I’m victim of a botnet conducting a brute force SASL attack op my mail server for more than three weeks now. As I use strong passwords on my mailboxes, all attempts have failed so far and fail2ban is doing a great job … so far. But I don’t trust it.
Any advice on how to stop this uncomfortable situation?
Here are some Netfilter logs showing the attack:
01/11/2024, 02:17:29 PM warn 101.69.242.122 matched rule id 3 (warning: unknown[101.69.242.122]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=marketing)
01/12/2024, 03:37:53 PM warn 102.35.42.242 matched rule id 3 (warning: unknown[102.35.42.242]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas)
01/11/2024, 06:22:48 AM warn 102.38.3.164 matched rule id 3 (warning: unknown[102.38.3.164]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas@dooms.eu)
01/11/2024, 08:20:25 PM warn 103.126.31.21 matched rule id 3 (warning: unknown[103.126.31.21]: SASL PLAIN authentication failed: (reason unavailable), sasl_username=lucas@dooms.eu)
01/12/2024, 11:35:13 AM warn 103.26.51.88 matched rule id 3 (warning: unknown[103.26.51.88]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=director@dooms.eu)
01/11/2024, 11:50:02 AM warn 104.168.34.166 matched rule id 3 (warning: unknown[104.168.34.166]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=luc@dooms.eu)
01/11/2024, 06:14:12 PM warn 104.168.34.168 matched rule id 3 (warning: unknown[104.168.34.168]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas@dooms.eu)
01/12/2024, 11:33:44 AM warn 104.168.34.178 matched rule id 3 (warning: unknown[104.168.34.178]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas@dooms.eu)
01/12/2024, 11:32:33 AM warn 104.168.34.178 matched rule id 3 (warning: unknown[104.168.34.178]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas@dooms.eu)
01/12/2024, 11:31:33 AM warn 104.168.34.178 matched rule id 3 (warning: unknown[104.168.34.178]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas@dooms.eu)
01/12/2024, 08:20:27 AM warn 105.73.197.117 matched rule id 3 (warning: unknown[105.73.197.117]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas@dooms.eu)
01/12/2024, 05:37:34 AM warn 106.117.11.121 matched rule id 3 (warning: unknown[106.117.11.121]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas@dooms.eu)
01/12/2024, 01:25:50 PM warn 107.172.44.144 matched rule id 3 (warning: unknown[107.172.44.144]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas@dooms.eu)
01/12/2024, 01:25:11 PM warn 107.172.44.144 matched rule id 3 (warning: unknown[107.172.44.144]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas@dooms.eu)
01/12/2024, 01:22:45 PM warn 107.172.44.144 matched rule id 3 (warning: unknown[107.172.44.144]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas@dooms.eu)
01/12/2024, 11:17:10 AM warn 107.172.44.144 matched rule id 3 (warning: unknown[107.172.44.144]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas@dooms.eu)
01/12/2024, 09:40:10 AM warn 107.172.44.144 matched rule id 3 (warning: unknown[107.172.44.144]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas@dooms.eu)
01/12/2024, 07:52:46 AM warn 110.17.162.58 matched rule id 3 (warning: unknown[110.17.162.58]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas)
01/12/2024, 05:37:16 AM warn 110.17.162.58 matched rule id 3 (warning: unknown[110.17.162.58]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas)
01/12/2024, 08:48:36 AM warn 110.249.178.166 matched rule id 3 (warning: unknown[110.249.178.166]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas@dooms.eu)
01/11/2024, 10:43:16 PM warn 110.49.145.41 matched rule id 3 (warning: unknown[110.49.145.41]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas@dooms.eu)
01/12/2024, 12:45:08 AM warn 110.7.52.183 matched rule id 3 (warning: unknown[110.7.52.183]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas)
01/11/2024, 12:54:06 PM warn 111.39.46.47 matched rule id 3 (warning: unknown[111.39.46.47]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=marketing@dooms.eu)
01/11/2024, 01:55:59 PM warn 111.50.158.56 matched rule id 3 (warning: unknown[111.50.158.56]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas)
