i just love

Forum for things that doesn't really have anything to do with hMailServer. Such as php.ini, beer, etc etc.
Post Reply
User avatar
johang
Senior user
Senior user
Posts: 319
Joined: 2008-09-01 09:20

i just love

Post by johang » 2020-08-03 08:55

love.jpg
sometimes i just love seing mailfunctioning scripting in work ..

( yes yes Palinka I KNOW i should do firewall ban.. i am just low maintainance lazy .. )
___________________________________________________________end of the line
spam filter appliance gateway: www.mailcleaner.org

User avatar
jimimaseye
Moderator
Moderator
Posts: 8711
Joined: 2011-09-08 17:48

Re: i just love

Post by jimimaseye » 2020-08-03 09:16

There is a post on the forum somewhere of a screenshot where i received 3.5 thousand autobans overnight. It looked scary until you realise that it's just hmailserver doing its job very well.

Why do you say it a malfunctioning script? Do you mean one of your scripts?

[Entered by mobile. Excuse my spelling.]
5.7 on test.
SpamassassinForWindows 3.4.0 spamd service
AV: Clamwin + Clamd service + sanesecurity defs : https://www.hmailserver.com/forum/viewtopic.php?f=21&t=26829

User avatar
johang
Senior user
Senior user
Posts: 319
Joined: 2008-09-01 09:20

Re: i just love

Post by johang » 2020-08-03 11:10

jimimaseye wrote:
2020-08-03 09:16
There is a post on the forum somewhere of a screenshot where i received 3.5 thousand autobans overnight. It looked scary until you realise that it's just hmailserver doing its job very well.

Why do you say it a malfunctioning script? Do you mean one of your scripts?

[Entered by mobile. Excuse my spelling.]
my reason to call it malfunction is that they actually try to authenticate with "number"name@domain.xx , so their script passes (for example) number 400 in their spam address list as included in emailadddress .. hilarious ..

for instance me actually having "371.spikesley@mydomain.com" as user are almost less then 0% propability in my case :D :D :D and they ask me with and without attached domainname from different IPaddresses ... ( if they wanted just to check for open relay, they could have stopped after 1 try, but these guys try to authenticate from multiple locations with same "username" )
___________________________________________________________end of the line
spam filter appliance gateway: www.mailcleaner.org

palinka
Senior user
Senior user
Posts: 2073
Joined: 2017-09-12 17:57

Re: i just love

Post by palinka » 2020-08-04 14:22

johang wrote:
2020-08-03 08:55
( yes yes Palinka I KNOW i should do firewall ban.. i am just low maintainance lazy .. )
Yeah, baby!!!

Just a dictionary attack. These bot nets are massive. So big they can have individual IPs hit you once and never return. 60% of my firewall bans never return for a second attack.

They're in the long game. Once they verify a user, they'll start attacking based on passwords. The whole thing is brute force that might take years but they'll keep trying no matter how futile it appears.

It hardly costs them anything.

User avatar
harmonmonic
New user
New user
Posts: 2
Joined: 2020-09-24 09:41

Re: i just love

Post by harmonmonic » 2020-09-25 18:10

johang wrote:
2020-08-03 11:10
jimimaseye wrote:
2020-08-03 09:16
There is a post on the forum somewhere of a screenshot where i received 3.5 thousand autobans overnight. It looked scary until you realise that it's just hmailserver doing its job very well.

Why do you say it a malfunctioning script? Do you mean one of your scripts?

[Entered by mobile. Excuse my spelling.]
my reason to call it malfunction is that they actually try to authenticate with "number"name@domain.xx , so their script passes (for example) number 400 in their spam address list as included in emailadddress .. hilarious ..

for instance me actually having "371.spikesley@mydomain.comHow to Contact Comcast Customer" Service as user are almost less then 0% propability in my case :D :D :D and they ask me with and without attached domainname from different IPaddresses ... ( if they wanted just to check for open relay, they could have stopped after 1 try, but these guys try to authenticate from multiple locations with same "username" )
probably the tricks of Russian hackers :lol:
Make Love No War

User avatar
SorenR
Senior user
Senior user
Posts: 3740
Joined: 2006-08-21 15:38
Location: Denmark

Re: i just love

Post by SorenR » 2020-09-25 20:12

The user "linda-k@...." was deleted from my server 5 years ago.

