port 47960 ssh2
Oct 10 11:22:25 optimus sshd[1583]: Failed password for root from 95.84.134.5 port 53908 ssh2
Oct 10 11:26:00 optimus sshd[2958]: Invalid user user1 from 95.84.134.5