2020-10-04 dovecot_login authenticator failed for \(wwAIXv8\) \[104.129.4.186\]: 535 Incorrect authentication data \(set_id=**REMOVED****REMOVED****REMOVED**_perl\)
2020-10-04 dovecot_login authenticator failed for \(DiHFaHM\) \[104.129.4.186\]: 535 Incorrect authentication data \(set_id=**REMOVED****REMOVED****REMOVED**_perl\)
2020-10-04 dovecot_login authenticator failed for \(vQ7mJL\) \[104.129.4.186\]: 535 Incorrect authentication data \(set_id=**REMOVED****REMOVED****REMOVED**_perl\)

Oct  4 04:18:23 srv1 postfix/smtpd[28948]: warning: unknown[104.129.4.186]: SASL LOGIN authentication failed: authentication failure
Oct  4 04:18:26 srv1 postfix/smtpd[28948]: warning: unknown[104.129.4.186]: SASL LOGIN authentication failed: authentication failure
Oct  4 04:18:40 srv1 postfix/smtpd[28948]: warning: unknown[104.129.4.186]: SASL LOGIN authentication failed: authentication failure
Oct  4 04:18:52 srv1 postfix/smtpd[28948]: warning: unknown[104.129.4.186]: SASL LOGIN authentication failed: authentication failure
Oct  4 04:18:56 srv1 postfix/smtpd[28948]: warning: unknown[104.129.4.186]: SASL LOGIN authentication failed: authentication failure
...

abuse-sasl

spam (f2b h2)

Aug  6 21:34:17 mail postfix/smtpd\[5919\]: warning: unknown\[104.129.4.186\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6\
Aug  6 21:34:23 mail postfix/smtpd\[6084\]: warning: unknown\[104.129.4.186\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6\
Aug  6 21:34:34 mail postfix/smtpd\[5969\]: warning: unknown\[104.129.4.186\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6\
Aug  6 21:34:44 mail postfix/smtpd\[6085\]: warning: unknown\[104.129.4.186\]: SASL LOGIN authentication failed: Connection lost to authentication server\

'IP reached maximum auth failures'

failed_logins

2020-08-14 05:36 SMTP:25 IP autobanned - 6 attempts  a day

failed_logins

Aug  2 05:46:45 mail.srvfarm.net postfix/smtpd[1405752]: warning: unknown[104.129.4.186]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Aug  2 05:46:45 mail.srvfarm.net postfix/smtpd[1405752]: lost connection after AUTH from unknown[104.129.4.186]
Aug  2 05:46:52 mail.srvfarm.net postfix/smtpd[1403822]: warning: unknown[104.129.4.186]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Aug  2 05:46:52 mail.srvfarm.net postfix/smtpd[1403822]: lost connection after AUTH from unknown[104.129.4.186]
Aug  2 05:47:03 mail.srvfarm.net postfix/smtpd[1404337]: warning: unknown[104.129.4.186]: SASL LOGIN authentication failed: UGFzc3dvcmQ6

Jun 27 07:18:02 localhost postfix/smtpd\[17976\]: warning: unknown\[104.129.4.186\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jun 27 07:18:11 localhost postfix/smtpd\[17976\]: warning: unknown\[104.129.4.186\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jun 27 07:18:23 localhost postfix/smtpd\[17976\]: warning: unknown\[104.129.4.186\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jun 27 07:18:39 localhost postfix/smtpd\[17976\]: warning: unknown\[104.129.4.186\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jun 27 07:18:48 localhost postfix/smtpd\[17748\]: warning: unknown\[104.129.4.186\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
...

Jun 26 12:21:44 localhost postfix/smtpd\[23554\]: warning: unknown\[104.129.4.186\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jun 26 12:21:52 localhost postfix/smtpd\[23499\]: warning: unknown\[104.129.4.186\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jun 26 12:22:04 localhost postfix/smtpd\[23554\]: warning: unknown\[104.129.4.186\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jun 26 12:22:19 localhost postfix/smtpd\[22802\]: warning: unknown\[104.129.4.186\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jun 26 12:22:28 localhost postfix/smtpd\[23499\]: warning: unknown\[104.129.4.186\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
...

