๐ณ๐ฑ
172.94.9.120
09 Jun 2026
2026-06-09T02:32:35.440110-06:00 master01-sol postfix/smtps/smtpd[3321023]: warning: unknown[172.94. ...
show more
2026-06-09T02:32:35.440110-06:00 master01-sol postfix/smtps/smtpd[3321023]: warning: unknown[172.94.9.120]: SASL LOGIN authentication failed: (reason unavailable), [email protected]
2026-06-09T02:32:42.130606-06:00 master01-sol postfix/smtps/smtpd[3321023]: warning: unknown[172.94.9.120]: SASL LOGIN authentication failed: (reason unavailable), [email protected]
2026-06-09T02:32:54.469872-06:00 master01-sol postfix/submission/smtpd[3321033]: warning: unknown[172.94.9.120]: SASL LOGIN authentication failed: (reason unavailable), [email protected]
...
show less
Phishing
Email Spam
Spoofing
Brute-Force
๐ฌ๐ง
172.94.9.120
05 Jun 2026
2026-06-05T14:40:35.399505-06:00 master01-sol postfix/smtps/smtpd[2217134]: warning: unknown[172.94. ...
show more
2026-06-05T14:40:35.399505-06:00 master01-sol postfix/smtps/smtpd[2217134]: warning: unknown[172.94.9.120]: SASL LOGIN authentication failed: (reason unavailable), [email protected]
2026-06-05T14:40:42.101908-06:00 master01-sol postfix/smtps/smtpd[2217134]: warning: unknown[172.94.9.120]: SASL LOGIN authentication failed: (reason unavailable), [email protected]
2026-06-05T14:40:56.472362-06:00 master01-sol postfix/submission/smtpd[2217139]: warning: unknown[172.94.9.120]: SASL LOGIN authentication failed: (reason unavailable), [email protected]
...
show less
Phishing
Email Spam
Spoofing
Brute-Force
๐ฌ๐ง
172.94.9.120
02 Jun 2026
2026-06-02T02:21:56.118253-06:00 master01-sol postfix/smtps/smtpd[1308703]: warning: unknown[172.94. ...
show more
2026-06-02T02:21:56.118253-06:00 master01-sol postfix/smtps/smtpd[1308703]: warning: unknown[172.94.9.120]: SASL LOGIN authentication failed: (reason unavailable), [email protected]
2026-06-02T02:22:02.315818-06:00 master01-sol postfix/smtps/smtpd[1308703]: warning: unknown[172.94.9.120]: SASL LOGIN authentication failed: (reason unavailable), [email protected]
2026-06-02T02:22:14.474827-06:00 master01-sol postfix/submission/smtpd[1308732]: warning: unknown[172.94.9.120]: SASL LOGIN authentication failed: (reason unavailable), [email protected]
...
show less
Phishing
Email Spam
Spoofing
Brute-Force
๐ณ๐ฑ
172.94.9.120
29 May 2026
2026-05-29T12:55:17.432509-06:00 master01-sol postfix/smtps/smtpd[263665]: warning: unknown[172.94.9 ...
show more
2026-05-29T12:55:17.432509-06:00 master01-sol postfix/smtps/smtpd[263665]: warning: unknown[172.94.9.120]: SASL LOGIN authentication failed: (reason unavailable), [email protected]
2026-05-29T12:55:24.119412-06:00 master01-sol postfix/smtps/smtpd[263665]: warning: unknown[172.94.9.120]: SASL LOGIN authentication failed: (reason unavailable), [email protected]
2026-05-29T12:55:37.438170-06:00 master01-sol postfix/submission/smtpd[263679]: warning: unknown[172.94.9.120]: SASL LOGIN authentication failed: (reason unavailable), [email protected]
...
show less
Phishing
Email Spam
Spoofing
Brute-Force
๐ฎ๐ฉ
119.110.72.118
20 May 2026
2026-05-20T11:18:06.078359-06:00 master01-sol postfix/submission/smtpd[2425331]: warning: unknown[11 ...
