How do I stop this from happening

maybl8

I saw this monitoring postfix.
It was just scrolling over and over again.
Is there a way to stop this when it happens?

postfix-mailcow-1  | Mar 19 17:54:00 d23e0a2e962b postfix/postscreen[1413]: HANGUP after 1.2 from [141.98.10.134]:55388 in tests after SMTP handshake
postfix-mailcow-1  | Mar 19 17:54:00 d23e0a2e962b postfix/postscreen[1413]: DISCONNECT [141.98.10.134]:55388
postfix-mailcow-1  | Mar 19 17:54:00 d23e0a2e962b postfix/tlsproxy[2666]: DISCONNECT [141.98.10.134]:55388
postfix-mailcow-1  | Mar 19 17:54:02 d23e0a2e962b postfix/postscreen[1413]: CONNECT from [141.98.10.134]:55571 to [172.22.1.253]:25
postfix-mailcow-1  | Mar 19 17:54:02 d23e0a2e962b whitelist_forwardinghosts: Look up 141.98.10.134 on whitelist, result 200 DUNNO
postfix-mailcow-1  | Mar 19 17:54:02 d23e0a2e962b postfix/dnsblog[1428]: addr 141.98.10.134 listed by domain bl.mailspike.net as 127.0.0.2
postfix-mailcow-1  | Mar 19 17:54:02 d23e0a2e962b postfix/dnsblog[1429]: addr 141.98.10.134 listed by domain zen.spamhaus.org as 127.0.0.3
postfix-mailcow-1  | Mar 19 17:54:02 d23e0a2e962b postfix/dnsblog[1429]: addr 141.98.10.134 listed by domain zen.spamhaus.org as 127.0.0.11
postfix-mailcow-1  | Mar 19 17:54:02 d23e0a2e962b postfix/dnsblog[1429]: addr 141.98.10.134 listed by domain zen.spamhaus.org as 127.0.0.4
postfix-mailcow-1  | Mar 19 17:54:02 d23e0a2e962b postfix/dnsblog[1429]: addr 141.98.10.134 listed by domain zen.spamhaus.org as 127.0.0.2
postfix-mailcow-1  | Mar 19 17:54:02 d23e0a2e962b postfix/dnsblog[1429]: addr 141.98.10.134 listed by domain zen.spamhaus.org as 127.0.0.9
postfix-mailcow-1  | Mar 19 17:54:02 d23e0a2e962b postfix/dnsblog[1423]: addr 141.98.10.134 listed by domain b.barracudacentral.org as 127.0.0.2
postfix-mailcow-1  | Mar 19 17:54:02 d23e0a2e962b postfix/dnsblog[1430]: addr 141.98.10.134 listed by domain bl.spamcop.net as 127.0.0.2
postfix-mailcow-1  | Mar 19 17:54:02 d23e0a2e962b postfix/postscreen[1413]: PREGREET 17 after 0.15 from [141.98.10.134]:55571: EHLO YRUo0eJPAN\r\n
postfix-mailcow-1  | Mar 19 17:54:03 d23e0a2e962b postfix/postscreen[1413]: DNSBL rank 35 for [141.98.10.134]:55571
postfix-mailcow-1  | Mar 19 17:54:03 d23e0a2e962b postfix/tlsproxy[2666]: CONNECT from [141.98.10.134]:55571
postfix-mailcow-1  | Mar 19 17:54:03 d23e0a2e962b postfix/tlsproxy[2666]: Anonymous TLS connection established from [141.98.10.134]:55571: TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)
postfix-mailcow-1  | Mar 19 17:54:03 d23e0a2e962b postfix/tlsproxy[2666]: DISCONNECT [141.98.10.134]:55571
postfix-mailcow-1  | Mar 19 17:54:03 d23e0a2e962b postfix/postscreen[1413]: HANGUP after 0.96 from [141.98.10.134]:55571 in tests after SMTP handshake
postfix-mailcow-1  | Mar 19 17:54:03 d23e0a2e962b postfix/postscreen[1413]: DISCONNECT [141.98.10.134]:55571
postfix-mailcow-1  | Mar 19 17:54:07 d23e0a2e962b postfix/postscreen[1413]: CONNECT from [141.98.10.134]:63774 to [172.22.1.253]:25
postfix-mailcow-1  | Mar 19 17:54:07 d23e0a2e962b whitelist_forwardinghosts: Look up 141.98.10.134 on whitelist, result 200 DUNNO
postfix-mailcow-1  | Mar 19 17:54:07 d23e0a2e962b postfix/dnsblog[1424]: addr 141.98.10.134 listed by domain zen.spamhaus.org as 127.0.0.4
postfix-mailcow-1  | Mar 19 17:54:07 d23e0a2e962b postfix/dnsblog[1424]: addr 141.98.10.134 listed by domain zen.spamhaus.org as 127.0.0.2
postfix-mailcow-1  | Mar 19 17:54:07 d23e0a2e962b postfix/dnsblog[1424]: addr 141.98.10.134 listed by domain zen.spamhaus.org as 127.0.0.9
postfix-mailcow-1  | Mar 19 17:54:07 d23e0a2e962b postfix/dnsblog[1424]: addr 141.98.10.134 listed by domain zen.spamhaus.org as 127.0.0.3
postfix-mailcow-1  | Mar 19 17:54:07 d23e0a2e962b postfix/dnsblog[1424]: addr 141.98.10.134 listed by domain zen.spamhaus.org as 127.0.0.11
postfix-mailcow-1  | Mar 19 17:54:07 d23e0a2e962b postfix/dnsblog[1426]: addr 141.98.10.134 listed by domain bl.mailspike.net as 127.0.0.2
postfix-mailcow-1  | Mar 19 17:54:07 d23e0a2e962b postfix/dnsblog[1424]: addr 141.98.10.134 listed by domain b.barracudacentral.org as 127.0.0.2
postfix-mailcow-1  | Mar 19 17:54:07 d23e0a2e962b postfix/dnsblog[1424]: addr 141.98.10.134 listed by domain bl.spamcop.net as 127.0.0.2
postfix-mailcow-1  | Mar 19 17:54:07 d23e0a2e962b postfix/postscreen[1413]: PREGREET 15 after 0.16 from [141.98.10.134]:63774: EHLO DoV9uXcU\r\n
postfix-mailcow-1  | Mar 19 17:54:07 d23e0a2e962b postfix/postscreen[1413]: DNSBL rank 35 for [141.98.10.134]:63774
postfix-mailcow-1  | Mar 19 17:54:07 d23e0a2e962b postfix/tlsproxy[2666]: CONNECT from [141.98.10.134]:63774
postfix-mailcow-1  | Mar 19 17:54:08 d23e0a2e962b postfix/tlsproxy[2666]: Anonymous TLS connection established from [141.98.10.134]:63774: TLSv1.2 with cipher ECDHE-RSA-AES2

DocFraggle

I don’t understand your question, you don’t want mailcow to block spam?

maybl8

Sorry I don’t want it to stop block spam. They were just attacking over and over again . It wasn’t stopping.
I went and stopped it with a iptables drop command.
Should I have just let it keep going and not stopped it?
Thanks

esackbauer

Don’t try to fix the internet 😉 You will always find such things, its a fight you will never win.
There is no 100% clean logs for a mail server. It is working as intended and identified that IP as spam address. Eventually the spammer will give up. Thats not an “attack”.