Hello,
I am using dovecot_authenticator for Exim and I get a lot of authentication failure log entries, most of them due to brute force attacks. The log entries are like this:
2021-10-11 13:30:21 dovecot_login authenticator failed for ([5.188.206.194]) [5.188.206.194]: 535 Incorrect authentication data
I wonder whether it would be possible to show the user ID the attacker used to authenticate himself.
Here it is the SMTP data for one of these SMTP sessions:
SMTP>> 250-disguised.domain.com Hello [5.188.206.194] [5.188.206.194] SMTP<< AUTH LOGIN SMTP>> 334 VXNlcm5hbWU6 received: CONT 1 UGFzc3dvcmQ6 SMTP>> 334 UGFzc3dvcmQ6 received: FAIL 1 user=webmaster@somedomain.net SMTP>> 535 Incorrect authentication data LOG: MAIN REJECT dovecot_login authenticator failed for ([5.188.206.194]) [5.188.206.194]: 535 Incorrect authentication data SMTP>> 421 disguised.domain.com lost input connection
Warm regards,
Jesús Ángel.