I modified the OnClientLogon(oClient) trigger to include password; Sub OnClientLogon(oClient, sPassword)
Password changes all the time. Many of them I see listed in Bitcoin extorsion mails addressed to other users on my server.
Also 80% of these passwords I can find on https://haveibeenpwned.com/Passwords.

I wonder how many infected computers are doing this as I ban the IP Address for 3 months.

BTW... I capture all these by scripting BEFORE autoban kicks in ;-)

Code: Select all

492 		"2020-09-19 07:07:55.861"	"AUTH FAIL      	212.98.122.91   	linda-k@mydomain.tld"
4076		"2020-09-19 07:41:28.527"	"AUTH FAIL      	220.124.240.66  	linda-k@mydomain.tld"
1100		"2020-09-19 07:55:20.275"	"AUTH FAIL      	125.34.240.33   	linda-k@mydomain.tld"
1004		"2020-09-19 10:12:40.523"	"AUTH FAIL      	182.71.16.42    	linda-k@mydomain.tld"
1956		"2020-09-19 10:13:03.320"	"AUTH FAIL      	113.161.83.28   	linda-k@mydomain.tld"
2360		"2020-09-19 10:50:24.449"	"AUTH FAIL      	72.223.168.82   	linda-k@mydomain.tld"
712 		"2020-09-19 10:55:52.753"	"AUTH FAIL      	85.159.35.138   	linda-k@mydomain.tld"
2008		"2020-09-19 11:05:06.039"	"AUTH FAIL      	98.162.25.15    	linda-k@mydomain.tld"
2756		"2020-09-19 11:07:40.320"	"AUTH FAIL      	184.176.166.23  	linda-k@mydomain.tld"
492 		"2020-09-19 11:27:03.093"	"AUTH FAIL      	72.221.196.135  	linda-k@mydomain.tld"
2756		"2020-09-19 11:42:19.132"	"AUTH FAIL      	14.192.248.5    	linda-k@mydomain.tld"
1004		"2020-09-19 13:37:01.476"	"AUTH FAIL      	73.36.232.192   	linda-k@mydomain.tld"
4076		"2020-09-19 13:49:32.875"	"AUTH FAIL      	89.216.102.123  	linda-k@mydomain.tld"
712 		"2020-09-19 13:58:18.992"	"AUTH FAIL      	184.179.216.156 	linda-k@mydomain.tld"
1100		"2020-09-19 14:02:00.972"	"AUTH FAIL      	41.90.15.59     	linda-k@mydomain.tld"
492 		"2020-09-19 14:46:08.628"	"AUTH FAIL      	60.246.3.124    	linda-k@mydomain.tld"
1004		"2020-09-19 14:46:29.988"	"AUTH FAIL      	60.246.2.254    	linda-k@mydomain.tld"
492 		"2020-09-19 14:51:46.890"	"AUTH FAIL      	176.37.248.76   	linda-k@mydomain.tld"
2848		"2020-09-19 17:06:09.878"	"AUTH FAIL      	59.125.248.139  	linda-k@mydomain.tld"
2360		"2020-09-19 17:06:28.753"	"AUTH FAIL      	202.137.141.109 	linda-k@mydomain.tld"
1100		"2020-09-19 17:11:48.609"	"AUTH FAIL      	184.178.172.20  	linda-k@mydomain.tld"
2756		"2020-09-19 17:13:15.218"	"AUTH FAIL      	178.46.163.201  	linda-k@mydomain.tld"
2756		"2020-09-19 17:22:03.195"	"AUTH FAIL      	62.48.247.238   	linda-k@mydomain.tld"
712 		"2020-09-19 17:31:07.640"	"AUTH FAIL      	202.137.134.220 	linda-k@mydomain.tld"
3528		"2020-09-19 19:40:19.945"	"AUTH FAIL      	180.183.247.206 	linda-k@mydomain.tld"
1956		"2020-09-19 19:42:21.976"	"AUTH FAIL      	174.76.35.25    	linda-k@mydomain.tld"
2952		"2020-09-19 20:12:55.343"	"AUTH FAIL      	183.247.151.247 	linda-k@mydomain.tld"
2008		"2020-09-19 20:22:47.101"	"AUTH FAIL      	212.98.122.91   	linda-k@mydomain.tld"