show more
2026-05-20T11:18:06.078359-06:00 master01-sol postfix/submission/smtpd[2425331]: warning: unknown[119.110.72.118]: SASL PLAIN authentication failed: (reason unavailable), [email protected]
2026-05-20T11:18:17.260837-06:00 master01-sol postfix/submission/smtpd[2425331]: warning: unknown[119.110.72.118]: SASL PLAIN authentication failed: (reason unavailable), [email protected]
2026-05-20T11:18:38.421562-06:00 master01-sol postfix/submission/smtpd[2425331]: warning: unknown[119.110.72.118]: SASL PLAIN authentication failed: (reason unavailable), [email protected]
...
show less
Phishing
Email Spam
Spoofing
Brute-Force
๐ฐ๐ท
121.78.158.30
15 May 2026
wazuh-alerts-4.x-2026.05.15
May 15 16:35:31 ns1 dovecot[308]: imap-login: Login aborted: Connection ...
show more
wazuh-alerts-4.x-2026.05.15
May 15 16:35:31 ns1 dovecot[308]: imap-login: Login aborted: Connection closed (auth failed, 1 attempts in 2 secs) (auth_failed): user=<[email protected] >, method=PLAIN, rip=121.78.158.30, lip=192.168.2.5, TLS, session=<Q/L7zN1RuNx5Tp4e>
manager.name - siem
show less
Email Spam
Brute-Force
๐จ๐ณ
183.36.25.148
15 May 2026
2026-05-15 15:50:23,519 fail2ban.filter [187]: INFO [postfix-sasl] Found 183.36.25.148 - ...
show more
2026-05-15 15:50:23,519 fail2ban.filter [187]: INFO [postfix-sasl] Found 183.36.25.148 - 2026-05-15 15:50:23
show less
Email Spam
Brute-Force
๐ท๐บ
95.174.97.156
17 Apr 2026
dovecot: auth-worker([email protected] ,95.174.97.156)<692153><CvL+XKhPANBfrmGc>: request [2]: sql: ...
show more
dovecot: auth-worker([email protected] ,95.174.97.156)<692153><CvL+XKhPANBfrmGc>: request [2]: sql: unknown user
2026-04-17T13:59:56.204466+00:00 ns1 dovecot: imap-login: Login aborted: Connection closed (auth failed, 1 attempts in 2 secs) (auth_failed): user=<[email protected] >, method=PLAIN, rip=95.174.97.156, lip=192.168.2.5, TLS, session=<CvL+XKhPANBfrmGc>
2026-04-17T14:00:03.259235+00:00 ns1 dovecot: imap-login: Login aborted: Connection closed (disconnected before auth was ready, waited 0 secs) (auth_process_not_ready): user=<>, rip=::1, lip=::1, secured, session=<qK+SXahP8KYAAAAAAAAAAAAAAAAAAAAB>
2026-04-17T14:00:03.259415+00:00 ns1 dovecot: pop3-login: Login aborted: Connection closed (disconnected before auth was ready, waited 0 secs) (auth_process_not_ready): user=<>, rip=::1, lip=::1, secured, session=<ArCSXahPiIEAAAAAAAAAAAAAAAAAAAAB>
show less
Phishing
Spoofing
๐ฐ๐ท
1.235.192.131
17 Apr 2026
postfix/submissions/smtpd[692123]: connect from unknown[1.235.192.131]
postfix/submissions/smtpd[69 ...
show more
postfix/submissions/smtpd[692123]: connect from unknown[1.235.192.131]
postfix/submissions/smtpd[692123]: warning: unknown[1.235.192.131]: SASL LOGIN authentication failed: (reason unavailable), sasl_username=chereen.j
postfix/submissions/smtpd[692123]: NOQUEUE: lost connection after AUTH from unknown[1.235.192.131]
postfix/submissions/smtpd[692123]: disconnect from unknown[1.235.192.131] ehlo=1 auth=0/1 commands=1/2
show less
Phishing
Spoofing
๐ง๐ท
192.178.95.17
16 Apr 2026
wazuh-alerts-4.x-2026.04.16:
Apr 16 19:59:58 ns1 named[226]: client @0x7c980c643400 192.178.95.17#5 ...
