|
🇵🇾
SecOpsSL
|
|
2026-10-27 20:00:43,692 WARN [ImapSSLServer-2750] [ip=192.168.0.25;oip=102.129.53.242;via=192.168.0.25(nginx/1.20.0);ua=Zimbra/8.8.15_GA_4717;cid=41595;] security - cmd=Auth; [email protected]; protocol=imap; error=authentication f ...
show more
2026-10-27 20:00:43,692 WARN [ImapSSLServer-2750] [ip=192.168.0.25;oip=102.129.53.242;via=192.168.0.25(nginx/1.20.0);ua=Zimbra/8.8.15_GA_4717;cid=41595;] security - cmd=Auth; [email protected]; protocol=imap; error=authentication failed for [[email protected]], invalid password;
show less
|
Email Spam
Brute-Force
|
|
🇳🇱
Mangelot Hosting
|
|
(dovecot_invalid_user) srv201 Dovecot login on non-existent account 102.129.53.242 (ZA/South Africa/ms-53-242.megasurf.co.za): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: Oct 6 09:03:01 dovecot[1132694]: ima ...
show more
(dovecot_invalid_user) srv201 Dovecot login on non-existent account 102.129.53.242 (ZA/South Africa/ms-53-242.megasurf.co.za): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: Oct 6 09:03:01 dovecot[1132694]: imap-login: Login aborted: Connection closed (auth failed, 2 attempts in 8 secs) (auth_failed): user=[USERNAME] method=PLAIN, rip=102.129.53.242, lip=0.0.0.x, TLS, session=<BqdDliZdFqRmgTXy>
show less
|
Web App Attack
|
|
Anonymous
|
|
fail2ban: brute-force/credential spraying against mail (IMAP/POP/webmail) — rmnet.it
|
Brute-Force
|
|
Anonymous
|
|
Authentication failure
|
Brute-Force
|
|
🇷🇴
clauss
|
|
IP reached maximum auth failures for a one day block
|
Brute-Force
|
|
🇦🇺
AWW-Admin
|
|
(imapd) Failed IMAP login from 102.129.53.242 (ms-53-242.megasurf.co.za)
|
Brute-Force
|
|
🇩🇪
FeG Deutschland
|
|
Mail: - login with unknown user - bruteforce
|
Brute-Force
|
|
🇮🇩
sockominfo
|
|
Zimbra: Login failures from malicious IP: 102.129.53.242. Threat Score: 6/10 (MEDIUM). Confidence: 40%. CVSS v3.1: 4.6/10 (Medium). CVSS Vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L. Bayesian Probability: 77%. MITRE ATT&CK: T1083 (File and Di ...
show more
Zimbra: Login failures from malicious IP: 102.129.53.242. Threat Score: 6/10 (MEDIUM). Confidence: 40%. CVSS v3.1: 4.6/10 (Medium). CVSS Vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L. Bayesian Probability: 77%. MITRE ATT&CK: T1083 (File and Directory Discovery). Tactic: TA0001. Freshness: Moderate. Source Reputation: UNKNOWN. Methodology: CVSS 3.1 + Bayesian + Temporal + Environmental + MITRE ATT&CK + OWASP. Standards: ISO/IEC 27065:2022, NIST SP 800-30, IEEE S&P 2020. Reported by TangerangKota-CSIRT. Status: MALICIOUS
show less
|
Hacking
Web App Attack
|
|
🇮🇩
sockominfo
|
|
Zimbra: Login failures from malicious IP: 102.129.53.242. Threat Score: 6.1/10 (MEDIUM). Confidence: 40%. CVSS v3.1: 4.6/10 (Medium). CVSS Vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L. Bayesian Probability: 77%. MITRE ATT&CK: T1083 (File and ...