712 		"2020-09-19 20:47:39.156"	"AUTH FAIL      	72.210.252.135  	linda-k@mydomain.tld"
3264		"2020-09-19 20:51:57.070"	"AUTH FAIL      	174.76.35.9     	linda-k@mydomain.tld"
492 		"2020-09-19 20:55:54.445"	"AUTH FAIL      	184.176.166.7   	linda-k@mydomain.tld"
2008		"2020-09-19 21:26:55.648"	"AUTH FAIL      	182.72.180.14   	linda-k@mydomain.tld"
2404		"2020-09-19 21:31:54.867"	"AUTH FAIL      	212.98.122.91   	linda-k@mydomain.tld"
492 		"2020-09-19 21:35:33.101"	"AUTH FAIL      	202.137.155.204 	linda-k@mydomain.tld"
3264		"2020-09-19 21:41:11.062"	"AUTH FAIL      	189.59.5.81     	linda-k@mydomain.tld"
2952		"2020-09-19 23:36:41.312"	"AUTH FAIL      	211.20.181.113  	linda-k@mydomain.tld"
492 		"2020-09-19 23:37:19.156"	"AUTH FAIL      	125.34.240.33   	linda-k@mydomain.tld"
3632		"2020-09-19 23:42:05.562"	"AUTH FAIL      	117.7.239.10    	linda-k@mydomain.tld"
3388		"2020-09-20 00:06:50.006"	"AUTH FAIL      	176.37.248.76   	linda-k@mydomain.tld"
2572		"2020-09-20 00:13:21.922"	"AUTH FAIL      	115.73.213.31   	linda-k@mydomain.tld"
3704		"2020-09-20 00:13:46.594"	"AUTH FAIL      	59.125.248.139  	linda-k@mydomain.tld"
3704		"2020-09-20 00:29:03.739"	"AUTH FAIL      	202.137.155.212 	linda-k@mydomain.tld"
4060		"2020-09-20 00:42:13.662"	"AUTH FAIL      	189.59.5.49     	linda-k@mydomain.tld"
2800		"2020-09-20 00:51:31.856"	"AUTH FAIL      	200.175.104.103 	linda-k@mydomain.tld"
2848		"2020-09-20 00:51:57.685"	"AUTH FAIL      	189.114.67.195  	linda-k@mydomain.tld"
2800		"2020-09-20 00:52:23.059"	"AUTH FAIL      	177.19.164.149  	linda-k@mydomain.tld"
1348		"2020-09-20 00:56:28.743"	"AUTH FAIL      	184.176.166.7   	linda-k@mydomain.tld"
2572		"2020-09-20 00:56:50.978"	"AUTH FAIL      	82.208.65.46    	linda-k@mydomain.tld"
2848		"2020-09-20 01:15:26.286"	"AUTH FAIL      	14.161.16.79    	linda-k@mydomain.tld"
3824		"2020-09-20 01:16:18.535"	"AUTH FAIL      	37.26.136.169   	linda-k@mydomain.tld"
3352		"2020-09-20 01:16:35.049"	"AUTH FAIL      	89.216.102.123  	linda-k@mydomain.tld"
1348		"2020-09-20 01:16:51.299"	"AUTH FAIL      	212.98.122.91   	linda-k@mydomain.tld"
2992		"2020-09-20 01:33:54.708"	"AUTH FAIL      	184.176.166.23  	linda-k@mydomain.tld"
3436		"2020-09-20 01:35:07.440"	"AUTH FAIL      	72.221.196.137  	linda-k@mydomain.tld"
2244		"2020-09-20 01:35:41.189"	"AUTH FAIL      	200.146.227.146 	linda-k@mydomain.tld"
2992		"2020-09-20 01:40:25.340"	"AUTH FAIL      	103.28.38.166   	linda-k@mydomain.tld"
2716		"2020-09-20 09:59:43.437"	"AUTH FAIL      	202.72.243.198  	linda-k@mydomain.tld"
3572		"2020-09-20 10:15:06.558"	"AUTH FAIL      	189.59.5.81     	linda-k@mydomain.tld"
560 		"2020-09-20 11:23:35.855"	"AUTH FAIL      	197.243.48.18   	linda-k@mydomain.tld"
508 		"2020-09-20 11:26:40.664"	"AUTH FAIL      	113.190.255.198 	linda-k@mydomain.tld"
2884		"2020-09-20 11:34:01.000"	"AUTH FAIL      	98.162.25.15    	linda-k@mydomain.tld"
2540		"2020-09-21 03:19:03.839"	"AUTH FAIL      	186.215.197.15  	linda-k@mydomain.tld"