Time:     Thu Jun 18 04:44:52 2020 -0300
IP:       104.129.4.186 (US/United States/104.129.4.186.static.quadranet.com)
Failures: 30 (smtpauth)
Interval: 3600 seconds
Blocked:  Permanent Block

Jun  7 18:04:15 mail postfix/smtpd[10385]: warning: unknown[104.129.4.186]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jun  7 18:04:15 mail postfix/smtpd[10382]: warning: unknown[104.129.4.186]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jun  7 18:04:22 mail postfix/smtpd[10382]: warning: unknown[104.129.4.186]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jun  7 18:04:22 mail postfix/smtpd[10385]: warning: unknown[104.129.4.186]: SASL LOGIN authentication failed: UGFzc3dvcmQ6

Brute Force attack - banned by Fail2Ban

$f2bV_matches

Jun  3 09:38:42 mailman postfix/smtpd[3699]: warning: unknown[104.129.4.186]: SASL LOGIN authentication failed: authentication failure

(smtpauth) Failed SMTP AUTH login from 104.129.4.186 (US/United States/104.129.4.186.static.quadranet.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 2020-05-24 00:43:25 login authenticator failed for (8HMYZt) [104.129.4.186]: 535 Incorrect authentication data (set_id=a.safar)

Apr 27 06:39:55 zimbra postfix/smtpd[3033]: lost connection after EHLO from unknown[104.129.4.186]
Apr 27 06:39:55 zimbra postfix/smtpd[3033]: lost connection after EHLO from unknown[104.129.4.186]
Apr 27 06:39:56 zimbra postfix/smtpd[3033]: lost connection after EHLO from unknown[104.129.4.186]
Apr 27 06:39:56 zimbra postfix/smtpd[3033]: lost connection after EHLO from unknown[104.129.4.186]
...

Rude login attack (5 tries in 1d)

2020-04-11 11:00:27 H=(Kbo0pV94) [104.129.4.186]:56097 I=[192.147.25.65]:25 F= rejected RCPT : Sender verify failed
2020-04-11 11:00:40 dovecot_login authenticator failed for (nQl8360cVx) [104.129.4.186]:49616 I=[192.147.25.65]:25: 535 Incorrect authentication data (set_id=habu@lerctr.org)
2020-04-11 11:00:56 dovecot_login authenticator failed for (G83zUl) [104.129.4.186]:50957 I=[192.147.25.65]:25: 535 Incorrect authentication data (set_id=habu@lerctr.org)
...

Apr  1 17:55:51 localhost postfix/smtpd\[25830\]: warning: unknown\[104.129.4.186\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Apr  1 17:55:58 localhost postfix/smtpd\[26205\]: warning: unknown\[104.129.4.186\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Apr  1 17:56:09 localhost postfix/smtpd\[25830\]: warning: unknown\[104.129.4.186\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Apr  1 17:56:35 localhost postfix/smtpd\[26205\]: warning: unknown\[104.129.4.186\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Apr  1 17:56:43 localhost postfix/smtpd\[25830\]: warning: unknown\[104.129.4.186\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
...

proto=tcp  .  spt=54162  .  dpt=25  .     Found on   Blocklist de       (300)

Unauthorized connection attempt from IP address 104.129.43.17 on Port 3389(RDP)

Contact form spam. -mob

MultiHost/MultiPort Probe, Scan, Hack -

RDP Scan

(From eric@talkwithcustomer.com) Hello knutsonchiropractic.com,

People ask, “why does TalkWithCustomer work so well?”

It’s simple.

TalkWithCustomer enables you to connect with a prospective customer at EXACTLY the Perfect Time.

- NOT one week, two weeks, three weeks after they’ve checked out your website knutsonchiropractic.com.
- NOT with a form letter style email that looks like it was written by a bot.
- NOT with a robocall that could come at any time out of the blue.

TalkWithCustomer connects you to that person within seconds of THEM asking to hear from YOU.

They kick off the conversation.

They take that first step.

They ask to hear from you regarding what you have to offer and how it can make their life better. 

