title: Abuse - SASL LOGIN authentication failed: UGFzc3dvcmQ6
body: <p>I have received an email from ISP that seems your IP is using this public IP as Abuse, I do not understand how to investigate this to find the source of the cause so I need bit help</p>
  
  <pre><code>postfix/smtpd[21723]: warning: unknown[X.X.X.X]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 Apr 26 10:51:59 shorelinedelivery
  postfix/smtpd[21723]: disconnect from unknown[X.X.X.X] Apr 26
  13:37:31 shorelinedelivery postfix/smtpd[25499]: connect from unknown[103.215.211.106] Apr 26 13:37:35 shorelinedelivery
  postfix/smtpd[25499]: warning: unknown[X.X.X.X]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 Apr 26 13:37:35 shorelinedelivery
  postfix/smtpd[25499]: disconnect from unknown[X.X.X.X] Apr 26
  15:08:34 shorelinedelivery postfix/smtpd[27596]: connect from unknown[X.X.X.X] Apr 26 15:08:37 shorelinedelivery
  postfix/smtpd[27596]: warning: unknown[X.X.X.X]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 Apr 26 15:08:37 shorelinedelivery
  postfix/smtpd[27596]: disconnect from unknown[X.X.X.X] Apr 26
  </code></pre>
  
  <p>X.X.X.X is our IP.
  I don't see any abusiveness or something wrong here, I don't get the postfix part we don't have any postfix server here and this ip is our users internet IP not any server, people use outlook. 
  I see the same problem with one of my server (word press installed) someone hacked into the server and added scripts to send spam emails. but I don't know how to read this log and investigate or what should I ask from ISP for more info.</p>
  
  <pre><code>Report from fail2ban
  Reported-From: abuse-report@vaniersel.net
  Report-Type: login-attack
  User-Agent: vaniersel.net abuse report
  Report-ID: 20180426000000198092@vaniersel.net
  Date: Thu, 26 Apr 2018 01:55:17 +0200
  Source: X.X.X.X
  Source-Type: ipv4
  Destination: 94.x.x.x
  Destination-Type: ipv4
  Attachment: text/plain
  Schema-URL: http://www.x-arf.org/schema/abuse_login-attack_0.1.2.json
  Category: abuse
  Service: smtp
  Port: 25
  </code></pre>