show more
wazuh-alerts-4.x-2026.04.16:
Apr 16 19:59:58 ns1 named[226]: client @0x7c980c643400 192.178.95.17#52444 (vivAFM.cOm.ni): query (cache) 'vivAFM.cOm.ni/A/IN' denied (allow-query-cache did not match)
show less
DNS Compromise
๐บ๐ธ
207.38.87.29
13 Apr 2026
401A069DD58FF5A851: SA score=5/5 time=3.726 bayes=undefined autolearn=no autolearn_force=no hits=DKI ...
show more
401A069DD58FF5A851: SA score=5/5 time=3.726 bayes=undefined autolearn=no autolearn_force=no hits=DKIM_SIGNED(0.1),DKIM_VALID(-0.1),DKIM_VALID_AU(-0.1),DKIM_VALID_EF(-0.1),DMARC_PASS(-0.1),HTML_FONT_SIZE_HUGE(0.001),HTML_MESSAGE(0.001),MISSING_HEADERS(1.207),RCVD_IN_DNSWL_BLOCKED(0.001),RCVD_IN_VALIDITY_CERTIFIED_BLOCKED(0.001),RCVD_IN_VALIDITY_SAFE_BLOCKED(0.001),RCVD_IN_ZEN_BLOCKED_OPENDNS(0.001),REPLYTO_WITHOUT_TO_CC(1.946),SPF_HELO_NONE(0.001),SPF_PASS(-0.001),STATIC_XPRIO_OLE(0.895),URIBL_BLACK(1.7),URIBL_BLOCKED(0.001),URIBL_DBL_BLOCKED_OPENDNS(0.001)
401A069DD58FF5A851: modified header 'X-SPAM-LEVEL' for <[email protected] > (rule: Modify Header)
401A069DD58FF5A851: modified header 'subject' for <[email protected] > (rule: Quarantine/Mark Spam (Level 3))
show less
Email Spam
๐ณ๐ฑ
45.94.31.100
13 Apr 2026
Apr 13 14:22:14 pmg.lasandino.com.ni postfix/postscreen[8241]: CONNECT from [45.94.31.100]:59287 to ...
show more
Apr 13 14:22:14 pmg.lasandino.com.ni postfix/postscreen[8241]: CONNECT from [45.94.31.100]:59287 to [192.168.2.10]:25
Apr 13 14:22:14 pmg.lasandino.com.ni postfix/postscreen[8241]: PREGREET 11 after 0.16 from [45.94.31.100]:59287: EHLO User\r\n
Apr 13 14:22:15 pmg.lasandino.com.ni postfix/postscreen[8241]: DISCONNECT [45.94.31.100]:59287
show less
Email Spam
๐จ๐ณ
114.100.48.120
08 Apr 2026
2026-04-08T02:56:34.204097-06:00 master01-rs postfix/smtps/smtpd[1360584]: warning: unknown[114.100. ...
show more
2026-04-08T02:56:34.204097-06:00 master01-rs postfix/smtps/smtpd[1360584]: warning: unknown[114.100.48.120]: SASL LOGIN authentication failed: (reason unavailable), sasl_username=mistico.b
2026-04-08T03:01:24.255308-06:00 master01-rs postfix/smtps/smtpd[1360645]: warning: unknown[114.100.48.120]: SASL LOGIN authentication failed: (reason unavailable), [email protected]
2026-04-08T03:15:16.161458-06:00 master01-rs postfix/smtps/smtpd[1362782]: warning: unknown[114.100.48.120]: SASL LOGIN authentication failed: (reason unavailable), [email protected]
...
show less
Phishing
Email Spam
Spoofing
Brute-Force
๐จ๐ฆ
91.193.6.157
03 Apr 2026
2026-04-02T23:41:58.127566-06:00 master01-rs postfix/submission/smtpd[4075921]: warning: unknown[91. ...
