Slavko wrote: > Please, i want ask others if are these (mostly) Brasil attempts know to > others too or am i "special" target?
Personal server here too. | root@moria # grep 'Incorrect authentication data' /var/log/exim4/mainlog.1 | wc -l | 1026 So, a bit more than 1.000 attempts yesterday. > The IP > is only rarely used more than once, and as one can see, the IP networks > and AS numbers doesn't get high counts too (with some exceptions which > i blocked manually). Same here, fail2ban doesn't help that much. > I do not know what > accounts/passwords they are trying, as real AUTH doesn't happen. Most try "postmaster" at domains the host is MX for, others try harvested addresses from domains the host is MX for (with and without domain), and yet others try addresses I know that have no obvious connection to that host. None of those has an STMP-Auth password, so no harm done. -thh _______________________________________________ mailop mailing list mailop@mailop.org https://list.mailop.org/listinfo/mailop