2652		"2020-09-21 03:20:46.620"	"AUTH FAIL      	78.140.7.9      	linda-k@mydomain.tld"
2652		"2020-09-21 05:14:33.984"	"AUTH FAIL      	187.58.132.251  	linda-k@mydomain.tld"
3564		"2020-09-21 05:15:17.796"	"AUTH FAIL      	184.179.216.145 	linda-k@mydomain.tld"
3240		"2020-09-21 05:15:35.341"	"AUTH FAIL      	72.223.168.76   	linda-k@mydomain.tld"
316 		"2020-09-21 05:22:54.958"	"AUTH FAIL      	203.155.253.189 	linda-k@mydomain.tld"
3240		"2020-09-21 05:24:29.191"	"AUTH FAIL      	177.135.101.5   	linda-k@mydomain.tld"
1396		"2020-09-21 21:49:36.765"	"AUTH FAIL      	184.176.166.17  	linda-k@mydomain.tld"
3784		"2020-09-21 21:58:12.554"	"AUTH FAIL      	72.221.232.144  	linda-k@mydomain.tld"
2044		"2020-09-21 22:00:22.117"	"AUTH FAIL      	72.221.232.136  	linda-k@mydomain.tld"
3196		"2020-09-22 00:06:52.423"	"AUTH FAIL      	124.41.248.30   	linda-k@mydomain.tld"
2716		"2020-09-22 00:07:35.062"	"AUTH FAIL      	174.76.35.9     	linda-k@mydomain.tld"
3776		"2020-09-22 00:22:38.255"	"AUTH FAIL      	72.210.252.135  	linda-k@mydomain.tld"
3804		"2020-09-22 00:22:57.583"	"AUTH FAIL      	189.59.69.3     	linda-k@mydomain.tld"
1436		"2020-09-22 00:27:36.313"	"AUTH FAIL      	184.179.216.139 	linda-k@mydomain.tld"
3196		"2020-09-22 00:28:08.984"	"AUTH FAIL      	113.161.62.166  	linda-k@mydomain.tld"
3208		"2020-09-22 01:46:37.297"	"AUTH FAIL      	201.140.110.78  	linda-k@mydomain.tld"
2496		"2020-09-22 01:47:01.187"	"AUTH FAIL      	187.58.132.251  	linda-k@mydomain.tld"
2768		"2020-09-22 01:53:11.648"	"AUTH FAIL      	184.178.172.7   	linda-k@mydomain.tld"
2192		"2020-09-22 02:01:37.140"	"AUTH FAIL      	183.247.151.247 	linda-k@mydomain.tld"
3436		"2020-09-22 02:48:54.253"	"AUTH FAIL      	89.21.77.158    	linda-k@mydomain.tld"
3528		"2020-09-22 02:55:02.796"	"AUTH FAIL      	186.215.143.149 	linda-k@mydomain.tld"
3676		"2020-09-22 03:10:12.265"	"AUTH FAIL      	78.140.7.9      	linda-k@mydomain.tld"
332 		"2020-09-22 03:15:15.087"	"AUTH FAIL      	72.210.252.142  	linda-k@mydomain.tld"
3724		"2020-09-22 04:37:13.058"	"AUTH FAIL      	202.137.155.149 	linda-k@mydomain.tld"
740 		"2020-09-22 04:37:49.462"	"AUTH FAIL      	72.223.168.76   	linda-k@mydomain.tld"
2992		"2020-09-22 04:38:35.431"	"AUTH FAIL      	85.238.103.176  	linda-k@mydomain.tld"
2992		"2020-09-22 04:40:14.570"	"AUTH FAIL      	115.84.92.6     	linda-k@mydomain.tld"
3528		"2020-09-22 04:52:10.603"	"AUTH FAIL      	113.190.39.146  	linda-k@mydomain.tld"
276 		"2020-09-22 04:52:28.164"	"AUTH FAIL      	46.173.117.50   	linda-k@mydomain.tld"
944 		"2020-09-22 04:52:49.476"	"AUTH FAIL      	72.210.252.135  	linda-k@mydomain.tld"
2992		"2020-09-22 04:53:18.726"	"AUTH FAIL      	200.175.104.103 	linda-k@mydomain.tld"
332 		"2020-09-22 04:53:44.007"	"AUTH FAIL      	60.246.0.164    	linda-k@mydomain.tld"
2976		"2020-09-22 17:32:50.132"	"AUTH FAIL      	114.199.112.138 	linda-k@mydomain.tld"
3280		"2020-09-22 17:33:09.304"	"AUTH FAIL      	203.113.102.178 	linda-k@mydomain.tld"