show more
2026-04-02T23:41:58.127566-06:00 master01-rs postfix/submission/smtpd[4075921]: warning: unknown[91.193.6.157]: SASL PLAIN authentication failed: (reason unavailable), [email protected]
2026-04-02T23:42:04.306986-06:00 master01-rs postfix/submission/smtpd[4075921]: warning: unknown[91.193.6.157]: SASL LOGIN authentication failed: (reason unavailable), [email protected]
2026-04-02T23:42:11.254569-06:00 master01-rs postfix/smtps/smtpd[4075338]: warning: unknown[91.193.6.157]: SASL PLAIN authentication failed: (reason unavailable), [email protected]
...
show less
Phishing
Email Spam
Spoofing
Brute-Force
๐จ๐ณ
122.225.203.106
31 Mar 2026
2026-03-31T13:26:34.195122-06:00 master01-rs postfix/smtps/smtpd[3509674]: warning: unknown[122.225. ...
show more
2026-03-31T13:26:34.195122-06:00 master01-rs postfix/smtps/smtpd[3509674]: warning: unknown[122.225.203.106]: SASL LOGIN authentication failed: (reason unavailable), sasl_username=chereen.j
2026-03-31T13:33:13.403539-06:00 master01-rs postfix/smtps/smtpd[3509887]: warning: unknown[122.225.203.106]: SASL LOGIN authentication failed: (reason unavailable), [email protected]
2026-03-31T13:44:09.477390-06:00 master01-rs postfix/submission/smtpd[3510791]: warning: unknown[122.225.203.106]: SASL LOGIN authentication failed: (reason unavailable), sasl_username=vpsamir
...
show less
Phishing
Email Spam
Spoofing
Brute-Force
๐ท๐ด
141.98.83.48
24 Mar 2026
141.98.83.48 12957 192.168.2.14 53 1:2016016 ET DOS DNS Amplification Attack Inbound ...
show more
141.98.83.48 12957 192.168.2.14 53 1:2016016 ET DOS DNS Amplification Attack Inbound
We are using pfsense with suricata.
show less
DDoS Attack
๐จ๐ณ
183.233.85.194
02 Mar 2026
GeoLocation.country_name China
decoder.parent postfix
full_log Mar 02 16:18:08 pmg.lasandi ...
show more
GeoLocation.country_name China
decoder.parent postfix
full_log Mar 02 16:18:08 pmg.lasandino.com.ni postfix/smtpd[2250]: NOQUEUE: reject: RCPT from unknown[42.51.37.71]: 450 4.7.25 Client host rejected: cannot find your hostname, [42.51.37.71]; from=<[email protected] > to=<[email protected] > proto=ESMTP helo=<0f82a3.cn>
show less
Email Spam
Brute-Force
๐ฆ๐ซ
149.54.15.42
02 Mar 2026
Postfix:
GeoLocation.country_name Afghanistan
_index wazuh-alerts-4.x-2026.03.02
data.srcip ...
show more
Postfix:
GeoLocation.country_name Afghanistan
_index wazuh-alerts-4.x-2026.03.02
data.srcip 149.54.15.42
decoder.name postfix
full_log Mar 02 14:51:22 master01-sol postfix/smtps/smtpd[2188284]: warning: unknown[149.54.15.42]: SASL LOGIN authentication failed: (reason unavailable), [email protected]
show less
Email Spam
Brute-Force
๐ฌ๐ง
185.247.137.164
02 Mar 2026
Dovecot:
full_log
Mar 01 21:41:37 master01-rs dovecot[720]: imap-login: Disconnected: Aborted lo ...
show more
Dovecot:
full_log
Mar 01 21:41:37 master01-rs dovecot[720]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.164, lip=192.168.2.5, TLS, session=<NpC4Vf1LPZO594mk>
Dovecot Aborted Login.
show less
Brute-Force
๐ฎ๐ณ
182.95.186.66
02 Mar 2026
Wazuh:
GeoLocation.country_name India
GeoLocation.location { "lon": 77, "lat": 20 }
_inde ...
