Attempted Brute Force (dovecot)

Aug 30 07:47:56 mail.srvfarm.net postfix/smtps/smtpd[3605554]: warning: unknown[186.216.68.183]: SASL PLAIN authentication failed: 
Aug 30 07:47:57 mail.srvfarm.net postfix/smtps/smtpd[3605554]: lost connection after AUTH from unknown[186.216.68.183]
Aug 30 07:48:43 mail.srvfarm.net postfix/smtpd[3603899]: warning: unknown[186.216.68.183]: SASL PLAIN authentication failed: 
Aug 30 07:48:44 mail.srvfarm.net postfix/smtpd[3603899]: lost connection after AUTH from unknown[186.216.68.183]
Aug 30 07:51:40 mail.srvfarm.net postfix/smtps/smtpd[3603756]: warning: unknown[186.216.68.183]: SASL PLAIN authentication failed:

Aug 30 07:47:56 mail.srvfarm.net postfix/smtps/smtpd[3605554]: warning: unknown[186.216.68.183]: SASL PLAIN authentication failed: 
Aug 30 07:47:57 mail.srvfarm.net postfix/smtps/smtpd[3605554]: lost connection after AUTH from unknown[186.216.68.183]
Aug 30 07:48:43 mail.srvfarm.net postfix/smtpd[3603899]: warning: unknown[186.216.68.183]: SASL PLAIN authentication failed: 
Aug 30 07:48:44 mail.srvfarm.net postfix/smtpd[3603899]: lost connection after AUTH from unknown[186.216.68.183]
Aug 30 07:51:40 mail.srvfarm.net postfix/smtps/smtpd[3603756]: warning: unknown[186.216.68.183]: SASL PLAIN authentication failed:

failed_logins

Aug 27 04:33:42 mail.srvfarm.net postfix/smtps/smtpd[1331222]: warning: unknown[186.216.68.222]: SASL PLAIN authentication failed: 
Aug 27 04:33:43 mail.srvfarm.net postfix/smtps/smtpd[1331222]: lost connection after AUTH from unknown[186.216.68.222]
Aug 27 04:37:40 mail.srvfarm.net postfix/smtps/smtpd[1314660]: warning: unknown[186.216.68.222]: SASL PLAIN authentication failed: 
Aug 27 04:37:40 mail.srvfarm.net postfix/smtps/smtpd[1314660]: lost connection after AUTH from unknown[186.216.68.222]
Aug 27 04:40:50 mail.srvfarm.net postfix/smtps/smtpd[1335343]: warning: unknown[186.216.68.222]: SASL PLAIN authentication failed:

Aug 27 04:55:26 mail.srvfarm.net postfix/smtps/smtpd[1335344]: warning: unknown[186.216.68.156]: SASL PLAIN authentication failed: 
Aug 27 04:55:27 mail.srvfarm.net postfix/smtps/smtpd[1335344]: lost connection after AUTH from unknown[186.216.68.156]
Aug 27 04:58:56 mail.srvfarm.net postfix/smtpd[1336010]: warning: unknown[186.216.68.156]: SASL PLAIN authentication failed: 
Aug 27 04:58:57 mail.srvfarm.net postfix/smtpd[1336010]: lost connection after AUTH from unknown[186.216.68.156]
Aug 27 05:04:12 mail.srvfarm.net postfix/smtpd[1341948]: warning: unknown[186.216.68.156]: SASL PLAIN authentication failed:

Aug 17 05:30:57 mail.srvfarm.net postfix/smtps/smtpd[2599208]: warning: unknown[186.216.68.162]: SASL PLAIN authentication failed: 
Aug 17 05:30:57 mail.srvfarm.net postfix/smtps/smtpd[2599208]: lost connection after AUTH from unknown[186.216.68.162]
Aug 17 05:39:39 mail.srvfarm.net postfix/smtps/smtpd[2601414]: warning: unknown[186.216.68.162]: SASL PLAIN authentication failed: 
Aug 17 05:39:39 mail.srvfarm.net postfix/smtps/smtpd[2601414]: lost connection after AUTH from unknown[186.216.68.162]
Aug 17 05:39:54 mail.srvfarm.net postfix/smtps/smtpd[2602315]: warning: unknown[186.216.68.162]: SASL PLAIN authentication failed:

