(smtpauth) Failed SMTP AUTH login from 191.53.236.131 (BR/Brazil/191-53-236-131.ptu-wr.mastercabo.com.br): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 2020-06-29 08:21:51 plain authenticator failed for ([191.53.236.131]) [191.53.236.131]: 535 Incorrect authentication data (set_id=marketin)

Brute force attempt

Brute force attempt

Brute force attempt

Aug 16 05:43:45 mail.srvfarm.net postfix/smtps/smtpd[1888819]: warning: unknown[191.53.236.198]: SASL PLAIN authentication failed: 
Aug 16 05:43:45 mail.srvfarm.net postfix/smtps/smtpd[1888819]: lost connection after AUTH from unknown[191.53.236.198]
Aug 16 05:50:12 mail.srvfarm.net postfix/smtps/smtpd[1909603]: warning: unknown[191.53.236.198]: SASL PLAIN authentication failed: 
Aug 16 05:50:13 mail.srvfarm.net postfix/smtps/smtpd[1909603]: lost connection after AUTH from unknown[191.53.236.198]
Aug 16 05:51:25 mail.srvfarm.net postfix/smtps/smtpd[1910221]: warning: unknown[191.53.236.198]: SASL PLAIN authentication failed:

Jul 24 10:57:05 mail.srvfarm.net postfix/smtps/smtpd[2184213]: warning: unknown[191.53.236.123]: SASL PLAIN authentication failed: 
Jul 24 10:57:06 mail.srvfarm.net postfix/smtps/smtpd[2184213]: lost connection after AUTH from unknown[191.53.236.123]
Jul 24 10:57:33 mail.srvfarm.net postfix/smtpd[2189961]: warning: unknown[191.53.236.123]: SASL PLAIN authentication failed: 
Jul 24 10:57:34 mail.srvfarm.net postfix/smtpd[2189961]: lost connection after AUTH from unknown[191.53.236.123]
Jul 24 11:04:12 mail.srvfarm.net postfix/smtpd[2185298]: warning: unknown[191.53.236.123]: SASL PLAIN authentication failed:

SASL PLAIN auth failed: ruser=...

SASL PLAIN auth failed: ruser=...

Jul 16 05:08:01 mail.srvfarm.net postfix/smtps/smtpd[684471]: warning: unknown[191.53.236.188]: SASL PLAIN authentication failed: 
Jul 16 05:08:02 mail.srvfarm.net postfix/smtps/smtpd[684471]: lost connection after AUTH from unknown[191.53.236.188]
Jul 16 05:10:41 mail.srvfarm.net postfix/smtpd[699497]: warning: unknown[191.53.236.188]: SASL PLAIN authentication failed: 
Jul 16 05:10:41 mail.srvfarm.net postfix/smtpd[699497]: lost connection after AUTH from unknown[191.53.236.188]
Jul 16 05:17:11 mail.srvfarm.net postfix/smtpd[699498]: warning: unknown[191.53.236.188]: SASL PLAIN authentication failed:

(smtpauth) Failed SMTP AUTH login from 191.53.236.203 (BR/Brazil/191-53-236-203.ptu-wr.mastercabo.com.br): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 2020-07-05 08:26:06 plain authenticator failed for ([191.53.236.203]) [191.53.236.203]: 535 Incorrect authentication data (set_id=h.sabet)

failed_logins

Jun 18 11:22:56 mail.srvfarm.net postfix/smtpd[1425131]: warning: unknown[191.53.236.145]: SASL PLAIN authentication failed: 
Jun 18 11:22:57 mail.srvfarm.net postfix/smtpd[1425131]: lost connection after AUTH from unknown[191.53.236.145]
Jun 18 11:31:14 mail.srvfarm.net postfix/smtps/smtpd[1421524]: warning: unknown[191.53.236.145]: SASL PLAIN authentication failed: 
Jun 18 11:31:14 mail.srvfarm.net postfix/smtps/smtpd[1421524]: lost connection after AUTH from unknown[191.53.236.145]
Jun 18 11:31:40 mail.srvfarm.net postfix/smtps/smtpd[1421524]: warning: unknown[191.53.236.145]: SASL PLAIN authentication failed:

Jun 18 13:55:40 mail.srvfarm.net postfix/smtps/smtpd[1472466]: warning: unknown[191.53.236.111]: SASL PLAIN authentication failed: 
Jun 18 13:55:41 mail.srvfarm.net postfix/smtps/smtpd[1472466]: lost connection after AUTH from unknown[191.53.236.111]
Jun 18 13:57:21 mail.srvfarm.net postfix/smtps/smtpd[1472487]: warning: unknown[191.53.236.111]: SASL PLAIN authentication failed: 
Jun 18 13:57:22 mail.srvfarm.net postfix/smtps/smtpd[1472487]: lost connection after AUTH from unknown[191.53.236.111]
Jun 18 14:01:22 mail.srvfarm.net postfix/smtps/smtpd[1472462]: warning: unknown[191.53.236.111]: SASL PLAIN authentication failed:

Jun  8 05:32:34 mail.srvfarm.net postfix/smtps/smtpd[671666]: warning: unknown[191.53.236.94]: SASL PLAIN authentication failed: 
Jun  8 05:32:35 mail.srvfarm.net postfix/smtps/smtpd[671666]: lost connection after AUTH from unknown[191.53.236.94]
Jun  8 05:36:08 mail.srvfarm.net postfix/smtps/smtpd[672461]: warning: unknown[191.53.236.94]: SASL PLAIN authentication failed: 
Jun  8 05:36:08 mail.srvfarm.net postfix/smtps/smtpd[672461]: lost connection after AUTH from unknown[191.53.236.94]
Jun  8 05:39:20 mail.srvfarm.net postfix/smtps/smtpd[673571]: lost connection after CONNECT from unknown[191.53.236.94]

Jun  5 17:54:25 mail.srvfarm.net postfix/smtpd[3159446]: warning: unknown[191.53.236.141]: SASL PLAIN authentication failed: 
Jun  5 17:54:25 mail.srvfarm.net postfix/smtpd[3159446]: lost connection after AUTH from unknown[191.53.236.141]
Jun  5 17:59:19 mail.srvfarm.net postfix/smtps/smtpd[3160258]: warning: unknown[191.53.236.141]: SASL PLAIN authentication failed: 
Jun  5 17:59:20 mail.srvfarm.net postfix/smtps/smtpd[3160258]: lost connection after AUTH from unknown[191.53.236.141]
Jun  5 18:00:53 mail.srvfarm.net postfix/smtps/smtpd[3160263]: warning: unknown[191.53.236.141]: SASL PLAIN authentication failed:

Sep  5 20:47:46 tamoto postfix/smtpd[12123]: warning: hostname 191-53-236-123.ptu-wr.mastercabo.com.br does not resolve to address 191.53.236.123: Name or service not known
Sep  5 20:47:46 tamoto postfix/smtpd[12123]: connect from unknown[191.53.236.123]
Sep  5 20:47:50 tamoto postfix/smtpd[12123]: warning: unknown[191.53.236.123]: SASL CRAM-MD5 authentication failed: authentication failure
Sep  5 20:47:51 tamoto postfix/smtpd[12123]: warning: unknown[191.53.236.123]: SASL PLAIN authentication failed: authentication failure
Sep  5 20:47:52 tamoto postfix/smtpd[12123]: warning: unknown[191.53.236.123]: SASL LOGIN authentication failed: authentication failure


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=191.53.236.123

Automatic report - Banned IP Access

Sep  6 18:01:34 pve1 sshd[28823]: Failed password for root from 62.210.122.172 port 51410 ssh2
...

(Sep  6)  LEN=40 TTL=52 ID=24053 TCP DPT=8080 WINDOW=33194 SYN 
 (Sep  6)  LEN=40 TTL=52 ID=48162 TCP DPT=8080 WINDOW=62658 SYN 
 (Sep  6)  LEN=40 TTL=52 ID=56313 TCP DPT=8080 WINDOW=33194 SYN 
 (Sep  6)  LEN=40 TTL=52 ID=30100 TCP DPT=8080 WINDOW=33194 SYN 
 (Sep  5)  LEN=40 TTL=52 ID=54871 TCP DPT=8080 WINDOW=19298 SYN 
 (Sep  5)  LEN=40 TTL=52 ID=54780 TCP DPT=8080 WINDOW=62658 SYN 
 (Sep  5)  LEN=40 TTL=52 ID=34904 TCP DPT=8080 WINDOW=23154 SYN 
 (Sep  5)  LEN=40 TTL=52 ID=21240 TCP DPT=8080 WINDOW=62658 SYN 
 (Sep  4)  LEN=40 TTL=52 ID=32959 TCP DPT=8080 WINDOW=19298 SYN 
 (Sep  4)  LEN=40 TTL=52 ID=35175 TCP DPT=8080 WINDOW=33194 SYN 
 (Sep  3)  LEN=40 TTL=52 ID=63072 TCP DPT=8080 WINDOW=62658 SYN 
 (Sep  2)  LEN=40 TTL=52 ID=35375 TCP DPT=8080 WINDOW=23154 SYN 
 (Sep  1)  LEN=40 TTL=52 ID=54708 TCP DPT=8080 WINDOW=19298 SYN 
 (Sep  1)  LEN=40 TTL=52 ID=1473 TCP DPT=8080 WINDOW=23154 SYN 
 (Sep  1)  LEN=40 TTL=52 ID=34190 TCP DPT=8080 WINDOW=33194 SYN 
 (Sep  1)  LEN=40 TTL=52 I...

