🇧🇷
ICS Labs
2026-05-28 20:34:57
(3 weeks ago)
ICS Labs identified 140.228.24.138 as a malicious indicator from threat intelligence.
DDoS Attack
Hacking
Exploited Host
🇮🇹
Inartis
2026-04-23 22:51:08
(1 month ago)
2026-04-24T00:51:07.483395mail1.inartis.it postfix/smtpd[1944895]: warning: unknown[140.228.24.138]: ...
show more
2026-04-24T00:51:07.483395mail1.inartis.it postfix/smtpd[1944895]: warning: unknown[140.228.24.138]: SASL PLAIN authentication failed: authentication failure, [email protected]
...
show less
Port Scan
Brute-Force
🇨🇦
polycoda
2026-04-23 01:25:35
(1 month ago)
AutoBlock: 📡 Port Scan (Non Decay-Based) - 🔐 SMTP Auth Failure (Decay-Based)
Port Scan
Brute-Force
🇷🇸
Smel
2026-04-23 01:04:16
(1 month ago)
Mail/25/465/587-993/995 Probe, Reject, BadAuth, Hack, SPAM -
Email Spam
Hacking
Brute-Force
🇬🇧
openstrike.co.uk
2026-04-19 22:51:18
(2 months ago)
Email auth failures (4)
Brute-Force
🇺🇸
bigscoots.com
2026-04-19 13:57:06
(2 months ago)
(smtpauth) Failed SMTP AUTH login from 140.228.24.138 (CA/Canada/-): 5 in the last 3600 secs; Ports: ...
show more
(smtpauth) Failed SMTP AUTH login from 140.228.24.138 (CA/Canada/-): 5 in the last 3600 secs; Ports: 25,465,587; Direction: 0; Trigger: LF_SMTPAUTH; Logs: 2026-04-19 09:56:12 dovecot_plain authenticator failed for H=([10.9.18.231]) [140.228.24.138]:20642: 535 Incorrect authentication data ([email protected] )
2026-04-19 09:56:18 dovecot_login authenticator failed for H=([10.9.18.231]) [140.228.24.138]:20642: 535 Incorrect authentication data ([email protected] )
2026-04-19 09:56:24 dovecot_plain authenticator failed for H=([10.9.18.231]) [140.228.24.138]:39348: 535 Incorrect authentication data ([email protected] )
2026-04-19 09:56:30 dovecot_login authenticator failed for H=([10.9.18.231]) [140.228.24.138]:39348: 535 Incorrect authentication data ([email protected] )
2026-04-19 09:57:03 dovecot_plain authenticator failed for H=([10.9.18.231]) [140.228.24.138]:8388: 535 Incorrect authentication data ([email protected] )
show less
Brute-Force
SSH
2026-04-19 11:51:11
(2 months ago)
Authentication failure
Brute-Force
🇧🇷
KingHost
2026-04-16 04:41:38
(2 months ago)
Brute-Force
🇺🇸
TheMadBeaker
2026-04-16 04:20:11
(2 months ago)
Fail2Ban - SMTP Bruteforce Attempt
Email Spam
Brute-Force
🇨🇿
lp
2026-04-16 03:19:47
(2 months ago)
Email account brute force: 5 attempts were recorded from 140.228.24.138
2026-04-16T04:16:46+02:00 wa ...
show more
Email account brute force: 5 attempts were recorded from 140.228.24.138
2026-04-16T04:16:46+02:00 warning: unknown[140.228.24.138]: SASL PLAIN authentication failed: authentication failure, [email protected]
2026-04-16T04:16:46+02:00 warning: unknown[140.228.24.138]: SASL LOGIN authentication failed: authentication failure, [email protected]
2026-04-16T04:16:47+02:00 warning: unknown[140.228.24.138]: SASL PLAIN authentication failed: authentication failure, [email protected]
2026-04-16T04:16:48+02:00 warning: unknown[140.228.24.138]: SASL LOGIN authentication failed: authentication failure, [email protected]
2026-04-16T04:16:55+02:00 warning: unknown[140.228.24.138]: SASL PLAIN authentication failed: authentication failure, [email protected]
show less
Brute-Force
🇺🇸
xmission.com
2026-04-09 08:48:29
(2 months ago)
Blocked by UFW (TCP on 1)
Source port: 47550
TTL: 115
Packet length: 52
TOS: 0x08
This report (for ...
show more
Blocked by UFW (TCP on 1)
Source port: 47550
TTL: 115
Packet length: 52
TOS: 0x08
This report (for 140.228.24.138) was generated by:
https://github.com/sefinek/UFW-AbuseIPDB-Reporter
show less
Port Scan
🇳🇱
maxxsense
2026-03-31 02:18:43
(2 months ago)
(smtpauth) Failed SMTP AUTH login from 140.228.24.138 (US/United States/-)
Brute-Force
🇩🇪
neverdown.eu
2026-03-25 15:19:06
(2 months ago)
(smtpauth) Failed SMTP AUTH login from 140.228.24.138 (CA/Canada/-): 5 in the last 60 secs; Ports: * ...
show more
(smtpauth) Failed SMTP AUTH login from 140.228.24.138 (CA/Canada/-): 5 in the last 60 secs; Ports: *; Direction: inout; Trigger: LF_SMTPAUTH; Logs: 2026-03-25 17:18:37 dovecot_plain authenticator failed for H=([10.9.18.208]) [140.228.24.138]:18898: 535 Incorrect authentication data ([email protected] )
2026-03-25 17:18:43 dovecot_login authenticator failed for H=([10.9.18.208]) [140.228.24.138]:18898: 535 Incorrect authentication data ([email protected] )
2026-03-25 17:18:50 dovecot_plain authenticator failed for H=([10.9.18.208]) [140.228.24.138]:37093: 535 Incorrect authentication data ([email protected] )
2026-03-25 17:18:52 dovecot_login authenticator failed for H=([10.9.18.208]) [140.228.24.138]:37093: 535 Incorrect authentication data ([email protected] )
2026-03-25 17:19:02 dovecot_plain authenticator failed for H=([10.9.18.208]) [140.228.24.138]:26557: 535 Incorrect authentication data ([email protected] )
show less
Port Scan
🇫🇷
dwmp
2026-03-24 07:44:31
(2 months ago)
Mar 24 08:44:29 plesk postfix/smtpd[2827446]: lost connection after CONNECT from unknown[140.228.24. ...
show more
Mar 24 08:44:29 plesk postfix/smtpd[2827446]: lost connection after CONNECT from unknown[140.228.24.138]
Mar 24 08:44:30 plesk postfix/smtpd[2824667]: warning: unknown[140.228.24.138]: SASL CRAM-MD5 authentication failed: authentication failure
Mar 24 08:44:30 plesk postfix/smtpd[2824667]: warning: unknown[140.228.24.138]: SASL PLAIN authentication failed: authentication failure
...
show less
Brute-Force
SSH
🇩🇪
tinect
2026-03-24 04:24:49
(2 months ago)
Gets ban for 100h for triggering crowdsecurity/dovecot-spam at root1.
Web App Attack