Aug 15 02:33:35 mail.srvfarm.net postfix/smtpd[966773]: warning: unknown[186.216.68.192]: SASL PLAIN authentication failed: 
Aug 15 02:33:36 mail.srvfarm.net postfix/smtpd[966773]: lost connection after AUTH from unknown[186.216.68.192]
Aug 15 02:34:18 mail.srvfarm.net postfix/smtps/smtpd[963401]: warning: unknown[186.216.68.192]: SASL PLAIN authentication failed: 
Aug 15 02:34:19 mail.srvfarm.net postfix/smtps/smtpd[963401]: lost connection after AUTH from unknown[186.216.68.192]
Aug 15 02:37:51 mail.srvfarm.net postfix/smtps/smtpd[969052]: warning: unknown[186.216.68.192]: SASL PLAIN authentication failed:

Jul 25 04:59:28 mail.srvfarm.net postfix/smtps/smtpd[352431]: warning: unknown[186.216.68.130]: SASL PLAIN authentication failed: 
Jul 25 04:59:29 mail.srvfarm.net postfix/smtps/smtpd[352431]: lost connection after AUTH from unknown[186.216.68.130]
Jul 25 05:08:26 mail.srvfarm.net postfix/smtps/smtpd[365292]: warning: unknown[186.216.68.130]: SASL PLAIN authentication failed: 
Jul 25 05:08:26 mail.srvfarm.net postfix/smtps/smtpd[365292]: lost connection after AUTH from unknown[186.216.68.130]
Jul 25 05:09:21 mail.srvfarm.net postfix/smtps/smtpd[365718]: lost connection after CONNECT from unknown[186.216.68.130]

Jul 24 09:46:07 mail.srvfarm.net postfix/smtps/smtpd[2158496]: warning: unknown[186.216.68.149]: SASL PLAIN authentication failed: 
Jul 24 09:46:07 mail.srvfarm.net postfix/smtps/smtpd[2158496]: lost connection after AUTH from unknown[186.216.68.149]
Jul 24 09:50:50 mail.srvfarm.net postfix/smtps/smtpd[2161003]: warning: unknown[186.216.68.149]: SASL PLAIN authentication failed: 
Jul 24 09:50:50 mail.srvfarm.net postfix/smtps/smtpd[2161003]: lost connection after AUTH from unknown[186.216.68.149]
Jul 24 09:51:17 mail.srvfarm.net postfix/smtps/smtpd[2164483]: warning: unknown[186.216.68.149]: SASL PLAIN authentication failed:

SASL PLAIN auth failed: ruser=...

2020-07-07 16:26:48 plain_virtual_exim authenticator failed for ([186.216.68.197]) [186.216.68.197]: 535 Incorrect authentication data


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=186.216.68.197

(smtpauth) Failed SMTP AUTH login from 186.216.68.203 (BR/Brazil/186-216-68-203.uni-wr.mastercabo.com.br): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 2020-06-29 15:38:03 plain authenticator failed for ([186.216.68.203]) [186.216.68.203]: 535 Incorrect authentication data (set_id=info@kooshanetesal.com)

Brute force attack to crack SMTP password (port 25 / 587)

Jun 16 05:07:22 mail.srvfarm.net postfix/smtps/smtpd[917496]: warning: unknown[186.216.68.85]: SASL PLAIN authentication failed: 
Jun 16 05:07:23 mail.srvfarm.net postfix/smtps/smtpd[917496]: lost connection after AUTH from unknown[186.216.68.85]
Jun 16 05:08:17 mail.srvfarm.net postfix/smtps/smtpd[915906]: lost connection after CONNECT from unknown[186.216.68.85]
Jun 16 05:13:52 mail.srvfarm.net postfix/smtps/smtpd[935106]: warning: unknown[186.216.68.85]: SASL PLAIN authentication failed: 
Jun 16 05:13:53 mail.srvfarm.net postfix/smtps/smtpd[935106]: lost connection after AUTH from unknown[186.216.68.85]

166.62.80.165 - - [11/Jul/2020:21:06:34 +0100] "POST /wp-login.php HTTP/1.1" 200 2178 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
166.62.80.165 - - [11/Jul/2020:21:06:36 +0100] "POST /wp-login.php HTTP/1.1" 200 2154 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
166.62.80.165 - - [11/Jul/2020:21:06:36 +0100] "POST /xmlrpc.php HTTP/1.1" 403 219 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
...