01/12/2024, 03:21:09 AM warn 111.50.168.9 matched rule id 3 (warning: unknown[111.50.168.9]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas@dooms.eu)
01/11/2024, 01:21:10 PM warn 111.70.3.4 matched rule id 3 (warning: 111-70-3-4.emome-ip.hinet.net[111.70.3.4]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=marketing@dooms.eu)
01/12/2024, 08:20:41 AM warn 111.92.109.248 matched rule id 3 (warning: unknown[111.92.109.248]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas)
01/11/2024, 11:42:59 PM warn 112.94.5.43 matched rule id 3 (warning: unknown[112.94.5.43]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas)
01/11/2024, 07:19:24 PM warn 113.160.171.27 matched rule id 3 (warning: unknown[113.160.171.27]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas)
01/11/2024, 02:16:56 PM warn 113.160.171.27 matched rule id 3 (warning: unknown[113.160.171.27]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=marketing@dooms.eu)
01/12/2024, 04:28:53 PM warn 113.160.178.187 matched rule id 3 (warning: unknown[113.160.178.187]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas@dooms.eu)
01/12/2024, 06:18:44 AM warn 113.160.203.137 matched rule id 3 (warning: unknown[113.160.203.137]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas@dooms.eu)
01/12/2024, 01:28:19 AM warn 113.175.240.33 matched rule id 3 (warning: unknown[113.175.240.33]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas)
01/11/2024, 11:11:11 PM warn 114.104.153.51 matched rule id 3 (warning: unknown[114.104.153.51]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas)
01/12/2024, 04:38:44 PM warn 114.104.153.51 matched rule id 3 (warning: unknown[114.104.153.51]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas@dooms.eu)
01/12/2024, 04:46:52 AM warn 114.104.158.172 matched rule id 3 (warning: unknown[114.104.158.172]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas)
01/12/2024, 05:37:04 AM warn 114.104.158.172 matched rule id 3 (warning: unknown[114.104.158.172]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas@dooms.eu)
01/12/2024, 04:26:42 PM warn 114.104.162.36 matched rule id 3 (warning: unknown[114.104.162.36]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas)
01/11/2024, 10:09:31 PM warn 115.23.23.90 matched rule id 3 (warning: unknown[115.23.23.90]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas@dooms.eu)
01/12/2024, 12:04:25 AM warn 115.238.191.246 matched rule id 3 (warning: unknown[115.238.191.246]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas@dooms.eu)
01/11/2024, 12:55:14 PM warn 115.238.94.18 matched rule id 3 (warning: unknown[115.238.94.18]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas)
01/12/2024, 10:41:35 AM warn 116.11.221.87 matched rule id 3 (warning: unknown[116.11.221.87]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=director)
01/11/2024, 09:33:59 PM warn 116.113.124.98 matched rule id 3 (warning: unknown[116.113.124.98]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas)
01/11/2024, 05:27:22 PM warn 116.236.142.18 matched rule id 3 (warning: unknown[116.236.142.18]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas@dooms.eu)
01/11/2024, 10:44:28 PM warn 117.203.175.185 matched rule id 3 (warning: unknown[117.203.175.185]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas)
01/11/2024, 06:52:45 AM warn 117.248.104.92 matched rule id 3 (warning: unknown[117.248.104.92]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas)
01/11/2024, 05:21:03 PM warn 117.32.102.90 matched rule id 3 (warning: unknown[117.32.102.90]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas@dooms.eu)
01/12/2024, 01:33:34 AM warn 117.32.132.170 matched rule id 3 (warning: unknown[117.32.132.170]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas@dooms.eu)
01/12/2024, 10:27:22 AM warn 117.32.98.98 matched rule id 3 (warning: unknown[117.32.98.98]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas)
01/11/2024, 11:39:17 AM warn 117.4.201.6 matched rule id 3 (warning: unknown[117.4.201.6]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=lucas@dooms.eu)