3

I have a webserver and mailserver that I use for fun/learning/breaking. There is only one user who should be logging in; me.

I notice in the postfix logs and HIDS alerts I get a lot of SASL failures from a particular subnet (only last octet is different, eg 45.14.165.0) in a short space of time during an attack.

I am curious if there is a way to find out more about the "threat actor". Is it a botnet, or a company? The whois only shows the Web hosting company assigned to that block.

Improve this question
1
  • That's a little more complicated that it might appear. Some of your options require that you inspect the traffic from these IPs.
    – schroeder ♦
    Commented Dec 20, 2022 at 23:28

1 Answer 1

Reset to default
0

There's no way aside from maybe using nmap on the target IP which can be illegal in your jurisdiction.

Maybe a large company such as Microsoft or Google knows but they certainly don't make such things public.

Improve this answer
1
  • I might look into that when I have some free time. I suppose I shouldn't be worried as the ones I know about are the ones getting blocked.
    – Èl Sea
    Commented Dec 22, 2022 at 23:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .