On Sat, 17 Jul 2021, Slavko via mailop wrote:
Please, i want ask others if are these (mostly) Brasil attempts know to
others too or am i "special" target? Some other questions, which comes
to my minds without answers, while perhaps nobody here will/can know
right answer, i will ask:
Nope, this is sadly a fact of life these days. At times there's way more
bad auth attempts than actual mail running through one of my MXes.
- i use blocklist.de IP list to block access on router for years, but i
feeling in recent time as it is not as effective as before, can it be
related, that i do not see similar attempts before?
The fact that you're using a blocklist is probably why you're only seeing
the distributed scattered attempts and not a roar from certain subnets.
I've had a few /24s blocked for years now and every time I give them a
test unblock they just start pouring brute force attempts in.
Picking one subnet from the last little while, there are attempts from:
Jul-18-21 00:24:40 [Worker_1] [TLS-out] 78.128.113.99 [SMTP Error] 535
5.7.8 Bad username or password (Authentication failed).
Jul-18-21 00:44:15 [Worker_1] [TLS-out] 78.128.113.75 [SMTP Error] 535
5.7.8 Bad username or password (Authentication failed).
Jul-18-21 01:09:57 [Worker_1] [TLS-out] 78.128.113.74 [SMTP Error] 535
5.7.8 Bad username or password (Authentication failed).
Jul-18-21 01:41:02 [Worker_1] [TLS-out] 78.128.113.77 [SMTP Error] 535
5.7.8 Bad username or password (Authentication failed).
Jul-18-21 01:46:41 [Worker_1] [TLS-out] 78.128.113.74 [SMTP Error] 535
5.7.8 Bad username or password (Authentication failed).
Jul-18-21 01:46:46 [Worker_1] 78.128.113.69 [SMTP Error] 521
(redacted) does not accept mail - closing transmission - too many
previous AUTH errors from network 78.128.113.0
(After five attempts the /24 goes into the sin bin and all auth attempts
are rejected.)
--
Andre van Eyssen. Phone: +61 417 211 788
mail: [email protected] http://andre.purplecow.org
About & Contact: http://www.purplecow.org/andre.html
_______________________________________________
mailop mailing list
[email protected]
https://list.mailop.org/listinfo/mailop