2428		"2020-09-22 17:33:31.695"	"AUTH FAIL      	118.163.135.18  	linda-k@mydomain.tld"
328 		"2020-09-22 19:28:37.101"	"AUTH FAIL      	85.159.35.138   	linda-k@mydomain.tld"
328 		"2020-09-22 19:28:54.976"	"AUTH FAIL      	72.223.168.82   	linda-k@mydomain.tld"
3280		"2020-09-22 19:37:20.750"	"AUTH FAIL      	189.59.5.81     	linda-k@mydomain.tld"
1484		"2020-09-22 20:41:47.250"	"AUTH FAIL      	72.221.196.150  	linda-k@mydomain.tld"
136 		"2020-09-22 20:42:04.359"	"AUTH FAIL      	197.243.48.18   	linda-k@mydomain.tld"
3904		"2020-09-22 20:42:48.812"	"AUTH FAIL      	90.150.87.199   	linda-k@mydomain.tld"
3140		"2020-09-22 20:43:24.828"	"AUTH FAIL      	72.221.232.136  	linda-k@mydomain.tld"
3052		"2020-09-22 21:26:22.843"	"AUTH FAIL      	177.19.164.149  	linda-k@mydomain.tld"
3104		"2020-09-22 21:26:45.515"	"AUTH FAIL      	186.215.197.15  	linda-k@mydomain.tld"
2676		"2020-09-22 21:27:02.953"	"AUTH FAIL      	212.98.122.91   	linda-k@mydomain.tld"
2636		"2020-09-22 22:46:17.273"	"AUTH FAIL      	201.140.110.78  	linda-k@mydomain.tld"
2628		"2020-09-22 22:46:35.085"	"AUTH FAIL      	121.128.135.74  	linda-k@mydomain.tld"
2600		"2020-09-22 22:46:51.742"	"AUTH FAIL      	72.221.232.136  	linda-k@mydomain.tld"
2640		"2020-09-22 22:47:08.632"	"AUTH FAIL      	64.119.197.105  	linda-k@mydomain.tld"
2640		"2020-09-22 22:47:26.523"	"AUTH FAIL      	184.179.216.141 	linda-k@mydomain.tld"
2876		"2020-09-23 00:36:29.701"	"AUTH FAIL      	184.178.172.16  	linda-k@mydomain.tld"
2708		"2020-09-23 00:37:00.186"	"AUTH FAIL      	72.210.252.148  	linda-k@mydomain.tld"
2036		"2020-09-23 00:37:21.512"	"AUTH FAIL      	85.26.209.188   	linda-k@mydomain.tld"
2996		"2020-09-23 00:49:43.613"	"AUTH FAIL      	203.113.102.178 	linda-k@mydomain.tld"
2036		"2020-09-23 00:50:20.832"	"AUTH FAIL      	174.76.35.28    	linda-k@mydomain.tld"
3400		"2020-09-23 00:50:43.456"	"AUTH FAIL      	189.59.69.3     	linda-k@mydomain.tld"
2200		"2020-09-23 00:51:01.502"	"AUTH FAIL      	103.28.38.166   	linda-k@mydomain.tld"
1512		"2020-09-23 02:36:05.140"	"AUTH FAIL      	60.246.0.72     	linda-k@mydomain.tld"
3636		"2020-09-23 02:36:23.031"	"AUTH FAIL      	125.34.240.33   	linda-k@mydomain.tld"
2996		"2020-09-23 02:42:05.088"	"AUTH FAIL      	186.215.197.15  	linda-k@mydomain.tld"
1140		"2020-09-23 03:04:48.992"	"AUTH FAIL      	118.163.135.18  	linda-k@mydomain.tld"
1140		"2020-09-23 07:54:01.253"	"AUTH FAIL      	184.179.216.151 	linda-k@mydomain.tld"
3400		"2020-09-23 08:05:55.425"	"AUTH FAIL      	92.124.137.220  	linda-k@mydomain.tld"
2912		"2020-09-24 17:41:15.125"	"AUTH FAIL      	72.221.232.147  	linda-k@mydomain.tld"
2912		"2020-09-24 17:46:10.687"	"AUTH FAIL      	118.163.97.19   	linda-k@mydomain.tld"
3692		"2020-09-24 17:46:27.234"	"AUTH FAIL      	60.248.249.190  	linda-k@mydomain.tld"
3692		"2020-09-24 17:46:45.109"	"AUTH FAIL      	184.176.166.26  	linda-k@mydomain.tld"