Sep  6 18:15:47 baraca dovecot: auth-worker(31271): passwd(printer@united.net.ua,212.70.149.68): unknown user
Sep  6 18:16:12 baraca dovecot: auth-worker(31271): passwd(primary@united.net.ua,212.70.149.68): unknown user
Sep  6 18:17:54 baraca dovecot: auth-worker(31285): passwd(primary@united.net.ua,212.70.149.68): unknown user
Sep  6 18:18:19 baraca dovecot: auth-worker(31285): passwd(plm@united.net.ua,212.70.149.68): unknown user
Sep  6 19:19:13 baraca dovecot: auth-worker(35608): passwd(msw@united.net.ua,212.70.149.68): unknown user
Sep  6 19:20:56 baraca dovecot: auth-worker(35608): passwd(msw@united.net.ua,212.70.149.68): unknown user
...

2020-08-31 x@x


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=124.239.56.230

2020-09-05 11:35:24.271975-0500  localhost smtpd[41784]: NOQUEUE: reject: RCPT from bzq-77-168-31-217.red.bezeqint.net[31.168.77.217]: 554 5.7.1 Service unavailable; Client host [31.168.77.217] blocked using zen.spamhaus.org; https://www.spamhaus.org/query/ip/31.168.77.217; from= to= proto=ESMTP helo=

Merda

Sep  6 15:23:27 localhost sshd[32947]: Invalid user deok from 165.22.77.163 port 51596
Sep  6 15:23:27 localhost sshd[32947]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.77.163
Sep  6 15:23:27 localhost sshd[32947]: Invalid user deok from 165.22.77.163 port 51596
Sep  6 15:23:29 localhost sshd[32947]: Failed password for invalid user deok from 165.22.77.163 port 51596 ssh2
Sep  6 15:28:25 localhost sshd[33308]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.77.163  user=root
Sep  6 15:28:27 localhost sshd[33308]: Failed password for root from 165.22.77.163 port 55568 ssh2
...

Aug 31 14:59:14 our-server-hostname postfix/smtpd[30984]: connect from unknown[123.14.93.226]
Aug 31 14:59:16 our-server-hostname postfix/smtpd[30984]: NOQUEUE: reject: RCPT from unknown[123.14.93.226]: 504 5.5.2 : Helo command rejected: need fully-qualified hostname; from=x@x helo=
Aug 31 14:59:16 our-server-hostname postfix/smtpd[30984]: disconnect from unknown[123.14.93.226]
Aug 31 14:59:16 our-server-hostname postfix/smtpd[31359]: connect from unknown[123.14.93.226]
Aug 31 14:59:18 our-server-hostname postfix/smtpd[31359]: NOQUEUE: reject: RCPT from unknown[123.14.93.226]: 504 5.5.2 : Helo command rejected: need fully-qualified hostname; from=x@x helo=
Aug 31 14:59:18 our-server-hostname postfix/smtpd[31359]: disconnect from unknown[123.14.93.226]
Aug 31 15:00:21 our-server-hostname postfix/smtpd[755]: connect from unknown[123.14.93.226]
Aug 31 15:00:22 our-server-hostname postfix/smtpd[755]: NOQUEUE: reject: RCPT from unknown[123.14.........
-------------------------------

Sep  6 14:30:54 saturn sshd[279790]: Failed password for invalid user debian-spamd from 124.128.158.37 port 29121 ssh2
Sep  6 14:37:46 saturn sshd[280047]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=124.128.158.37  user=root
Sep  6 14:37:49 saturn sshd[280047]: Failed password for root from 124.128.158.37 port 29122 ssh2
...

Lines containing failures of 60.52.69.27
Aug 31 00:42:49 newdogma sshd[16619]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=60.52.69.27  user=r.r
Aug 31 00:42:51 newdogma sshd[16619]: Failed password for r.r from 60.52.69.27 port 29501 ssh2
Aug 31 00:42:56 newdogma sshd[16619]: Received disconnect from 60.52.69.27 port 29501:11: Bye Bye [preauth]
Aug 31 00:42:56 newdogma sshd[16619]: Disconnected from authenticating user r.r 60.52.69.27 port 29501 [preauth]
Aug 31 01:05:24 newdogma sshd[23386]: Connection reset by 60.52.69.27 port 21209 [preauth]
Aug 31 01:08:49 newdogma sshd[24205]: Connection closed by 60.52.69.27 port 29491 [preauth]
Aug 31 01:12:18 newdogma sshd[24937]: Invalid user francois from 60.52.69.27 port 50588
Aug 31 01:12:18 newdogma sshd[24937]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=60.52.69.27 
Aug 31 01:12:20 newdogma sshd[24937]: Failed password for invalid user........
------------------------------

Icarus honeypot on github

Failed password for invalid user greg from 122.51.108.64 port 59396 ssh2

Port probing on unauthorized port 445

2020-09-05 09:34:19 server smtpd[51828]: warning: unknown[103.133.105.65]:54685: SASL LOGIN authentication failed: Invalid authentication mechanism