And it happens almost immediately. In real time. While they’re still looking over your website knutsonchiropractic.com, trying to make up their mind whether you are right for them.

When you connect with them at that very moment it’s the ultimate in Perfect Timing –

(From eric@talkwithcustomer.com) Hey,

You have a website mikulachiropractic.net, right?

Of course you do. I am looking at your website now.

It gets traffic every day – that you’re probably spending $2 / $4 / $10 or more a click to get.  Not including all of the work you put into creating social media, videos, blog posts, emails, and so on.

So you’re investing seriously in getting people to that site.

But how’s it working?  Great? Okay?  Not so much?

If that answer could be better, then it’s likely you’re putting a lot of time, effort, and money into an approach that’s not paying off like it should.

Now… imagine doubling your lead conversion in just minutes… In fact, I’ll go even better.
 
You could actually get up to 100X more conversions!

I’m not making this up.  As Chris Smith, best-selling author of The Conversion Code says: Speed is essential - there is a 100x decrease in Leads when a Lead is contacted within 14 minutes vs being contacted within 5 minutes.

He’s backed up by a

Jun 19 02:56:11 askasleikir sshd[48567]: Failed password for invalid user nathaly from 122.51.119.246 port 39422 ssh2

Unauthorized connection attempt detected from IP address 149.28.18.232 to port 22 [T]

(PL/Poland/-) SMTP Bruteforcing attempts

Jun 19 10:47:55 ajax sshd[24406]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.131.84.222 
Jun 19 10:47:57 ajax sshd[24406]: Failed password for invalid user veeam from 104.131.84.222 port 41059 ssh2

Jun 18 04:30:26 Server1 sshd[7606]: Invalid user pub from 103.83.157.86 port 46372
Jun 18 04:30:26 Server1 sshd[7606]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.83.157.86
Jun 18 04:30:29 Server1 sshd[7606]: Failed password for invalid user pub from 103.83.157.86 port 46372 ssh2
Jun 18 04:30:29 Server1 sshd[7606]: Received disconnect from 103.83.157.86 port 46372:11: Bye Bye [preauth]
Jun 18 04:30:29 Server1 sshd[7606]: Disconnected from invalid user pub 103.83.157.86 port 46372 [preauth]
Jun 18 04:34:43 Server1 sshd[7656]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.83.157.86  user=r.r


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=103.83.157.86

Jun 19 09:40:34 DAAP sshd[6853]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.142.59.3  user=root
Jun 19 09:40:36 DAAP sshd[6853]: Failed password for root from 113.142.59.3 port 37099 ssh2
Jun 19 09:46:08 DAAP sshd[6953]: Invalid user marco from 113.142.59.3 port 34031
Jun 19 09:46:08 DAAP sshd[6953]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.142.59.3
Jun 19 09:46:08 DAAP sshd[6953]: Invalid user marco from 113.142.59.3 port 34031
Jun 19 09:46:10 DAAP sshd[6953]: Failed password for invalid user marco from 113.142.59.3 port 34031 ssh2
...

SSH login attempts.

SSH login attempts.

Jun 19 08:24:31 ns382633 sshd\[15820\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.201.16  user=root
Jun 19 08:24:33 ns382633 sshd\[15820\]: Failed password for root from 106.12.201.16 port 41328 ssh2
Jun 19 08:29:51 ns382633 sshd\[16711\]: Invalid user student from 106.12.201.16 port 34682
Jun 19 08:29:51 ns382633 sshd\[16711\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.201.16
Jun 19 08:29:53 ns382633 sshd\[16711\]: Failed password for invalid user student from 106.12.201.16 port 34682 ssh2

SSH login attempts.

(VN/Vietnam/-) SMTP Bruteforcing attempts

Invalid user admin from 51.210.103.33 port 36240

SSH login attempts.

Jun 19 12:10:29 vpn01 sshd[19050]: Failed password for root from 218.92.0.248 port 16175 ssh2
Jun 19 12:10:42 vpn01 sshd[19050]: error: maximum authentication attempts exceeded for root from 218.92.0.248 port 16175 ssh2 [preauth]
...

SSH login attempts.