Brute force attempt

Unauthorised access (Jul 11) SRC=2.63.82.236 LEN=52 PREC=0x20 TTL=116 ID=18475 DF TCP DPT=445 WINDOW=8192 SYN

2020-07-11T21:37:11.464110mail.csmailer.org sshd[15460]: Invalid user hc from 180.76.172.55 port 55834
2020-07-11T21:37:11.470660mail.csmailer.org sshd[15460]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.172.55
2020-07-11T21:37:11.464110mail.csmailer.org sshd[15460]: Invalid user hc from 180.76.172.55 port 55834
2020-07-11T21:37:13.271828mail.csmailer.org sshd[15460]: Failed password for invalid user hc from 180.76.172.55 port 55834 ssh2
2020-07-11T21:38:29.668775mail.csmailer.org sshd[15532]: Invalid user ts from 180.76.172.55 port 48344
...

Jul 12 00:05:29 srv01 postfix/smtpd\[15102\]: warning: unknown\[185.143.73.58\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jul 12 00:06:12 srv01 postfix/smtpd\[15102\]: warning: unknown\[185.143.73.58\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jul 12 00:06:55 srv01 postfix/smtpd\[8335\]: warning: unknown\[185.143.73.58\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jul 12 00:07:37 srv01 postfix/smtpd\[14116\]: warning: unknown\[185.143.73.58\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jul 12 00:08:15 srv01 postfix/smtpd\[2116\]: warning: unknown\[185.143.73.58\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
...

Jul 10 22:37:36 atl4 postfix/smtpd[7440]: warning: unknown[46.38.150.142]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jul 10 22:39:12 atl4 postfix/smtpd[7440]: warning: unknown[46.38.150.142]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jul 10 22:40:43 atl4 postfix/smtpd[7440]: warning: unknown[46.38.150.142]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jul 10 22:42:12 atl4 postfix/smtpd[7440]: warning: unknown[46.38.150.142]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jul 10 22:43:36 atl4 postfix/smtpd[7440]: warning: unknown[46.38.150.142]: SASL LOGIN authentication failed: UGFzc3dvcmQ6

2020-07-11T20:58:52.610740abusebot-5.cloudsearch.cf sshd[20672]: Invalid user messagebus from 106.13.145.44 port 50696
2020-07-11T20:58:52.617398abusebot-5.cloudsearch.cf sshd[20672]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.145.44
2020-07-11T20:58:52.610740abusebot-5.cloudsearch.cf sshd[20672]: Invalid user messagebus from 106.13.145.44 port 50696
2020-07-11T20:58:54.474859abusebot-5.cloudsearch.cf sshd[20672]: Failed password for invalid user messagebus from 106.13.145.44 port 50696 ssh2
2020-07-11T21:01:39.905365abusebot-5.cloudsearch.cf sshd[20741]: Invalid user srvadmin from 106.13.145.44 port 47296
2020-07-11T21:01:39.910988abusebot-5.cloudsearch.cf sshd[20741]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.145.44
2020-07-11T21:01:39.905365abusebot-5.cloudsearch.cf sshd[20741]: Invalid user srvadmin from 106.13.145.44 port 47296
2020-07-11T21:01:41.693383abusebot-5.cloudsearch.c
...

Automated report (2020-07-12T04:06:19+08:00). Faked user agent detected.

Jul 11 21:52:11 rush sshd[14189]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.114.98.96
Jul 11 21:52:13 rush sshd[14189]: Failed password for invalid user fangbz from 167.114.98.96 port 50620 ssh2
Jul 11 21:55:31 rush sshd[14323]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.114.98.96
...

Automatic report - Port Scan Attack

Invalid user sunsheng from 181.209.87.50 port 49502

SSH Invalid Login

Jul 11 23:11:03 server sshd[10880]: Failed password for invalid user logger from 163.172.232.201 port 43858 ssh2
Jul 11 23:14:08 server sshd[14241]: Failed password for invalid user trudy from 163.172.232.201 port 41122 ssh2
Jul 11 23:17:18 server sshd[17439]: Failed password for invalid user sunyufei from 163.172.232.201 port 38418 ssh2

(imapd) Failed IMAP login from 14.160.39.26 (VN/Vietnam/static.vnpt.vn): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Jul 12 00:36:05 ir1 dovecot[2885757]: imap-login: Disconnected (auth failed, 1 attempts in 5 secs): user=, method=PLAIN, rip=14.160.39.26, lip=5.63.12.44, TLS, session=

536. On Jul 11 2020 experienced a Brute Force SSH login attempt -> 1 unique times by 208.109.14.122.