Displaying 2 results from an estimated 2 matches for "mrelay3".
2010 Nov 10
1
dovecot dictionary attacks
...asswd was already harvested by 94.242.206.37 why would they bother
to start another dict. attack.
I'm just not sure how they guess the username/password as its not on any
logs that goes back months and I don't have a dovecot record for that user.
/var/log/maillog:Nov 10 02:46:16 mrelay3 postfix/smtpd[27776]: 3B64928015:
client=unknown[94.242.206.37], sasl_method=LOGIN, sasl_username=paramus
/var/log/maillog:Nov 10 02:47:54 mrelay3 postfix/smtpd[27776]: 247AB28016:
client=unknown[94.242.206.37], sasl_method=LOGIN, sasl_username=paramus
/var/log/maillog:Nov 10 02:48:00 mrelay3 pos...
2010 Nov 10
1
dictonary attacks
...ending out all sorts
of spam with the sasl username of Paramus.
This username Paramus never shows up on the dovecot dictionary attack log,
as a matter of fact the user Paramus is nowhere to be found on the dovecot
log at all and I have logs going back months.
/var/log/maillog:Nov 10 02:46:16 mrelay3 postfix/smtpd[27776]: 3B64928015:
client=unknown[94.242.206.37], sasl_method=LOGIN, sasl_username=paramus
/var/log/maillog:Nov 10 02:47:54 mrelay3 postfix/smtpd[27776]: 247AB28016:
client=unknown[94.242.206.37], sasl_method=LOGIN, sasl_username=paramus
/var/log/maillog:Nov 10 02:48:00 mrelay3 pos...