2912		"2020-09-24 17:52:18.093"	"AUTH FAIL      	202.72.243.198  	linda-k@mydomain.tld"
1628		"2020-09-24 17:52:38.093"	"AUTH FAIL      	184.178.172.7   	linda-k@mydomain.tld"
3772		"2020-09-24 22:49:19.031"	"AUTH FAIL      	200.146.227.146 	linda-k@mydomain.tld"
2912		"2020-09-24 22:49:55.343"	"AUTH FAIL      	72.223.168.82   	linda-k@mydomain.tld"
1628		"2020-09-24 23:59:56.859"	"AUTH FAIL      	189.59.5.49     	linda-k@mydomain.tld"
2444		"2020-09-25 00:04:38.234"	"AUTH FAIL      	87.248.183.165  	linda-k@mydomain.tld"
3136		"2020-09-25 00:17:54.275"	"AUTH FAIL      	202.137.141.109 	linda-k@mydomain.tld"
1000		"2020-09-25 00:23:49.428"	"AUTH FAIL      	211.20.181.113  	linda-k@mydomain.tld"
3500		"2020-09-25 02:34:42.858"	"AUTH FAIL      	212.98.122.91   	linda-k@mydomain.tld"
2768		"2020-09-25 04:04:51.246"	"AUTH FAIL      	72.221.232.142  	linda-k@mydomain.tld"
3840		"2020-09-25 05:47:24.384"	"AUTH FAIL      	85.238.103.176  	linda-k@mydomain.tld"
3944		"2020-09-25 05:48:49.445"	"AUTH FAIL      	118.163.135.17  	linda-k@mydomain.tld"
3420		"2020-09-25 06:18:52.230"	"AUTH FAIL      	62.99.78.120    	linda-k@mydomain.tld"
2768		"2020-09-25 07:09:32.369"	"AUTH FAIL      	184.176.166.7   	linda-k@mydomain.tld"
2444		"2020-09-25 09:06:15.402"	"AUTH FAIL      	202.137.155.149 	linda-k@mydomain.tld"
3944		"2020-09-25 11:15:01.078"	"AUTH FAIL      	181.112.40.114  	linda-k@mydomain.tld"
3336		"2020-09-25 11:26:53.363"	"AUTH FAIL      	184.176.166.16  	linda-k@mydomain.tld"
1000		"2020-09-25 11:29:53.082"	"AUTH FAIL      	14.232.208.111  	linda-k@mydomain.tld"
3500		"2020-09-25 11:33:06.218"	"AUTH FAIL      	60.246.2.248    	linda-k@mydomain.tld"
3796		"2020-09-25 11:33:33.187"	"AUTH FAIL      	177.19.187.79   	linda-k@mydomain.tld"
3840		"2020-09-25 11:33:55.078"	"AUTH FAIL      	98.162.25.10    	linda-k@mydomain.tld"
3136		"2020-09-25 12:30:57.449"	"AUTH FAIL      	177.135.101.5   	linda-k@mydomain.tld"
2444		"2020-09-25 12:31:50.230"	"AUTH FAIL      	72.223.168.76   	linda-k@mydomain.tld"
332 		"2020-09-25 12:43:45.488"	"AUTH FAIL      	98.162.25.15    	linda-k@mydomain.tld"
3944		"2020-09-25 12:53:44.058"	"AUTH FAIL      	186.215.130.242 	linda-k@mydomain.tld"
2768		"2020-09-25 12:54:29.433"	"AUTH FAIL      	72.221.196.137  	linda-k@mydomain.tld"
3136		"2020-09-25 13:49:58.984"	"AUTH FAIL      	177.135.101.101 	linda-k@mydomain.tld"
3372		"2020-09-25 14:34:42.308"	"AUTH FAIL      	113.161.83.28   	linda-k@mydomain.tld"
3944		"2020-09-25 14:38:46.304"	"AUTH FAIL      	103.12.160.83   	linda-k@mydomain.tld"
3372		"2020-09-25 14:44:31.800"	"AUTH FAIL      	182.190.4.53    	linda-k@mydomain.tld"
3336		"2020-09-25 15:50:01.792"	"AUTH FAIL      	186.215.195.249 	linda-k@mydomain.tld"
3500		"2020-09-25 15:53:49.773"	"AUTH FAIL      	184.179.216.149 	linda-k@mydomain.tld"
3424		"2020-09-25 15:57:22.957"	"AUTH FAIL      	190.202.44.194  	linda-k@mydomain.tld"
3228		"2020-09-25 16:21:48.109"	"AUTH FAIL      	184.176.166.10  	linda-k@mydomain.tld"
SørenR.

