Re: 83.222.190.50 from Sopot, Bulgaria using braindead hacking software

On Thu, 29 Aug 2024 18:06:54 -0000 (UTC)
Edward McGuire <metaed@metaed.com> wrote:

On 2024-08-29, Randolf Richardson 張文道 <noc@inter-corporate.com> wrote:

I'm seeing a lot of hacking attempts from 83.222.190.50 [...] I recommend
permanently blocking this IP address

 
My mail server autoblocked this address 45 days ago. The log has recycled since

They're probably focusing on one or a small number of target
mail servers at a time.  I wonder if they have concerns about
resource limits or if they're just paranoid about attracting
too much attention.

then so I can't say exactly what rule snagged it. Generally it's something like
"SASL authentication failed".

I'd say it's very likely as you suspect.  That's what we saw.

--
Randolf Richardson 張文道, CNA - noc@inter-corporate.com
Inter-Corporate Computer & Network Services, Inc.
Beautiful British Columbia, Canada
https://www.inter-corporate.com/