show more
Wazuh:
GeoLocation.country_name India
GeoLocation.location { "lon": 77, "lat": 20 }
_index wazuh-alerts-4.x-2026.03.02
agent.id 003
data.srcip 182.95.186.66
decoder.name postfix
decoder.parent postfix
full_log Mar 02 14:51:34 master01-sol postfix/smtps/smtpd[2188284]: warning: unknown[182.95.186.66]: SASL LOGIN authentication failed: (reason unavailable), sasl_username=mmercado
id 1772463092.2286216
input.type log
location journald
manager.name siem
show less
Email Spam
Brute-Force
๐ท๐ด
141.98.83.48
26 Feb 2026
02/26/2026 11:21:02 2 UDP Potentially Bad Traffic 141.98.83.48 20997 192.168.2.14 53 1: ...
show more
02/26/2026 11:21:02 2 UDP Potentially Bad Traffic 141.98.83.48 20997 192.168.2.14 53 1:2016016 ET DOS DNS Amplification Attack Inbound
show less
DDoS Attack
๐ณ๐ฑ
77.83.39.208
05 Feb 2026
2026-02-04T18:38:45.023007-06:00 master01-rs postfix/submission/smtpd[1460202]: warning: unknown[77. ...
show more
2026-02-04T18:38:45.023007-06:00 master01-rs postfix/submission/smtpd[1460202]: warning: unknown[77.83.39.208]: SASL PLAIN authentication failed: (reason unavailable), sasl_username=admin
2026-02-04T18:38:51.482681-06:00 master01-rs postfix/submission/smtpd[1460202]: warning: unknown[77.83.39.208]: SASL LOGIN authentication failed: (reason unavailable), sasl_username=admin
2026-02-04T18:39:02.472774-06:00 master01-rs postfix/submission/smtpd[1460202]: warning: unknown[77.83.39.208]: SASL PLAIN authentication failed: (reason unavailable), sasl_username=root
...
show less
Phishing
Email Spam
Spoofing
Brute-Force
๐ป๐ณ
171.247.175.72
16 Jan 2026
GeoLocation.city_name Ho Chi Minh City
GeoLocation.country_name Vietnam
_index ...
show more
GeoLocation.city_name Ho Chi Minh City
GeoLocation.country_name Vietnam
_index wazuh-alerts-4.x-2026.01.16
data.srcip 171.247.175.72
decoder.name postfix
full_log Jan 16 15:27:22 master01-sol postfix/smtps/smtpd[3996948]: warning: unknown[171.247.175.72]: SASL LOGIN authentication failed: (reason unavailable), [email protected]
show less
Email Spam
Brute-Force
๐ฐ๐ท
119.206.62.88
16 Jan 2026
GeoLocation.country_name South Korea
_index wazuh-alerts-4.x-2026.01.16
data.srcip ...
show more
GeoLocation.country_name South Korea
_index wazuh-alerts-4.x-2026.01.16
data.srcip 119.206.62.88
decoder.name postfix
full_log Jan 16 15:27:40 master01-sol postfix/smtps/smtpd[3996948]: warning: unknown[119.206.62.88]: SASL LOGIN authentication failed: (reason unavailable), sasl_username=admin
rule.groups syslog, postfix, authentication_failed
show less
Phishing
Email Spam
Brute-Force
๐จ๐ณ
112.92.68.85
11 Dec 2025
2025-12-11T12:22:18.863245-06:00 pmg postfix/smtpd[7821]: NOQUEUE: reject: RCPT from unknown[112.92. ...
show more
2025-12-11T12:22:18.863245-06:00 pmg postfix/smtpd[7821]: NOQUEUE: reject: RCPT from unknown[112.92.68.85]: 450 4.7.25 Client host rejected: cannot find your hostname, [112.92.68.85]; from=<[email protected] > to=<[email protected] > proto=SMTP helo=<xcjzjl.com>
show less
Phishing
Email Spam