On Sun Mar 20 2016 12:47:32 @lbutlr <@lbutlr> said: > > But they still keep coming. > > $ date && grep UGFzc3dvcmQ6 /var/log/maillog | tail -1 > Sun Mar 20 12:43:33 MDT 2016 > Mar 20 12:43:31 mail postfix/smtpd[28552]: warning: unknown[185.103.253.246]: > SASL LOGIN authentication failed: UGFzc3dvcmQ6
Mar 20 12:55:37 mail postfix/postscreen[29826]: CONNECT from [185.103.253.246]:50804 to [65.121.55.45]:25 Mar 20 12:55:37 mail postfix/postscreen[29826]: BLACKLISTED [185.103.253.246]:50804 Mar 20 12:55:37 mail postfix/postscreen[29826]: PASS OLD [185.103.253.246]:50804 Mar 20 12:55:37 mail postfix/smtpd[29832]: connect from unknown[185.103.253.246] Mar 20 12:55:47 mail postfix/smtpd[29832]: warning: unknown[185.103.253.246]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 Mar 20 12:55:47 mail postfix/smtpd[29832]: lost connection after AUTH from unknown[185.103.253.246] Mar 20 12:55:47 mail postfix/smtpd[29832]: disconnect from unknown[185.103.253.246] ehlo=1 auth=0/1 commands=1/2 So, they show blacklist on postscreen, but still hit smtpd with he same message filling the logs. Sigh -- You only had to look into Teatime's mismatched eyes to know one thing, which was this: if Teatime wanted to find you he would not look everywhere. He'd look in only one place, which would be the place where you were hiding. --Hogfather
