Unauthorized SMTP/IMAP/POP3 connection attempt

Sep 14 18:36:40 mail.srvfarm.net postfix/smtpd[2073486]: warning: unknown[200.66.125.8]: SASL PLAIN authentication failed: 
Sep 14 18:36:41 mail.srvfarm.net postfix/smtpd[2073486]: lost connection after AUTH from unknown[200.66.125.8]
Sep 14 18:39:39 mail.srvfarm.net postfix/smtps/smtpd[2073815]: warning: unknown[200.66.125.8]: SASL PLAIN authentication failed: 
Sep 14 18:39:39 mail.srvfarm.net postfix/smtps/smtpd[2073815]: lost connection after AUTH from unknown[200.66.125.8]
Sep 14 18:44:56 mail.srvfarm.net postfix/smtpd[2073290]: warning: unknown[200.66.125.8]: SASL PLAIN authentication failed:

$f2bV_matches

Aug 12 05:04:57 mail.srvfarm.net postfix/smtpd[2849282]: warning: unknown[200.66.115.10]: SASL PLAIN authentication failed: 
Aug 12 05:04:57 mail.srvfarm.net postfix/smtpd[2849282]: lost connection after AUTH from unknown[200.66.115.10]
Aug 12 05:06:04 mail.srvfarm.net postfix/smtps/smtpd[2853371]: warning: unknown[200.66.115.10]: SASL PLAIN authentication failed: 
Aug 12 05:06:05 mail.srvfarm.net postfix/smtps/smtpd[2853371]: lost connection after AUTH from unknown[200.66.115.10]
Aug 12 05:10:40 mail.srvfarm.net postfix/smtpd[2849280]: warning: unknown[200.66.115.10]: SASL PLAIN authentication failed:

(smtpauth) Failed SMTP AUTH login from 200.66.113.120 (BR/Brazil/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 2020-07-30 00:56:59 plain authenticator failed for ([200.66.113.120]) [200.66.113.120]: 535 Incorrect authentication data (set_id=info@raei-co.com)

Jul 25 05:40:45 mail.srvfarm.net postfix/smtps/smtpd[352443]: warning: unknown[200.66.115.212]: SASL PLAIN authentication failed: 
Jul 25 05:40:46 mail.srvfarm.net postfix/smtps/smtpd[352443]: lost connection after AUTH from unknown[200.66.115.212]
Jul 25 05:47:06 mail.srvfarm.net postfix/smtps/smtpd[368189]: warning: unknown[200.66.115.212]: SASL PLAIN authentication failed: 
Jul 25 05:47:06 mail.srvfarm.net postfix/smtps/smtpd[368189]: lost connection after AUTH from unknown[200.66.115.212]
Jul 25 05:47:44 mail.srvfarm.net postfix/smtps/smtpd[367696]: warning: unknown[200.66.115.212]: SASL PLAIN authentication failed:

Jul 24 07:47:24 mail.srvfarm.net postfix/smtps/smtpd[2116868]: warning: unknown[200.66.117.224]: SASL PLAIN authentication failed: 
Jul 24 07:47:25 mail.srvfarm.net postfix/smtps/smtpd[2116868]: lost connection after AUTH from unknown[200.66.117.224]
Jul 24 07:47:33 mail.srvfarm.net postfix/smtps/smtpd[2116832]: warning: unknown[200.66.117.224]: SASL PLAIN authentication failed: 
Jul 24 07:47:34 mail.srvfarm.net postfix/smtps/smtpd[2116832]: lost connection after AUTH from unknown[200.66.117.224]
Jul 24 07:53:42 mail.srvfarm.net postfix/smtpd[2115628]: warning: unknown[200.66.117.224]: SASL PLAIN authentication failed:

Jul 24 11:01:16 mail.srvfarm.net postfix/smtps/smtpd[2191178]: warning: unknown[200.66.115.195]: SASL PLAIN authentication failed: 
Jul 24 11:01:16 mail.srvfarm.net postfix/smtps/smtpd[2191178]: lost connection after AUTH from unknown[200.66.115.195]
Jul 24 11:04:09 mail.srvfarm.net postfix/smtps/smtpd[2191177]: warning: unknown[200.66.115.195]: SASL PLAIN authentication failed: 
Jul 24 11:04:09 mail.srvfarm.net postfix/smtps/smtpd[2191177]: lost connection after AUTH from unknown[200.66.115.195]
Jul 24 11:10:57 mail.srvfarm.net postfix/smtps/smtpd[2188735]: warning: unknown[200.66.115.195]: SASL PLAIN authentication failed:

Jul 24 12:27:58 mail.srvfarm.net postfix/smtpd[2217477]: warning: unknown[200.66.117.134]: SASL PLAIN authentication failed: 
Jul 24 12:27:58 mail.srvfarm.net postfix/smtpd[2217477]: lost connection after AUTH from unknown[200.66.117.134]
Jul 24 12:35:26 mail.srvfarm.net postfix/smtps/smtpd[2233237]: warning: unknown[200.66.117.134]: SASL PLAIN authentication failed: 
Jul 24 12:35:27 mail.srvfarm.net postfix/smtps/smtpd[2233237]: lost connection after AUTH from unknown[200.66.117.134]
Jul 24 12:35:32 mail.srvfarm.net postfix/smtps/smtpd[2233107]: warning: unknown[200.66.117.134]: SASL PLAIN authentication failed:

SASL PLAIN auth failed: ruser=...

SASL PLAIN auth failed: ruser=...

SASL PLAIN auth failed: ruser=...

Jun 18 05:41:19 mail.srvfarm.net postfix/smtps/smtpd[1342981]: warning: unknown[200.66.123.187]: SASL PLAIN authentication failed: 
Jun 18 05:41:19 mail.srvfarm.net postfix/smtps/smtpd[1342981]: lost connection after AUTH from unknown[200.66.123.187]
Jun 18 05:41:41 mail.srvfarm.net postfix/smtps/smtpd[1343122]: warning: unknown[200.66.123.187]: SASL PLAIN authentication failed: 
Jun 18 05:41:42 mail.srvfarm.net postfix/smtps/smtpd[1343122]: lost connection after AUTH from unknown[200.66.123.187]
Jun 18 05:46:00 mail.srvfarm.net postfix/smtpd[1342867]: warning: unknown[200.66.123.187]: SASL PLAIN authentication failed:

Jun 16 05:06:03 mail.srvfarm.net postfix/smtps/smtpd[917493]: warning: unknown[200.66.117.207]: SASL PLAIN authentication failed: 
Jun 16 05:06:04 mail.srvfarm.net postfix/smtps/smtpd[917493]: lost connection after AUTH from unknown[200.66.117.207]
Jun 16 05:07:11 mail.srvfarm.net postfix/smtpd[921343]: warning: unknown[200.66.117.207]: SASL PLAIN authentication failed: 
Jun 16 05:07:12 mail.srvfarm.net postfix/smtpd[921343]: lost connection after AUTH from unknown[200.66.117.207]
Jun 16 05:11:42 mail.srvfarm.net postfix/smtpd[936034]: lost connection after CONNECT from unknown[200.66.117.207]

Jun  7 11:55:50 mail.srvfarm.net postfix/smtpd[94713]: warning: unknown[200.66.122.126]: SASL PLAIN authentication failed: 
Jun  7 11:55:50 mail.srvfarm.net postfix/smtpd[94713]: lost connection after AUTH from unknown[200.66.122.126]
Jun  7 11:58:19 mail.srvfarm.net postfix/smtpd[99649]: warning: unknown[200.66.122.126]: SASL PLAIN authentication failed: 
Jun  7 11:58:20 mail.srvfarm.net postfix/smtpd[99649]: lost connection after AUTH from unknown[200.66.122.126]
Jun  7 12:01:58 mail.srvfarm.net postfix/smtps/smtpd[95103]: warning: unknown[200.66.122.126]: SASL PLAIN authentication failed:

103.91.210.9 (CN/China/-), 5 distributed sshd attacks on account [root] in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_DISTATTACK; Logs: Sep 20 12:51:01 server sshd[16744]: Failed password for root from 211.95.84.146 port 43668 ssh2
Sep 20 12:58:31 server sshd[18467]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.245.218.48  user=root
Sep 20 13:03:22 server sshd[19648]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.91.210.9  user=root
Sep 20 12:53:09 server sshd[17299]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.56.140.62  user=root
Sep 20 12:53:11 server sshd[17299]: Failed password for root from 58.56.140.62 port 26818 ssh2

IP Addresses Blocked:

211.95.84.146 (CN/China/-)
162.245.218.48 (US/United States/-)

Bruteforce detected by fail2ban

34.94.155.56 - - [20/Sep/2020:18:53:42 +0200] "POST /xmlrpc.php HTTP/1.1" 403 613 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
34.94.155.56 - - [20/Sep/2020:19:21:23 +0200] "POST /xmlrpc.php HTTP/1.1" 403 22141 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
...

" "

Automatic report - XMLRPC Attack

20/9/20@13:03:46: FAIL: Alarm-Network address from=83.36.227.153
20/9/20@13:03:47: FAIL: Alarm-Network address from=83.36.227.153
...

Sep 20 16:41:16 ws12vmsma01 sshd[4014]: Invalid user user04 from 113.111.61.225
Sep 20 16:41:19 ws12vmsma01 sshd[4014]: Failed password for invalid user user04 from 113.111.61.225 port 52930 ssh2
Sep 20 16:45:21 ws12vmsma01 sshd[4603]: Invalid user teste from 113.111.61.225
...

Sep 20 18:50:21 pl1server sshd[24283]: Invalid user pi from 79.37.243.21 port 44278
Sep 20 18:50:21 pl1server sshd[24282]: Invalid user pi from 79.37.243.21 port 44276
Sep 20 18:50:21 pl1server sshd[24283]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=79.37.243.21
Sep 20 18:50:21 pl1server sshd[24282]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=79.37.243.21
Sep 20 18:50:23 pl1server sshd[24283]: Failed password for invalid user pi from 79.37.243.21 port 44278 ssh2
Sep 20 18:50:23 pl1server sshd[24282]: Failed password for invalid user pi from 79.37.243.21 port 44276 ssh2
Sep 20 18:50:23 pl1server sshd[24283]: Connection closed by 79.37.243.21 port 44278 [preauth]
Sep 20 18:50:23 pl1server sshd[24282]: Connection closed by 79.37.243.21 port 44276 [preauth]


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=79.37.243.21

Sep 20 20:03:07 root sshd[7185]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190-77-79-127.dyn.dsl.cantv.net  user=root
Sep 20 20:03:09 root sshd[7185]: Failed password for root from 190.77.79.127 port 16403 ssh2
...

Sep 20 10:38:07 dignus sshd[9191]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.186.180  user=root
Sep 20 10:38:10 dignus sshd[9191]: Failed password for root from 51.38.186.180 port 47757 ssh2
Sep 20 10:41:57 dignus sshd[9921]: Invalid user admin from 51.38.186.180 port 53409
Sep 20 10:41:57 dignus sshd[9921]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.186.180
Sep 20 10:41:59 dignus sshd[9921]: Failed password for invalid user admin from 51.38.186.180 port 53409 ssh2
...

2020-09-20 12:00:20.073577-0500  localhost smtpd[52512]: NOQUEUE: reject: RCPT from unknown[39.34.247.91]: 554 5.7.1 Service unavailable; Client host [39.34.247.91] blocked using zen.spamhaus.org; https://www.spamhaus.org/query/ip/39.34.247.91; from= to= proto=ESMTP helo=<[39.34.247.91]>

2020-09-20T17:03:05.431640abusebot-4.cloudsearch.cf sshd[20359]: Invalid user admin from 58.152.206.121 port 34481
2020-09-20T17:03:06.486237abusebot-4.cloudsearch.cf sshd[20363]: Invalid user admin from 58.152.206.121 port 34514
2020-09-20T17:03:05.698122abusebot-4.cloudsearch.cf sshd[20359]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=n058152206121.netvigator.com
2020-09-20T17:03:05.431640abusebot-4.cloudsearch.cf sshd[20359]: Invalid user admin from 58.152.206.121 port 34481
2020-09-20T17:03:07.622886abusebot-4.cloudsearch.cf sshd[20359]: Failed password for invalid user admin from 58.152.206.121 port 34481 ssh2
2020-09-20T17:03:06.751315abusebot-4.cloudsearch.cf sshd[20363]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=n058152206121.netvigator.com
2020-09-20T17:03:06.486237abusebot-4.cloudsearch.cf sshd[20363]: Invalid user admin from 58.152.206.121 port 34514
2020-09-20T17:03:08.554284abusebot-4
...

Sep 20 17:03:40 *** sshd[8287]: User root from 106.53.207.227 not allowed because not listed in AllowUsers

Listed on    zen-spamhaus also abuseat.org and dnsbl-sorbs   / proto=6  .  srcport=28986  .  dstport=23  .     (2342)

2020-09-20 11:52:40.611339-0500  localhost smtpd[52080]: NOQUEUE: reject: RCPT from unknown[178.32.50.239]: 450 4.7.25 Client host rejected: cannot find your hostname, [178.32.50.239]; from= to= proto=ESMTP helo=