Jan 10 17:16:35 mail postfix/smtps/smtpd[46846]: warning: unknown[87.120.93.11]: SASL LOGIN authenti ...
show moreJan 10 17:16:35 mail postfix/smtps/smtpd[46846]: warning: unknown[87.120.93.11]: SASL LOGIN authentication failed: authentication failur
e
show less
Jan 11 11:05:50 mail postfix/smtps/smtpd[38941]: warning: unknown[87.120.93.10]: SASL LOGIN authenti ...
show moreJan 11 11:05:50 mail postfix/smtps/smtpd[38941]: warning: unknown[87.120.93.10]: SASL LOGIN authentication failed: authentication failur
e
show less
Dec 23 18:49:21 mail postfix/smtps/smtpd[64218]: warning: unknown[194.169.175.26]: SASL LOGIN authen ...
show moreDec 23 18:49:21 mail postfix/smtps/smtpd[64218]: warning: unknown[194.169.175.26]: SASL LOGIN authentication failed: authentication fail
ure
show less
Feb 13 10:52:59 mail postfix/smtps/smtpd[22515]: warning: unknown[45.131.193.74]: SASL LOGIN authent ...
show moreFeb 13 10:52:59 mail postfix/smtps/smtpd[22515]: warning: unknown[45.131.193.74]: SASL LOGIN authentication failed: authentication failure
Feb 13 10:53:00 mail postfix/smtps/smtpd[22515]: lost connection after AUTH from unknown[45.131.193.74]
Feb 13 10:53:00 mail postfix/smtps/smtpd[22515]: disconnect from unknown[45.131.193.74] ehlo=1 auth=0/1 commands=1/2
show less
Feb 13 10:51:19 mail postfix/smtpd[461]: warning: unknown[103.114.217.50]: SASL LOGIN authentication ...
show moreFeb 13 10:51:19 mail postfix/smtpd[461]: warning: unknown[103.114.217.50]: SASL LOGIN authentication failed: authentication failure
Feb 13 10:51:20 mail postfix/smtpd[461]: lost connection after AUTH from unknown[103.114.217.50]
Feb 13 10:51:20 mail postfix/smtpd[461]: disconnect from unknown[103.114.217.50] ehlo=2 starttls=1 auth=0/1 commands=3/4
Feb 13 10:51:16 mail postfix/smtpd[557]: warning: unknown[103.114.217.50]: SASL LOGIN authentication failed: authentication failure
Feb 13 10:51:17 mail postfix/smtpd[557]: lost connection after AUTH from unknown[103.114.217.50]
Feb 13 10:51:20 mail postfix/postscreen[15267]: CONNECT from [103.114.217.50]:57036 to [91.238.204.4]:25
show less
grep sasl_user /var/log/zimbra.log | grep ********* | awk '{print $7}' |sed -rn 's/.*\[//;s/\].*//p' ...
show moregrep sasl_user /var/log/zimbra.log | grep ********* | awk '{print $7}' |sed -rn 's/.*\[//;s/\].*//p' | sort -nr -k 1 | uniq -c |sort -nr -k 1
1056 51.89.110.165
1056 connections for 30 minute to a mail account with a compromised password. Spam being sent to various mail servers.
show less
May 12 06:05:34 mail postfix/smtps/smtpd[64406]: NOQUEUE: filter: RCPT from unknown[20.24.82.19]: <p ...
show moreMay 12 06:05:34 mail postfix/smtps/smtpd[64406]: NOQUEUE: filter: RCPT from unknown[20.24.82.19]: <[email protected]>: Sender address triggers FILTER smtp-amavis:[127.0.0.1]:10026; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<?ssl.SSLContext?object?at?0x7fc43aa9cf40?>
show less