“Those who don't know history are doomed to repeat it.”
― Edmund Burke

User avatar
mattg
Moderator
Moderator
Posts: 21025
Joined: 2007-06-14 05:12
Location: 'The Outback' Australia

Re: i just love

Post by mattg » 2020-09-27 02:51

SorenR wrote:
2020-09-25 20:12
I modified the OnClientLogon(oClient) trigger to include password; Sub OnClientLogon(oClient, sPassword)
This would be interesting to have in our main builds, just so that we can see the password being used in failed attempts.
I wouldn't like to record passwords used in successful connections
Just 'cause I link to a page and say little else doesn't mean I am not being nice.
https://www.hmailserver.com/documentation

palinka
Senior user
Senior user
Posts: 2073
Joined: 2017-09-12 17:57

Re: i just love

Post by palinka » 2020-09-27 15:05

mattg wrote:
2020-09-27 02:51
SorenR wrote:
2020-09-25 20:12
I modified the OnClientLogon(oClient) trigger to include password; Sub OnClientLogon(oClient, sPassword)
This would be interesting to have in our main builds, just so that we can see the password being used in failed attempts.
I wouldn't like to record passwords used in successful connections
Yes, please. On 5.7 variant.

User avatar
SorenR
Senior user
Senior user
Posts: 3740
Joined: 2006-08-21 15:38
Location: Denmark

Re: i just love

Post by SorenR » 2020-09-27 16:48

mattg wrote:
2020-09-27 02:51
SorenR wrote:
2020-09-25 20:12
I modified the OnClientLogon(oClient) trigger to include password; Sub OnClientLogon(oClient, sPassword)
This would be interesting to have in our main builds, just so that we can see the password being used in failed attempts.
I wouldn't like to record passwords used in successful connections
https://github.com/SorenRR/hMailServer/ ... 00d15ae6f1

Look at IMAPCommandLogin.cpp, POP3Connection.cpp and SMTPConnection.cpp.
SørenR.

“Those who don't know history are doomed to repeat it.”
― Edmund Burke

Post Reply