show more
Zimbra: Login failures from malicious IP: 102.129.53.242. Threat Score: 6.1/10 (MEDIUM). Confidence: 40%. CVSS v3.1: 4.6/10 (Medium). CVSS Vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L. Bayesian Probability: 77%. MITRE ATT&CK: T1083 (File and Directory Discovery). Tactic: TA0001. Freshness: Fresh. Source Reputation: UNKNOWN. Methodology: CVSS 3.1 + Bayesian + Temporal + Environmental + MITRE ATT&CK + OWASP. Standards: ISO/IEC 27065:2022, NIST SP 800-30, IEEE S&P 2020. Reported by TangerangKota-CSIRT. Status: MALICIOUS
show less
|
Hacking
Web App Attack
|
|
🇮🇩
sockominfo
|
|
Zimbra: Login failures from malicious IP: 102.129.53.242. Threat Score: 6.2/10 (MEDIUM). Confidence: 40%. CVSS v3.1: 4.6/10 (Medium). CVSS Vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L. Bayesian Probability: 77%. MITRE ATT&CK: T1083 (File and ...
show more
Zimbra: Login failures from malicious IP: 102.129.53.242. Threat Score: 6.2/10 (MEDIUM). Confidence: 40%. CVSS v3.1: 4.6/10 (Medium). CVSS Vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L. Bayesian Probability: 77%. MITRE ATT&CK: T1083 (File and Directory Discovery). Tactic: TA0001. Freshness: Fresh. Source Reputation: UNKNOWN. Methodology: CVSS 3.1 + Bayesian + Temporal + Environmental + MITRE ATT&CK + OWASP. Standards: ISO/IEC 27065:2022, NIST SP 800-30, IEEE S&P 2020. Reported by TangerangKota-CSIRT. Status: MALICIOUS
show less
|
Hacking
Web App Attack
|
|
🇮🇩
sockominfo
|
|
Zimbra: Login failures from malicious IP: 102.129.53.242. Threat Score: 5.3/10 (MEDIUM). Reported by TangerangKota-CSIRT
|
Hacking
Web App Attack
|
|
🇮🇩
sockominfo
|
|
Zimbra: Login failures from malicious IP: 102.129.53.242. Threat Score: 6.3/10 (MEDIUM). Confidence: 40%. CVSS v3.1: 4.6/10 (Medium). CVSS Vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L. Bayesian Probability: 77%. MITRE ATT&CK: T1083 (File and ...
show more
Zimbra: Login failures from malicious IP: 102.129.53.242. Threat Score: 6.3/10 (MEDIUM). Confidence: 40%. CVSS v3.1: 4.6/10 (Medium). CVSS Vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L. Bayesian Probability: 77%. MITRE ATT&CK: T1083 (File and Directory Discovery). Tactic: TA0001. Freshness: Fresh. Source Reputation: UNKNOWN. Methodology: CVSS 3.1 + Bayesian + Temporal + Environmental + MITRE ATT&CK + OWASP. Standards: ISO/IEC 27065:2022, NIST SP 800-30, IEEE S&P 2020. Reported by TangerangKota-CSIRT. Status: MALICIOUS
show less
|
Hacking
Web App Attack
|
|
🇮🇩
sockominfo
|
|
Zimbra: Login failures from malicious IP: 102.129.53.242. Threat Score: 6.4/10 (MEDIUM). Confidence: 40%. CVSS v3.1: 4.6/10 (Medium). CVSS Vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L. Bayesian Probability: 77%. MITRE ATT&CK: T1083 (File and ...
show more
Zimbra: Login failures from malicious IP: 102.129.53.242. Threat Score: 6.4/10 (MEDIUM). Confidence: 40%. CVSS v3.1: 4.6/10 (Medium). CVSS Vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L. Bayesian Probability: 77%. MITRE ATT&CK: T1083 (File and Directory Discovery). Tactic: TA0001. Freshness: Very Fresh. Source Reputation: UNKNOWN. Methodology: CVSS 3.1 + Bayesian + Temporal + Environmental + MITRE ATT&CK + OWASP. Standards: ISO/IEC 27065:2022, NIST SP 800-30, IEEE S&P 2020. Reported by TangerangKota-CSIRT. Status: MALICIOUS
show less
|
Hacking
Web App Attack
|
|
🇬🇧
D3monite
|
|
Attempted Brute Force (dovecot)
|
Brute-Force
|
|
🇷🇺
DZBOT
|
|
DZBOT: [MTA] NO LOGIN / auth failed
|
Port Scan
Brute-Force
|
