It appears that Thomas Hochstein via mailop <mai...@ml.th-h.de> said: >Slavko wrote: > >> Please, i want ask others if are these (mostly) Brasil attempts know to >> others too or am i "special" target? > >Personal server here too. > >| root@moria # grep 'Incorrect authentication data' /var/log/exim4/mainlog.1 | >wc -l >| 1026 > >So, a bit more than 1.000 attempts yesterday.
About 12,000 here. It's a botnet, it's not targeting you any more than any other random server it can find, and I don't know of any way to block it. You can use something like fail2ban to block individual IPs but it's a very large botnet. The logins are pretty random: 2021-07-15 01:09:03.374311500 mailfront[97178]: Fake login rssman / abc123 2021-07-15 01:09:05.838211500 mailfront[97183]: Fake login bob_fr / qwerty 2021-07-15 01:09:06.772155500 mailfront[97191]: Fake login andrew / asdfgh 2021-07-15 01:09:07.335611500 mailfront[97194]: Fake login nnsquad / abc123456 2021-07-15 01:09:07.898144500 mailfront[97195]: Fake login rssmanagi / abc123456 2021-07-15 01:09:10.362742500 mailfront[97201]: Fake login bob_fr / asdfgh 2021-07-15 01:09:11.357415500 mailfront[97208]: Fake login andrew_ / letmein 2021-07-15 01:09:11.853999500 mailfront[97212]: Fake login nnsqua / 000000 2021-07-15 01:09:12.347805500 mailfront[97215]: Fake login rssman / 000000 2021-07-15 01:09:14.819537500 mailfront[97224]: Fake login bob_fra / letmein 2021-07-15 01:09:15.370713500 mailfront[97214]: Fake login tele / 7001 2021-07-15 01:09:15.924577500 mailfront[97229]: Fake login andrew / abc123 2021-07-15 01:09:16.431118500 mailfront[97235]: Fake login nnsqua / 123123 2021-07-15 01:09:16.789482500 mailfront[97236]: Fake login rssman / 123123 2021-07-15 01:09:19.228958500 mailfront[97241]: Fake login tele / 4001 2021-07-15 01:09:19.270550500 mailfront[97243]: Fake login bob_fr / abc123 2021-07-15 01:09:20.502396500 mailfront[97251]: Fake login andrew_ma / abc123456 2021-07-15 01:09:21.005099500 mailfront[97256]: Fake login nnsqua / 111111 2021-07-15 01:09:21.275142500 mailfront[97258]: Fake login rssman / 111111 2021-07-15 01:09:23.966663500 mailfront[97267]: Fake login bob_frank / abc123456 2021-07-15 01:09:24.922478500 mailfront[97274]: Fake login andrew / 000000 2021-07-15 01:09:25.596200500 mailfront[97279]: Fake login nnsqua / 222222 2021-07-15 01:09:25.772230500 mailfront[97280]: Fake login rssman / 222222 2021-07-15 01:09:28.488612500 mailfront[97289]: Fake login bob_fr / 000000 2021-07-15 01:09:29.315868500 mailfront[97299]: Fake login andrew / 123123 2021-07-15 01:09:30.066903500 mailfront[97302]: Fake login nnsqua / 333333 2021-07-15 01:09:30.179992500 mailfront[97304]: Fake login rssman / 333333 2021-07-15 01:09:33.019374500 mailfront[97317]: Fake login bob_fr / 123123 2021-07-15 01:09:33.807393500 mailfront[97323]: Fake login andrew / 111111 2021-07-15 01:09:34.482521500 mailfront[97328]: Fake login nnsqua / 444444 2021-07-15 01:09:34.719871500 mailfront[97329]: Fake login rssman / 444444 2021-07-15 01:09:37.517548500 mailfront[97336]: Fake login bob_fr / 111111 2021-07-15 01:09:38.452654500 mailfront[97343]: Fake login andrew / 222222 2021-07-15 01:09:39.100721500 mailfront[97346]: Fake login nnsqua / 555555 2021-07-15 01:09:39.158732500 mailfront[97347]: Fake login rssman / 555555 2021-07-15 01:09:42.019243500 mailfront[97356]: Fake login bob_fr / 222222 2021-07-15 01:09:43.087836500 mailfront[97364]: Fake login andrew / 333333 2021-07-15 01:09:43.571643500 mailfront[97367]: Fake login rssman / 666666 2021-07-15 01:09:43.656882500 mailfront[97368]: Fake login nnsqua / 666666 2021-07-15 01:09:46.697044500 mailfront[97375]: Fake login bob_fr / 333333 2021-07-15 01:09:47.531018500 mailfront[97386]: Fake login andrew / 444444 2021-07-15 01:09:48.110315500 mailfront[97390]: Fake login nnsqua / 777777 2021-07-15 01:09:48.117088500 mailfront[97388]: Fake login rssman / 777777 2021-07-15 01:09:51.304767500 mailfront[97397]: Fake login bob_fr / 444444 2021-07-15 01:09:52.100357500 mailfront[97406]: Fake login andrew / 555555 2021-07-15 01:09:52.679086500 mailfront[97407]: Fake login rssman / 888888 2021-07-15 01:09:52.699856500 mailfront[97408]: Fake login nnsqua / 888888 2021-07-15 01:09:55.784831500 mailfront[97416]: Fake login bob_fr / 555555 2021-07-15 01:09:56.733251500 mailfront[97421]: Fake login andrew / 666666 2021-07-15 01:09:57.219744500 mailfront[97422]: Fake login nnsqua / 999999 2021-07-15 01:09:57.260230500 mailfront[97423]: Fake login rssman / 999999 2021-07-15 01:10:00.259598500 mailfront[97429]: Fake login bob_fr / 666666 2021-07-15 01:10:01.268775500 mailfront[97436]: Fake login andrew / 777777 2021-07-15 01:10:01.777671500 mailfront[97438]: Fake login nnsqua / 696969 2021-07-15 01:10:01.853818500 mailfront[97437]: Fake login rssman / 696969 2021-07-15 01:10:04.698859500 mailfront[97455]: Fake login bob_fr / 777777 2021-07-15 01:10:05.905906500 mailfront[97464]: Fake login andrew / 888888 2021-07-15 01:10:06.302905500 mailfront[97469]: Fake login nnsqu / admin 2021-07-15 01:10:06.322055500 mailfront[97470]: Fake login rssma / admin 2021-07-15 01:10:09.147370500 mailfront[97487]: Fake login bob_fr / 888888 2021-07-15 01:10:10.383177500 mailfront[97497]: Fake login andrew / 999999 R's, John _______________________________________________ mailop mailing list mailop@mailop.org https://list.mailop.org/listinfo/mailop
